libssl.1.1.dylib not found for Ruby 3.0 and TruffleRuby on macos-14

[eregon]

Ensure the following before filing this issue

• I verified it reproduces with the latest version with - uses: ruby/setup-ruby@v1 (see Versioning policy)

• I tried to reproduce the issue locally by following the workflow steps (including all commands done by ruby/setup-ruby, except for Downloading Ruby & Extracting Ruby),
  and it did not reproduce locally (if it does reproduce locally, it's not a ruby/setup-ruby issue)

Are you running on a GitHub-hosted runner or a self-hosted runner?

GitHub-hosted runner

Link to the failed workflow job (must be a public workflow job, so the necessary information is available)

https://github.com/eregon/setup-ruby/actions/runs/11724213556/job/32657603152

Any other notes?

Regular run failing: https://github.com/ruby/setup-ruby/actions/runs/11718129929/job/32638979324?pr=667

/Users/runner/.rubies/truffleruby-24.1.1/bin/bundle lock
Could not load OpenSSL.
You must recompile Ruby with OpenSSL support.

Debug run: https://github.com/eregon/setup-ruby/actions/runs/11724213556/job/32657603152

Run ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
<internal:core> core/kernel.rb:255:in `require': you may need to install the system OpenSSL library libssl - see https://github.com/oracle/truffleruby/blob/master/doc/user/installing-libssl.md (dlopen(/Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.bundle, 0x0009): Library not loaded: /opt/homebrew/opt/openssl@1.1/lib/libssl.1.1.dylib (RuntimeError)
  Referenced from: <544C5488-F84C-3FC0-A63A-965284495972> /Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.bundle
  Reason: tried: '/opt/homebrew/opt/openssl@1.1/lib/libssl.1.1.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/opt/openssl@1.1/lib/libssl.1.1.dylib' (no such file), '/opt/homebrew/opt/openssl@1.1/lib/libssl.1.1.dylib' (no such file))
	from /Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.rb:13:in `<top (required)>'
	from <internal:core> core/kernel.rb:255:in `require'

It is caused by actions/runner-images#10817

[eregon]

truffleruby*-head should automatically get fixed as all macos-14 images don't have openssl@1.1 and only 3.
For the truffleruby release builds on macos-14 we will have to recompile them after that.

[hsbt]

It may be related with https://github.com/ruby/uri/actions/runs/11737031870/job/32697190779

I sometimes faced above error with Ruby 3.0.x and macos-latest that is macos-14

[eregon]

It sounds likely, indeed.
Actually I forgot in this issue that for releases, built by https://github.com/ruby/ruby-builder, we only build on macos-12 (soon macos-13 ruby/ruby-builder#19) and so if when it was build on macos-12 CRuby picked Hoembrew openssl@1.1 then we could have the same issue.

I'll have to investigate to make sure.
ruby-build also sometimes builds its own openssl (for CRuby, never for TruffleRuby), which would avoid this problem.
Probably we'll have to rebuild all these macOS builds which link to 1.1.

[eregon]

actions/runner-images#10817 (comment)

We are currently reverting the change and keeping OpenSSL 1.1 in our images. It will be the default version for now.

So this issue should no longer happen soon.
We probably still want to figure out which Ruby builds link to which SSL (e.g. by adding some extra commands in test.yml).

[eregon]

From https://github.com/ruby/setup-ruby/actions/runs/11757562634/job/32754961816

1.9 	/Users/runner/hostedtoolcache/Ruby/1.9.3-p551/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.0 	/Users/runner/hostedtoolcache/Ruby/2.0.0-p648/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.1 	/Users/runner/hostedtoolcache/Ruby/2.1.9/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.2	/Users/runner/hostedtoolcache/Ruby/2.2.10/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.3	/Users/runner/hostedtoolcache/Ruby/2.3.8/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.4 	/Users/runner/hostedtoolcache/Ruby/2.4.10/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.5 	/Users/runner/hostedtoolcache/Ruby/2.5.9/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.6 	/Users/runner/hostedtoolcache/Ruby/2.6.10/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.7 	/Users/runner/hostedtoolcache/Ruby/2.7.8/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
3.0	/usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
3.1	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.2 	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.3 	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.4	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
ruby-head	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
truffleruby	/usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby-head 	/usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby+graalvm	/usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby+graalvm-head	/usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)

So:

• 1.9-2.7 use vendored libssl built by ruby-build.
• 3.0 uses /usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib (Ruby 3.0 openssl gem only supports libssl <= 1.1, cannot use 3)
• 3.1-head uses /usr/local/opt/openssl@3/lib/libssl.3.dylib
• truffleruby* uses /usr/local/opt/openssl@1.1/lib/libssl.1.1.dylib

[eregon]

We could rebuild CRuby 3.0.x, but we either need the runners to not have libssl 1.1 anymore, or add an option in ruby-build to always use vendored libssl.

For truffleruby*-head, I'll change to prefer libssl 3 over libssl 1.1: truffleruby/truffleruby#3713
But for existing truffleruby releases, they all prefer libssl 1.1 over libssl 3, so either we need to wait for libssl 1.1 to be removed and recompile after, or we need to recompile with OPENSSL_PREFIX=$(brew --prefix openssl@3).