Skip to content

[8.x](backport #4766) split FIPS unit tests from fips140=only test #4769

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michel-laterman merged 1 commit into from
Apr 9, 2025
Merged

[8.x](backport #4766) split FIPS unit tests from fips140=only test #4769

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .buildkite/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,18 @@ steps:
- build/*.xml
- build/coverage*.out

- label: ":smartbear-testexecute: Run fips140=only unit tests"
key: unit-test-fips140-only
command: ".buildkite/scripts/unit_test.sh"
env:
FIPS: "true"
GODEBUG: "fips140=only"
agents:
provider: "gcp"
artifact_paths:
- build/*.xml
- build/coverage*.out

- label: ":smartbear-testexecute: Run unit tests: MacOS 13"
key: unit-test-macos-13
command: ".buildkite/scripts/unit_test.sh"
Expand Down
6 changes: 1 addition & 5 deletions .buildkite/scripts/unit_test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,4 @@ add_bin_path
with_go

echo "Starting the unit tests..."
if [[ ${FIPS:-} == "true" ]]; then
make test-unit-fips junit-report
else
make test-unit junit-report
fi
make test-unit junit-report
11 changes: 4 additions & 7 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,16 +225,13 @@ test: prepare-test-context ## - Run all tests
test-release: ## - Check that all release binaries are created
./.buildkite/scripts/test-release.sh $(DEFAULT_VERSION)

# If FIPS=true unit tests need microsoft/go + OpenSSL with FIPS
.PHONY: test-unit
test-unit: prepare-test-context ## - Run unit tests only
set -o pipefail; ${GOFIPSEXPERIMENT} go test ${GO_TEST_FLAG} -tags=$(GOBUILDTAGS) -v -race -coverprofile=build/coverage-${OS_NAME}.out ./... | tee build/test-unit-${OS_NAME}.out
set -o pipefail; go test ${GO_TEST_FLAG} -tags=$(GOBUILDTAGS) -v -race -coverprofile=build/coverage-${OS_NAME}.out ./... | tee build/test-unit-${OS_NAME}.out

# FIPS unit tests are meant to use go v1.24 to check FIPS compliance.
# This check is very strict, and should be thought of as a static-code analysis tool.
.PHONY: test-unit-fips
test-unit-fips: prepare-test-context ## - Run unit tests with go 1.24's fips140=only for testing
set -o pipefail; GOFIPS140=latest GODEBUG=fips140=only go test ${GO_TEST_FLAG} -tags=$(GOBUILDTAGS) -v -race -coverprofile=build/coverage-${OS_NAME}.out ./... | tee build/test-unit-fips-${OS_NAME}.out
.PHONY: test-fips-provider-unit
test-fips-provider-unit: prepare-test-context ## - Run unit tests with GOEXPERIMENT=systemcrypto to check that system FIPS provider works
set -o pipefail; GOEXPERIMENT=systemcrypto CGO_ENABLED=1 go test ${GO_TEST_FLAG} -tags=$(GOBUILDTAGS) -v -race -coverprofile=build/coverage-${OS_NAME}.out ./... | tee build/test-unit-${OS_NAME}.out

.PHONY: benchmark
benchmark: prepare-test-context install-benchstat ## - Run benchmark tests only
Expand Down
Loading