openssl VS Traveling Ruby

JRuby doesn't use the official openssl gem which contains C extensions that compile against libopenssl, but instead uses jruby-openssl. There are a few minor compatibility issues with jruby-openssl. I've ran into the missing EC.generate method before. In theory CRuby's openssl OpenSSL::PKey::EC.generate creates a new OpenSSL::PKey::EC object and calls #generate_key, but trying that in JRuby produces a smaller EC key implying there's some data missing from the EC key, so I'm not sure if that approach is equivalent.

I would edit ossl.c and copy some code from Ruby OpenSSL commit 8e98d2e. This might be easier than building an old version of OpenSSL.

The used digest algorithm. I created an issue with the OpenSSL gem, see https://github.com/ruby/openssl/issues/474

ruby-install 0.8.3 has been released. This version explicitly pins the homebrew openssl dependency to [email protected]. OpenSSL 3.0 was released this month and is now available in homebrew. Unfortunately, ruby’s openssl bindings are still working on OpenSSL 3.0 support, so attempting to compile any current ruby version against OpenSSL 3.0 from homebrew will result in a compilation error. Until all actively supported versions of Ruby support OpenSSL 3.0, ruby-install will continue to compile against [email protected] on macOS with homebrew.

If you absolutely need a native binary distribution for your apps, there is a project called Traveling Ruby that originated at Phusion, makers of the popular Phusion Passenger Ruby application server. It's worth noting that this project has a number of open issues that are aging and the latest commits are from 2021, so I'm not sure about its current status. There are also important caveats with regard to native extensions and Windows. Given the popularity of packages that require native extensions (like the XML/HTML library Nokogiri), you may find that this solution simply doesn't work for you.

You may be to get a precompiled binary with OpenSSL 1.1 statically linked. Maybe Traveling Ruby? https://github.com/phusion/traveling-ruby

There's really not much else in this space. The main alternative - Traveling Ruby - has limitations on Windows and I don't think it supports Ruby 3.0.

But even with all of the above, you're absolutely right, it is just easier to ship a binary blob. That's where the rewrite totally pays off. I just wonder whether the team has stressed all the options when it comes to keep ruby. There are packaging solutions which ship with its own interpreter, such as Travelling Ruby. And mruby could also generate a binary blob, although they'd have to open another can of works, such as finding replacements for dependencies such as net-ssh, which AFAIK can't be used with mruby. So in the end, maybe they did. And given the prevalence of go products in hashicorp, maybe it makes sense to just invest a bit more in it?

You could try using Traveling Ruby as an alternative to Ocra. I have only used Ocra in the past for this task, but I'd say it's worth a try.