Repository: nodejs/node
Pull request: tools: pin OpenSSL to 3.5.4 on test-shared workflow

Because of https://github.com/nodejs/node/issues/60088, we cannot yet test with OpenSSL 3.6.0. Pinning to unblock https://github.com/nodejs/node/pull/60315.
Also adding [`cachix/cachix-action`](https://github.com/cachix/cachix-action/tree/0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad/) so we don't need to build OpenSSL every time. PRs from forks won't have access to the secret, but that's on purpose, so they can benefit from the read-only cache, but cannot do any cache poisoning.

<!--
Before submitting a pull request, please read:

- the CONTRIBUTING guide at https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md
- the commit message formatting guidelines at
  https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#commit-message-guidelines

For code changes:
1. Include tests for any bug fixes or new features.
2. Update documentation if relevant.
3. Ensure that `make -j4 test` (UNIX), or `vcbuild test` (Windows) passes.

If you believe this PR should be highlighted in the Node.js CHANGELOG
please add the `notable-change` label.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.
-->


Changed files:
filename: .github/workflows/test-shared.yml
patch: @@ -1,3 +1,5 @@
+# This action uses the following secrets:
+#   CACHIX_AUTH_TOKEN: Write access to nodejs.cachix.org – without it, the cache is read-only.
 name: Test Shared libraries
 
 on:
@@ -95,6 +97,11 @@ jobs:
         with:
           extra_nix_config: sandbox = true
 
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          name: nodejs
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
       - name: Configure sccache
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # v7.0.1
         with:

filename: BUILDING.md
patch: @@ -270,6 +270,12 @@ direnv allow .
 make build-ci -j12
 ```
 
+Most dependencies will likely be available in the official nixpkgs cache,
+although for some dependencies we have to deviate for the upstream repository,
+in which case those will be built locally, or you can use the Cachix repository
+for the project: `cachix use nodejs`. See <https://docs.cachix.org/> for more
+information.
+
 The use of `make build-ci` is to ensure you are using the `CONFIG_FLAGS`
 environment variable. You can also specify it manually:
 

filename: shell.nix
patch: @@ -12,7 +12,6 @@
       nghttp2
       nghttp3
       ngtcp2
-      openssl
       simdjson
       simdutf
       sqlite
@@ -21,6 +20,23 @@
       zstd
       ;
     http-parser = pkgs.llhttp;
+    openssl = pkgs.openssl.overrideAttrs (old: {
+      version = "3.5.4";
+      src = pkgs.fetchurl {
+        url = builtins.replaceStrings [ old.version ] [ "3.5.4" ] old.src.url;
+        hash = "sha256-lnMR+ElVMWlpvbHY1LmDcY70IzhjnGIexMNP3e81Xpk=";
+      };
+      doCheck = false;
+      configureFlags = (old.configureFlags or [ ]) ++ [
+        "no-docs"
+        "no-tests"
+      ];
+      outputs = [
+        "bin"
+        "out"
+        "dev"
+      ];
+    });
   },
   ccache ? pkgs.ccache,
   ninja ? pkgs.ninja,