//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

//go:build fips && linux && amd64
// +build fips,linux,amd64

package fips

import _ "crypto/tls/fipsonly"

# MinIO FIPS Builds

MinIO creates FIPS builds using a patched version of the Go compiler (that uses BoringCrypto, from BoringSSL, which is [FIPS 140-2 validated](https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2964.pdf)) published by the Golang Team [here](https://github.com/golang/go/tree/dev.boringcrypto/misc/boring).

	MOVW	$0, (R1)  // 3f0000b9
	MOVWU	$0, (R1)  // 3f0000b9
	MOVH	$0, (R1)  // 3f000079
	MOVHU	$0, (R1)  // 3f000079
	MOVB	$0, (R1)  // 3f000039
	MOVBU	$0, (R1)  // 3f000039

// small offset fits into instructions
	MOVB	R1, 1(R2) // 41040039
	MOVH	R1, 1(R2) // 41100078
	MOVH	R1, 2(R2) // 41040079
	MOVW	R1, 1(R2) // 411000b8
	MOVW	R1, 4(R2) // 410400b9
	MOVD	R1, 1(R2) // 411000f8

      # This should fail if grep returns non-zero exit
      - name: Test binary
        run: |
          docker run --rm minio/fips-test:latest ./minio --version

RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips -o /go/bin/minio && \
    curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips.minisig -o /go/bin/minio.minisig && \
    curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.fips.sha256sum -o /go/bin/minio.sha256sum && \
    chmod +x /go/bin/minio

implementation must:
</p>

<ul>
	<li>Represent integer constants with at least 256 bits.</li>

	<li>Represent floating-point constants, including the parts of
	    a complex constant, with a mantissa of at least 256 bits
	    and a signed binary exponent of at least 16 bits.</li>

	<li>Give an error if unable to represent an integer constant
	    precisely.</li>

	if err != nil {
		t.Fatalf("Failed to serialize xlmeta %v", err)
	}
	fivs, err := getFileInfoVersions(buf, basefi.Volume, basefi.Name, false)
	if err != nil {
		t.Fatalf("getFileInfoVersions failed: %v", err)
	}
	chkNumVersions := func(fis []FileInfo) bool {
		for i := 0; i < len(fis)-1; i++ {
			if fis[i].NumVersions != fis[i+1].NumVersions {
				return false
			}
		}
		return true
	}

  // Optional: mode bits to use on created files by default. Must be a
  // Optional: mode bits used to set permissions on created files by default.
  // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
  // YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
  // Defaults to 0644.
  // Directories within the path are not affected by this setting.

  /** Checks that the passed argument is positive, and ceils it to a multiple of 32. */
  static int checkPositiveAndMakeMultipleOf32(int bits) {
    checkArgument(bits > 0, "Number of bits must be positive");
    return (bits + 31) & ~31;
  }

  /**
   * Returns a hash function which computes its hash code by concatenating the hash codes of the
   * underlying hash functions together. This can be useful if you need to generate hash codes of a

implementation must:
</p>

<ul>
	<li>Represent integer constants with at least 256 bits.</li>

	<li>Represent floating-point constants, including the parts of
	    a complex constant, with a mantissa of at least 256 bits
	    and a signed binary exponent of at least 16 bits.</li>

	<li>Give an error if unable to represent an integer constant
	    precisely.</li>