From cb494112d093d3d62d0e44163ac0124aa89825b5 Mon Sep 17 00:00:00 2001 From: Ilya Kuznetsov Date: Thu, 13 Aug 2026 11:27:05 +0000 Subject: [PATCH 1/2] Build releases against the FIPS 140-3 validated Go crypto module --- .goreleaser.yaml | 7 +++++++ .nextchanges/notable-changes/fips140.md | 5 +++++ 2 files changed, 12 insertions(+) create mode 100644 .nextchanges/notable-changes/fips140.md diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 751151a74a1..197f42da958 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -7,6 +7,13 @@ before: builds: - env: - CGO_ENABLED=0 + # Link the Go Cryptographic Module and default FIPS 140-3 mode on. Pinned to + # a frozen version rather than an alias: only v1.0.0 carries a CMVP + # certificate, "latest" tracks the in-tree source with no fixed artifact to + # cite, and "certified" is resolved by the toolchain so it moves on upgrade. + # Callers who need the previous behaviour can start the binary with + # GODEBUG=fips140=off. + - GOFIPS140=v1.0.0 mod_timestamp: '{{ .CommitTimestamp }}' flags: - -trimpath diff --git a/.nextchanges/notable-changes/fips140.md b/.nextchanges/notable-changes/fips140.md new file mode 100644 index 00000000000..1d85e667e7d --- /dev/null +++ b/.nextchanges/notable-changes/fips140.md @@ -0,0 +1,5 @@ +Released binaries are now built against the FIPS 140-3 validated Go Cryptographic +Module (v1.0.0, CMVP certificate #5247), with FIPS 140-3 mode enabled by default. +TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 +and CBC suites from what the client offers. Start the CLI with +`GODEBUG=fips140=off` to restore the previous behaviour. From 3c7c16a6b91563fcd6e96021cf3f2308d6de94ef Mon Sep 17 00:00:00 2001 From: Ilya Kuznetsov Date: Thu, 13 Aug 2026 12:37:12 +0000 Subject: [PATCH 2/2] Format the changelog fragment per the guidelines --- .nextchanges/cli/fips140.md | 1 + .nextchanges/notable-changes/fips140.md | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-) create mode 100644 .nextchanges/cli/fips140.md delete mode 100644 .nextchanges/notable-changes/fips140.md diff --git a/.nextchanges/cli/fips140.md b/.nextchanges/cli/fips140.md new file mode 100644 index 00000000000..5bb9ba96f2c --- /dev/null +++ b/.nextchanges/cli/fips140.md @@ -0,0 +1 @@ +Released binaries are now built against the FIPS 140-3 validated Go Cryptographic Module, with FIPS 140-3 mode enabled by default. TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 and CBC from what the client offers. FIPS mode can be disabled at startup with `GODEBUG=fips140=off`, which restores the previous TLS behaviour ([#6262](https://github.com/databricks/cli/pull/6262)). diff --git a/.nextchanges/notable-changes/fips140.md b/.nextchanges/notable-changes/fips140.md deleted file mode 100644 index 1d85e667e7d..00000000000 --- a/.nextchanges/notable-changes/fips140.md +++ /dev/null @@ -1,5 +0,0 @@ -Released binaries are now built against the FIPS 140-3 validated Go Cryptographic -Module (v1.0.0, CMVP certificate #5247), with FIPS 140-3 mode enabled by default. -TLS connections negotiate only FIPS-approved cipher suites, which drops ChaCha20 -and CBC suites from what the client offers. Start the CLI with -`GODEBUG=fips140=off` to restore the previous behaviour.