[yugabyte#30735] build: Bump OpenSSL verison to 3.5.7/3.1.2

Summary:
Bumping OpenSSL to 3.5.7, since 3.0.x is going EOL in September, and 3.5.x
is the next LTS series. Also bumping the FIPS provider to 3.1.2, since the
current version (3.0.8) will no longer be certified after September, and 3.1.2
is the newest FIPS certified version.

As of OpenSSL 3.2.x, `openssl req` and `openssl ca` always produce X.509v3
certificates instead of X.509v1 certificates. This breaks the certificate generation
for our test certificates, so this revision also fixes that issue
(related: openssl/openssl#26144).

Additionally, the SecureConnectionTest.CipherSuites tests setting the ciphersuites
gflag, but uses TLS_AES_128_CCM_8_SHA256 to test, which has been moved
to SECLEVEL=0 as of OpenSSL 3.2.x (openssl/openssl#19613).
This revision changes it to use TLS_AES_128_CCM_SHA256 instead.

A TSAN suppression was also added on `libcrypto.so.3` to catch data races such as:
```
Read of size 8 at 0x7208000a8a40 by thread T53:
  #0 memcmp ${YB_LLVM_TOOLCHAIN_DIR}-build/src/llvm-project/compiler-rt/lib/tsan/rtl/../../sanitizer_common/sanitizer_common_interceptors.inc:879:3 (secure_connection_test+0xbd2ca)
  #1 ASN1_STRING_cmp <null> (libcrypto.so.3+0x22dc5f)
  #2 yb::rpc::RefinedStream::Handshake() ${YB_SRC_ROOT}/src/yb/rpc/refined_stream.cc:230:37 (libyrpc.so+0x1626f1)
  #3 yb::rpc::RefinedStream::ProcessReceived(yb::StronglyTypedBool<yb::rpc::ReadBufferFull_Tag>) ${YB_SRC_ROOT}/src/yb/rpc/refined_stream.cc:155:14 (libyrpc.so+0x16244b)
  ...

Previous write of size 8 at 0x7208000a8a40 by thread T52 (mutexes: write M0):
  #0 memcpy ${YB_LLVM_TOOLCHAIN_DIR}-build/src/llvm-project/compiler-rt/lib/tsan/rtl/../../sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:117:5 (secure_connection_test+0xabfee)
  #1 ASN1_STRING_set <null> (libcrypto.so.3+0x22d987)
  #2 yb::rpc::RefinedStream::Handshake() ${YB_SRC_ROOT}/src/yb/rpc/refined_stream.cc:230:37 (libyrpc.so+0x1626f1)
  #3 yb::rpc::RefinedStream::ProcessReceived(yb::StronglyTypedBool<yb::rpc::ReadBufferFull_Tag>) ${YB_SRC_ROOT}/src/yb/rpc/refined_stream.cc:155:14 (libyrpc.so+0x16244b)
  ...

Location is heap block of size 21 at 0x7208000a8a40 allocated by thread T52:
  #0 malloc ${YB_LLVM_TOOLCHAIN_DIR}-build/src/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:682:5 (secure_connection_test+0xaec70)
  #1 CRYPTO_realloc <null> (libcrypto.so.3+0x34df2d)
  #2 yb::rpc::RefinedStream::Handshake() ${YB_SRC_ROOT}/src/yb/rpc/refined_stream.cc:230:37 (libyrpc.so+0x1626f1)
  #3 yb::rpc::RefinedStream::ProcessReceived(yb::StronglyTypedBool<yb::rpc::ReadBufferFull_Tag>) ${YB_SRC_ROOT}/src/yb/rpc/refined_stream.cc:155:14 (libyrpc.so+0x16244b)
  ...

Mutex M0 (0x7210000bb300) created at:
  #0 pthread_rwlock_init ${YB_LLVM_TOOLCHAIN_DIR}-build/src/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1553:3 (secure_connection_test+0xb409a)
  #1 CRYPTO_THREAD_lock_new <null> (libcrypto.so.3+0x36174d)
  #2 yb::rpc::SecureContext::Impl::UseCertificates(string const&, yb::Slice const&, yb::Slice const&) ${YB_SRC_ROOT}/src/yb/rpc/secure_stream.cc:667:3 (libyrpc.so+0x199972)
  #3 yb::rpc::SecureContext::UseCertificates(string const&, yb::Slice const&, yb::Slice const&) ${YB_SRC_ROOT}/src/yb/rpc/secure_stream.cc:725:17 (libyrpc.so+0x19d0b2)
  ...
```
This is a false positive with missing frames, which is a known issue with TSAN when some dynamic libraries
(OpenSSL in this case) are not instrumented. Switching libcrypto.so with one from a manual instrumented
build of OpenSSL resolves the issue, but thirdparty does not currently build properly with instrumented OpenSSL
due to dependencies between different libraries (yugabyte#32121). TSAN errors with libcrypto.so were entirely suppressed
since there are many different traces in which this surfaces.

Test Plan: Jenkins

Reviewers: hsunder

Reviewed By: hsunder

Subscribers: mihnea, ybase

Tags: #jenkins-ready

Differential Revision: https://phorge.dev.yugabyte.com/D50928

Author: es1024

build-support/generate_test_certificates.sh

@@ -45,6 +45,7 @@ policy = yugabyte_policy
 
 unique_subject = no
 copy_extensions = copy
+x509_extensions = my_extensions
 
 [ yugabyte_policy ]
 commonName = supplied
@@ -55,6 +56,10 @@ distinguished_name = yugabyte_distinguished_name
 
 [ yugabyte_distinguished_name ]
 commonName = $common_name
+
+[ my_extensions ]
+basicConstraints = critical, CA:true
+keyUsage = critical, keyCertSign, cRLSign
 EOT
 
   cat > "$dir/ca.conf" <<-EOT

build-support/thirdparty_archives.yml

@@ -1,116 +1,116 @@
-sha: 773e60eab3f66d340e52f12e69657824559dd62f
+sha: e42841c02e3e540840ba44ae23cd2adc3c2c245d
 archives:
 
   - os_type: almalinux8
     architecture: aarch64
     compiler_type: clang19
-    tag: v20260523150803-773e60eab3-almalinux8-aarch64-clang19
+    tag: v20260610131017-e42841c02e-almalinux8-aarch64-clang19
 
   - os_type: almalinux8
     architecture: aarch64
     compiler_type: clang19
     lto_type: full
-    tag: v20260523150549-773e60eab3-almalinux8-aarch64-clang19-full-lto
+    tag: v20260610131047-e42841c02e-almalinux8-aarch64-clang19-full-lto
 
   - os_type: almalinux8
     architecture: aarch64
     compiler_type: clang21
-    tag: v20260523150734-773e60eab3-almalinux8-aarch64-clang21
+    tag: v20260610130721-e42841c02e-almalinux8-aarch64-clang21
 
   - os_type: almalinux8
     architecture: aarch64
     compiler_type: clang21
     lto_type: full
-    tag: v20260523150701-773e60eab3-almalinux8-aarch64-clang21-full-lto
+    tag: v20260610131048-e42841c02e-almalinux8-aarch64-clang21-full-lto
 
   - os_type: almalinux8
     architecture: x86_64
     compiler_type: clang19
-    tag: v20260523150611-773e60eab3-almalinux8-x86_64-clang19
+    tag: v20260610130711-e42841c02e-almalinux8-x86_64-clang19
 
   - os_type: almalinux8
     architecture: x86_64
     compiler_type: clang19
     lto_type: full
-    tag: v20260523150544-773e60eab3-almalinux8-x86_64-clang19-full-lto
+    tag: v20260610130720-e42841c02e-almalinux8-x86_64-clang19-full-lto
 
   - os_type: almalinux8
     architecture: x86_64
     compiler_type: clang21
-    tag: v20260523150649-773e60eab3-almalinux8-x86_64-clang21
+    tag: v20260610130712-e42841c02e-almalinux8-x86_64-clang21
 
   - os_type: almalinux8
     architecture: x86_64
     compiler_type: clang21
     lto_type: full
-    tag: v20260523150623-773e60eab3-almalinux8-x86_64-clang21-full-lto
+    tag: v20260610130747-e42841c02e-almalinux8-x86_64-clang21-full-lto
 
   - os_type: almalinux8
     architecture: x86_64
     compiler_type: gcc15
-    tag: v20260523150558-773e60eab3-almalinux8-x86_64-gcc15
+    tag: v20260610130653-e42841c02e-almalinux8-x86_64-gcc15
 
   - os_type: almalinux9
     architecture: x86_64
     compiler_type: clang19
-    tag: v20260523150624-773e60eab3-almalinux9-x86_64-clang19
+    tag: v20260610130738-e42841c02e-almalinux9-x86_64-clang19
 
   - os_type: almalinux9
     architecture: x86_64
     compiler_type: clang21
-    tag: v20260523150618-773e60eab3-almalinux9-x86_64-clang21
+    tag: v20260610130744-e42841c02e-almalinux9-x86_64-clang21
 
   - os_type: almalinux9
     architecture: x86_64
     compiler_type: gcc15
-    tag: v20260523150613-773e60eab3-almalinux9-x86_64-gcc15
+    tag: v20260610130729-e42841c02e-almalinux9-x86_64-gcc15
 
   - os_type: macos
     architecture: arm64
     compiler_type: clang
-    tag: v20260523150348-773e60eab3-macos-arm64
+    tag: v20260610130458-e42841c02e-macos-arm64
 
   - os_type: macos
     architecture: arm64
     compiler_type: clang21
-    tag: v20260523150347-773e60eab3-macos-arm64-clang21
+    tag: v20260610130502-e42841c02e-macos-arm64-clang21
 
   - os_type: macos
     architecture: x86_64
     compiler_type: clang
-    tag: v20260523150545-773e60eab3-macos-x86_64
+    tag: v20260610130717-e42841c02e-macos-x86_64
 
   - os_type: macos
     architecture: x86_64
     compiler_type: clang21
-    tag: v20260523150518-773e60eab3-macos-x86_64-clang21
+    tag: v20260610130703-e42841c02e-macos-x86_64-clang21
 
   - os_type: ubuntu22.04
     architecture: x86_64
     compiler_type: clang19
-    tag: v20260523150551-773e60eab3-ubuntu2204-x86_64-clang19
+    tag: v20260610130654-e42841c02e-ubuntu2204-x86_64-clang19
 
   - os_type: ubuntu22.04
     architecture: x86_64
     compiler_type: clang21
-    tag: v20260523150642-773e60eab3-ubuntu2204-x86_64-clang21
+    tag: v20260610162042-e42841c02e-ubuntu2204-x86_64-clang21
 
   - os_type: ubuntu22.04
     architecture: x86_64
     compiler_type: gcc15
-    tag: v20260523150606-773e60eab3-ubuntu2204-x86_64-gcc15
+    tag: v20260610130702-e42841c02e-ubuntu2204-x86_64-gcc15
 
   - os_type: ubuntu24.04
     architecture: x86_64
     compiler_type: clang19
-    tag: v20260523150629-773e60eab3-ubuntu2404-x86_64-clang19
+    tag: v20260610130659-e42841c02e-ubuntu2404-x86_64-clang19
 
   - os_type: ubuntu24.04
     architecture: x86_64
     compiler_type: clang21
-    tag: v20260523150610-773e60eab3-ubuntu2404-x86_64-clang21
+    tag: v20260610130814-e42841c02e-ubuntu2404-x86_64-clang21
 
   - os_type: ubuntu24.04
     architecture: x86_64
     compiler_type: gcc15
-    tag: v20260523150519-773e60eab3-ubuntu2404-x86_64-gcc15
+    tag: v20260610130812-e42841c02e-ubuntu2404-x86_64-gcc15

build-support/tsan-suppressions.txt

@@ -199,3 +199,6 @@ race:std::fs::
 race:std::sys::
 race:documentdb_gateway::
 race:pg_documentdb_gw_host::
+
+# False positive because we compile OpenSSL without TSAN instrumentation (#32121).
+race:libcrypto.so.3

src/yb/integration-tests/secure_connection_test.cc

@@ -221,7 +221,7 @@ TEST_F_EX(SecureConnectionTest, CipherList, SecureConnectionCipherListTest) {
 
 class SecureConnectionCipherSuitesTest : public SecureConnectionTest {
   void SetUp() override {
-    ANNOTATE_UNPROTECTED_WRITE(FLAGS_ciphersuites) = "TLS_AES_128_CCM_8_SHA256";
+    ANNOTATE_UNPROTECTED_WRITE(FLAGS_ciphersuites) = "TLS_AES_128_CCM_SHA256";
     ANNOTATE_UNPROTECTED_WRITE(FLAGS_ssl_protocols) = "tls13";
     SecureConnectionTest::SetUp();
   }