golang/go · error

scanning PE for FIPS magic: %v

Error message

scanning PE for FIPS magic: %v

What it means

During PE FIPS post-link processing, the code scans the .data section in 16-byte increments looking for the FIPS magic bytes. This specific error (at line 518) fires when an I/O error occurs while reading the first fipsMagicLen bytes at the current scan offset. This is the initial magic-detection read within the scan loop.

Source

Thrown at src/cmd/link/internal/ld/fips140.go:518

	// Find the go:fipsinfo symbol.
	// PE does not put it in its own section, so we have to scan for it.
	// It is near the start of the data segment, right after go:buildinfo,
	// so we should not have to scan too far.
	const maxScan = 16 << 20
	sect := pf.Section(".data")
	if sect == nil {
		return fmt.Errorf("cannot find .data")
	}
	b := bufio.NewReader(sect.Open())
	off := int64(0)
	data := make([]byte, fipsMagicLen+fipsSumLen+9*ctxt.Arch.PtrSize)
	for ; ; off += 16 {
		if off >= maxScan {
			break
		}
		if _, err := io.ReadFull(b, data[:fipsMagicLen]); err != nil {
			return fmt.Errorf("scanning PE for FIPS magic: %v", err)
		}
		if string(data[:fipsMagicLen]) == fipsMagic {
			if _, err := io.ReadFull(b, data[fipsMagicLen:]); err != nil {
				return fmt.Errorf("scanning PE for FIPS magic: %v", err)
			}
			break
		}
	}

	uptr := ctxt.Arch.ByteOrder.Uint64
	if ctxt.Arch.PtrSize == 4 {
		uptr = func(x []byte) uint64 {
			return uint64(ctxt.Arch.ByteOrder.Uint32(x))
		}
	}

	// Add the sections listed in go:fipsinfo to the FIPS object.
	// Determine the base used for the self pointer, and then apply

View on GitHub (pinned to b6b368adc5)

Solutions

1. Verify the binary file is not corrupted: re-run the build
2. Clean rebuild: go clean -cache && GOFIPS=1 go build
3. Check file permissions and ensure no other process is modifying the binary
4. Disable antivirus scanning temporarily to rule out file locking
5. Report as a Go linker bug if the issue persists with a clean build

// Handle I/O errors during FIPS magic scan
if _, err := io.ReadFull(b, data[:fipsMagicLen]); err != nil {
    if err == io.EOF || err == io.ErrUnexpectedEOF {
        break // section ended before finding magic — not necessarily an error
    }
    return fmt.Errorf("scanning PE for FIPS magic: %w (check binary integrity)", err)
}

When it happens

Trigger: io.ReadFull(b, data[:fipsMagicLen]) is called inside the scan loop (off += 16). If it returns an error (e.g. EOF before fipsMagicLen bytes, or a read error from the bufio.Reader wrapping the section data), the error wraps the underlying I/O error.

Common situations: The .data section is shorter than expected (premature EOF); corrupted PE file with truncated section data; I/O errors reading the binary from disk; race condition where the binary is modified while being scanned; anti-virus software locking or modifying the file.

Related errors

• cannot find .data
• corrupt pointer found in go:fipsinfo
• dynamic relocation to unreachable symbol %s
• internal error in windynrelocsym: redirect GOT token applied
• internal error in windynrelocsym: underlying sym for %q has

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/579477f1ae2d56f7. Report an issue: GitHub.