openssl: new release 3.4.0

[xnox]

Enable jitter seed source, compiled with jitterentropy-library, using
manually fetched certified build.

Enable PIE (position independent executables).

Enable executing test-suite.

Update hardening-check to expected values, no CF protection on
libcrypto, due to jitterentroply library being linked.

Fixes: #31548

[smoser]

I think this looks good.

[xnox]

Failed Packages
dotnet-8 (error | 35m36s)
falco-no-driver (error | 6m39s)
fluent-bit-3.1 (error | 18s)
freerdp (error | 1m17s)
guacamole-server (error | 0s)
istio-envoy-1.23 (error | 2m0s)
libpulsar (error | 1m40s)
nodejs-16 (error | 6m28s)
nodejs-19 (error | 6m11s)
powershell (error | 0s)
pulseaudio (error | 7s)
py3-tkinter (error | 8m10s)
tcl-tls (error | 1m32s)

World test rebuild of 200+ packages is mostly good. Will spot check above if they are openssl induced or pre-existing FTBFS.

[xnox]

Failed Packages dotnet-8 (error | 35m36s) falco-no-driver (error | 6m39s) fluent-bit-3.1 (error | 18s) freerdp (error | 1m17s) guacamole-server (error | 0s) istio-envoy-1.23 (error | 2m0s) libpulsar (error | 1m40s) nodejs-16 (error | 6m28s) nodejs-19 (error | 6m11s) powershell (error | 0s) pulseaudio (error | 7s) py3-tkinter (error | 8m10s) tcl-tls (error | 1m32s)

World test rebuild of 200+ packages is mostly good. Will spot check above if they are openssl induced or pre-existing FTBFS.

All of the above FTBFS are unrelated to openssl upgrade and are related to download errors/timeouts; gcc-14; python upgrades; uninstallable build dependencies; etc. I have fixed some of them, and others may need to open bug reports.

Overall this is good to merge now, and all the SBOM and build-time deps have been resolved in a better way since original request (by using forbidden repositories & keys).

[smoser]

thanks.

[luhring]

Thanks for the effort here! This looks much better.