configure: fix --with-ngtcp2=<path> option for crypto libs

ngtcp2 1.14.0 added module dependencies to `ngtcp2_crypto_*.pc` files.
This broke certain build cases in curl, because configure was is
querying pkg-config modules by setting `PKG_CONFIG_LIBDIR` to the
directory specified via `--with-*=` options, including `--with-ngtcp2=`.
Setting `PKG_CONFIG_LIBDIR` tells pkg-config (and pkgconf) to ignore
system locations. This caused that `ngtcp2_crypto_gnutls.pc` could no
longer find its indirect dependencies, if those were present at system
locations (where they typically are). Another fallout was BoringSSL,
because it does not provide `openssl.pc` on its own, and successful
detection relied on finding a non-BoringSSL copy, typically at a system
location (also fixed in ngtcp2 main branch).

Fix `ngtcp2_crypto_*` detections to not touch `PKG_CONFIG_LIBDIR` and
instead prepend `<path>` set via `--with-ngtcp2=` to `PKG_CONFIG_PATH`.
This ensures to pick up any dependent modules from system locations.

Note the side-effect is that potentially undesired modules may be
detected this way from system locations, i.e. it makes this particular
detection less "hermetic" than the rest used in curl configure.

(Configurations using a bare `--with-ngtcp2` with no path were not
affected, and served as a workaround before this patch. It remains a
valid way of configuration after.)

Both `pkgconf` and `pkg-config` use this logic to calculate their search
directory list:
```pseudo
search = {}
if PKG_CONFIG_PATH is set
  search += PKG_CONFIG_PATH
endif
if PKG_CONFIG_LIBDIR is set (even if empty)
  search += PKG_CONFIG_LIBDIR
else
  search += built-in-pkg-config-dirs
endif
```

Refs:
https://github.com/curl/curl/pull/18028/commits (earlier attempt. Failed due to using `PKG_CONFIG_DIR` instead of the correct `PKG_CONFIG_PATH`)
c0874ce824
https://man.archlinux.org/man/pkgconf.1.en
https://manpages.debian.org/unstable/pkgconf/pkgconf.1.en.html
https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html
10e27fd63c

Bug: https://github.com/curl/curl/pull/18022#issuecomment-3120587041
Bug: https://github.com/ngtcp2/ngtcp2/pull/1689#issuecomment-3120593664
Follow-up to 04d90b5deb #20931
Follow-up to 3c64ffaff4 #18415 #18188
Follow-up to 99500660af #18028 #18022

Closes #20920
This commit is contained in:
Viktor Szakats 2026-03-13 16:34:57 +01:00
parent 3e74a3e062
commit 38107d3354
No known key found for this signature in database
4 changed files with 58 additions and 46 deletions

View File

@ -354,11 +354,11 @@ jobs:
matrix:
build:
- name: 'openssl'
PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
tflags: '--min=1640'
configure: >-
LDFLAGS=-Wl,-rpath,/home/runner/openssl/build/lib
--with-openssl=/home/runner/openssl/build --with-ngtcp2 --enable-ssls-export
--with-openssl=/home/runner/openssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ssls-export
- name: 'openssl'
install_steps: skipall
@ -385,6 +385,7 @@ jobs:
- name: 'awslc'
install_steps: skipall
# Intentionally using bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' to test this way of configuration, in addition to '--with-ngtcp2=<path>' in other jobs.
PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
configure: >-
LDFLAGS=-Wl,-rpath,/home/runner/awslc/build/lib
@ -399,10 +400,10 @@ jobs:
- name: 'boringssl'
install_steps: skipall
PKG_CONFIG_PATH: /home/runner/boringssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2-boringssl/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
PKG_CONFIG_PATH: /home/runner/boringssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
configure: >-
LDFLAGS=-Wl,-rpath,/home/runner/boringssl/build/lib
--with-openssl=/home/runner/boringssl/build --with-ngtcp2 --enable-ssls-export
--with-openssl=/home/runner/boringssl/build --with-ngtcp2=/home/runner/ngtcp2-boringssl/build --enable-ssls-export
- name: 'boringssl'
PKG_CONFIG_PATH: /home/runner/boringssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2-boringssl/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
@ -414,10 +415,10 @@ jobs:
- name: 'gnutls'
install_packages: libp11-kit-dev libssh-dev
install_steps: skipall
PKG_CONFIG_PATH: /home/runner/nettle/build/lib64/pkgconfig:/home/runner/gnutls/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
PKG_CONFIG_PATH: /home/runner/nettle/build/lib64/pkgconfig:/home/runner/gnutls/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib -Wl,-rpath,/home/runner/nettle/build/lib64 -Wl,-rpath,/home/runner/ngtcp2/build/lib
configure: >-
--with-gnutls=/home/runner/gnutls/build --with-ngtcp2 --with-libssh --enable-ssls-export
--with-gnutls=/home/runner/gnutls/build --with-ngtcp2=/home/runner/ngtcp2/build --with-libssh --enable-ssls-export
- name: 'gnutls'
install_packages: libp11-kit-dev libssh-dev
@ -431,10 +432,10 @@ jobs:
- name: 'wolfssl'
install_packages: libssh2-1-dev
install_steps: skipall
PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
configure: >-
LDFLAGS=-Wl,-rpath,/home/runner/wolfssl/build/lib
--with-wolfssl=/home/runner/wolfssl/build --with-ngtcp2 --enable-ech --with-libssh2 --enable-ssls-export
--with-wolfssl=/home/runner/wolfssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --with-libssh2 --enable-ssls-export
--enable-unity
- name: 'wolfssl'

View File

@ -1311,22 +1311,33 @@ AC_DEFUN([CURL_CHECK_WIN32_CRYPTO], [
esac
])
dnl CURL_EXPORT_PCDIR ($pcdir)
dnl CURL_EXPORT_PCDIR ($pcdir, [$additive])
dnl ------------------------
dnl if $pcdir is not empty, set PKG_CONFIG_LIBDIR to $pcdir and export
dnl if $pcdir is not empty, set PKG_CONFIG_LIBDIR to $pcdir and export.
dnl if $additive is set, extend PKG_CONFIG_PATH instead, by prepending $pcdir
dnl to it, to ensure that system locations are still checked. This is
dnl necessary for modules that depend on modules residing there
dnl (e.g. gnutls.pc).
dnl
dnl we need this macro since pkg-config distinguishes among empty and unset
dnl variable while checking PKG_CONFIG_LIBDIR
dnl we need this macro to limit/expand search locations to/with a custom
dnl configured one.
dnl
AC_DEFUN([CURL_EXPORT_PCDIR], [
if test -n "$1"; then
PKG_CONFIG_LIBDIR="$1"
export PKG_CONFIG_LIBDIR
if test -n "$2"; then
dnl honor system locations
PKG_CONFIG_PATH="$1${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
export PKG_CONFIG_PATH
else
dnl ignore and override system locations
PKG_CONFIG_LIBDIR="$1"
export PKG_CONFIG_LIBDIR
fi
fi
])
dnl CURL_TRACE_PCDIR ($module, [$pcdir])
dnl CURL_TRACE_PCDIR ($module, [$pcdir], [$additive])
dnl ------------------------
dnl show pkg-config module lookup details, along with a detailed errors
dnl message in case of failure. Supports both pkg-config and pkgconf.
@ -1336,7 +1347,7 @@ AC_DEFUN([CURL_TRACE_PCDIR], [
dnl Example pkgconf line:
dnl libpkgconf/pkg.c:746 [pkgconf_pkg_t *pkgconf_pkg_try_specific_path(pkgconf_client_t *, [...]*)]: trying path: /usr/local/lib/pkgconfig for libngtcp2_crypto_gnutls
dnl Rest of strings are for catching classic pkg-config lines.
trc=`CURL_EXPORT_PCDIR([$2])
trc=`CURL_EXPORT_PCDIR([$2], [$3])
if test -n "$PKG_CONFIG_LIBDIR"; then
echo "PKG_CONFIG_LIBDIR: '$PKG_CONFIG_LIBDIR'"
fi
@ -1344,7 +1355,7 @@ AC_DEFUN([CURL_TRACE_PCDIR], [
echo "PKG_CONFIG_PATH: '$PKG_CONFIG_PATH'"
fi
$PKGCONFIG --exists --debug $1 2>&1 | $EGREP '(trying path:|Adding directory|Looking for|Scanning directory|Cannot open directory)' | $SED 's/^.*trying path:/trying path:/'`
msg=`CURL_EXPORT_PCDIR([$2])
msg=`CURL_EXPORT_PCDIR([$2], [$3])
$PKGCONFIG --exists --print-errors $1 2>&1`
if test -n "$msg"; then
trc=`echo "$trc"; echo '==== error:'; echo "$msg"`
@ -1355,7 +1366,7 @@ ${trc}
---- end])
])
dnl CURL_CHECK_PKGCONFIG ($module, [$pcdir])
dnl CURL_CHECK_PKGCONFIG ($module, [$pcdir], [$additive])
dnl ------------------------
dnl search for the pkg-config tool. Set the PKGCONFIG variable to hold the
dnl path to it, or 'no' if not found/present.
@ -1377,7 +1388,7 @@ AC_DEFUN([CURL_CHECK_PKGCONFIG], [
if test "$PKGCONFIG" != "no"; then
AC_MSG_CHECKING([for $1 options with pkg-config])
dnl ask pkg-config about $1
itexists=`CURL_EXPORT_PCDIR([$2]) dnl
itexists=`CURL_EXPORT_PCDIR([$2], [$3]) dnl
$PKGCONFIG --exists $1 >/dev/null 2>&1 && echo 1`
if test -z "$itexists"; then
@ -1385,13 +1396,13 @@ AC_DEFUN([CURL_CHECK_PKGCONFIG], [
dnl variable to 'no'
AC_MSG_RESULT([no])
if test -n "$CURL_TRACE_PKG_CONFIG$CURL_CI"; then
CURL_TRACE_PCDIR([$1], [$2])
CURL_TRACE_PCDIR([$1], [$2], [$3])
fi
PKGCONFIG="no"
else
AC_MSG_RESULT([found])
if test -n "$CURL_TRACE_PKG_CONFIG"; then
CURL_TRACE_PCDIR([$1], [$2])
CURL_TRACE_PCDIR([$1], [$2], [$3])
fi
fi
fi

View File

@ -3262,18 +3262,18 @@ if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" && test "$HAVE_LIBR
CLEANCPPFLAGS="$CPPFLAGS"
CLEANLIBS="$LIBS"
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_libressl, $want_tcp2_path)
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_libressl, $want_tcp2_path, 1)
if test "$PKGCONFIG" != "no"; then
LIB_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LIB_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-l libngtcp2_crypto_libressl`
AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_LIBRESSL])
CPP_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
CPP_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1) dnl
$PKGCONFIG --cflags-only-I libngtcp2_crypto_libressl`
AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_LIBRESSL])
LD_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LD_NGTCP2_CRYPTO_LIBRESSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-L libngtcp2_crypto_libressl`
AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_LIBRESSL])
@ -3323,18 +3323,18 @@ if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" && test "$HAVE_LIBR
CLEANCPPFLAGS="$CPPFLAGS"
CLEANLIBS="$LIBS"
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_quictls, $want_tcp2_path)
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_quictls, $want_tcp2_path, 1)
if test "$PKGCONFIG" != "no"; then
LIB_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LIB_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-l libngtcp2_crypto_quictls`
AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_QUICTLS])
CPP_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
CPP_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1) dnl
$PKGCONFIG --cflags-only-I libngtcp2_crypto_quictls`
AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_QUICTLS])
LD_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LD_NGTCP2_CRYPTO_QUICTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-L libngtcp2_crypto_quictls`
AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_QUICTLS])
@ -3382,18 +3382,18 @@ if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" &&
CLEANCPPFLAGS="$CPPFLAGS"
CLEANLIBS="$LIBS"
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_ossl, $want_tcp2_path)
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_ossl, $want_tcp2_path, 1)
if test "$PKGCONFIG" != "no"; then
LIB_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LIB_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-l libngtcp2_crypto_ossl`
AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_OSSL])
CPP_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
CPP_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1) dnl
$PKGCONFIG --cflags-only-I libngtcp2_crypto_ossl`
AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_OSSL])
LD_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LD_NGTCP2_CRYPTO_OSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-L libngtcp2_crypto_ossl`
AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_OSSL])
@ -3442,18 +3442,18 @@ if test "$USE_NGTCP2" = "1" && test "$OPENSSL_ENABLED" = "1" &&
CLEANCPPFLAGS="$CPPFLAGS"
CLEANLIBS="$LIBS"
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_boringssl, $want_tcp2_path)
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_boringssl, $want_tcp2_path, 1)
if test "$PKGCONFIG" != "no"; then
LIB_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LIB_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-l libngtcp2_crypto_boringssl`
AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_BORINGSSL])
CPP_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
CPP_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1) dnl
$PKGCONFIG --cflags-only-I libngtcp2_crypto_boringssl`
AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_BORINGSSL])
LD_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LD_NGTCP2_CRYPTO_BORINGSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-L libngtcp2_crypto_boringssl`
AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_BORINGSSL])
@ -3499,18 +3499,18 @@ if test "$USE_NGTCP2" = "1" && test "$GNUTLS_ENABLED" = "1"; then
CLEANCPPFLAGS="$CPPFLAGS"
CLEANLIBS="$LIBS"
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_gnutls, $want_tcp2_path)
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_gnutls, $want_tcp2_path, 1)
if test "$PKGCONFIG" != "no"; then
LIB_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LIB_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-l libngtcp2_crypto_gnutls`
AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_GNUTLS])
CPP_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
CPP_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1) dnl
$PKGCONFIG --cflags-only-I libngtcp2_crypto_gnutls`
AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_GNUTLS])
LD_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LD_NGTCP2_CRYPTO_GNUTLS=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-L libngtcp2_crypto_gnutls`
AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_GNUTLS])
@ -3556,18 +3556,18 @@ if test "$USE_NGTCP2" = "1" && test "$WOLFSSL_ENABLED" = "1"; then
CLEANCPPFLAGS="$CPPFLAGS"
CLEANLIBS="$LIBS"
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_wolfssl, $want_tcp2_path)
CURL_CHECK_PKGCONFIG(libngtcp2_crypto_wolfssl, $want_tcp2_path, 1)
if test "$PKGCONFIG" != "no"; then
LIB_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LIB_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-l libngtcp2_crypto_wolfssl`
AC_MSG_NOTICE([-l is $LIB_NGTCP2_CRYPTO_WOLFSSL])
CPP_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path]) dnl
CPP_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1) dnl
$PKGCONFIG --cflags-only-I libngtcp2_crypto_wolfssl`
AC_MSG_NOTICE([-I is $CPP_NGTCP2_CRYPTO_WOLFSSL])
LD_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path])
LD_NGTCP2_CRYPTO_WOLFSSL=`CURL_EXPORT_PCDIR([$want_tcp2_path], 1)
$PKGCONFIG --libs-only-L libngtcp2_crypto_wolfssl`
AC_MSG_NOTICE([-L is $LD_NGTCP2_CRYPTO_WOLFSSL])

View File

@ -138,7 +138,7 @@ Build curl (with autotools):
% git clone https://github.com/curl/curl
% cd curl
% autoreconf -fi
% ./configure PKG_CONFIG_PATH=/path/to/gnutls/lib/pkgconfig:/path/to/ngtcp2/lib/pkgconfig --with-gnutls=/path/to/gnutls --with-ngtcp2 --with-nghttp3=/path/to/nghttp3
% ./configure PKG_CONFIG_PATH=/path/to/gnutls/lib/pkgconfig --with-gnutls=/path/to/gnutls --with-ngtcp2=/path/to/ngtcp2 --with-nghttp3=/path/to/nghttp3
% make
% make install