be more strict about reporting fips mode

Author: qrkourier

tlz/fips.go

@@ -1,10 +1,13 @@
-//go:build goexperiment.opensslcrypto
+//go:build goexperiment.opensslcrypto && requirefips
 
 package tlz
 
-import "crypto/boring"
+import (
+    "crypto/boring"
+    _ "crypto/tls/fipsonly"
+)
 
-// returns true if the binary was built with FIPS mode enabled
+// returns true if the OpenSSL FIPS provider is active at runtime
 func FipsEnabled() bool {
     return boring.Enabled()
 }

tlz/nofips.go

@@ -1,4 +1,4 @@
-//go:build !goexperiment.opensslcrypto
+//go:build !goexperiment.opensslcrypto && !requirefips
 
 package tlz