openssl_3_1: remove and explicitely state versioning

  });

in {

  # intended version "policy":

  # - 1.1 as long as some package exists, which does not build without it

  # - latest 3.x LTS

  # - latest 3.x non-LTS as preview/for development

  #

  # - other versions in between only when reasonable need is stated for some package

  # - backport every security critical fix release e.g. 3.0.y -> 3.0.y+1 but no new version, e.g. 3.1 -> 3.2

  # If you do upgrade here, please update in pkgs/top-level/release.nix

  # the permitted insecure version to ensure it gets cached for our users

    };

  };

  openssl_3_1 = common {

    version = "3.1.4";

    hash = "sha256-hAr1Nmq5tSK95SWCa+PvD7Cvgcap69hMqmAP6hcx7uM=";

    patches = [

      ./3.0/nix-ssl-cert-file.patch

      # openssl will only compile in KTLS if the current kernel supports it.

      # This patch disables build-time detection.

      ./3.0/openssl-disable-kernel-detection.patch

      (if stdenv.hostPlatform.isDarwin

       then ./use-etc-ssl-certs-darwin.patch

       else ./use-etc-ssl-certs.patch)

    ];

    withDocs = true;

    extraMeta = with lib; {

      license = licenses.asl20;

    };

  };

  openssl_3_2 = common {

    version = "3.2.0";

    hash = "sha256-FMgm8Hx+QzcG+1xp+p4l2rlWhIRLTJYqLPG/GD60aQ4=";

  inherit (callPackages ../development/libraries/openssl { })

    openssl_1_1

    openssl_3

    openssl_3_1

    openssl_3_2;

  opensubdiv = callPackage ../development/libraries/opensubdiv { };