golang/go · warning

fips unsupported on %s

Error message

fips unsupported on %s

What it means

The FIPS 140 post-link verification step dispatches to platform-specific handlers based on the output binary format (elffips for ELF, machofips for Mach-O, pefips for PE). If the output format is none of these (e.g. Plan 9 a.out, WebAssembly), the function returns this error. The binary itself is left unmodified and will function normally, but FIPS compliance cannot be verified at link time.

Source

Thrown at src/cmd/link/internal/ld/fips140.go:323

	if !obj.EnableFIPS() {
		return nil
	}
	if ctxt.BuildMode == BuildModePlugin { // not sure why this doesn't work
		return nil
	}
	switch {
	case ctxt.IsElf():
		return elffips(ctxt, exe, fipso)
	case ctxt.HeadType == objabi.Hdarwin:
		return machofips(ctxt, exe, fipso)
	case ctxt.HeadType == objabi.Hwindows:
		return pefips(ctxt, exe, fipso)
	}

	// If we can't do FIPS, leave the output binary alone.
	// If people enable FIPS the init-time check will fail,
	// but the binaries will work otherwise.
	return fmt.Errorf("fips unsupported on %s", ctxt.HeadType)
}

// machofips updates go:fipsinfo after external linking
// on systems using Mach-O (GOOS=darwin, GOOS=ios).
func machofips(ctxt *Link, exe, fipso string) error {
	// Open executable both for reading Mach-O and for the fipsObj.
	mf, err := macho.Open(exe)
	if err != nil {
		return err
	}
	defer mf.Close()

	wf, err := os.OpenFile(exe, os.O_RDWR, 0)
	if err != nil {
		return err
	}
	defer wf.Close()

View on GitHub (pinned to b6b368adc5)

Solutions

1. Check that the target platform supports FIPS post-link verification (Linux/ELF, macOS/Mach-O, Windows/PE)
2. Switch to a supported platform if FIPS compliance is required
3. If FIPS is optional, the binary will work without verification — the runtime init check will fail if FIPS is enabled at runtime
4. Check Go release notes for FIPS platform support expansion

// Check if the target platform supports FIPS post-link verification
func isFIPSSupported(headType objabi.HeadType) bool {
    switch headType {
    case objabi.Helf, objabi.Hdarwin, objabi.Hwindows:
        return true
    }
    return false
}

// Handle non-fatal FIPS platform errors gracefully
if err := fipsPostLink(ctxt, exe, fipso); err != nil {
    if strings.Contains(err.Error(), "fips unsupported") {
        log.Printf("Warning: %v — binary will work but FIPS runtime check may fail", err)
        return nil // non-fatal
    }
    return err
}

When it happens

Trigger: The fips140 post-link function checks ctxt.IsElf(), ctxt.HeadType == objabi.Hdarwin, and ctxt.HeadType == objabi.Hwindows. If none match, the error is returned with the head type name. The calling code may treat this as non-fatal since the binary still works.

Common situations: Building for an unsupported platform (GOOS=plan9, GOOS=js/wasm) with FIPS enabled; targeting a platform where FIPS verification has not been implemented; using a Go version where FIPS support is limited to specific platforms.

Related errors

• cannot find __go_fipsinfo
• cannot find .go.fipsinfo
• invalid pointers found in .go.fipsinfo
• cannot find .data
• scanning PE for FIPS magic: %v

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/3f483fd2644edc5f. Report an issue: GitHub.