From 83fa3a7ace0c366c46d076394490ac25aa777589 Mon Sep 17 00:00:00 2001
From: Santiago Rodriguez
 <46354312+santiagorodriguez96@users.noreply.github.com>
Date: Tue, 2 Jun 2026 18:10:19 -0300
Subject: [PATCH 1/3] ci: test against OpenSSL `v4.0.0`

---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3a9a2b0a..c36b3099 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,6 +27,7 @@ jobs:
           - '3.2'
           - '3.1'
         openssl:
+          - '4.0.0'
           - '3.6.0'
           - '3.5.4'
           - '3.4.3'

From 4d8c8a11f174a18f100ea29362c7542a084011e9 Mon Sep 17 00:00:00 2001
From: Santiago Rodriguez
 <46354312+santiagorodriguez96@users.noreply.github.com>
Date: Wed, 3 Jun 2026 11:54:30 -0300
Subject: [PATCH 2/3] ci: support installing openssl `v4.0.0`

---
 .github/actions/install-openssl/action.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/actions/install-openssl/action.yml b/.github/actions/install-openssl/action.yml
index 18deda21..208f9aa2 100644
--- a/.github/actions/install-openssl/action.yml
+++ b/.github/actions/install-openssl/action.yml
@@ -29,16 +29,12 @@ runs:
           ./Configure --prefix=$HOME/openssl --libdir=lib linux-x86_64
           make depend && make -j4 && make install_sw
           ;;
-        3.*)
+        3.* | 4.*)
           OPENSSL_COMMIT=openssl-
           OPENSSL_COMMIT+=$(echo ${{ inputs.version  }})
           git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
           echo "Git commit: $(git rev-parse HEAD)"
-          if [[ ${{ inputs.version }} == 3.5* ]]; then
-            ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests no-legacy
-          else
-            ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests
-          fi
+          ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests
           make -j4 && make install_sw && make install_fips
           ;;
         *)

From 0d9af2ddd1a4cbec5b2453deb048e53293efa1ec Mon Sep 17 00:00:00 2001
From: Santiago Rodriguez
 <46354312+santiagorodriguez96@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:26:34 -0300
Subject: [PATCH 3/3] ci: skip OpenSSL 4.0.0 for Ruby 3.1-3.3

Their bundled `openssl` gem predates OpenSSL 4.0 support, so the
stdlib openssl extension fails to compile against OpenSSL 4.0.0.
---
 .github/workflows/build.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c36b3099..bba41c0e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,6 +36,15 @@ jobs:
           - '3.1.8'
           - '3.0.18'
           - '1.1.1w'
+        exclude:
+          # Ruby 3.1-3.3 bundle an `openssl` gem too old for OpenSSL 4.0.
+          # Re-enable once upstream ships patch releases that bump it.
+          - ruby: '3.3'
+            openssl: '4.0.0'
+          - ruby: '3.2'
+            openssl: '4.0.0'
+          - ruby: '3.1'
+            openssl: '4.0.0'
         include:
           - ruby: truffleruby
           - ruby: '3.0'