feat(fips): add per-module FIPS compliance gate and update elastic-agent-libs

[macdewee]

What is the problem this PR solves?

Fleet Server had no automated check to verify that FIPS builds are free of non-FIPS crypto imports. Any new binary or module added to the repository could silently pull in a forbidden crypto library (e.g. crypto/md5, golang.org/x/crypto non-FIPS paths) and only be discovered at release time.

Additionally, elastic-agent-libs needed to be updated to a version that includes fipsscan — the helper used by the new compliance tests — and the tlscommon.LoadCertificateAuthorities call in instrumentation.go needed to be adapted to the new API (logger parameter required since v0.46.1).

How does this PR solve the problem?

• FIPS compliance test (fips_compliance_test.go, gated on requirefips build tag) added to every Go module in the repo (cmd/fleet, pkg/api, testing/e2e). Each test discovers all package main binaries in its module and calls fipsscan.CheckViolations to assert no transitive non-FIPS crypto imports exist. The knownViolations map is empty — any new violation fails the test immediately.
• mage check:FIPSComplianceGate target added to magefile.go. It walks the repo for go.mod files and verifies each module (except dev-tools, which has no Go packages) contains a fips_compliance_test.go. This prevents a new module from being added without the test.
• elastic-agent-libs bumped to v0.46.2-0.20260717072702-02294d812c7d across go.mod, pkg/api/go.mod, and testing/go.mod. Added as a direct dependency of pkg/api (required by fipsscan).
• instrumentation.go fix: passes an explicit logger to tlscommon.LoadCertificateAuthorities, which now requires one after the global-logger removal in elastic-agent-libs v0.46.1.

How to test this PR locally

# Verify the compliance gate passes (all modules have the test file)
mage check:FIPSComplianceGate

# Run the FIPS compliance tests (requires a FIPS-capable toolchain)
FIPS=true GOFLAGS="-tags=requirefips" go test -run TestFIPSFullyCompliant ./... ./pkg/api/... ./testing/...

# Unit tests still pass
mage test:unit

To verify the gate catches a missing file: temporarily rename one fips_compliance_test.go and run mage check:FIPSComplianceGate — it should fail with the module path listed.

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have added tests that prove my fix is effective or that my feature works
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added an entry in ./changelog/fragments using the changelog tool

[mergify]

This pull request does not have a backport label. Could you fix it @macdewee? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[github-actions]

TL;DR

The Run check-ci job fails before tests run because pkg/api/fips_compliance_test.go declares package api_testrt, while the generated files in that directory declare package api. Go treats the mismatched test package as a second package, so the testing module cannot import pkg/api.

Remediation

• Change the package declaration in pkg/api/fips_compliance_test.go to package api_test (the external-test convention for package api).
• Re-run .buildkite/scripts/check_ci.sh or the affected go test/go list commands to confirm the package conflict is gone.

Investigation details

Root Cause

At pkg/api/fips_compliance_test.go:9, the new test uses package api_testrt. The existing generated package is api (for example, pkg/api/client.gen.go:8), and the failing import path is reached from testing/e2e/api_version/client_api_current.go:39. External Go test files must use the package name plus the _test suffix; api_testrt is not recognized as the external test package for api, producing the reported mixed-package error.

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/15531
• Job/step: Run check-ci / .buildkite/scripts/check_ci.sh
• Key log excerpt: e2e/api_version/client_api_current.go:39:2: found packages api (client.gen.go) and api_testrt (fips_compliance_test.go) in .../pkg/api

Verification

• Not run locally: the failure is directly identified from the Buildkite log and PR diff; the PR branch is not checked out in the analysis workspace.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mergify]

This pull request is now in conflicts. Could you fix it @macdewee? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b drosiek-fips-native-go upstream/drosiek-fips-native-go
git merge upstream/main
git push upstream drosiek-fips-native-go