Bump base images to 0.0.50 for the FIPS TLS 1.3 fix

Merge order: base-images!175 must merge and be tagged v0.0.50 before this MR can merge. The ubi-go image is what carries the fix. This MR only repoints Runner at it and contains no fix of its own.

The ubi-go toolchain in base images 0.0.49 and earlier applies the golang-fips hkdf-expandlabel-read patch, which panics crypto/tls when the OpenSSL FIPS provider cannot derive the exact HKDF-Expand-Label output length. Every FIPS binary built with that toolchain dies on its first TLS 1.3 handshake on a FIPS-enabled host. Reported as #39707 (closed).

  • Bump RUNNER_IMAGES_VERSION from 0.0.49 to 0.0.50 in .gitlab/ci/_common.gitlab-ci.yml. That is the only reference to the tag in this repo.
  • The patch removal itself lands in base-images!175; this MR only consumes the resulting image.

Merge order

ubi-go:0.0.50 is 0.0.49 rebuilt with the patch deleted. It does not exist yet, so this MR stays in Draft until it does.

  1. base-images!175 merges, deleting the patch from dockerfiles/ci/Dockerfile.go.
  2. base-images is tagged v0.0.50, which builds and publishes ubi-go:0.0.50. Tracked in base-images#13.
  3. This MR comes out of Draft and merges.

Merging before step 2 breaks CI here, because the image tag cannot be pulled.

Affected releases

Every 19.x FIPS artifact carries the defect, so all three maintained stable branches need the same bump. Each backport is its own MR.

Branch Current MR Toolchain effect
main 0.0.49 this MR none, go1.26.5 both sides
19-3-stable 0.0.48 !7282 (merged) none, go1.26.5 both sides
19-2-stable 0.0.47 !7283 (merged) go1.26.4 to go1.26.5
19-1-stable 0.0.43 !7284 (merged) go1.26.3 to go1.26.5
Edited by Lachlan Grant

Merge request reports

Loading
Loading