curl/curl.spec

%define major 4
%define libname %mklibname %{name} %{major}
%define libname_libressl %mklibname %{name}-libressl %{major}
%define libname_gnutls %mklibname %{name}-gnutls %{major}
%define devname %mklibname %{name} -d
%define devname_libressl %mklibname %{name}-libressl -d
%define devname_gnutls %mklibname %{name}-gnutls -d

%define ssh2 0

# Using libressl allows to support GOST TLS without pain
# test: curl https://www.cryptopro.ru:4444/test/tls-cli.asp
# Building a separate curl with libressl
%bcond_without libressl

# Quite a lot of third-party software is compiled on Debian/Ubuntu
# and is linked with libcurl dynamically, Debian's invention libcurl-gnutls.so
# becomes a runtime dependency. Build the same crap to satisfy runtime dependencies.
# Examples of such software:
# - OnlyOffice DesktopEditors (and probably R7 Office)
# - SberPro https://www.sberbank.ru/ru/legal/new/sbrfbusiness
# GnuTLS, btw, is also capable of GOST.
%bcond_without gnutls

# Important! We perform autoreconf, then change resulting 'configure'
# script, this prevents if from regenerating after we have changed it.
%define _disable_rebuild_configure 1

%define _docs %{expand:
%doc _docs/CHANGES \
%doc _docs/COPYING \
%doc _docs/README \
%doc _docs/README.md \
%doc _docs/RELEASE-NOTES \
%doc _docs/SECURITY.md \
%doc _docs/docs/FAQ \
%doc _docs/docs/THANKS \
%doc _docs/docs/KNOWN_BUGS \
%doc _docs/docs/*.md
}

%define ssl_list openssl %{?with_libressl:libressl} %{?with_gnutls:gnutls}

%define shell_begin %{expand:for SSL in %%{ssl_list} ; \
	do \
	mkdir -p "$SSL" ;\
	pushd "$SSL"}
%define shell_end popd; done

Summary:	Gets a file from a FTP, GOPHER or HTTP server
Name:		curl
Version:	7.75.0
Release:	3
Epoch:		1
License:	BSD-like
Group:		Networking/Other
Url:		https://curl.haxx.se
# Release tarball does not have some useful docs
#Source0:	https://curl.haxx.se/download/%{name}-%{version}.tar.xz
Source0:	https://github.com/curl/curl/archive/curl-%(echo %{version} | sed -e 's,\.,_,g').tar.gz?/%{name}-%{version}.tar.gz
Patch0:		%{name}-7.59.0-multilib.patch
Patch2:		%{name}-7.59.0-debug.patch
Patch3:		%{name}-libressl.patch
Patch4:		CVE-2021-22897.patch
Patch5:		CVE-2021-22898.patch
BuildRequires:	groff
BuildRequires:	rsync
BuildRequires:	stunnel
BuildRequires:	openldap-devel
BuildRequires:	pkgconfig(krb5)
BuildRequires:	pkgconfig(libcares)
BuildRequires:	pkgconfig(com_err)
#BuildRequires:	pkgconfig(libidn)
BuildRequires:	pkgconfig(libidn2)
%if 0%{?ssh2}
BuildRequires:	pkgconfig(libssh2)
%else
BuildRequires:	pkgconfig(libssh)
%endif
%if %{with libressl}
BuildRequires:	pkgconfig(libressl)
%endif
%if %{with gnutls}
BuildRequires:	pkgconfig(gnutls)
%endif
BuildRequires:	pkgconfig(openssl)
BuildRequires:	pkgconfig(zlib)
BuildRequires:	pkgconfig(krb5-gssapi)
# TODO: Package and enable libpsl support
Requires:	%{libname} = %{EVRD}
Provides:	webfetch = %{EVRD}

%description
curl is a client to get documents/files from servers, using any of the
supported protocols. The command is designed to work without user interaction
or any kind of interactivity.
It offers a busload of useful tricks like proxy support, user authentication,
ftp upload, HTTP post, file transfer resume and more.
This version is compiled with SSL (https) support.

%files
%_docs
%{_bindir}/%{name}
%{_mandir}/man1/%{name}.1*

#----------------------------------------------------------------------------
%if %{with libressl}
%package -n curl-libressl
Summary:	Gets a file from a FTP, GOPHER or HTTP server
Group:		Networking/Other
Provides:	curl-gost = %{EVRD}

%description -n curl-libressl
curl is a client to get documents/files from servers, using any of the
supported protocols. The command is designed to work without user interaction
or any kind of interactivity.
It offers a busload of useful tricks like proxy support, user authentication,
ftp upload, HTTP post, file transfer resume and more.
This version is compiled with LibreSSL and is capable of GOST TLS.

%files -n curl-libressl
%_docs
%{_bindir}/curl-libressl
%{_bindir}/curl-gost
%endif
#----------------------------------------------------------------------------

%if %{with gnutls}
%package -n curl-gnutls
Summary:	Gets a file from a FTP, GOPHER or HTTP server
Group:		Networking/Other

%description -n curl-gnutls
curl is a client to get documents/files from servers, using any of the
supported protocols. The command is designed to work without user interaction
or any kind of interactivity.
It offers a busload of useful tricks like proxy support, user authentication,
ftp upload, HTTP post, file transfer resume and more.
This version is compiled with GnuTLS library.

%files -n curl-gnutls
%_docs
%{_bindir}/curl-gnutls
%endif
#----------------------------------------------------------------------------

%package -n %{libname}
Summary:	A library of functions for file transfer
Group:		Networking/Other
Requires:	rootcerts

%description -n %{libname}
libcurl is a library of functions for sending and receiving files through
various protocols, including http and ftp.
You should install this package if you plan to use any applications that
use libcurl.

%files -n %{libname}
%_docs
%{_libdir}/libcurl.so.%{major}*

#----------------------------------------------------------------------------
%if %{with libressl}
%package -n %{libname_libressl}
Summary:	A library of functions for file transfer
Group:		Networking/Other
Requires:	rootcerts

%description -n %{libname_libressl}
libcurl is a library of functions for sending and receiving files through
various protocols, including http and ftp.
You should install this package if you plan to use any applications that
use libcurl.
libcurl-libressl is linked with LibreSSL and is capable of GOST TLS.

%files -n %{libname_libressl}
%_docs
%{_libdir}/libcurl-libressl.so.%{major}*
%endif
#----------------------------------------------------------------------------

%if %{with gnutls}
%package -n %{libname_gnutls}
Summary:	A library of functions for file transfer
Group:		Networking/Other
Requires:	rootcerts

%description -n %{libname_gnutls}
libcurl is a library of functions for sending and receiving files through
various protocols, including http and ftp.
You should install this package if you plan to use any applications that
use libcurl.
libcurl-gnutls is linked with GnuTLS library.

%files -n %{libname_gnutls}
%_docs
%{_libdir}/libcurl-gnutls.so.%{major}*
%endif
#----------------------------------------------------------------------------

%package -n %{devname}
Summary:	Header files and static libraries for libcurl
Group:		Development/C
Requires:	%{libname} = %{EVRD}
Provides:	%{name}-devel = %{EVRD}

%description -n %{devname}
libcurl is a library of functions for sending and receiving files through
various protocols, including http and ftp.
You should install this package if you wish to develop applications that
use libcurl.

%files -n %{devname}
%_docs
%{_bindir}/%{name}-config
%{_libdir}/libcurl.so
%{_includedir}/%{name}
%exclude %{_includedir}/curl-libressl
%{_libdir}/pkgconfig/libcurl.pc
%{_datadir}/aclocal/*.m4
%{_mandir}/man1/%{name}-config.1*
%{_mandir}/man3/*

#----------------------------------------------------------------------------
%if %{with libressl}

%package -n %{devname_libressl}
Summary:	Header files and devel libraries for libcurl with LibreSSL
Group:		Development/C
Requires:	%{libname_libressl} = %{EVRD}
Provides:	%{name}-libressl-devel = %{EVRD}
Provides:	%{name}-gost-devel = %{EVRD}

%description -n %{devname_libressl}
libcurl is a library of functions for sending and receiving files through
various protocols, including http and ftp.
You should install this package if you wish to develop applications that
use libcurl linked with LibreSSL and capable of GOST.

%files -n %{devname_libressl}
%_docs
%{_includedir}/curl-libressl
%{_libdir}/pkgconfig/libcurl-libressl.pc
%{_libdir}/libcurl-libressl.so

%endif
#----------------------------------------------------------------------------

%if %{with gnutls}

%package -n %{devname_gnutls}
Summary:	Header files and devel libraries for libcurl with gnutls
Group:		Development/C
Requires:	%{libname_gnutls} = %{EVRD}
Provides:	%{name}-gnutls-devel = %{EVRD}

%description -n %{devname_gnutls}
libcurl is a library of functions for sending and receiving files through
various protocols, including http and ftp.
You should install this package if you wish to develop applications that
use libcurl linked with gnutls and capable of GOST.

%files -n %{devname_gnutls}
%_docs
%{_includedir}/curl-gnutls
%{_libdir}/pkgconfig/libcurl-gnutls.pc
%{_libdir}/libcurl-gnutls.so

%endif
#----------------------------------------------------------------------------

%package examples
Summary:	Example files for %{name} development
Group:		Development/C
Requires:	%{name}-devel = %{EVRD}
BuildArch:	noarch

%description examples
Example files for %{name} development.

%files examples
%doc docs/examples

#----------------------------------------------------------------------------

%prep
%setup -q -n curl-curl-%(echo %{version} | sed -e 's,\.,_,g')
cp libcurl.pc.in libcurl.pc.in.0
%apply_patches
# after Patch3 curl-libressl.patch
# 0 - original (OpenSSL), 1 - patched (LibreSSL)
cp libcurl.pc.in libcurl.pc.in.1
regexp="$(echo %{ssl_list} | sed -e 's, ,|,g')"
for i in %{ssl_list}; do
	mkdir -p "$i"
	cp -r $(ls -1v | grep -vE "$regexp") "$i"/
done

# remove "-DEV" from useragent ("curl/7.74.0-DEV" -> "curl/7.74.0")
sed -i -e 's,-DEV\",\",' include/curl/curlver.h

# %%_docs copy docs/*.md, remove odd ones
rm -fv docs/README.md
# build scripts seem to remove useful files, backup them
mkdir -p _docs/
rsync -av --relative --progress $(echo "%_docs" | sed -e 's,%doc,,g' -e 's,_docs/,,g') _docs/

rm -fr $(ls -1v | grep -vE "${regexp}|docs|COPYING|CHANGES")

%build
%setup_compile_flags
%shell_begin

ADD_CONF_OPTS=""
case "$SSL" in
 libressl )
	with_gnutls=without
	cp libcurl.pc.in.1 libcurl.pc.in
	# validate that correct file is being used
	grep -q LIBRESSL_ libcurl.pc.in
	new_libname=libcurl-libressl
	sed -i configure.ac \
		-e 's,openssl.pc,libressl.pc,g' \
		-e 's,PKGCONFIG(openssl,PKGCONFIG(libressl,g' \
		-e 's,$PREFIX_OPENSSL/lib$libsuff,$PREFIX_OPENSSL/lib,g'
	# $LIBS apply to libcurl.so only, so there will not be overlinking
	# even if to add -lxxx here
	export LIBS="$(pkg-config --cflags-only-I --libs-only-L libressl)"
	export CFLAGS="$LIBS"
	export PREFIX_OPENSSL=%{libressl_prefix}
	# It will be /usr/include/curl-libressl/curl
	# to allow '#include <curl/xxx.h> to work with -I/usr/include/curl-libressl
	ADD_CONF_OPTS="\
		--includedir=%{_includedir}/curl-libressl \
	"
	;;
 openssl )
	with_gnutls=without
	cp libcurl.pc.in.0 libcurl.pc.in
	! grep -q LIBRESSL_ libcurl.pc.in
	new_libname=libcurl
	export LIBS="$(pkg-config --cflags-only-I --libs-only-L openssl)"
	export CFLAGS="$LIBS"
	export PREFIX_OPENSSL=%{_prefix}
	ADD_CONF_OPTS=""
	;;
 gnutls )
	with_gnutls=with
	new_libname=libcurl-gnutls
	# It will be /usr/include/curl-libressl/gnutls
	# to allow '#include <curl/xxx.h> to work with -I/usr/include/curl-gnuttls
	ADD_CONF_OPTS="\
		--includedir=%{_includedir}/curl-gnutls \
	"
	;;
esac

autoreconf -fiv
sed -i configure \
	-e "s,\$libname,${new_libname},g" \
	-e "s,\${libname},${new_libname},g"

%configure \
	--disable-static \
	--with-ssl=off \
	--${with_gnutls}-gnutls \
	--without-bearssl \
	--with-zlib \
	--with-lber-lib=lber \
	--with-libidn2 \
%if 0%{?ssh2}
	--with-ssh2 \
%else
	--with-libssh \
%endif
	--with-random \
	--enable-hidden-symbols \
	--enable-optimize \
	--enable-nonblocking \
	--enable-thread \
	--enable-crypto-auth \
	--enable-libgcc \
	--enable-ldaps \
	--enable-ipv6 \
	--with-ca-bundle=%{_openssldir}/certs/ca-bundle.crt \
	--with-gssapi=%{_prefix} \
	--enable-ares \
	--enable-tls-srp \
	--without-libpsl \
	$ADD_CONF_OPTS --

%make

# we don't want them in curl-examples:
rm -r docs/examples/.deps ||:

%shell_end

%install
%shell_begin
case "$SSL" in
	openssl )
		%makeinstall_std
	;;
	libressl )
		tmp="$(mktemp -d -p $PWD)"
		mkdir -p "$tmp"
		make DESTDIR="${tmp}" install
		mv -v ${tmp}%{_bindir}/curl %{buildroot}%{_bindir}/curl-libressl
		mv -v ${tmp}%{_libdir}/libcurl-libressl* %{buildroot}%{_libdir}
		mv -v ${tmp}%{_includedir}/curl-libressl %{buildroot}%{_includedir}/
		cat ${tmp}%{_libdir}/pkgconfig/libcurl.pc | \
			sed -r \
				-e 's,^Name:.+,Name: libcurl-libressl,g' \
				-e 's,-lcurl,-lcurl-libressl,g' \
				-e "s,@LIBRESSL_LIBS@,$(pkg-config --libs-only-L libressl),g" \
				-e "s,@LIBRESSL_LIBS_PRIVATE@,,g" \
				-e "s,@LIBRESSL_CFLAGS@,$(pkg-config --cflags-only-I libressl),g" \
			> %{buildroot}%{_libdir}/pkgconfig/libcurl-libressl.pc
		#rm -fr "$tmp"
	;;
	gnutls )
		tmp="$(mktemp -d -p $PWD)"
		mkdir -p "$tmp"
		make DESTDIR="${tmp}" install
		mv -v ${tmp}%{_bindir}/curl %{buildroot}%{_bindir}/curl-gnutls
		mv -v ${tmp}%{_libdir}/libcurl-gnutls* %{buildroot}%{_libdir}
		mv -v ${tmp}%{_includedir}/curl-gnutls %{buildroot}%{_includedir}/
		cat ${tmp}%{_libdir}/pkgconfig/libcurl.pc | \
			sed -r \
				-e 's,^Name:.+,Name: libcurl-gnutls,g' \
				-e 's,-lcurl,-lcurl-gnutls,g' \
				-e 's,-I$\{includedir\},-I$\{includedir\} -I$\{includedir\}/curl-gnutls,' \
			> %{buildroot}%{_libdir}/pkgconfig/libcurl-gnutls.pc
	;;
	* ) echo 'Unknown $SSL' && exit 1 ;;
esac

# [july 2008] HACK. to be replaced by a real fix
sed -i -e 's!-Wl,--as-needed!!' -e 's!-Wl,--no-undefined!!' %{buildroot}%{_bindir}/%{name}-config
sed -i -e 's!-Wl,--as-needed!!' -e 's!-Wl,--no-undefined!!' %{buildroot}%{_libdir}/pkgconfig/*.pc

# (tpg) use rootcerts's certificates #35917
find %{buildroot} -name ca-bundle.crt -exec rm -f '{}' \;

# we don't package mk-ca-bundle so we don't need man for it
rm -f %{buildroot}%{_mandir}/man1/mk-ca-bundle.1*

%shell_end

%if %{with libressl}
( cd %{buildroot}%{_bindir} ; ln -s curl-libressl curl-gost )
%endif

%check
export LD_LIBRARY_PATH=%{buildroot}%{_libdir}
%if %{with libressl}
readelf -a %{buildroot}%{_bindir}/curl-libressl | grep NEEDED | grep -q libcurl-libressl
readelf -a %{buildroot}%{_libdir}/libcurl-libressl.so | grep SONAME | grep -q libcurl-libressl
readelf -a %{buildroot}%{_libdir}/libcurl-libressl.so | grep NEEDED | grep -q 'libssl.so.%{libressl_libssl_sover}'
readelf -a %{buildroot}%{_libdir}/libcurl-libressl.so | grep NEEDED | grep -q 'libcrypto.so.%{libressl_libcrypto_sover}'
readelf -a %{buildroot}%{_libdir}/libcurl-gnutls.so | grep NEEDED | grep -q 'libgnutls.so.'
! readelf -a %{buildroot}%{_libdir}/libcurl.so | grep SONAME | grep -q libcurl-libressl
readelf -a %{buildroot}%{_libdir}/libcurl-gnutls.so | grep SONAME | grep -q libcurl-gnutls
# Check that GSS-API has been enabled
readelf -a %{buildroot}%{_libdir}/libcurl.so          | grep NEEDED | grep -q libgssapi
readelf -a %{buildroot}%{_libdir}/libcurl-libressl.so | grep NEEDED | grep -q libgssapi
readelf -a %{buildroot}%{_libdir}/libcurl-gnutls.so   | grep NEEDED | grep -q libgssapi
# This test will not fail if there is no connection with internet
# --insecure to ignore missing SSL certificate
if %{buildroot}%{_bindir}/curl-libressl --insecure \
	"https://www.cryptopro.ru:4444/test/tls-cli.asp" 2>&1 | \
	grep -q ':unsupported algorithm$' ;
then
	echo "GOST is not supported"
	exit 1
fi
%endif