romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 05:43:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: remove support for Secure Transport and BearSSL

Browse source 
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677
This commit is contained in:
Daniel Stenberg 2025-06-09 14:07:21 +02:00
parent b761eb5add
commit 08a3e8e19a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
89 changed files with 163 additions and 5036 deletions
Download patch file Download diff file Expand all files Collapse all files

111
m4/curl-bearssl.m4
View file

@ -1,111 +0,0 @@
#***************************************************************************
# _ _ ____ _
# Project ___| | | | _ \| |
# / __| | | | |_) | |
# | (__| |_| | _ <| |___
# \___|\___/|_| \_\_____|
#
# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
#
# This software is licensed as described in the file COPYING, which
# you should have received as part of this distribution. The terms
# are also available at https://curl.se/docs/copyright.html.
#
# You may opt to use, copy, modify, merge, publish, distribute and/or sell
# copies of the Software, and permit persons to whom the Software is
# furnished to do so, under the terms of the COPYING file.
#
# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
# KIND, either express or implied.
#
# SPDX-License-Identifier: curl
#
#***************************************************************************
AC_DEFUN([CURL_WITH_BEARSSL], [
dnl ----------------------------------------------------
dnl check for BearSSL
dnl ----------------------------------------------------
if test "x$OPT_BEARSSL" != xno; then
_cppflags=$CPPFLAGS
_ldflags=$LDFLAGS
_ldflagspc=$LDFLAGSPC
ssl_msg=
if test X"$OPT_BEARSSL" != Xno; then
if test "$OPT_BEARSSL" = "yes"; then
OPT_BEARSSL=""
fi
if test -z "$OPT_BEARSSL" ; then
dnl check for lib first without setting any new path
AC_CHECK_LIB(bearssl, br_ssl_client_init_full,
dnl libbearssl found, set the variable
[
AC_DEFINE(USE_BEARSSL, 1, [if BearSSL is enabled])
BEARSSL_ENABLED=1
USE_BEARSSL="yes"
ssl_msg="BearSSL"
test bearssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
], [], -lbearssl)
fi
addld=""
addlib=""
addcflags=""
bearssllib=""
if test "x$USE_BEARSSL" != "xyes"; then
dnl add the path and test again
addld=-L$OPT_BEARSSL/lib$libsuff
addcflags=-I$OPT_BEARSSL/include
bearssllib=$OPT_BEARSSL/lib$libsuff
LDFLAGS="$LDFLAGS $addld"
LDFLAGSPC="$LDFLAGSPC $addld"
if test "$addcflags" != "-I/usr/include"; then
CPPFLAGS="$CPPFLAGS $addcflags"
fi
AC_CHECK_LIB(bearssl, br_ssl_client_init_full,
[
AC_DEFINE(USE_BEARSSL, 1, [if BearSSL is enabled])
BEARSSL_ENABLED=1
USE_BEARSSL="yes"
ssl_msg="BearSSL"
test bearssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
],
[
CPPFLAGS=$_cppflags
LDFLAGS=$_ldflags
LDFLAGSPC=$_ldflagspc
], -lbearssl)
fi
if test "x$USE_BEARSSL" = "xyes"; then
AC_MSG_NOTICE([detected BearSSL])
check_for_ca_bundle=1
LIBS="-lbearssl $LIBS"
if test -n "$bearssllib"; then
dnl when shared libs were found in a path that the run-time
dnl linker doesn't search through, we need to add it to
dnl CURL_LIBRARY_PATH to prevent further configure tests to fail
dnl due to this
if test "x$cross_compiling" != "xyes"; then
CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$bearssllib"
export CURL_LIBRARY_PATH
AC_MSG_NOTICE([Added $bearssllib to CURL_LIBRARY_PATH])
fi
fi
fi
fi dnl BearSSL not disabled
test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
fi
])

46
m4/curl-sectransp.m4
View file

@ -1,46 +0,0 @@
#***************************************************************************
# _ _ ____ _
# Project ___| | | | _ \| |
# / __| | | | |_) | |
# | (__| |_| | _ <| |___
# \___|\___/|_| \_\_____|
#
# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
#
# This software is licensed as described in the file COPYING, which
# you should have received as part of this distribution. The terms
# are also available at https://curl.se/docs/copyright.html.
#
# You may opt to use, copy, modify, merge, publish, distribute and/or sell
# copies of the Software, and permit persons to whom the Software is
# furnished to do so, under the terms of the COPYING file.
#
# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
# KIND, either express or implied.
#
# SPDX-License-Identifier: curl
#
#***************************************************************************
AC_DEFUN([CURL_WITH_SECURETRANSPORT], [
AC_MSG_CHECKING([whether to enable Secure Transport])
if test "x$OPT_SECURETRANSPORT" != xno; then
if test "x$OPT_SECURETRANSPORT" != "xno" &&
(test "x$cross_compiling" != "xno" || test -d "/System/Library/Frameworks/Security.framework"); then
AC_MSG_RESULT(yes)
AC_DEFINE(USE_SECTRANSP, 1, [enable Secure Transport])
ssl_msg="Secure Transport"
test secure-transport != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
SECURETRANSPORT_ENABLED=1
SECURETRANSPORT_LDFLAGS='-framework CoreFoundation -framework CoreServices -framework Security'
LDFLAGS="$LDFLAGS $SECURETRANSPORT_LDFLAGS"
LDFLAGSPC="$LDFLAGSPC $SECURETRANSPORT_LDFLAGS"
else
AC_MSG_RESULT(no)
fi
test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
else
AC_MSG_RESULT(no)
fi
])