Skip to content

[release/1.35] cherry-pick: Fix for broken FIPS builds (#41226)#41592

Merged
phlax merged 1 commit into
envoyproxy:release/v1.35from
grnmeira:backport-fix-fips-build
Oct 17, 2025
Merged

[release/1.35] cherry-pick: Fix for broken FIPS builds (#41226)#41592
phlax merged 1 commit into
envoyproxy:release/v1.35from
grnmeira:backport-fix-fips-build

Fix for broken FIPS builds (#41226)

01da027
Select commit
Loading
Failed to load commit list.
CI (Envoy) / Envoy/Prechecks succeeded Oct 17, 2025 in 13m 47s

Envoy/Prechecks (success)

Check has finished

Details

Check run finished (success ✔️)

The check run can be viewed here:

Envoy/Prechecks (pr/41592/release/v1.35@01da027)

Check started by

Request (pr/41592/release/v1.35@01da027)

grnmeira @grnmeira 01da027 #41592 merge release/v1.35@c84715c

[release/1.35] cherry-pick: Fix for broken FIPS builds (#41226)

This PR moved the Go dependency in FIPS builds to a Bazel http_archive. Once that was done, Bazel's filegroup doesn't seem to be dealing so well with non-UTF-8 characters present in a file name in Go's test suite, causing the build to fail.

#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: error reading file '@@fips_go_linux_amd64//:test/fixedbugs/issue27836.dir/Þmain.go': /build/top/BUILD/envoy/build/bazel_root/base/external/fips_go_linux_amd64/test/fixedbugs/issue27836.dir/Þmain.go (No such file or directory)
#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: 1 input file(s) are in error
#23 171.2 Target //distribution/binary:release failed to build

It's not fully understood what circumstances cause Bazel to behave like that, but it seems reasonable to remove the test directory from the exports. Once a bug is filed to the Bazel project I'll update the PR with the issue number.

Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

Environment

Request variables

Key Value
ref 2111cae
sha 01da027
pr 41592
base-sha c84715c
actor grnmeira @grnmeira
message [release/1.35] cherry-pick: Fix for broken FIPS builds (#41226)...
started 1760692239.054214
target-branch release/v1.35
trusted false
Build image

Container image/s (as used in this CI run)

Key Value
default envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8
mobile envoyproxy/envoy-build-ubuntu:mobile-f4a881a1205e8e6db1a57162faf3df7aed88eae8
Version

Envoy version (as used in this CI run)

Key Value
major 1
minor 35
patch 6
dev true