Support FIPS 140-3 validated crypto via fips-golang-1.26-linux package

[ivo1116]

Summary

Go 1.24+ ships with a native FIPS 140-3 validated cryptographic module (CMVP Certificate #5247). A PR has been opened to add an opt-in FIPS variant package (fips-golang-1.26-linux) to bosh-package-golang-release:

• PR: Add FIPS 140-3 variant package for Go 1.26 (linux) bosh-package-golang-release#39

Once that merges, diego-release can vendor the FIPS package to produce binaries compiled with the CMVP-certified crypto module, enabling deployment in regulated environments (FedRAMP, US government, etc.).

What would change in diego-release

The change is mechanical — no code modifications to any Diego component:

1. Vendor the FIPS golang package:

   bosh vendor-package fips-golang-1.26-linux ~/workspace/bosh-package-golang-release

2. Update package specs (all Go packages — rep, bbs, auctioneer, route_emitter, etc.):

    dependencies:
   -  - golang-1.26-linux
   +  - fips-golang-1.26-linux

3. Update packaging scripts (glob pattern):

   -source /var/vcap/packages/golang-*-linux/bosh/compile.env
   +source /var/vcap/packages/fips-golang-*-linux/bosh/compile.env

That's it. All Diego binaries (rep, bbs, auctioneer, route_emitter, locket, ssh_proxy, cfdot, file_server, etc.) would then be compiled with FIPS 140-3 mode enabled.

What FIPS mode provides at runtime

• Integrity self-check at process initialization
• Known-answer self-tests (KATs) for all crypto algorithms
• crypto/rand backed by NIST SP 800-90A DRBG
• crypto/tls restricted to FIPS-approved cipher suites and TLS 1.2+
• Pairwise consistency tests on generated keys
• No performance-impacting changes for steady-state operation (~1-2ms extra per TLS handshake)

Testing done

Successfully deployed FIPS-enabled Diego on a test landscape (ubuntu-noble stemcell, AWS):

• All processes (rep, route_emitter, garden, silk-daemon) started without issues
• No TLS cipher compatibility problems observed
• FIPS verified via: strings /var/vcap/packages/rep/bin/rep | grep "fips140=on"
• Result: DefaultGODEBUG=fips140=on

CI compatibility

The package uses the PREFIX naming convention (fips-golang-1.26-linux) which is compatible with the existing bump-golang-package-name task in wg-app-platform-runtime-ci via PREFIX=fips. Future Go version bumps (1.26→1.27) would be handled automatically by CI.

Context

• No external forks needed (BoringCrypto, Microsoft, Red Hat golang-fips are all unnecessary)
• Red Hat's golang-fips fork has announced Go 1.26 as their final release and recommends upstream Go's native FIPS
• Ruby-based CF components (Cloud Controller, BOSH) already inherit FIPS-compliant OpenSSL from the stemcell
• Java-based UAA uses Bouncy Castle FIPS
• Go-based components are the remaining gap for full platform FIPS compliance

Blocked on

• Add FIPS 140-3 variant package for Go 1.26 (linux) bosh-package-golang-release#39 (FIPS package availability)

[ivo1116]

Related changes needed across the CF ecosystem

After cloudfoundry/bosh-package-golang-release#39 merges, the same mechanical change (vendor fips-golang-1.26-linux + update specs/packaging) would be needed in all Go-based CF releases:

Release	Go packages to update
diego-release (this repo)	~15 (rep, bbs, auctioneer, route_emitter, cfdot, locket, ssh_proxy, file_server, diego-sshd, certsplitter, healthcheck, proxy, vizzini, lifecycles)
routing-release	~4 (gorouter, route_registrar, tcp_router, routing-api)
garden-runc-release	~5 (guardian, garden-healthcheck, grootfs, netplugin, idmapper)
silk-release	~5 (silk-controller, silk-daemon, silk-cni, policy-server, vxlan-policy-agent)
loggregator-release	~4 (doppler, trafficcontroller, rlp, rlp-gateway)
loggregator-agent-release	~4 (forwarder-agent, syslog-agent, metrics-agent)
log-cache-release	~2 (log-cache, log-cache-gateway)
nats-release	~3 (nats-tls-healthcheck, nats-smoke, nats-v2-wrapper)
bpm-release	~1 (bpm — uses golang-1-linux, needs fips-golang-1-linux variant added later)
syslog-release	~2
nfs-volume-release	~2
statsd-injector-release	~1
otel-collector-release	~1
cf-networking-release	~3

Additionally, a PR to wg-app-platform-runtime-ci would add FIPS bump steps to each release's Concourse pipeline (using the existing PREFIX=fips parameter in the shared tasks), ensuring automatic maintenance on future Go version bumps.

All changes are purely mechanical — no component code changes required.

[ivo1116]

Clarification: The FIPS package (fips-golang-1.26-linux) is an addition to bosh-package-golang-release, not a replacement. The existing golang-1.26-linux package remains unchanged and available.

Releases that need FIPS compliance opt in by vendoring fips-golang-1.26-linux instead of (or alongside) golang-1.26-linux. Releases that don't need FIPS continue using the standard package with zero impact.

This could be done as:

• A full switch (replace golang-1.26-linux with fips-golang-1.26-linux) for releases that want FIPS as the default
• Or keeping both packages, with a build-time toggle for which one is used

The approach is up to the release maintainers.