support building with GOFIPS140

Signed-off-by: Ryan Richard <richardry@vmware.com>

test/testlib/securetls_preference_fips.go

@@ -1,12 +1,16 @@
-// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+// This file overrides securetls_preference_nonfips.go when Pinniped is built in FIPS-only mode using the legacy boring crypto compiler.
 //go:build fips_strict
 
 package testlib
 
+// DefaultCipherSuitePreference returns an expected value for tests.
 // Because of a bug in nmap, the cipher suite preference is
 // incorrectly shown as 'client' in some cases.
 // in fips-only mode, it correctly shows the cipher preference
 // as 'server', while in non-fips mode it shows as 'client'.
-const DefaultCipherSuitePreference = "server"
+func DefaultCipherSuitePreference() string {
+	return "server"
+}

test/testlib/securetls_preference_nonfips.go

@@ -1,12 +1,20 @@
-// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !fips_strict
 
 package testlib
 
+import "crypto/fips140"
+
+// DefaultCipherSuitePreference returns an expected value for tests.
 // Because of a bug in nmap, the cipher suite preference is
 // incorrectly shown as 'client' in some cases.
 // in fips-only mode, it correctly shows the cipher preference
 // as 'server', while in non-fips mode it shows as 'client'.
-const DefaultCipherSuitePreference = "client"
+func DefaultCipherSuitePreference() string {
+	if fips140.Enabled() {
+		return "server"
+	}
+	return "client"
+}

test/testlib/skip.go

@@ -1,9 +1,12 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package testlib
 
-import "testing"
+import (
+	"crypto/fips140"
+	"testing"
+)
 
 // SkipUnlessIntegration skips the current test if `-short` has been passed to `go test`.
 func SkipUnlessIntegration(t *testing.T) {
@@ -14,6 +17,22 @@ func SkipUnlessIntegration(t *testing.T) {
 	}
 }
 
+func SkipTestWhenUsingGOFIPS140(t *testing.T) {
+	t.Helper()
+
+	if fips140.Enabled() {
+		t.Skip("this test is skipped when using GOFIPS140")
+	}
+}
+
+func SkipTestUnlessUsingGOFIPS140(t *testing.T) {
+	t.Helper()
+
+	if !fips140.Enabled() {
+		t.Skip("this test requires GOFIPS140")
+	}
+}
+
 func SkipTestWhenLDAPIsUnavailable(t *testing.T, env *TestEnv) {
 	t.Helper()