Bump base images to 0.0.50 for the FIPS TLS 1.3 fix
Merge order: base-images!175 must merge and be tagged
v0.0.50before this MR can merge. Theubi-goimage is what carries the fix. This MR only repoints Runner at it and contains no fix of its own.
The ubi-go toolchain in base images 0.0.49 and earlier applies the golang-fips hkdf-expandlabel-read patch, which panics crypto/tls when the OpenSSL FIPS provider cannot derive the exact HKDF-Expand-Label output length. Every FIPS binary built with that toolchain dies on its first TLS 1.3 handshake on a FIPS-enabled host. Reported as #39707 (closed).
- Bump
RUNNER_IMAGES_VERSIONfrom0.0.49to0.0.50in.gitlab/ci/_common.gitlab-ci.yml. That is the only reference to the tag in this repo. - The patch removal itself lands in base-images!175; this MR only consumes the resulting image.
Merge order
ubi-go:0.0.50 is 0.0.49 rebuilt with the patch deleted. It does not exist yet, so this MR stays in Draft until it does.
- base-images!175 merges, deleting the patch from
dockerfiles/ci/Dockerfile.go. - base-images is tagged
v0.0.50, which builds and publishesubi-go:0.0.50. Tracked in base-images#13. - This MR comes out of Draft and merges.
Merging before step 2 breaks CI here, because the image tag cannot be pulled.
Affected releases
Every 19.x FIPS artifact carries the defect, so all three maintained stable branches need the same bump. Each backport is its own MR.
| Branch | Current | MR | Toolchain effect |
|---|---|---|---|
main |
0.0.49 | this MR | none, go1.26.5 both sides |
19-3-stable |
0.0.48 | !7282 (merged) | none, go1.26.5 both sides |
19-2-stable |
0.0.47 | !7283 (merged) | go1.26.4 to go1.26.5 |
19-1-stable |
0.0.43 | !7284 (merged) | go1.26.3 to go1.26.5 |