← Commit list

1730407b74

Viktor Szakats
Viktor Szakats
2026-01-17
SUCCESS Duration: 633s

Subject

windows: add build option to use the native CA store

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

.github/workflows/windows.yml +2 -1CMakeLists.txt +11 -3acinclude.m4 +2 -0configure.ac +49 -6docs/INSTALL-CMAKE.md +3 -1docs/libcurl/curl_version_info.md +7 -0lib/curl_config-cmake.h.in +3 -0lib/version.c +4 -0lib/vtls/vtls.c +2 -2
.github/workflows/windows.yml+2 -1
@@ -200,7 +200,7 @@ jobs:
- { build: 'autotools', sys: 'msys' , env: 'x86_64' , tflags: '' , config: '--with-openssl', install: 'openssl-devel libssh2-devel', name: 'default R' }
# MinGW
- { build: 'autotools', sys: 'mingw64' , env: 'x86_64' , tflags: 'skiprun' , config: '--enable-debug --with-openssl --disable-threaded-resolver --disable-curldebug --enable-static --without-zlib', install: 'mingw-w64-x86_64-openssl mingw-w64-x86_64-libssh2', name: 'default' }
- - { build: 'autotools', sys: 'mingw64' , env: 'x86_64' , tflags: '' , config: '--enable-debug --with-openssl --enable-windows-unicode --enable-ares --with-openssl-quic --enable-static --disable-shared', install: 'mingw-w64-x86_64-c-ares mingw-w64-x86_64-openssl mingw-w64-x86_64-nghttp3 mingw-w64-x86_64-libssh2', name: 'c-ares U' }
+ - { build: 'autotools', sys: 'mingw64' , env: 'x86_64' , tflags: '' , config: '--enable-debug --with-openssl --enable-windows-unicode --enable-ares --with-openssl-quic --enable-static --disable-shared --enable-ca-native', install: 'mingw-w64-x86_64-c-ares mingw-w64-x86_64-openssl mingw-w64-x86_64-nghttp3 mingw-w64-x86_64-libssh2', name: 'c-ares U' }
- { build: 'cmake' , sys: 'mingw64' , env: 'x86_64' , tflags: '--min=1650', config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON', install: 'mingw-w64-x86_64-c-ares mingw-w64-x86_64-libssh2', type: 'Debug', name: 'schannel c-ares U' }
# MinGW torture
- { build: 'cmake' , sys: 'mingw64' , env: 'x86_64' , tflags: '-t --shallow=13 --min=700 1 to 950' , config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON', install: 'mingw-w64-x86_64-c-ares mingw-w64-x86_64-libssh2', type: 'Debug', name: 'schannel U torture 1' }
@@ -764,6 +764,7 @@ jobs:
-DNGTCP2_INCLUDE_DIR=/ucrt64/include
-DNGTCP2_LIBRARY=/ucrt64/lib/libngtcp2.dll.a
-DNGTCP2_CRYPTO_OSSL_LIBRARY=/ucrt64/lib/libngtcp2_crypto_ossl.dll.a
+ -DCURL_CA_NATIVE=ON
- name: 'schannel U'
install-vcpkg: 'zlib libssh2[core,zlib]'
CMakeLists.txt+11 -3
@@ -1325,6 +1325,13 @@ endif()
#
# CA handling
#
+option(CURL_CA_NATIVE "Use native CA store" OFF)
+if(CURL_CA_NATIVE)
+ set(_curl_disable_ca_search_default ON)
+else()
+ set(_curl_disable_ca_search_default OFF)
+endif()
+
if(_curl_ca_bundle_supported)
set(_ca_opt_desc "Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
@@ -1347,7 +1354,7 @@ if(_curl_ca_bundle_supported)
unset(CURL_CA_BUNDLE CACHE)
elseif(CURL_CA_BUNDLE STREQUAL "auto")
unset(CURL_CA_BUNDLE CACHE)
- if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32 AND NOT USE_APPLE_SECTRUST)
+ if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32 AND NOT USE_APPLE_SECTRUST AND NOT CURL_CA_NATIVE)
set(_curl_ca_bundle_autodetect TRUE)
endif()
else()
@@ -1361,7 +1368,7 @@ if(_curl_ca_bundle_supported)
unset(CURL_CA_PATH CACHE)
elseif(CURL_CA_PATH STREQUAL "auto")
unset(CURL_CA_PATH CACHE)
- if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32 AND NOT USE_APPLE_SECTRUST)
+ if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32 AND NOT USE_APPLE_SECTRUST AND NOT CURL_CA_NATIVE)
set(_curl_ca_path_autodetect TRUE)
endif()
else()
@@ -1418,7 +1425,7 @@ if(_curl_ca_bundle_supported)
endif()
if(WIN32)
- option(CURL_DISABLE_CA_SEARCH "Disable unsafe CA bundle search in PATH on Windows" OFF)
+ option(CURL_DISABLE_CA_SEARCH "Disable unsafe CA bundle search in PATH on Windows" ${_curl_disable_ca_search_default})
option(CURL_CA_SEARCH_SAFE "Enable safe CA bundle search (within the curl tool directory) on Windows" OFF)
endif()
@@ -1998,6 +2005,7 @@ curl_add_if("PSL" USE_LIBPSL)
curl_add_if("CAcert" CURL_CA_EMBED_SET)
curl_add_if("SSLS-EXPORT" _ssl_enabled AND USE_SSLS_EXPORT)
curl_add_if("AppleSecTrust" USE_APPLE_SECTRUST AND _ssl_enabled AND (USE_OPENSSL OR USE_GNUTLS))
+curl_add_if("NativeCA" NOT USE_APPLE_SECTRUST AND _ssl_enabled AND CURL_CA_NATIVE)
if(_items)
if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.13)
list(SORT _items CASE INSENSITIVE)
acinclude.m4+2 -0
@@ -1151,6 +1151,8 @@ AS_HELP_STRING([--without-ca-path], [Do not use a default CA path]),
if test "$APPLE_SECTRUST_ENABLED" = "1"; then
ca_native="Apple SecTrust"
+ elif test "$ca_native_opt" = "1"; then
+ ca_native="yes"
else
ca_native="no"
fi
configure.ac+49 -6
@@ -2093,6 +2093,28 @@ elif test "$VALID_DEFAULT_SSL_BACKEND" = "yes"; then
AC_DEFINE_UNQUOTED([CURL_DEFAULT_SSL_BACKEND], ["$DEFAULT_SSL_BACKEND"], [Default SSL backend])
fi
+dnl ---------------------
+dnl check native CA store
+dnl ---------------------
+
+ca_native_opt=0
+AC_MSG_CHECKING([whether to use native CA store])
+AC_ARG_ENABLE(ca-native,
+AS_HELP_STRING([--enable-ca-native],[Enable native CA store])
+AS_HELP_STRING([--disable-ca-native],[Disable native CA store (default)]),
+[ case "$enableval" in
+ yes)
+ AC_MSG_RESULT([yes])
+ AC_DEFINE(CURL_CA_NATIVE, 1, [If native CA store is enabled])
+ ca_native_opt=1
+ ;;
+ *)
+ AC_MSG_RESULT([no])
+ ;;
+ esac ],
+ AC_MSG_RESULT([no])
+)
+
dnl **********************************************************************
dnl Check for the CA bundle
dnl **********************************************************************
@@ -2109,21 +2131,38 @@ dnl check unsafe CA search
dnl ----------------------
if test "$curl_cv_native_windows" = "yes"; then
+ ca_search=1
AC_MSG_CHECKING([whether to enable unsafe CA bundle search in PATH on Windows])
AC_ARG_ENABLE(ca-search,
-AS_HELP_STRING([--enable-ca-search],[Enable unsafe CA bundle search in PATH on Windows (default)])
+AS_HELP_STRING([--enable-ca-search],[Enable unsafe CA bundle search in PATH on Windows])
AS_HELP_STRING([--disable-ca-search],[Disable unsafe CA bundle search in PATH on Windows]),
[ case "$enableval" in
no)
AC_MSG_RESULT([no])
- AC_DEFINE(CURL_DISABLE_CA_SEARCH, 1, [If unsafe CA bundle search in PATH on Windows is disabled])
+ ca_search=0
;;
- *)
+ yes)
AC_MSG_RESULT([yes])
;;
+ *)
+ if test "$ca_native_opt" = "1"; then
+ AC_MSG_RESULT([no])
+ ca_search=0
+ else
+ AC_MSG_RESULT([yes])
+ fi
+ ;;
esac ],
- AC_MSG_RESULT([yes])
+ if test "$ca_native_opt" = "1"; then
+ AC_MSG_RESULT([no])
+ ca_search=0
+ else
+ AC_MSG_RESULT([yes])
+ fi
)
+ if test "$ca_search" = "0"; then
+ AC_DEFINE(CURL_DISABLE_CA_SEARCH, 1, [If unsafe CA bundle search in PATH on Windows is disabled])
+ fi
fi
dnl --------------------
@@ -5286,8 +5325,12 @@ if test "$OPENSSL_ENABLED" = "1" || test -n "$SSL_ENABLED"; then
fi
fi
-if test "$APPLE_SECTRUST_ENABLED" = "1"; then
- SUPPORT_FEATURES="$SUPPORT_FEATURES AppleSecTrust"
+if test -n "$SSL_ENABLED"; then
+ if test "$APPLE_SECTRUST_ENABLED" = "1"; then
+ SUPPORT_FEATURES="$SUPPORT_FEATURES AppleSecTrust"
+ elif test "$ca_native_opt" = "1"; then
+ SUPPORT_FEATURES="$SUPPORT_FEATURES NativeCA"
+ fi
fi
if test "$want_httpsrr" != "no"; then
docs/INSTALL-CMAKE.md+3 -1
@@ -260,6 +260,8 @@ target_link_libraries(my_target PRIVATE CURL::libcurl)
- `CURL_CA_BUNDLE`: Absolute path to the CA bundle. Set `none` to disable or `auto` for auto-detection. Default: `auto`
- `CURL_CA_EMBED`: Absolute path to the CA bundle to embed in the curl tool. Default: (disabled)
- `CURL_CA_FALLBACK`: Use built-in CA store of OpenSSL. Default: `OFF`
+- `CURL_CA_NATIVE`: Use native CA store. Default: `OFF`
+ Supported by GnuTLS, OpenSSL (including forks) on Windows, wolfSSL.
- `CURL_CA_PATH`: Absolute path to a directory containing CA certificates stored individually. Set `none` to disable or `auto` for auto-detection. Default: `auto`
- `CURL_CA_SEARCH_SAFE`: Enable safe CA bundle search (within the curl tool directory) on Windows. Default: `OFF`
@@ -283,7 +285,7 @@ target_link_libraries(my_target PRIVATE CURL::libcurl)
- `CURL_DISABLE_BASIC_AUTH`: Disable Basic authentication. Default: `OFF`
- `CURL_DISABLE_BEARER_AUTH`: Disable Bearer authentication. Default: `OFF`
- `CURL_DISABLE_BINDLOCAL`: Disable local binding support. Default: `OFF`
-- `CURL_DISABLE_CA_SEARCH`: Disable unsafe CA bundle search in PATH on Windows. Default: `OFF`
+- `CURL_DISABLE_CA_SEARCH`: Disable unsafe CA bundle search in PATH on Windows. Default: `OFF` (turns to `ON`, when `CURL_CA_NATIVE=ON`)
- `CURL_DISABLE_COOKIES`: Disable cookies support. Default: `OFF`
- `CURL_DISABLE_DICT`: Disable DICT. Default: `OFF`
- `CURL_DISABLE_DIGEST_AUTH`: Disable Digest authentication. Default: `OFF`
docs/libcurl/curl_version_info.md+7 -0
@@ -286,6 +286,13 @@ supports HTTP deflate using libz
libcurl was built with multiple SSL backends. For details, see
curl_global_sslset(3).
+## `NativeCA`
+
+*features* mask bit: non-existent
+
+libcurl was built to enable native CA store, to verify server certificates
+(Added in 8.19.0).
+
## `NTLM`
*features* mask bit: CURL_VERSION_NTLM
lib/curl_config-cmake.h.in+3 -0
@@ -34,6 +34,9 @@
/* Default SSL backend */
#cmakedefine CURL_DEFAULT_SSL_BACKEND "${CURL_DEFAULT_SSL_BACKEND}"
+/* Use native CA store */
+#cmakedefine CURL_CA_NATIVE 1
+
/* disables alt-svc */
#cmakedefine CURL_DISABLE_ALTSVC 1
lib/version.c+4 -0
@@ -513,9 +513,13 @@ static const struct feat features_table[] = {
#ifdef USE_LIBPSL
FEATURE("PSL", NULL, CURL_VERSION_PSL),
#endif
+#ifdef USE_SSL
#ifdef USE_APPLE_SECTRUST
FEATURE("AppleSecTrust", NULL, 0),
+#elif defined(CURL_CA_NATIVE)
+ FEATURE("NativeCA", NULL, 0),
#endif
+#endif /* USE_SSL */
#ifdef USE_SPNEGO
FEATURE("SPNEGO", NULL, CURL_VERSION_SPNEGO),
#endif
lib/vtls/vtls.c+2 -2
@@ -295,7 +295,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
#endif
if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
-#ifdef USE_APPLE_SECTRUST
+#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
sslc->native_ca_store = TRUE;
#endif
@@ -341,7 +341,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
#ifndef CURL_DISABLE_PROXY
sslc = &data->set.proxy_ssl;
if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
-#ifdef USE_APPLE_SECTRUST
+#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
sslc->native_ca_store = TRUE;
#endif