{"record":{"id":"de95ac39a4e36ece","repo":"golang/go","slug":"fips-140-3-mode-is-not-supported-on-goos-goarch","errorCode":null,"errorMessage":"FIPS 140-3 mode is not supported on {GOOS}-{GOARCH}","messagePattern":"FIPS 140-3 mode is not supported on (.+?)-(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/fips140.go","lineNumber":58,"sourceCode":"\n\t// ASAN disapproves of reading swaths of global memory in fips140/check.\n\t// One option would be to expose runtime.asanunpoison through\n\t// crypto/internal/fips140deps and then call it to unpoison the range\n\t// before reading it, but it is unclear whether that would then cause\n\t// false negatives. For now, FIPS+ASAN doesn't need to work.\n\tif asanEnabled {\n\t\treturn errors.New(\"FIPS 140-3 mode is incompatible with ASAN\")\n\t}\n\n\t// See EnableFIPS in cmd/internal/obj/fips.go for commentary.\n\t// Also, js/wasm and windows/386 don't have good enough timers\n\t// for the CPU jitter entropy source.\n\tswitch {\n\tcase runtime.GOARCH == \"wasm\",\n\t\truntime.GOOS == \"windows\" && runtime.GOARCH == \"386\",\n\t\truntime.GOOS == \"openbsd\", // due to -fexecute-only, see #70880\n\t\truntime.GOOS == \"aix\":\n\t\treturn errors.New(\"FIPS 140-3 mode is not supported on \" + runtime.GOOS + \"-\" + runtime.GOARCH)\n\t}\n\n\tif boringEnabled {\n\t\treturn errors.New(\"FIPS 140-3 mode is incompatible with GOEXPERIMENT=boringcrypto\")\n\t}\n\n\treturn nil\n}\n\nfunc Name() string {\n\treturn \"Go Cryptographic Module\"\n}\n\n// Version returns the formal version (such as \"v1.0.0\") if building against a\n// frozen module with GOFIPS140. Otherwise, it returns \"latest\".\nfunc Version() string {\n\t// This return value is replaced by mkzip.go, it must not be changed or\n\t// moved to a different file.","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/fips140.go#L40-L76","documentation":"Returned by fips140.Supported() on platforms where FIPS 140-3 mode cannot run: js/wasm (and wasm GOARCH generally), windows/386, openbsd (any arch, due to -fexecute-only breaking the integrity check, issue #70880), and aix. Reasons vary: insufficient timers for the CPU jitter entropy source, or object-file semantics that break the integrity check.","triggerScenarios":"Targeting one of the excluded GOOS/GOARCH combinations and attempting to enable FIPS mode (GOFIPS140=1) or calling fips140.Supported().","commonSituations":"Cross-compiling from a supported host to windows/386 or wasm with FIPS enabled; CI matrix that includes openbsd/aix; legacy 386 Windows deployment.","solutions":["Retarget to a supported platform (amd64, arm64, or s390x on supported OSes).","If you must run on an excluded platform, do not enable GOFIPS140 — fall back to the standard (non-FIPS) crypto path.","For Windows deployments, use windows/amd64 or windows/arm64 instead of windows/386.","Track upstream: openbsd support may change if issue #70880 is resolved."],"exampleFix":"# before\nGOOS=windows GOARCH=386 GOFIPS140=1 go build ./...\n\n# after\nGOOS=windows GOARCH=amd64 GOFIPS140=1 go build ./...","handlingStrategy":"validation","validationCode":"if err := fips140.Supported(); err != nil {\n    if strings.Contains(err.Error(), \"not supported on\") {\n        log.Fatalf(\"FIPS unavailable on %s-%s; retarget build\", runtime.GOOS, runtime.GOARCH)\n    }\n    log.Fatalf(\"FIPS unsupported: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := fips140.Supported(); err != nil {\n    return fmt.Errorf(\"FIPS startup check failed: %w\", err)\n}","preventionTips":["Build for a supported GOOS/GOARCH (amd64, arm64, s390x on supported OSes).","Do not enable GOFIPS140=1 in cross-compile jobs targeting wasm/windows-386/openbsd/aix.","Gate FIPS startup on Supported() and fail fast."],"tags":["fips140","platform","wasm","windows-386","openbsd","aix","compatibility"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}