My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities provided by GNU coreutils for a long time to generate checksums. Now we need to be compliant. SHA-2 comes from FIPS-180-2, and I can't find a validation program like NIST CMVP for FIPS-180. I did see on some CMVP certifications that a Secure Hash Standard (FIPS-180) certificate was also listed, so I had hoped to find GNU holding a certification for their implementation in NIST's CMVP database, but I couldn't find one.
Can anyone point me to documentation that shows GNU coretuils is validated for FIPS-180-2 compliance? If not, I'd love suggestions for where to look for an alternative provider. I did find that Red Hat holds a certification for an OpenSSL implementation, which also lists SHA-3 and SHS certificates, Cert #3781, but that's for RHEL8 and we're on RHEL7.
Barring alternatives, is there a way to prove GNU coreutils's SHA-2 implementations are "sufficiently secure"? I feel that question is asking for trouble and a whole lot of math proofs... The GNU website doesn't say much about SHA-2. I read the source code for the utility here, but found nothing interesting.