openssl_1_1 mark as insecure/remove before 23.05 branchoff

[ajs124]

OpenSSL 1.1.1 (we call it openssl_1_1) will reach end of life on 11 Sep 2023.

This means we should either mark it insecure or ideally completely remove it before the 23.11 release.

The default was already switched in #150093, so most thing should use openssl_3 now.
For applications that support the OpenSSL 3 API, but need old and broken cryptography, there's also openssl_legacy, which will be supported, because it's just openssl_3 but with the legacy crypto provider enabled.

This is a tracking issue to reference and coordinate this work.

cc @NickCao

[ajs124]

Apparently this https://github.com/loqs/PACKAGES-OSSL3 exists, which might come in handy

[NickCao]

• python3Packages.uamqp: OpenSSL 3.x support needed for Fedora, CentOS, RHEL Azure/azure-uamqp-python#276
• python3Packages.bitcoinlib: python3Packages.bitcoinlib: 0.11.2 -> 0.12.0, python3Packages.opentimestamps: 0.4.3 -> 0.4.5 #213933
• python3Packages.cryptography Revert "python3.pkgs.cryptography: use openssl_1_1" #211317
• python3Packages.etebase: python3Packages.etebase: 0.31.5 -> 0.31.6 #213937
• python3Packages.m2crypto: python3Packages.m2crypto: 0.36.0 -> 0.38.0 #211319

[NickCao]

• sslsplit: droe/sslsplit@e17de84

[mdarocha]

Related: #214843, which is blocked by removal of .NET 3.1 (#202572)

[cyntheticfox]

Not sure if I'm just doing this wrong, but openssl_legacy, as-written in top-level, performs an override on openssl to apply the patch. As such setting for ~/.config/nixpkgs/config.nix,

{
  packageOverrides = pkgs: rec {
    openssl = pkgs.openssl_legacy;
  };
}

fails due to infinite recursion. Should we instead have openssl_legacy as a package definition output to enable this use case, or am I approaching this in the wrong manner (should I be trying to overlay, define my own, write some kind of legacyOpenSSL option into the Nixpkgs config system)?

[ajs124]

This should work with an overlay, I think. Are you sure you want to enable the legacy provider for everything that you're building though?