ci: upgrade OpenSSL on macOS runners before building#55
Merged
Conversation
The cryptography wheel bundled by PyInstaller references _SSL_get0_group_name (added in OpenSSL 3.2), but the macos-15-intel runner has an older libssl.3.dylib that doesn't export this symbol, causing the smoke test to crash. Upgrading openssl@3 before the build ensures PyInstaller bundles a compatible dylib. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
cryptography 49.0.0 has no pre-built wheel for macOS x86_64 and builds from source. The Rust openssl-sys crate picks up Python's OpenSSL via PKG_CONFIG_PATH (set by setup-python), which differs from the Homebrew libssl.3.dylib that PyInstaller later bundles — so _SSL_get0_group_name is present at compile time but missing at runtime. Setting OPENSSL_STATIC=1 and OPENSSL_DIR forces static linking against Homebrew's OpenSSL, embedding all required symbols into _rust.abi3.so and eliminating the libssl.3.dylib runtime dependency entirely. The timeout is bumped to 10 min to allow for the longer static link step. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
cryptography 49.0.0 has no pre-built macOS x86_64 wheel and builds from Rust source. setup-python sets PKG_CONFIG_PATH to Python's own OpenSSL, which openssl-sys picks up for headers during compilation — but PyInstaller later bundles Homebrew's libssl.3.dylib from /usr/local/opt/openssl@3. These two OpenSSL builds differ, so _SSL_get0_group_name is present at compile time but missing at runtime. Setting OPENSSL_DIR=/usr/local/opt/openssl@3 forces openssl-sys to use Homebrew's headers and link against Homebrew's dylib, ensuring the compile-time and runtime libraries match. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
cryptography 49.0.0 dropped macOS x86_64 wheel publishing and switched to AWS-LC as its Rust backend. Building from source on macos-15-intel produces a _rust.abi3.so that references _SSL_get0_group_name (an AWS-LC extension), but PyInstaller bundles standard OpenSSL's libssl.3.dylib which lacks this symbol, causing a crash at runtime. Pinning to <49 ensures pip selects 48.0.1, which ships a universal2 wheel with a properly delocated OpenSSL for both arm64 and x86_64. Reverts the now-unnecessary OPENSSL_DIR workflow workaround. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Move the pin out of requirements.txt (which affects all platforms) and into a runner-specific PIP_CONSTRAINT set via GITHUB_ENV. All other runners continue to get the latest cryptography. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This issue was discovered in this run triggerd for #54:
macos-15-intelsmoke test was crashing because thecryptographywheel's Rust extension (_rust.abi3.so) references_SSL_get0_group_name(added in OpenSSL 3.2), but PyInstaller was bundling an olderlibssl.3.dylibfrom the runner that doesn't export that symbol.cryptographyversion to<49for MacOS x86_64.This is just a dirty fix to keep the CLI alive. We should officially deprecate the CLI for x86_64 MacOS as well.
Test plan
build (macos-15-intel, darwin, amd64)job passes the Non-Docker Smoke tests stepmacos-14(arm64) and other runners