-
Notifications
You must be signed in to change notification settings - Fork 209
/
Copy path_build.sh
executable file
·1851 lines (1678 loc) · 70.9 KB
/
_build.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/env bash
# Copyright (C) Viktor Szakats. See LICENSE.md
# SPDX-License-Identifier: MIT
# shellcheck disable=SC3040,SC2039
set -o xtrace -o errexit -o nounset; [ -n "${BASH:-}${ZSH_NAME:-}" ] && set -o pipefail
# Build configuration environment variables:
#
# CW_BLD
# List of components to build. E.g. 'curl' or 'zlib libssh2 curl' or 'none'.
# Optional. Default: (all)
#
# CW_GET
# List of components to (re-)download. E.g. 'zlib curl' or 'none'.
# Optional. Default: (all)
#
# CW_NOGET
# List of components to never download. E.g. 'curl'.
# Optional. Default: (none)
#
# CW_LLVM_MINGW_PATH
# Point to LLVM MinGW installation (for win target).
#
# CW_LLVM_MINGW_ONLY
# Use llvm-mingw for all Windows builds. Default: 0
#
# CW_CONFIG
# Build configuration. Certain keywords select certain configurations. E.g.: 'main-micro'.
# Optional. Default: 'main' (inherited from the active repo branch name)
#
# Supported keywords:
# main production build
# test test build (.map files enabled by default, publishing disabled)
# dev development build (use source snapshots instead of stable releases)
# noh3 build without HTTP/3 (QUIC) support
# nobrotli build without brotli
# nozstd build without zstd
# nozlib build without zlib
# zlibng build with zlib-ng instead of zlib
# noftp build without FTP/FTPS support
# nohttp build without HTTP and proxy support
# nocookie build without cookie support
# imap build with IMAP protocol (for zero, bldtst or pico build)
# awslc build with AWS-LC [EXPERIMENTAL]
# boringssl build with BoringSSL [EXPERIMENTAL]
# libressl build with LibreSSL
# quictls build with quictls
# openssl build with OpenSSL
# ostls build with OS-supplied TLS backend-only (Schannel or SecureTransport)
# osnotls build without OS-supplied TLS backends
# libssh1 build with libssh
# libssh2 build with libssh2
# mini build with less features, see README.md
# micro build with less features, see README.md
# nano build with less features, see README.md
# pico build with less features, see README.md
# bldtst build without 3rd-party dependencies (except zlib) (for testing)
# zero build without 3rd-party dependencies (for testing, implies 'small' option)
# trurl build trurl (default for 'dev' and 'test' configs)
# thinlto build with ThinLTO enabled (requires llvm) [EXPERIMENTAL]
# small optimize for size
# r64 build riscv64 target only [EXPERIMENTAL]
# a64 build arm64 target only
# x64 build x86_64 target only
# x86 build i686 target only (for win target)
# nounity build without CMake UNITY mode (slower builds for slightly smaller binaries)
# nocurltool do not build the curl tool (requires cmake)
# curldocs include curl Markdown manual pages in the package
# msvcrt build against msvcrt instead of UCRT (for win target)
# gcc build with GCC (including Apple clang aliased to gcc) (defaults to llvm, and "gcc" (= Apple clang) for mac target)
# unicode build curl in UNICODE mode (for win target) [EXPERIMENTAL]
# osnoidn build curl without OS-supplied IDN support
# werror turn compiler warnings into errors
# nodumpconf do not dump curl_config.h
# debug debug build
# curltests build curl tests
# win build Windows target (default)
# mac build macOS target (requires macOS host)
# linux build Linux target (requires Linux host)
# musl build Linux target with musl CRT (for linux target) (default for Alpine)
# macuni build macOS universal (arm64 + x86_64) package (for mac target)
#
# CW_JOBS
# Number of parallel make jobs. Default: 2
#
# CW_CCSUFFIX
# llvm/clang and gcc suffix. E.g. '-8' for clang-8.
# Optional. Default: (empty)
#
# CW_REVISION
# Override the stable build revision number.
#
# CW_MAP
# Build or not .map files. Default: 0 for release config
#
# CW_NOTIME
# Do not measure built times. Default: 0
#
# CW_NOPKG
# Skip packaging steps.
#
# CW_PKG_NODELETE
# Leave the unified package tree on the disk. Default: 0
#
# CW_PKG_FLATTEN
# Flatten unified package dir layout for executables. Default: 0
#
# SIGN_CODE_GPG_PASS, SIGN_CODE_KEY_PASS: for code signing
# SIGN_PKG_KEY_ID, SIGN_PKG_GPG_PASS, SIGN_PKG_KEY_PASS: for package signing
# DEPLOY_GPG_PASS, DEPLOY_KEY_PASS: for publishing results
# Secrets used for the above operations.
# Optional. Skipping any operation missing a secret.
# TODO:
# - consider replacing `CURL_CA_SEARCH_SAFE=ON` with `CURL_DISABLE_CA_SEARCH=ON`
# on Windows.
# - switch to git tags / auto-generated tarballs.
# How to verify integrity / signature? Also, Git hash is still SHA1.
# Some Git servers do not provide stable tarballs, e.g. googlesource.com.
# A stable reference release date can be difficult to obtain when using
# a dynamically/automatically generated source tarball, depending on server.
# GitHub offers a stable timestamp, but not e.g. googlesource.com.
# Tags/versions need to be resolved to hashes securely and permanently.
# - add FreeBSD builds?
# - linux: musl alpine why need -static-pie and not -static?
# - linux: musl libcurl.so.4.8.0 tweak to be also portable (possible?)
# fix apps linked against musl libcurl.so. Or stop making/distributing it?
# they require '/lib/ld-musl-x86_64.so.1' / '/lib/ld-musl-aarch64.so.1' now.
# meaning e.g.: `apt install musl; LD_LIBRARY_PATH=. ./trurl`
# - merge _ci-*.sh scripts into one.
# - win: Drop x86 builds.
# https://data.firefox.com/dashboard/hardware#operating-system-metric-overview-2
# A hidden aspect of x86: The Chocolatey package manager installs x86
# binaries on ARM systems to run them in emulated mode. Windows as of ~2021
# got the ability to run x64 in emulated mode, but tooling support is
# missing, just like support for native ARM binaries:
# https://github.com/chocolatey/choco/issues/1803
# https://github.com/chocolatey/choco/issues/2172
# winget and scoop both support native ARM64.
# Distros:
# - https://github.com/chocolatey-community/chocolatey-packages/tree/master/automatic/curl
# - https://github.com/ScoopInstaller/Main/blob/master/bucket/curl.json
# - https://github.com/microsoft/winget-pkgs/tree/master/manifests/c/cURL/cURL
# Resources:
# - https://clang.llvm.org/docs/Toolchain.html
# - https://blog.llvm.org/2019/11/deterministic-builds-with-clang-and-lld.html
# - https://github.com/mstorsjo/llvm-mingw
# - https://github.com/llvm/llvm-project
# - https://salsa.debian.org/pkg-llvm-team
# - https://git.code.sf.net/p/mingw-w64/mingw-w64
# https://github.com/mirror/mingw-w64
# - https://sourceware.org/git/binutils-gdb.git
# - https://github.com/netwide-assembler/nasm
# Manuals:
# - https://www.man7.org/linux/man-pages/man1/as.1.html
# - https://sourceware.org/binutils/docs/as.html
# - https://sourceware.org/binutils/docs-2.41/as.html
#
# - https://www.man7.org/linux/man-pages/man1/gcc.1.html
# - https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
# - https://gcc.gnu.org/onlinedocs/gcc-13.2.0/gcc/Optimize-Options.html#index-fsemantic-interposition
#
# - https://www.man7.org/linux/man-pages/man1/ld.1.html
# - https://sourceware.org/binutils/docs/ld.html
# - https://sourceware.org/binutils/docs-2.41/ld.html
# - https://man.archlinux.org/man/extra/lld/ld.lld.1.en
#
# - https://rui314.github.io/mold.html
# Build times for Windows with quictls (2023-10-25):
# - cmake-unity: 27 min 22 sec 1642s 100%
# - gnumake: 29 min 11 sec 1751s 107% 100%
# Supported build tools:
#
# zlib cmake
# zlibng cmake
# zstd cmake
# brotli cmake
# cares cmake
# libpsl manual
# nghttp2 cmake
# nghttp3 cmake
# ngtcp2 cmake
# openssl/quictls proprietary
# boringssl/awslc cmake
# libressl cmake
# libssh cmake
# libssh2 cmake-unity
# curl cmake-unity
# trurl gnumake
# osslsigncode cmake
cd "$(dirname "$0")"
export LC_ALL=C
export LC_MESSAGES=C
export LANG=C
export GREP_OPTIONS=
export ZIPOPT=
export ZIP=
unamem="$(uname -m)"
# for macOS ARM64 hosts
if [ "${unamem}" = 'arm64' ]; then
unamem='aarch64'
fi
readonly _LOG='logurl.txt'
readonly _SELF='curl-for-win'
if [ -n "${APPVEYOR_ACCOUNT_NAME:-}" ]; then
# https://www.appveyor.com/docs/environment-variables/
_SLUG="${APPVEYOR_REPO_NAME}"
_LOGURL="${APPVEYOR_URL}/project/${APPVEYOR_ACCOUNT_NAME}/${APPVEYOR_PROJECT_SLUG}/build/${APPVEYOR_BUILD_VERSION}/job/${APPVEYOR_JOB_ID}?fullLog=true"
# _LOGURL="${APPVEYOR_URL}/api/buildjobs/${APPVEYOR_JOB_ID}/log"
_COMMIT="${APPVEYOR_REPO_COMMIT}"
_COMMIT_SHORT="$(printf '%.8s' "${_COMMIT}")"
elif [ -n "${GITHUB_RUN_ID:-}" ]; then
# https://docs.github.com/actions/learn-github-actions/environment-variables
_SLUG="${GITHUB_REPOSITORY}"
_LOGURL="${GITHUB_SERVER_URL}/${_SLUG}/actions/runs/${GITHUB_RUN_ID}"
_COMMIT="${GITHUB_SHA}"
_COMMIT_SHORT="$(printf '%.8s' "${_COMMIT}")"
elif [ -n "${CI_JOB_ID:-}" ]; then
# https://docs.gitlab.com/ce/ci/variables/index.html
_SLUG="${CI_PROJECT_PATH}"
_LOGURL="${CI_SERVER_URL}/${_SLUG}/-/jobs/${CI_JOB_ID}/raw"
_COMMIT="${CI_COMMIT_SHA}"
_COMMIT_SHORT="$(printf '%.8s' "${_COMMIT}")"
else
_SLUG="curl/${_SELF}"
_LOGURL=''
_COMMIT="$(git rev-parse --verify HEAD || true)"
_COMMIT_SHORT="$(git rev-parse --short=8 HEAD || true)"
fi
echo "${_LOGURL}" | tee "${_LOG}"
export _CONFIG
if [ -n "${CW_CONFIG:-}" ]; then
_CONFIG="${CW_CONFIG}"
else
_CONFIG="${APPVEYOR_REPO_BRANCH:-}${CI_COMMIT_REF_NAME:-}${GITHUB_REF_NAME:-}"
fi
[ -n "${_CONFIG}" ] || _CONFIG="$(git symbolic-ref --short --quiet HEAD || true)"
[ -n "${_CONFIG}" ] || _CONFIG='main'
if command -v git >/dev/null 2>&1; then
# Broken on AppVeyor CI since around 2023-02:
# fatal: No remote configured to list refs from.
_URL_BASE="$(git ls-remote --get-url | sed 's/\.git$//' || true)"
fi
if [ -z "${_URL_BASE}" ]; then
_URL_BASE="https://github.com/${_SLUG}"
fi
if [ -n "${_COMMIT}" ]; then
# _URL_FULL="${_URL_BASE}/tree/${_COMMIT}"
_TAR="${_URL_BASE}/archive/${_COMMIT}.tar.gz"
else
# _URL_FULL="${_URL_BASE}"
_TAR="${_URL_BASE}/archive/refs/heads/${_CONFIG}.tar.gz"
fi
# Detect host OS
export _HOST
case "$(uname)" in
*_NT*) _HOST='win';;
Linux*) _HOST='linux';;
Darwin*) _HOST='mac';;
*BSD) _HOST='bsd';;
*) _HOST='unrecognized';;
esac
export _DISTRO=''
if [ "${_HOST}" = 'linux' ] && [ -s /etc/os-release ]; then
_DISTRO="$(grep -a '^ID=' /etc/os-release | cut -c 4- | tr -d '"' || true)"
_DISTRO="${_DISTRO:-unrecognized}"
fi
export _OS='win'
[[ "${_CONFIG}" = *'mac'* ]] && _OS='mac'
[[ "${_CONFIG}" = *'linux'* ]] && _OS='linux'
export _CACERT='cacert.pem'
[ -n "${CW_CCSUFFIX:-}" ] || CW_CCSUFFIX=''
if [ "${_OS}" = 'mac' ]; then
_CONFCC='gcc' # = Apple clang
else
_CONFCC='llvm'
fi
[[ "${_CONFIG}" = *'gcc'* ]] && _CONFCC='gcc'
[[ "${_CONFIG}" = *'llvm'* ]] && _CONFCC='llvm'
export _CRT
if [ "${_OS}" = 'win' ]; then
_CRT='ucrt'
[[ "${_CONFIG}" = *'msvcrt'* ]] && _CRT='msvcrt'
elif [ "${_OS}" = 'linux' ]; then
if [ "${_HOST}" = 'mac' ]; then
# Assume musl-cross toolchain via Homebrew, based on musl-cross-make
# https://github.com/richfelker/musl-cross-make
# https://github.com/FiloSottile/homebrew-musl-cross
# https://words.filippo.io/easy-windows-and-linux-cross-compilers-for-macos/
_CONFCC='gcc'
_CRT='musl'
elif [ "${_DISTRO}" = 'alpine' ]; then
_CRT='musl'
else
# TODO: make musl the default (once all issues are cleared)
_CRT='gnu'
[[ "${_CONFIG}" = *'musl'* ]] && _CRT='musl'
fi
else
# macOS: /usr/lib/libSystem.B.dylib
_CRT='sys'
fi
export DYN_DIR
export DYN_EXT
export BIN_EXT
if [ "${_OS}" = 'win' ]; then
DYN_DIR='bin'
DYN_EXT='.dll'
BIN_EXT='.exe'
elif [ "${_OS}" = 'mac' ]; then
DYN_DIR='lib'
DYN_EXT='.dylib'
BIN_EXT=''
elif [ "${_OS}" = 'linux' ]; then
DYN_DIR='lib'
DYN_EXT='.so'
BIN_EXT=''
fi
if [ -z "${CW_MAP:-}" ]; then
export CW_MAP='0'
[[ "${_CONFIG}" != *'main'* ]] && CW_MAP='1'
fi
export _JOBS=2
[ -n "${CW_JOBS:-}" ] && _JOBS="${CW_JOBS}"
my_time='time'
[ -n "${CW_NOTIME:-}" ] && my_time=
# Form suffix for alternate builds
export _FLAV=''
if [[ "${_CONFIG}" = *'zero'* ]]; then
_FLAV='-zero'
elif [[ "${_CONFIG}" = *'bldtst'* ]]; then
_FLAV='-bldtst'
elif [[ "${_CONFIG}" = *'pico'* ]]; then
_FLAV='-pico'
elif [[ "${_CONFIG}" = *'nano'* ]]; then
_FLAV='-nano'
elif [[ "${_CONFIG}" = *'micro'* ]]; then
_FLAV='-micro'
elif [[ "${_CONFIG}" = *'mini'* ]]; then
_FLAV='-mini'
elif [[ "${_CONFIG}" = *'noh3'* ]]; then
_FLAV='-noh3'
fi
# Required for an ugly OpenSSL hack.
# https://clang.llvm.org/docs/CrossCompilation.html
case "${_HOST}" in
win) _HOST_TRIPLET="${unamem}-pc-mingw32";;
linux) _HOST_TRIPLET="${unamem}-pc-linux";;
bsd) _HOST_TRIPLET="${unamem}-pc-bsd";;
mac) _HOST_TRIPLET="${unamem}-apple-darwin";;
*) _HOST_TRIPLET="${unamem}-pc-$(uname -s | tr '[:upper:]' '[:lower:]')";; # lazy guess
esac
if [ "${_HOST}" = 'linux' ]; then
# Short triplet used on the filesystem
_HOST_TRIPLETSH="${unamem}-linux-gnu"
else
_HOST_TRIPLETSH="${_HOST_TRIPLET}"
fi
export _PKGOS
if [ "${_OS}" = 'win' ]; then
_PKGOS='mingw'
elif [ "${_OS}" = 'mac' ]; then
_PKGOS='macos'
else
_PKGOS="${_OS}"
fi
export PUBLISH_PROD_FROM
if [ "${APPVEYOR_REPO_PROVIDER:-}" = 'gitHub' ] || \
[ -n "${GITHUB_RUN_ID:-}" ]; then
PUBLISH_PROD_FROM='linux'
else
PUBLISH_PROD_FROM=''
fi
export _BLD='build.txt'
export _URLS='urls.txt'
rm -f ./*-*-"${_PKGOS}"*.*
rm -f hashes.txt "${_BLD}" "${_URLS}"
touch hashes.txt "${_BLD}" "${_URLS}"
. ./_versions.sh
# Revision suffix used in package filenames
export _REVSUFFIX="${_REV}"; [ -z "${_REVSUFFIX}" ] || _REVSUFFIX="_${_REVSUFFIX}"
# Download sources
. ./_dl.sh
# Install required component
if [ "${_OS}" = 'win' ] && [ "${_HOST}" = 'mac' ]; then
if [ ! -d .venv ]; then
python3 -m venv .venv
PIP_PROGRESS_BAR=off .venv/bin/python3 -m pip --disable-pip-version-check --no-cache-dir --require-virtualenv install pefile
fi
export PATH; PATH="$(pwd)/.venv/bin:${PATH}"
fi
# Find and setup llvm-mingw downloaded above.
if [ "${_OS}" = 'win' ] && \
[ -z "${CW_LLVM_MINGW_PATH:-}" ] && \
[ -d 'llvm-mingw' ]; then
export CW_LLVM_MINGW_PATH; CW_LLVM_MINGW_PATH="$(pwd)/llvm-mingw"
export CW_LLVM_MINGW_VER_; CW_LLVM_MINGW_VER_="$(cat 'llvm-mingw/version.txt')"
echo "! Using llvm-mingw: '${CW_LLVM_MINGW_PATH}' (${CW_LLVM_MINGW_VER_})"
fi
# Decrypt package signing key
SIGN_PKG_KEY='sign-pkg.gpg.asc'
if [ -s "${SIGN_PKG_KEY}" ] && \
[ -n "${SIGN_PKG_KEY_ID:-}" ] && \
[ -n "${SIGN_PKG_GPG_PASS:+1}" ]; then
gpg --batch --yes --no-tty --quiet \
--pinentry-mode loopback --passphrase-fd 0 \
--decrypt "${SIGN_PKG_KEY}" 2>/dev/null <<EOF | \
gpg --batch --quiet --import
${SIGN_PKG_GPG_PASS}
EOF
fi
# decrypt code signing key
export SIGN_CODE_KEY; SIGN_CODE_KEY="$(pwd)/sign-code.p12"
if [ -s "${SIGN_CODE_KEY}.asc" ] && \
[ -n "${SIGN_CODE_GPG_PASS:+1}" ]; then
install -m 600 /dev/null "${SIGN_CODE_KEY}"
gpg --batch --yes --no-tty --quiet \
--pinentry-mode loopback --passphrase-fd 0 \
--decrypt "${SIGN_CODE_KEY}.asc" 2>/dev/null >> "${SIGN_CODE_KEY}" <<EOF || true
${SIGN_CODE_GPG_PASS}
EOF
fi
if [ "${_OS}" = 'win' ] && \
[ -s "${SIGN_CODE_KEY}" ]; then
if command -v osslsigncode >/dev/null 2>&1; then
export _OSSLSIGNCODE=osslsigncode
"${_OSSLSIGNCODE}" --version # We need 2.2 or newer
elif [ -x "$(pwd)/osslsigncode-local" ]; then
export _OSSLSIGNCODE; _OSSLSIGNCODE="$(pwd)/osslsigncode-local"
"${_OSSLSIGNCODE}" --version
elif [ -n "${SIGN_PKG_KEY_PASS:+1}" ]; then
unset SIGN_CODE_KEY_PASS
echo "! WARNING: osslsigncode not found, code signing disabled."
fi
fi
_ori_path="${PATH}"
bld() {
bldtools='(cmake|gnumake)'
pkg="$1"
if [ -z "${CW_BLD:-}" ] || echo " ${CW_BLD} " | grep -q -E -- " ${pkg}(-${bldtools})? "; then
shift
export _BLDDIR="${_PKGDIR}"
pkgori="${pkg}"
[ -n "${2:-}" ] && pkg="$2"
# allow selecting an alternate build tool
withbuildtool="$(echo "${CW_BLD:-}" | \
grep -a -o -E -- "${pkg}-${bldtools}" || true)"
if [ -n "${withbuildtool}" ] && [ -f "${withbuildtool}.sh" ]; then
pkg="${withbuildtool}"
bldtool="$(echo "${pkg}" | \
grep -a -o -E -- "-${bldtools}")"
_BLDDIR+="${bldtool}-${_CC}"
fi
_BLDDIR+='-bld'
${my_time} "./${pkg}.sh" "$1" "${pkgori}"
if [ "${CW_DEV_MOVEAWAY:-}" = '1' ] && [ "${pkg}" != "${pkgori}" ]; then
mv -n "${pkgori}" "${pkg}"
fi
fi
}
build_single_target() {
export _CPU="$1"
export _CC="${_CONFCC}"
# Select and advertise a single copy of components having multiple
# implementations.
export _ZLIB=''
if [[ "${_DEPS}" = *'zlibng'* ]]; then
_ZLIB='zlibng'
elif [[ "${_DEPS}" = *'zlibold'* ]]; then
_ZLIB='zlib'
fi
[ -d "${_ZLIB}" ] || _ZLIB=''
export _OPENSSL=''; boringssl=0
if [[ "${_DEPS}" = *'libressl'* ]]; then
_OPENSSL='libressl'
elif [[ "${_DEPS}" = *'awslc'* ]]; then
_OPENSSL='awslc'; boringssl=1
elif [[ "${_DEPS}" = *'boringssl'* ]]; then
_OPENSSL='boringssl'; boringssl=1
elif [[ "${_DEPS}" = *'quictls'* ]]; then
_OPENSSL='quictls'
elif [[ "${_DEPS}" = *'openssl'* ]]; then
_OPENSSL='openssl'
fi
[ -d "${_OPENSSL}" ] || _OPENSSL=''
use_llvm_mingw=0
versuffix_llvm_mingw=''
versuffix_non_llvm_mingw=''
if [ "${_OS}" = 'win' ]; then
if [ "${CW_LLVM_MINGW_ONLY:-}" = '1' ]; then
use_llvm_mingw=1
elif [ "${_CPU}" = 'a64' ]; then
use_llvm_mingw=1
versuffix_llvm_mingw=' (ARM64)'
fi
fi
# Toolchain
export _TOOLCHAIN=''
if [ "${_OS}" = 'win' ]; then
if [ "${use_llvm_mingw}" = '1' ]; then
if [ "${_CC}" != 'llvm' ] || \
[ "${_CRT}" != 'ucrt' ] || \
[ -z "${CW_LLVM_MINGW_PATH:-}" ]; then
echo "! WARNING: '${_CONFIG}/${_CPU}' builds require llvm/clang, UCRT and CW_LLVM_MINGW_PATH. Skipping."
return
fi
_TOOLCHAIN='llvm-mingw'
else
_TOOLCHAIN='mingw-w64'
fi
elif [ "${_OS}" = 'mac' ] && [ "${_CC}" = 'gcc' ]; then
if "${_CC}${CW_CCSUFFIX}" --version | grep -q -a -E '(Apple clang|Apple LLVM|based on LLVM)'; then
_CC='llvm'
_TOOLCHAIN='llvm-apple' # Apple clang
fi
fi
export _TRIPLET=''
_SYSROOT=''
_CCPREFIX=
_CCSUFFIX=
export _MAKE='make'
export MAKEFLAGS="-j${_JOBS}"
export _RUN_BIN=''
if [ "${_TOOLCHAIN}" != 'llvm-mingw' ]; then
_CCSUFFIX="${CW_CCSUFFIX}"
fi
# GCC-specific machine selection option
[ "${_CPU}" = 'x86' ] && _OPTM='-m32'
[ "${_CPU}" = 'x64' ] && _OPTM='-m64'
[ "${_CPU}" = 'a64' ] && _OPTM='-marm64pe'
[ "${_CPU}" = 'x86' ] && _machine='i686'
[ "${_CPU}" = 'x64' ] && _machine='x86_64'
[ "${_CPU}" = 'a64' ] && _machine='aarch64'
[ "${_CPU}" = 'r64' ] && _machine='riscv64'
export _CPUPUB="${_machine}"
if [ "${_OS}" = 'mac' ] && [ "${_machine}" = 'aarch64' ] && [ "${_CC}" = 'llvm' ]; then
# llvm-apple supports multiple archs separated by ';', e.g. 'arm64e;x86_64'
# It also understands arm64e (vs arm64)
# Revert to arm64, because documents suggests that arm64e is not supported
# by macOS by default (for user apps) and enabling it is an involved process
# (as of macOS Ventura):
# https://github.com/lelegard/arm-cpusysregs/blob/6316fb608c8e4cd817d72485a57abbffd3d811b4/docs/arm64e-on-macos.md#enabling-arm64e-on-macos-13-ventura
_machines='arm64'
# _machines='arm64e'
else
_machines="${_machine}"
fi
export _CURL_DLL_SUFFIX=''
export _CURL_DLL_SUFFIX_NODASH=''
if [ "${_OS}" = 'win' ]; then
[ "${_CPU}" = 'x64' ] && _CURL_DLL_SUFFIX_NODASH="${_CPU}"
[ "${_CPU}" = 'a64' ] && _CURL_DLL_SUFFIX_NODASH='arm64'
[ -n "${_CURL_DLL_SUFFIX_NODASH}" ] && _CURL_DLL_SUFFIX="-${_CURL_DLL_SUFFIX_NODASH}"
fi
if [ "${_OS}" = 'win' ]; then
[ "${_CPU}" = 'x86' ] && pkgcpu='win32'
[ "${_CPU}" = 'x64' ] && pkgcpu='win64'
[ "${_CPU}" = 'a64' ] && pkgcpu='win64a'
else
# TODO: add support for macOS universal (multi-CPU) builds?
pkgcpu="${_machine}"
fi
export _PKGSUFFIX="-${pkgcpu}-${_PKGOS}"
# Reset for each target
PATH="${_ori_path}"
if [ "${_HOST}" = 'mac' ]; then
brew_root="$(brew --prefix)"
_MAC_LLVM_PATH="${brew_root}/opt/llvm/bin" # or "$(brew --prefix llvm)/bin"
fi
if [ "${_OS}" = 'win' ]; then
if [ "${_HOST}" = 'win' ]; then
export PATH
if [ "${_TOOLCHAIN}" = 'llvm-mingw' ]; then
PATH="${CW_LLVM_MINGW_PATH}/bin:${_ori_path}"
else
[ "${_CPU}" = 'x86' ] && _MSYSROOT='/mingw32'
[ "${_CPU}" = 'x64' ] && _MSYSROOT='/mingw64'
[ "${_CPU}" = 'a64' ] && _MSYSROOT='/clangarm64'
[ -n "${_MSYSROOT}" ] && PATH="${_MSYSROOT}/bin:${_ori_path}"
fi
_MAKE='mingw32-make'
_RUN_BIN='true'
# Skip ARM64 target on 64-bit Intel, run all targets on ARM64:
if [ "${unamem}" = 'x86_64' ] && \
[ "${_CPU}" != 'a64' ]; then
_RUN_BIN=
elif [ "${unamem}" = 'aarch64' ]; then
_RUN_BIN=
fi
else
if [ "${_TOOLCHAIN}" = 'llvm-mingw' ]; then
export PATH="${CW_LLVM_MINGW_PATH}/bin:${_ori_path}"
elif [ "${_CC}" = 'llvm' ] && [ "${_HOST}" = 'mac' ]; then
export PATH="${_MAC_LLVM_PATH}:${_ori_path}"
fi
_TRIPLET="${_machine}-w64-mingw32"
# Prefixes do not work with MSYS2/mingw-w64, because `ar`, `nm` and
# `ranlib` are missing from them. They are accessible either _without_
# one, or as prefix + `gcc-ar`, `gcc-nm`, `gcc-runlib`.
_CCPREFIX="${_TRIPLET}-"
# mingw-w64 sysroots
if [ "${_TOOLCHAIN}" != 'llvm-mingw' ]; then
if [ "${_HOST}" = 'mac' ]; then
_SYSROOT="${brew_root}/opt/mingw-w64/toolchain-${_machine}"
elif [ "${_HOST}" = 'linux' ]; then
_SYSROOT="/usr/${_TRIPLET}"
fi
fi
_RUN_BIN='true'
if [ "${_HOST}" = 'linux' ] || \
[ "${_HOST}" = 'bsd' ]; then
# Run x64 targets on same CPU:
if [ "${_CPU}" = 'x64' ] && \
[ "${unamem}" = 'x86_64' ]; then
if command -v wine64 >/dev/null 2>&1; then
_RUN_BIN='wine64'
elif command -v wine >/dev/null 2>&1; then
_RUN_BIN='wine'
fi
fi
elif [ "${_HOST}" = 'mac' ]; then
# Run x64 targets on Intel and ARM (requires Wine 6.0.1):
if [ "${_CPU}" = 'x64' ]; then
if command -v wine64 >/dev/null 2>&1; then
_RUN_BIN='wine64'
elif command -v wine >/dev/null 2>&1; then
_RUN_BIN='wine'
fi
fi
fi
fi
else
if [ "${_CC}" = 'llvm' ] && [ "${_TOOLCHAIN}" != 'llvm-apple' ] && [ "${_HOST}" = 'mac' ]; then
export PATH="${_MAC_LLVM_PATH}:${_ori_path}"
fi
if [ "${_OS}" = 'linux' ]; then
# Include CRT type in Linux triplets, to make it visible in
# the curl version banner.
if [ "${_HOST}" = 'mac' ]; then
_TRIPLET="${_machine}-linux-musl"
_TRIPLETSH="${_TRIPLET}"
_CCPREFIX="${_TRIPLET}-"
elif [ "${_DISTRO}" = 'alpine' ]; then
# E.g. x86_64-alpine-linux-musl
_TRIPLET="${_machine}-${_DISTRO}-linux-${_CRT}"
_TRIPLETSH="${_TRIPLET}"
else
if [ "${_CRT}" = 'musl' ]; then
# E.g. x86_64-unknown-linux-musl
_TRIPLET="${_machine}-unknown-linux-${_CRT}"
else
_TRIPLET="${_machine}-pc-linux-${_CRT}"
fi
# Short triplet used on the filesystem
_TRIPLETSH="${_machine}-linux-gnu"
fi
if [ "${_DISTRO}" = 'debian' ] && \
[ "${_CC}" = 'gcc' ] && \
[ "${unamem}" != "${_machine}" ] && \
[ ! -d "/usr/lib/gcc-cross/${_TRIPLETSH}" ]; then
echo "! WARNING: '${_CONFIG}/${_CPU}' build requires gcc-cross package. Skipping."
return
fi
if [ "${unamem}" != "${_machine}" ] && [ "${_CC}" = 'gcc' ]; then
# https://packages.debian.org/testing/arm64/gcc-x86-64-linux-gnu/filelist
# https://packages.debian.org/testing/arm64/binutils-x86-64-linux-gnu/filelist
# /usr/bin/x86_64-linux-gnu-gcc
# https://packages.debian.org/testing/amd64/gcc-aarch64-linux-gnu/filelist
# https://packages.debian.org/testing/amd64/binutils-aarch64-linux-gnu/filelist
# /usr/bin/aarch64-linux-gnu-gcc
_CCPREFIX="${_TRIPLETSH}-"
fi
_RUN_BIN='true'
if [ "${_HOST}" = 'linux' ] && [ "${_OS}" = 'linux' ]; then
# Skip running non-native builds
if [ "${unamem}" = "${_machine}" ]; then
_RUN_BIN=''
elif [ "${_DISTRO}" = 'debian' ]; then
_RUN_BIN="qemu-${_machine}-static"
fi
fi
elif [ "${_OS}" = 'mac' ]; then
_TRIPLET="${_machine}-apple-darwin"
_RUN_BIN='true'
if [ "${_HOST}" = 'mac' ]; then
# Skip running arm64 on x86_64
if [ "${_CPU}" = 'x64' ] || \
[ "${unamem}" = 'aarch64' ]; then
_RUN_BIN=''
fi
fi
fi
fi
if [ "${_CC}" = 'llvm' ]; then
ccver="$("clang${_CCSUFFIX}" -dumpversion)"
else
ccver="$("${_CCPREFIX}gcc${_CCSUFFIX}" -dumpversion)"
if [ "${_CRT}" = 'ucrt' ]; then
# Create specs files that overrides msvcrt with ucrt. We need this
# for gcc when building against UCRT.
# https://stackoverflow.com/questions/57528555/how-do-i-build-against-the-ucrt-with-mingw-w64
_GCCSPECS="$(pwd)/gcc-specs-ucrt"
"${_CCPREFIX}gcc${_CCSUFFIX}" -dumpspecs | sed 's/-lmsvcrt/-lucrt/g' > "${_GCCSPECS}"
fi
fi
export _CCVER
_CCVER="$(printf '%02d' \
"$(printf '%s' "${ccver}" | grep -a -o -E '^[0-9]+')")"
export _OSVER='0000'
# Setup common toolchain configuration options
export _TOP; _TOP="$(pwd)" # Must be an absolute path
export _PKGDIR="_${_CPU}-${_OS}-${_CRT}"
export _PKGDIRS="${_PKGDIR}"
[ -n "${_OPENSSL}" ] && _PKGDIRS+="-${_OPENSSL}"
_PREFIX='/usr'
export _PP="${_PKGDIR}${_PREFIX}"
export _PPS="${_PKGDIRS}${_PREFIX}"
export _CC_GLOBAL=''
export _CFLAGS_GLOBAL=''
export _CFLAGS_GLOBAL_CMAKE=''
export _CFLAGS_GLOBAL_RAW=''
export _CPPFLAGS_GLOBAL=''
export _CXXFLAGS_GLOBAL=''
export _RCFLAGS_GLOBAL=''
export _LDFLAGS_GLOBAL=''
export _LDFLAGS_BIN_GLOBAL=''
export _LDFLAGS_CXX_GLOBAL='' # CMake uses this
export _CMAKE_GLOBAL='-Wno-dev' # Suppress CMake warnings meant for upstream developers
export _CMAKE_CXX_GLOBAL=''
export _CMAKE_ASM_GLOBAL=''
export _CROSS=0
export _MK
if command -v ninja >/dev/null 2>&1; then
_MK='ninja'
else
_MK='gnumake'
fi
if [ "${_MK}" = 'ninja' ]; then
_CMAKE_GLOBAL+=' -G Ninja'
fi
if [[ "${_CONFIG}" =~ (small|zero) ]]; then
_CFLAGS_GLOBAL_RAW+=' -Os'
_CMAKE_GLOBAL+=' -DCMAKE_BUILD_TYPE=MinSizeRel'
else
_CFLAGS_GLOBAL_RAW+=' -O3'
_CMAKE_GLOBAL+=' -DCMAKE_BUILD_TYPE=Release'
fi
# for CMake and openssl
unset CC
if [ "${_OS}" = 'win' ]; then
if [ "${_OPENSSL}" = 'awslc' ]; then
_CPPFLAGS_GLOBAL+=' -D_WIN32_WINNT=0x0700' # Windows 7
else
_CPPFLAGS_GLOBAL+=' -D_WIN32_WINNT=0x0600' # Windows Vista
fi
if [ "${_HOST}" != "${_OS}" ] || \
[ "${unamem}" != "${_machine}" ]; then
_CMAKE_GLOBAL="-DCMAKE_SYSTEM_NAME=Windows ${_CMAKE_GLOBAL}"
_CROSS=1
fi
[ "${_CPU}" = 'x86' ] && _RCFLAGS_GLOBAL+=' --target=pe-i386'
[ "${_CPU}" = 'x64' ] && _RCFLAGS_GLOBAL+=' --target=pe-x86-64'
[ "${_CPU}" = 'a64' ] && _RCFLAGS_GLOBAL+=" --target=${_TRIPLET}" # llvm-windres supports triplets here. https://github.com/llvm/llvm-project/blob/main/llvm/tools/llvm-rc/llvm-rc.cpp
if [ "${_HOST}" = 'win' ]; then
# '-G MSYS Makefiles' command-line option is problematic due to spaces
# and unwanted escaping/splitting. Pass it via envvar instead.
export CMAKE_GENERATOR='MSYS Makefiles'
# Without this, the value '/usr/local' becomes 'msys64/usr/local'
export MSYS2_ARG_CONV_EXCL='-DCMAKE_INSTALL_PREFIX='
fi
if [ "${_CRT}" = 'ucrt' ]; then
_CPPFLAGS_GLOBAL+=' -D_UCRT'
_LDFLAGS_GLOBAL+=' -Wl,-lucrt'
if [ "${_CC}" = 'gcc' ]; then
_LDFLAGS_GLOBAL+=" -specs=${_GCCSPECS}"
fi
fi
_CPPFLAGS_GLOBAL+=' -D_FORTIFY_SOURCE=3'
elif [ "${_OS}" = 'mac' ]; then
if [ "${_HOST}" != "${_OS}" ]; then
_CMAKE_GLOBAL="-DCMAKE_SYSTEM_NAME=Darwin ${_CMAKE_GLOBAL}"
_CROSS=1
fi
# macOS 10.9 Mavericks 2013-10-22. Seems to work for arm64 builds,
# though arm64 was released in macOS 11.0 Big Sur 2020-11-12.
# Bump to macOS 10.13 High Sierra 2017-09-25 if we decide to disable
# LDAP/LDAPS for macOS builds.
# NOTE: 10.8 (and older) trigger C++ issues with Xcode and CMake.
macminver='10.9'
_CMAKE_GLOBAL+=" -DCMAKE_OSX_DEPLOYMENT_TARGET=${macminver}"
# TODO: This option might have been renamed to `-mmacos-version-min=`?
_CFLAGS_GLOBAL+=" -mmacosx-version-min=${macminver}"
_CXXFLAGS_GLOBAL+=" -mmacosx-version-min=${macminver}"
_OSVER="$(printf '%02d%02d' \
"$(printf '%s' "${macminver}" | cut -d '.' -f 1)" \
"$(printf '%s' "${macminver}" | cut -d '.' -f 2)")"
if [ "${_CC}" != 'gcc' ]; then
_CMAKE_GLOBAL+=" -DCMAKE_OSX_ARCHITECTURES=${_machines}"
fi
elif [ "${_OS}" = 'linux' ]; then
if [ "${_HOST}" != "${_OS}" ] || \
[ "${unamem}" != "${_machine}" ]; then
_CMAKE_GLOBAL="-DCMAKE_SYSTEM_NAME=Linux ${_CMAKE_GLOBAL}"
_CROSS=1
fi
# Override defaults such as: 'lib/aarch64-linux-gnu'
_CMAKE_GLOBAL+=' -DCMAKE_INSTALL_LIBDIR=lib'
# OpenSSF guide:
# https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
# https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C%2B%2B.md
if [[ ( "${_CC}" = 'llvm' && "${_CCVER}" -ge '16' ) || \
( "${_CC}" = 'gcc' && "${_CCVER}" -ge '13' ) ]]; then
_CFLAGS_GLOBAL+=' -fstrict-flex-arrays=3'
_CXXFLAGS_GLOBAL+=' -fstrict-flex-arrays=3'
fi
# With musl, this seems to be a no-op as of Alpine v3.18
# https://en.wikipedia.org/wiki/Buffer_overflow_protection
_CFLAGS_GLOBAL+=' -fstack-protector-all'
_CXXFLAGS_GLOBAL+=' -fstack-protector-all'
if false && [ "${_CC}" = 'gcc' ] && [ "${_CCVER}" -ge '14' ]; then
# https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fhardened
_CFLAGS_GLOBAL+=' -fhardened'
_CXXFLAGS_GLOBAL+=' -fhardened'
else
# https://en.wikipedia.org/wiki/Position-independent_code#PIE
_CFLAGS_GLOBAL_RAW+=' -fPIC'
_CMAKE_GLOBAL+=' -DCMAKE_POSITION_INDEPENDENT_CODE=ON'
# With musl, this relies on package `fortify-headers` (Alpine)
_CPPFLAGS_GLOBAL+=' -D_FORTIFY_SOURCE=2'
# Requires glibc 2.34, gcc 12 (2022)
# https://developers.redhat.com/articles/2023/02/06/how-improve-application-security-using-fortifysource3
# https://developers.redhat.com/articles/2022/09/17/gccs-new-fortification-level
# _CPPFLAGS_GLOBAL+=' -D_FORTIFY_SOURCE=3'
if [ "${_CPU}" = 'x64' ] || \
[ "${_CPU}" = 'x86' ] || \
[ "${_CC}" = 'gcc' ]; then
_CFLAGS_GLOBAL+=' -fstack-clash-protection'
_CXXFLAGS_GLOBAL+=' -fstack-clash-protection'
fi
_LDFLAGS_GLOBAL+=' -Wl,-z,relro,-z,now'
fi
_LDFLAGS_GLOBAL+=' -Wl,-z,noexecstack' # Seems to be the default on our platforms, but make it explicit.
_LDFLAGS_GLOBAL+=' -Wl,-z,nodlopen'
if [ "${_CRT}" = 'musl' ]; then
if [ "${_HOST}" = 'mac' ]; then
_LDFLAGS_BIN_GLOBAL+=' -static'
elif [ "${_DISTRO}" = 'alpine' ]; then
_LDFLAGS_BIN_GLOBAL+=' -static-pie'
else
_LDFLAGS_BIN_GLOBAL+=' -static'
fi
fi
fi
if [ "${_CROSS}" = '1' ]; then
_CMAKE_GLOBAL+=" -DCMAKE_SYSTEM_PROCESSOR=${_machine}"
fi
_CFLAGS_GLOBAL+=' -fno-omit-frame-pointer'
_CXXFLAGS_GLOBAL+=' -fno-omit-frame-pointer'
# https://fedoraproject.org/wiki/Security_Features_Matrix
# RISC-V: https://gcc.gnu.org/onlinedocs/gcc/RISC-V-Options.html
if [ "${_CPU}" = 'x64' ] || \
[ "${_CPU}" = 'x86' ]; then
# https://maskray.me/blog/2022-12-18-control-flow-integrity
_CFLAGS_GLOBAL+=' -fcf-protection=full'
_CXXFLAGS_GLOBAL+=' -fcf-protection=full'
if [ "${_OS}" = 'linux' ]; then
# https://github.com/llvm/llvm-project/issues/44828
# https://reviews.llvm.org/D59780
# https://github.com/llvm/llvm-project/commit/7cd429f27d4886bb841ed0e3702e970f5f6cccd1
_LDFLAGS_GLOBAL+=' -Wl,-z,cet-report=warning -Wl,-z,force-ibt,-z,shstk'
elif [ "${_OS}" = 'win' ] && [ "${_CC}" = 'llvm' ]; then
_LDFLAGS_GLOBAL+=' -Wl,-Xlink=-cetcompat'
fi
elif [ "${_CPU}" = 'a64' ]; then
# https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html
_CFLAGS_GLOBAL+=' -mbranch-protection=standard'
_CXXFLAGS_GLOBAL+=' -mbranch-protection=standard'
fi
_CMAKE_GLOBAL+=' -DCMAKE_INSTALL_MESSAGE=NEVER'
_CMAKE_GLOBAL+=" -DCMAKE_INSTALL_PREFIX=${_PREFIX}"
# Hide symbols by default. Our goal is to create curl and libcurl, and to
# export the libcurl interface from the libcurl shared lib, without exporting
# the interfaces of its dependencies statically linked to the libcurl shared
# lib. This needs setting the default visibility 'hidden' and make sure that
# no dependency build is overriding this default, nor do they enable any
# per-function attribute to override it. Except when building libcurl itself.
# https://gcc.gnu.org/wiki/Visibility
#
# FIXME: We enable assembly code with most TLS backends (and zstd has some
# too on some targets). I have not found a way to enforce hidden visibility
# for symbols declared in assembly code (via .global or .globl) meaning these
# continue to leak out from the libcurl shared library.