Add support for FIPS

[tehbooom]

Would like to add support for FIPS 140-3 compliance like we have for Agents and Beats.

So ideally in the config you would set

fips_enabled: true
package_paths:
  - /packages/package-registry

cache_time.index: 10s
cache_time.search: 10m
cache_time.categories: 10m
cache_time.catch_all: 10m

[jsoriano]

Could you be more specific about the changes that would be needed in this project to be FIPS compliant? Would it be enough with a configuration flag or it would need a different build?

[cmacknz]

https://go.dev/doc/security/fips140

Go 1.25 will let you compile using FIPS compliant cryptography (and possibly have the same binary run in fips mode based on configuration), where the pure Go cryptographic module backing it is now on the NIST in-process list. https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/modules-in-process-list

So this is good enough for anyone that can accept in-process modules before they are officially validated and signed off by NIST.

For Elastic Agent and Beats we have an internal requirement to use a module that is certified by NIST, so we build with Microsoft's Go fork that lets us link against certified versions of OpenSSL. This is a lot more work.

[tehbooom]

So if I am understanding this correctly we may not need to set a flag in the config.

Instead just build the binary with GOFIPS140=v1.0.0 GODEBUG=fips140=only go build

However, we will not have a dockerfile for this correct?

[cmacknz]

Yes that will produce the executable and you'd have to package it into Docker yourself.