[3.13] gh-158010: Update OpenSSL in binaries and CI from 3.0 to 3.5 (#158015)

Includes addition of `Modules/_ssl_data*.h` definitions backported from 3.14's `Modules/_ssl_data_35.h`.
(adapted from commit cf52673)
Co-authored-by: Petr Viktorin <encukou@gmail.com>

Author: zware

.github/workflows/build.yml

@@ -378,7 +378,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -485,7 +485,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:

.github/workflows/reusable-macos.yml

@@ -50,7 +50,7 @@ jobs:
           --with-pydebug \
           ${{ inputs.free-threading && '--disable-gil' || '' }} \
           --prefix=/opt/python-dev \
-          --with-openssl="$(brew --prefix openssl@3.0)"
+          --with-openssl="$(brew --prefix openssl@3.5)"
     - name: Build CPython
       run: make -j8
     - name: Display build info

.github/workflows/reusable-ubuntu.yml

@@ -25,7 +25,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

Android/android.py

@@ -221,7 +221,7 @@ def unpack_deps(host, prefix_dir, cache_dir):
     for name_ver in [
         "bzip2-1.0.8-3",
         "libffi-3.4.4-3",
-        "openssl-3.0.22-0",
+        "openssl-3.5.8-0",
         "sqlite-3.53.4-0",
         "xz-5.4.6-1"
     ]:

Mac/BuildScript/README.rst

@@ -73,7 +73,7 @@ download them.
 
     - builds the following third-party libraries
 
-        * OpenSSL 3.0.x
+        * OpenSSL 3.5.x
         * Tcl/Tk 8.6.x
         * NCurses
         * SQLite

Mac/BuildScript/build-installer.py

@@ -246,9 +246,9 @@ def library_recipes():
 
     result.extend([
           dict(
-              name="OpenSSL 3.0.22",
-              url="https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz",
-              checksum="67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81",
+              name="OpenSSL 3.5.8",
+              url="https://github.com/openssl/openssl/releases/download/openssl-3.5.8/openssl-3.5.8.tar.gz",
+              checksum="a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2",
               buildrecipe=build_universal_openssl,
               configure=None,
               install=None,

Misc/Brewfile

@@ -1,6 +1,6 @@
 brew "gdbm"
 brew "mpdecimal"
-brew "openssl@3.0"
+brew "openssl@3.5"
 brew "pkg-config"
 brew "tcl-tk@8"
 brew "xz"

Misc/NEWS.d/next/Build/2026-08-26-16-10-15.gh-issue-156369.55jGEj.rst

@@ -0,0 +1,2 @@
+Updated Android builds to use OpenSSL 3.5.8, jumping from the 3.0 series
+to 3.5 after 3.0's end of public support in September 2026.