Skip to main content

Atmos binaries now build with Go's FIPS 140-3 crypto module by default

· 3 min read
Erik Osterman
Erik Osterman
Founder @ Cloud Posse

Federal agencies, financial institutions, and healthcare organizations are often required to run only cryptography that's been validated against FIPS 140, the U.S. government's standard for approved algorithms and key sizes. For a command-line tool built on a general-purpose language runtime, meeting that bar has traditionally meant compiling against a separate validated crypto library, or simply hoping the runtime's own TLS and encryption code happens to stick to approved algorithms.

The Problem​

Atmos talks to a lot of TLS endpoints — cloud provider APIs, git servers, artifact registries, the Terraform module registry. Every one of those connections depends on the cryptography built into the Go runtime atmos is compiled with. Until now, nothing about that cryptography was validated or restricted to FIPS-approved algorithms; it just used whatever Go's standard library picked. Operators who needed a FIPS 140-3 claim for their toolchain had no way to get one from an official atmos release.

The Fix​

Every officially released atmos binary — along with every binary built from a checkout using atmos build — now links Go's own FIPS 140-3 crypto module and defaults to enforcing FIPS 140-3 mode at runtime. Go standard-library TLS connections, key generation, and hashing are restricted to FIPS-approved algorithms and key sizes automatically. No flag, environment variable, or config change is required.

This covers the TLS and cryptography atmos itself uses for outbound connections, and it's FIPS 140-3 mode — enforced by Go's runtime — not a CMVP compliance certification for the atmos binary itself. Declarative secrets management (atmos secret keygen and the age-based SOPS backend, along with the sealed values atmos pushes to GitHub Actions secrets) relies on its own encryption, chosen for compatibility with those specific ecosystems, and sits outside Go's FIPS module boundary entirely — worth knowing if your compliance program needs FIPS coverage across secrets handling too.

How to Use It​

Nothing to opt into — every current and future atmos release ships this way by default. To confirm it on any binary, ask atmos itself:

atmos version --format=json
{
  "version": "1.226.1",
  "os": "darwin",
  "arch": "arm64",
  "fips": true
}

If you'd rather check without atmos installed yet — say, auditing a downloaded binary — any standard Go toolchain can tell you the same thing:

go version -m ./atmos | grep -i fips
build   DefaultGODEBUG=fips140=on
build   GOFIPS140=latest

Get Involved​

Have feedback on this, or a compliance requirement it doesn't yet cover? Open an issue or join the conversation in the Cloud Posse community Slack.