Bump base images to 0.0.50 for the FIPS TLS 1.3 fix (19-2-stable)
Merge order: base-images!175 must merge and be tagged
v0.0.50before this MR can merge. Theubi-goimage is what carries the fix. This MR only repoints Runner at it and contains no fix of its own.
Backport of !7281 (merged) to 19-2-stable.
The ubi-go toolchain in base images 0.0.47 applies the golang-fips hkdf-expandlabel-read patch, which panics crypto/tls when the OpenSSL FIPS provider cannot derive the exact HKDF-Expand-Label output length. Every FIPS binary built with that toolchain dies on its first TLS 1.3 handshake on a FIPS-enabled host. Reported as #39707 (closed).
- Bump
RUNNER_IMAGES_VERSIONfrom0.0.47to0.0.50in.gitlab/ci/_common.gitlab-ci.yml. - Toolchain effect: go1.26.4 to go1.26.5, a patch release.
- The patch removal itself lands in base-images!175; this MR only consumes the resulting image.
Merge order
ubi-go:0.0.50 is 0.0.49 rebuilt with the patch deleted. It does not exist yet, so this MR stays in Draft until it does.
- base-images!175 merges, deleting the patch from
dockerfiles/ci/Dockerfile.go. - base-images is tagged
v0.0.50, which builds and publishesubi-go:0.0.50. Tracked in base-images#13. - This MR comes out of Draft and merges.
Merging before step 2 breaks CI here, because the image tag cannot be pulled.