[curl] http3 (with ngtcp2) non experimental feature by talregev · Pull Request #46459 · microsoft/vcpkg

talregev · 2025-07-17T08:11:37Z

Changes comply with the maintainer guide.
SHA512s are updated for each updated download.
The "supports" clause reflects platforms that may be fixed by this new version.
Any fixed CI baseline entries are removed from that file.
Any patches that are no longer applied are deleted from the port's directory.
The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
Only one version is added to each modified port's versions file.

This is the continue of this PR:
#37146

talregev · 2025-07-18T03:32:28Z

This is different compilation of openssl from the original PR.
This compilation is with ngtcp2, the non experimental way in curl to do http3. Meaning the way curl want and support. This is the http3 feature that most likely will be inserting into Linux (Ubuntu) apps manager (apt).

talregev · 2025-07-18T03:36:14Z

https://curl.se/docs/http3.html
Billy O'Neal (@BillyONeal)

talregev · 2025-07-26T12:17:18Z

I sent a msg to curl Debian maintainers about http3 feature.
Currently they will shift the http3 experimental feature with curl on Debian 13.
Soon the release is over, they will start to work on openssl + ngtcp2 + nghttp3 the non experimental way for Debian 14.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940519

Kai Pastor (dg0yt)

Comparing with

Kai Pastor (dg0yt) · 2025-07-30T04:58:01Z

 vcpkg_check_features(OUT_FEATURE_OPTIONS FEATURE_OPTIONS
    FEATURES
        http2       USE_NGHTTP2
+        http3       USE_NGTCP2


Shouln't http3 also be wired to control the use of nghttp3?

It adding nghttp3 inside curl cmake automatic.
I don't want it will be confusion with openssl + nghttp3 the experimental way for http3 with openssl.

"automatic" without context doesn't answer the question.

I looked it up now: USE_NGTCP2 is (almost*) sufficient to control the use of the nghttp3 dependency (USE_QUICHE left aside):
https://github.com/curl/curl/blob/cfbfb65047e85e6b08af65fe9cdbcf68e9ad496a/CMakeLists.txt#L1087-L1131

*) There is the multi-ssl problem again: curl could support this with wolfssl, but the port won't allow that combination - feature "http3" can depend only on one particlar SSL option.

Given that USE_NGHTTP3 does not appear to be an input I'm happy with this as talregev has written

Kai Pastor (dg0yt) · 2025-07-30T05:00:35Z

+curl[core,http3,gnutls]=options
+curl[core,http3,mbedtls]=options
+curl[core,http3,schannel]=options
+curl[core,http3,wolfssl]=options


Is this meant to enforce single-backend configuration in feature testing?
AFAICS nghttp3+ngtcp2 would also work with gnutls and wolfssl (and the "fork family").

You cannot have multi ssl when you do http3 in curl. You have to choose one backend.
You can see my previous PR that I give alternative options for http3:
http3-gnutls, http3-wolfssl. but they exclusive to each other.
#40219

You can also see Daniel comment:
curl/curl#14308 (comment)
https://github.com/curl/curl/blob/master/docs/INSTALL.md?plain=1#L155

You cannot have multi ssl when you do http3 in curl. You have to choose one backend.

So the original barrier for adding http3 to this port is not resolved.

You cannot have multi ssl when you do http3 in curl. You have to choose one backend.

So the original barrier for adding http3 to this port is not resolved.

The barrieries was if the http3 + openssl will be non experimental, and also that other distributions is going to adapt it.
So now I propose http3 + ngtp2 + openssl the non experimental way, also debian is going to adapt it, and ubuntu will follow.
look on these comments:
#37146 (comment)
#37146 (comment)

I believe the expected outcome from #37146 was that we find it likely that http3 is more useful to more people than multissl, and that when we added http3 the gnutls, mbedtls, etc. backends would be removed.

The things that matter are:

The out of the box experience vcpkg customers get from vcpkg install curl needs to produce a libcurl that can talk to TLS servers. OpenSSL is the defacto backend on *nix, schannel is the defacto backend on Windows, and Secure Transport is the defacto backend on macOS. Choosing a backend that is not the defacto one is likely to result in a libcurl that can't talk to TLS servers due to missing root certificates. Of course, Apple has broken this by removing Secure Transport for macOS, but they also provide a system copy of libcurl users can use.... too bad we don't have a great way of exposing that difference in vcpkg....

If we are going to, in effect, remove the lesser used TLS backends from the port in favor of adding http3, that needs to be marked non-experimental by the curl project, and needs to actually work on at least one of the triplets we test for in the curated registry.

After some discussion yesterday we've decided to allow this limited exception to https://learn.microsoft.com/vcpkg/contributing/maintainer-guide#do-not-use-features-to-implement-alternatives because:

The features that would create alternative issues are already here. If we were adding curl as a new port today, we would forbid them.

Removing them may break customers who are already using those other features due to a conflict with the http3 feature they are likely to not care about.

We believe http3 support is important and likely to be more important than the non-default TLS backends.

The big differences between now and the last time we considered this is:

http3 implemented in terms of one of our canonical default TLS backends is no longer considered experimental by the curl project: http3 on ngtcp2 on openssl appears to be the path being taken here.

It was our understanding last time that we would have had to forbid schannel and Secure Transport in order to allow http3 which would break the out of the box experience on Windows and macOS, respectively, due to missing root certificates. However, as Michał Petryka (@MichalPetryka) explained below, getting at the platform's root certificates with the OpenSSL TLS implementation is possible which we didn't know. And curl themselves broke Secure Transport because macOS broke Secure Transport.

Billy O'Neal (BillyONeal) · 2025-08-06T23:11:29Z

+curl[core,http3,gnutls]=options
+curl[core,http3,mbedtls]=options
+curl[core,http3,schannel]=options
+curl[core,http3,wolfssl]=options


I believe the expected outcome from #37146 was that we find it likely that http3 is more useful to more people than multissl, and that when we added http3 the gnutls, mbedtls, etc. backends would be removed.

The things that matter are:

The out of the box experience vcpkg customers get from vcpkg install curl needs to produce a libcurl that can talk to TLS servers. OpenSSL is the defacto backend on *nix, schannel is the defacto backend on Windows, and Secure Transport is the defacto backend on macOS. Choosing a backend that is not the defacto one is likely to result in a libcurl that can't talk to TLS servers due to missing root certificates. Of course, Apple has broken this by removing Secure Transport for macOS, but they also provide a system copy of libcurl users can use.... too bad we don't have a great way of exposing that difference in vcpkg....

If we are going to, in effect, remove the lesser used TLS backends from the port in favor of adding http3, that needs to be marked non-experimental by the curl project, and needs to actually work on at least one of the triplets we test for in the curated registry.

Billy O'Neal (BillyONeal) · 2025-08-06T23:11:42Z

    },
+    "http3": {
+      "description": "Enable http3 with openssl backend",
+      "supports": "(uwp | !windows) & !mingw",


Wait, how does it work for UWP?!!?

it always has.

and Secure Transport is the defacto backend on macOS.

Curl remove the support in Secure Transport. So now in vcpkg curl the openssl is defacto backend on all platforms except for windows or mingw.

Billy O'Neal (BillyONeal) · 2025-08-07T00:54:53Z

working-http3.zip

broken-no-schannel.zip

Just confirming that no schannel on Windows means no TLS:

C:\Dev\test>ninja -C build
ninja: Entering directory `build'
[0/1] Re-running CMake...-- Running vcpkg install
Detecting compiler hash for triplet x64-windows...
Compiler found: C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/MSVC/14.44.35207/bin/Hostx64/x64/cl.exe
Detecting compiler hash for triplet x64-windows-static...
Compiler found: C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/MSVC/14.44.35207/bin/Hostx64/x64/cl.exe
The following packages are already installed:
  * vcpkg-cmake:x64-windows@2024-04-23
  * vcpkg-cmake-config:x64-windows@2024-05-23
  * zlib:x64-windows-static@1.3.1
The following packages will be rebuilt:
    curl[core,openssl]:x64-windows-static@8.15.0#1
The following packages will be built and installed:
  * openssl:x64-windows-static@3.5.1
  * vcpkg-cmake-get-vars:x64-windows@2025-05-29
Additional packages (*) will be modified to complete this operation.
Restored 2 package(s) from C:\Users\bion\AppData\Local\vcpkg\archives in 759 ms. Use --debug to see more details.
Removing 1/4 curl:x64-windows-static
Elapsed time to handle curl:x64-windows-static: 20.2 ms
Installing 2/4 vcpkg-cmake-get-vars:x64-windows@2025-05-29...
Elapsed time to handle vcpkg-cmake-get-vars:x64-windows: 9.49 ms
vcpkg-cmake-get-vars:x64-windows package ABI: 929a3dceafe103b4e83cf87ffa8e8d902cb0c7214d27a11b7430ee690a04d1cf
Installing 3/4 openssl:x64-windows-static@3.5.1...
Elapsed time to handle openssl:x64-windows-static: 86.4 ms
openssl:x64-windows-static package ABI: 20db3173dc6f2473d486d5101997b9c11e9cfb1ccd5f4534bbd403ee9bd0e1f6
Installing 4/4 curl[core,openssl]:x64-windows-static@8.15.0#1...
Building curl[core,openssl]:x64-windows-static@8.15.0#1...
-- Using cached curl-curl-curl-8_15_0.tar.gz
-- Cleaning sources at C:/Dev/vcpkg/buildtrees/curl/src/url-8_15_0-8a95464ca7.clean. Use --editable to skip cleaning for the packages you specify.
-- Extracting source C:/Dev/vcpkg-downloads/curl-curl-curl-8_15_0.tar.gz
-- Applying patch dependencies.patch
-- Applying patch pkgconfig-curl-config.patch
-- Using source at C:/Dev/vcpkg/buildtrees/curl/src/url-8_15_0-8a95464ca7.clean
-- Using cached msys2-mingw-w64-x86_64-pkgconf-1~2.4.3-1-any.pkg.tar.zst
-- Using cached msys2-msys2-runtime-3.6.2-2-x86_64.pkg.tar.zst
-- Using msys root at C:/Dev/vcpkg-downloads/tools/msys2/9272adbcaf19caef
-- Found external ninja('1.12.1').
-- Configuring x64-windows-static
-- Building x64-windows-static-dbg
-- Building x64-windows-static-rel
-- Fixing pkgconfig file: C:/Dev/vcpkg/packages/curl_x64-windows-static/lib/pkgconfig/libcurl.pc
-- Fixing pkgconfig file: C:/Dev/vcpkg/packages/curl_x64-windows-static/debug/lib/pkgconfig/libcurl.pc
-- Installing: C:/Dev/vcpkg/packages/curl_x64-windows-static/share/curl/vcpkg-cmake-wrapper.cmake
-- Installing: C:/Dev/vcpkg/packages/curl_x64-windows-static/share/curl/usage
-- Performing post-build validation
Starting submission of curl[core,openssl]:x64-windows-static@8.15.0#1 to 1 binary cache(s) in the background
Elapsed time to handle curl:x64-windows-static: 23 s
curl:x64-windows-static package ABI: cec329afe0220f390ead87af32cb423c3d880dba13c2c818edbfa97ec8b3ff47
Installed contents are licensed to you by owners. Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Packages installed in this vcpkg installation declare the following licenses:
Apache-2.0
BSD-3-Clause
ISC
MIT
curl
curl is compatible with built-in CMake targets:

    find_package(CURL REQUIRED)
    target_link_libraries(main PRIVATE CURL::libcurl)

Waiting for 1 remaining binary cache submissions...
Completed submission of curl[core,openssl]:x64-windows-static@8.15.0#1 to 1 binary cache(s) in 858 ms (1/1)
All requested installations completed successfully in: 24 s
-- Running vcpkg install - done
-- Found OpenSSL: optimized;C:/Dev/test/build/vcpkg_installed/x64-windows-static/lib/libcrypto.lib;debug;C:/Dev/test/build/vcpkg_installed/x64-windows-static/debug/lib/libcrypto.lib (found suitable version "3.5.1", minimum required is "3")
-- Configuring done (30.4s)
-- Generating done (0.0s)
-- Build files have been written to: C:/Dev/test/build

[2/3] Linking CXX executable curl_hello_world.exe

C:\Dev\test>.\build\curl_hello_world.exe
Hello World! Downloading https://nghttp2.org/ using curl...
Making request to https://nghttp2.org/...
curl_easy_perform() failed: SSL peer certificate or SSH remote key was not OK

C:\Dev\test>

Billy O'Neal (BillyONeal) · 2025-08-07T00:56:16Z

I guess we could just always pick schannel on Windows and always pick openssl on everything else which would work and meet the requirements. Going to ask other maintainers about it.

Michał Petryka (MichalPetryka) · 2025-08-07T00:56:37Z

Just confirming that no schannel on Windows means no TLS

You need to pass --ca-native/CURLSSLOPT_NATIVE_CA to CURL for it.

While researching a build failure in `shears/seen`, I noticed that the `vcpkg` Pipeline [has been broken since August last year](https://dev.azure.com/git/git/_build?definitionId=9&_a=summary) 🤦. The reason is that the `schannel` feature of `curl` was removed, as part of microsoft/vcpkg#46459. This PR did not remove _Secure Channel support_, it merely removed the ability to specify it _as a feature_. Let's accommodate for that.

vcbuild: stop hard-coding OpenSSL as a dependency Git for Windows' default SSL backend is actually Secure Channel. Let's not hard-code any backend, just ask for _any_ SSL backend. This is necessary because we cannot ask for `schannel`, as microsoft/vcpkg#46459 removed the option to specify that as a feature. Signed-off-by: Dennis Ameling <dennis@dennisameling.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

While researching a build failure in `shears/seen`, I noticed that the `vcpkg` Pipeline [has been broken since August last year](https://dev.azure.com/git/git/_build?definitionId=9&_a=summary) 🤦. The reason is that the `schannel` feature of `curl` was removed, as part of microsoft/vcpkg#46459. This PR did not remove _Secure Channel support_, it merely removed the ability to specify it _as a feature_. Let's accommodate for that.

vcbuild: stop hard-coding OpenSSL as a dependency Git for Windows' default SSL backend is actually Secure Channel. Let's not hard-code any backend, just ask for _any_ SSL backend. This is necessary because we cannot ask for `schannel`, as microsoft/vcpkg#46459 removed the option to specify that as a feature. Signed-off-by: Dennis Ameling <dennis@dennisameling.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

While researching a build failure in `shears/seen`, I noticed that the `vcpkg` Pipeline [has been broken since August last year](https://dev.azure.com/git/git/_build?definitionId=9&_a=summary) 🤦. The reason is that the `schannel` feature of `curl` was removed, as part of microsoft/vcpkg#46459. This PR did not remove _Secure Channel support_, it merely removed the ability to specify it _as a feature_. Let's accommodate for that.

vcbuild: stop hard-coding OpenSSL as a dependency Git for Windows' default SSL backend is actually Secure Channel. Let's not hard-code any backend, just ask for _any_ SSL backend. This is necessary because we cannot ask for `schannel`, as microsoft/vcpkg#46459 removed the option to specify that as a feature. Signed-off-by: Dennis Ameling <dennis@dennisameling.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

While researching a build failure in `shears/seen`, I noticed that the `vcpkg` Pipeline [has been broken since August last year](https://dev.azure.com/git/git/_build?definitionId=9&_a=summary) 🤦. The reason is that the `schannel` feature of `curl` was removed, as part of microsoft/vcpkg#46459. This PR did not remove _Secure Channel support_, it merely removed the ability to specify it _as a feature_. Let's accommodate for that.

Git for Windows' default SSL backend is actually Secure Channel. Let's not hard-code any backend, just ask for _any_ SSL backend. This is necessary because we cannot ask for `schannel`, as microsoft/vcpkg#46459 removed the option to specify that as a feature. Signed-off-by: Dennis Ameling <dennis@dennisameling.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

talregev changed the title ~~[curl] http3 for non windows platforms~~ [curl] http3 for non channel (windows) platforms Jul 17, 2025

talregev commented Jul 17, 2025

View reviewed changes

Comment thread ports/ngtcp2/portfile.cmake Outdated

talregev force-pushed the TalR/openssl_ngtcp2 branch 4 times, most recently from f3b02ef to 57c4afd Compare July 17, 2025 08:36

talregev changed the title ~~[curl] http3 for non channel (windows) platforms~~ [curl] http3 for openssl (non windows) platforms Jul 17, 2025

talregev force-pushed the TalR/openssl_ngtcp2 branch 3 times, most recently from 65ccdec to 0d3a8e2 Compare July 17, 2025 09:44

talregev changed the title ~~[curl] http3 for openssl (non windows) platforms~~ [curl] http3 non experimental feature for openssl (non windows) platforms Jul 20, 2025

talregev changed the title ~~[curl] http3 non experimental feature for openssl (non windows) platforms~~ [curl] http3 (with ngtcp2) non experimental feature for openssl (non windows) platforms Jul 20, 2025

talregev changed the title ~~[curl] http3 (with ngtcp2) non experimental feature for openssl (non windows) platforms~~ [curl] http3 (with ngtcp2) non experimental feature for non windows (openssl) platforms Jul 20, 2025

Victor Romero (vicroms) added the requires:vcpkg-team-review This PR or issue requires someone on the vcpkg team to take a further look. label Jul 25, 2025

talregev force-pushed the TalR/openssl_ngtcp2 branch 2 times, most recently from c4538e0 to cd10ec6 Compare July 26, 2025 05:50

talregev force-pushed the TalR/openssl_ngtcp2 branch 2 times, most recently from 7138ecb to 1b16a27 Compare July 30, 2025 04:42

Kai Pastor (dg0yt) reviewed Jul 30, 2025

View reviewed changes

Billy O'Neal (BillyONeal) added info:needs-maintainer-attention Lets the current 'on rotation' vcpkg maintainer know they need to look at this. and removed requires:vcpkg-team-review This PR or issue requires someone on the vcpkg team to take a further look. labels Jul 31, 2025

talregev mentioned this pull request Aug 2, 2025

[curl] Added http3 feature #46723

Closed

7 tasks

Billy O'Neal (BillyONeal) reviewed Aug 6, 2025

View reviewed changes

Billy O'Neal (BillyONeal) added the requires:vcpkg-team-review This PR or issue requires someone on the vcpkg team to take a further look. label Aug 7, 2025

Johannes Schindelin (dscho) mentioned this pull request Jun 26, 2026

Fix vcpkg_install.bat git-for-windows/git#6298

Merged

Uh oh!

Conversation

talregev commented Jul 17, 2025

Uh oh!

Uh oh!

talregev commented Jul 18, 2025

Uh oh!

talregev commented Jul 18, 2025

Uh oh!

talregev commented Jul 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Kai Pastor (dg0yt) left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

talregev Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

talregev Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

talregev Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Billy O'Neal (BillyONeal) commented Aug 7, 2025

Uh oh!

Billy O'Neal (BillyONeal) commented Aug 7, 2025

Uh oh!

Michał Petryka (MichalPetryka) commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

talregev commented Jul 26, 2025 •

edited

Loading

talregev Jul 30, 2025 •

edited

Loading

talregev Jul 30, 2025 •

edited

Loading

talregev Aug 7, 2025 •

edited

Loading

Michał Petryka (MichalPetryka) commented Aug 7, 2025 •

edited

Loading