[18.0-fr6] Use both ssl pin commits

ci/playbooks/content_provider/pre.yml

@@ -13,6 +13,9 @@
       ansible.builtin.include_role:
         name: prepare-workspace
 
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: ../tasks/pin_openssl.yml
+
     - name: Install ansible-core
       become: true
       ansible.builtin.package:

ci/playbooks/e2e-prepare.yml

@@ -7,6 +7,9 @@
       ansible.builtin.include_role:
         name: prepare-workspace
 
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: tasks/pin_openssl.yml
+
     - name: Create zuul-output directory
       ansible.builtin.file:
         path: "{{ ansible_user_dir }}/zuul-output/logs"

ci/playbooks/pre-doc.yml

@@ -7,6 +7,9 @@
       ansible.builtin.include_role:
         name: prepare-workspace
 
+    - name: Pin OpenSSL for job TLS downloads
+      ansible.builtin.include_tasks: tasks/pin_openssl.yml
+
     - name: Output pip related things
       ansible.builtin.command:
         cmd: pip --version

ci/playbooks/tasks/pin_openssl.yml

@@ -0,0 +1,15 @@
+- name: Pin OpenSSL to 3.5.5
+  become: true
+  register: _cifmw_pin_openssl
+  changed_when: >-
+    _cifmw_pin_openssl.rc == 0 and
+    "Nothing to do." not in (_cifmw_pin_openssl.stdout | default(""))
+  failed_when: false
+  ansible.builtin.command:
+    argv:
+      - dnf
+      - downgrade
+      - --allowerasing
+      - -y
+      - openssl-3.5.5
+      - openssl-libs-3.5.5

scripts/setup_molecule

@@ -25,6 +25,12 @@ export PROJECT_DIR="$(dirname $(dirname $(readlink -f ${BASH_SOURCE[0]})))"
 #                  system ansible may be installed.
 export ANSIBLE_SKIP_CONFLICT_CHECK=1
 
+# Workaround: OpenSSL >= 3.5.6 introduced strict DER validation that rejects
+# some real-world CA root certs (openssl/openssl#25023), breaking Ansible's
+# url lookup plugin. Pin to 3.5.5 until the issue is resolved upstream.
+# Remove this block once openssl/openssl#25023 is fixed.
+sudo dnf downgrade --allowerasing -y openssl-3.5.5 openssl-libs-3.5.5 2>/dev/null || true
+
 PIP_INSTALL_ARGUMENTS="-U -r ${PROJECT_DIR}/test-requirements.txt"
 case ${USE_VENV-'yes'} in
     y|yes|true)