golang/go · error

cannot find .go.fipsinfo

Error message

cannot find .go.fipsinfo

What it means

During ELF (Linux) FIPS 140 post-link processing, the linker opens the linked executable and looks for the .go.fipsinfo section using elf.File.Section(".go.fipsinfo"). If this section is absent, the FIPS info data was not emitted during compilation or was stripped.

Source

Thrown at src/cmd/link/internal/ld/fips140.go:426

	}
	defer ef.Close()

	wf, err := os.OpenFile(exe, os.O_RDWR, 0)
	if err != nil {
		return err
	}
	defer wf.Close()

	f, err := newFipsObj(wf, fipso)
	if err != nil {
		return err
	}
	defer f.Close()

	// Find the go:fipsinfo symbol.
	sect := ef.Section(".go.fipsinfo")
	if sect == nil {
		return fmt.Errorf("cannot find .go.fipsinfo")
	}

	data, err := sect.Data()
	if err != nil {
		return err
	}

	uptr := ctxt.Arch.ByteOrder.Uint64
	if ctxt.Arch.PtrSize == 4 {
		uptr = func(x []byte) uint64 {
			return uint64(ctxt.Arch.ByteOrder.Uint32(x))
		}
	}

	// Add the sections listed in go:fipsinfo to the FIPS object.
	// We expect R_zzz_RELATIVE relocations where the zero-based
	// values are already stored in the data. That is, the addend
	// is in the data itself in addition to being in the relocation tables.

View on GitHub (pinned to b6b368adc5)

Solutions

1. Ensure FIPS is enabled at compile time: GOFIPS=1 go build
2. Do not strip the binary with -s, -w, or external strip tools when FIPS is required
3. Verify all packages use the same FIPS-enabled Go toolchain
4. Clean rebuild: go clean -cache && GOFIPS=1 go build
5. Confirm Go version supports FIPS for Linux/ELF (1.24+)

// Before FIPS post-link, verify the ELF section exists
func verifyELFFipsInfo(exe string) error {
    f, err := elf.Open(exe)
    if err != nil {
        return err
    }
    defer f.Close()
    if f.Section(".go.fipsinfo") == nil {
        return fmt.Errorf("binary lacks .go.fipsinfo — was FIPS enabled at compile time?")
    }
    return nil
}

// Handle missing FIPS section with actionable guidance
sect := ef.Section(".go.fipsinfo")
if sect == nil {
    return fmt.Errorf("cannot find .go.fipsinfo (rebuild with GOFIPS=1, do not use -s/-w)")
}

When it happens

Trigger: The elffips function calls ef.Section(".go.fipsinfo") on the opened ELF binary. If the return is nil (section not found), the error is returned. This section should contain the FIPS info structure emitted by the Go compiler when FIPS support is active.

Common situations: FIPS post-linking runs but compilation did not emit the section (GOFIPS not set); section stripped by external tools (strip, objcopy) or -ldflags='-s'; mixing object files from different Go versions; using a Go version without FIPS compilation support.

Related errors

• invalid pointers found in .go.fipsinfo
• fips unsupported on %s
• cannot find __go_fipsinfo
• cannot find .data
• scanning PE for FIPS magic: %v

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/8484b138d63ec9d8. Report an issue: GitHub.