# Kedify FIPS 140-3 Attestation

<table class="meta">
<tbody>
<tr><th>Release:</th><td><code>kedify/agent@v0.6.8</code></td></tr>
<tr><th>Commit:</th><td><code>c228ebc91e3c56bce8884d53d7e0e885811ca2b5</code></td></tr>
<tr><th>Generated date:</th><td><code>2026-07-31T13:03:54Z</code></td></tr>
</tbody>
</table>

## Summary

This document is a vendor self-attestation for the hardened container image variants published by Kedify in the release identified above. It describes the FIPS 140-3 cryptographic posture of those images for procurement teams and security questionnaires.

The cryptographic module embedded in Kedify binaries is the Go Cryptographic Module, and its CMVP status is [tracked by the upstream Go team](https://go.dev/security/fips140). The claim is FIPS Inside: each hardened Kedify binary embeds the validated module and routes approved cryptographic operations through it.

## Cryptographic module

| Item | Value |
| --- | --- |
| Module name | Go Cryptographic Module |
| Module version | `v1.0.0` |
| FIPS standard | FIPS 140-3 |
| CMVP status | Tracked at <https://go.dev/security/fips140> |
| Build flag (Go) | `GOFIPS140=v1.0.0` |
| Required Go version | 1.24 or later |
| External dependencies | None. The module is statically compiled into each Kedify binary. |

The CMVP cert state for the Go Cryptographic Module changes as it moves through validation. The link above is the source of truth at any given moment.

<div class="page-break"></div>

## Images in scope

The following images embed the Go FIPS 140-3 module and carry the OCI labels `io.kedify.crypto.module=go-fips140` and `io.kedify.crypto.version=v1.0.0`:

<table class="image-block">
<tr><th>Image:</th><td><code>ghcr.io/kedify/agent</code></td></tr>
<tr><th>Tag:</th><td><code>v0.6.8-hardened</code></td></tr>
<tr><th>Digest:</th><td><code>sha256:1bb8743e55fb74a91d6216fc1824d4589c271f094d7020b8fb234eca902a7d6b</code></td></tr>
</table>

Manifest digests above are pinned to this release. They will not change for this tag; a future release of the same image will publish a new digest under its own tag.

<div class="page-break"></div>

## Build evidence

For every hardened binary built for this release, `go version -m` reports the FIPS module is linked. The exact build settings are:

```
manager-hardened-amd64:
	build	-buildmode=exe
	build	CGO_ENABLED=0
	build	GOARCH=amd64
	build	GOFIPS140=v1.0.0-c2097c7c
	build	GOOS=linux
	build	vcs.revision=c228ebc91e3c56bce8884d53d7e0e885811ca2b5

manager-hardened-arm64:
	build	-buildmode=exe
	build	CGO_ENABLED=0
	build	GOARCH=arm64
	build	GOFIPS140=v1.0.0-c2097c7c
	build	GOOS=linux
	build	vcs.revision=c228ebc91e3c56bce8884d53d7e0e885811ca2b5

```

<div class="page-break"></div>

## Signing

Kedify signs this attestation document and the hardened container manifests listed above with a Cosign static keypair. The public key is published at <https://docs.kedify.io/kedify-cosign.pub>.

Verify the attestation document:

```sh
cosign verify-blob --key https://docs.kedify.io/kedify-cosign.pub \
  --signature kedify-fips-attestation-v0.6.8.md.sig kedify-fips-attestation-v0.6.8.md
```

Verify each hardened image manifest:

```sh
cosign verify --key https://docs.kedify.io/kedify-cosign.pub   ghcr.io/kedify/agent:v0.6.8-hardened
```

The signature establishes that the document or image was published by Kedify. The validated module's lab attestation is the upstream Go Cryptographic Module's CMVP record, linked above.

## Reporting and contact

Security findings related to this attestation should be sent to <support@kedify.io>.

## References

- Go Cryptographic Module CMVP status: <https://go.dev/security/fips140>
- Go FIPS 140-3 documentation: <https://go.dev/doc/security/fips140>
- Kedify FIPS compliance page: <https://docs.kedify.io/security-and-compliance/fips/>
- NIST CMVP program: <https://csrc.nist.gov/projects/cryptographic-module-validation-program>