[leogr]

What type of PR is this?

/kind cleanup

Any specific area of the project related to this PR?

/area build

What this PR does / why we need it:

Updates bundled OpenSSL from 3.1.4 to 3.5.9 LTS for Falco 0.45.2. Falco embeds this library, so refreshing the container's OpenSSL package does not update the copy used by Falco.

The source archive SHA-256 matches both the upstream checksum file and the GitHub release asset digest. The OpenSSL change updates the archive URL and checksum, keeping the existing build arguments.

The package build also needs the amd64 release runner pinned to ubuntu-24.04. On ubuntu-latest, Ubuntu 26.04's rpm package conflicts with the imported systemd-rpm-macros package over sysusers.attr, failing before checkout. This restores the runner version where the same package setup passed.

The package test workflow installs libasan8, matching the sanitizer binary's verified libasan.so.8 dependency. The previous libasan5 package is unavailable on the current runner and prevented those tests from starting.

The amd64 event-generator job also uses ubuntu-24.04. On Ubuntu 26.04, the pinned action cannot hard-link its executable from RUNNER_TEMP into /tmp, failing with invalid cross-device link before generating events. The same action previously passed all 636 tests for each driver on Ubuntu 24.04. Sanitizer tests stay on their current runner to match the sanitizer build.

Special notes for your reviewer:

These commits are also carried in the cumulative release sync:

• chore(release): sync eMudhra packaging fixes for 0.45.2 #4052

Validation:

• Downloaded and verified the official source archive.
• cmake-format 0.6.13 and git diff --check pass.
• Static OpenSSL 3.5.9 and curl 8.7.1 built on macOS arm64. An integration harness using httplib 0.23.1 passed 11 TLS checks: TLS 1.2/1.3, custom CA trust, wrong CA/hostname rejection, and mutual TLS acceptance/rejection.
• The existing eMudhra regression checker passed all 49 certificate assertions with the new OpenSSL and the fixed CA bundle/directory.
• All six GitHub Actions workflows pass at 334b94f9a901b50ad243643f531bd97c477dd131, including Linux package builds on both architectures, sanitizer package tests, event-generator tests with both drivers, and CodeQL.
• Package builds verify bundled OpenSSL 3.5.9; development unit-test jobs use system dependencies.

Completed CI:

• https://github.com/falcosecurity/falco/actions/runs/40500484254

N.B. This adopts OpenSSL's default TLS security level 2. RSA/DSA/DH keys below 2048 bits and EC keys below 224 bits are rejected. Deployments using weaker certificates or DH parameters must replace them, including custom HTTPS output and webserver/mTLS configurations. The native tests use RSA 2048 and SHA-256 without lowering the security level.

Upstream release:

• https://github.com/openssl/openssl/releases/tag/openssl-3.5.9

Does this PR introduce a user-facing change?:

update(cmake): bump bundled OpenSSL to 3.5.9 LTS, adopting TLS security level 2 (RSA/DSA/DH keys must be at least 2048 bits and EC keys at least 224 bits)

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, sgaist

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [leogr,sgaist]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[poiana]

LGTM label has been added.

Details

Git tree hash: 75bce02f95da1425a35d8ba9b2444b7e59beb153