XuanYang-cnandGitHub 1f9da58f61 fix: declare -lcrypto in the FIPS OpenSSL cgo package (#50375) ...

The boringcrypto-only cgo package pkg/util/fips/openssl_enabled.go calls
libcrypto symbols (OSSL_LIB_CTX_load_config,
EVP_default_properties_is_fips_enabled,
RAND_bytes) but declared no link dependency, so FIPS builds failed at
the Go
external-link step with "libcrypto.so.3: DSO missing from command line".
The link
only used to succeed when a transitive library re-exported those
symbols.

Declare the dependency in the package that needs it via `#cgo LDFLAGS:
-lcrypto`
rather than adding -lcrypto to CGO_LDFLAGS in the Makefile/environment.
A
package-scoped directive leaves the recorded CGO_LDFLAGS build setting
empty, so it
does not change the package hash of other cgo packages and does not
require every
Go plugin to be rebuilt with a matching flag to keep plugin.Open
working.

Verified on a real FIPS build: bin/milvus links libcrypto.so.3 directly,
while the
hook/autoindex/cipher plugins keep empty CGO_LDFLAGS, carry no libcrypto
dependency,
and pass the plugin.Open package-hash check.

issue: #50374

Signed-off-by: yangxuan <xuan.yang@zilliz.com>

2026-06-09 10:56:23 +08:00

..

openssl_disabled.go

enhance: force CRC32C when OpenSSL FIPS is enabled (#50239)

2026-06-03 15:18:19 +08:00

openssl_enabled.go

fix: declare -lcrypto in the FIPS OpenSSL cgo package (#50375)

2026-06-09 10:56:23 +08:00