SSL: RECORD_LAYER_FAILURE when downloading template on macOS

[G-lalala]

Environment

• OS: macOS 15.6.1 (Darwin 24.6.0)
• Python: 3.14.2 (installed via Homebrew)
• OpenSSL: 3.6.0
• specify-cli: v0.0.22
• Installation method: uv tool install specify-cli --from git+https://github.com/github/spec-kit.git

Description

specify init fails with an SSL/TLS handshake error when attempting to download the template ZIP file from release-assets.githubusercontent.com.

Command

specify init . --ai claude --force --ignore-agent-tools

Questions

1. Has anyone else encountered this issue on macOS with recent OpenSSL versions?
2. Are there any known compatibility issues with release-assets.githubusercontent.com and OpenSSL 3.6.0?
3. Would it be possible to provide an alternative download method (e.g., direct GitHub API asset download without redirect)?

What Works ✅

• API call to https://api.github.com/repos/github/spec-kit/releases/latest succeeds
• Access to https://github.com and https://api.github.com works fine
• The CLI successfully fetches release metadata and identifies the correct template file

What Fails ❌

• Download from https://release-assets.githubusercontent.com/... (after redirect from GitHub releases)
• Using --skip-tls flag does not resolve the issue
• Both Python's urllib and httpx (with truststore) fail with the same error
• System curl (LibreSSL 3.3.6) also fails with: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version

Thanks.