golang/go · error

FIPS 140-3 mode is not supported on {GOOS}-{GOARCH}

Error message

FIPS 140-3 mode is not supported on {GOOS}-{GOARCH}

What it means

Returned by fips140.Supported() on platforms where FIPS 140-3 mode cannot run: js/wasm (and wasm GOARCH generally), windows/386, openbsd (any arch, due to -fexecute-only breaking the integrity check, issue #70880), and aix. Reasons vary: insufficient timers for the CPU jitter entropy source, or object-file semantics that break the integrity check.

Source

Thrown at src/crypto/internal/fips140/fips140.go:58

	// ASAN disapproves of reading swaths of global memory in fips140/check.
	// One option would be to expose runtime.asanunpoison through
	// crypto/internal/fips140deps and then call it to unpoison the range
	// before reading it, but it is unclear whether that would then cause
	// false negatives. For now, FIPS+ASAN doesn't need to work.
	if asanEnabled {
		return errors.New("FIPS 140-3 mode is incompatible with ASAN")
	}

	// See EnableFIPS in cmd/internal/obj/fips.go for commentary.
	// Also, js/wasm and windows/386 don't have good enough timers
	// for the CPU jitter entropy source.
	switch {
	case runtime.GOARCH == "wasm",
		runtime.GOOS == "windows" && runtime.GOARCH == "386",
		runtime.GOOS == "openbsd", // due to -fexecute-only, see #70880
		runtime.GOOS == "aix":
		return errors.New("FIPS 140-3 mode is not supported on " + runtime.GOOS + "-" + runtime.GOARCH)
	}

	if boringEnabled {
		return errors.New("FIPS 140-3 mode is incompatible with GOEXPERIMENT=boringcrypto")
	}

	return nil
}

func Name() string {
	return "Go Cryptographic Module"
}

// Version returns the formal version (such as "v1.0.0") if building against a
// frozen module with GOFIPS140. Otherwise, it returns "latest".
func Version() string {
	// This return value is replaced by mkzip.go, it must not be changed or
	// moved to a different file.

View on GitHub (pinned to b6b368adc5)

Solutions

  1. Retarget to a supported platform (amd64, arm64, or s390x on supported OSes).
  2. If you must run on an excluded platform, do not enable GOFIPS140 — fall back to the standard (non-FIPS) crypto path.
  3. For Windows deployments, use windows/amd64 or windows/arm64 instead of windows/386.
  4. Track upstream: openbsd support may change if issue #70880 is resolved.

Example fix

# before
GOOS=windows GOARCH=386 GOFIPS140=1 go build ./...

# after
GOOS=windows GOARCH=amd64 GOFIPS140=1 go build ./...
Defensive patterns

Strategy: validation

Validate before calling

if err := fips140.Supported(); err != nil {
    if strings.Contains(err.Error(), "not supported on") {
        log.Fatalf("FIPS unavailable on %s-%s; retarget build", runtime.GOOS, runtime.GOARCH)
    }
    log.Fatalf("FIPS unsupported: %v", err)
}

Try / catch

if err := fips140.Supported(); err != nil {
    return fmt.Errorf("FIPS startup check failed: %w", err)
}

Prevention

When it happens

Trigger: Targeting one of the excluded GOOS/GOARCH combinations and attempting to enable FIPS mode (GOFIPS140=1) or calling fips140.Supported().

Common situations: Cross-compiling from a supported host to windows/386 or wasm with FIPS enabled; CI matrix that includes openbsd/aix; legacy 386 Windows deployment.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/de95ac39a4e36ece. Report an issue: GitHub.