Update Mac versions in helix queues - #113399

Closed
agocke wants to merge 8 commits into
dotnet:mainfrom
agocke:update-mac
Closed

Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom
agocke:update-mac

Conversation

@agocke

@agockeagocke commented Mar 11, 2025

Copy link
Copy Markdown
Member

No description provided.

CopilotAI review requested due to automatic review settings March 11, 2025 22:46
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Mar 11, 2025
CopilotAI reviewed Mar 11, 2025
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:

  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)

eng/pipelines/coreclr/templates/helix-queues-setup.yml:41

  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105

  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open

This was referenced Mar 12, 2025
Closed
Open
Closed
@steveisok
steveisok requested a review from a teamMarch 12, 2025 12:29
@steveisoksteveisok removed the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Mar 12, 2025
@dotnet-policy-service

dotnet-policy-serviceBot commented Mar 12, 2025

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

@agocke

agocke commented Mar 12, 2025

Copy link
Copy Markdown
MemberAuthor

It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?

@vcsjones

vcsjones commented Mar 12, 2025•
edited
Loading

Copy link
Copy Markdown
Member

No usable version of libssl was found
SIGABRT

These images don't appear to have OpenSSL on them, or its not getting installed correctly.

@vcsjones

vcsjones commented Mar 12, 2025

Copy link
Copy Markdown
Member

It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.

I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.

@agocke

agocke commented Mar 13, 2025

Copy link
Copy Markdown
MemberAuthor

What would break if we dropped OpenSSL?

@vcsjones

vcsjones commented Mar 13, 2025

Copy link
Copy Markdown
Member

What would break if we dropped OpenSSL?

On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.

@matouskozak

matouskozak commented Apr 2, 2025

Copy link
Copy Markdown
Member

@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?

@agocke

agocke commented Apr 2, 2025

Copy link
Copy Markdown
MemberAuthor

Mobile can go in separately

@vcsjones

vcsjones commented Jul 10, 2025

Copy link
Copy Markdown
Member

Circling back around to this...

What would break if we dropped OpenSSL?

OpenSSL on macOS has been dropped.

@build-analysisbuild-analysisBot mentioned this pull request Jul 11, 2025
Closed
This was referenced Jul 12, 2025
Open
Closed
@build-analysisbuild-analysisBot mentioned this pull request Jul 12, 2025
Closed
@ManickaP

ManickaP commented Jul 14, 2025

Copy link
Copy Markdown
Member

Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?
Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.

cc @wfurt, @liveans

@vcsjones

vcsjones commented Jul 14, 2025•
edited
Loading

Copy link
Copy Markdown
Member

I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.

As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.

Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is

  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path

So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.

  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.

Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.

Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.

I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.

@ManickaP

ManickaP commented Jul 15, 2025

Copy link
Copy Markdown
Member

@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025
Closed
Closed
Open
@vcsjonesvcsjones mentioned this pull request Sep 22, 2025
Merged
@agocke

agocke commented Nov 17, 2025

Copy link
Copy Markdown
MemberAuthor

@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?

@agocke

agocke commented Nov 17, 2025

Copy link
Copy Markdown
MemberAuthor

Never mind, this is stale

@agockeagocke closed this Nov 17, 2025
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Update Mac versions in helix queues - #113399
Closed
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Closed
Update Mac versions in helix queues#113399
agocke wants to merge 8 commits into
dotnet:mainfrom 
agocke:update-mac
Conversation
@agocke
@agockeagocke
commented
Mar 11, 2025

Copy link


Copy Markdown

Member
 No description provided. 
CopilotAI
review requested due to automatic review settings
March 11, 2025 22:46
@ghostghost
added
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 11, 2025
CopilotAI
reviewed
Mar 11, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR updates the Mac versions in the helix queues configuration and adjusts the version numbers for various Mac platforms. The key changes include:
  • Updating OSX version numbers for iOS Simulator/Mac Catalyst arm64 queues.
  • Modifying OSX version numbers for iOS/tvOS Simulator x64 & MacCatalyst x64 queues.
  • Adjusting OSX arm64 and OSX x64 versions for public and internal team projects.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
FileDescription
eng/pipelines/coreclr/templates/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
eng/pipelines/libraries/helix-queues-setup.ymlUpdated OSX version numbers for multiple Mac platform queues
Comments suppressed due to low confidence (2)
eng/pipelines/coreclr/templates/helix-queues-setup.yml:41
  • There appears to be an inconsistency in OSX version numbers: the iOS/tvOS Simulator x64 & MacCatalyst queue is updated to 'OSX.14.Amd64.Open' while the dedicated OSX x64 queue is updated to 'OSX.15.Amd64.Open' further down. Please verify whether these versions should be aligned.
- - OSX.14.Amd64.Open

eng/pipelines/libraries/helix-queues-setup.yml:105
  • The updated version for the iOS/tvOS Simulator x64 & MacCatalyst queue ('OSX.15.Amd64.Open') differs from the corresponding update in the coreclr templates file. Please confirm if this discrepancy is intentional or if both files should use the same OSX version.
- - OSX.15.Amd64.Open


This was referenced Mar 12, 2025

Closed


Open


Closed

@steveisok
steveisok
requested a review
from a teamMarch 12, 2025 12:29
@steveisoksteveisok
removed
the 
needs-area-label
An area label is needed to ensure this gets routed to the appropriate area owners
label
Mar 12, 2025
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Mar 12, 2025

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @dotnet/runtime-infrastructure

See info in area-owners.md if you want to be subscribed.
@agocke
agocke
commented
Mar 12, 2025

Copy link


Copy Markdown

MemberAuthor
It looks like there are some failing tests on Mac OS for cryptography. @vcsjones do you happen to know any blockers here?
@vcsjones
vcsjones
commented
Mar 12, 2025•

edited

Loading

Copy link


Copy Markdown

Member
No usable version of libssl was found

SIGABRT
These images don't appear to have OpenSSL on them, or its not getting installed correctly.
@vcsjones
vcsjones
commented
Mar 12, 2025

Copy link


Copy Markdown

Member
It's not enough to run install-dependencies.sh from arcade. While that does install openssl from Brew, it does not put libssl or libcrypto in a directory where macOS will look.
I don't remember the specifics, but machines appear to need some kind of configuration based on dotnet/dnceng#1625.
@agocke
agocke
commented
Mar 13, 2025

Copy link


Copy Markdown

MemberAuthor
What would break if we dropped OpenSSL?
@vcsjones
vcsjones
commented
Mar 13, 2025

Copy link


Copy Markdown

Member
What would break if we dropped OpenSSL?
On macOS? We would have no test coverage for classes like RSAOpenSsl and ECDsaOpenSsl on macOS (well, we would need to disable it). These classes are supported on macOS when OpenSSL is present on the system.
@matouskozak
matouskozak
commented
Apr 2, 2025

Copy link


Copy Markdown

Member
@agocke fyi: I have a PR for the Apple mobile workloads migration here #113313. Do you want to do it in a single PR here or split it for desktop/mobile?
@agocke
agocke
commented
Apr 2, 2025

Copy link


Copy Markdown

MemberAuthor
Mobile can go in separately
@vcsjones
vcsjones
commented
Jul 10, 2025

Copy link


Copy Markdown

Member
Circling back around to this...
What would break if we dropped OpenSSL?
OpenSSL on macOS has been dropped.
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 11, 2025

Closed


This was referenced Jul 12, 2025

Open


Closed

@build-analysisbuild-analysisBot
mentioned this pull request
Jul 12, 2025

Closed

@ManickaP
ManickaP
commented
Jul 14, 2025

Copy link


Copy Markdown

Member
Just a quick question, does this mean we're dropping installing OpenSSL on MAC machines in helix?

Because our QUIC tests depends on MsQuic which in turn depends on system libcrypto (from OpenSSL). So if we're completely dropping OpenSSL from testing MAC machines, we're losing test coverage there.
cc @wfurt, @liveans
@vcsjones
vcsjones
commented
Jul 14, 2025•

edited

Loading

Copy link


Copy Markdown

Member
I should probably document somewhere why S.S.Cryptography decided to finally break with OpenSSL on macOS. I am sure there are better places but let's start here.
As far as @bartonjs and I are aware, recent macOS version on Apple Silicon do not make it feasible to support OpenSSL, at least the way the native shim expects to be able to load it.
Apple Silicon, plus applications built with the Hardened Runtime, on macOS 14 (and perhaps older)+ adjust the system PATH in such a way that we cannot get it to load libcrypto or libssl. The library path searching is
  • /System/Volumes/Preboot/Cryptexes/
  • /usr/lib
  • SxS with executable
  • An absolute path
So when the native shim does dlopen("libcrypto.3.dylib") it looks in those paths.
  1. It's not in the system cryptex
  2. It's not in /usr/lib
  3. It's not next to dotnet
  4. We don't dlopen with an absolute path because that path is variable.
Traditionally, we expected libssl and libcrypto to just show up in the search path. Usually that meant linking the libraries in /usr/local/lib, or DYLD_LIBRARY_PATH. However both that path and environment variable are ignored by Apple's harden runtime.
Both the cryptex directory and /usr/lib are non-writable directories. Even as root. Apple's SIP protects them. We can't realistically expect libcrypto and libssl to be next to everyone's dotnet application. And we can't use an absolute path because OpenSSL is not really have an "official" place on macOS.
I don't know much about how MsQuic works on macOS, how CI or users are expected to acquire all of the dependencies. However if it works similar to the OpenSSL native shim works, it's very difficult to get MsQuic working on a modern MacOS version when it's in a PATH the Apple library loader won't look in.
@ManickaP
ManickaP
commented
Jul 15, 2025

Copy link


Copy Markdown

Member
@liveans this ⬆️ might be related to #114912

This was referenced Aug 11, 2025

Closed


Closed


Open

@vcsjonesvcsjones
mentioned this pull request
Sep 22, 2025
 Merged

@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
@elinor-fung it looks like some host tests are failing on MacOS 26. Could you take a look?
@agocke
agocke
commented
Nov 17, 2025

Copy link


Copy Markdown

MemberAuthor
Never mind, this is stale
@agockeagocke
closed this
Nov 17, 2025
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Dec 18, 2025
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

@agockeagocke

Labels

area-Infrastructure

Projects

Runtime Infra

Status: Done


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

6 participants

@agocke@vcsjones@matouskozak@ManickaP@steveisok