From e1ffea29e8d38f324f46a2f576c66ba6d90a6e77 Mon Sep 17 00:00:00 2001
From: robert <robert@r.uby.dev>
Date: Tue, 20 Oct 2026 05:41:28 -0300
Subject: [PATCH] freebsd: fix broken OpenSSL configuration

Fixes #529

FreeBSD provides OpenSSL as part of its base
system and it is configured to use the certs
that are also provided as part of the base
system (/etc/ssl/cert.pem).

The 'openssl' package that ruby-install currently
uses does not ship any certs and after install a
simple HTTPS request will fail:

```
ruby -rnet/http -e 'p Net::HTTP.get_response(URI.parse("https://google.com"))'
/../4.0.0/net/protocol.rb:46:in 'OpenSSL::SSL::SSLSocket#connect_nonblock': SSL_connect
returned=1 errno=0 peeraddr=142.250.219.206:443 state=error: certificate verify failed
(unable to get local  issuer certificate) (OpenSSL::SSL::SSLError)
OpenSSL error queue reported 0 errors:
```

The 'ca_root_nss' package does provide certs, but
not in a location that the OpenSSL package will
look. It would require extra steps that are more
complicated than depending on the base system's
OpenSSL.

This change was tested in isolation, on an empty
jail that is based on 16-CURRENT. This is the script
I used, and it might be useful for your own tests:

```sh
set -ex
jobs=$(sysctl -n hw.ncpu)

if [ "$(id -u)" != "0" ]; then
  echo "you must be root"
  exit 1
fi

if [ ! -e "/tmp/ruby-install" ]; then
  bsdinstall jail /tmp/ruby-install
fi

PREFIX=/usr/local DESTDIR=/tmp/ruby-install make install

jail -n ruby-install -c path=/tmp/ruby-install \
                        host.hostname=ruby-install \
                        ip4=inherit \
                        persist \
                        mount.devfs \
                        devfs_ruleset=4 \
                        exec.start="/bin/sh /etc/rc" \
                        exec.stop="/bin/sh /etc/rc.shutdown jail"

pkg -j ruby-install install -y bash curl

jexec -u root ruby-install ruby-install "ruby" "4.0.7" "-j" "${jobs}" "--prefix" "/usr/local"
jexec -u root ruby-install ruby -rnet/http -e 'p Net::HTTP.get_response(URI("https://ruby-lang.org"))'

jail -r ruby-install
```
---
 share/ruby-install/ruby/dependencies.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/share/ruby-install/ruby/dependencies.sh b/share/ruby-install/ruby/dependencies.sh
index afa36749..3b9ac226 100644
--- a/share/ruby-install/ruby/dependencies.sh
+++ b/share/ruby-install/ruby/dependencies.sh
@@ -59,7 +59,6 @@ case "$package_manager" in
 		;;
 	pkg)
 		ruby_dependencies=(
-			openssl
 			libyaml
 			libffi
 		)