From ece77572fa731ace99bb5540606da9c5f21a517e Mon Sep 17 00:00:00 2001 From: rabi Date: Tue, 7 Jul 2026 15:23:06 +0530 Subject: [PATCH] Pin OpenSSL Change-Id: Ib0b1f31c59984dcac63f72199ccbe3180df3dd9f Signed-off-by: rabi --- ci/playbooks/content_provider/pre.yml | 3 +++ ci/playbooks/e2e-prepare.yml | 3 +++ ci/playbooks/pod-jobs.yml | 3 +++ ci/playbooks/pre-doc.yml | 3 +++ ci/playbooks/tasks/pin_openssl.yml | 15 +++++++++++++++ 5 files changed, 27 insertions(+) create mode 100644 ci/playbooks/tasks/pin_openssl.yml diff --git a/ci/playbooks/content_provider/pre.yml b/ci/playbooks/content_provider/pre.yml index 35aa5f712..1fab7fb1d 100644 --- a/ci/playbooks/content_provider/pre.yml +++ b/ci/playbooks/content_provider/pre.yml @@ -13,6 +13,9 @@ ansible.builtin.include_role: name: prepare-workspace + - name: Pin OpenSSL for job TLS downloads + ansible.builtin.include_tasks: ../tasks/pin_openssl.yml + - name: Install ansible-core become: true ansible.builtin.package: diff --git a/ci/playbooks/e2e-prepare.yml b/ci/playbooks/e2e-prepare.yml index fdc8588ad..a4e06f89f 100644 --- a/ci/playbooks/e2e-prepare.yml +++ b/ci/playbooks/e2e-prepare.yml @@ -7,6 +7,9 @@ ansible.builtin.include_role: name: prepare-workspace + - name: Pin OpenSSL for job TLS downloads + ansible.builtin.include_tasks: tasks/pin_openssl.yml + - name: Create zuul-output directory ansible.builtin.file: path: "{{ ansible_user_dir }}/zuul-output/logs" diff --git a/ci/playbooks/pod-jobs.yml b/ci/playbooks/pod-jobs.yml index a9cb1f653..a1d75f685 100644 --- a/ci/playbooks/pod-jobs.yml +++ b/ci/playbooks/pod-jobs.yml @@ -2,6 +2,9 @@ - name: Run light checks in pod hosts: all tasks: + - name: Pin OpenSSL for job TLS downloads + ansible.builtin.include_tasks: tasks/pin_openssl.yml + - name: Install packages become: true ansible.builtin.package: diff --git a/ci/playbooks/pre-doc.yml b/ci/playbooks/pre-doc.yml index 4bd9ac6a6..8242440c9 100644 --- a/ci/playbooks/pre-doc.yml +++ b/ci/playbooks/pre-doc.yml @@ -7,6 +7,9 @@ ansible.builtin.include_role: name: prepare-workspace + - name: Pin OpenSSL for job TLS downloads + ansible.builtin.include_tasks: tasks/pin_openssl.yml + - name: Output pip related things ansible.builtin.command: cmd: pip --version diff --git a/ci/playbooks/tasks/pin_openssl.yml b/ci/playbooks/tasks/pin_openssl.yml new file mode 100644 index 000000000..6285c85ed --- /dev/null +++ b/ci/playbooks/tasks/pin_openssl.yml @@ -0,0 +1,15 @@ +- name: Pin OpenSSL to 3.5.5 + become: true + register: _cifmw_pin_openssl + changed_when: >- + _cifmw_pin_openssl.rc == 0 and + "Nothing to do." not in (_cifmw_pin_openssl.stdout | default("")) + failed_when: false + ansible.builtin.command: + argv: + - dnf + - downgrade + - --allowerasing + - -y + - openssl-3.5.5 + - openssl-libs-3.5.5