Backport: Skip golang-fips hkdf-expandlabel-read patch in FIPS Go build (5.63.1)

Jon Dovestonrequested to merge
backport-gofips-hkdf-fix-to-5-63 into 5-63-stable

Backports b43e7013 from master to the 5-63-stable line, for the omnibus-gitlab 19-2-stable branch (which pins BUILDER_IMAGE_REVISION: 5.63.0).

Why

The golang-fips patch 005-hkdf-expandlabel-read.patch replaces the io.ReadAll-based HKDF-Expand-Label read in crypto/tls with a single r.Read of the exact output length. Any failure of the underlying OpenSSL EVP_PKEY_derive call is then converted into a fatal panic:

panic: tls: HKDF-Expand-Label invocation failed unexpectedly

This crashes TLS 1.3 servers built with this toolchain.

Fix

Delete the patch from the golang-fips checkout before full-initialize-repo.sh applies the patch set, restoring the previous (pre go1.25.9-2) behavior until a proper upstream fix is available. This reintroduces the HKDF performance regression the patch was written to fix, which we accept in order to restore function: https://issues.redhat.com/browse/OCPBUGS-79679

The patch is matched by name rather than number because its number differs between golang-fips release tags (004-hkdf-expandlabel-read on go1.25.12, 005-hkdf-expandlabel-read on go1.26.4): https://github.com/golang-fips/go/tree/go1.26.4-1-openssl-fips/patches

Plan

This is the first of three planned patch backports, one for each of the last three omnibus-gitlab stable branches:

  • 19.2 → 5.63.0 → this MR → 5.63.1 (this MR)
  • 19.1 → TBD builder version → 5-6x-stable (follow-up)
  • 19.0 → TBD builder version → 5-6x-stable (follow-up)

5-63-stable was branched from tag 5.63.0. Once this MR is reviewed and merged, a 5.63.1 tag will be cut from 5-63-stable.

Changelog: fixed

Merge request reports