From eef109e7cf2631c52833b3c5665bec11b79a30d3 Mon Sep 17 00:00:00 2001
From: rorosen <76747196+rorosen@users.noreply.github.com>
Date: Tue, 25 Mar 2025 10:54:30 +0100
Subject: [PATCH] rke2: build with goboring library (#393009)

Use the FIPS Compatible boringcrypto Go compiler. This version of Go
replaces the standard Go crypto libraries with the FIPS validated
BoringCrypto module. Using a validated compiler is a requirement for
FIPS 140-2 Enablement of the RKE2 package.
---
 pkgs/applications/networking/cluster/rke2/builder.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/applications/networking/cluster/rke2/builder.nix b/pkgs/applications/networking/cluster/rke2/builder.nix
index 3fc25f67480a..d09ca95fd11f 100644
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@@ -74,6 +74,9 @@ let
       lvm2 # dmsetup
     ];
 
+    # Passing boringcrypto to GOEXPERIMENT variable to build with goboring library
+    GOEXPERIMENT = "boringcrypto";
+
     # See: https://github.com/rancher/rke2/blob/e7f87c6dd56fdd76a7dab58900aeea8946b2c008/scripts/build-binary#L27-L38
     ldflags = [
       "-w"
@@ -120,6 +123,14 @@ let
 
     doCheck = false;
 
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      # Verify that the binary uses BoringCrypto
+      go tool nm $out/bin/.rke2-wrapped | grep '_Cfunc__goboringcrypto_' > /dev/null
+      runHook postInstallCheck
+    '';
+
     passthru = {
       inherit updateScript;
       tests =