Skip to content

Conversation

@ycombinator
Copy link
Contributor

@ycombinator ycombinator commented Oct 22, 2025

Description

When #13926 is merged, all unit tests in this repository will be run with GODEBUG=fips140=only to help surface any FIPS-140 violations in all the Go modules in this repository.

The cmd/builder module is not used when running the OpenTelemetry Collector. It is a tool used to build OpenTelemetry Collector distributions. As such, strictly speaking, we do not need to worry about FIPS-140 violations in this module.

However, since unit tests for all modules will be run with GODEBUG=fips140=only, it is convenient to address any FIPS-140 violations in this module as well.

The module is responsible for building OpenTelemetry Collector distributions from a configuration file. The configuration file lists Go modules which are then downloaded in order to compile the distribution. During the download, if GODEBUG=fips140=only is set, the following error will be thrown:

crypto/ecdh: use of X25519 is not allowed in FIPS 140-only mode

To suppress this error, we append tlsmklem=0 to the GODEBUG environment variable. This is OK to do because a) we are only doing this from unit test code, not the module's code itself and b) as mentioned above, this particular module is not involved in the running of the OpenTelemetry Collector itself, i.e. we are not suppressing a legitimate FIPS violation in OpenTelemetry Collector code.

Link to tracking issue

Fixes #13997

Testing

Run the existing unit tests in the cmd/builder module with Go >= 1.24.6 and GODEBUG=fips140=only.

cd cmd/builder
GODEBUG=fips140=only go test -v ./... -count 1

@codecov
Copy link

codecov bot commented Oct 22, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.64%. Comparing base (71418b6) to head (e659400).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #14068      +/-   ##
==========================================
+ Coverage   91.61%   91.64%   +0.02%     
==========================================
  Files         655      656       +1     
  Lines       42793    42801       +8     
==========================================
+ Hits        39205    39225      +20     
+ Misses       2765     2757       -8     
+ Partials      823      819       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ycombinator ycombinator marked this pull request as ready for review October 22, 2025 22:48
@ycombinator ycombinator requested a review from a team as a code owner October 22, 2025 22:48
@ycombinator ycombinator changed the title [fips][cmd/builder] Unit tests: Add GODEBUG=tlsmklem=0 if GODEBUG=fips140=only is set [fips][cmd/builder] Unit tests: Add GODEBUG=tlsmklem=0 if GODEBUG=fips140=only is set Oct 24, 2025
@ycombinator ycombinator changed the title [fips][cmd/builder] Unit tests: Add GODEBUG=tlsmklem=0 if GODEBUG=fips140=only is set [fips140][cmd/builder] Unit tests: Add GODEBUG=tlsmklem=0 if GODEBUG=fips140=only is set Oct 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[fips140] cmd/builder unit tests fail with GODEBUG=fips140=only

1 participant