The trixie-backports binary package appears to contain an incorrect
lib/fips140/v1.26.0.zip file which does not match the checksum recorded
in fips140.sum.

As a result, GOFIPS140=v1.26.0 fails verification and prevents builds.

Reproducer:

  GOFIPS140=v1.26.0 go version

or

  GOFIPS140=v1.26.0 go build

The error is:

  go: verifying GOFIPS140=v1.26.0:
  SHA-256 hash of v1.26.0.zip is
  125641ee878e91c9f411c6245bab097c9240f1ce85e207e2ff506f84ac5de3b8,
  want
  9b28f847fdf1db4a36cb2b2f8ec09443c039383f085630a03ecfaddf6db7ea23

Investigation:

Installed package version:

  golang-1.27-src 1.27.1-2~bpo13+1
  golang-1.27-go  1.27.1-2~bpo13+1

Installed file checksum:

  sha256sum /usr/share/go-1.27/lib/fips140/v1.26.0.zip

  125641ee878e91c9f411c6245bab097c9240f1ce85e207e2ff506f84ac5de3b8

fips140.sum contains:

  v1.26.0.zip
  9b28f847fdf1db4a36cb2b2f8ec09443c039383f085630a03ecfaddf6db7ea23

The installed file matches the package md5sums:

  md5sum /usr/share/go-1.27/lib/fips140/v1.26.0.zip
  grep v1.26.0 /var/lib/dpkg/info/golang-1.27-src.md5sums

  bc92a869df9d3dfb12b958c8214c5cfd

The installed file also matches a freshly downloaded binary package:

  apt download golang-1.27-src
  dpkg-deb -x golang-1.27-src_1.27.1-2~bpo13+1_all.deb /tmp/go-src
  sha256sum /tmp/go-src/usr/share/go-1.27/lib/fips140/v1.26.0.zip

  125641ee878e91c9f411c6245bab097c9240f1ce85e207e2ff506f84ac5de3b8

However, the source package contains a different file:

  apt source golang-1.27=1.27.1-2~bpo13+1

  sha256sum golang-1.27-1.27.1/lib/fips140/v1.26.0.zip

  9b28f847fdf1db4a36cb2b2f8ec09443c039383f085630a03ecfaddf6db7ea23

which matches fips140.sum.

Therefore:

  Source package ZIP:
      9b28f847fdf1db4a36cb2b2f8ec09443c039383f085630a03ecfaddf6db7ea23

  Binary package ZIP:
      125641ee878e91c9f411c6245bab097c9240f1ce85e207e2ff506f84ac5de3b8

This appears to be a binary package build/backport issue. The binary
package contents do not match the source package contents and cause
GOFIPS140 verification failures.