Add ms_tls13kdf buildtag for FIPS builds

dev-tools/mage/gotest.go

@@ -46,7 +46,7 @@
 }
 
 func makeGoTestArgs(name string) GoTestArgs {
 	fileName := fmt.Sprintf("build/TEST-go-%s", strings.Replace(strings.ToLower(name), " ", "_", -1))
 	params := GoTestArgs{
 		LogName:         name,
 		Race:            RaceDetector,
@@ -64,8 +64,8 @@
 
 func makeGoTestArgsForModule(name, module string) GoTestArgs {
 	fileName := fmt.Sprintf("build/TEST-go-%s-%s",
 		strings.Replace(strings.ToLower(name), " ", "_", -1),
 		strings.Replace(strings.ToLower(module), " ", "_", -1),
 	)
 	params := GoTestArgs{
 		LogName:         fmt.Sprintf("%s-%s", name, module),
@@ -86,7 +86,7 @@
 func testTagsFromEnv() []string {
 	tags := strings.Split(strings.Trim(os.Getenv("TEST_TAGS"), ", "), ",")
 	if FIPSBuild {
-		tags = append(tags, "requirefips")
+		tags = append(tags, "requirefips", "ms_tls13kdf")
 	}
 	return tags
 }

dev-tools/packaging/packages.yml

@@ -42,6 +42,7 @@ settings:
         GOEXPERIMENT: systemcrypto
       tags:
         - requirefips
+        - ms_tls13kdf
       platforms:
         - *linux-amd64
         - *linux-arm64

dev-tools/packaging/testing/package_test.go

@@ -450,7 +450,7 @@
 		return "", errors.New("version label not found")
 	}
 
 	parts := strings.SplitN(file, "/", -1)
 	if len(parts) == 0 {
 		return "", errors.New("failed to get file name parts")
 	}
@@ -808,6 +808,7 @@
 				case "-tags":
 					foundTags = true
 					require.Contains(t, setting.Value, "requirefips")
+					require.Contains(t, setting.Value, "ms_tls13kdf")
 					continue
 				case "GOEXPERIMENT":
 					foundExperiment = true

magefile.go

@@ -339,7 +339,7 @@ func (Build) WindowsArchiveRootBinary() error {
 	if devtools.FIPSBuild {
 		// there is no actual FIPS relevance for this particular binary
 		// but better safe than sorry
-		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips")
+		args.ExtraFlags = append(args.ExtraFlags, "-tags=requirefips,ms_tls13kdf")
 		args.CGO = true
 	}