Add ms_tls13kdf buildtag for FIPS builds (#8092) (#8139)

Add ms_tls13kdf buildtag for FIPS builds

(cherry picked from commit c2ecbaf)

Co-authored-by: Michel Laterman <[email protected]>

Author: mergify[bot]

dev-tools/mage/gotest.go

@@ -86,7 +86,7 @@ func makeGoTestArgsForModule(name, module string) GoTestArgs {
 func testTagsFromEnv() []string {
 	tags := strings.Split(strings.Trim(os.Getenv("TEST_TAGS"), ", "), ",")
 	if FIPSBuild {
-		tags = append(tags, "requirefips")
+		tags = append(tags, "requirefips", "ms_tls13kdf")
 	}
 	return tags
 }

dev-tools/packaging/packages.yml

@@ -42,6 +42,7 @@ settings:
         GOEXPERIMENT: systemcrypto
       tags:
         - requirefips
+        - ms_tls13kdf
       platforms:
         - *linux-amd64
         - *linux-arm64

dev-tools/packaging/testing/package_test.go

@@ -712,6 +712,7 @@ func checkFIPS(t *testing.T, agentPackageRootDir string) {
 				case "-tags":
 					foundTags = true
 					require.Contains(t, setting.Value, "requirefips")
+					require.Contains(t, setting.Value, "ms_tls13kdf")
 					continue
 				case "GOEXPERIMENT":
 					foundExperiment = true

magefile.go

@@ -335,7 +335,7 @@ func (Build) WindowsArchiveRootBinary() error {
 	if devtools.FIPSBuild {
 		// there is no actual FIPS relevance for this particular binary
 		// but better safe than sorry
-		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips")
+		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips,ms_tls13kdf")
 		args.CGO = true
 	}