golang/go · error

cannot find __go_fipsinfo

Error message

cannot find __go_fipsinfo

What it means

During Mach-O (macOS/iOS) FIPS 140 post-link processing, the linker opens the linked executable and looks for the __go_fipsinfo section using macho.File.Section("__go_fipsinfo"). If this section is absent, the FIPS info symbol was not emitted during compilation or was stripped, and the post-link step cannot proceed.

Source

Thrown at src/cmd/link/internal/ld/fips140.go:351

	}
	defer mf.Close()

	wf, err := os.OpenFile(exe, os.O_RDWR, 0)
	if err != nil {
		return err
	}
	defer wf.Close()

	f, err := newFipsObj(wf, fipso)
	if err != nil {
		return err
	}
	defer f.Close()

	// Find the go:fipsinfo symbol.
	sect := mf.Section("__go_fipsinfo")
	if sect == nil {
		return fmt.Errorf("cannot find __go_fipsinfo")
	}
	data, err := sect.Data()
	if err != nil {
		return err
	}

	uptr := ctxt.Arch.ByteOrder.Uint64
	if ctxt.Arch.PtrSize == 4 {
		uptr = func(x []byte) uint64 {
			return uint64(ctxt.Arch.ByteOrder.Uint32(x))
		}
	}

	// Add the sections listed in go:fipsinfo to the FIPS object.
	// On Mac, the debug/macho package is not reporting any relocations,
	// but the addends are all in the data already, all relative to
	// the same base.
	// Determine the base used for the self pointer, and then apply

View on GitHub (pinned to b6b368adc5)

Solutions

1. Ensure FIPS is enabled at compile time (GOFIPS=1 or appropriate build tags)
2. Do not strip debug/symbol info with -s or -w when FIPS is required
3. Verify all packages are compiled with the same FIPS-enabled Go toolchain
4. Clean rebuild: go clean -cache && GOFIPS=1 go build
5. Check Go version supports FIPS for macOS (1.24+)

// Before FIPS post-link, verify the section exists
func verifyMachOFipsInfo(exe string) error {
    mf, err := macho.Open(exe)
    if err != nil {
        return err
    }
    defer mf.Close()
    if mf.Section("__go_fipsinfo") == nil {
        return fmt.Errorf("binary lacks __go_fipsinfo — was FIPS enabled at compile time?")
    }
    return nil
}

// Handle missing FIPS section gracefully
sect := mf.Section("__go_fipsinfo")
if sect == nil {
    return fmt.Errorf("cannot find __go_fipsinfo (ensure GOFIPS=1 at build time, avoid -s/-w stripping)")
}

When it happens

Trigger: The machofips function calls mf.Section("__go_fipsinfo") on the opened Mach-O binary. If the return is nil (section not found), the error is returned. This section should have been created by the Go compiler when FIPS support is enabled.

Common situations: FIPS post-linking is invoked but the compilation did not actually emit FIPS info (e.g. GOFIPS not set at compile time); the section was stripped by an external tool or -ldflags='-s'; mixing FIPS-enabled and non-FIPS object files; Go version mismatch where the compiler does not emit the section.

Related errors

• fips unsupported on %s
• cannot find .go.fipsinfo
• invalid pointers found in .go.fipsinfo
• cannot find .data
• scanning PE for FIPS magic: %v

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/b790163abf5c214e. Report an issue: GitHub.