Add FIPS-140-3 Compliant Build
Is your feature request related to a problem? Please describe.
Organizations in regulated industries such as government, finance, and healthcare often require software that complies with cryptographic standards like FIPS 140-3. OpenBao currently does not offer an official build that meets FIPS 140-3 requirements, which limits its use in environments with strict compliance mandates.
Describe the solution you'd like
We would like OpenBao to provide an official FIPS 140-3 compliant build.
Starting with Go 1.24, the Go toolchain supports FIPS 140-3 through a dedicated cryptographic module (GOFIPS140) and runtime toggles (GODEBUG=fips140=on|only).
The OpenBao build/release process should support these options to provide a FIPS-140-3 compliant distribution.
Additional Considerations:
As OpenBao depends on wrappers/plugins in go-kms-wrappers, we possibly need to consider it as well.
Describe alternatives you've considered
Yet another build increases OpenBaos (already complex) distribution matrix by yet another dimension. Building OpenBao by default FIPS-140-3 compliant could be an alternative. Admittedly, at this point in time I have no understanding of all consequences and dependencies.
Explain any additional use-cases
- Government agencies deploying OpenBao for secrets management.
- Enterprises requiring FIPS-validated cryptographic operations for audit and compliance.
- Vendors integrating OpenBao into their products needing FIPS assurance.
Additional context
FIPS 140-3 is the latest U.S. government standard for cryptographic modules and aligns with international standards (ISO/IEC 19790:2012). By enabling a FIPS-compliant build, OpenBao can gain adoption in security-sensitive environments and demonstrate strong cryptographic assurance.
Relevant reference:
Source: openbao/openbao