From 00db0cf7c45725922f620c6d0355ee2e85ef129e Mon Sep 17 00:00:00 2001
From: WarmUpTill <19472752+WarmUpTill@users.noreply.github.com>
Date: Wed, 22 Oct 2025 21:34:38 +0200
Subject: [PATCH] CI: Refactor OpenSSL handling on MacOS to support MQTT SSL

---
 .../actions/build-dependencies/action.yaml    |  2 +-
 .github/scripts/.build-deps.zsh               | 44 +++++++++++--------
 .github/scripts/.build.zsh                    |  6 +--
 .github/scripts/utils.zsh/check_macos         |  4 +-
 .github/workflows/build-project.yaml          |  4 +-
 plugins/http/CMakeLists.txt                   | 15 ++++---
 plugins/mqtt/CMakeLists.txt                   |  7 +++
 plugins/twitch/CMakeLists.txt                 | 16 ++++---
 8 files changed, 58 insertions(+), 40 deletions(-)

diff --git a/.github/actions/build-dependencies/action.yaml b/.github/actions/build-dependencies/action.yaml
index b3783c55..7be611cb 100644
--- a/.github/actions/build-dependencies/action.yaml
+++ b/.github/actions/build-dependencies/action.yaml
@@ -22,7 +22,7 @@ runs:
     - name: Setup cmake
       uses: jwlawson/actions-setup-cmake@v1.13
       with:
-        cmake-version: '3.28.x'
+        cmake-version: '3.x.x'
 
     - name: Restore cached dependencies
       id: restore-cache
diff --git a/.github/scripts/.build-deps.zsh b/.github/scripts/.build-deps.zsh
index fa547da9..673c1103 100755
--- a/.github/scripts/.build-deps.zsh
+++ b/.github/scripts/.build-deps.zsh
@@ -394,8 +394,11 @@ Usage: %B${functrace[1]%:*}%b <option> [<options>]
 
         popd
 
-        pushd ${advss_dep_path}
         log_info "Prepare openssl ..."
+        rm -rf ${advss_dep_path}/openssl ${advss_dep_path}/openssl_build
+        mkdir ${advss_dep_path}/openssl_build
+        pushd ${advss_dep_path}/openssl_build
+
         rm -rf openssl
         git clone https://github.com/openssl/openssl.git --branch openssl-3.1.2 --depth 1
         mv openssl openssl_x86
@@ -403,25 +406,27 @@ Usage: %B${functrace[1]%:*}%b <option> [<options>]
 
         log_info "Building openssl x86 ..."
         export MACOSX_DEPLOYMENT_TARGET=10.9
-        cd openssl_x86
-        ./Configure darwin64-x86_64-cc shared
-        make
+        pushd openssl_x86
+        ./Configure darwin64-x86_64-cc no-shared no-module no-zlib --prefix=${advss_dep_path}
+        make -j$(nproc)
+        popd
 
         log_info "Building openssl arm ..."
         export MACOSX_DEPLOYMENT_TARGET=10.15
-        cd ../openssl_arm
-        ./Configure enable-rc5 zlib darwin64-arm64-cc no-asm
-        make
+        pushd openssl_arm
+        ./Configure enable-rc5 darwin64-arm64-cc no-shared no-module no-asm no-zlib --prefix=${advss_dep_path}
+        make -j$(nproc)
+
+        log_info "Install openssl ..."
+        make install
+        popd
 
         log_info "Combine arm and x86 openssl binaries ..."
-        cd ..
-        mkdir openssl-combined
-        lipo -create openssl_x86/libcrypto.a openssl_arm/libcrypto.a -output openssl-combined/libcrypto.a
-        lipo -create openssl_x86/libssl.a openssl_arm/libssl.a -output openssl-combined/libssl.a
+        lipo -create openssl_x86/libcrypto.a openssl_arm/libcrypto.a -output ${advss_dep_path}/lib/libcrypto.a
+        lipo -create openssl_x86/libssl.a openssl_arm/libssl.a -output ${advss_dep_path}/lib/libssl.a
 
         log_info "Clean up openssl dir ..."
-        mv openssl_x86 openssl
-        rm -rf openssl_arm
+        rm -rf openssl_x86 openssl_arm
         popd
 
         pushd ${project_root}/deps/libusb
@@ -439,14 +444,16 @@ Usage: %B${functrace[1]%:*}%b <option> [<options>]
         mkdir ${project_root}/deps/libusb/out_x86
         ./autogen.sh
         ./configure --host=x86_64-apple-darwin --prefix=${advss_dep_path}
-        make && make install
+        make -j$(nproc)
+        make install
 
         log_info "Configure libusb arm ..."
         make clean
         rm -r ${project_root}/deps/libusb/out_x86
         mkdir ${project_root}/deps/libusb/out_x86
         ./configure --host=aarch64-apple-darwin --prefix=${project_root}/deps/libusb/out_x86
-        make && make install
+        make -j$(nproc)
+        make install
 
         log_info "Building libusb arm ..."
         make clean
@@ -459,7 +466,8 @@ Usage: %B${functrace[1]%:*}%b <option> [<options>]
         export MACOSX_DEPLOYMENT_TARGET=10.15
         mkdir ${project_root}/deps/libusb/out_arm
         ./configure --host=aarch64-apple-darwin --prefix=${project_root}/deps/libusb/out_arm
-        make && make install
+        make -j$(nproc)
+        make install
 
         log_info "Combine arm and x86 libusb binaries ..."
         lipo -create ${project_root}/deps/libusb/out_x86/lib/libusb-1.0.0.dylib \
@@ -491,8 +499,8 @@ Usage: %B${functrace[1]%:*}%b <option> [<options>]
           -DPAHO_BUILD_SHARED=OFF
           -DPAHO_BUILD_STATIC=ON
           -DPAHO_WITH_MQTT_C=ON
-          -DOPENSSL_ROOT_DIR="${advss_dep_path}"
-          -DPAHO_WITH_SSL=OFF # TODO: figure out linking issues with openssl
+          -DPAHO_WITH_SSL=ON
+          -DOPENSSL_USE_STATIC_LIBS=ON
         )
 
         pushd ${mqtt_dir}
diff --git a/.github/scripts/.build.zsh b/.github/scripts/.build.zsh
index bfeb8522..d7189520 100755
--- a/.github/scripts/.build.zsh
+++ b/.github/scripts/.build.zsh
@@ -253,12 +253,8 @@ ${_usage_host:-}"
       macos-*)
         if (( ${+CI} )) typeset -gx NSUnbufferedIO=YES
 
-        local openssl_lib_dir="${advss_deps_path}/openssl-combined/"
-        local openssl_include_dir="${advss_deps_path}/openssl/include"
-
         cmake_args+=(
-          -DOPENSSL_INCLUDE_DIR="${openssl_include_dir}"
-          -DOPENSSL_LIBRARIES="${openssl_lib_dir}/libcrypto.a;${openssl_lib_dir}/libssl.a"
+          -DCMAKE_PREFIX_PATH="${advss_deps_path}"
           --preset ${_preset}
         )
 
diff --git a/.github/scripts/utils.zsh/check_macos b/.github/scripts/utils.zsh/check_macos
index 54b5fbf6..fc9dd74b 100644
--- a/.github/scripts/utils.zsh/check_macos
+++ b/.github/scripts/utils.zsh/check_macos
@@ -18,5 +18,7 @@ if (( ! ${+commands[brew]} )) {
 }
 
 brew bundle --file ${SCRIPT_HOME}/.Brewfile
-rehash
+# Workaround to make sure locally built openssl is picked up by cmake
+brew uninstall --ignore-dependencies openssl@3 || true
+rehash || true
 log_group
diff --git a/.github/workflows/build-project.yaml b/.github/workflows/build-project.yaml
index 0fd75fd5..a03b5190 100644
--- a/.github/workflows/build-project.yaml
+++ b/.github/workflows/build-project.yaml
@@ -6,7 +6,7 @@ on:
         description: "Project name detected by parsing build spec file"
         value: ${{ jobs.check-event.outputs.pluginName }}
 env:
-  DEP_DIR: .deps/advss-build-dependencies-2
+  DEP_DIR: .deps/advss-build-dependencies-3
 jobs:
   check-event:
     name: Check GitHub Event Data 🔎
@@ -213,7 +213,7 @@ jobs:
       - name: Set up CMake 🏗️
         uses: jwlawson/actions-setup-cmake@v1.13
         with:
-          cmake-version: '3.24.x'
+          cmake-version: '3.x.x'
 
       - name: Set up Homebrew 🍺
         uses: Homebrew/actions/setup-homebrew@master
diff --git a/plugins/http/CMakeLists.txt b/plugins/http/CMakeLists.txt
index d9bd2b3b..7b2de9ef 100644
--- a/plugins/http/CMakeLists.txt
+++ b/plugins/http/CMakeLists.txt
@@ -15,12 +15,15 @@ if(NOT TARGET httplib)
                    EXCLUDE_FROM_ALL)
 endif()
 
-if(NOT OPENSSL_INCLUDE_DIR OR NOT OPENSSL_LIBRARIES)
-  find_package(OpenSSL)
-  if(NOT OPENSSL_FOUND)
-    message(WARNING "OpenSSL not found!\n" "HTTP support will be disabled!\n\n")
-    return()
-  endif()
+if(OS_MACOS)
+  set(OPENSSL_USE_STATIC_LIBS
+      ON
+      CACHE BOOL "Use static OpenSSL" FORCE)
+endif()
+find_package(OpenSSL)
+if(NOT OPENSSL_FOUND)
+  message(WARNING "OpenSSL not found!\n" "HTTP support will be disabled!\n\n")
+  return()
 endif()
 
 find_package(ZLIB)
diff --git a/plugins/mqtt/CMakeLists.txt b/plugins/mqtt/CMakeLists.txt
index 74de5c77..0397315e 100644
--- a/plugins/mqtt/CMakeLists.txt
+++ b/plugins/mqtt/CMakeLists.txt
@@ -3,6 +3,13 @@ project(advanced-scene-switcher-mqtt)
 
 # --- Check paho.mqtt.cpp requirements ---
 
+if(OS_MACOS)
+  set(OPENSSL_USE_STATIC_LIBS
+      ON
+      CACHE BOOL "Use static OpenSSL" FORCE)
+endif()
+find_package(OpenSSL)
+
 find_package(PahoMqttCpp)
 if(NOT PahoMqttCpp_FOUND)
   message(WARNING "PahoMqttCpp not found!\n"
diff --git a/plugins/twitch/CMakeLists.txt b/plugins/twitch/CMakeLists.txt
index e52a9452..93b4cc61 100644
--- a/plugins/twitch/CMakeLists.txt
+++ b/plugins/twitch/CMakeLists.txt
@@ -15,13 +15,15 @@ if(NOT TARGET httplib)
                    EXCLUDE_FROM_ALL)
 endif()
 
-if(NOT OPENSSL_INCLUDE_DIR OR NOT OPENSSL_LIBRARIES)
-  find_package(OpenSSL)
-  if(NOT OPENSSL_FOUND)
-    message(WARNING "OpenSSL not found!\n"
-                    "Twitch support will be disabled!\n\n")
-    return()
-  endif()
+if(OS_MACOS)
+  set(OPENSSL_USE_STATIC_LIBS
+      ON
+      CACHE BOOL "Use static OpenSSL" FORCE)
+endif()
+find_package(OpenSSL)
+if(NOT OPENSSL_FOUND)
+  message(WARNING "OpenSSL not found!\n" "Twitch support will be disabled!\n\n")
+  return()
 endif()
 
 find_package(ZLIB)