From 4cb0afbecc9e45d388ef7852be191b87f0a8bb14 Mon Sep 17 00:00:00 2001
From: Patrick Linnane <patrick@linnane.io>
Date: Tue, 13 Oct 2026 19:32:39 -0700
Subject: [PATCH] Allow OpenSSL 4 for Rubies that support it

Ruby/OpenSSL 3.2.4, 3.3.3 and 4.0.2 added OpenSSL 4 support and ship
with Ruby 3.3.12, 3.4.10 and 4.0.6. Widen the needs_openssl upper
bound to 4.x.x for those releases and later, including the matching
development definitions, so an installed OpenSSL 4 is used instead of
vendoring OpenSSL 3. Make update-cruby apply the same boundaries to
new definitions, and cover a 4.x.x upper bound in the build tests.

Signed-off-by: Patrick Linnane <patrick@linnane.io>
---
 script/update-cruby             | 15 +++++--
 share/ruby-build/3.3-dev        |  2 +-
 share/ruby-build/3.3.12         |  2 +-
 share/ruby-build/3.4-dev        |  2 +-
 share/ruby-build/3.4.10         |  2 +-
 share/ruby-build/3.4.11         |  2 +-
 share/ruby-build/4.0-dev        |  2 +-
 share/ruby-build/4.0.6          |  2 +-
 share/ruby-build/4.0.7          |  2 +-
 share/ruby-build/4.1-dev        |  2 +-
 share/ruby-build/4.1.0-preview1 |  2 +-
 share/ruby-build/ruby-dev       |  2 +-
 test/build.bats                 | 71 +++++++++++++++++++++++++++++++++
 13 files changed, 94 insertions(+), 14 deletions(-)

diff --git a/script/update-cruby b/script/update-cruby
index bc65a50ff4..d42ca67695 100755
--- a/script/update-cruby
+++ b/script/update-cruby
@@ -36,11 +36,20 @@ else
   exit 1
 fi
 
-major_version=$(echo ${version} | cut -d '.' -f 1)
+IFS=.- read -r major_version minor_version patch_version _prerelease <<< "$version"
+openssl_upper_bound="3.x.x"
+# These releases include Ruby/OpenSSL 3.2.4, 3.3.3, and 4.0.2, respectively.
+if (( (major_version == 3 && minor_version == 3 && patch_version >= 12) ||
+      (major_version == 3 && minor_version == 4 && patch_version >= 10) ||
+      (major_version == 4 && (minor_version >= 1 || patch_version >= 6)) ||
+      major_version > 4 )); then
+  openssl_upper_bound="4.x.x"
+fi
+
 if [ "$major_version" -ge 4 ]; then
-  needs_openssl="needs_openssl:1.1.1-3.x.x"
+  needs_openssl="needs_openssl:1.1.1-${openssl_upper_bound}"
 else
-  needs_openssl="needs_openssl:1.0.2-3.x.x"
+  needs_openssl="needs_openssl:1.0.2-${openssl_upper_bound}"
 fi
 
 cat > "$file" <<EOS
diff --git a/share/ruby-build/3.3-dev b/share/ruby-build/3.3-dev
index 2bcb38599a..3c2f90b306 100644
--- a/share/ruby-build/3.3-dev
+++ b/share/ruby-build/3.3-dev
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.18" "https://github.com/openssl/openssl/releases/download/openssl-3.0.18/openssl-3.0.18.tar.gz#d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b" openssl --if needs_openssl:1.0.2-3.x.x
+install_package "openssl-3.0.18" "https://github.com/openssl/openssl/releases/download/openssl-3.0.18/openssl-3.0.18.tar.gz#d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b" openssl --if needs_openssl:1.0.2-4.x.x
 install_git "ruby-3.3-dev" "https://github.com/ruby/ruby.git" "ruby_3_3" autoconf enable_shared standard_install_with_bundled_gems
diff --git a/share/ruby-build/3.3.12 b/share/ruby-build/3.3.12
index 513211f14b..6bca8f1c00 100644
--- a/share/ruby-build/3.3.12
+++ b/share/ruby-build/3.3.12
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.21" "https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz#617e29af8e421f46649484a4937e48c685e47f46488167c982f88bc4ec1d522f" openssl --if needs_openssl:1.0.2-3.x.x
+install_package "openssl-3.0.21" "https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz#617e29af8e421f46649484a4937e48c685e47f46488167c982f88bc4ec1d522f" openssl --if needs_openssl:1.0.2-4.x.x
 install_package "ruby-3.3.12" "https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.12.tar.gz#b06d63beae271933033e27f0a389bc582a009e7845357d44365c39de525a051b" enable_shared standard
diff --git a/share/ruby-build/3.4-dev b/share/ruby-build/3.4-dev
index 856e6e11c9..216f3285f5 100644
--- a/share/ruby-build/3.4-dev
+++ b/share/ruby-build/3.4-dev
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.18" "https://github.com/openssl/openssl/releases/download/openssl-3.0.18/openssl-3.0.18.tar.gz#d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b" openssl --if needs_openssl:1.0.2-3.x.x
+install_package "openssl-3.0.18" "https://github.com/openssl/openssl/releases/download/openssl-3.0.18/openssl-3.0.18.tar.gz#d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b" openssl --if needs_openssl:1.0.2-4.x.x
 install_git "ruby-3.4-dev" "https://github.com/ruby/ruby.git" "ruby_3_4" autoconf enable_shared standard_install_with_bundled_gems
diff --git a/share/ruby-build/3.4.10 b/share/ruby-build/3.4.10
index 5d6645ecdc..d10dfdb0d0 100644
--- a/share/ruby-build/3.4.10
+++ b/share/ruby-build/3.4.10
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.21" "https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz#617e29af8e421f46649484a4937e48c685e47f46488167c982f88bc4ec1d522f" openssl --if needs_openssl:1.0.2-3.x.x
+install_package "openssl-3.0.21" "https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz#617e29af8e421f46649484a4937e48c685e47f46488167c982f88bc4ec1d522f" openssl --if needs_openssl:1.0.2-4.x.x
 install_package "ruby-3.4.10" "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz#ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec" enable_shared standard
diff --git a/share/ruby-build/3.4.11 b/share/ruby-build/3.4.11
index 9af15c3e7f..b34413e81d 100644
--- a/share/ruby-build/3.4.11
+++ b/share/ruby-build/3.4.11
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.22" "https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz#67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81" openssl --if needs_openssl:1.0.2-3.x.x
+install_package "openssl-3.0.22" "https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz#67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81" openssl --if needs_openssl:1.0.2-4.x.x
 install_package "ruby-3.4.11" "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.gz#5c22be44524312b3d433d68739bcc530633b1da5ef8ba0afa0a37680da17d3de" enable_shared standard
diff --git a/share/ruby-build/4.0-dev b/share/ruby-build/4.0-dev
index 2f45c9cb8a..783bffca75 100644
--- a/share/ruby-build/4.0-dev
+++ b/share/ruby-build/4.0-dev
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.18" "https://github.com/openssl/openssl/releases/download/openssl-3.0.18/openssl-3.0.18.tar.gz#d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b" openssl --if needs_openssl:1.1.1-3.x.x
+install_package "openssl-3.0.18" "https://github.com/openssl/openssl/releases/download/openssl-3.0.18/openssl-3.0.18.tar.gz#d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b" openssl --if needs_openssl:1.1.1-4.x.x
 install_git "ruby-4.0-dev" "https://github.com/ruby/ruby.git" "ruby_4_0" autoconf enable_shared standard_install_with_bundled_gems
diff --git a/share/ruby-build/4.0.6 b/share/ruby-build/4.0.6
index 04ffa88081..b70a49751a 100644
--- a/share/ruby-build/4.0.6
+++ b/share/ruby-build/4.0.6
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.21" "https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz#617e29af8e421f46649484a4937e48c685e47f46488167c982f88bc4ec1d522f" openssl --if needs_openssl:1.1.1-3.x.x
+install_package "openssl-3.0.21" "https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz#617e29af8e421f46649484a4937e48c685e47f46488167c982f88bc4ec1d522f" openssl --if needs_openssl:1.1.1-4.x.x
 install_package "ruby-4.0.6" "https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.gz#837d299e8f7ddf2be31a229a7a7e019d354979825117989acb3b32b1a9be262a" enable_shared standard
diff --git a/share/ruby-build/4.0.7 b/share/ruby-build/4.0.7
index d8f0affb3a..8a16e689b1 100644
--- a/share/ruby-build/4.0.7
+++ b/share/ruby-build/4.0.7
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.22" "https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz#67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81" openssl --if needs_openssl:1.1.1-3.x.x
+install_package "openssl-3.0.22" "https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz#67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81" openssl --if needs_openssl:1.1.1-4.x.x
 install_package "ruby-4.0.7" "https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz#911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c721e253412e82d" enable_shared standard
diff --git a/share/ruby-build/4.1-dev b/share/ruby-build/4.1-dev
index b11afbf81d..08789c3ed7 100644
--- a/share/ruby-build/4.1-dev
+++ b/share/ruby-build/4.1-dev
@@ -1,2 +1,2 @@
-install_package "openssl-3.5.4" "https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz#967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99" openssl --if needs_openssl:1.1.1-3.x.x
+install_package "openssl-3.5.4" "https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz#967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99" openssl --if needs_openssl:1.1.1-4.x.x
 install_git "ruby-master" "https://github.com/ruby/ruby.git" "master" autoconf enable_shared standard_install_with_bundled_gems
diff --git a/share/ruby-build/4.1.0-preview1 b/share/ruby-build/4.1.0-preview1
index 039ad3156a..7089d477c5 100644
--- a/share/ruby-build/4.1.0-preview1
+++ b/share/ruby-build/4.1.0-preview1
@@ -1,2 +1,2 @@
-install_package "openssl-3.0.22" "https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz#67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81" openssl --if needs_openssl:1.1.1-3.x.x
+install_package "openssl-3.0.22" "https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz#67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81" openssl --if needs_openssl:1.1.1-4.x.x
 install_package "ruby-4.1.0-preview1" "https://cache.ruby-lang.org/pub/ruby/4.1/ruby-4.1.0-preview1.tar.gz#fb530bb88e90de3ae91c1310a27ae090e6bd989b8726de50ef12a890a85b88ef" enable_shared standard
diff --git a/share/ruby-build/ruby-dev b/share/ruby-build/ruby-dev
index d79507c2a7..7cd3aee141 100644
--- a/share/ruby-build/ruby-dev
+++ b/share/ruby-build/ruby-dev
@@ -1,2 +1,2 @@
-install_package "openssl-3.5.4" "https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz#967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99" openssl --if needs_openssl:1.1.1-3.x.x
+install_package "openssl-3.5.4" "https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz#967311f84955316969bdb1d8d4b983718ef42338639c621ec4c34fddef355e99" openssl --if needs_openssl:1.1.1-4.x.x
 install_git "ruby-master" "${RUBY_REPO:-https://github.com/ruby/ruby.git}" "${RUBY_REF:-master}" autoconf enable_shared standard_install_with_bundled_gems
diff --git a/test/build.bats b/test/build.bats
index 4a86784509..8548b987f6 100755
--- a/test/build.bats
+++ b/test/build.bats
@@ -371,6 +371,34 @@ make install
 OUT
 }
 
+@test "use system OpenSSL 4" {
+  cached_tarball "ruby-3.2.0" configure
+
+  stub_repeated uname '-s : echo Linux'
+  stub_repeated brew false
+  stub cc '-xc -E - : echo "OpenSSL 4.0.3  29 Sep 2026"'
+  stub_repeated pkg-config false
+  stub_make_install
+
+  run_inline_definition <<DEF
+install_package "openssl-1.1.1w" "https://www.openssl.org/source/openssl-1.1.1w.tar.gz" openssl --if needs_openssl:1.1.1-4.x.x
+install_package "ruby-3.2.0" "http://ruby-lang.org/ruby/2.0/ruby-3.2.0.tar.gz"
+DEF
+  assert_success
+
+  unstub uname
+  unstub brew
+  unstub cc
+  unstub pkg-config
+  unstub make
+
+  assert_build_log <<OUT
+ruby-3.2.0: [--prefix=$INSTALL_ROOT,--with-ext=openssl,psych,+]
+make -j 2
+make install
+OUT
+}
+
 @test "use pkg-config OpenSSL" {
   cached_tarball "ruby-3.2.0" configure
 
@@ -637,6 +665,49 @@ make install
 OUT
 }
 
+@test "link to Homebrew OpenSSL 4" {
+  cached_tarball "ruby-3.2.0" configure
+
+  local homebrew_prefix="${TMP}/homebrew"
+  executable "${homebrew_prefix}/opt/openssl@3/bin/openssl" <<EXE
+#!/$BASH
+[ "\$1" = "version" ] || exit 1
+echo 'OpenSSL 3.5.4  30 Sep 2025'
+EXE
+  executable "${homebrew_prefix}/opt/openssl@4/bin/openssl" <<EXE
+#!/$BASH
+[ "\$1" = "version" ] || exit 1
+echo 'OpenSSL 4.0.3  29 Sep 2026'
+EXE
+
+  stub_repeated uname '-s : echo Linux'
+  stub cc '-xc -E - : echo "OpenSSL 1.0.1a  1 Aug 2023"'
+  stub_repeated brew \
+    'list : printf "openssl@3\nopenssl@4\n"' \
+    "--prefix : if [ \$# -ge 2 ]; then echo '$homebrew_prefix'/opt/\$2; else echo '$homebrew_prefix'; fi " \
+    "--repository : echo '$homebrew_prefix'"
+  stub_repeated pkg-config false
+  stub_make_install
+
+  run_inline_definition <<DEF
+install_package "openssl-1.1.1w" "https://www.openssl.org/source/openssl-1.1.1w.tar.gz" openssl --if needs_openssl:1.1.1-4.x.x
+install_package "ruby-3.2.0" "http://ruby-lang.org/ruby/2.0/ruby-3.2.0.tar.gz"
+DEF
+  assert_success
+
+  unstub uname
+  unstub cc
+  unstub brew
+  unstub pkg-config
+  unstub make
+
+  assert_build_log <<OUT
+ruby-3.2.0: [--prefix=$INSTALL_ROOT,--with-openssl-dir=$TMP/homebrew/opt/openssl@4,--with-ext=openssl,psych,+]
+make -j 2
+make install
+OUT
+}
+
 @test "forward extra command-line arguments as configure flags" {
   cached_tarball "ruby-3.2.0" configure