From 30c923c3f8a7080683630ff61eed7d7f822df5e8 Mon Sep 17 00:00:00 2001 From: Omer Roth Date: Thu, 6 Aug 2026 12:12:27 +0300 Subject: [PATCH 1/5] Configure OpenSSL library paths in workflow Set DYLD_LIBRARY_PATH and DYLD_FALLBACK_LIBRARY_PATH for OpenSSL. --- .github/workflows/build_executable.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build_executable.yml b/.github/workflows/build_executable.yml index dc1d34fe..0c1fce3b 100644 --- a/.github/workflows/build_executable.yml +++ b/.github/workflows/build_executable.yml @@ -64,6 +64,9 @@ jobs: run: | brew update brew upgrade openssl@3 + OPENSSL_LIB="$(brew --prefix openssl@3)/lib" + echo "DYLD_LIBRARY_PATH=$OPENSSL_LIB:$DYLD_LIBRARY_PATH" >> $GITHUB_ENV + echo "DYLD_FALLBACK_LIBRARY_PATH=$OPENSSL_LIB:$DYLD_FALLBACK_LIBRARY_PATH" - name: Set up Python 3.13 id: setup-python From a21e475cd0c296a19debe48d9d52f577bc7dbc93 Mon Sep 17 00:00:00 2001 From: Omer Roth Date: Thu, 6 Aug 2026 14:16:10 +0300 Subject: [PATCH 2/5] CM-70014 added macOS openssl 3 handling to pyinstaller spec --- pyinstaller.spec | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pyinstaller.spec b/pyinstaller.spec index d93766a8..389c24b3 100644 --- a/pyinstaller.spec +++ b/pyinstaller.spec @@ -37,10 +37,24 @@ _hiddenimports = [ 'cycode.cli.apps.mcp', ] +# Handle binaries additions +extra_binaries = [] +if platform.system() == "Darwin": + try: + brew_openssl = subprocess.check_output(["brew", "--prefix", "openssl@3"]).decode().strip() + openssl_lib = os.path.join(brew_openssl, "lib") + extra_binaries.extend([ + (os.path.join(openssl_lib, "libssl.3.dylib"), "."), + (os.path.join(openssl_lib, "libcrypto.3.dylib"), "."), + ]) + except Exception as e: + print(f"Warning: Could not locate Homebrew OpenSSL: {e}") + a = Analysis( scripts=['cycode/cli/main.py'], excludes=['tests', 'setuptools', 'pkg_resources'], hiddenimports=_hiddenimports, + binaries=extra_binaries, ) exe_args = [PYZ(a.pure), a.scripts, a.binaries, a.datas] From 0b74b0a98a76824816837264319cea0d577326ed Mon Sep 17 00:00:00 2001 From: Omer Roth Date: Thu, 6 Aug 2026 14:21:54 +0300 Subject: [PATCH 3/5] CM-70014 remove addition to CI --- .github/workflows/build_executable.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.github/workflows/build_executable.yml b/.github/workflows/build_executable.yml index 0c1fce3b..94f285ce 100644 --- a/.github/workflows/build_executable.yml +++ b/.github/workflows/build_executable.yml @@ -58,15 +58,6 @@ jobs: LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`) git checkout $LATEST_TAG echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV - - - name: Upgrade OpenSSL on macOS Builder - if: runner.os == 'macOS' - run: | - brew update - brew upgrade openssl@3 - OPENSSL_LIB="$(brew --prefix openssl@3)/lib" - echo "DYLD_LIBRARY_PATH=$OPENSSL_LIB:$DYLD_LIBRARY_PATH" >> $GITHUB_ENV - echo "DYLD_FALLBACK_LIBRARY_PATH=$OPENSSL_LIB:$DYLD_FALLBACK_LIBRARY_PATH" - name: Set up Python 3.13 id: setup-python From 3b811fae7d8baf662a012d55997caf0e11aa40e8 Mon Sep 17 00:00:00 2001 From: "omer.roth" Date: Thu, 6 Aug 2026 17:22:55 +0300 Subject: [PATCH 4/5] CM-70014 add fix for macos intel arch for libssl --- pyinstaller.spec | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/pyinstaller.spec b/pyinstaller.spec index 389c24b3..f0c28385 100644 --- a/pyinstaller.spec +++ b/pyinstaller.spec @@ -37,26 +37,33 @@ _hiddenimports = [ 'cycode.cli.apps.mcp', ] -# Handle binaries additions -extra_binaries = [] -if platform.system() == "Darwin": - try: - brew_openssl = subprocess.check_output(["brew", "--prefix", "openssl@3"]).decode().strip() - openssl_lib = os.path.join(brew_openssl, "lib") - extra_binaries.extend([ - (os.path.join(openssl_lib, "libssl.3.dylib"), "."), - (os.path.join(openssl_lib, "libcrypto.3.dylib"), "."), - ]) - except Exception as e: - print(f"Warning: Could not locate Homebrew OpenSSL: {e}") - a = Analysis( scripts=['cycode/cli/main.py'], excludes=['tests', 'setuptools', 'pkg_resources'], hiddenimports=_hiddenimports, - binaries=extra_binaries, ) +if platform.system() == 'Darwin': + try: + openssl_lib = os.path.join( + subprocess.check_output(['brew', '--prefix', 'openssl@3'], text=True).strip(), 'lib' + ) + brew_ssl = os.path.join(openssl_lib, 'libssl.3.dylib') + brew_crypto = os.path.join(openssl_lib, 'libcrypto.3.dylib') + + if os.path.exists(brew_ssl) and os.path.exists(brew_crypto): + a.binaries = [ + binary for binary in a.binaries + if 'libssl' not in binary[0] and 'libcrypto' not in binary[0] + ] + a.binaries.append(('libssl.3.dylib', brew_ssl, 'BINARY')) + a.binaries.append(('libcrypto.3.dylib', brew_crypto, 'BINARY')) + print(f'Replaced collected OpenSSL dylibs with Homebrew ones from {openssl_lib}') + else: + print(f'Warning: Homebrew OpenSSL dylibs not found in {openssl_lib}') + except Exception as e: + print(f'Warning: Could not override OpenSSL binaries: {e}') + exe_args = [PYZ(a.pure), a.scripts, a.binaries, a.datas] if _ONEDIR_MODE: exe_args = [PYZ(a.pure), a.scripts] From b51080333a1cac69db2ee1feed7a61e63ce768d0 Mon Sep 17 00:00:00 2001 From: "omer.roth" Date: Thu, 6 Aug 2026 17:48:38 +0300 Subject: [PATCH 5/5] CM-70014 another fix --- pyinstaller.spec | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/pyinstaller.spec b/pyinstaller.spec index f0c28385..e5be2bc2 100644 --- a/pyinstaller.spec +++ b/pyinstaller.spec @@ -2,6 +2,10 @@ # Run `poetry run pyinstaller pyinstaller.spec` to generate the binary. # Set the env var `CYCODE_ONEDIR_MODE` to generate a single directory instead of a single file. +import os +import platform +import subprocess + _INIT_FILE_PATH = os.path.join('cycode', '__init__.py') _CODESIGN_IDENTITY = os.environ.get('APPLE_CERT_NAME') _ONEDIR_MODE = os.environ.get('CYCODE_ONEDIR_MODE') is not None @@ -44,23 +48,20 @@ a = Analysis( ) if platform.system() == 'Darwin': + # cryptography ships no macOS x86_64 wheel since 46.0.4, so on Intel it is built from source and + # dynamically links Homebrew's OpenSSL 3 (it needs symbols like `SSL_get0_group_name`, added in + # OpenSSL 3.2). PyInstaller also collects the older OpenSSL 3.0.x that ships with the + # setup-python toolcache Python; both land at the same destination name and the toolcache copy + # wins the dedup, which breaks `import cryptography` at runtime. Drop every collected + # libssl/libcrypto and inject Homebrew's, which satisfies both consumers. try: openssl_lib = os.path.join( subprocess.check_output(['brew', '--prefix', 'openssl@3'], text=True).strip(), 'lib' ) - brew_ssl = os.path.join(openssl_lib, 'libssl.3.dylib') - brew_crypto = os.path.join(openssl_lib, 'libcrypto.3.dylib') - - if os.path.exists(brew_ssl) and os.path.exists(brew_crypto): - a.binaries = [ - binary for binary in a.binaries - if 'libssl' not in binary[0] and 'libcrypto' not in binary[0] - ] - a.binaries.append(('libssl.3.dylib', brew_ssl, 'BINARY')) - a.binaries.append(('libcrypto.3.dylib', brew_crypto, 'BINARY')) - print(f'Replaced collected OpenSSL dylibs with Homebrew ones from {openssl_lib}') - else: - print(f'Warning: Homebrew OpenSSL dylibs not found in {openssl_lib}') + a.binaries = [b for b in a.binaries if 'libssl' not in b[0] and 'libcrypto' not in b[0]] + for name in ('libssl.3.dylib', 'libcrypto.3.dylib'): + a.binaries.append((name, os.path.join(openssl_lib, name), 'BINARY')) + print(f'Replaced collected OpenSSL dylibs with Homebrew ones from {openssl_lib}') except Exception as e: print(f'Warning: Could not override OpenSSL binaries: {e}')