Skip golang-fips hkdf-expandlabel-read patch in FIPS Go build

What does this MR do?

Removes the golang-fips hkdf-expandlabel-read patch from the FIPS Go toolchain build (docker/snippets/go_fips) before scripts/full-initialize-repo.sh applies the patch set.

That patch replaces the io.ReadAll-based HKDF-Expand-Label read in crypto/tls with a single r.Read of the exact output length, converting any failure of the underlying OpenSSL EVP_PKEY_derive call into a fatal panic:

panic: tls: HKDF-Expand-Label invocation failed unexpectedly

This crashes TLS 1.3 servers built with this toolchain. Removing the patch restores the pre-go1.25.9-2 behavior. We knowingly reintroduce the HKDF performance regression the patch was written to fix (https://issues.redhat.com/browse/OCPBUGS-79679) in order to restore function first.

The patch is deleted by name glob rather than number because the numbering differs across golang-fips release tags (https://github.com/golang-fips/go/tree/go1.26.4-1-openssl-fips/patches). Plain rm (not rm -f) fails the build loudly once a future tag no longer ships the patch, e.g. after the native-FIPS transition of https://github.com/golang-fips/go/pull/359.

Only the go_fips snippet is edited; the FIPS builder Dockerfiles are generated from it in CI, so all FIPS image variants pick this up.

🤖 Generated with Claude Code

Merge request reports

Loading