Would you consider the inclusion of a PR that adds a build tag (tentative name opencontainers_selinux.nocrypto, perhaps) that elides uniqMcs and its call tree from the build? Our usecase is a minimal binary to spawn shells for users (including transitioning to the user's context via SetExecLabel, if selinux is enabled), and since this is the last source of inclusion of any package in crypto/..., getting rid of it would mean not having to care about FIPS compliance at all (as well as losing us a tiny bit of binary size, but that's a very minor thing).
Would you consider the inclusion of a PR that adds a build tag (tentative name
opencontainers_selinux.nocrypto, perhaps) that elidesuniqMcsand its call tree from the build? Our usecase is a minimal binary to spawn shells for users (including transitioning to the user's context viaSetExecLabel, if selinux is enabled), and since this is the last source of inclusion of any package incrypto/..., getting rid of it would mean not having to care about FIPS compliance at all (as well as losing us a tiny bit of binary size, but that's a very minor thing).