Bump openssl from 3.3.2 to 4.0.0

[dependabot]

Bumps openssl from 3.3.2 to 4.0.0.

Release notes

Sourced from openssl's releases.

v4.0.0

A high-level overview is available in History.md: https://github.com/ruby/openssl/blob/master/History.md#version-400

Merged Pull Requests

• pkey: Use openssl generated pkcs8 key instead by @​samuel40791765 in ruby/openssl#830
• Various cleanups in pkey tests by @​rhenium in ruby/openssl#834
• Reduce OpenSSL::Buffering#do_write overhead by @​byroot in ruby/openssl#831
• Require LibreSSL 3.9 or later (Drop support for 3.1-3.8) by @​rhenium in ruby/openssl#836
• Require OpenSSL 1.1.0 or later (Drop support for 1.0.2) by @​rhenium in ruby/openssl#839
• Require OpenSSL 1.1.1 or later (Drop support for 1.1.0) by @​rhenium in ruby/openssl#841
• Use X509_ALGOR_get0() accessor for X509_ALGOR by @​botovq in ruby/openssl#687
• pkey: change PKey::{RSA,DSA,DH}#params to use nil for missing parameters by @​rhenium in ruby/openssl#774
• ts: use TS_VERIFY_CTX_set0_{store,certs}() on OpenSSL 3.4 by @​rhenium in ruby/openssl#842
• ssl: separate SSLContext#min_version= and #max_version= by @​rhenium in ruby/openssl#849
• pkey/ec: remove deprecated PKey::EC::Point#mul(ary, ary [, bn]) form by @​rhenium in ruby/openssl#843
• test_ssl.rb: Test respecting system default min. by @​junaruga in ruby/openssl#851
• Cleanups in SSL tests by @​rhenium in ruby/openssl#853
• Add build support for AWS-LC by @​samuel40791765 in ruby/openssl#852
• Avoid calling sk_*() with NULL by @​rhenium in ruby/openssl#854
• ssl: remove cert_store from start_server test helper by @​rhenium in ruby/openssl#858
• Patch and enable tests with AWS-LC by @​samuel40791765 in ruby/openssl#855
• Use ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"] instead of OpenSSL::OPENSSL_FIPS. by @​junaruga in ruby/openssl#862
• ssl: manually craft invalid SAN extensions in tests by @​rhenium in ruby/openssl#861
• digest: always run SHA-3 and truncated SHA-2 tests by @​rhenium in ruby/openssl#864
• ssl: refactor check_supported_protocol_versions by @​rhenium in ruby/openssl#866
• ssl: fix tests using TLS 1.1 or older by @​rhenium in ruby/openssl#867
• Improve AWS-LC tests by @​junaruga in ruby/openssl#863
• Improve document of initialize_copy by @​midnight-wonderer in ruby/openssl#869
• Skip PKCS7 with indefinite length test in AWS-LC by @​samuel40791765 in ruby/openssl#871
• pkcs7: fix test failure on RHEL 9 by @​rhenium in ruby/openssl#876
• CI: Upgrade OpenSSL versions by @​junaruga in ruby/openssl#878
• Fix the tests using SHA-1 Probabilistic Signature Scheme (PSS) parameters. by @​junaruga in ruby/openssl#879
• .github/workflows/test.yml: stop using ubuntu-20.04 runner image by @​rhenium in ruby/openssl#880
• ssl: fix SSLSocket#syswrite with String-convertible objects by @​rhenium in ruby/openssl#881
• asn1: check for missing EOC in indefinite length encoding by @​rhenium in ruby/openssl#859
• .github/workflows/test.yml: update test-openssls by @​rhenium in ruby/openssl#884
• AWS-LC has support for parsing ber constructed strings now by @​samuel40791765 in ruby/openssl#888
• cipher: remove Cipher#encrypt(password, iv) form by @​rhenium in ruby/openssl#887
• ssl: fix potential memory leak in SSLContext#setup by @​rhenium in ruby/openssl#882
• CI test.yml - add workflow_dispatch by @​MSP-Greg in ruby/openssl#890
• ssl: add SSLContext#sigalgs= and #client_sigalgs= by @​rhenium in ruby/openssl#895
• pkey: add support for OpenSSL 3 provider-only pkeys by @​rhenium in ruby/openssl#898
• Use Dir.glob and base keyword arg for the installer of Ruby package by @​hsbt in ruby/openssl#904
• Run have_func with the header providing the declarations by @​nobu in ruby/openssl#905
• ssl: rename SSLContext#ecdh_curves= to #groups= by @​rhenium in ruby/openssl#900
• pkey/ec: avoid calling SYM2ID() on user-supplied objects by @​rhenium in ruby/openssl#907
• asn1: align UTCTime year range with RFC 5280 by @​rhenium in ruby/openssl#909
• Various test and CI improvements by @​rhenium in ruby/openssl#910
• Rakefile: fix :test/:test_fips => :compile dependency by @​rhenium in ruby/openssl#911
• ssl: add SSLSocket#sigalg, #peer_sigalg, #group by @​junaruga in ruby/openssl#908

... (truncated)

Changelog

Sourced from openssl's changelog.

Version 4.0.0

Compatibility

• Ruby >= 2.7
• OpenSSL >= 1.1.1, LibreSSL >= 3.9, and AWS-LC 1.66.0
  • Removed support for OpenSSL 1.0.2-1.1.0 and LibreSSL 3.1-3.8. [[GitHub #835]](ruby/openssl#835)
  • Added support for AWS-LC. [[GitHub #833]](ruby/openssl#833)

Notable changes

• OpenSSL::SSL
  • Reduce overhead when writing to OpenSSL::SSL::SSLSocket. #syswrite no longer creates a temporary String object. [[GitHub #831]](ruby/openssl#831)
  • Make OpenSSL::SSL::SSLContext#min_version= and #max_version= wrap the corresponding OpenSSL APIs directly, and remove the fallback to SSL options. [[GitHub #849]](ruby/openssl#849)
  • Add OpenSSL::SSL::SSLContext#sigalgs= and #client_sigalgs= for specifying signature algorithms to use for connections. [[GitHub #895]](ruby/openssl#895)
  • Rename OpenSSL::SSL::SSLContext#ecdh_curves= to #groups= following the underlying OpenSSL API rename. This method is no longer specific to ECDHE. The old method remains as an alias. [[GitHub #900]](ruby/openssl#900)
  • Add OpenSSL::SSL::SSLSocket#sigalg, #peer_sigalg, and #group for getting the signature algorithm and the key agreement group used in the current connection. [[GitHub #908]](ruby/openssl#908)
  • Enable SSL_CTX_set_dh_auto() for servers by default. [[GitHub #924]](ruby/openssl#924)
  • Improve Ractor compatibility. Note that the internal-use constant OpenSSL::SSL::SSLContext::DEFAULT_PARAMS is now frozen. [[GitHub #925]](ruby/openssl#925)
• OpenSSL::PKey
  • Remove OpenSSL::PKey::EC::Point#mul support with array arguments. The underlying OpenSSL API has been removed, and the method has been deprecated since ruby/openssl v3.0.0. [[GitHub #843]](ruby/openssl#843)
  • OpenSSL::PKey::{RSA,DSA,DH}#params uses nil to indicate missing fields instead of the number 0. [[GitHub #774]](ruby/openssl#774)
  • Unify OpenSSL::PKey::PKeyError classes. The former subclasses OpenSSL::PKey::DHError, OpenSSL::PKey::DSAError,

... (truncated)

Commits

• 5af1eda Ruby/OpenSSL 4.0.0
• 5880083 Merge pull request #985 from rhenium/ky/freeze-string-constants
• 2a6f41e Merge pull request #987 from ruby/dependabot/github_actions/step-security/har...
• 16c58b9 Merge pull request #986 from ruby/dependabot/github_actions/actions/cache-5
• 2b94376 build(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0
• 8641e35 build(deps): bump actions/cache from 4 to 5
• b0de8ba ossl.c: improve docs for constants and methods under ::OpenSSL
• 695126f Freeze more constants for Ractor compatibility
• 42effce Merge pull request #983 from rhenium/ky/pkcs7-init-raise-pkcs7error
• 3c38181 Merge pull request #984 from rhenium/ky/x509cert-eq-document-wrong
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[jkmassel]

This is only for Ruby, not on the Rust side.