Fix macOS CI by building against openssl@3 - #13
Open
tedmalone wants to merge 2 commits into
Open
Conversation
Homebrew no longer carries openssl@1.1, so `brew install openssl@1.1` fails outright and the macOS job dies in setup, before any Go code is compiled: Warning: No available formula with the name "openssl@1.1". Error: Process completed with exit code 1 The last green macOS run was 2026-06-03; nothing in the tree changed, the formula went away underneath it. Every PR to this repo fails the same way today, #12 among them. Moves the three references to openssl@3, and hardens the symlink step while it is being touched: macos-latest is arm64 now, so brew's prefix is /opt/homebrew rather than /usr/local, and a bare `ln -s` into /usr/local/include fails if the link is already there. `mkdir -p` plus `ln -sfn` at an explicit target is idempotent either way. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
maraino
requested changes
Aug 11, 2026
maraino
left a comment
maraino
left a comment
There was a problem hiding this comment.
We don't need to add the link in /usr/local/include
Comment on lines
+59
to
+61
| run: | | ||
| sudo mkdir -p /usr/local/include | ||
| sudo ln -sfn "$(brew --prefix openssl@3)/include/openssl" /usr/local/include/openssl |
There was a problem hiding this comment.
This is not necessary, you're already adding the C_INCLUDE_PATH bellow. Tested on a macOS with openssl in /opt/homebrew/...
$ brew --prefix openssl@3
/opt/homebrew/opt/openssl@3
Author
There was a problem hiding this comment.
Good catch — removed the Link openssl step (6e00673). The Test step already points cgo at the headers/libs via C_INCLUDE_PATH/LIBRARY_PATH using brew --prefix openssl@3, which resolves on both the Intel (/usr/local) and Apple Silicon (/opt/homebrew) layouts, so the /usr/local/include/openssl symlink was redundant. Thanks!
hslatman
changed the title
The Test step already points cgo at the headers/libs via C_INCLUDE_PATH/LIBRARY_PATH using `brew --prefix openssl@3`, which resolves on both Intel (/usr/local) and Apple Silicon (/opt/homebrew) runners. The /usr/local/include/openssl symlink is a leftover from the Intel-only layout and is no longer needed. Per review feedback from @maraino.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Homebrew no longer carries
openssl@1.1, so the macOS job fails in setup — before any Go code is compiled:Nothing in the tree changed; the formula went away underneath it. The last green macOS run on this repo was 2026-06-03, and the next one — 08-03 — failed this way. Every PR to this repo fails the same way today, #12 among them.
Change
The three
openssl@1.1references becomeopenssl@3.The symlink step is hardened while it's being touched.
macos-latestis arm64 now, so brew's prefix is/opt/homebrew, not/usr/local— and a bareln -sinto/usr/local/includefails outright if the link is already there.mkdir -pplusln -sfnat an explicit target is idempotent whichever state the runner is in.The
Teststep already passesC_INCLUDE_PATH/LIBRARY_PATHexplicitly, so the symlink is only there for cgo that hardcodes<openssl/...>; keeping it, just making it not fail the job.Scope
CI only — no Go code touched. Targets
surrogateso #12 picks it up on rebase.