diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go index c77aedbbd0..5a981f8bc1 100644 --- a/src/cmd/dist/test.go +++ b/src/cmd/dist/test.go @@ -714,7 +714,7 @@ func (t *tester) registerTests() { }) // Check that all crypto packages compile (and test correctly, in longmode) with fips. - if fipsSupported() { + if t.fipsSupported() { // Test standard crypto packages with fips140=on. t.registerTest("GODEBUG=fips140=on go test crypto/...", &goTest{ variant: "gofips140", @@ -1794,7 +1794,7 @@ func isEnvSet(evar string) bool { return false } -func fipsSupported() bool { +func (t *tester) fipsSupported() bool { // Use GOFIPS140 or GOEXPERIMENT=boringcrypto, but not both. if strings.Contains(goexperiment, "boringcrypto") { return false @@ -1811,6 +1811,13 @@ func fipsSupported() bool { goos == "aix": return false } + + // For now, FIPS+ASAN doesn't need to work. + // If this is made to work, also re-enable the test in check_test.go. + if t.asan { + return false + } + return true } diff --git a/src/crypto/internal/fips140/check/check.go b/src/crypto/internal/fips140/check/check.go index d8526e151d..ff61b80cb3 100644 --- a/src/crypto/internal/fips140/check/check.go +++ b/src/crypto/internal/fips140/check/check.go @@ -83,7 +83,8 @@ func init() { // crypto/internal/fips140deps and then call it to unpoison the range // before reading it, but it is unclear whether that would then cause // false negatives. For now, FIPS+ASAN doesn't need to work. - // If this is made to work, also re-enable the test in check_test.go. + // If this is made to work, also re-enable the test in check_test.go + // and in cmd/dist/test.go. panic("fips140: cannot verify in asan mode") } diff --git a/src/crypto/internal/fips140test/check_test.go b/src/crypto/internal/fips140test/check_test.go index 1c7dae4127..8e1998a525 100644 --- a/src/crypto/internal/fips140test/check_test.go +++ b/src/crypto/internal/fips140test/check_test.go @@ -41,7 +41,6 @@ func TestFIPSCheckVerify(t *testing.T) { if asan.Enabled { // Verification panics with asan; don't bother. t.Skipf("skipping with -asan") - return } cmd := testenv.Command(t, os.Args[0], "-test.v", "-test.run=TestFIPSCheck")