Support `GODEBUG=fips140=only`

[qmuntal]

GODEBUG=fips140=only is not well supported by us. Some checks are not properly enforced. We need to investigate what's missing and fix it.

[qmuntal]

The standard library doesn't currently run tests with GODEBUG=fips140=only (see golang/go#70514). I would wait till we have a test suite to validate against before doing any work.

[dagood]

In https://devblogs.microsoft.com/go/go-1-24-fips-update/ we said this will be fully ready for 1.25, something to keep in mind if upstream work gets down to the wire.

[qmuntal]

Thanks for reporting. We don't currently support FIPS-only mode, see #1656.

Let's keep this issue open to track this specific gap.

[bdhill-arista]

The standard library doesn't currently run tests with GODEBUG=fips140=only (see golang/go#70514). I would wait till we have a test suite to validate against before doing any work.

Looks like this got punted to go1.26: https://github.com/golang/go/milestone/373