Hi, I have identified the cause and verified a packaging fix. The attached patch excludes the FIPS snapshot directory from dh_strip_nondeterminism in debian/rules:
--exclude=usr/share/go-$(GOVER)/lib/fips140/
dh_strip_nondeterminism changes the ZIP entry timestamps and sorts the
entries. The files inside the archive are unchanged, but the SHA-256 of
the archive no longer matches fips140.sum.
Using the installed normalizer (1.14.1-2) on a temporary copy of the
original v1.26.0.zip with SOURCE_DATE_EPOCH=1789304900 reproduced the
reported binary package hash exactly:
Original:
9b28f847fdf1db4a36cb2b2f8ec09443c039383f085630a03ecfaddf6db7ea23
After normalization:
125641ee878e91c9f411c6245bab097c9240f1ce85e207e2ff506f84ac5de3b8
I also downloaded golang-1.26-src 1.26.8-1 from forky and confirmed that
both bundled FIPS ZIPs fail their own manifest checks. Go 1.26 does not
check the raw archive hash at runtime; Go 1.27 checks it before unpacking
an uncached snapshot. This explains why the packaging issue becomes a
runtime failure in 1.27.
After rebuilding 1.27.1-2~bpo13+1 with the attached patch, I extracted the
resulting golang-1.27-src binary package and checked its archives against
its bundled fips140.sum:
v1.0.0-c2097c7c.zip: OK
v1.26.0.zip: OK
The rebuilt v1.26.0.zip has the original expected SHA-256 shown above.
This verification covers the packaged archives; I have not yet run a
post-fix GOFIPS140 build with a fresh module cache.
The patch preserves all FIPS snapshot archives byte-for-byte and leaves
other normalization unchanged. No change to fips140.sum or Go's checksum
verification is needed.
Suggested changelog entry:
* Exclude FIPS snapshot archives from dh_strip_nondeterminism to preserve
their SHA-256 hashes and prevent GOFIPS140 checksum failures.
Regards,
Richard
--debian-1149659-fips140-fix
Content-Type: text/x-diff; charset=us-ascii;
name="preserve-fips140-archives.patch"
Content-Disposition: attachment; filename="preserve-fips140-archives.patch"
Content-Transfer-Encoding: 7bit
diff --git a/debian/rules b/debian/rules
--- a/debian/rules
+++ b/debian/rules
@@ -98,5 +98,6 @@
override_dh_strip_nondeterminism:
dh_strip_nondeterminism \
+ --exclude=usr/share/go-$(GOVER)/lib/fips140/ \
--exclude=usr/share/go-$(GOVER)/src/image/png/testdata/invalid-trunc.png \
--exclude=usr/share/go-$(GOVER)/src/archive/zip/testdata/test-baddirsz.zip \
--exclude=usr/share/go-$(GOVER)/src/archive/zip/testdata/comment-truncated.zip
--debian-1149659-fips140-fix--
preserve-fips140-archives.patch
Description: preserve-fips140-archives.patch
