@@ -309,10 +309,14 @@ jobs:
309309 shell : bash
310310 run : |
311311 set -euxo pipefail
312- brew install boost openssl llvm@17 bison
312+ # Pin openssl@3 (Apache-2.0): the default 'openssl' formula will move to
313+ # OpenSSL 4.0, which drops the legacy TLS-method APIs Thrift still uses.
314+ brew install boost openssl@3 llvm@17 bison
313315 ln -sf "$(brew --prefix llvm@17)/bin/clang-format" "$(brew --prefix)/bin/clang-format"
314316 echo "$(brew --prefix bison)/bin" >> "$GITHUB_PATH"
315317 echo "$(brew --prefix llvm@17)/bin" >> "$GITHUB_PATH"
318+ # Homebrew OpenSSL is keg-only, so point find_package(OpenSSL) at it.
319+ echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
316320 clang-format --version
317321 bison --version
318322 - name : Cache Maven packages
@@ -429,8 +433,16 @@ jobs:
429433 throw "Boost not found under C:\local after installing ${{ matrix.boost_choco }}"
430434 }
431435 echo $boostDir.FullName >> $env:GITHUB_PATH
432- choco install openssl -y --no-progress
433- $sslPath = (Get-ChildItem 'C:\Program Files\OpenSSL*' -Directory | Select-Object -First 1).FullName
436+ # Use a pinned OpenSSL 3.x (Apache-2.0). 'choco install openssl' now
437+ # installs OpenSSL 4.0, which removed the legacy TLS-method APIs that
438+ # Apache Thrift's TSSLSocket still calls. The FireDaemon zip is a clean
439+ # prebuilt OpenSSL 3.5.x that keeps them.
440+ $sslZip = "$env:RUNNER_TEMP\openssl-3.5.3.zip"
441+ $sslDir = "$env:RUNNER_TEMP\openssl-3"
442+ curl.exe -L --fail --retry 3 -o $sslZip 'https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.3.zip'
443+ Expand-Archive -Path $sslZip -DestinationPath $sslDir -Force
444+ $sslPath = (Get-ChildItem $sslDir -Recurse -Directory -Filter 'x64' | Select-Object -First 1).FullName
445+ if (-not $sslPath) { throw "OpenSSL x64 dir not found under $sslDir" }
434446 echo "$sslPath\bin" >> $env:GITHUB_PATH
435447 echo "OPENSSL_ROOT_DIR=$sslPath" >> $env:GITHUB_ENV
436448 - name : Cache Maven packages
0 commit comments