From 4bfb0d47c6fdacd97fc3ed3fbd6b406fc9b0d8e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
Date: Thu, 5 Nov 2026 19:21:32 +0100
Subject: [PATCH] Keep the macOS OpenSSL search paths out of /tmp

OpenSSL compiles its installation prefix in as the directory it
searches for engines and providers loaded by name. The macOS release
job installed OpenSSL with --prefix=/tmp/opensslinstall, so the binary
would look for, say, "-engine pkcs11" in /tmp/opensslinstall, which any
local user can create.

Keep OpenSSL's default /usr/local prefix and stage the installation
with DESTDIR, as the Windows job does with its default prefix. Fail the
build if the binary refers to the staging directory. The cache key
changes because the installed layout does.
---
 .github/workflows/release.yml | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b380142..75eb686 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -203,7 +203,7 @@ jobs:
         uses: actions/cache@v6
         with:
           path: "${{env.OPENSSL_PREFIX}}"
-          key: openssl-${{ env.OPENSSL_VERSION }}-static-${{ matrix.arch }}-macos${{ env.MACOSX_DEPLOYMENT_TARGET }}
+          key: openssl-${{ env.OPENSSL_VERSION }}-static-${{ matrix.arch }}-macos${{ env.MACOSX_DEPLOYMENT_TARGET }}-usr-local
       - name: Build OpenSSL
         if: steps.cache-openssl.outputs.cache-hit != 'true'
         shell: sh
@@ -216,13 +216,16 @@ jobs:
           tar xf openssl.tar.gz
           cd "openssl-${OPENSSL_VERSION}"
           # no-module => legacy provider is compiled into libcrypto.a (no dlopen).
-          # Use the macOS system OpenSSL directory rather than a path that only
-          # exists on the build machine.
+          # Keep the default /usr/local prefix and stage the installation with
+          # DESTDIR: the prefix is compiled in as the engine and provider search
+          # path, so it must not be a directory like /tmp that any local user
+          # can write. Use the macOS system OpenSSL directory for the same
+          # reason.
           ./Configure "darwin64-${{ matrix.osx_arch }}-cc" \
             no-shared no-module no-tests no-docs \
-            --prefix="${{env.OPENSSL_PREFIX}}" --libdir=lib --openssldir=/etc/ssl
+            --libdir=lib --openssldir=/etc/ssl
           make -j"$(sysctl -n hw.ncpu)"
-          make install_sw
+          make install_sw DESTDIR="${{env.OPENSSL_PREFIX}}"
 
       # Setup xcode build environment
       - name: Install Xcode (macOS)
@@ -262,7 +265,7 @@ jobs:
             -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/dist" \
             -DCMAKE_OSX_ARCHITECTURES="${{ matrix.osx_arch }}" \
             -DCMAKE_OSX_DEPLOYMENT_TARGET="${{env.MACOSX_DEPLOYMENT_TARGET}}" \
-            -DOPENSSL_ROOT_DIR="${{env.OPENSSL_PREFIX}}" \
+            -DOPENSSL_ROOT_DIR="${{env.OPENSSL_PREFIX}}/usr/local" \
             -DZLIB_ROOT="${{env.ZLIB_PREFIX}}" \
             -DZLIB_USE_STATIC_LIBS=TRUE \
             -DOPENSSL_USE_STATIC_LIBS=TRUE
@@ -286,6 +289,10 @@ jobs:
             echo "::error::binary links a non-system dylib"
             exit 1
           fi
+          if strings "$bin" | grep -F "${OPENSSL_PREFIX}"; then
+            echo "::error::binary refers to the OpenSSL staging directory"
+            exit 1
+          fi
           if ! "$bin" --version | grep -q "OpenSSL ${OPENSSL_VERSION} "; then
             "$bin" --version
             echo "::error::binary does not use the OpenSSL ${OPENSSL_VERSION} built above"