dev-libs/openssl: sync with ::gentoo

[tormath1]

In this PR, we properly pull ::gentoo updates regarding dev-libs/openssl recent CVEs.

Testing done

emerge -pv dev-libs/openssl

• Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
• Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

NOTE:

• To be backported on Alpha
• Once merged, we need to retag alpha-4820.0.1

[chewi]

Okay, although we're close to merging the ::gentoo branch. Perhaps this should only be merged to the Alpha release branch?

[Copilot]

Copilot review overview

🟡 Changes recommended

The security changelog omits two CVEs fixed by OpenSSL 3.6.5.

Review effort: Balanced
Findings: 1

Open (1)

• Incomplete 3.6.5 security changelog omits two CVE fixes · New

What changed in this PR

Synchronizes OpenSSL security releases from Gentoo and selects 3.6.5 for Flatcar.

Changes:

• Adds OpenSSL 3.4.8, 3.5.9, 3.6.5, and 4.0.3.
• Updates keywords, manifests, and profile acceptance.
• Documents the upgrade and security fixes.

File	Description
openssl-4.0.3.ebuild	Adds OpenSSL 4.0.3.
openssl-3.6.5.ebuild	Adds selected OpenSSL 3.6.5.
openssl-3.5.9.ebuild	Adds OpenSSL 3.5.9.
openssl-3.5.8.ebuild	Stabilizes supported architectures.
openssl-3.4.8.ebuild	Adds OpenSSL 3.4.8.
openssl-3.4.7.ebuild	Stabilizes supported architectures.
openssl-3.0.22.ebuild	Stabilizes supported architectures.
Manifest	Adds release artifact checksums.
package.accept_keywords	Allows OpenSSL 3.6.5.
changelog/​updates/​2026-09-22-openssl.md	Records the version update.
changelog/​security/​2026-09-22-openssl.md	Lists addressed CVEs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The obsolete OpenSSL 3.6.4 keyword exception remains enabled alongside 3.6.5.

Review effort: Balanced
Findings: 1

Open (1)

• Remove duplicate OpenSSL block and move 3.6.5 entry · New

Resolved since last review (1)

• Incomplete 3.6.5 security changelog omits two CVE fixes

[Copilot]

Copilot review overview

🔵 Needs a closer look

The profile retains the superseded OpenSSL 3.6.4 keyword entry alongside the new 3.6.5 pin.

Review effort: Balanced
Findings: 1

Open (1)

• Remove duplicate OpenSSL block and move 3.6.5 entry

[tormath1]

Okay, although we're close to merging the ::gentoo branch. Perhaps this should only be merged to the Alpha release branch?

Does it hurt I we merge this to main now ? Just to be sure that we have it for the next release (via the merging of the ::gentoo branch or via the current regular way)

EDIT: Cherry-picked to:

• flatcar-4820

[Copilot]

Copilot review overview

🔵 Needs a closer look

It updates a security-critical cryptography package while validation is limited to dependency resolution rather than a build or runtime test.

Review effort: Balanced
Findings: 1

Open (1)

• Remove duplicate OpenSSL block and move 3.6.5 entry

[chewi]

Yeah, it's fine. Please go ahead.