{"record":{"id":"3f483fd2644edc5f","repo":"golang/go","slug":"fips-unsupported-on-s","errorCode":null,"errorMessage":"fips unsupported on %s","messagePattern":"fips unsupported on (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/cmd/link/internal/ld/fips140.go","lineNumber":323,"sourceCode":"\tif !obj.EnableFIPS() {\n\t\treturn nil\n\t}\n\tif ctxt.BuildMode == BuildModePlugin { // not sure why this doesn't work\n\t\treturn nil\n\t}\n\tswitch {\n\tcase ctxt.IsElf():\n\t\treturn elffips(ctxt, exe, fipso)\n\tcase ctxt.HeadType == objabi.Hdarwin:\n\t\treturn machofips(ctxt, exe, fipso)\n\tcase ctxt.HeadType == objabi.Hwindows:\n\t\treturn pefips(ctxt, exe, fipso)\n\t}\n\n\t// If we can't do FIPS, leave the output binary alone.\n\t// If people enable FIPS the init-time check will fail,\n\t// but the binaries will work otherwise.\n\treturn fmt.Errorf(\"fips unsupported on %s\", ctxt.HeadType)\n}\n\n// machofips updates go:fipsinfo after external linking\n// on systems using Mach-O (GOOS=darwin, GOOS=ios).\nfunc machofips(ctxt *Link, exe, fipso string) error {\n\t// Open executable both for reading Mach-O and for the fipsObj.\n\tmf, err := macho.Open(exe)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer mf.Close()\n\n\twf, err := os.OpenFile(exe, os.O_RDWR, 0)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer wf.Close()\n","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/link/internal/ld/fips140.go#L305-L341","documentation":"The FIPS 140 post-link verification step dispatches to platform-specific handlers based on the output binary format (elffips for ELF, machofips for Mach-O, pefips for PE). If the output format is none of these (e.g. Plan 9 a.out, WebAssembly), the function returns this error. The binary itself is left unmodified and will function normally, but FIPS compliance cannot be verified at link time.","triggerScenarios":"The fips140 post-link function checks ctxt.IsElf(), ctxt.HeadType == objabi.Hdarwin, and ctxt.HeadType == objabi.Hwindows. If none match, the error is returned with the head type name. The calling code may treat this as non-fatal since the binary still works.","commonSituations":"Building for an unsupported platform (GOOS=plan9, GOOS=js/wasm) with FIPS enabled; targeting a platform where FIPS verification has not been implemented; using a Go version where FIPS support is limited to specific platforms.","solutions":["Check that the target platform supports FIPS post-link verification (Linux/ELF, macOS/Mach-O, Windows/PE)","Switch to a supported platform if FIPS compliance is required","If FIPS is optional, the binary will work without verification — the runtime init check will fail if FIPS is enabled at runtime","Check Go release notes for FIPS platform support expansion"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check if the target platform supports FIPS post-link verification\nfunc isFIPSSupported(headType objabi.HeadType) bool {\n    switch headType {\n    case objabi.Helf, objabi.Hdarwin, objabi.Hwindows:\n        return true\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"// Handle non-fatal FIPS platform errors gracefully\nif err := fipsPostLink(ctxt, exe, fipso); err != nil {\n    if strings.Contains(err.Error(), \"fips unsupported\") {\n        log.Printf(\"Warning: %v — binary will work but FIPS runtime check may fail\", err)\n        return nil // non-fatal\n    }\n    return err\n}","preventionTips":["FIPS post-link only supports ELF (Linux), Mach-O (macOS/iOS), and PE (Windows)","If targeting other platforms, FIPS verification cannot be done at link time","The binary will still function; the FIPS runtime init check will fail if FIPS is enabled at runtime","Check Go release notes for expanded FIPS platform support"],"tags":["fips","fips140","linker","go-toolchain","platform-support"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}