build,deps,tools: prepare to update to OpenSSL 3.5

[richardlau]

• test: prepare test-crypto-rsa-dsa for newer OpenSSL
  Update parallel/test-crypto-rsa-dsa to prepare for updating
  deps/openssl to later versions of OpenSSL which support implicit
  rejections with RSA_PKCS1_PADDING.
• build,deps,tools: prepare to update to OpenSSL 3.5
  Update the updater script and files under deps/openssl/config in
  preparation for updating deps/openssl to OpenSSL 3.5.

---

Note that this PR does not do the actual upgrade -- that should be handled by running the workflow after this lands.

This co-depends on #58099, which needs to land before the updater script is run (it shouldn't matter in which order they land, but both that PR and this one are needed for the files in deps/openssl/config to be regenerated).

[nodejs-github-bot]

Review requested:

• @nodejs/gyp
• @nodejs/security-wg

[aduh95]

Can we backport this to LTS? Should we add the lts-watch labels?

[richardlau]

Can we backport this to LTS? Should we add the lts-watch labels?

I've stuck a watch label for Node.js 22 as we have to update that at some point because OpenSSL 3.0 reaches End-of-Life in September 2026 which is before the End-of-Life of Node.js 22 (end of April 2027).

For Node.js 20 we could stay on OpenSSL 3.0 as Node.js 20 will reach End-of-Life at the end of April 2026 which is prior to End-of-Life of OpenSSL 3.0. But we can have a separate discussion about how we would manage updates of OpenSSL across all of our LTS versions.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.21%. Comparing base (2b4f554) to head (6abfd51).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #58100   +/-   ##
=======================================
  Coverage   90.20%   90.21%           
=======================================
  Files         630      630           
  Lines      186446   186446           
  Branches    36619    36624    +5     
=======================================
+ Hits       168190   168196    +6     
+ Misses      11053    11047    -6     
  Partials     7203     7203           

see 34 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66530/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66532/

[richardlau]

Moving this to draft. I ran a CI on https://github.com/richardlau/node-1/tree/openssl-3.5 (from which the commits in this PR are based) and that has failed to build on Windows: https://ci.nodejs.org/job/node-test-commit/79522/

I suspect we'll need to add even more entries into deps/openssl/config/Makefile_VC-WIN* for the missing *.asm file(s). (There must be a better way of doing this than manually editing.)