From 41f1e29583db19a974f2439234e46aee65b16863 Mon Sep 17 00:00:00 2001
From: dijunkun <junkun.di@hotmail.com>
Date: Wed, 21 Oct 2026 11:07:16 +0800
Subject: [PATCH] [fix] pin desktop and Python dependencies to OpenSSL 3.3.2

---
 apps/desktop/xmake/options.lua    | 3 +++
 deps/thirdparty/openssl/xmake.lua | 7 +++++++
 deps/thirdparty/xmake.lua         | 2 +-
 3 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 deps/thirdparty/openssl/xmake.lua

diff --git a/apps/desktop/xmake/options.lua b/apps/desktop/xmake/options.lua
index 283e9cca..338b18f1 100644
--- a/apps/desktop/xmake/options.lua
+++ b/apps/desktop/xmake/options.lua
@@ -49,6 +49,9 @@ function setup_options_and_dependencies()
     end
 
     add_requireconfs("**.python", {version = "3.12", override = true, configs = {pgo = false}})
+    -- Keep application and build-tool dependencies on the same OpenSSL release.
+    add_requireconfs("**.openssl", "**.openssl3",
+        {version = "3.3.2", system = false, override = true})
     add_requires("spdlog 1.14.1", {system = false})
     add_requires("slint 1.17.1", {configs = {shared = true}})
     add_requires("libsdl3 3.2.26", {configs = {shared = false}})
diff --git a/deps/thirdparty/openssl/xmake.lua b/deps/thirdparty/openssl/xmake.lua
new file mode 100644
index 00000000..1902b9a5
--- /dev/null
+++ b/deps/thirdparty/openssl/xmake.lua
@@ -0,0 +1,7 @@
+-- Python's recipe looks up its dependency as "openssl". Keep that name while
+-- using the OpenSSL 3 recipe, including its sources, patches and build scripts.
+package("openssl")
+    set_base("openssl3")
+    -- Rebuild consumers cached against the old OpenSSL 1.x ABI.
+    set_policy("package.strict_compatibility", true)
+package_end()
diff --git a/deps/thirdparty/xmake.lua b/deps/thirdparty/xmake.lua
index e314aea5..b52115c0 100644
--- a/deps/thirdparty/xmake.lua
+++ b/deps/thirdparty/xmake.lua
@@ -1 +1 @@
-includes("cpp-httplib", "rust", "slint")
+includes("cpp-httplib", "openssl", "rust", "slint")