From 0c9ef181524db045c55e63b1e0b3a3e4caa11e74 Mon Sep 17 00:00:00 2001 From: Michael Burke Date: Wed, 8 Jul 2026 11:51:47 -0400 Subject: [PATCH 1/2] Revert "Pin OpenSSL" This reverts commit 95353339bd4d73399b96ff02aa2b24e9cd86b8bd. Signed-off-by: Michael Burke --- ci/playbooks/content_provider/pre.yml | 3 --- ci/playbooks/e2e-prepare.yml | 3 --- ci/playbooks/pre-doc.yml | 3 --- ci/playbooks/tasks/pin_openssl.yml | 15 --------------- 4 files changed, 24 deletions(-) delete mode 100644 ci/playbooks/tasks/pin_openssl.yml diff --git a/ci/playbooks/content_provider/pre.yml b/ci/playbooks/content_provider/pre.yml index 1fab7fb1d..35aa5f712 100644 --- a/ci/playbooks/content_provider/pre.yml +++ b/ci/playbooks/content_provider/pre.yml @@ -13,9 +13,6 @@ ansible.builtin.include_role: name: prepare-workspace - - name: Pin OpenSSL for job TLS downloads - ansible.builtin.include_tasks: ../tasks/pin_openssl.yml - - name: Install ansible-core become: true ansible.builtin.package: diff --git a/ci/playbooks/e2e-prepare.yml b/ci/playbooks/e2e-prepare.yml index a4e06f89f..fdc8588ad 100644 --- a/ci/playbooks/e2e-prepare.yml +++ b/ci/playbooks/e2e-prepare.yml @@ -7,9 +7,6 @@ ansible.builtin.include_role: name: prepare-workspace - - name: Pin OpenSSL for job TLS downloads - ansible.builtin.include_tasks: tasks/pin_openssl.yml - - name: Create zuul-output directory ansible.builtin.file: path: "{{ ansible_user_dir }}/zuul-output/logs" diff --git a/ci/playbooks/pre-doc.yml b/ci/playbooks/pre-doc.yml index 8242440c9..4bd9ac6a6 100644 --- a/ci/playbooks/pre-doc.yml +++ b/ci/playbooks/pre-doc.yml @@ -7,9 +7,6 @@ ansible.builtin.include_role: name: prepare-workspace - - name: Pin OpenSSL for job TLS downloads - ansible.builtin.include_tasks: tasks/pin_openssl.yml - - name: Output pip related things ansible.builtin.command: cmd: pip --version diff --git a/ci/playbooks/tasks/pin_openssl.yml b/ci/playbooks/tasks/pin_openssl.yml deleted file mode 100644 index 6285c85ed..000000000 --- a/ci/playbooks/tasks/pin_openssl.yml +++ /dev/null @@ -1,15 +0,0 @@ -- name: Pin OpenSSL to 3.5.5 - become: true - register: _cifmw_pin_openssl - changed_when: >- - _cifmw_pin_openssl.rc == 0 and - "Nothing to do." not in (_cifmw_pin_openssl.stdout | default("")) - failed_when: false - ansible.builtin.command: - argv: - - dnf - - downgrade - - --allowerasing - - -y - - openssl-3.5.5 - - openssl-libs-3.5.5 From c1349d2520fd57bd7e410af3d32200c77f80e059 Mon Sep 17 00:00:00 2001 From: Michael Burke Date: Wed, 8 Jul 2026 11:51:56 -0400 Subject: [PATCH 2/2] [setup_molecule] Revert "Workaround OpenSSL 3.5.x breaking Ansible url lookups" This reverts commit 1bc9f55bb804f3132a9fea29a6f5010a95bbc6cf. Signed-off-by: Michael Burke --- scripts/setup_molecule | 6 ------ 1 file changed, 6 deletions(-) diff --git a/scripts/setup_molecule b/scripts/setup_molecule index c798adb18..36cee7fa9 100755 --- a/scripts/setup_molecule +++ b/scripts/setup_molecule @@ -25,12 +25,6 @@ export PROJECT_DIR="$(dirname $(dirname $(readlink -f ${BASH_SOURCE[0]})))" # system ansible may be installed. export ANSIBLE_SKIP_CONFLICT_CHECK=1 -# Workaround: OpenSSL >= 3.5.6 introduced strict DER validation that rejects -# some real-world CA root certs (openssl/openssl#25023), breaking Ansible's -# url lookup plugin. Pin to 3.5.5 until the issue is resolved upstream. -# Remove this block once openssl/openssl#25023 is fixed. -sudo dnf downgrade --allowerasing -y openssl-3.5.5 openssl-libs-3.5.5 2>/dev/null || true - PIP_INSTALL_ARGUMENTS="-U -r ${PROJECT_DIR}/test-requirements.txt" case ${USE_VENV-'yes'} in y|yes|true)