I think OpenSSL 3 support was never backported to Ruby 3.0 and earlier, so worth watching out for that (Ruby build is notorious for just skipping modules if it fails).

Ruby 2.7 could be disabled by the time OpenSSL 1.1 is EOL should we choose. Though we'll need to do something for Ruby 3.0 anyway.

An option is backporting the OpenSSL gem (3.0.2?). Upstream thought about doing this themselves (https://bugs.ruby-lang.org/issues/18658) but declined to do so since they wanted to retain OpenSSL 1.0.x compatibility. There are some other compatibility concerns however: https://github.com/ruby/openssl/blob/master/History.md#compatibility-notes

LibreSSL is an option but one I'm unsure of the consequences of, and is something we've generally not used (except movgrab apparently).

Yea, looks like it just refuses to build:
/private/tmp/rubyA2.7-20230621-82680-e453l8/ruby-2.7.8/ext/openssl/extconf.rb:111: OpenSSL >= 1.0.1, < 3.0.0 or LibreSSL >= 2.5.0 is required

Yea, looks like it just refuses to build: /private/tmp/rubyA2.7-20230621-82680-e453l8/ruby-2.7.8/ext/openssl/extconf.rb:111: OpenSSL >= 1.0.1, < 3.0.0 or LibreSSL >= 2.5.0 is required

Then can we replace openssl@1.1 with libressl?

I reckon we either offer a similar fix as we did to ruby@3.0. If that doesn't work, Ruby 2.7 is already EOL anyway.

  /private/tmp/rubyA2.7-20230625-34024-17cmb8z/ruby-2.7.8/ext/digest/digest_conf.rb:68:in `require': cannot load such file -- /private/tmp/rubyA2.7-20230625-34024-17cmb8z/ruby-2.7.8/ext/openssl/deprecation (LoadError)
  	from /private/tmp/rubyA2.7-20230625-34024-17cmb8z/ruby-2.7.8/ext/digest/digest_conf.rb:68:in `digest_conf'
  	from /private/tmp/rubyA2.7-20230625-34024-17cmb8z/ruby-2.7.8/ext/digest/md5/extconf.rb:13:in `<top (required)>'
  	from ./ext/extmk.rb:214:in `load'
  	from ./ext/extmk.rb:214:in `block in extmake'
  	from /private/tmp/rubyA2.7-20230625-34024-17cmb8z/ruby-2.7.8/lib/mkmf.rb:331:in `open'
  	from ./ext/extmk.rb:210:in `extmake'
  	from ./ext/extmk.rb:575:in `block in <main>'
  	from ./ext/extmk.rb:571:in `each'
  	from ./ext/extmk.rb:571:in `<main>'
  make[1]: *** [ext/digest/exts.mk] Error 1

Let's see if an older openssl gem works.

Dependent failure is spurious: https://github.com/Homebrew/homebrew-core/actions/runs/5380336644/jobs/9763600018?pr=134420#step:4:35

In any case, the only dependent is deprecated.

Dependent failure is spurious: https://github.com/Homebrew/homebrew-core/actions/runs/5380336644/jobs/9763600018?pr=134420#step:4:35

This is because of its use in caveats.

🤖 An automated task has requested bottles to be published to this PR.

Hi, I didn't understand why ruby 2.7 was bumped to openssl@3? As mentioned in the comments and the ruby bug tracker that combination is not supported.