allow EOL OpenSSL versions in nix

Author: panva

.github/actions/build-shared/action.yml

@@ -58,7 +58,7 @@ runs:
       run: |
         nix-shell \
           -I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
-          --pure --keep TAR_DIR --keep FLAKY_TESTS \
+          --pure --keep TAR_DIR --keep FLAKY_TESTS --keep NIXPKGS_ALLOW_INSECURE \
           --keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
           --arg loadJSBuiltinsDynamically false \
           --arg useSeparateDerivationForV8 true \

.github/workflows/test-shared.yml

@@ -211,6 +211,9 @@ jobs:
     continue-on-error: ${{ matrix.openssl['continue-on-error'] }}
     env:
       OPENSSL_ATTR: ${{ matrix.openssl.attr }}
+      # Some EOL-with-extended-support cycles (e.g. 1.1.1) are marked
+      # insecure by nixpkgs' meta check and refuse to evaluate without this.
+      NIXPKGS_ALLOW_INSECURE: '1'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with: