echo/CMake
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

macOS: Prefer building with system-provided curl

Browse Source 
Our vendored curl only enables the Secure Transport backend by default
(`CURL_SSL_BACKEND=secure-transport`), but it is limited to TLS 1.2.

The macOS SDK provides the curl development components, and the
corresponding `libcurl.4.dylib` runtime library comes with macOS.
On macOS 12 and above, the default `CURL_SSL_BACKEND=openssl`
backend seems to be capable of selecting TLS 1.3 at runtime for
https connections.

Unfortunately the macOS version of curl, even on macOS 14.4, does
not accept `CURL_SSLVERSION_TLSv1_3` at runtime to enforce TLS 1.3.
However, while our vendored curl accepts the option and passes it
to Secure Transport, macOS does not actually enforce it anyway.

Fixes: #25870
Fixes: #23701
This commit is contained in:
Brad King 2024-05-09 09:01:46 -04:00
parent d224c018fe
commit d3cbee99e3
5 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitlab/ci/configure_macos_arm64_ninja.cmake
View File

@ -8,7 +8,7 @@ set(CMake_TEST_FindOpenMP_CXX "ON" CACHE BOOL "")
set(CMake_TEST_GUI "ON" CACHE BOOL "")
set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
set(CMake_TEST_TLS_VERIFY_URL_BAD "https://badtls-expired.kitware.com" CACHE STRING "")
set(CMake_TEST_TLS_VERSION "1.3" CACHE STRING "")
set(CMake_TEST_TLS_VERSION "1.2" CACHE STRING "")
include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

2
.gitlab/ci/configure_macos_x86_64_makefiles.cmake
View File

@ -8,7 +8,7 @@ if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
endif()
set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
set(CMake_TEST_TLS_VERIFY_URL_BAD "https://badtls-expired.kitware.com" CACHE STRING "")
set(CMake_TEST_TLS_VERSION "1.3" CACHE STRING "")
set(CMake_TEST_TLS_VERSION "1.2" CACHE STRING "")
include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

2
.gitlab/ci/configure_macos_x86_64_ninja.cmake
View File

@ -11,7 +11,7 @@ if (NOT "$ENV{CMAKE_CI_NIGHTLY}" STREQUAL "")
endif()
set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
set(CMake_TEST_TLS_VERIFY_URL_BAD "https://badtls-expired.kitware.com" CACHE STRING "")
set(CMake_TEST_TLS_VERSION "1.3" CACHE STRING "")
set(CMake_TEST_TLS_VERSION "1.2" CACHE STRING "")
include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

3
CMakeLists.txt
View File

@ -178,6 +178,9 @@ macro(CMAKE_HANDLE_SYSTEM_LIBRARIES)
string(TOLOWER "${util}" lutil)
set(CMAKE_USE_SYSTEM_${util} "${CMAKE_USE_SYSTEM_LIBRARY_${util}}"
CACHE BOOL "Use system-installed ${lutil}" FORCE)
elseif(util STREQUAL "CURL" AND APPLE)
# macOS provides a curl with backends configured by Apple.
set(CMAKE_USE_SYSTEM_LIBRARY_${util} ON)
else()
set(CMAKE_USE_SYSTEM_LIBRARY_${util} OFF)
endif()

4
bootstrap
View File

@ -684,8 +684,8 @@ Configuration:
(default)
--system-cppdap use system-installed cppdap library
--no-system-cppdap use cmake-provided cppdap library (default)
--system-curl use system-installed curl library
--no-system-curl use cmake-provided curl library (default)
--system-curl use system-installed curl library (default on macOS)
--no-system-curl use cmake-provided curl library (default elsewhere)
--system-expat use system-installed expat library
--no-system-expat use cmake-provided expat library (default)
--system-jsoncpp use system-installed jsoncpp library