Pin OpenSSL

ci/playbooks/content_provider/pre.yml

@@ -13,6 +13,9 @@
       ansible.builtin.include_role:
         name: prepare-workspace
 
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: ../tasks/pin_openssl.yml
+
     - name: Install ansible-core
       become: true
       ansible.builtin.package:

ci/playbooks/e2e-prepare.yml

@@ -7,6 +7,9 @@
       ansible.builtin.include_role:
         name: prepare-workspace
 
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: tasks/pin_openssl.yml
+
     - name: Create zuul-output directory
       ansible.builtin.file:
         path: "{{ ansible_user_dir }}/zuul-output/logs"

ci/playbooks/pod-jobs.yml

@@ -2,6 +2,9 @@
 - name: Run light checks in pod
   hosts: all
   tasks:
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: tasks/pin_openssl.yml
+
     - name: Install packages
       become: true
       ansible.builtin.package:

ci/playbooks/pre-doc.yml

@@ -7,6 +7,9 @@
       ansible.builtin.include_role:
         name: prepare-workspace
 
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: tasks/pin_openssl.yml
+
     - name: Output pip related things
       ansible.builtin.command:
         cmd: pip --version

ci/playbooks/tasks/pin_openssl.yml

@@ -0,0 +1,15 @@
+- name: Pin OpenSSL to 3.5.5
+  become: true
+  register: _cifmw_pin_openssl
+  changed_when: >-
+    _cifmw_pin_openssl.rc == 0 and
+    "Nothing to do." not in (_cifmw_pin_openssl.stdout | default(""))
+  failed_when: false
+  ansible.builtin.command:
+    argv:
+      - dnf
+      - downgrade
+      - --allowerasing
+      - -y
+      - openssl-3.5.5
+      - openssl-libs-3.5.5