From 7adcc89a72ce1a12f480e5d6f79bb81aed820549 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 08:50:15 +0000
Subject: [PATCH 1/2] build(macos): Build OpenSSL from source for x86_64
 cross-compile

Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
---
 .github/workflows/build.yml | 28 ----------------------------
 Cargo.lock                  |  1 +
 Cargo.toml                  |  7 +++++++
 3 files changed, 8 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9b8a125314..42feb2cca1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -84,34 +84,6 @@ jobs:
       - name: Add Rustup Target
         run: rustup target add ${{ matrix.target }}
 
-      # On x86_64, this environment variable specifies to the openssl-sys crate
-      # where to find the OpenSSL library.
-      - name: Set OpenSSL env (x86_64)
-        if: matrix.arch == 'x86_64'
-        run: echo "X86_64_APPLE_DARWIN_OPENSSL_DIR=${{ github.workspace }}/openssl-x86_64" >> $GITHUB_ENV
-
-      - name: Get OpenSSL cache month (x86_64)
-        if: matrix.arch == 'x86_64'
-        id: cache-date
-        run: echo "month=$(date +%Y-%m)" >> $GITHUB_OUTPUT
-
-      - name: Cache x86_64 OpenSSL
-        if: matrix.arch == 'x86_64'
-        id: cache-openssl-x86
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # 6.1.0
-        with:
-          path: ${{ env.X86_64_APPLE_DARWIN_OPENSSL_DIR }}
-          key: openssl-x86_64-${{ runner.os }}-${{ steps.cache-date.outputs.month }}
-
-      # To cross-compile for x86_64 from an ARM-based macOS runner, we need to have the
-      # x86_64 OpenSSL libraries installed locally.
-      - name: Download x86_64 OpenSSL
-        if: matrix.arch == 'x86_64' && steps.cache-openssl-x86.outputs.cache-hit != 'true'
-        run: |
-          arch -x86_64 brew fetch --bottle-tag=tahoe openssl@3.5
-          mkdir -p $X86_64_APPLE_DARWIN_OPENSSL_DIR
-          tar xzf $(arch -x86_64 brew --cache --bottle-tag=tahoe openssl@3.5) -C $X86_64_APPLE_DARWIN_OPENSSL_DIR --strip-components=2
-
       - name: Cache Dependencies
         uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
 
diff --git a/Cargo.lock b/Cargo.lock
index 7a35b7a3b1..7234c94a0a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3640,6 +3640,7 @@ dependencies = [
  "objectstore-client",
  "open",
  "openssl-probe 0.1.6",
+ "openssl-sys",
  "parking_lot",
  "percent-encoding",
  "plist",
diff --git a/Cargo.toml b/Cargo.toml
index 23f9630d9f..269d1e2f35 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -140,6 +140,13 @@ windows-sys = { version = "0.59.0", features = ["Win32_Storage_FileSystem"] }
 [target."cfg(not(target_os = \"macos\"))".dependencies]
 curl = { version = "0.4.46", features = ["static-curl", "static-ssl"] }
 
+# On macOS, curl links the system libcurl, but `openssl-sys` still needs OpenSSL
+# headers at build time. We cross-compile for Intel Macs on ARM runners, where no
+# x86_64 OpenSSL is available, so build it from source. The linker drops it from
+# the final binary, which does not use OpenSSL.
+[target."cfg(all(target_os = \"macos\", target_arch = \"x86_64\"))".dependencies]
+openssl-sys = { version = "0.9.117", features = ["vendored"] }
+
 # We optimize the release build for size.
 [profile.release]
 opt-level = 2       # I obtained the smallest binary size with opt-level 2 on my system.

From 123bf2b79622efc0b6a67c8ba6e2159c7a8d95ba Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 09:15:52 +0000
Subject: [PATCH 2/2] build(macos): Use curl's static-ssl instead of a direct
 openssl-sys dep

Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>
---
 Cargo.lock | 1 -
 Cargo.toml | 6 +++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7234c94a0a..7a35b7a3b1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3640,7 +3640,6 @@ dependencies = [
  "objectstore-client",
  "open",
  "openssl-probe 0.1.6",
- "openssl-sys",
  "parking_lot",
  "percent-encoding",
  "plist",
diff --git a/Cargo.toml b/Cargo.toml
index 269d1e2f35..0f3c7cce39 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -142,10 +142,10 @@ curl = { version = "0.4.46", features = ["static-curl", "static-ssl"] }
 
 # On macOS, curl links the system libcurl, but `openssl-sys` still needs OpenSSL
 # headers at build time. We cross-compile for Intel Macs on ARM runners, where no
-# x86_64 OpenSSL is available, so build it from source. The linker drops it from
-# the final binary, which does not use OpenSSL.
+# x86_64 OpenSSL is available, so `static-ssl` builds it from source. Without
+# `static-curl`, libcurl stays dynamic, and the linker drops OpenSSL from the binary.
 [target."cfg(all(target_os = \"macos\", target_arch = \"x86_64\"))".dependencies]
-openssl-sys = { version = "0.9.117", features = ["vendored"] }
+curl = { version = "0.4.46", features = ["static-ssl"] }
 
 # We optimize the release build for size.
 [profile.release]