error: failed to run custom build command for openssl-sys" after cargo update

TL;DR

The openssl-sys build script cannot find usable OpenSSL development files on your system - either install them through your OS package manager or enable the crate's vendored feature so it builds OpenSSL from source. The update did not break your code; it just pulled an openssl-sys version whose build script probes the system more strictly. Check the full build output above the error line for the actual missing piece.

Error

"error: failed to run custom build command for openssl-sys" after cargo update

Steps

1. Read the real error. Scroll up in the cargo output past the "failed to run custom build command" line to the build script's stderr. Expected: a message about missing headers, libraries, or an unusable OpenSSL version - that is the actual problem.
2. Check for system OpenSSL dev files. Look for the OpenSSL headers and libraries on your system (your OS package manager can tell you which dev package provides them). Expected: you confirm whether they are present and which version they are.
3. Option A - install system OpenSSL dev files. Install the OpenSSL development package for your OS, then run cargo build again. Expected: the build script finds the headers and compilation proceeds.
4. Option B - use the vendored feature. Add the vendored feature to the openssl-sys dependency entry in Cargo.toml so the crate compiles its own copy of OpenSSL instead of using the system's. Expected: cargo build compiles OpenSSL from source - slower, but independent of the system.
5. Verify the fix sticks. Run cargo build from a clean target dir. Expected: the build completes with no openssl-sys errors. Commit the Cargo.toml/Cargo.lock change so CI gets the same behavior.

Use this when

• cargo update leads to an openssl-sys build script failure
• The error is "failed to run custom build command" naming openssl-sys
• Building on a fresh machine or CI image without OpenSSL dev files
• System OpenSSL is too old or too new for the openssl-sys version

Not for this skill when

• The failing build script belongs to a different crate - read the crate name carefully
• Your own build.rs is failing - that is your code, not openssl-sys
• The error is a linker error like "cannot find -lssl" at link time - related but a different fix

Variant phrasings

• openssl-sys build failed after cargo update
• failed to run custom build script for openssl-sys v0.9
• cargo can't find OpenSSL after updating dependencies
• openssl-sys build script probe failed

Why it happens

openssl-sys does not contain OpenSSL; its build script locates OpenSSL on your system and generates the Rust bindings against it. A cargo update can pull a newer openssl-sys that requires a newer (or older) OpenSSL than the system provides, or drops support for the layout your OS uses. The build script then fails its probe, and cargo reports the generic "failed to run custom build command" without the details unless you scroll up.

Edge cases

• On some systems there are multiple OpenSSL installs (system vs brewed vs conda) and the build script picks the wrong one - the vendored feature sidesteps this entirely.
• The vendored feature downloads and compiles OpenSSL, which needs a C compiler and perl - make sure those exist in minimal CI images.
• Pinning openssl-sys to the older version works short-term but you inherit its security posture - prefer fixing the environment.
• If you cross-compile, the build script needs the target's OpenSSL, not the host's - vendored is usually the simpler path there.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_lrFfhYnV70XHJ9pSoRAIgw