refactor: use bluebottle/pkg/fipsboot for the FIPS 140-3 startup guard (#911)

cmd/ecr-credential-provider/main.go

@@ -24,7 +24,7 @@ import (
 	"github.com/mulgadc/spinifex/internal/guestenv"
 	"github.com/mulgadc/spinifex/internal/imdscreds"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 const (

cmd/ecs-agent/main.go

@@ -17,7 +17,7 @@ import (
 	"os/signal"
 	"syscall"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 func main() {

cmd/eks-gateway-fetch/main.go

@@ -40,7 +40,7 @@ import (
 
 	"github.com/mulgadc/spinifex/internal/eksgw"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 // stagedAddon mirrors the gateway's StagedAddonManifest wire shape; duplicated

cmd/eks-gateway-publish/main.go

@@ -31,7 +31,7 @@ import (
 
 	"github.com/mulgadc/spinifex/internal/eksgw"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 const (

cmd/installer/main.go

@@ -5,10 +5,10 @@ import (
 	"os"
 	"strings"
 
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 	"github.com/mulgadc/spinifex/cmd/installer/autoinstall"
 	"github.com/mulgadc/spinifex/cmd/installer/install"
 	"github.com/mulgadc/spinifex/cmd/installer/ui"
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
 )
 
 func main() {

cmd/lb-agent/main.go

@@ -21,7 +21,7 @@ import (
 	"github.com/mulgadc/bluebottle/pkg/otelsetup"
 	"github.com/mulgadc/spinifex/spinifex/lbagent"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 func main() {

cmd/rds-agent/main.go

@@ -16,7 +16,7 @@ import (
 	"os/signal"
 	"syscall"
 
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
 
 func main() {

cmd/spinifex/main.go

@@ -1,8 +1,8 @@
 package main
 
 import (
+	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 	"github.com/mulgadc/spinifex/cmd/spinifex/cmd"
-	_ "github.com/mulgadc/spinifex/internal/fipsboot"
 )
 
 func main() {

go.mod

@@ -21,7 +21,7 @@ require (
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/miekg/dns v1.1.73
-	github.com/mulgadc/bluebottle v1.18.1-0.20260827042935-b2f552cd66c4
+	github.com/mulgadc/bluebottle v1.18.1-0.20260827043632-fca81ec29266
 	github.com/mulgadc/northstar v1.18.0
 	github.com/mulgadc/predastore v1.18.1-0.20260826045109-26ce1b091112
 	github.com/mulgadc/viperblock v1.18.0

go.sum

@@ -1327,8 +1327,8 @@ github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELU
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/mulgadc/bluebottle v1.18.1-0.20260827042935-b2f552cd66c4 h1:C/LBupoohsrQJPX34I/AQ47QP2FTABWblH71oDfA9Bs=
-github.com/mulgadc/bluebottle v1.18.1-0.20260827042935-b2f552cd66c4/go.mod h1:mvvV4d2w+kGLXxO1ymptNlxqUlNJKB2oAhk6PkpVLj8=
+github.com/mulgadc/bluebottle v1.18.1-0.20260827043632-fca81ec29266 h1:F8lFWRvjjvXGWTNGdiQOZX7VJ9FCy6uJXFMuYn6KnAg=
+github.com/mulgadc/bluebottle v1.18.1-0.20260827043632-fca81ec29266/go.mod h1:mvvV4d2w+kGLXxO1ymptNlxqUlNJKB2oAhk6PkpVLj8=
 github.com/mulgadc/northstar v1.18.0 h1:ksRjIKE6qtrw/ZoYaJh8JRBh+xdnuDw8FsmFLFCiXbg=
 github.com/mulgadc/northstar v1.18.0/go.mod h1:z6iol77R1vsIQyIBc1JQboUPhSJ6eG4bipzfbZZbLEM=
 github.com/mulgadc/predastore v1.18.1-0.20260826045109-26ce1b091112 h1:eCzKJDL1lmw6DNwjbDCQBoT3ZHIsYE1lMj5qitjySrY=

internal/fipsboot/fipsboot.go

@@ -1,16 +0,0 @@
-// Package fipsboot enforces FIPS 140-3 at startup via blank import in every binary.
-// Requires GOFIPS140=v1.0.0 at build time; panics if GODEBUG=fips140=off disables
-// the runtime FIPS mode.
-package fipsboot
-
-import (
-	"crypto/fips140"
-)
-
-func init() {
-	if !fips140.Enabled() {
-		//nolint:forbidigo // Refuse to start when the required FIPS mode is disabled.
-		panic("fipsboot: FIPS 140-3 mode is not enabled at runtime — refusing to start. " +
-			"Build with GOFIPS140=v1.0.0 and do not set GODEBUG=fips140=off.")
-	}
-}