Merge branch 'maint-3.3' into maint-4.0

* maint-3.3:
  .github/workflows/test.yml: synchronize with master
  Remove test_ed25519_not_approved_on_fips.
  test_s_generate_parameters: Consider a DSA error in FIPS.
  Revert "Always respect the openssl prefix chosen by truffle/openssl-prefix on TruffleRuby"

Author: rhenium

.github/workflows/push_gem.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: audit
 

.github/workflows/test.yml

@@ -101,23 +101,24 @@ jobs:
         openssl:
           # https://openssl-library.org/source/
           - openssl-1.1.1w # EOL 2023-09-11, still used by RHEL 8 and Ubuntu 20.04
-          - openssl-3.0.18 # Supported until 2026-09-07 (LTS)
+          - openssl-3.0.20 # Supported until 2026-09-07 (LTS)
           - openssl-3.1.8 # EOL 2025-03-14
-          - openssl-3.2.6 # Supported until 2025-11-23
-          - openssl-3.3.5 # Supported until 2026-04-09
-          - openssl-3.4.3 # Supported until 2026-10-22
-          - openssl-3.5.4 # Supported until 2030 (LTS)
-          - openssl-3.6.0 # EOL TBD
+          - openssl-3.2.6 # EOL 2025-11-23
+          - openssl-3.3.7 # EOL 2026-04-09
+          - openssl-3.4.5 # Supported until 2026-10-22
+          - openssl-3.5.6 # Supported until 2030-04-08 (LTS)
+          - openssl-3.6.2 # Supported until 2026-11-01
+          - openssl-4.0.0 # Supported until 2027-05-14
           - openssl-master
           # http://www.libressl.org/releases.html
           - libressl-3.9.2 # EOL 2025-04-05
-          - libressl-4.0.1 # Supported until 2025-10-08
+          - libressl-4.0.1 # EOL 2025-10-08
           - libressl-4.1.2 # Supported until 2026-04-28
-          - libressl-4.2.1
+          - libressl-4.2.1 # Supported until 2026-10-22
           # https://github.com/aws/aws-lc/tags
           - aws-lc-latest
         include:
-          - { name-extra: 'without legacy provider', openssl: openssl-3.5.4, append-configure: 'no-legacy' }
+          - { name-extra: 'without legacy provider', openssl: openssl-4.0.0, append-configure: 'no-legacy' }
           - { openssl: aws-lc-latest, skip-warnings: true }
     steps:
       - name: repo checkout
@@ -202,4 +203,4 @@ jobs:
           bundle exec rake debug
           bundle exec rake test_fips TESTOPTS="-v --no-show-detail-immediately" OSSL_TEST_ALL=1
         timeout-minutes: 5
-        if: ${{ startsWith(matrix.openssl, 'openssl-3') || matrix.openssl == 'openssl-master' }}
+        if: ${{ startsWith(matrix.openssl, 'openssl') && !startsWith(matrix.openssl, 'openssl-1') }}