[BPO] openssl/3.0.5-2ubuntu2 from kinetic

OpenSSL is one of those tricky things out there I would like to get a Security insight for before we do any kind of backporting of it. There's other things this could impact, backports or not.

Mark, are you asking this to be backported in -backports or in -updates and -security? This is one of the packages that if we do this in -backports any security patches applied by the Security team for OpenSSL in -security and -updates would be ignored with the higher version of this in -backports.

Minor OpenSSL releases have historically introduced a whole lot of behaviour and API changes that required fixing dozens of other packages in the archive. I don't recommend putting 3.0.5 in backports.

What I suggest is to actually SRU the 3-4 commits that fix SSL_OP_LEGACY_SERVER_CONNECT to the version currently in Jammy.

I've discussed this with mapreri who is another person on the backporters team.

Given the API/ABI changes that happen during OpenSSL microreleases that break packages integrations AND that this will add a security delta (-backports doesn't receive Security Team support so if they change and patch a CVE in -security or -updates it remains unpatched in -backports which introduces a significant Security risk.

Additionally, if it's only 3 or 4 commits to fix SSL_OP_LEGACY_SERVER_CONNECT then you need to follow the SRU process, not the Backports process.

Rejecting this backport as "Won't Fix" due to the aforementioned reasons. Additionally, the Backporters Team are going to blacklist `openssl` for backport requests unless it comes from Security at this time.

Thomas and Marc, thanks for the guidance and time spent here. :)

I'll look into the SRU process.