Skip to content

Go 1.24 FIPS-only mode panics #23

@Proximyst

Description

@Proximyst

When using Vellum's Levenshtein package, Go 1.24's new FIPS-only mode makes the code panic:

$ make
GODEBUG=fips140=only go run .
panic: crypto/md5: use of MD5 is not allowed in FIPS 140-only mode

goroutine 1 [running]:
crypto/md5.(*digest).checkSum(0x8cc68500?)
        /usr/lib/go/src/crypto/md5/md5.go:162 +0x105
crypto/md5.Sum({0xc00014bca0?, 0x20?, 0xc00014bcb0?})
        /usr/lib/go/src/crypto/md5/md5.go:194 +0x98
github.com/blevesearch/vellum/levenshtein.getHash(0xc00014bd78)
        /home/mariell/go/pkg/mod/github.com/blevesearch/vellum@v1.1.0/levenshtein/parametric_dfa.go:348 +0x157
github.com/blevesearch/vellum/levenshtein.(*hash).getOrAllocate(0xc00014bea8, {{0x5f51a0, 0x0, 0x0}})
        /home/mariell/go/pkg/mod/github.com/blevesearch/vellum@v1.1.0/levenshtein/parametric_dfa.go:329 +0x3c
github.com/blevesearch/vellum/levenshtein.fromNfa(0xc00014beee)
        /home/mariell/go/pkg/mod/github.com/blevesearch/vellum@v1.1.0/levenshtein/parametric_dfa.go:250 +0xa9
github.com/blevesearch/vellum/levenshtein.NewLevenshteinAutomatonBuilder(0x0?, 0x0?)
        /home/mariell/go/pkg/mod/github.com/blevesearch/vellum@v1.1.0/levenshtein/levenshtein.go:45 +0x25
main.main()
        /home/mariell/work/pocs/poc-vellum-fips-panic/main.go:10 +0x1d
exit status 2
make: *** [Makefile:2: reproduce] Error 1
package main

import (
	"fmt"

	"github.com/blevesearch/vellum/levenshtein"
)

func main() {
	_, err := levenshtein.NewLevenshteinAutomatonBuilder(2, true)
	if err != nil {
		panic(err)
	}

	fmt.Println("successfully made automaton builder")
}

Complete, minimal reproduction repository: https://codeberg.org/mariell/poc-vellum-fips-panic

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions