Backport: Skip golang-fips hkdf-expandlabel-read patch in FIPS Go build (5.60.2)

Jon Dovestonrequested to merge
backport-gofips-hkdf-fix-to-5-60 into 5-60-stable

Backports b43e7013 from master to the 5-60-stable line, for the omnibus-gitlab 19-1-stable branch (which pins BUILDER_IMAGE_REVISION: 5.60.1).

Why

The golang-fips patch 004-hkdf-expandlabel-read.patch (shipped on go1.25.11-1-openssl-fips) replaces the io.ReadAll-based HKDF-Expand-Label read in crypto/tls with a single r.Read of the exact output length. Any failure of the underlying OpenSSL EVP_PKEY_derive call is then converted into a fatal panic:

panic: tls: HKDF-Expand-Label invocation failed unexpectedly

This crashes TLS 1.3 servers built with this toolchain.

Fix

Delete the patch from the golang-fips checkout before full-initialize-repo.sh applies the patch set, restoring the previous behavior until a proper upstream fix is available. This reintroduces the HKDF performance regression the patch was written to fix, which we accept in order to restore function: https://issues.redhat.com/browse/OCPBUGS-79679

The patch is matched by name rather than number because its number differs between golang-fips release tags (004-hkdf-expandlabel-read on go1.25.11, 005-hkdf-expandlabel-read on go1.26.4): https://github.com/golang-fips/go/tree/go1.25.11-1-openssl-fips/patches

Plan

Second of three planned patch backports, one for each of the last three omnibus-gitlab stable branches:

  • 19.2 → 5.63.0 → !492 (merged) → 5.63.1
  • 19.1 → 5.60.1 → this MR → 5.60.2
  • 19.0 → 5.57.1 → follow-up MR → 5.57.2

5-60-stable already existed (tip = tag 5.60.1). Once this MR is reviewed and merged, a 5.60.2 tag will be cut from 5-60-stable.

Changelog: fixed

Merge request reports