Update module gitlab.com/gitlab-org/labkit to v1.64.11

What does this MR do?

Bumps gitlab.com/gitlab-org/labkit from v1.64.8 to v1.64.11 (leaves labkit/v2 untouched; it has no fips package).

Why:

• v1.64.9 splits crypto/boring usage behind boringcrypto build tags, so fips.Enabled() reports boringcrypto or the native Go crypto/fips140 module. This fixes compilation with -tags fips on native GOFIPS140 toolchains, which previously failed with:

  imports crypto/boring: build constraints exclude all Go files in .../src/crypto/boring

• v1.64.11 additionally filters out empty SSH algorithm names leaked by golang.org/x/crypto/ssh under GOFIPS builds. This matters functionally for gitlab-shell: internal/sshd/server_config.go selects SSH algorithms via labkit fips.DefaultAlgorithms().

This complements the merged Makefile guard !1516 (merged) (skip boringcrypto when GOFIPS140 selects the native module).

Known upstream follow-up

labkit labkit!598 (merged) (per-FIPS-backend SSH algorithm policy) is still open upstream. Until it lands, x/crypto's own fips140=on runtime filtering governs which algorithms survive: ssh.SetDefaults() silently drops kex algorithms that are not FIPS-approved (e.g. curve25519-sha256). See test evidence below.

Test evidence

Local, Go 1.25.12 darwin/arm64:

Command	v1.64.8 (before)	v1.64.11 (after)
go build ./...	ok	ok
go vet ./...	ok	ok
GOFIPS140=v1.0.0 go build -tags fips ./cmd/... ./internal/sshd/	compile error (imports crypto/boring: build constraints exclude all Go files)	ok
go test ./internal/sshd/ -count=1	ok	ok
go test -tags fips ./internal/sshd/ -count=1	n/a	ok
GOFIPS140=v1.0.0 go test -tags fips ./internal/sshd/ -count=1	n/a (fails to compile)	TestCustomAlgorithms fails (see below), rest pass

TestCustomAlgorithms failure under GOFIPS140=v1.0.0 is not a labkit regression — the combination could not even compile before this bump. Binaries built with GOFIPS140=v1.0.0 default to fips140=on at runtime, and x/crypto v0.54.0 then registers only FIPS-approved kex algorithms (kex.go init), so SetDefaults() filters the test's custom curve25519-sha256 kex list to nil. The same test binary passes with GODEBUG=fips140=off. Aligning test expectations per FIPS backend is part of the labkit!598 (merged) follow-up noted above.

CGO/gssapi note: tests were run with the default (no gssapi build tag) stub, as in regular local builds.

References

Related to #865 (closed)

Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s

Epic: &22761 (closed)

Milestone: 19.3 (active, due 2026-08-14)

🤖 Generated with Claude Code

Update (2026-08-13): retargeted to v1.64.11, which includes the per-FIPS-backend SSH algorithm policy from labkit!598 (merged). TestCustomAlgorithms now carries a skip guard for native FIPS 140-3 mode: under fips140=on, golang.org/x/crypto/ssh registers only FIPS-approved algorithms and SetDefaults() silently filters non-approved custom choices (e.g. curve25519-sha256 kex), so custom-algorithm passthrough cannot be asserted in that mode. With the guard, the full internal/sshd suite passes locally under GOFIPS140=v1.0.0 -tags fips.