ci: build with openssl@3 on macOS, brew's openssl is OpenSSL 4 now

The macos-15-arm64 runner image of 28 October (20261028.0489) ships openssl@4
4.1.0, and brew --prefix openssl points to it. monero-project and monero-cpp
both run that command on macOS and overwrite OPENSSL_ROOT_DIR with the result,
and boost 1.85 does not build with OpenSSL 4: asio's rfc2818_verification.ipp
reads ASN1_IA5STRING members, which are opaque now, so "Build monero" fails in
epee/abstract_http_client.cpp. GitHub rolls the images out gradually, the run
of the release pull request landed on the previous image (20260907, openssl@3
3.6.4) and passed, the next ones on main did not. macos-14 and macos-15-intel
are still on images with openssl@3 and will follow.

Install openssl@3, export its prefix in OPENSSL_ROOT_DIR and pass it with -D to
the cmake of monero-project and monero-cpp, which ignore the environment. The
module finds it in the environment. Applies to Tests and Build MacOS.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: everoddandeven

.github/workflows/build-macos.yml

@@ -41,9 +41,13 @@ jobs:
 
     - name: Install dependencies
       run: |
-        HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
+        HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl@3 zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
         brew unlink boost || true
         brew link boost@1.85 --force
+        # brew's openssl is OpenSSL 4 on the newer runner images, which boost 1.85 does not build with.
+        # monero-project and monero-cpp take brew's openssl unless they are given another one, so
+        # they get it on the command line, and the module finds it in the environment
+        echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
         pip3 install pytest pytest-cov setuptools wheel scikit-build-core --break-system-packages
 
     - name: Install pybind11 v2.13.6
@@ -70,7 +74,7 @@ jobs:
         cd external/monero-cpp/external/monero-project
         mkdir -p build/release
         cd build/release
-        cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
+        cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" ../../
         make -j3 wallet cryptonote_protocol
         cd ../../../../../../
 
@@ -79,7 +83,7 @@ jobs:
         cd external/monero-cpp
         mkdir -p build
         cd build
-        cmake .. -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+        cmake .. -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
         cmake --build .
         make -j3
         cd ../../../

.github/workflows/test.yml

@@ -420,9 +420,13 @@ jobs:
 
       - name: Install dependencies
         run: |
-          HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
+          HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl@3 zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
           brew unlink boost || true
           brew link boost@1.85 --force
+          # brew's openssl is OpenSSL 4 on the newer runner images, which boost 1.85 does not build with.
+          # monero-project and monero-cpp take brew's openssl unless they are given another one, so
+          # they get it on the command line, and the module finds it in the environment
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
           pip3 install pytest pytest-rerunfailures pytest-timeout pytest-cov setuptools wheel scikit-build-core --break-system-packages
 
       - name: Install pybind11 v2.13.6
@@ -445,7 +449,7 @@ jobs:
           cd external/monero-cpp/external/monero-project
           mkdir -p build/release
           cd build/release
-          cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
+          cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" ../../
           make -j3 wallet cryptonote_protocol
           cd ../../../../../../
 
@@ -454,7 +458,7 @@ jobs:
           cd external/monero-cpp
           mkdir -p build
           cd build
-          cmake .. -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          cmake .. -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
           cmake --build .
           make -j3
           cd ../../../