Bump base images to 0.0.50 for the FIPS TLS 1.3 fix (19-2-stable)

Merge order: base-images!175 must merge and be tagged v0.0.50 before this MR can merge. The ubi-go image is what carries the fix. This MR only repoints Runner at it and contains no fix of its own.

Backport of !7281 (merged) to 19-2-stable.

The ubi-go toolchain in base images 0.0.47 applies the golang-fips hkdf-expandlabel-read patch, which panics crypto/tls when the OpenSSL FIPS provider cannot derive the exact HKDF-Expand-Label output length. Every FIPS binary built with that toolchain dies on its first TLS 1.3 handshake on a FIPS-enabled host. Reported as #39707 (closed).

  • Bump RUNNER_IMAGES_VERSION from 0.0.47 to 0.0.50 in .gitlab/ci/_common.gitlab-ci.yml.
  • Toolchain effect: go1.26.4 to go1.26.5, a patch release.
  • The patch removal itself lands in base-images!175; this MR only consumes the resulting image.

Merge order

ubi-go:0.0.50 is 0.0.49 rebuilt with the patch deleted. It does not exist yet, so this MR stays in Draft until it does.

  1. base-images!175 merges, deleting the patch from dockerfiles/ci/Dockerfile.go.
  2. base-images is tagged v0.0.50, which builds and publishes ubi-go:0.0.50. Tracked in base-images#13.
  3. This MR comes out of Draft and merges.

Merging before step 2 breaks CI here, because the image tag cannot be pulled.

Edited by Lachlan Grant

Merge request reports

Loading
Loading