golang/go · warning

fips unsupported on

Error message

fips unsupported on %s

What it means

The FIPS 140 post-link verification step dispatches to platform-specific handlers based on the output binary format (elffips for ELF, machofips for Mach-O, pefips for PE). If the output format is none of these (e.g. Plan 9 a.out, WebAssembly), the function returns this error. The binary itself is left unmodified and will function normally, but FIPS compliance cannot be verified at link time.

Solutions

1. Check that the target platform supports FIPS post-link verification (Linux/ELF, macOS/Mach-O, Windows/PE)
2. Switch to a supported platform if FIPS compliance is required
3. If FIPS is optional, the binary will work without verification — the runtime init check will fail if FIPS is enabled at runtime
4. Check Go release notes for FIPS platform support expansion

// Check if the target platform supports FIPS post-link verification
func isFIPSSupported(headType objabi.HeadType) bool {
    switch headType {
    case objabi.Helf, objabi.Hdarwin, objabi.Hwindows:
        return true
    }
    return false
}

// Handle non-fatal FIPS platform errors gracefully
if err := fipsPostLink(ctxt, exe, fipso); err != nil {
    if strings.Contains(err.Error(), "fips unsupported") {
        log.Printf("Warning: %v — binary will work but FIPS runtime check may fail", err)
        return nil // non-fatal
    }
    return err
}

When it happens

Trigger: The fips140 post-link function checks ctxt.IsElf(), ctxt.HeadType == objabi.Hdarwin, and ctxt.HeadType == objabi.Hwindows. If none match, the error is returned with the head type name. The calling code may treat this as non-fatal since the binary still works.

Common situations: Building for an unsupported platform (GOOS=plan9, GOOS=js/wasm) with FIPS enabled; targeting a platform where FIPS verification has not been implemented; using a Go version where FIPS support is limited to specific platforms.

Related errors

• cannot find .data
• cannot find __go_fipsinfo
• cannot find .go.fipsinfo
• corrupt pointer found in go:fipsinfo
• invalid pointers found in .go.fipsinfo

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/3f483fd2644edc5f. Report an issue: GitHub.

Appendix: source

Thrown at src/cmd/link/internal/ld/fips140.go:323

	if !obj.EnableFIPS() {
		return nil
	}
	if ctxt.BuildMode == BuildModePlugin { // not sure why this doesn't work
		return nil
	}
	switch {
	case ctxt.IsElf():
		return elffips(ctxt, exe, fipso)
	case ctxt.HeadType == objabi.Hdarwin:
		return machofips(ctxt, exe, fipso)
	case ctxt.HeadType == objabi.Hwindows:
		return pefips(ctxt, exe, fipso)
	}

	// If we can't do FIPS, leave the output binary alone.
	// If people enable FIPS the init-time check will fail,
	// but the binaries will work otherwise.
	return fmt.Errorf("fips unsupported on %s", ctxt.HeadType)
}

// machofips updates go:fipsinfo after external linking
// on systems using Mach-O (GOOS=darwin, GOOS=ios).
func machofips(ctxt *Link, exe, fipso string) error {
	// Open executable both for reading Mach-O and for the fipsObj.
	mf, err := macho.Open(exe)
	if err != nil {
		return err
	}
	defer mf.Close()

	wf, err := os.OpenFile(exe, os.O_RDWR, 0)
	if err != nil {
		return err
	}
	defer wf.Close()

View on GitHub (pinned to b6b368adc5)