From 23ff11cdddaf2b761d34a1e628482aa7a39bbad3 Mon Sep 17 00:00:00 2001 From: Coretan Kehidupan Date: Fri, 10 Jul 2026 00:49:25 +0700 Subject: [PATCH] doc: specify FIPS module version usage in fips140 docs --- doc/godebug.md | 2 ++ src/cmd/go/alldocs.go | 2 ++ src/cmd/go/internal/help/helpdoc.go | 2 ++ 3 files changed, 6 insertions(+) diff --git a/doc/godebug.md b/doc/godebug.md index 5fecfb5ccba3eb..cd8ad084e992fe 100644 --- a/doc/godebug.md +++ b/doc/godebug.md @@ -277,6 +277,8 @@ The possible values are: - "on": the Go Cryptographic Module operates in FIPS 140-3 mode. - "only": like "on", but cryptographic algorithms not approved by FIPS 140-3 return an error or panic. +For `on` and `only`, the module version is controlled by the +`GOFIPS140` environment variable. By default it is `GOFIPS140=latest`. For more information, see [FIPS 140-3 Compliance](/doc/security/fips140). This setting is fixed at program startup time, and can't be modified by changing the `GODEBUG` environment variable after the program starts. diff --git a/src/cmd/go/alldocs.go b/src/cmd/go/alldocs.go index 44cec1ae79e710..fccd270a115138 100644 --- a/src/cmd/go/alldocs.go +++ b/src/cmd/go/alldocs.go @@ -2609,6 +2609,8 @@ // The default is GOFIPS140=off, which makes no FIPS-140 changes at all. // Other values enable FIPS-140 compliance measures and select alternate // versions of the cryptography source code. +// Valid values are off, latest, inprocess, certified, and versions +// of the form v1.N.N. // See https://go.dev/doc/security/fips140 for details. // GO_EXTLINK_ENABLED // Whether the linker should use external linking mode diff --git a/src/cmd/go/internal/help/helpdoc.go b/src/cmd/go/internal/help/helpdoc.go index b305457a23d104..08defcad07be9e 100644 --- a/src/cmd/go/internal/help/helpdoc.go +++ b/src/cmd/go/internal/help/helpdoc.go @@ -744,6 +744,8 @@ Special-purpose environment variables: The default is GOFIPS140=off, which makes no FIPS-140 changes at all. Other values enable FIPS-140 compliance measures and select alternate versions of the cryptography source code. + Valid values are off, latest, inprocess, certified, and versions + of the form v1.N.N. See https://go.dev/doc/security/fips140 for details. GO_EXTLINK_ENABLED Whether the linker should use external linking mode