Update OpenSSL to the 1.1.1 July 19 CVE level

[pshipton]

Includes fix for CVE-2023-3446.

[AdamBrousseau]

jenkins compile amac jdk11

[AdamBrousseau]

I'm not convinced a tag is going to work instead of a branch because the clone uses the -b option instead of a clone followed by a checkout.
https://github.com/ibmruntimes/openj9-openjdk-jdk8/blob/8d52f27f414f9756e4c365786c249ec00757f2ff/closed/get_openssl_source.sh#L94C1-L94C56

git clone --depth=1 -b $OPENSSL_SOURCE_TAG $OPENSSL_URL

[pshipton]

We always use a tag, there aren't branches for the releases. 1.1.1u is short form for a tag and is converted by get_openssl_source.sh to the tag name OpenSSL_1_1_1u.

The build looks correct, it contains output Configuring OpenSSL version 1.1.1v-dev

[pshipton]

It also shows switching to '97b4f2b515ffd3ce91c6d5cd6d04614a4a15d7df' which is the correct SHA.

[keithc-ca]

And

[2023-07-20T14:55:58.368Z] Compiling OpenJ9 in /Users/jenkins/workspace/Build_JDK11_aarch64_mac_Personal/build/macosx-aarch64-normal-server-release/vm
[2023-07-20T14:55:58.368Z]   Source version info:
[2023-07-20T14:55:58.368Z]     openjdk - 7ef5802f8c7
[2023-07-20T14:55:58.368Z]     openj9  - 2bfa51e0c09
[2023-07-20T14:55:58.368Z]     omr     - e6b8e7aa86b
[2023-07-20T14:55:58.368Z]     openssl - 97b4f2b5

[keithc-ca]

Jenkins test sanity.openjdk alinux64 jdk17

[pshipton]

Since OpenSSL isn't bundled on alinux, sanity.openjdk testing isn't going to test the change. It would need to be run on Windows or Mac.

[keithc-ca]

Jenkins test sanity.openjdk win jdk17

[pshipton]

The failures are known issues unrelated to this change.

[keithc-ca]

Test failures:

TEST: java/security/SecureRandom/ApiTest.java
TEST: java/security/SecureRandom/EnoughSeedTest.java

Those tests passed in a grinder: https://openj9-jenkins.osuosl.org/job/Grinder/2594/.