env snap=v1.26.0
env alias=inprocess

env GOFIPS140=$snap

# Go+BoringCrypto conflicts with GOFIPS140.
[GOEXPERIMENT:boringcrypto] skip

# list with GOFIPS140=$alias CGO_ENABLED=0.
# CGO disabled builds should default to go/fips140
env CGO_ENABLED=0
go list -f '{{.DefaultGODEBUG}}'
stdout fips140=auto

go list std
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check

# build does not use regular fips
go list -json -test
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check
env CGO_ENABLED=

# CGO enabled builds should default to openssl
go list -f '{{.DefaultGODEBUG}}'
! stdout fips140

# list with GOFIPS140=$snap CGO_ENABLED=0
env CGO_ENABLED=0
go list -f '{{.DefaultGODEBUG}}'
stdout fips140=auto

go list std
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check

# build does not use regular fips
go list -json -test
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check
env CGO_ENABLED=

# std lists fips snapshot and not regular fips
go list std
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check

# build does not use regular fips
go list -json -test
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check

# again with GOFIPS140=$alias
env GOFIPS140=$alias

# CGO enabled builds should default to openssl
go list -f '{{.DefaultGODEBUG}}'
! stdout fips140

# std lists fips snapshot and not regular fips
go list std
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check

# build does not use regular fips
go list -json -test
stdout crypto/internal/fips140/$snap/sha256
! stdout crypto/internal/fips140/sha256
! stdout crypto/internal/fips140/check

[short] skip

# build with GOFIPS140=snap is cached
go build -x -o x.exe
stderr link.*-fipso
go build -x -o x.exe
! stderr link.*-fipso

# build test with GOFIPS140=snap is cached
go test -x -c
stderr link.*-fipso
go test -x -c
! stderr link

-- go.mod --
module m
-- x.go --
package main
import _ "crypto/sha256"
func main() {
}
-- x_test.go --
package main
import "testing"
func Test(t *testing.T) {}
