Enable GODEBUG=fips140=only with systemcrypto backends

[gdams]

Fixes: #1656

Will need documentation before merging but pushing up the code changes for testing/review

[gdams]

I don't think this change is neccessary, adding a comment to remind me

[github-actions]

Patch Consistency Review - ✅ No Issues Found

I've reviewed PR #2149 for patch consistency across the two modified patch files:

• patches/0001-Vendor-external-dependencies.patch
• patches/0004-Use-crypto-backends.patch

Review Findings

✅ Vendor Patch Compliance: The changes to vendor dependencies (updating github.com/golang-fips/openssl/v2, github.com/microsoft/go-crypto-darwin, and github.com/microsoft/go-crypto-winnative to newer versions) are correctly placed in 0001-Vendor-external-dependencies.patch, which is the designated patch for all vendor directory modifications.

✅ Dependency File Updates: The vendor patch properly updates all three required dependency files:

• src/go.mod - Updated with new version refs
• src/go.sum - Updated with new checksums
• src/vendor/modules.txt - Updated with new module info

✅ Patch Naming Convention: Both patches follow the established naming convention (numbered prefix with descriptive names).

✅ Logical Consistency: The changes demonstrate proper coordination between patches:

• The vendor patch (0001) updates backend libraries to versions that include FIPSApproved() method support
• The crypto-backends patch (0004) adds code to utilize this new capability for GODEBUG=fips140=only enforcement
• Changes are appropriately scoped to their respective patches based on purpose

✅ No Redundancy: The changes don't duplicate functionality already covered by existing patches. The new FIPSApproved() interface method check in fips140only.ApprovedHash() is an additive enhancement that complements the existing type-based checks.

Summary

The patch changes maintain consistency and follow the repository's patch management conventions correctly. The vendor library updates in patch 0001 and the corresponding usage in patch 0004 are well-coordinated and appropriately separated by concern.

AI generated by Patch Consistency Review Agent