Add ms_tls13kdf tag when requirefips is passed (#44227) (#44279)

Add ms_tls13kdf tag when requirefips is passed

(cherry picked from commit fff4a78)

Co-authored-by: Michel Laterman <[email protected]>

Author: mergify[bot]

dev-tools/mage/fips-settings.yaml

@@ -10,6 +10,7 @@ compile:
     GOEXPERIMENT: systemcrypto
   tags:
     - requirefips
+    - ms_tls13kdf
   platforms:
     # If the platform list changes, update the platforms for FIPS packaging in CI pipelines '.buildkite/**/pipeline.<beat>.yml' and '.buildkite/packaging-pipeline.yml'
     - linux/amd64

dev-tools/mage/gotest.go

@@ -124,11 +124,11 @@ func fetchGoPackages(module string) ([]string, error) {
 
 // testTagsFromEnv gets a list of comma-separated tags from the TEST_TAGS
 // environment variables, e.g: TEST_TAGS=aws,azure.
-// If the FIPS env var is set to true, the requirefips tag is injected.
+// If the FIPS env var is set to true, the requirefips and ms_tls13kdf tags are injected.
 func testTagsFromEnv() []string {
 	tags := strings.Split(strings.Trim(os.Getenv("TEST_TAGS"), ", "), ",")
 	if FIPSBuild {
-		tags = append(tags, "requirefips")
+		tags = append(tags, "requirefips", "ms_tls13kdf")
 	}
 	return tags
 }

dev-tools/packaging/package_test.go

@@ -833,6 +833,7 @@ func checkFIPS(t *testing.T, beatName, path string) {
 		case "-tags":
 			foundTags = true
 			require.Contains(t, setting.Value, "requirefips")
+			require.Contains(t, setting.Value, "ms_tls13kdf")
 			continue
 		case "GOEXPERIMENT":
 			foundExperiment = true