[3.14] gh-149254: Update CI to use latest OpenSSL versions (GH-149330)

Also update Modules/_ssl_data_35.h to include symbols added between 3.5.5 and 3.5.6.

(adapted from commit 68fe899)

Author: zware

.github/workflows/build.yml

@@ -312,7 +312,7 @@ jobs:
         # Keep 1.1.1w in our list despite it being upstream EOL and otherwise
         # unsupported as it most resembles other 1.1.1-work-a-like ssl APIs
         # supported by important vendors such as AWS-LC.
-        openssl_ver: [1.1.1w, 3.0.18, 3.2.6, 3.3.5, 3.4.3, 3.5.4]
+        openssl_ver: [1.1.1w, 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2]
         # See Tools/ssl/make_ssl_data.py for notes on adding a new version
     env:
       OPENSSL_VER: ${{ matrix.openssl_ver }}
@@ -424,7 +424,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.0.20
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@v4
@@ -544,7 +544,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.0.20
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:

.github/workflows/reusable-ubuntu.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     timeout-minutes: 60
     env:
-      OPENSSL_VER: 3.0.18
+      OPENSSL_VER: 3.0.20
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

Modules/_ssl_data_35.h

@@ -1,6 +1,6 @@
 /* File generated by Tools/ssl/make_ssl_data.py */
-/* Generated on 2025-10-04T17:49:19.148321+00:00 */
-/* Generated from Git commit openssl-3.5.4-0-gc1eeb9406 */
+/* Generated on 2026-05-03T20:36:01.807725+00:00 */
+/* Generated from Git commit openssl-3.5.6-0-g286ddeaac */
 
 /* generated from args.lib2errnum */
 static struct py_ssl_library_code library_codes[] = {
@@ -1668,6 +1668,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"CERTIFICATE_VERIFY_ERROR", 46, 100},
   #endif
+  #ifdef CMS_R_CIPHER_AEAD_IN_ENVELOPED_DATA
+    {"CIPHER_AEAD_IN_ENVELOPED_DATA", ERR_LIB_CMS, CMS_R_CIPHER_AEAD_IN_ENVELOPED_DATA},
+  #else
+    {"CIPHER_AEAD_IN_ENVELOPED_DATA", 46, 200},
+  #endif
   #ifdef CMS_R_CIPHER_AEAD_SET_TAG_ERROR
     {"CIPHER_AEAD_SET_TAG_ERROR", ERR_LIB_CMS, CMS_R_CIPHER_AEAD_SET_TAG_ERROR},
   #else
@@ -4243,6 +4248,11 @@ static struct py_ssl_error_code error_codes[] = {
   #else
     {"CONNECT_FAILURE", 61, 100},
   #endif
+  #ifdef HTTP_R_CONTENT_TYPE_MISMATCH
+    {"CONTENT_TYPE_MISMATCH", ERR_LIB_HTTP, HTTP_R_CONTENT_TYPE_MISMATCH},
+  #else
+    {"CONTENT_TYPE_MISMATCH", 61, 131},
+  #endif
   #ifdef HTTP_R_ERROR_PARSING_ASN1_LENGTH
     {"ERROR_PARSING_ASN1_LENGTH", ERR_LIB_HTTP, HTTP_R_ERROR_PARSING_ASN1_LENGTH},
   #else

Tools/ssl/multissltests.py

@@ -45,14 +45,15 @@
 OPENSSL_OLD_VERSIONS = [
     "1.1.1w",
     "3.1.8",
+    "3.2.6",
 ]
 
 OPENSSL_RECENT_VERSIONS = [
-    "3.0.18",
-    "3.2.6",
-    "3.3.5",
-    "3.4.3",
-    "3.5.4",
+    "3.0.20",
+    "3.3.7",
+    "3.4.5",
+    "3.5.6",
+    "3.6.2",
     # See make_ssl_data.py for notes on adding a new version.
 ]