Merge branch 'labkit-1-64-10-fips-native' into 'main'

Update module gitlab.com/gitlab-org/labkit to v1.64.11

See merge request https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/1523

Merged-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Approved-by: James Liu <jliu@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Jason Plum <jplum@gitlab.com>

Author: 2 people

go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	gitlab.com/gitlab-org/cells/topology-service v0.0.0-20260522095121-2c761c2e9850
 	gitlab.com/gitlab-org/gitaly/v18 v18.9.0-rc4
-	gitlab.com/gitlab-org/labkit v1.64.8
+	gitlab.com/gitlab-org/labkit v1.64.11
 	gitlab.com/gitlab-org/labkit/v2 v2.3.0
 	golang.org/x/crypto v0.54.0
 	golang.org/x/sync v0.22.0

go.sum

@@ -528,8 +528,8 @@ gitlab.com/gitlab-org/gitaly/v18 v18.9.0-rc4 h1:2PQlCQF5ioVdmcjY6Ut8zxwFY2TIgHWn
 gitlab.com/gitlab-org/gitaly/v18 v18.9.0-rc4/go.mod h1:ijDPC9GyV3UdmrZG4LiBQJyMjOuzLcbH5AuQ8GpSSIk=
 gitlab.com/gitlab-org/go/reopen v1.0.0 h1:6BujZ0lkkjGIejTUJdNO1w56mN1SI10qcVQyQlOPM+8=
 gitlab.com/gitlab-org/go/reopen v1.0.0/go.mod h1:D6OID8YJDzEVZNYW02R/Pkj0v8gYFSIhXFTArAsBQw8=
-gitlab.com/gitlab-org/labkit v1.64.8 h1:YyYvCGf1Drkf4V+9b5hjLtOM2pOxnwDueOgR1g2/mfs=
-gitlab.com/gitlab-org/labkit v1.64.8/go.mod h1:ARZnzZ49zdjPQfoyaW8sEpZz2EDFXN4NKNblste8nhc=
+gitlab.com/gitlab-org/labkit v1.64.11 h1:DaFI+CU2IcILZ6tULuCOOHbjEh1R+orOrkdbWCgdiyw=
+gitlab.com/gitlab-org/labkit v1.64.11/go.mod h1:ARZnzZ49zdjPQfoyaW8sEpZz2EDFXN4NKNblste8nhc=
 gitlab.com/gitlab-org/labkit/v2 v2.3.0 h1:N8ULmZ9WoFOqs4dFKu8ENfN/MPgMFtZu7/qFsIBk1d0=
 gitlab.com/gitlab-org/labkit/v2 v2.3.0/go.mod h1:oeJFqS+ECV8nD+Iye0o4rDKJPS+4rVFvVzBmb+7DcxM=
 go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=

internal/sshd/server_config_test.go

@@ -372,6 +372,15 @@ func TestNonFipsDefaultAlgorithms(t *testing.T) {
 }
 
 func TestCustomAlgorithms(t *testing.T) {
+	if fips.Enabled() {
+		// Under the native Go FIPS 140-3 module, x/crypto's ssh package
+		// registers only FIPS-approved algorithms, and SetDefaults()
+		// silently drops non-approved custom choices (curve25519 kex,
+		// chacha20 ciphers, ...). Skip under any FIPS backend for
+		// consistency with the other tests in this file.
+		t.Skip("FIPS mode restricts SSH algorithms; custom non-approved algorithms are filtered by x/crypto")
+	}
+
 	customMACs := []string{"hmac-sha2-512-etm@openssh.com"}
 	customKexAlgos := []string{"curve25519-sha256", "curve25519-sha256@libssh.org"}
 	customCiphers := []string{"aes256-gcm@openssh.com"}