BN_lebin2bn used, but not available in AWS-LC-FIPS
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 431
- Forks
- 44
- Avg merge
- 21h 18m
- Merged PRs (30d)
- 30
Description
Microsoft build of Go version
go1.25
What is your operating system and platform?
Some Amazon Bottlerocket, likely 1.45
Output of go env in your module/workspace:
n/a
What did you do?
Build and run go binary on bottlerocket 1.45
What did you see happen?
Cannot get required symbol "BN_lebin2bn" from libcrypto version 1.1
SIGABRT: abort
...
vendor/github.com/golang-fips/openssl/v2._Cfunc_go_openssl_load_functions
...
What did you expect to see?
Some sensible warning that OpenSSL 1.0 is no longer supported.
Or the application just working, and using other symbols that are available in OpenSSL 1.0.2k-fips 26 Jan 2017
Based on known-versions I thought 1.0.2 is still supported.
Maybe ECDSA code paths are triggered, when ECDSA is not supported at all, or some such? Or is this an issue from bind-now linking?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in vendor/github.com/golang-fips/openssl/v2 at _Cfunc_go_openssl_load_functions, then inspect the known-versions handling and the ECDSA-related symbol loading. Reproduce the failure with go1.25 on Bottlerocket 1.45 and libcrypto 1.1; done means the supported-version behavior and the response to the missing BN_lebin2bn symbol are clearly defined and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100