c37ed9a11e
Stefan Eissing
2025-10-16
Subject
apple sectrust: add to features
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
CMakeLists.txt +4 -0configure.ac +4 -0docs/libcurl/curl_version_info.md +7 -0lib/version.c +3 -0lib/vtls/apple.c +4 -4lib/vtls/apple.h +2 -2lib/vtls/vtls.c +1 -1m4/curl-apple-sectrust.m4 +5 -2
CMakeLists.txt+4 -0
| @@ -767,6 +767,9 @@ endif() | |
| if(APPLE) | |
| option(USE_APPLE_SECTRUST "Use Apple OS-native certificate verification" OFF) | |
| if(USE_APPLE_SECTRUST) | |
| + | if(NOT CURL_USE_OPENSSL AND NOT CURL_USE_GNUTLS) |
| + | message(FATAL_ERROR "Apple SecTrust is only supported with Openssl/GnuTLS") |
| + | endif() |
| find_library(COREFOUNDATION_FRAMEWORK NAMES "Security") | |
| mark_as_advanced(COREFOUNDATION_FRAMEWORK) | |
| if(NOT COREFOUNDATION_FRAMEWORK) | |
| @@ -2173,6 +2176,7 @@ curl_add_if("HTTPSRR" _ssl_enabled AND USE_HTTPSRR) | |
| curl_add_if("PSL" USE_LIBPSL) | |
| curl_add_if("CAcert" CURL_CA_EMBED_SET) | |
| curl_add_if("SSLS-EXPORT" _ssl_enabled AND USE_SSLS_EXPORT) | |
| + | curl_add_if("AppleSecTrust" USE_APPLE_SECTRUST AND _ssl_enabled AND (USE_OPENSSL OR USE_GNUTLS)) |
| if(_items) | |
| if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.13) | |
| list(SORT _items CASE INSENSITIVE) | |
configure.ac+4 -0
| @@ -5304,6 +5304,10 @@ if test "x$OPENSSL_ENABLED" = "x1" -o -n "$SSL_ENABLED"; then | |
| fi | |
| fi | |
| + | if test "x$APPLE_SECTRUST_ENABLED" = "x1"; then |
| + | SUPPORT_FEATURES="$SUPPORT_FEATURES AppleSecTrust" |
| + | fi |
| + | |
| if test "x$want_httpsrr" != "xno"; then | |
| SUPPORT_FEATURES="$SUPPORT_FEATURES HTTPSRR" | |
| fi | |
docs/libcurl/curl_version_info.md+7 -0
| @@ -159,6 +159,13 @@ entry. | |
| HTTP Alt-Svc parsing and the associated options (Added in 7.64.1) | |
| + | ## `AppleSecTrust` |
| + | |
| + | *features* mask bit: non-existent |
| + | |
| + | libcurl was built with support for Apple's SecTrust service to verify |
| + | server certificates (Added in 8.17.0). |
| + | |
| ## `AsynchDNS` | |
| *features* mask bit: CURL_VERSION_ASYNCHDNS | |
lib/version.c+3 -0
| @@ -523,6 +523,9 @@ static const struct feat features_table[] = { | |
| #ifdef USE_LIBPSL | |
| FEATURE("PSL", NULL, CURL_VERSION_PSL), | |
| #endif | |
| + | #ifdef USE_APPLE_SECTRUST |
| + | FEATURE("AppleSecTrust", NULL, 0), |
| + | #endif |
| #ifdef USE_SPNEGO | |
| FEATURE("SPNEGO", NULL, CURL_VERSION_SPNEGO), | |
| #endif | |
lib/vtls/apple.c+4 -4
| @@ -46,16 +46,16 @@ | |
| #include "vtls.h" | |
| #include "apple.h" | |
| - | #if defined(USE_SSL) && defined(USE_APPLE_SECTRUST) |
| + | #ifdef USE_APPLE_SECTRUST |
| #include <Security/Security.h> | |
| - | #endif /* USE_SSL && USE_APPLE_SECTRUST */ |
| + | #endif |
| /* The last #include files should be: */ | |
| #include "../curl_memory.h" | |
| #include "../memdebug.h" | |
| - | #if defined(USE_SSL) && defined(USE_APPLE_SECTRUST) |
| + | #ifdef USE_APPLE_SECTRUST |
| #define SSL_SYSTEM_VERIFIER | |
| #if (defined(MAC_OS_X_VERSION_MAX_ALLOWED) \ | |
| @@ -294,4 +294,4 @@ out: | |
| return result; | |
| } | |
| - | #endif /* USE_SSL && USE_APPLE_SECTRUST */ |
| + | #endif /* USE_APPLE_SECTRUST */ |
lib/vtls/apple.h+2 -2
| @@ -26,7 +26,7 @@ | |
| #include "../curl_setup.h" | |
| - | #if defined(USE_SSL) && defined(USE_APPLE_SECTRUST) |
| + | #ifdef USE_APPLE_SECTRUST |
| struct Curl_cfilter; | |
| struct Curl_easy; | |
| struct ssl_peer; | |
| @@ -50,6 +50,6 @@ CURLcode Curl_vtls_apple_verify(struct Curl_cfilter *cf, | |
| void *cb_user_data, | |
| const unsigned char *ocsp_buf, | |
| size_t ocsp_len); | |
| - | #endif /* USE_SSL && USE_APPLE_SECTRUST */ |
| + | #endif /* USE_APPLE_SECTRUST */ |
| #endif /* HEADER_CURL_VTLS_APPLE_H */ | |
lib/vtls/vtls.c+1 -1
| @@ -80,7 +80,7 @@ | |
| #ifdef USE_APPLE_SECTRUST | |
| #include <Security/Security.h> | |
| - | #endif /* USE_APPLE_SECTRUST */ |
| + | #endif |
| /* The last #include files should be: */ | |
| #include "../curl_memory.h" | |
m4/curl-apple-sectrust.m4+5 -2
| @@ -41,7 +41,10 @@ if test "x$OPT_APPLE_SECTRUST" = xyes; then | |
| ],[ | |
| build_for_apple="no" | |
| ]) | |
| - | if test "x$build_for_apple" != "xno"; then |
| + | if test "x$build_for_apple" == "xno"; then |
| + | AC_MSG_ERROR([Apple SecTrust can only be enabled for Apple OS targets]) |
| + | fi |
| + | if test "x$OPENSSL_ENABLED" == "x1" -o "x$GNUTLS_ENABLED" == "x1"; then |
| AC_MSG_RESULT(yes) | |
| AC_DEFINE(USE_APPLE_SECTRUST, 1, [enable Apple OS certificate validation]) | |
| APPLE_SECTRUST_ENABLED=1 | |
| @@ -49,7 +52,7 @@ if test "x$OPT_APPLE_SECTRUST" = xyes; then | |
| LDFLAGS="$LDFLAGS $APPLE_SECTRUST_LDFLAGS" | |
| LDFLAGSPC="$LDFLAGSPC $APPLE_SECTRUST_LDFLAGS" | |
| else | |
| - | AC_MSG_RESULT(no) |
| + | AC_MSG_ERROR([Apple SecTrust is only supported for OpenSSL/GnuTLS builds]) |
| fi | |
| else | |
| AC_MSG_RESULT(no) | |