Fix WPFF CI failures

.github/workflows/bind9.yml

@@ -74,6 +74,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/cjose.yml

@@ -81,6 +81,11 @@ jobs:
           apt install --reinstall -y \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/curl.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/debian-package.yml

@@ -85,6 +85,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
           # In standalone mode, use OPENSSL_CONF to enable wolfProvider.
           if [ "${{ matrix.replace_default }}" = "false" ]; then
             echo "Setting OPENSSL_CONF to /etc/ssl/openssl.cnf.d/wolfprovider.conf"
@@ -108,6 +113,11 @@ jobs:
 
       - name: Uninstall package and verify cleanup
         run: |
+          # libwolfprov was held earlier to prevent transitive libssl3
+          # upgrades from clobbering the wolfprov-patched libssl3. Release
+          # the hold here so apt-get is allowed to remove it.
+          apt-mark unhold libwolfprov || true
+
           # Uninstall the package
           apt-get remove -y libwolfprov
 

.github/workflows/git-ssh-dr.yml

@@ -73,6 +73,11 @@ jobs:
         apt install --reinstall -y \
           ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
     - name: Verify wolfProvider is properly installed
       run: |
         $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/grpc.yml

@@ -81,6 +81,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/hostap.yml

@@ -77,6 +77,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Show OpenSSL version
         run: |
           echo "OpenSSL version:"

.github/workflows/iperf.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/krb5.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libcryptsetup.yml

@@ -75,6 +75,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libeac3.yml

@@ -75,6 +75,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libfido2.yml

@@ -68,6 +68,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libhashkit2.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libnice.yml

@@ -72,6 +72,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/liboauth2.yml

@@ -72,6 +72,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/librelp.yml

@@ -82,6 +82,11 @@ jobs:
           apt install --reinstall -y \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libssh2.yml

@@ -72,6 +72,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/libwebsockets.yml

@@ -79,6 +79,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Download libwebsockets
         uses: actions/checkout@v4
         with:

.github/workflows/net-snmp.yml

@@ -74,6 +74,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/nginx.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/openldap.yml

@@ -74,6 +74,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/opensc.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/openssh.yml

@@ -83,6 +83,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/openvpn.yml

@@ -76,6 +76,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/pam-pkcs11.yml

@@ -83,6 +83,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/ppp.yml

@@ -75,6 +75,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/python3-ntp.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/qt5network5.yml

@@ -69,6 +69,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/rsync.yml

@@ -69,6 +69,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/socat.yml

@@ -75,6 +75,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/sscep.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \

.github/workflows/stunnel.yml

@@ -73,6 +73,11 @@ jobs:
           apt install --reinstall -y --allow-downgrades --allow-change-held-packages \
             ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb
 
+          # Prevent later 'apt-get install' of test dependencies from
+          # replacing the wolfprov-patched libssl3, which breaks 
+          # replace-default mode.
+          apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov
+
       - name: Verify wolfProvider is properly installed
         run: |
           $GITHUB_WORKSPACE/scripts/verify-install.sh \