[3.13] gh-158010: Update OpenSSL in binaries and CI from 3.0 to 3.5

.github/workflows/build.yml

@@ -378,7 +378,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -485,7 +485,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:

.github/workflows/reusable-macos.yml

@@ -50,7 +50,7 @@ jobs:
           --with-pydebug \
           ${{ inputs.free-threading && '--disable-gil' || '' }} \
           --prefix=/opt/python-dev \
-          --with-openssl="$(brew --prefix openssl@3.0)"
+          --with-openssl="$(brew --prefix openssl@3.5)"
     - name: Build CPython
       run: make -j8
     - name: Display build info

.github/workflows/reusable-ubuntu.yml

@@ -25,7 +25,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

Android/android.py

@@ -221,7 +221,7 @@ def unpack_deps(host, prefix_dir, cache_dir):
     for name_ver in [
         "bzip2-1.0.8-3",
         "libffi-3.4.4-3",
-        "openssl-3.0.22-0",
+        "openssl-3.5.8-0",
         "sqlite-3.53.4-0",
         "xz-5.4.6-1"
     ]:

Mac/BuildScript/build-installer.py

@@ -246,9 +246,9 @@ def library_recipes():
 
     result.extend([
           dict(
-              name="OpenSSL 3.0.22",
-              url="https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz",
-              checksum="67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81",
+              name="OpenSSL 3.5.8",
+              url="https://github.com/openssl/openssl/releases/download/openssl-3.5.8/openssl-3.5.8.tar.gz",
+              checksum="a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2",
               buildrecipe=build_universal_openssl,
               configure=None,
               install=None,

Misc/Brewfile

@@ -1,6 +1,6 @@
 brew "gdbm"
 brew "mpdecimal"
-brew "openssl@3.0"
+brew "openssl@3.5"
 brew "pkg-config"
 brew "tcl-tk@8"
 brew "xz"

Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst

@@ -0,0 +1 @@
+Updated Android builds to use OpenSSL 3.5.8.

Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst

@@ -0,0 +1 @@
+Updated Windows builds to use OpenSSL 3.5.8.

Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst

@@ -0,0 +1 @@
+Updated macOS installer to use OpenSSL 3.5.8.

Misc/externals.spdx.json

@@ -70,21 +70,21 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "0a7db2958a5ba7f3a7438835f1a583476a611aa160e04b445f9a25e2ffe865aa"
+          "checksumValue": "36af13403a6f34251c875946d1d524c228cbf7b82fd54dd13d9019fbc37da87e"
         }
       ],
-      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.22.tar.gz",
+      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.5.8.tar.gz",
       "externalRefs": [
         {
           "referenceCategory": "SECURITY",
-          "referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.22:*:*:*:*:*:*:*",
+          "referenceLocator": "cpe:2.3:a:openssl:openssl:3.5.8:*:*:*:*:*:*:*",
           "referenceType": "cpe23Type"
         }
       ],
       "licenseConcluded": "NOASSERTION",
       "name": "openssl",
       "primaryPackagePurpose": "SOURCE",
-      "versionInfo": "3.0.22"
+      "versionInfo": "3.5.8"
     },
     {
       "SPDXID": "SPDXRef-PACKAGE-sqlite",