gtls: drop support for GnuTLS < 3.6.5

[bagder]

Release date 2018-12-01. Has TLS 1.3 support.

[bagder]

The Linux old job uses GnuTLS 3.5.8 it seems!

[vszakats]

Old Linux has OpenSSL 1.0.2, and I moved to GnuTLS to keep TLS.
wolfSSL might work, but it's missing pre-Bullseye as per
https://sources.debian.org/src/wolfssl/, so probably not easy.

Option is maybe installing something manually from a newer release
that fits? or bumping to a Linux just old enough have a supported backend,
or bumping minimum to 3.5.8 (2017-01-09, -2 years compared to 3.6.5) only.

We could also build and cache a supported version there, but I don't
know how cache in a container and it may a rabbit hole to make the
build work.

[bagder]

or bumping minimum to 3.5.8

Right, but I think it make sense to raise it to a TLS 1.3 capable version. Still seven years old.

[bagder]

So maybe bump linux-old to Debian bullseye or something?

[dfandrich]

Leaving linux-old at the current version allows us to test old build tools, especially cmake, autotools & perl. I would rather leave the current linux-old alone so we can verify those even if it means dropping some dependencies. I think it's more important to verify those fundamental build tools than being able to test more old libraries.

[vszakats]

Leaving linux-old at the current version allows us to test old build tools, especially cmake, autotools & perl. I would rather leave the current linux-old alone so we can verify those even if it means dropping some dependencies. I think it's more important to verify those fundamental build tools than being able to test more old libraries.

Agreed, a TLS-less job would still be useful for this.

That said, I wouldn't mind a CMake bump to 3.17 (6y old,
vs current 3.7.2 which is 10yo). More details at
#18704. If we decide
to do it, it may allow bumping Linux old too and restore TLS,
perhaps also libssh2 that we had to let go earlier.

[bagder]

I just suspect we test older versions than we need to, thus taking on more work than necessary. I think Debian Bullseye could be a fair oldest Linux to test on for now.

Freexian offers LTS services for older releases, sure, but I don't think we need bend over backwards to help their business when it comes at a cost for us.