Documentation
¶
Overview ¶
Package hmackey checks operator-supplied HMAC keys (salts, webhook secrets) at config load (ADR-0038). Go's FIPS 140-3 module refuses an HMAC key shorter than 112 bits: under GODEBUG=fips140=only it panics inside hmac.New, which would crash a request goroutine or a background worker long after startup. So in FIPS mode (crypto/fips140.Enabled(): fips140=on or only, the default in a FIPS build) a short key refuses to start, naming the setting; outside FIPS mode it only warns, so existing deployments keep running. Keys are never stretched: receivers such as GitHub compute the HMAC with the raw secret.
Index ¶
Constants ¶
const MinFIPS = 14
MinFIPS is the shortest HMAC key Go's FIPS 140-3 module accepts: 112 bits.
Variables ¶
This section is empty.
Functions ¶
func Check ¶
Check validates one HMAC key named by flag (the config key or CLI flag an operator would change). An empty key is the caller's business (feature off, or a random key generated later) and passes. In FIPS mode a key under MinFIPS bytes is an error; otherwise it is logged as a warning on log (nil: slog.Default) and accepted.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package hmackeytest lets tests run hmackey's checks as if FIPS mode were on or off.
|
Package hmackeytest lets tests run hmackey's checks as if FIPS mode were on or off. |
|
internal
|
|
|
fipsmode
Package fipsmode is the FIPS-mode probe internal/hmackey consults.
|
Package fipsmode is the FIPS-mode probe internal/hmackey consults. |