ci: build with openssl@3 on macOS and for a baseline cpu

Two things broke the builds on the new runner images and on a cache restored
from another machine.

macOS: the macos-15-arm64 image of 28 October (20261028.0489) ships openssl@4
4.1.0, brew --prefix openssl points to it, and boost 1.85 does not build with
OpenSSL 4 (asio's rfc2818_verification.ipp reads ASN1_IA5STRING members, which
are opaque now), so "Build monero" failed in epee/abstract_http_client.cpp.
GitHub rolls the images out gradually: the run of the release pull request
landed on the previous one (openssl@3 3.6.4) and passed, the next ones did not.
Install openssl@3, export its prefix in OPENSSL_ROOT_DIR and pass it with -D to
the cmake of monero-project and monero-cpp, which overwrite it with
brew --prefix openssl and ignore the environment. The module finds it in the
environment. openssl@4 is also linked into /opt/homebrew, and the
-I/opt/homebrew/include of boost and zeromq comes before the one of openssl@3,
so its headers were still found first in monero-cpp: unlink it, the keg stays
where it is for the formulae that depend on it.

Linux: monero-project builds with -march=native unless ARCH is set, and ccache
does not know the cpu. The Linux build of a pull request hit 207 of 207 objects
from the cache that main saved on another runner, and pytest died with an
illegal instruction (exit 132) as soon as it loaded the module. The same
objects end up in the deb packages and in the macOS Intel wheels, which then
need the instructions of the cpu that built them. Pass ARCH explicitly, as the
Windows job and monero-cpp already do: x86-64 on x86_64, armv8-a on arm64, the
old default elsewhere (armhf). The flags change, so the objects in the existing
caches are not used any more.

Applies to Tests, Build MacOS and docker/build.sh.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: everoddandeven

.github/workflows/build-macos.yml

@@ -41,9 +41,16 @@ jobs:
 
     - name: Install dependencies
       run: |
-        HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
+        HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl@3 zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
         brew unlink boost || true
         brew link boost@1.85 --force
+        # brew links openssl@4 into /opt/homebrew, and the -I/opt/homebrew/include of boost and zeromq comes
+        # before the one of openssl@3, so its headers win over the ones of OPENSSL_ROOT_DIR
+        brew unlink openssl@4 || true
+        # brew's openssl is OpenSSL 4 on the newer runner images, which boost 1.85 does not build with.
+        # monero-project and monero-cpp take brew's openssl unless they are given another one, so
+        # they get it on the command line, and the module finds it in the environment
+        echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
         pip3 install pytest pytest-cov setuptools wheel scikit-build-core --break-system-packages
 
     - name: Install pybind11 v2.13.6
@@ -70,7 +77,11 @@ jobs:
         cd external/monero-cpp/external/monero-project
         mkdir -p build/release
         cd build/release
-        cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
+        # monero builds with -march=native unless it is told which cpu to build for, and objects compiled
+        # on a runner with newer instructions, restored by ccache or shipped in a package, end in an illegal
+        # instruction on another cpu
+        ARCH=$([ "$(uname -m)" = x86_64 ] && echo x86-64 || echo armv8-a)
+        cmake -DSTATIC=ON -DARCH="$ARCH" -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" ../../
         make -j3 wallet cryptonote_protocol
         cd ../../../../../../
 
@@ -79,7 +90,7 @@ jobs:
         cd external/monero-cpp
         mkdir -p build
         cd build
-        cmake .. -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+        cmake .. -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
         cmake --build .
         make -j3
         cd ../../../

.github/workflows/test.yml

@@ -91,7 +91,10 @@ jobs:
           cd external/monero-cpp/external/monero-project
           mkdir -p build/release
           cd build/release
-          cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
+          # monero builds with -march=native unless it is told which cpu to build for, and objects compiled
+          # on a runner with newer instructions, restored by ccache or shipped in a package, end in an illegal
+          # instruction on another cpu
+          cmake -DSTATIC=ON -DARCH=x86-64 -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
           make -j3 wallet cryptonote_protocol
           cd ../../../../../../
 
@@ -420,9 +423,16 @@ jobs:
 
       - name: Install dependencies
         run: |
-          HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
+          HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl@3 zmq libpgm miniupnpc expat libunwind-headers protobuf unbound ccache
           brew unlink boost || true
           brew link boost@1.85 --force
+          # brew links openssl@4 into /opt/homebrew, and the -I/opt/homebrew/include of boost and zeromq comes
+          # before the one of openssl@3, so its headers win over the ones of OPENSSL_ROOT_DIR
+          brew unlink openssl@4 || true
+          # brew's openssl is OpenSSL 4 on the newer runner images, which boost 1.85 does not build with.
+          # monero-project and monero-cpp take brew's openssl unless they are given another one, so
+          # they get it on the command line, and the module finds it in the environment
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
           pip3 install pytest pytest-rerunfailures pytest-timeout pytest-cov setuptools wheel scikit-build-core --break-system-packages
 
       - name: Install pybind11 v2.13.6
@@ -445,7 +455,11 @@ jobs:
           cd external/monero-cpp/external/monero-project
           mkdir -p build/release
           cd build/release
-          cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
+          # monero builds with -march=native unless it is told which cpu to build for, and objects compiled
+          # on a runner with newer instructions, restored by ccache or shipped in a package, end in an illegal
+          # instruction on another cpu
+          ARCH=$([ "$(uname -m)" = x86_64 ] && echo x86-64 || echo armv8-a)
+          cmake -DSTATIC=ON -DARCH="$ARCH" -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" ../../
           make -j3 wallet cryptonote_protocol
           cd ../../../../../../
 
@@ -454,7 +468,7 @@ jobs:
           cd external/monero-cpp
           mkdir -p build
           cd build
-          cmake .. -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          cmake .. -DOPENSSL_ROOT_DIR="$OPENSSL_ROOT_DIR" -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
           cmake --build .
           make -j3
           cd ../../../

docker/build.sh

@@ -45,10 +45,17 @@ if [[ $(uname -s) == "MINGW64_NT"* || $(uname -s) == "MSYS"* ]]; then
         make release-static-win32 -j$HOST_NCORES
     fi
 else
-    # OS is not windows
+    # OS is not windows. monero builds with -march=native unless it is told which cpu to build for, and objects compiled
+    # on a runner with newer instructions, restored by ccache or shipped in a package, end in an illegal
+    # instruction on another cpu
+    case $(uname -m) in
+        x86_64) MONERO_ARCH="x86-64";;
+        aarch64|arm64) MONERO_ARCH="armv8-a";;
+        *) MONERO_ARCH="native";;
+    esac
     mkdir -p build/release &&
     cd build/release &&
-    cmake -DSTATIC=ON -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
+    cmake -DSTATIC=ON -DARCH="$MONERO_ARCH" -DBUILD_64=ON -DCMAKE_BUILD_TYPE=Release ../../
     make -j$HOST_NCORES wallet cryptonote_protocol
 fi
 cd ../../../../