libssl.1.1.dylib not found for Ruby 3.0 and TruffleRuby on macos-14

[eregon]

Ensure the following before filing this issue

• I verified it reproduces with the latest version with - uses: ruby/setup-ruby@v1 (see Versioning policy)

• I tried to reproduce the issue locally by following the workflow steps (including all commands done by ruby/setup-ruby, except for Downloading Ruby & Extracting Ruby),
  and it did not reproduce locally (if it does reproduce locally, it's not a ruby/setup-ruby issue)

Are you running on a GitHub-hosted runner or a self-hosted runner?

GitHub-hosted runner

Link to the failed workflow job (must be a public workflow job, so the necessary information is available)

https://github.com/eregon/setup-ruby/actions/runs/11724213556/job/32657603152

Any other notes?

Regular run failing: https://github.com/ruby/setup-ruby/actions/runs/11718129929/job/32638979324?pr=667

/Users/runner/.rubies/truffleruby-24.1.1/bin/bundle lock
Could not load OpenSSL.
You must recompile Ruby with OpenSSL support.

Debug run: https://github.com/eregon/setup-ruby/actions/runs/11724213556/job/32657603152

Run ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
<internal:core> core/kernel.rb:255:in `require': you may need to install the system OpenSSL library libssl - see https://github.com/oracle/truffleruby/blob/master/doc/user/installing-libssl.md (dlopen(/Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.bundle, 0x0009): Library not loaded: /opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib (RuntimeError)
  Referenced from: <544C5488-F84C-3FC0-A63A-965284495972> /Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.bundle
  Reason: tried: '/opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib' (no such file), '/opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib' (no such file))
	from /Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.rb:13:in `<top (required)>'
	from <internal:core> core/kernel.rb:255:in `require'

It is caused by actions/runner-images#10817

[eregon]

truffleruby*-head should automatically get fixed as all macos-14 images don't have [email protected] and only 3.
For the truffleruby release builds on macos-14 we will have to recompile them after that.

[hsbt]

It may be related with https://github.com/ruby/uri/actions/runs/11737031870/job/32697190779

I sometimes faced above error with Ruby 3.0.x and macos-latest that is macos-14

[eregon]

It sounds likely, indeed.
Actually I forgot in this issue that for releases, built by https://github.com/ruby/ruby-builder, we only build on macos-12 (soon macos-13 ruby/ruby-builder#19) and so if when it was build on macos-12 CRuby picked Hoembrew [email protected] then we could have the same issue.

I'll have to investigate to make sure.
ruby-build also sometimes builds its own openssl (for CRuby, never for TruffleRuby), which would avoid this problem.
Probably we'll have to rebuild all these macOS builds which link to 1.1.

[eregon]

actions/runner-images#10817 (comment)

We are currently reverting the change and keeping OpenSSL 1.1 in our images. It will be the default version for now.

So this issue should no longer happen soon.
We probably still want to figure out which Ruby builds link to which SSL (e.g. by adding some extra commands in test.yml).

[eregon]

From https://github.com/ruby/setup-ruby/actions/runs/11757562634/job/32754961816

1.9 	/Users/runner/hostedtoolcache/Ruby/1.9.3-p551/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.0 	/Users/runner/hostedtoolcache/Ruby/2.0.0-p648/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.1 	/Users/runner/hostedtoolcache/Ruby/2.1.9/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.2	/Users/runner/hostedtoolcache/Ruby/2.2.10/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.3	/Users/runner/hostedtoolcache/Ruby/2.3.8/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.4 	/Users/runner/hostedtoolcache/Ruby/2.4.10/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.5 	/Users/runner/hostedtoolcache/Ruby/2.5.9/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.6 	/Users/runner/hostedtoolcache/Ruby/2.6.10/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.7 	/Users/runner/hostedtoolcache/Ruby/2.7.8/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
3.0	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
3.1	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.2 	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.3 	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.4	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
ruby-head	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
truffleruby	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby-head 	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby+graalvm	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby+graalvm-head	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)

So:

• 1.9-2.7 use vendored libssl built by ruby-build.
• 3.0 uses /usr/local/opt/[email protected]/lib/libssl.1.1.dylib (Ruby 3.0 openssl gem only supports libssl <= 1.1, cannot use 3)
• 3.1-head uses /usr/local/opt/openssl@3/lib/libssl.3.dylib
• truffleruby* uses /usr/local/opt/[email protected]/lib/libssl.1.1.dylib

[eregon]

We could rebuild CRuby 3.0.x, but we either need the runners to not have libssl 1.1 anymore, or add an option in ruby-build to always use vendored libssl.

For truffleruby*-head, I'll change to prefer libssl 3 over libssl 1.1: oracle/truffleruby#3713
But for existing truffleruby releases, they all prefer libssl 1.1 over libssl 3, so either we need to wait for libssl 1.1 to be removed and recompile after, or we need to recompile with OPENSSL_PREFIX=$(brew --prefix openssl@3).

[eregon]

I fixed this for CRuby 3.0.x with
https://github.com/ruby/ruby-builder/actions/runs/11825221988/job/32948504823
https://github.com/ruby/ruby-builder/actions/runs/11825503027
and verified that works in
https://github.com/ruby/setup-ruby/actions/runs/11826456846/job/32952496665#step:15:7
Note that 3.0.7 is in the hostedtoolcache and so there it still uses 1.1 from Homebrew.
Previous builds are renamed with -ssl11 at https://github.com/ruby/ruby-builder/releases/tag/toolcache

I also tried to fix it for TruffleRuby but unfortunately there is an unexpected error:
https://github.com/ruby/setup-ruby/actions/runs/11826456846/job/32952511503

$ gem install json -v 2.2.0
dyld[3532]: missing symbol called

macOS doesn't tell which symbol is missing here :(
So I will revert the change for truffleruby releases for now.