Tatsh / wiswa / 34787695051

100%

push

github

templates/github/workflows/pyinstaller: link OpenSSL statically

cryptography stopped publishing a macOS x86_64 wheel. The Intel runner
therefore builds the extension from source against the Homebrew OpenSSL
3.2 installation, linking dynamically by default.

PyInstaller flattens every collected dylib into one directory, and the
older libssl.3.dylib bundled with Python lands there under the same
file name. The older library wins the collision, and the extension
cannot resolve the OpenSSL 3.2 symbols it was built against.

The new step exports OPENSSL_STATIC=1 ahead of the dependency install.
The cryptography build then links the OpenSSL archives into the
extension, and no OpenSSL dylib enters the collected set. The published
wheels are built the same way.

The variable applies to every macOS runner. An arm64 job installs the
published wheel and never reads it.

Signed-off-by: Andrew Udvare <audvare@gmail.com>

788 of 788 branches covered (100.0%)

Branch coverage included in aggregate %.

2040 of 2040 relevant lines covered (100.0%)

5.0 hits per line