FIPS: support Go native FIPS 140-3 module (GOFIPS140) toolchains

Under FIPS_MODE=1 the Makefile probes and exports GOEXPERIMENT=boringcrypto, which cmd/go refuses to combine with GOFIPS140 — breaking builds on GOFIPS140 toolchains (CNG failure: https://gitlab.com/gitlab-org/build/CNG/-/jobs/15232583916).

  • Land !1516 (merged) (guard boringcrypto behind go env GOFIPS140 empty-or-off) — merged 2026-07-14
  • Bump labkit once its fips fix is released — functional: SSH algorithm selection keys on fips.Enabled()
  • Decide CGO/gssapi posture under native FIPS (CGO is no longer toolchain-mandated; CGO_ENABLED=1 currently also enables the gssapi build tag)

Part of &22761 (closed) (spike: https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706).

🤖 Generated with Claude Code

Edited by Jason Plum