Skip to content

Remove openssl gem requirement #5736

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mokagio merged 4 commits into from
Aug 14, 2026
Merged

Remove openssl gem requirement #5736

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
471a9e3
Remove `openssl` requirement. Unnecessary in Ruby 3.4.9
mokagio Aug 13, 2026
8156757
Enforce the Ruby version declared in `.ruby-version`
mokagio Aug 13, 2026
24de909
Remove confusing `ruby file:` rule
mokagio Aug 14, 2026
9384850
Run `bundle install` and track result to remove `ruby file:` edits
mokagio Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,3 @@ gem 'fastlane-plugin-wpmreleasetoolkit', '~> 14.11'

# Used in scripts/themes/
gem 'google-apis-sheets_v4', '~> 0.48'

# To avoid errors like:
#
# SSL_connect returned=1 errno=0 peeraddr=3.5.132.155:443 state=error: certificate verify failed (unable to get certificate CRL)
#
# See https://github.com/ruby/openssl/issues/949
gem 'openssl', '~> 4.0'

@claude claude Bot Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth double-checking the premise here: removing this doesn't leave you with "no openssl gem", it drops you back to the default gem bundled with Ruby. Gemfile.lock had openssl (4.0.2); Ruby 3.4 ships openssl as a default gem in the 3.3.x line, so this is effectively a downgrade of the TLS stack, not just deleting a redundant entry.

So "unnecessary in Ruby 3.4.9" holds only if the fix for ruby/openssl#949 is present in the 3.3.x default gem, not merely in 4.0. Quick check on a 3.4.9 install:

ruby -ropenssl -e 'puts [RUBY_VERSION, OpenSSL::VERSION, OpenSSL::OPENSSL_LIBRARY_VERSION].join(" / ")'

Two caveats on how to validate:

  • SSL_connect ... unable to get certificate CRL is sensitive to the system OpenSSL library and cert store, so a green Linux Buildkite run does not prove macOS dev machines are fine. Reproduce on the environment where it originally bit (I couldn't find the commit that added the pin — the checkout here is shallow — but the wording suggests a local/dev-machine failure).
  • After this change the openssl version is no longer recorded in Gemfile.lock at all, so it becomes implicit per-environment, and you pick up openssl fixes only on Ruby patch releases / .ruby-version bumps rather than on the gem's own cadence. Minor, but it's the reproducibility trade-off you're making.

@mokagio mokagio Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified. Everything is good for our usage in Ruby 3.4.9.

3.4.9 ships openssl 3.3.1, which contains the fix for the issue.

Image
AI-performed research details

The fix is ruby/openssl#950, which
removes V_FLAG_CRL_CHECK_ALL from the default cert store. It shipped in
openssl 3.1.2 / 3.2.2 / 3.3.1
(maintainer confirmation),
and Ruby picked it up as a default-gem backport in 3.4.8
(Bo98).

Same file, two tags — this is the whole argument:

Confirmed on a local 3.4.9 install:

$ bundle exec ruby -ropenssl -e 'puts [RUBY_VERSION, OpenSSL::VERSION].join(" / ")'
3.4.9 / 3.3.1

That also dates the pin: it landed in #4929 (2026-01-30) while .ruby-version
was 3.2.2, i.e. openssl 3.1.0, which predates the fix. It was load-bearing then
and stopped being so at #5605, when we moved to 3.4.9.

On "downgrade of the TLS stack" — the gem is a binding, not the TLS
implementation. The stack is the system OpenSSL library (unchanged by this
diff); 4.0.2 → 3.3.1 is a binding-API downgrade, and both sides carry the CRL
fix. And you're right that a green CI run proves nothing here: my machine links
OpenSSL 3.5.5, which doesn't trigger the bug at all. The source anchors above
are the environment-independent proof.

The reproducibility point stands, though: the
developers being on Ruby >= 3.4.8

2 changes: 0 additions & 2 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,6 @@ GEM
faraday (>= 1, < 3)
sawyer (~> 0.9)
open4 (1.3.4)
openssl (4.0.2)
options (2.3.2)
optparse (0.8.1)
os (1.1.4)
Expand Down Expand Up @@ -391,7 +390,6 @@ DEPENDENCIES
fastlane-plugin-firebase_app_distribution (~> 1.0)
fastlane-plugin-wpmreleasetoolkit (~> 14.11)
google-apis-sheets_v4 (~> 0.48)
openssl (~> 4.0)

BUNDLED WITH
4.0.17
Loading