setup-ruby libssl.1.1.dylib not found for Ruby 3.0 and TruffleRuby on macos-14

Ensure the following before filing this issue

[X] I verified it reproduces with the latest version with - uses: ruby/setup-ruby@v1 (see Versioning policy)
[X] I tried to reproduce the issue locally by following the workflow steps (including all commands done by ruby/setup-ruby, except for Downloading Ruby & Extracting Ruby), and it did not reproduce locally (if it does reproduce locally, it's not a ruby/setup-ruby issue)

Are you running on a GitHub-hosted runner or a self-hosted runner?

GitHub-hosted runner

Link to the failed workflow job (must be a public workflow job, so the necessary information is available)

https://github.com/eregon/setup-ruby/actions/runs/11724213556/job/32657603152

Any other notes?

Regular run failing: https://github.com/ruby/setup-ruby/actions/runs/11718129929/job/32638979324?pr=667

/Users/runner/.rubies/truffleruby-24.1.1/bin/bundle lock
Could not load OpenSSL.
You must recompile Ruby with OpenSSL support.

Debug run: https://github.com/eregon/setup-ruby/actions/runs/11724213556/job/32657603152

Run ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
<internal:core> core/kernel.rb:255:in `require': you may need to install the system OpenSSL library libssl - see https://github.com/oracle/truffleruby/blob/master/doc/user/installing-libssl.md (dlopen(/Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.bundle, 0x0009): Library not loaded: /opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib (RuntimeError)
  Referenced from: <544C5488-F84C-3FC0-A63A-965284495972> /Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.bundle
  Reason: tried: '/opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib' (no such file), '/opt/homebrew/opt/[email protected]/lib/libssl.1.1.dylib' (no such file))
	from /Users/runner/.rubies/truffleruby-24.1.1/lib/mri/openssl.rb:13:in `<top (required)>'
	from <internal:core> core/kernel.rb:255:in `require'

It is caused by https://github.com/actions/runner-images/issues/10817

Nov 07 '24 13:11 eregon

truffleruby*-head should automatically get fixed as all macos-14 images don't have [email protected] and only 3. For the truffleruby release builds on macos-14 we will have to recompile them after that.

Nov 07 '24 13:11 eregon

It may be related with https://github.com/ruby/uri/actions/runs/11737031870/job/32697190779

I sometimes faced above error with Ruby 3.0.x and macos-latest that is macos-14

Nov 08 '24 06:11 hsbt

It sounds likely, indeed. Actually I forgot in this issue that for releases, built by https://github.com/ruby/ruby-builder, we only build on macos-12 (soon macos-13 https://github.com/ruby/ruby-builder/pull/19) and so if when it was build on macos-12 CRuby picked Hoembrew [email protected] then we could have the same issue.

I'll have to investigate to make sure. ruby-build also sometimes builds its own openssl (for CRuby, never for TruffleRuby), which would avoid this problem. Probably we'll have to rebuild all these macOS builds which link to 1.1.

Nov 08 '24 12:11 eregon

https://github.com/actions/runner-images/issues/10817#issuecomment-2465799411

We are currently reverting the change and keeping OpenSSL 1.1 in our images. It will be the default version for now.

So this issue should no longer happen soon. We probably still want to figure out which Ruby builds link to which SSL (e.g. by adding some extra commands in test.yml).

Nov 08 '24 22:11 eregon

From https://github.com/ruby/setup-ruby/actions/runs/11757562634/job/32754961816

1.9 	/Users/runner/hostedtoolcache/Ruby/1.9.3-p551/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.0 	/Users/runner/hostedtoolcache/Ruby/2.0.0-p648/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.1 	/Users/runner/hostedtoolcache/Ruby/2.1.9/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.2	/Users/runner/hostedtoolcache/Ruby/2.2.10/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.3	/Users/runner/hostedtoolcache/Ruby/2.3.8/x64/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0)
2.4 	/Users/runner/hostedtoolcache/Ruby/2.4.10/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.5 	/Users/runner/hostedtoolcache/Ruby/2.5.9/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.6 	/Users/runner/hostedtoolcache/Ruby/2.6.10/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
2.7 	/Users/runner/hostedtoolcache/Ruby/2.7.8/x64/openssl/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
3.0	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
3.1	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.2 	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.3 	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
3.4	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
ruby-head	/usr/local/opt/openssl@3/lib/libssl.3.dylib (compatibility version 3.0.0, current version 3.0.0)
truffleruby	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby-head 	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby+graalvm	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
truffleruby+graalvm-head	/usr/local/opt/[email protected]/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)

So:

1.9-2.7 use vendored libssl built by ruby-build.
3.0 uses /usr/local/opt/[email protected]/lib/libssl.1.1.dylib (Ruby 3.0 openssl gem only supports libssl <= 1.1, cannot use 3)
3.1-head uses /usr/local/opt/openssl@3/lib/libssl.3.dylib
truffleruby* uses /usr/local/opt/[email protected]/lib/libssl.1.1.dylib

Nov 09 '24 16:11 eregon

We could rebuild CRuby 3.0.x, but we either need the runners to not have libssl 1.1 anymore, or add an option in ruby-build to always use vendored libssl.

For truffleruby*-head, I'll change to prefer libssl 3 over libssl 1.1: https://github.com/oracle/truffleruby/pull/3713 But for existing truffleruby releases, they all prefer libssl 1.1 over libssl 3, so either we need to wait for libssl 1.1 to be removed and recompile after, or we need to recompile with OPENSSL_PREFIX=$(brew --prefix openssl@3).

Nov 09 '24 16:11 eregon

I fixed this for CRuby 3.0.x with https://github.com/ruby/ruby-builder/actions/runs/11825221988/job/32948504823 https://github.com/ruby/ruby-builder/actions/runs/11825503027 and verified that works in https://github.com/ruby/setup-ruby/actions/runs/11826456846/job/32952496665#step:15:7 Note that 3.0.7 is in the hostedtoolcache and so there it still uses 1.1 from Homebrew. Previous builds are renamed with -ssl11 at https://github.com/ruby/ruby-builder/releases/tag/toolcache

I also tried to fix it for TruffleRuby but unfortunately there is an unexpected error: https://github.com/ruby/setup-ruby/actions/runs/11826456846/job/32952511503

$ gem install json -v 2.2.0
dyld[3532]: missing symbol called

macOS doesn't tell which symbol is missing here :( So I will revert the change for truffleruby releases for now.

Nov 13 '24 22:11 eregon

As far as I can tell from https://github.com/actions/runner-images/issues/10817 [email protected] will remain on runners where it's installed, so it will keep working and there is nothing to change here.

Sep 17 '25 20:09 eregon