freebsd: plumb in systemcrypto support for FreeBSD

cryptobackend/aes/aes_linux.go → cryptobackend/aes/aes_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package aes
 

cryptobackend/aes/gcm/gcm_linux.go → cryptobackend/aes/gcm/gcm_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package gcm
 

cryptobackend/backend_linux.go → cryptobackend/backend_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package backend
 

cryptobackend/bbig/big_linux.go → cryptobackend/bbig/big_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package bbig
 

cryptobackend/chacha20poly1305/chacha20poly1305_linux.go → cryptobackend/chacha20poly1305/chacha20poly1305_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package chacha20poly1305
 

cryptobackend/des/des_linux.go → cryptobackend/des/des_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package des
 

cryptobackend/drbg/rand_linux.go → cryptobackend/drbg/rand_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package drbg
 

cryptobackend/dsa/dsa_linux.go → cryptobackend/dsa/dsa_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package dsa
 

cryptobackend/ecdh/ecdh_linux.go → cryptobackend/ecdh/ecdh_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package ecdh
 

cryptobackend/ecdsa/ecdsa_linux.go → cryptobackend/ecdsa/ecdsa_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package ecdsa
 

cryptobackend/ed25519/ed25519_linux.go → cryptobackend/ed25519/ed25519_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package ed25519
 

cryptobackend/hash/hash_linux.go → cryptobackend/hash/hash_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package hash
 

cryptobackend/hkdf/hkdf_linux.go → cryptobackend/hkdf/hkdf_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package hkdf
 

cryptobackend/hmac/hmac_linux.go → cryptobackend/hmac/hmac_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package hmac
 

cryptobackend/internal/fips140state/systemfips_linux.go → cryptobackend/internal/fips140state/systemfips_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package fips140state
 

cryptobackend/internal/opensslsetup/opensslsetup_linux.go → cryptobackend/internal/opensslsetup/opensslsetup_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 // opensslsetup is a package that initializes the OpenSSL library.
 // It doesn't export any symbol, but blank importing it has the

cryptobackend/md5/md5_linux.go → cryptobackend/md5/md5_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package md5
 

cryptobackend/mldsa/mldsa_linux.go → cryptobackend/mldsa/mldsa_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package mldsa
 

cryptobackend/mlkem/mlkem_linux.go → cryptobackend/mlkem/mlkem_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package mlkem
 

cryptobackend/pbkdf2/pbkdf2_linux.go → cryptobackend/pbkdf2/pbkdf2_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package pbkdf2
 

cryptobackend/rc4/rc4_linux.go → cryptobackend/rc4/rc4_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package rc4
 

cryptobackend/rsa/rsa_linux.go → cryptobackend/rsa/rsa_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package rsa
 

cryptobackend/sha1/sha1_linux.go → cryptobackend/sha1/sha1_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package sha1
 

cryptobackend/sha256/sha256_linux.go → cryptobackend/sha256/sha256_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package sha256
 

cryptobackend/sha3/sha3_linux.go → cryptobackend/sha3/sha3_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package sha3
 

cryptobackend/sha512/sha512_linux.go → cryptobackend/sha512/sha512_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package sha512
 

cryptobackend/tls12/tls12_linux.go → cryptobackend/tls12/tls12_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package tls12
 

cryptobackend/tls13/tls13_linux.go → cryptobackend/tls13/tls13_openssl.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.systemcrypto
+//go:build goexperiment.opensslcrypto
 
 package tls13
 

eng/_util/cmd/updatecryptodocs/header.md

@@ -26,6 +26,11 @@ OpenSSL 3 implements all the cryptographic algorithms using [Providers](https://
 The Microsoft build of Go officially supports the built-in providers and [SCOSSL (SymCrypt provider for OpenSSL)](https://github.com/microsoft/SymCrypt-OpenSSL) v1.6.1 or later.
 SCOSSL is expected to be used with the default built-in provider enabled as a fallback (which is the case when using [Azure Linux 3](https://github.com/microsoft/AzureLinux)).
 
+### FreeBSD
+
+Since Go 1.27, the Microsoft build of Go uses the [OpenSSL crypto library](https://docs.openssl.org/3.0/man7/crypto/) on FreeBSD (`amd64` and `arm64`), the same backend as on Linux.
+The algorithm support listed in the Linux column of the tables below also applies to FreeBSD.
+
 ### macOS
 
 On macOS, the Microsoft build of Go uses [CommonCrypto](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/Common%20Crypto.3cc.html) and [CryptoKit](https://developer.apple.com/documentation/cryptokit) for cryptographic operations.

eng/doc/CrossPlatformCryptography.md

@@ -28,6 +28,11 @@ OpenSSL 3 implements all the cryptographic algorithms using [Providers](https://
 The Microsoft build of Go officially supports the built-in providers and [SCOSSL (SymCrypt provider for OpenSSL)](https://github.com/microsoft/SymCrypt-OpenSSL) v1.6.1 or later.
 SCOSSL is expected to be used with the default built-in provider enabled as a fallback (which is the case when using [Azure Linux 3](https://github.com/microsoft/AzureLinux)).
 
+### FreeBSD
+
+Since Go 1.27, the Microsoft build of Go uses the [OpenSSL crypto library](https://docs.openssl.org/3.0/man7/crypto/) on FreeBSD (`amd64` and `arm64`), the same backend as on Linux.
+The algorithm support listed in the Linux column of the tables below also applies to FreeBSD.
+
 ### macOS
 
 On macOS, the Microsoft build of Go uses [CommonCrypto](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/Common%20Crypto.3cc.html) and [CryptoKit](https://developer.apple.com/documentation/cryptokit) for cryptographic operations.

eng/doc/NocgoOpenSSL.md

@@ -1,22 +1,26 @@
 # No-cgo OpenSSL Backend
 
-This document describes how the Microsoft build of Go uses the cgo-less OpenSSL backend on Linux.
+This document describes how the Microsoft build of Go uses the cgo-less OpenSSL backend on Linux and FreeBSD.
 
 ## Overview
 
-In Go 1.27 and later, the cgo-less OpenSSL backend is part of `systemcrypto` on Linux.
+In Go 1.27 and later, the cgo-less OpenSSL backend is part of `systemcrypto` on Linux and FreeBSD.
 It is selected automatically when cgo is disabled and the target architecture is supported.
 
 > [!NOTE]
-> In Go 1.26, this backend was available as the experimental `GOEXPERIMENT=ms_nocgo_opensslcrypto` feature.
+> In Go 1.26, this backend was available as the experimental `GOEXPERIMENT=ms_nocgo_opensslcrypto` feature on Linux only.
 >
 > In Go 1.27, that experiment has been removed because the cgo-less backend is selected automatically when needed.
+>
+> FreeBSD support was added in Go 1.27.
 
 This allows the use of OpenSSL without requiring cgo.
 
 ## Supported architectures
 
-The cgo-less OpenSSL backend is supported on the following architectures:
+The cgo-less OpenSSL backend is supported on the following architectures.
+
+On Linux:
 
 - 386
 - **amd64**
@@ -27,6 +31,11 @@ The cgo-less OpenSSL backend is supported on the following architectures:
 - riscv64
 - s390x (added in Go 1.27)
 
+On FreeBSD (added in Go 1.27):
+
+- **amd64**
+- **arm64**
+
 The set of supported architectures is limited because each architecture requires a unique assembly implementation to call OpenSSL.
 Architectures are added based on demand and available resources.
 To see existing requests or request support for additional architectures, use the [![](https://img.shields.io/github/labels/microsoft/go/Area-Nocgo)](https://github.com/microsoft/go/labels/Area-Nocgo) label.

eng/doc/fips/README.md

@@ -119,6 +119,7 @@ The `systemcrypto` experiment uses platform-specific code via build constraints.
 | Target platform | Library |
 | --- | --- |
 | Linux | OpenSSL |
+| FreeBSD (amd64 and arm64, since Go 1.27) | OpenSSL |
 | Windows | CNG |
 | macOS | CommonCrypto & CryptoKit |