g8e v1.6.8

[1.6.8] - 2026-07-31

Overview

FIPS 140-3 compliance release. g8e now builds against the Go Cryptographic Module v1.0.0 (CMVP Cert #5247, CAVP A6650) in FIPS 140-3 approved mode, with a dedicated FIPS build pipeline (make build-fips, Dockerfile.fips), a FIPS CI workflow, a g8e version --fips runtime self-check, and a new FIPS 140-3 compliance reference document. All TLS configurations drop X25519 in favor of the FIPS-validated X25519MLKEM768 hybrid plus P-384/P-256, and Ed25519-signed TLS certificates are rejected at load time. The demo harness approval flow now pushes approvals to the console via SSE and prints a host-reachable approval link.

Security

• FIPS 140-3 approved mode — g8e links the Go Cryptographic Module v1.0.0 (CMVP Cert #5247, CAVP A6650) at build time via GOFIPS140=v1.0.0. The binary enters FIPS 140-3 approved mode by default and runs integrity self-checks and known-answer tests at init/first use; no runtime environment variable is required. The compliance claim is restricted to linux/amd64 on Debian GNU/Linux 12 (vendor-affirmed OE, CMVP Cert #5247 Table 3). See FIPS 140-3 Compliance for the validated boundary, excluded algorithms, and OE matrix. Affected files: Makefile, Dockerfile.fips, .github/workflows/build-and-test-fips.yml.
• X25519 removed from TLS key agreement — All g8e TLS configurations (gateway server, CLI mTLS client, embedded TLS config) now use certs.FIPSCurvePreferences(): X25519MLKEM768 (FIPS 203 post-quantum hybrid, preferred), P-384, P-256. X25519 is excluded because it is not SP 800-56A rev3 compliant and is omitted from Go's FIPS TLS mode. Affected files: internal/certs/embed.go, internal/cli/auth/tls.go, internal/services/gateway/gateway_certs.go.
• Ed25519 TLS certificates rejected at load time — The PKI certificate loader now rejects any certificate with a PureEd25519 signature algorithm, returning ErrPKIEd25519CertRejected. Ed25519 remains validated for application-layer signatures (consensus, receipts, notary) but is not within the validated boundary for TLS certificate signatures; g8e enforces ECDSA P-256 for all PKI-issued certificates. This is a fail-closed guard. Affected files: internal/services/gateway/gateway_certs.go, internal/constants/errors.go.

Breaking Changes

• Ed25519-signed TLS certificates no longer load — Any CA or service certificate using an Ed25519 signature is now rejected at load time with ErrPKIEd25519CertRejected. Deployments using Ed25519-signed PKI certificates must regenerate them with ECDSA P-256. Application-layer Ed25519 signatures (consensus, receipts, notary proofs) are unaffected.
• X25519 removed from TLS curve preferences — Clients relying solely on X25519 for TLS 1.3 key agreement can no longer connect. P-256 and P-384 are universally supported by TLS 1.3 stacks, so practical impact is limited to non-conformant or X25519-only clients.

Added

• g8e version subcommand — New subcommand printing build metadata (version, build ID, build time, platform). With the --fips flag, it additionally queries the native crypto/fips140 package (Enabled(), Enforced(), Version()) to report FIPS 140-3 module status and exits non-zero if approved mode is not active, serving as an auditor/operator self-check. Affected files: internal/cli/cmd/version.go, internal/cli/cmd/main.go.
• make build-fips and make verify-fips targets — build-fips produces bin/g8e-fips-linux-amd64 with GOFIPS140=v1.0.0, CGO_ENABLED=0, GOOS=linux, GOARCH=amd64, pinned to the certified frozen module version. verify-fips builds the FIPS variant and runs ./g8e-fips version --fips to confirm approved mode is active, exiting non-zero on failure. Affected files: Makefile.
• Dockerfile.fips — Multi-stage FIPS-compliant Docker build. Builder stage sets ENV GOFIPS140=v1.0.0 and CGO_ENABLED=0, builds for linux/amd64, and runs g8e version --fips as a build-time self-check. Runtime stage is pinned to debian:12-slim (vendor-affirmed OE); the binary is statically linked with zero runtime dependencies and no runtime env var required. Affected files: Dockerfile.fips.
• FIPS CI workflow — .github/workflows/build-and-test-fips.yml builds with GOFIPS140=v1.0.0, runs make verify-fips, executes the unit and integration test suites with the FIPS module linked, and verifies the binary is statically linked. Affected files: .github/workflows/build-and-test-fips.yml.
• FIPS-mode FedRAMP demo compose — demos/fedramp/compose.fips.yml builds all three g8e services (gateway, operator, agent-runtime) from Dockerfile.fips, using separate container names (g8e-fedramp-fips-*), separate named volumes (fedramp-fips-*), and different host ports (8089/8452) to avoid conflicts with the standard demo. Affected files: demos/fedramp/compose.fips.yml, demos/fedramp/README.md.
• FIPS 140-3 compliance reference doc — New docs/reference/fips140-3.md is the single source of truth for g8e's FIPS compliance claim: validated module, validated algorithms, excluded algorithms, operating environment, build-time activation, runtime verification, and CI pipeline. Other docs cross-reference it rather than duplicating details. Affected files: docs/reference/fips140-3.md.
• --approval-url flag for demos scenarios run — Host-reachable base URL used to render the human-facing approval link printed to stderr, distinct from --public-url (which the harness dials directly for SSE/status and must be reachable from the harness process). Defaults to --public-url when empty. Affected files: internal/cli/cmd/scenarios_run.go, internal/cli/cmd/demos.go.
• ApprovalDisplayURL harness config field — New approval_display_url field in the agent harness config, separating the host-reachable display URL (printed for the human approver) from the container-internal public_base_url (dialed by the harness). Falls back to PublicBaseURL when empty. Affected files: internal/tools/agent_harness/config/config.go, internal/tools/agent_harness/client/client.go.

Changed

• FIPSCurvePreferences refactored to function — Changed from a package-level var slice to a FIPSCurvePreferences() []tls.CurveID function returning a fresh slice on each call, preventing consumers from mutating shared package-level state. All call sites updated. Affected files: internal/certs/embed.go, internal/cli/auth/tls.go, internal/services/gateway/gateway_certs.go.
• Approval flow pushes to console via SSE — WaitForHumanApproval now prints the console URL (where the approval is pushed via SSE) as the primary approval path, with the direct /api/v1/approve/ link as an alternative. The printed link uses ApprovalDisplayURL so the host browser can open it in the demo topology where the harness process and human approver reach the gateway via different addresses. DHS and FedRAMP demo harness configs set ApprovalURL to the host-reachable HTTPS surface (https://localhost:8450 / https://localhost:8451). Affected files: internal/tools/agent_harness/client/client.go, internal/cli/cmd/demo_dhs.go, internal/cli/cmd/demo_fedramp.go.
• README compliance badge — The compliance badge now includes FIPS140-3, and a FIPS 140-3 paragraph plus reference doc link were added to the README body and reference section. Affected files: README.md.
• Documentation reconciliation — docs/architecture/auth.md and docs/architecture/encryption.md gained FIPS 140-3 sections documenting the validated module, validated/excluded algorithms, operating environment, and runtime verification. docs/reference/compliance-alignment.md SC-13 control updated to reference the FIPS compliance claim. docs/devs/codemap.md updated with the version subcommand, version.go, FIPSCurvePreferences(), and a FIPS 140-3 build infrastructure section. Affected files: docs/architecture/auth.md, docs/architecture/encryption.md, docs/reference/compliance-alignment.md, docs/devs/codemap.md.

Fixed

• Python release verification CI — release-python-protocol.yml changed pip install to python -m pip install to fix the pip invocation in the release verification step. Affected files: .github/workflows/release-python-protocol.yml.

Tests

• Added internal/cli/cmd/version_test.go covering runVersion output (version/build ID/build time/platform) and the --fips flag path (FIPS enabled/disabled reporting, non-zero exit when FIPS mode is not active).
• Added internal/services/gateway/gateway_certs_test.go covering the Ed25519 certificate rejection guard and FIPS curve preference usage in the gateway TLS config.
• Added internal/certs/embed_test.go TestFIPSCurvePreferences_ExcludesX25519 covering the FIPS curve set.
• Added internal/cli/cmd/demos_test.go and internal/cli/cmd/scenarios_run_test.go cases for --approval-url flag wiring, ApprovalURL in DHS/FedRAMP harness configs, and applyAgentHarnessFlags setting ApprovalDisplayURL.