golang-fips/go

Rethink `crypto/boring.Enabled()`

bdarnell opened this issue · 0 comments

The crypto/boring.Enabled() function borrows its package name and the boringcrypto build tag from the standard library's boringcrypto experiment, but it's not actually compatible because the standard library has Enabled as a public constant while golang-fips changed it to be a function.

I would recommend avoiding the name crypto/boring.Enabled unless you can make it actually compatible with the standard library interface. I'd rather have this function appear under some other package name instead of piggybacking on crypto/boring. And if a build tag is necessary, it should probably be something specific to golang-fips (nothing else in the patch is build-tag restricted, although whether you use one here or not I'm going to have to wrap my call sites in a build tag to support both standard and fips toolchains).

For an example of the confusion this can cause see cockroachdb/cockroach#114709 (comment)