// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

//go:build (!fips && (fips_140_2 || fips_140_3)) || (fips && !fips_140_2 && !fips_140_3) || (fips_140_2 && fips_140_3)

package constants

import "C"

// This function is the equivalent of an external (CGo) function definition,
// without implementation in any imported or built library. This results in
// a linker err if the above build constraints are satisfied:
//
//	/home/cipherboy/GitHub/cipherboy/vault-enterprise/helper/constants/fips_build_check.go:10: undefined reference to `github.com/hashicorp/vault/helper/constants.VaultFIPSBuildRequiresVersionAgnosticTagAndOneVersionTag'
//
// This indicates that a build error has occurred due to mismatched tags.
//
// In particular, we use this to enforce the following restrictions on build
// tags:
//
//   - If a versioned fips_140_* tag is specified, the unversioned tag must
//     also be.
//   - If the unversioned tag is specified, a versioned tag must be.
//   - Both versioned flags cannot be specified at the same time.
//
// In the unlikely event that a FFI implementation for this function exists
// in the future, it should be renamed to a new function which does not
// exist.
//
// This approach was chosen above the other implementation in fips_cgo_check.go
// because this version does not break static analysis tools: most tools do not
// cross the CGo boundary and thus do not know that the below function is
// missing an implementation. However, in the other file, the function call is
// not marked as CGo (in part large because the lack of a cgo build tag
// prohibits us from using the same technique) and thus it must be a Go
// declaration, that is missing.
func VaultFIPSBuildRequiresVersionAgnosticTagAndOneVersionTag()

func init() {
	VaultFIPSBuildRequiresVersionAgnosticTagAndOneVersionTag()
}