[curl] Requesting [core,mbedtls] still builds and depends on openssl

[genotrance]

Describe the bug
./vcpkg install curl[core,mbedtls]

Environment

• OS: Tested on Alpine Linux musl
• Compiler: gcc 9.3.0

To Reproduce
Steps to reproduce the behavior:

1. ./vcpkg install curl[core,mbedtls]

Expected behavior
I expect to depend 100% on mbedtls and have no dependencies on openssl.

Failure logs

• There is no failure, just that the openssl binaries are also built and required at runtime.

[autoantwort]

This is not possible until something like #22216 gets implemented since these feature are options and not additive

[dg0yt]

Cannot reproduce.

$ ./vcpkg depend-info curl[core,mbedtls]
vcpkg-cmake: 
vcpkg-cmake-config: 
mbedtls: vcpkg-cmake, vcpkg-cmake-config
zlib: vcpkg-cmake
curl[mbedtls]: mbedtls, vcpkg-cmake, vcpkg-cmake-config, zlib

[genotrance]

My mistake - I reduced the feature list too much. The following works as expected:

./vcpkg install curl[core,mbedtls]

However, if you include http2, it drags in openssl.

 ./vcpkg install curl[core,http2,mbedtls] --recurse
Computing installation plan...
The following packages will be built and installed:
    curl[core,http2,mbedtls,openssl,ssl]:x64-linux@8.6.0
  * mbedtls:x64-linux@2.28.7
  * nghttp2:x64-linux@1.59.0
  * openssl:x64-linux@3.2.1
  * zlib:x64-linux@1.3.1

I didn't see any feature options in the nghttp2 package.

[jimwang118]

I didn't see any feature options in the nghttp2 package.

Yes, nghttp2 does not have any features.

[dg0yt]

I didn't see any feature options in the nghttp2 package.

Yes, nghttp2 does not have any features.

What does this mean to the original problem?
Why is this issue now in category:question now?

curl[http2] is declared to depend on curl[core,ssl] which selects the default SSL backend, curl[openssl] on linux.
If possible, remove the dependency on curl[core,ssl]. It restricts choice of an alternative SSL backend.

[jimwang118]

curl[http2] is declared to depend on curl[core,ssl] which selects the default SSL backend, curl[openssl] on linux. If possible, remove the dependency on curl[core,ssl]. It restricts choice of an alternative SSL backend.

Can curl[http2] delete the dependent feature ssl?

[dg0yt]

Try!

[jimwang118]

Try!

After removing the ssl dependency, there is no problem compiling and using. I will submit a PR to fix it.

[jimwang118]

The upstream explains that you need to rely on openssl when using http2, and we need to ensure the port's versatility. You can remove http2's dependence on ssl locally yourself. https://github.com/curl/curl/blob/d5b0fee39a7898dac42cb4fc64e35f5bc085e766/docs/HTTP2.md

[genotrance]

The link is not clear but the following note from nghttp2's repo clarifies:

OpenSSL >= 1.1.1; or LibreSSL >= 3.8.1; or aws-lc >= 1.19.0; or BoringSSL

Doesn't look like nghttp2 even supports mbedtls right now.

I'm new to vcpkg and this was a surprise to me. Might be good to notify in some way but this can happen with any package with any dependency. It would require vcpkg to support all combinations of features for every package (libressl and wolfssl are already in vcpkg so you would want nghttp2 to have those as features) and track which features are alternatives and reduce redundancy.

Closing this this is not feasible for mbedtls specifically but the general issue still holds.