OS-8632 Update OpenSSL to 3.5 (next LTS)

[danmcd]

Not QUITE ready yet, but far enough along to compile in the strap build.

[danmcd]

One thing that I know is missing: When this patient gets opened up, we MUST also upgrade /usr/bin/openssl to be a 64-bit binary. Do not +1 or IA until that is either fixed, or a damned good reason it's not is given.

[danmcd]

Indeed openssl(1) is now only a 64-bit binary. Operationally deployed on Kebecloud and both NUCs, so far without incident.

[danmcd]

Per @jperkin I ran this test, to make sure the 3.6 certificate expiration bug was not present.

[root@moe (kebecloud) ~]# openssl version
OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)
[root@moe (kebecloud) ~]# openssl x509 -enddate -checkend $(( 86400 * 365 * 9 )) -in /opt/tools/etc/openssl/certs/mozilla-rootcert-89.pem && echo 'no expire'
notAfter=Jun  4 11:04:38 2035 GMT
Certificate will expire
[root@moe (kebecloud) ~]# openssl x509 -enddate -checkend $(( 86400 * 365 * 8 )) -in /opt/tools/etc/openssl/certs/mozilla-rootcert-89.pem && echo 'no expire'
notAfter=Jun  4 11:04:38 2035 GMT
Certificate will not expire
no expire
[root@moe (kebecloud) ~]# 

[tsoome]

I suppose there will be more testing done notes? So far it does look good IMO.

[danmcd]

I suppose there will be more testing done notes? So far it does look good IMO.

Will perform any other testing you'd like. I have "gmake test" results in the ticket.

[tsoome]

I suppose there will be more testing done notes? So far it does look good IMO.

Will perform any other testing you'd like. I have "gmake test" results in the ticket.

its all good, thanks!