Workaround broken openssl 3.5.7-1 on EL9

openssl-3.5.7-1.el9 has an ASN.1 regression (clean EOF at an object
boundary raises ASN1_R_NOT_ENOUGH_DATA instead of succeeding), which
breaks any TLS client relying on that behavior -- e.g. ansible's uri
module and dnf/rpm HTTPS fetches. Exclude the broken build and pin to
the last known-good NVR until the upstream fix (openssl/openssl#31818)
merges and ships in a CentOS Stream 9 release.

See: https://issues.redhat.com/browse/RHEL-192424

Author: ogajduse

roles/vagrant_workarounds/tasks/main.yml

@@ -13,3 +13,24 @@
   shell: rm -f /boot/*-generic.img
   when:
     - ansible_facts['os_family'] == 'Debian'
+
+# workaround for https://issues.redhat.com/browse/RHEL-192424
+- name: don't install broken openssl on EL9
+  community.general.ini_file:
+    path: /etc/dnf/dnf.conf
+    section: main
+    option: excludepkgs
+    value: 'openssl-3.5.7-1.*,openssl-libs-3.5.7-1.*,openssl-fips-provider-3.5.7-1.*'
+  when:
+    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_facts['distribution_major_version'] == '9'
+
+- name: force downgrade to openssl-3.5.5-3.el9
+  ansible.builtin.package:
+    name:
+      - openssl-3.5.5-3.el9
+      - openssl-libs-3.5.5-3.el9
+    state: present
+  when:
+    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_facts['distribution_major_version'] == '9'