Migrate Linux CI from OpenSSL 3.0.19 to 3.5.5 LTS

OpenSSL 3.0 reaches EOL on 2026-09-07. Update the manylinux wheel
build to compile OpenSSL 3.5.5 (LTS, supported until 2030) from
source, and update documented version requirements accordingly.

Closes #9

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lnagel

.github/workflows/build.yml

@@ -109,22 +109,22 @@ jobs:
           # Use manylinux_2_28 for GCC 13 (C++23 support)
           CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
           CIBW_MANYLINUX_AARCH64_IMAGE: manylinux_2_28
-          # Install build dependencies in the container (need GCC 13 for C++23, OpenSSL 3.x)
+          # Install build dependencies in the container (need GCC 13 for C++23, OpenSSL 3.5 LTS)
           CIBW_BEFORE_ALL_LINUX: >
             dnf install -y gcc-toolset-13 perl-IPC-Cmd perl-Time-Piece libxml2-devel zlib-devel &&
             source /opt/rh/gcc-toolset-13/enable &&
-            curl -L https://www.openssl.org/source/openssl-3.0.19.tar.gz | tar xz &&
-            cd openssl-3.0.19 &&
-            ./config --prefix=/usr/local/openssl3 --openssldir=/usr/local/openssl3 &&
+            curl -L https://github.com/openssl/openssl/releases/download/openssl-3.5.5/openssl-3.5.5.tar.gz | tar xz &&
+            cd openssl-3.5.5 &&
+            ./config --prefix=/usr/local/openssl35 --openssldir=/usr/local/openssl35 &&
             make -j$(nproc) &&
             make install_sw install_ssldirs
           CIBW_ENVIRONMENT_LINUX: >
             CC=/opt/rh/gcc-toolset-13/root/usr/bin/gcc
             CXX=/opt/rh/gcc-toolset-13/root/usr/bin/g++
-            OPENSSL_ROOT_DIR=/usr/local/openssl3
-            PKG_CONFIG_PATH=/usr/local/openssl3/lib64/pkgconfig
+            OPENSSL_ROOT_DIR=/usr/local/openssl35
+            PKG_CONFIG_PATH=/usr/local/openssl35/lib64/pkgconfig
             PATH=/opt/rh/gcc-toolset-13/root/usr/bin:$PATH
-            LD_LIBRARY_PATH=/usr/local/openssl3/lib64:/usr/local/openssl3/lib:/opt/rh/gcc-toolset-13/root/usr/lib64:$LD_LIBRARY_PATH
+            LD_LIBRARY_PATH=/usr/local/openssl35/lib64:/usr/local/openssl35/lib:/opt/rh/gcc-toolset-13/root/usr/lib64:$LD_LIBRARY_PATH
           # Install flatbuffers from source on Linux
           CIBW_BEFORE_BUILD_LINUX: >
             uv pip install --system cmake swig &&

CLAUDE.md

@@ -15,7 +15,7 @@ Python bindings for [libcdoc](https://github.com/open-eid/libcdoc) via SWIG. Pro
 - **Static linking** (`BUILD_SHARED_LIBS=OFF`) — self-contained wheels, LGPL-2.1 compliance via RELINKING.md + sdist source
 - **Patch-based approach** — upstream libcdoc.i is modified via `patches/libcdoc-python.patch` at CMake configure time (rather than forking)
 - **SWIG `%rename` before `%include`** — order matters, rename rules must appear before upstream interface is included
-- **`MACOSX_DEPLOYMENT_TARGET=15.0`** — required by Homebrew OpenSSL 3
+- **`MACOSX_DEPLOYMENT_TARGET=15.0`** — required by Homebrew OpenSSL 3.5+
 
 ## Test
 
@@ -46,7 +46,7 @@ Never use `git -C <path>` — always run git commands from the working directory
 4. `build_sdist` — on release/PR
 5. `publish` — OIDC trusted publishing to PyPI
 
-Linux wheels build OpenSSL and flatbuffers from source inside manylinux_2_28 with GCC 13.
+Linux wheels build OpenSSL 3.5 LTS and flatbuffers from source inside manylinux_2_28 with GCC 13.
 
 ## Version management
 

README.md

@@ -14,15 +14,15 @@ uv add pycdoc
 
 ### Runtime
 - Python 3.10+
-- OpenSSL 3.0+ (usually pre-installed on modern systems)
+- OpenSSL 3.5+ (usually pre-installed on modern systems)
 
 ### Building from Source
 
 Building from source requires:
 - Python 3.10+
 - CMake 3.20+
 - SWIG 4.0+
-- OpenSSL 3.0+
+- OpenSSL 3.5+
 - libxml2
 - zlib
 - FlatBuffers

RELINKING.md

@@ -9,7 +9,7 @@ Section 6, you have the right to modify libcdoc and relink. Here's how.
 - CMake 3.20+
 - C++23 compiler (GCC 13+, Clang 16+, MSVC 2022+)
 - SWIG 4.0+
-- System libraries: OpenSSL 3.0+, libxml2, zlib, flatbuffers
+- System libraries: OpenSSL 3.5+, libxml2, zlib, flatbuffers
 
 ## Rebuilding from source distribution