curl + recursive dependen{cies,ts}: switch to `openssl@3`

[carlocab]

• [x] Have you followed the guidelines for contributing?
• [x] Have you ensured that your commits follow the commit style guide?
• [x] Have you checked that there aren't other open pull requests for the same formula update/change?
• [ ] Have you built your formula locally with brew install --build-from-source <formula>, where <formula> is the name of the formula you're submitting?
• [ ] Is your test running fine brew test <formula>, where <formula> is the name of the formula you're submitting?
• [ ] Does your build pass brew audit --strict <formula> (after doing brew install --build-from-source <formula>)? If this is a new formula, does it pass brew audit --new <formula>?

---

This will probably break a whole bunch of things, especially on Linux, but we may as well try to get this going.

[carlocab]

This PR is probably missing at least node and lanraragi, which are part of nghttp2's dependency graph.

[carlocab]

Oops, nope. There's lots more. Presumably the tap-syntax job is picking up all the uses_from_macos "curl" instances that I was trying to ignore here.

[Bo98]

I think our tap_syntax check only follows macOS dependency graph so we should maybe fix that first.

[Bo98]

Presumably the tap-syntax job is picking up all the uses_from_macos "curl" instances

I'm surprised since we set HOMEBREW_SIMULATE_MACOS_ON_LINUX?

[carlocab]

Presumably the tap-syntax job is picking up all the uses_from_macos "curl" instances

I'm surprised since we set HOMEBREW_SIMULATE_MACOS_ON_LINUX?

Yea, that was a guess that turned out to be mistaken. I had thought brew audit --strict foo recurses through foo's dependency graph, but it does not.

[Bo98]

Ideally we should get that audit checking on Linux first though before we migrate. https://github.com/Homebrew/brew/pull/12117 will help enable that but I imagine a lot of things will pop up.

Plus fixing the conflict that currently exists between [email protected] and openssl@3 on Linux: #85812.

[lprimak]

Please do not hurry to switch to OpenSSL v3: There is an issue that will brick older Macs with this: https://github.com/openssl/openssl/issues/16670

Thank you

[chris-araman]

Is https://github.com/openssl/openssl/issues/16670 actually a blocker? Homebrew requires macOS 10.15 or later.

[lprimak]

Lots of people still use older macs including me. The above issue is resolved but not merged in yet

[Bo98]

Homebrew primarily supports 10.15 or higher but does "support" down to 10.10 best effort basis (see footnote 2 of the document you linked) - that means we don't actively test it and it's up to users to send pull requests to fix things.

While we don't normally let older macOS issues block things here, in this scenario knowingly breaking older macOS by rendering curl unusable would end up crippling brew entirely for them since installing Homebrew's curl is required on < 10.12.

The patch is known (I suggested it already upstream) but I need to send legal documents in order to open a pull request. It's probably will have to do it to get things moving - I'll have a look before the Christmas period.

[lprimak]

Thanks @Bo98

[cho-m]

Going to close this as quite outdated and probably easier to open new PRs. We should track OpenSSL 3 migration via #104784 or another issue where we can scope this better.