Skip golang-fips hkdf-expandlabel-read patch in FIPS Go build
What does this MR do?
Removes the golang-fips hkdf-expandlabel-read patch from the FIPS Go
toolchain build (docker/snippets/go_fips) before
scripts/full-initialize-repo.sh applies the patch set.
That patch replaces the io.ReadAll-based HKDF-Expand-Label read in
crypto/tls with a single r.Read of the exact output length,
converting any failure of the underlying OpenSSL EVP_PKEY_derive
call into a fatal panic:
panic: tls: HKDF-Expand-Label invocation failed unexpectedlyThis crashes TLS 1.3 servers built with this toolchain. Removing the patch restores the pre-go1.25.9-2 behavior. We knowingly reintroduce the HKDF performance regression the patch was written to fix (https://issues.redhat.com/browse/OCPBUGS-79679) in order to restore function first.
The patch is deleted by name glob rather than number because the
numbering differs across golang-fips release tags
(https://github.com/golang-fips/go/tree/go1.26.4-1-openssl-fips/patches).
Plain rm (not rm -f) fails the build loudly once a future tag no
longer ships the patch, e.g. after the native-FIPS transition of
https://github.com/golang-fips/go/pull/359.
Only the go_fips snippet is edited; the FIPS builder Dockerfiles are
generated from it in CI, so all FIPS image variants pick this up.