curl-rustls.yaml

package:
  name: curl-rustls
  version: "8.12.1"
  epoch: 3
  description: "URL retrieval utility and library"
  copyright:
    - license: MIT
  dependencies:
    runtime:
      - libcurl-rustls4
  checks:
    disabled:
      - empty # curl-rustls is expected to be empty, it brings in a runtime dep on libcurl-rustls4

environment:
  contents:
    packages:
      - autoconf
      - automake
      - brotli-dev
      - build-base
      - busybox
      - ca-certificates-bundle
      - libpsl-dev
      - libtool
      - nghttp2-dev
      - openssl-dev
      - perl
      - rustls-ffi-dev
      - wolfi-base
      - zlib-dev

var-transforms:
  - from: ${{package.version}}
    match: \.
    replace: _
    to: mangled-package-version

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/curl/curl.git
      tag: curl-${{vars.mangled-package-version}}
      expected-commit: 57495c64871d18905a0941db9196ef90bafe9a29

  - runs: autoreconf -vif

  - uses: autoconf/configure
    with:
      opts: |
        --enable-ipv6 \
        --enable-unix-sockets \
        --without-openssl \
        --with-rustls \
        --with-nghttp2 \
        --with-pic \
        --disable-ldap \
        --without-libssh2

  - uses: autoconf/make

  - runs: |
      make install DESTDIR="/home/build/curl-rustls"

subpackages:
  - name: "libcurl-rustls4"
    description: "curl library (rustls backend)"
    dependencies:
      provider-priority: 10
      provides:
        - libcurl-abi=${{package.version}}
    pipeline:
      - runs: |
          mkdir -p "${{targets.subpkgdir}}"/usr/lib
          mv "/home/build/curl-rustls"/usr/lib/libcurl.so.* "${{targets.subpkgdir}}"/usr/lib/
          strip "${{targets.subpkgdir}}"/usr/lib/libcurl.so.*
    test:
      pipeline:
        - uses: test/tw/ldd-check

update:
  enabled: true
  version-separator: _
  github:
    identifier: curl/curl
    strip-prefix: curl-

test:
  environment:
    contents:
      packages:
        - build-base
        - gcc
        - ca-certificates-bundle
        - libcurl-rustls4
        - curl-dev
  pipeline:
    - name: "Test library linking"
      runs: |
        cat > test.c << 'EOF'
        #include <curl/curl.h>
        #include <stdio.h>

        int main() {
            CURL *curl = curl_easy_init();
            if (!curl) return 1;
            printf("CURL Version: %s\n", curl_version());
            curl_easy_cleanup(curl);
            return 0;
        }
        EOF
        gcc test.c -o test -lcurl
        ./test
    - name: "Verify rustls backend"
      runs: |
        cat > ssl_backend.c << 'EOF'
        #include <curl/curl.h>
        #include <stdio.h>
        #include <string.h>

        int main() {
            CURL *curl = curl_easy_init();
            if (!curl) {
                return 1;
            }

            curl_version_info_data *data = curl_version_info(CURLVERSION_NOW);
            if (data->ssl_version && strstr(data->ssl_version, "rustls")) {
                printf("SSL backend: %s\n", data->ssl_version);
                curl_easy_cleanup(curl);
                return 0;
            }

            fprintf(stderr, "Expected rustls backend, got: %s\n",
                    data->ssl_version ? data->ssl_version : "none");
            curl_easy_cleanup(curl);
            return 1;
        }
        EOF
        gcc ssl_backend.c -o ssl_backend -lcurl
        ./ssl_backend
    - name: "Verify rustls backend behavior"
      runs: |
        cat > test.c << 'EOF'
        #include <curl/curl.h>
        #include <stdio.h>

        int main(void) {
            CURL *curl = curl_easy_init();
            CURLcode res;

            if (!curl) {
                return 1;
            }

            // Try to force TLS 1.1 - this should fail with rustls
            curl_easy_setopt(curl, CURLOPT_URL, "https://wolfi.dev");
            curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);

            res = curl_easy_perform(curl);

            // rustls should reject TLS 1.1
            if (res != CURLE_SSL_CONNECT_ERROR) {
                fprintf(stderr, "Expected TLS 1.1 to fail with rustls\n");
                curl_easy_cleanup(curl);
                return 0;
            }

            curl_easy_cleanup(curl);
            return 1;
        }
        EOF
        gcc test.c -o test -lcurl
        ./test