[1/3] curl: add option for libpsl, the Public Suffix List library

Instead of hardcoding this to disabled, add a PACKAGECONFIG.

No behavioural changes in this patch.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 meta/recipes-support/curl/curl_8.21.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Hello, Ross

On 7/23/26 15:55, Ross Burton via lists.openembedded.org wrote:
> Instead of hardcoding this to disabled, add a PACKAGECONFIG.
> 
> No behavioural changes in this patch.
> 
> Signed-off-by: Ross Burton <ross.burton@arm.com>
> ---
>   meta/recipes-support/curl/curl_8.21.0.bb | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-support/curl/curl_8.21.0.bb b/meta/recipes-support/curl/curl_8.21.0.bb
> index d245e7fe60f..399b915dee8 100644
> --- a/meta/recipes-support/curl/curl_8.21.0.bb
> +++ b/meta/recipes-support/curl/curl_8.21.0.bb
> @@ -55,6 +55,7 @@ PACKAGECONFIG[ldap] = "--enable-ldap,--disable-ldap,openldap"
>   PACKAGECONFIG[ldaps] = "--enable-ldaps,--disable-ldaps,openldap"
>   PACKAGECONFIG[libgsasl] = "--with-libgsasl,--without-libgsasl,libgsasl"
>   PACKAGECONFIG[libidn] = "--with-libidn2,--without-libidn2,libidn2"
> +PACKAGECONFIG[libpsl] = "--with-libpsl,--without-libpsl,libpsl"
>   PACKAGECONFIG[libssh] = "--with-libssh,--without-libssh,libssh"
>   PACKAGECONFIG[libssh2] = "--with-libssh2,--without-libssh2,libssh2"
>   PACKAGECONFIG[mbedtls] = "--with-mbedtls,--without-mbedtls,mbedtls"
> @@ -85,7 +86,6 @@ CURL_CA_BUNDLE_BASE_DIR:class-target = "${sysconfdir}"
>   
>   EXTRA_OECONF = " \
>       --disable-libcurl-option \
> -    --without-libpsl \
>       --enable-optimize \
>       --with-ca-bundle=${CURL_CA_BUNDLE_BASE_DIR}/ssl/certs/ca-certificates.crt \
>       ${@'--without-ssl' if (bb.utils.filter('PACKAGECONFIG', 'gnutls mbedtls openssl schannel', d) == '') else ''} \


Coincidence or not, I just started checking this critical vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2026-8924

And it is directly related to libpsl. I presumed that having it disabled 
(by default or not) would make oe-core's version of curl (e.g. in 
Scarthgap and Kirkstone) not affected. In fact, I checked if the parts 
of the code inside USE_LIBPSL ifdef blocks is built or not (it isn't), 
and in do_configure logs:

curl version:     7.82.0
SSL:              enabled (OpenSSL v3+)
SSH:              no      (--with-{libssh,libssh2})
zlib:             enabled
brotli:           no      (--with-brotli)
zstd:             no      (--with-zstd)
GSS-API:          no      (--with-gssapi)
GSASL:            no      (--with-gsasl)
TLS-SRP:          enabled
resolver:         POSIX threaded
IPv6:             no      (--enable-ipv6)
Unix sockets:     enabled
IDN:              enabled (libidn2)
Build libcurl:    Shared=yes, Static=yes
Built-in manual:  no      (--enable-manual)
--libcurl option: no
Verbose errors:   enabled (--disable-verbose)
Code coverage:    disabled
SSPI:             no      (--enable-sspi)
ca cert bundle:   /etc/ssl/certs/ca-certificates.crt
ca cert path:     no
ca fallback:      no
LDAP:             no      (--enable-ldap / --with-ldap-lib / 
--with-lber-lib)
LDAPS:            no      (--enable-ldaps)
RTSP:             no      (--enable-rtsp)
RTMP:             no      (--with-librtmp)
PSL:              no      (--with-libpsl)
(...)

I'm not sure yet if this is a premature conclusion of mine, but I'd 
still want to give this heads-up, considered you added this option to 
PACKAGECONFIG in your second patch.