deps: update OpenSSL to 3.0.16

[nodejs-github-bot]

This is an automated update of OpenSSL to 3.0.16.

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/65592/

[lpinca]

RSLGTM

[jasnell]

So I know, is this updating to the mainline OpenSSL or is this still the quictls fork?

[richardlau]

So I know, is this updating to the mainline OpenSSL or is this still the quictls fork?

Mainline OpenSSL. It is the result of running the GitHub OpenSSL update workflow after landing #57301.

[jasnell]

Note that the maintaining openssl doc will need to be updated also, as that still refers to the quictls fork. I've started locally trying to see how well openssl 3.5 builds. So far I've run into one issue with comp.h.in not generating. ... ok, yeah, as expected there are a number of updates that need to be made to the build files for 3.5 to build. Several new header templates to generate, other headers and impl files that have moved around.

[panva]

Note that the maintaining openssl doc will need to be updated also, as that still refers to the quictls fork. I've started locally trying to see how well openssl 3.5 builds. So far I've run into one issue with comp.h.in not generating. ... ok, yeah, as expected there are a number of updates that need to be made to the build files for 3.5 to build. Several new header templates to generate, other headers and impl files that have moved around.

Really? I've built and installed 3.5 from main and built/linked it to Node.js with 0 issues just a couple days ago. Warnings many, errors 0. macOS here, only ran tools/test.py -J crypto webcrypto tho

[jasnell]

Interesting. What process did you use for updating? I'm trying from master and it's just not building

[panva]

Interesting. What process did you use for updating? I'm trying from master and it's just not building

• cloned openssl, configure, make, make install
• in node ./configure --shared-openssl --shared-openssl-includes=/usr/local/include --shared-openssl-libpath=/usr/local/lib --node-builtin-modules-path $(pwd) --ninja and make

./node -p process.versions.openssl
3.5.0-dev

➜  node git:(main) tools/test.py -J crypto webcrypto 
[00:07|% 100|+ 135|-   0]: Done                                               

All tests passed.

[panva]

Granted first I tried just copying the openssl repo to deps but that has failed spectacularly.

[jasnell]

Ok yeah, I was going the "official" route with deps and that was... A big fail.