acvpwrapper

ACVP Wrapper Repro Guide

This folder contains the embedded ACVP wrapper used by clickhouse-backup-acvp and clickhouse-backup acvp.

The tracked config for public-Go-API validation is:

• pkg/acvpwrapper/acvp_test_fips140v1.26.public.config.json

It intentionally excludes ML-KEM and ML-DSA vector suites because those ACVP paths rely on internal Go crypto APIs that are not publicly exposed in Go 1.26.

Compliance Scope

• This wrapper is a reproducibility harness for ACVP expected-output tests.
• It is not itself a CMVP certificate artifact.
• The compliance-relevant cryptographic implementation is Go's native crypto/internal/fips140/... module when run with GODEBUG=fips140=on (or only), per Go's FIPS documentation.

Certificate And Security Policy Context

• Go's official FIPS status and validation lifecycle is documented here: FIPS 140-3 Compliance (Go docs).
• As documented by Go, module validations are tracked in CMVP lists; at the time of writing, v1.26.0 is listed as "Implementation Under Test" and v1.0.0 is listed as "In Process" (with CAVP certificate A6650).
• Go's published FIPS documentation and blog post are the authoritative public references for certificate/security-policy context:
  • The FIPS 140-3 Go Cryptographic Module (Go blog)
  • CMVP Modules In Process List
  • CMVP Validated Modules Search (Go Cryptographic Module)
  • CAVP Certificate A6650

Reference Traceability (Claim -> Source)

Pinned Version Provenance

Pins used by run.sh are taken from upstream Go's ACVP test setup for the v1.26 stream:

• boringssl commit: baaf868e6e8f
  • From bsslVersion = v0.0.0-20251111011041-baaf868e6e8f in Go crypto/internal/fips140test/acvp_test.go.
• acvp-testdata commit: d893de8b8b1c
  • From goAcvpVersion = v0.0.0-20251201200548-d893de8b8b1c in the same Go test.
• Upstream config source:
  • src/crypto/internal/fips140test/acvp_test_fips140v1.26.config.json in Go source.
• This repo's tracked config:
  • pkg/acvpwrapper/acvp_test_fips140v1.26.public.config.json
  • Derived from Go's v1.26 config, with ML-KEM and ML-DSA suites removed to keep the run strictly on public Go crypto APIs.

Reproduce The Current Result

Run from the repository root.

One-command repro

bash pkg/acvpwrapper/run.sh

Expected output includes:

• 38 ACVP tests matched expectations

Manual step-by-step

1) Build the wrapper binary

docker run --rm \
  -v "$PWD:/work" \
  -w /work \
  golang:1.26-alpine \
  sh -lc 'export PATH=$PATH:/usr/local/go/bin && CGO_ENABLED=0 go build -o clickhouse-backup ./cmd/clickhouse-backup && ln -sf clickhouse-backup clickhouse-backup-acvp'

2) Fetch pinned upstream inputs

rm -rf /tmp/boringssl /tmp/acvp-testdata
git clone https://boringssl.googlesource.com/boringssl /tmp/boringssl
git -C /tmp/boringssl checkout baaf868e6e8f

git clone https://github.com/geomys/acvp-testdata /tmp/acvp-testdata
git -C /tmp/acvp-testdata checkout d893de8b8b1c

3) Build pinned acvptool

docker run --rm \
  -v /tmp/boringssl:/src \
  -w /src \
  golang:1.26-alpine \
  sh -lc 'export PATH=$PATH:/usr/local/go/bin && go build -o /src/acvptool-pinned ./util/fipstools/acvp/acvptool'

4) Run the expected-output check

docker run --rm \
  -e ACVP_WRAPPER=1 \
  -e GODEBUG=fips140=on \
  -v "$PWD:/work" \
  -v /tmp/boringssl:/tmp/boringssl:ro \
  -v /tmp/acvp-testdata:/tmp/acvp-testdata:rw \
  -w /tmp/acvp-testdata \
  golang:1.26-alpine \
  sh -lc 'export PATH=$PATH:/usr/local/go/bin && go run /tmp/boringssl/util/fipstools/acvp/acvptool/test/check_expected.go -tool /tmp/boringssl/acvptool-pinned -module-wrappers go:/work/clickhouse-backup-acvp -tests /work/pkg/acvpwrapper/acvp_test_fips140v1.26.public.config.json'

Expected output includes:

• 38 ACVP tests matched expectations