Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package golang-stable-image for
openSUSE:Factory checked in at 2026-10-27 16:47:57
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/golang-stable-image (Old)
and /work/SRC/openSUSE:Factory/.golang-stable-image.new.2252680 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "golang-stable-image"
Tue Oct 27 16:47:57 2026 rev:64 rq:1392792 version:unknown
Changes:
--------
--- /work/SRC/openSUSE:Factory/golang-stable-image/golang-stable-image.changes
2026-09-24 23:04:30.553943902 +0200
+++
/work/SRC/openSUSE:Factory/.golang-stable-image.new.2252680/golang-stable-image.changes
2026-10-27 16:48:16.879774185 +0100
@@ -1,0 +2,5 @@
+Mon Oct 26 16:00:21 UTC 2026 - SUSE Update Bot <[email protected]>
+
+- improve migration instructions in the README.md
+
+-------------------------------------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ README.md ++++++
--- /var/tmp/diff_new_pack.LL3moq/_old 2026-10-27 16:48:17.575803374 +0100
+++ /var/tmp/diff_new_pack.LL3moq/_new 2026-10-27 16:48:17.580803583 +0100
@@ -4,7 +4,7 @@
## Description
-[Go](https://go.dev/) (a.k.a., Golang) is a statically-typed programming
+[Go](https://go.dev/) (a.k.a. Golang) is a statically-typed programming
language, with syntax loosely derived from C. Go offers additional features
such as garbage collection, type safety, certain dynamic-typing capabilities,
additional built-in types (for example, variable-length arrays and key-value
@@ -14,79 +14,128 @@
Go binaries can natively operate in a mode that facilitates
[FIPS 140-3 compliance](https://go.dev/doc/security/fips140).
+Go includes a cryptographic module certified under NIST's
+Cryptographic Module Validation Program (CMVP).
### The GOFIPS140 environment variable
-The `GOFIPS140` environment variable can be used with `go build`, `go install`,
-and `go test` to enable FIPS 140-3 mode.
+The `GOFIPS140` environment variable controls FIPS 140-3 mode during
compilation
+with `go build`, `go install`, and `go test`.
-The recommended values are `off` (default value) or `certified` to select the
-corresponding NIST CMVP certified release.
+The available values are:
-### The fips140 GODEBUG option
+- **`off`** (default): Uses the standard library's cryptographic
implementations in
+ standard mode. The compiled binary does not enable FIPS mode by default at
runtime.
+- **`certified`**: Links against the latest frozen snapshot of the Go
Cryptographic
+ Module that has completed an official NIST CMVP validation certificate.
Binaries
+ compiled with `GOFIPS140=certified` automatically execute in FIPS 140-3 mode
by
+ default (`fips140=on`) at runtime.
+- **`latest`**: Uses the current toolchain's cryptographic module and enables
FIPS
+ 140-3 mode by default at runtime.
+- **`<version>`** (for example, `v1.0.0`): Links against a specific frozen
snapshot
+ version of the cryptographic module.
+
+To compile an application with the certified module enabled:
+
+```ShellSession
+$ GOFIPS140=certified go build -o myapp .
+```
+
+In a `Dockerfile`:
-The `fips140` option in `GODEBUG` controls FIPS 140-3 mode during runtime
execution.
+```Dockerfile
+RUN GOFIPS140=certified go build -o /hello .
+```
+
+### The fips140 GODEBUG option
-It defaults to `off` unless `GOFIPS140` was set at build time.
+The `fips140` option in the `GODEBUG` environment variable controls FIPS 140-3
mode
+during runtime execution. It defaults to `off` unless `GOFIPS140=certified` or
+`GOFIPS140=latest` was specified at build time.
The possible values for `fips140` are:
-- **off**: The Go Cryptographic Module does not operate in FIPS 140-3 mode.
-- **on**: The Go Cryptographic Module operates in FIPS 140-3 mode.
-- **only**: The Go Cryptographic Module operates in FIPS 140-3 mode, but
cryptographic algorithms not approved by FIPS 140-3 return an error or panic.
+- **`off`**: The Go Cryptographic Module does not operate in FIPS 140-3 mode.
+- **`on`**: The Go Cryptographic Module operates in FIPS 140-3 mode. The
runtime
+ executes Power-On Self-Tests (POST) during initialization and key generation,
+ enforces the NIST SP 800-90A DRBG for random number generation, and restricts
+ `crypto/tls` to approved cipher suites, curves, and protocol versions (TLS
1.2 and TLS 1.3).
+- **`only`**: Strict FIPS 140-3 mode. Cryptographic algorithms, key sizes, or
+ configurations not approved by FIPS 140-3 return an error or panic. This
setting
+ is recommended in CI/CD pipelines to detect unapproved algorithms.
+
+To run an application container with FIPS 140-3 mode explicitly enabled:
+
+```ShellSession
+$ podman run -e GODEBUG="fips140=on" my-golang-app
+```
+
+### Verifying the binary
+
+To verify that a binary was compiled with the certified Go cryptographic
module:
+
+```ShellSession
+$ go version -m myapp
+```
+
+The output will include the embedded module snapshot under
`crypto/internal/fips140`.
### Migration from Go-openssl
-Starting with Go 1.27, the Go-openssl variant—which routes cryptographic
-operations through OpenSSL—will no longer be supported in openSUSE BCI.
+Starting with Go 1.27, the legacy Go-openssl variant—which routed cryptographic
+operations through OpenSSL via CGO—will no longer be supported or provided in
openSUSE BCI.
+All workloads requiring FIPS 140-3 compliance should migrate to this standard
Go
+container image.
+
-To maintain compatibility with prior Go-openssl behavior, during build time
-set `GOFIPS140` to `certified` or set `fips140=on` during runtime in `GODEBUG`.
+#### How to migrate
+
+1. Replace the legacy base image
`registry.suse.com/bci/golang:<version>-openssl`
+ with `registry.opensuse.org/opensuse/bci/golang:1.27`.
+2. Build your binary with `GOFIPS140=certified` (for example,
+ `RUN CGO_ENABLED=0 GOFIPS140=certified go build -o /hello .`).
+3. Deploy the binary into a minimal container image such as `bci-nano`.
## Usage
-We recommend using the Go image as a build environment. Thus,
-the compiler does not need to be shipped as part of the images that are
-deployed. Instead, we recommend using the Go image as the
-builder image only.
-
-There are two options to work with Go images. First, you can encapsulate your
-application in a `scratch` container image, essentially an empty file system
-image. This approach only works if your Go application does not depend on libc
-or any other library or files, as they will not be available.
+We recommend using the Go image solely as a build environment so that
+the compiler does not need to be shipped as part of deployed images.
-The second option uses a slim base container image with just the minimal
+There are two options for working with Go images. First, you can encapsulate
your
+application in a `bci-nano` container image, a minimal runtime environment
containing
+only basic locale data and CA certificates. This approach only works if your
Go application does not
+depend on libc or any other libraries or binaries, as they will not be
available.
+
+The second option uses a slim base container image (such as `bci-micro`) with
the minimal
packages required to run the Go application.
To compile and deploy an application, copy the sources, fetch dependencies
-(assuming go.mod is used for dependency management), and build the binary using
+(assuming `go.mod` is used for dependency management), and build the binary
using
the following Dockerfile options.
-### Building from `scratch`
+### Building from `bci-nano`
```Dockerfile
# Build the application using the Go 1.27 development container image
-FROM registry.opensuse.org/opensuse/bci/golang:1.27 as build
+FROM registry.opensuse.org/opensuse/bci/golang:1.27 AS build
WORKDIR /app
-# pre-copy/cache go.mod for pre-downloading dependencies and only
+# Pre-copy/cache go.mod for pre-downloading dependencies and only
# redownloading them in subsequent builds if they change
COPY go.mod go.sum ./
RUN go mod download && go mod verify
COPY . ./
-# Make sure to build the application with CGO disabled.
-# This will force Go to use some Go implementations of code
-# rather than those supplied by the host operating system.
-# You need this for scratch images as those supporting libraries
-# are not available.
+# Disable CGO to create a statically linked binary using Go's built-in
+# implementations rather than host operating system C libraries. This is
+# required for bci-nano images as C runtime libraries (libc) are not available.
RUN CGO_ENABLED=0 go build -o /hello
-# Bundle the application into a scratch image
-FROM scratch
+# Bundle the application into a bci-nano image
+FROM registry.suse.com/bci/bci-nano:latest
COPY --from=build /hello /usr/local/bin/hello
@@ -100,15 +149,13 @@
$ podman run -it --rm my-golang-app
```
-There are situations when you don't want to run an application inside a
container.
-
-To compile the application, without running it inside a container instance,
use the following command:
+To compile an application on the host using the containerized Go toolchain
(without creating an application container image), run:
```ShellSession
$ podman run --rm -v "$PWD":/app:Z -w /app
registry.opensuse.org/opensuse/bci/golang:1.27 go build -v
```
-To run the application tests inside a container, use the following command:
+To run application tests inside a container, run:
```ShellSession
$ podman run --rm -v "$PWD":/app:Z -w /app
registry.opensuse.org/opensuse/bci/golang:1.27 go test -v
@@ -117,16 +164,16 @@
### Building from openSUSE BCI
-The [openSUSE BCI General Purpose Base
Containers](https://opensource.suse.com/bci-docs/documentation/general-purpose-bci/)
-images offer four different options for deployment, depending on your exact
requirements.
+The [openSUSE BCI General Purpose Base Container
Images](https://opensource.suse.com/bci-docs/documentation/general-purpose-bci/)
+documentation describes four different options for deployment, depending on
your exact requirements.
```Dockerfile
-# Build the application using the Go 1.27 development Container Image
-FROM registry.opensuse.org/opensuse/bci/golang:1.27 as build
+# Build the application using the Go 1.27 development container image
+FROM registry.opensuse.org/opensuse/bci/golang:1.27 AS build
WORKDIR /app
-# pre-copy/cache go.mod for pre-downloading dependencies and only
+# Pre-copy/cache go.mod for pre-downloading dependencies and only
# redownloading them in subsequent builds if they change
COPY go.mod go.sum ./
RUN go mod download && go mod verify
@@ -135,7 +182,7 @@
RUN go build -o /hello
-# Bundle the application into a scratch image
+# Bundle the application into a bci-micro image
FROM registry.opensuse.org/opensuse/bci/bci-micro:latest
COPY --from=build /hello /usr/local/bin/hello
