python-build: honor explicitly configured OpenSSL on macOS by aprylewu · Pull Request #3541 · pyenv/pyenv

aprylewu · 2026-09-11T17:17:09Z

When a macOS build supplies --with-openssl, Python-Build still selects an OpenSSL installation from Homebrew and prepends its include, library, and runtime search paths. The explicit configure option survives, but the injected flags can refer to a different installation.

Skip automatic OpenSSL selection when an explicit --with-openssl argument is present. Recognize both argument forms in CONFIGURE_OPTS, PYTHON_CONFIGURE_OPTS, and definition-provided package options. The check also covers definitions that call the Homebrew/MacPorts OpenSSL selectors directly or repeatedly. A standalone --with-openssl-rpath still allows automatic selection. General dependency-prefix flags are unchanged.

Prerequisite

Considered a hook or plugin. This corrects the built-in dependency selection before it alters compiler flags or installs a bundled OpenSSL.
Closes "use openssl@<...> from homebrew" is displayed even if OpenSSL to use has been specified explicitly #2852.

Tests

Added four original regressions through the python-build entry point using tiny local source fixtures and stubbed build commands, plus four direct/repeated-selector regressions requested during review. The original cases fail on the base revision; the four follow-up cases fail on the previous PR head. All pass with this change.
Covered automatic Homebrew selection with --with-openssl-rpath alone and the bundled fallback when no OpenSSL location is configured or found.
Bash 3.2 syntax check with extglob enabled and git diff --check.
make test on macOS with Bash 3.2 and Bats 1.10.0: 470 passed, 9 skipped (fish/PowerShell are unavailable; the Linux ldconfig -p case does not apply).

The fixtures inspect configure arguments and compiler flags; no CPython or OpenSSL compilation is performed locally.

Implementation and regression tests were prepared with assistance from OpenAI Codex.

Summary by cubic

Honors an explicitly configured OpenSSL on macOS so automatic Homebrew or MacPorts selection no longer overrides it.

python-build now treats --with-openssl and --with-openssl=... in CONFIGURE_OPTS, PYTHON_CONFIGURE_OPTS, and package options as an explicit choice. It skips Homebrew/MacPorts discovery, skips the bundled OpenSSL fallback, and still allows automatic selection when only --with-openssl-rpath is present. The guard also applies when definitions call the Homebrew or MacPorts selectors directly or repeatedly. Closes pyenv/pyenv issue #2852.

Tests

Adds regression tests for explicit Homebrew/MacPorts bypass, direct and repeated selector calls, rpath-only behavior, and the bundled fallback.

^{Written for commit f5c262e. Summary will update on new commits.}

Skip automatic OpenSSL selection when configure options supply --with-openssl, while keeping rpath-only options on the existing detection path. Assisted-by: OpenAI Codex Signed-off-by: Mingyang Wu <129849514+aprylewu@users.noreply.github.com>

cubic-dev-ai

No issues found across 2 files

_{Re-trigger cubic}

native-api

Will this also prevent picking OpenSSL from Homebrew/MacPorts?
IIRC after has_broken_mac_openssl, OpenSSL search triggers again at some point.

FWIW, scripts aren't required to call has_broken_mac_openssl at all.

Share the explicit OpenSSL check between the broken-system predicate and both package-manager selectors. Return success without discovery when already configured so custom definitions cannot fall through to another OpenSSL installation. Signed-off-by: Mingyang Wu <129849514+aprylewu@users.noreply.github.com>

aprylewu · 2026-09-13T02:28:42Z

Good point: the original guard only covered has_broken_mac_openssl. I traced the later standard-build steps: they call the general use_homebrew/use_macports dependency-prefix setup, not the OpenSSL selectors again. But a definition can call either OpenSSL selector directly, bypassing that guard.

Commit b567c52 factors out the option check and applies it to both use_homebrew_openssl and use_macports_openssl too. They return success without probing or modifying options/flags when OpenSSL is already configured, matching the existing readline convention and avoiding fallback to another installation. The predicate still skips the bundled OpenSSL build. General dependency-prefix flags remain unchanged; this specifically prevents OpenSSL selection and its extra arguments/flags.

Added four regressions for direct calls without the predicate and repeated calls after it, covering both package managers. All four fail on the previous head and pass now. All 10 OpenSSL cases and the full suite pass on Bash 3.2 (470 passed, 9 skipped); no CPython/OpenSSL compilation was needed.

native-api · 2026-09-13T02:29:09Z

 }

 use_homebrew_openssl() {
+  configured_with_openssl && return 0


This should be 1, no?

Yes, changed both to return 1 in f5c262e. has_broken_mac_openssl still has its own guard to skip the bundled build.

native-api · 2026-09-13T02:30:55Z

  local arg
  for arg in ${CONFIGURE_OPTS} ${PYTHON_CONFIGURE_OPTS} "${PYTHON_CONFIGURE_OPTS_ARRAY[@]}"; do
-    [[ "$arg" = --with-openssl || "$arg" = --with-openssl=* ]] && return 1
+    [[ "$arg" = --with-openssl || "$arg" = --with-openssl=* ]] && return 0


Replace with =~ --with-openssl[ =] ?

Switched to ^--with-openssl(=|$) per argument. That also handles --with-openssl /path, while keeping --with-openssl-rpath out.

Return nonzero when neither package-manager selector selects an OpenSSL installation. Keep the separate explicit-config guard in the bundled build predicate and use an anchored regex for each configure argument. Signed-off-by: Mingyang Wu <129849514+aprylewu@users.noreply.github.com>

native-api

Looking through the code, I confirmed that indeed, OpenSSL search is indeed currently only triggered from has_broken_mac_openssl.
We probably need to do that more like the Tcl-related code does.
Maybe even refactor all OpenSSL search logic into a subroutine like #3399 suggests.

aprylewu · 2026-09-14T03:07:06Z

Agreed. OpenSSL discovery being a side effect of has_broken_mac_openssl is harder to follow than the Tcl/Tk build step.

I read through #3399. A shared selection routine needs to preserve the version constraints, source-build fallback and custom definitions. I'd suggest keeping that refactor separate and this PR focused on honoring explicit --with-openssl options. If you'd prefer the OpenSSL extraction first, I can adjust this PR.

native-api · 2026-09-14T05:30:36Z

Here's the design I had in mind: add probing of OpenSSL within package_build_standard in the same fashion as other libraries:

 plugins/python-build/bin/python-build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/python-build/bin/python-build b/plugins/python-build/bin/python-build
index 6a651ed0..0a802722 100755
--- a/plugins/python-build/bin/python-build
+++ b/plugins/python-build/bin/python-build
@@ -873,6 +873,7 @@ build_package_standard_build() {
 
   if [ "$package_var_name" = "PYTHON" ]; then
     if can_use_homebrew; then
+      configured_with_openssl || use_homebrew_openssl || true
       use_custom_tcltk || use_homebrew_tcltk || true
       use_homebrew_readline || true
       use_homebrew_ncurses || true
@@ -885,6 +886,7 @@ build_package_standard_build() {
       fi
     fi
     if can_use_macports; then
+      configured_with_openssl || use_macports_openssl || true
       use_custom_tcltk || true
       use_macports_readline || true
       use_macports_ncurses || true
@@ -1729,7 +1731,6 @@ has_broken_mac_openssl() {
 }
 
 use_homebrew_openssl() {
-  configured_with_openssl && return 1
   can_use_homebrew || return 1
   command -v brew >/dev/null || return 1
   for openssl in ${PYTHON_BUILD_HOMEBREW_OPENSSL_FORMULA:-openssl}; do
@@ -1768,7 +1769,6 @@ use_homebrew_openssl() {
 }
 
 use_macports_openssl() {
-  configured_with_openssl && return 1
   can_use_macports || return 1
   command -v port >/dev/null || return 1
   local port_location="$(command -v port)"

aprylewu requested review from a team as code owners September 11, 2026 17:17

cubic-dev-ai Bot reviewed Sep 11, 2026

View reviewed changes

native-api reviewed Sep 13, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

python-build: honor explicitly configured OpenSSL on macOS - #3541

python-build: honor explicitly configured OpenSSL on macOS#3541
aprylewu wants to merge 3 commits into
pyenv:masterfrom
aprylewu:fix/explicit-openssl-selection

aprylewu commented Sep 11, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

native-api left a comment

Uh oh!

aprylewu commented Sep 13, 2026

Uh oh!

native-api Sep 13, 2026

Uh oh!

aprylewu Sep 13, 2026

Uh oh!

native-api Sep 13, 2026

Uh oh!

aprylewu Sep 13, 2026

Uh oh!

native-api left a comment

Uh oh!

aprylewu commented Sep 14, 2026

Uh oh!

native-api commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

aprylewu commented Sep 11, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Prerequisite

Tests

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

native-api left a comment

Choose a reason for hiding this comment

Uh oh!

aprylewu commented Sep 13, 2026

Uh oh!

native-api Sep 13, 2026

Choose a reason for hiding this comment

Uh oh!

aprylewu Sep 13, 2026

Choose a reason for hiding this comment

Uh oh!

native-api Sep 13, 2026

Choose a reason for hiding this comment

Uh oh!

aprylewu Sep 13, 2026

Choose a reason for hiding this comment

Uh oh!

native-api left a comment

Choose a reason for hiding this comment

Uh oh!

aprylewu commented Sep 14, 2026

Uh oh!

native-api commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aprylewu commented Sep 11, 2026 •

edited by cubic-dev-ai Bot

Loading