From 5a63ee3c09e95bfd7afd7822a1a9254e361b940f Mon Sep 17 00:00:00 2001 From: Lance Fredrickson Date: Thu, 17 Apr 2025 13:05:43 -0600 Subject: [PATCH] package/libcurl: also specify the CA bundle location When given a certificate directory with --with-ca-path, curl doesn't list the files in that directory. Instead, it uses the certificate hash to directly open the requested CA certificate. Therefore, putting a bundle in that directory and removing all the individual certificates is not possible. In order to support use of the bundle, a separate configuration option --with-ca-bundle is needed. With this option, it is possible to remove the individual certificates and include just the bundle, which reduces the size of the root filesystem a bit. Note that the bundle is generated by the ca-certificates package, which also installs the individual certificates and the hash symlinks. It keeps both individual certificates and the bundle in the target. Signed-off-by: Lance Fredrickson Signed-off-by: Arnout Vandecappelle --- package/libcurl/libcurl.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index e1e5a7facb..d9a712bcb6 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -58,7 +58,8 @@ endif ifeq ($(BR2_PACKAGE_LIBCURL_OPENSSL),y) LIBCURL_DEPENDENCIES += openssl LIBCURL_CONF_OPTS += --with-openssl=$(STAGING_DIR)/usr \ - --with-ca-path=/etc/ssl/certs + --with-ca-path=/etc/ssl/certs \ + --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt else LIBCURL_CONF_OPTS += --without-openssl endif