# Template file for 'curl'
pkgname=curl
version=8.18.0
revision=0
short_desc="Command line HTTP/HTTPS client and libcurl"
maintainer="finwo <finwo@pm.me>"
license="curl"
homepage="https://curl.se/"
distfiles="https://curl.se/download/curl-${version}.tar.xz"
checksum=40df79166e74aa20149365e11ee4c798a46ad57c34e4f68fd13100e2c9a91946
depends="glibc busybox openssl zlib"
makedepends="openssl zlib"

# Notes:
# - Why: a rescue image needs to pull things onto the box -- an installer
#   payload, a replacement config, a kernel. tinyssh is daemon-only (upstream
#   ships no client, so no scp/sftp either), which left busybox wget as the
#   sole inbound path. wget is fine until you need TLS with a real CA store,
#   redirects, or a useful error message when a fetch fails at 3am.
# - Protocol surface is cut hard: this is a recovery tool, not a general
#   purpose client. HTTP/HTTPS/FTP stay; everything else goes. Each disabled
#   protocol is one less parser reachable from the network.
# - OpenSSL backend (we already package it) rather than bundling another TLS
#   stack. CA bundle comes from the system path, not baked in here.
# - libcurl ships too: it is the same build, and shipping only the binary
#   would mean statically linking it for no reason.

do_configure() {
	cd "${WRKSRC}"
	./configure \
		--prefix=/usr \
		--libdir=/usr/lib \
		--disable-static \
		--enable-shared \
		--with-openssl \
		--with-zlib \
		--without-libpsl \
		--without-libidn2 \
		--without-brotli \
		--without-zstd \
		--without-nghttp2 \
		--without-libssh2 \
		--disable-ldap \
		--disable-ldaps \
		--disable-rtsp \
		--disable-dict \
		--disable-telnet \
		--disable-tftp \
		--disable-pop3 \
		--disable-imap \
		--disable-smb \
		--disable-smtp \
		--disable-gopher \
		--disable-mqtt \
		--disable-manual \
		--enable-optimize
}

do_build() {
	cd "${WRKSRC}"
	make -j"$(nproc)"
}

do_install() {
	cd "${WRKSRC}"
	make install DESTDIR="${DESTDIR}"

	# Sysroot seed: anything later linking libcurl builds against ours.
	make install DESTDIR="${SYSROOT}"

	rm -f  "${DESTDIR}"/usr/lib/*.la "${SYSROOT}"/usr/lib/*.la
	rm -rf "${DESTDIR}/usr/share/man" "${DESTDIR}/usr/share/doc"
	# curl-config is a build-time helper for consumers, not a switch tool.
	rm -f "${DESTDIR}/usr/bin/curl-config"

	[ -x "${DESTDIR}/usr/bin/curl" ] || die "curl: no curl binary"
	[ -e "${DESTDIR}/usr/lib/libcurl.so" ] || die "curl: no libcurl"
	# Prove TLS is actually wired up; a curl without HTTPS is a trap in a
	# rescue image, and configure will happily build one.
	readelf -d "${DESTDIR}/usr/bin/curl" | grep -q 'libcurl\.so' \
		|| die "curl: binary does not link libcurl"
	readelf -d "${DESTDIR}/usr/lib/libcurl.so."* | grep -q 'libssl\.so' \
		|| die "curl: libcurl not linked against OpenSSL (no HTTPS)"
}
