From fdbc135f9cf57599cca8aeeed947d0b736fdb197 Mon Sep 17 00:00:00 2001
From: Zachary Ware <zach@python.org>
Date: Fri, 13 Feb 2026 17:02:11 -0600
Subject: [PATCH] gh-144551: Update various CI jobs to OpenSSL 3.5 (GH-144808)

Also includes a fix to the address sanitizer build to build the `_ssl`
module against the expected OpenSSL build.
---
 .github/workflows/build.yml           | 6 +++---
 .github/workflows/reusable-macos.yml  | 4 ++--
 .github/workflows/reusable-ubuntu.yml | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f9a6fb61272..f302cb04932 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -428,7 +428,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.5.5
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@v6
@@ -539,7 +539,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.5.5
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:
@@ -574,7 +574,7 @@ jobs:
       run: |
         echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
     - name: Configure CPython
-      run: ./configure --config-cache --with-address-sanitizer --without-pymalloc
+      run: ./configure --config-cache --with-address-sanitizer --without-pymalloc --with-openssl="$OPENSSL_DIR"
     - name: Build CPython
       run: make -j4
     - name: Display build info
diff --git a/.github/workflows/reusable-macos.yml b/.github/workflows/reusable-macos.yml
index 7eef66bd9d9..6afbf6595d9 100644
--- a/.github/workflows/reusable-macos.yml
+++ b/.github/workflows/reusable-macos.yml
@@ -35,7 +35,7 @@ jobs:
       run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
     - name: Install Homebrew dependencies
       run: |
-        brew install pkg-config openssl@3.0 xz gdbm tcl-tk@9 make
+        brew install pkg-config openssl@3.5 xz gdbm tcl-tk@9 make
         # Because alternate versions are not symlinked into place by default:
         brew link --overwrite tcl-tk@9
     - name: Configure CPython
@@ -50,7 +50,7 @@ jobs:
           --enable-safety \
           ${{ inputs.free-threading && '--disable-gil' || '' }} \
           --prefix=/opt/python-dev \
-          --with-openssl="$(brew --prefix openssl@3.0)"
+          --with-openssl="$(brew --prefix openssl@3.5)"
     - name: Build CPython
       if : ${{ inputs.free-threading || inputs.os != 'macos-15-intel' }}
       run: gmake -j8
diff --git a/.github/workflows/reusable-ubuntu.yml b/.github/workflows/reusable-ubuntu.yml
index ad725e92f2b..03f41069b84 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.5.5
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps: