Skip to content

Containerfile.art: Add GOEXPERIMENT=strictfipsruntime for FIPS compliance - #191

Merged
bcaton85 merged 1 commit into
quay:redhat-3.17from
redhat-chai-bot:art/fips-compliance-fix-3.17
Oct 12, 2026
Merged

bcaton85 merged 1 commit into
quay:redhat-3.17from
redhat-chai-bot:art/fips-compliance-fix-3.17

Conversation

@redhat-chai-bot

Copy link
Copy Markdown

Add FIPS-compliant build flags to the Go build command in Containerfile.art.

Problem

The CSO FBC is failing the fbc-fips-check-oci-ta conforma check because the Go binary is not built with FIPS-compliant flags.

Fix

Change the Go build command from:

RUN CGO_ENABLED=1 make build

to:

RUN GOEXPERIMENT=strictfipsruntime CGO_ENABLED=1 go build -tags strictfipsruntime -v -o bin/security-labeller ./cmd/security-labeller

Context

Same fix as #180 (redhat-3.18) and #190 (redhat-5.0).


AI-generated. Review for accuracy.

@shruti-rh requested from Slack

…ance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@bcaton85
bcaton85 merged commit 6587015 into quay:redhat-3.17 Oct 12, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants