update Makefile to set a crypto flag

Makefile

@@ -1,9 +1,14 @@
 # Ensure go bin path is in path (especially for CI)
 PATH := $(PATH):$(GOPATH)/bin
 
+# include script to possibly set a crypto flag for older machines
+include crypto_adx_flag.mk
+
+CGO_FLAG := CGO_CFLAGS=$(CRYPTO_FLAG)
+
 .PHONY: test
 test:
-	GO111MODULE=on go test -coverprofile=coverage.txt ./...
+	GO111MODULE=on $(CGO_FLAG) go test -coverprofile=coverage.txt ./...
 
 .PHONY: coverage
 coverage: test

crypto/cloudkms/signer.go

@@ -88,8 +88,8 @@ func (s *Signer) Sign(message []byte) ([]byte, error) {
 			DataCrc32C: checksum(message),
 		}
 	} else {
-		// this is guaranteed to only return supported hash algos by KMS
-		// since `s.hashAlgo` is guaranteed to be supported during signer creation
+		// this is guaranteed to only return supported hash algos by KMS,
+		// since `s.hashAlgo` has been checked when the signer object was created.
 		hasher, err := crypto.NewHasher(s.hashAlgo)
 		if err != nil {
 			return nil, fmt.Errorf("cloudkms: failed to sign: %w", err)

crypto/crypto.go

@@ -118,7 +118,6 @@ func NewInMemorySigner(privateKey PrivateKey, hashAlgo HashAlgorithm) (InMemoryS
 			privateKey.Algorithm(), hashAlgo)
 	}
 
-	// The error is ignored because the hash algorithm is valid at this point
 	hasher, err := NewHasher(hashAlgo)
 	if err != nil {
 		return InMemorySigner{}, fmt.Errorf("signer with hasher %s can't be instantiated with this function", hashAlgo)

crypto_adx_flag.mk

@@ -0,0 +1,25 @@
+# This script can be imported by Makefiles in order to set the `CRYPTO_FLAG` automatically.
+# The `CRYPTO_FLAG` is a Go command flag that should be used when the machine's CPU executing 
+# the command may not support ADX instructions.
+# For new machines that support ADX instructions, the `CRYPTO_FLAG` flag is not needed (or set
+# to an empty string).  
+
+# First detect ADX support:
+# `ADX_SUPPORT` is 1 if ADX instructions are supported on the current machine and 0 otherwise.
+ifeq ($(shell uname -s),Linux)
+# detect ADX support on the CURRENT linux machine.
+	ADX_SUPPORT := $(shell if ([ -f "/proc/cpuinfo" ] && grep -q -e '^flags.*\badx\b' /proc/cpuinfo); then echo 1; else echo 0; fi)
+else
+# on non-linux machines, set the flag to 1 by default
+	ADX_SUPPORT := 1
+endif
+
+# Then, set `CRYPTO_FLAG`
+# the crypto package uses BLST source files underneath which may use ADX instructions.
+ifeq ($(ADX_SUPPORT), 1)
+# if ADX instructions are supported on the current machine, default is to use a fast ADX implementation 
+	CRYPTO_FLAG := ""
+else
+# if ADX instructions aren't supported, this CGO flags uses a slower non-ADX implementation 
+	CRYPTO_FLAG := "-O -D__BLST_PORTABLE__"
+endif