Skip to content

[curl] Add apple-sectrust feature #51089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
awesomekling wants to merge 1 commit into
base: master
Choose a base branch
from
+55 −22
Draft

[curl] Add apple-sectrust feature #51089

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 41 additions & 21 deletions ports/curl/portfile.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,27 +15,28 @@ vcpkg_replace_string("${SOURCE_PATH}/include/curl/curlver.h" [[LIBCURL_TIMESTAMP

vcpkg_check_features(OUT_FEATURE_OPTIONS FEATURE_OPTIONS
FEATURES
http2 USE_NGHTTP2
http3 USE_NGTCP2
wolfssl CURL_USE_WOLFSSL
openssl CURL_USE_OPENSSL
openssl CURL_CA_FALLBACK
mbedtls CURL_USE_MBEDTLS
ssh CURL_USE_LIBSSH2
tool BUILD_CURL_EXE
c-ares ENABLE_ARES
sspi CURL_WINDOWS_SSPI
brotli CURL_BROTLI
idn2 USE_LIBIDN2
winidn USE_WIN32_IDN
zstd CURL_ZSTD
psl CURL_USE_LIBPSL
gssapi CURL_USE_GSSAPI
gsasl CURL_USE_GSASL
gnutls CURL_USE_GNUTLS
rtmp USE_LIBRTMP
httpsrr USE_HTTPSRR
ssls-export USE_SSLS_EXPORT
apple-sectrust USE_APPLE_SECTRUST
Copy link
Copy Markdown
Member

@BillyONeal BillyONeal Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like a newlines change but it isn't, the file is still correctly LF, this is just inserting extra spaces to get the options to line up again now that apple-sectrust is longer.

No change requested.

http2 USE_NGHTTP2
http3 USE_NGTCP2
wolfssl CURL_USE_WOLFSSL
openssl CURL_USE_OPENSSL
openssl CURL_CA_FALLBACK
mbedtls CURL_USE_MBEDTLS
ssh CURL_USE_LIBSSH2
tool BUILD_CURL_EXE
c-ares ENABLE_ARES
sspi CURL_WINDOWS_SSPI
brotli CURL_BROTLI
idn2 USE_LIBIDN2
winidn USE_WIN32_IDN
zstd CURL_ZSTD
psl CURL_USE_LIBPSL
gssapi CURL_USE_GSSAPI
gsasl CURL_USE_GSASL
gnutls CURL_USE_GNUTLS
rtmp USE_LIBRTMP
httpsrr USE_HTTPSRR
ssls-export USE_SSLS_EXPORT
INVERTED_FEATURES
ldap CURL_DISABLE_LDAP
ldap CURL_DISABLE_LDAPS
Expand All @@ -50,6 +51,25 @@ if("ssl" IN_LIST FEATURES AND
list(APPEND FEATURE_OPTIONS -DCURL_USE_SCHANNEL=ON)
endif()

if("apple-sectrust" IN_LIST FEATURES)
Copy link
Copy Markdown
Member

@BillyONeal BillyONeal Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this even be a feature or should we always just do it? (It's hard to imagine a case where one does not want this behavior)

set(apple_sectrust_has_compatible_backend OFF)
if("ssl" IN_LIST FEATURES OR "openssl" IN_LIST FEATURES OR "gnutls" IN_LIST FEATURES)
set(apple_sectrust_has_compatible_backend ON)
endif()

if(NOT apple_sectrust_has_compatible_backend AND
("mbedtls" IN_LIST FEATURES OR "wolfssl" IN_LIST FEATURES))
message(FATAL_ERROR "apple-sectrust requires curl[ssl], curl[openssl], or curl[gnutls].")
endif()

if(NOT apple_sectrust_has_compatible_backend)
list(APPEND FEATURE_OPTIONS
-DCURL_USE_OPENSSL=ON
-DCURL_CA_FALLBACK=ON
)
endif()
endif()

if("http3" IN_LIST FEATURES AND
("wolfssl" IN_LIST FEATURES OR
"mbedtls" IN_LIST FEATURES OR
Expand Down
8 changes: 8 additions & 0 deletions ports/curl/vcpkg.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
{
"name": "curl",
"version": "8.19.0",
"port-version": 1,
"description": "A library for transferring data with URLs",
"homepage": "https://curl.se/",
"license": "curl AND ISC AND BSD-3-Clause",
Expand All @@ -20,6 +21,13 @@
"ssl"
],
"features": {
"apple-sectrust": {
"description": "Use Apple's SecTrust certificate verification",
"supports": "osx",
"dependencies": [
"openssl"
]
},
Copy link
Copy Markdown
Contributor

@dg0yt dg0yt Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this feature depend on openssl libs?

And do we want an apple-specific feature? A similar capability exists for Windows (CURL_CA_NATIVE).

Copy link
Copy Markdown

@x-xiang x-xiang Apr 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apple SecTrust is only supported with Openssl/GnuTLS，without mbedTLS/wolfSSL

"brotli": {
"description": "brotli support (brotli)",
"dependencies": [
Expand Down
2 changes: 1 addition & 1 deletion versions/baseline.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2290,7 +2290,7 @@
},
"curl": {
"baseline": "8.19.0",
"port-version": 0
"port-version": 1
},
"curlcpp": {
"baseline": "3.1",
Expand Down
5 changes: 5 additions & 0 deletions versions/c-/curl.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
{
"versions": [
{
"git-tree": "fc2715100188e70fd07bae1373ac22025b8ee6a3",
"version": "8.19.0",
"port-version": 1
},
{
"git-tree": "2826bbcd8b83d191393e58842c2baa969b9363f9",
"version": "8.19.0",
Expand Down
Loading