Pin openssl to 3.5.5-3.el9 on EL9 Jenkins nodes

[Odilhao]

Summary

• openssl-3.5.7-1 on EL9 breaks TLS handling (RHEL-192424); runners are already picking it up (e.g. openssl-libs-3.5.7-1.el9.x86_64).
• Exclude the broken NVR via /etc/dnf/dnf.conf excludepkgs and force openssl/openssl-libs back to the last known-good 3.5.5-3.el9 build on EL9 Jenkins nodes.
• Follows the same workaround pattern used in theforeman/forklift#1962 and theforeman/foremanctl#632.

Test plan

• Puppet parser validate / puppet-lint pass in CI
• Apply to an EL9 Jenkins node and confirm openssl/openssl-libs downgrade to 3.5.5-3.el9 and stay pinned across subsequent runs

[evgeni]

What problem are we solving by downgrading OpenSSL on the Jenkins nodes?

[ehelms]

What problem are we solving by downgrading OpenSSL on the Jenkins nodes?

The same problem we see everywhere else:

21:55:50  + ansible-playbook -i localhost centos.org/ansible/jenkins_job.yml -e @extra_vars-1783475747970-826bbb65-289a-46ab-b956-0ec6c19adaac.yaml -e @extra_vars-1783475749019-114f9184-0d9c-4e49-a42d-7a9beb948bdb.yaml
21:55:50  [WARNING]: Unable to parse /home/jenkins/workspace/foreman-nightly-rpm-
21:55:50  pipeline/localhost as an inventory source
21:55:50  [WARNING]: No inventory was parsed, only implicit localhost is available
21:55:50  [WARNING]: provided hosts list is empty, only localhost is available. Note that
21:55:50  the implicit localhost does not match 'all'
21:55:50  
21:55:50  PLAY [localhost] ***************************************************************
21:55:50  
21:55:50  TASK [Start Jenkins job] *******************************************************
21:55:51  fatal: [localhost]: FAILED! => {"changed": false, "content": "", "elapsed": 0, "msg": "Status code was -1 and not [201]: Connection failure: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4192)", "redirected": false, "status": -1, "url": "https://jenkins-foreman.apps.ocp.cloud.ci.centos.org//job/foreman-pipeline-foreman-rpm-nightly/buildWithParameters?TOKEN=&expected_version="}

https://ci.theforeman.org/job/foreman-nightly-rpm-pipeline/3187/console

[Odilhao]

What problem are we solving by downgrading OpenSSL on the Jenkins nodes?

The failure on this job.

https://ci.theforeman.org/job/foreman-nightly-rpm-pipeline/3187/

Since we do have openssl-libs-3.5.7-1.el9.x86_64 in the node, we are being affected by the asn1 problem.

[evgeni]

Ha! Of course! Thanks for the context