Fixes CVE-2021-22876 and CVE-2021-22890.
* gnu/packages/curl.scm (curl/fixed): New variable.
(curl)[replacement]: New field.
* gnu/packages/patches/curl-7.76-use-ssl-cert-env.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/curl.scm (guile-curl): Update to 0.7.
[#:modules, #:imported-modules]: Load guile-build-system for
target-guile-effective-version.
[#:configure-flags]: Use target-guile-effective-version.
[#:phases]: Add 'patch-undefined-references.
Use target-guile-effective-version.
[inputs]: Use guile-3.0.
When OpenLDAP is missing, cURL will fall back to an internal LDAP
client implementation, so there is no loss of functionality. This simplifies
bootstrapping and reduces the closure size by 6.1 MiB.
* gnu/packages/curl.scm (curl)[inputs]: Remove OPENLDAP.
This is a follow-up to commits 6ab31af7c7fae218388b624af6c092d72b12c5b3 and
e21b70acccedb3758ef124543fb522795d219608.
* gnu/packages/curl.scm: Do not import (gnu packages groff).
* gnu/packages/linux.scm: Do not import (gnu packages attr).
This is necessary to avoid a circular dependency in the next commit.
* gnu/packages/curl.scm (curl-minimal): New public variable.
* gnu/packages/cmake.scm (cmake-minimal-bootstrap): New public variable.
* gnu/packages/image.scm (libjpeg-turbo)[arguments]: Add #:cmake.
* gnu/packages/patches/curl-use-ssl-cert-env.patch: New file.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
* gnu/packages/curl.scm (curl)[source]: Use the patch.
[native-search-paths]: Add the new variables.
Signed-off-by: Marius Bakke <mbakke@fastmail.com>
This is a followup to commits c1f4e6491cecc5d121ef371a8fb2aa0a07030d36
and af8f7eb4f2a664c2d0fb3faabaf2e80c72993ef6.
* gnu/packages/curl.scm (libssh2-1.8.0): Use hidden-package.
Commit af8f7eb4f2a664c2d0fb3faabaf2e80c72993ef6 accidentally changed the cURL
derivation. Remove use of HIDDEN-PACKAGE and restore input order to prevent a
large number of rebuilds.
* gnu/packages/ssh.scm (libssh2-1.8.0): Move from here ...
* gnu/packages/curl.scm (libssh2-1.8.0): ... to here. Don't use
HIDDEN-PACKAGE and make it non-public.
(curl)[inputs]: Move LIBSSH2-1.8.0 where it was before af8f7eb4f2a66.