macOS wheels: use delocate to repair wheels instead of linking static openssl libraries

.github/workflows/build-wheels.yml

@@ -252,11 +252,30 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    # It is not documented in Github that openssl 3 is installed in their macos images
+    # so we install it here to be safe
+    - if: ${{ startsWith(inputs.platform-tag, 'macosx') }}
+      name: Ensure openssl is installed on Github macOS runners.
+      run: brew install openssl@${{ env.MACOS_OPENSSL_VERSION }}
+
+    - if: ${{ startsWith(inputs.platform-tag, 'macosx') }}
+      name: Set minimum macos version required to install wheel
+      # - We use delocate to repair the wheel because it throws an error if
+      # the openssl library version is newer than the wheel's macOS version tag
+      # Linking the static libraries produces a warning for that same reason that but it doesn't throw an error.
+      # macOS wheel is only backwards compatible with the macOS major version it is built from
+      # - Use single dash for backwards compatibility with older sw_vers
+      run: echo MACOSX_DEPLOYMENT_TARGET=$(sw_vers -productVersion | cut -d"." -f 1).0 >> $GITHUB_ENV
+
+    - if: ${{ inputs.platform-tag == 'macosx_arm64' }}
+      name: Ensure that linker can find openssl
+      # On mac m1, openssl@3 installed via brew is not in the linker's default library path
+      run: echo CFLAGS="-L$(brew --prefix openssl@${{ env.MACOS_OPENSSL_VERSION }})/lib $CFLAGS" >> $GITHUB_ENV
+
     - name: Build wheel
       uses: pypa/cibuildwheel@v2.21.3
       env:
         CIBW_ENVIRONMENT_PASS_LINUX: ${{ inputs.unoptimized && 'UNOPTIMIZED' || '' }}
-        CIBW_ENVIRONMENT_MACOS: SSL_LIB_PATH="$(brew --prefix openssl@${{ env.MACOS_OPENSSL_VERSION }})/lib/" CPATH="$(brew --prefix openssl@${{ env.MACOS_OPENSSL_VERSION }})/include/" STATIC_SSL=1
         CIBW_BUILD: ${{ env.BUILD_IDENTIFIER }}
         CIBW_BUILD_FRONTEND: build
         CIBW_BEFORE_ALL_LINUX: >
@@ -275,6 +294,10 @@ jobs:
           auditwheel show {dest_dir}/* &&
           rm -rf $WHEEL_DIR
         CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: "delvewheel repair --add-path ./aerospike-client-c/vs/x64/Release -w {dest_dir} {wheel}"
+        # We also want to verify the same thing on macos
+        CIBW_REPAIR_WHEEL_COMMAND_MACOS: >
+          delocate-listdeps {wheel} &&
+          delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}
         CIBW_TEST_COMMAND: ${{ env.TEST_COMMAND }}
 
     # For debugging

setup.py

@@ -96,7 +96,7 @@
     extra_link_args.append("-static-libasan")
     extra_link_args.extend(sanitizer_flags)
 
-library_dirs = ['/usr/local/opt/openssl/lib', '/usr/local/lib']
+library_dirs = ['/usr/local/lib']
 libraries = [
     'ssl',
     'crypto',