From 7b9a34d692cecf9e8319b73cf1f648442f72839c Mon Sep 17 00:00:00 2001
From: Scott Linder <Scott.Linder@amd.com>
Date: Thu, 22 Jan 2026 12:38:44 -0500
Subject: [PATCH] meson: sink curl dependency past openssl

The curl dependency is declared before the openssl dependency. In a
purely subproject-based build this leads to the curl subproject finding
no ssl backend and turning off dependent options like HTTPS support.
This produces confusing configurations where, for example, a build
nominally has http_backend=openssl, installs git-remote-https, and then
complains at runtime that it cannot actually handle the https protocol.

Sink the curl dependency past the openssl dependency, and rely on the
default behavior of the curl meson wrapper to pick up the openssl
subproject.

It isn't straightforward to test this on an arbitrary machine, as the
curl build can find another suitable openssl install even when the
overall build has https_backend=none:

  $ meson setup -Dforce_fallback_for=openssl,curl -Dhttps_backend=none build
      HTTPS               : YES

I tested the change in an alpine:3.21 docker container without openssl
or curl installed, and in summary the new behavior is:

  $ rm -rf build && meson setup build
      HTTPS               : NO
  $ patch -p1 <this.patch
  $ rm -rf build && meson setup build
      HTTPS               : YES
  $ rm -rf build && meson setup -Dhttps_backend=none build
      HTTPS               : NO

A future patch could also transform https_backend into curl subproject
default_options to avoid linking against a system openssl in a build
where it will never be used. I didn't implement that here as I didn't
want to bloat the meson build for a marginal, benign case.

Signed-off-by: Scott Linder <Scott.Linder@amd.com>
---
 meson.build | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/meson.build b/meson.build
index dd52efd1c87574..ebfeb727d7b5dc 100644
--- a/meson.build
+++ b/meson.build
@@ -1110,23 +1110,6 @@ else
   build_options_config.set('USE_LIBPCRE2', '')
 endif
 
-curl = dependency('libcurl', version: '>=7.21.3', required: get_option('curl'), default_options: ['default_library=static', 'tests=disabled', 'tool=disabled'])
-use_curl_for_imap_send = false
-if curl.found()
-  if curl.version().version_compare('>=7.34.0')
-    libgit_c_args += '-DUSE_CURL_FOR_IMAP_SEND'
-    use_curl_for_imap_send = true
-  endif
-
-  # Most executables don't have to link against libcurl, but we still need its
-  # include directories so that we can resolve LIBCURL_VERSION in "help.c".
-  libgit_dependencies += curl.partial_dependency(includes: true)
-  build_options_config.set('NO_CURL', '')
-else
-  libgit_c_args += '-DNO_CURL'
-  build_options_config.set('NO_CURL', '1')
-endif
-
 expat = dependency('expat', required: get_option('expat'), default_options: ['default_library=static', 'build_tests=false'])
 if expat.found()
   libgit_dependencies += expat
@@ -1547,6 +1530,23 @@ if https_backend != 'openssl'
   libgit_c_args += '-DNO_OPENSSL'
 endif
 
+curl = dependency('libcurl', version: '>=7.21.3', required: get_option('curl'), default_options: ['default_library=static', 'tests=disabled', 'tool=disabled'])
+use_curl_for_imap_send = false
+if curl.found()
+  if curl.version().version_compare('>=7.34.0')
+    libgit_c_args += '-DUSE_CURL_FOR_IMAP_SEND'
+    use_curl_for_imap_send = true
+  endif
+
+  # Most executables don't have to link against libcurl, but we still need its
+  # include directories so that we can resolve LIBCURL_VERSION in "help.c".
+  libgit_dependencies += curl.partial_dependency(includes: true)
+  build_options_config.set('NO_CURL', '')
+else
+  libgit_c_args += '-DNO_CURL'
+  build_options_config.set('NO_CURL', '1')
+endif
+
 if sha1_backend == 'sha1dc'
   libgit_c_args += '-DSHA1_DC'
   libgit_c_args += '-DSHA1DC_NO_STANDARD_INCLUDES=1'