atomic-desktops/tracker
19
4
Fork 0
Code Issues 57 Pull requests Activity

Consider shipping libcurl instead of libcurl-minimal #120

New issue
Closed
opened 2026-06-21 07:06:22 +00:00 by alexhaydock · 12 comments
alexhaydock commented 2026-06-21 07:06:22 +00:00
Copy link

Describe the enhancement

I've noticed that the version of libcurl shipped in the base Fedora Atomic images is libcurl-minimal. This filters all the way down the Atomic ecosystem including the UBlue, Bazzite, etc downstreams.

The result is that end users on these systems using curl (and whatever apps rely on system libcurl) aren't able to use some features - notably Brotli compression and HTTP/3 seem to be missing.

$ podman run --rm -it quay.io/fedora-ostree-desktops/silverblue:44 curl --version
curl 8.18.0 (x86_64-redhat-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.7 zlib/1.3.1.zlib-ng libidn2/2.3.8 nghttp2/1.68.0 mit-krb5/1.22.2
Release-Date: 2026-01-07
Protocols: file ftp ftps http https ipfs ipns
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz SPNEGO SSL threadsafe UnixSockets

Compare this to a regular Fedora container, which ships full libcurl instead of libcurl-minimal:

$ podman run --rm -it quay.io/fedora/fedora:44 curl --version
curl 8.18.0 (x86_64-redhat-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.7 zlib/1.3.1.zlib-ng brotli/1.2.0 libidn2/2.3.8 libpsl/0.21.5 libssh/0.12.0/openssl/zlib nghttp2/1.68.0 ngtcp2/1.22.1 nghttp3/1.16.0 mit-krb5/1.22.2 OpenLDAP/2.6.13
Release-Date: 2026-01-07
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets

I understand that libcurl-minimal describes itself as being "for minimal systems", so maybe there's engineering reasons why the Atomic upstream images currently ship the minimal version - but if the regular container is shipping full curl/libcurl then I can't see too many reasons why the bootable variant couldn't.

System details

  • quay.io/fedora-ostree-desktops/silverblue:44

Additional information

No response

### Describe the enhancement I've noticed that the version of `libcurl` shipped in the base Fedora Atomic images is `libcurl-minimal`. This filters all the way down the Atomic ecosystem including the UBlue, Bazzite, etc downstreams. The result is that end users on these systems using curl (and whatever apps rely on system `libcurl`) aren't able to use some features - notably Brotli compression and HTTP/3 seem to be missing. ```sh $ podman run --rm -it quay.io/fedora-ostree-desktops/silverblue:44 curl --version curl 8.18.0 (x86_64-redhat-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.7 zlib/1.3.1.zlib-ng libidn2/2.3.8 nghttp2/1.68.0 mit-krb5/1.22.2 Release-Date: 2026-01-07 Protocols: file ftp ftps http https ipfs ipns Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz SPNEGO SSL threadsafe UnixSockets ``` Compare this to a regular Fedora container, which ships full `libcurl` instead of `libcurl-minimal`: ```sh $ podman run --rm -it quay.io/fedora/fedora:44 curl --version curl 8.18.0 (x86_64-redhat-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.7 zlib/1.3.1.zlib-ng brotli/1.2.0 libidn2/2.3.8 libpsl/0.21.5 libssh/0.12.0/openssl/zlib nghttp2/1.68.0 ngtcp2/1.22.1 nghttp3/1.16.0 mit-krb5/1.22.2 OpenLDAP/2.6.13 Release-Date: 2026-01-07 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets ``` I understand that `libcurl-minimal` describes itself as being "for minimal systems", so maybe there's engineering reasons why the Atomic upstream images currently ship the minimal version - but if the regular container is shipping full curl/libcurl then I can't see too many reasons why the bootable variant couldn't. ### System details - quay.io/fedora-ostree-desktops/silverblue:44 ### Additional information _No response_
👍 2
siosm self-assigned this 2026-06-21 13:19:34 +00:00
siosm commented 2026-06-21 13:19:53 +00:00
Owner
Copy link

SGTM. I've made atomic-desktops/config#778. Let's see what the CI says.

SGTM. I've made https://forge.fedoraproject.org/atomic-desktops/config/pulls/778. Let's see what the CI says.
boniboyblue commented 2026-06-21 15:23:20 +00:00
Copy link

Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default

Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default
👍 1
alexhaydock commented 2026-06-21 15:31:36 +00:00
Author
Copy link

@boniboyblue

Looking at the rationale of the original decision, I can't say I disagree with it:

Those infrequently used protocols are less tested than the common ones and are a source of security bugs. Most users are not using those protocols anyway, so disabling them reduces the bug and attack surface.

I think this makes a lot of sense for the obscure protocols called out in the original decision (gopher, NTLM, POP3, etc). It's just a bit of a shame that libcurl-minimal is missing HTTP/3 support, which was my main area of concern here.

I do note that HTTP/3 was only added to the spec as of Dec 2025 even for full curl. I wonder if a better route might be for me to file an enhancement against the curl package to propose adding just HTTP/3 into the libcurl-minimal build.

@boniboyblue Looking at the rationale of the original decision, I can't say I disagree with it: > Those infrequently used protocols are less tested than the common ones and are a source of security bugs. Most users are not using those protocols anyway, so disabling them reduces the bug and attack surface. I think this makes a lot of sense for the obscure protocols called out in the original decision (gopher, NTLM, POP3, etc). It's just a bit of a shame that `libcurl-minimal` is missing HTTP/3 support, which was my main area of concern here. I do note that HTTP/3 was only added to the spec as of Dec 2025 even for full curl. I wonder if a better route might be for me to file an enhancement against the curl package to propose adding just HTTP/3 into the `libcurl-minimal` build.
alexhaydock commented 2026-06-21 16:47:46 +00:00
Author
Copy link

Based on the above discussion, I'm closing this in favour of a report against the curl package itself: https://bugzilla.redhat.com/show_bug.cgi?id=2491199

I might reopen this one if that proposal gets rejected though, to discuss further here.

Based on the above discussion, I'm closing this in favour of a report against the `curl` package itself: https://bugzilla.redhat.com/show_bug.cgi?id=2491199 I might reopen this one if that proposal gets rejected though, to discuss further here.
siosm commented 2026-06-21 18:44:08 +00:00
Owner
Copy link

Thanks for finding the change proposal. I had missed it.

Thanks for finding the change proposal. I had missed it.
decathorpe commented 2026-06-21 19:17:49 +00:00
Copy link

Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default

Note: ChangePageIncomplete. The Change linked above wasn't implemented.

> Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default Note: ChangePageIncomplete. The Change linked above wasn't implemented.
👍 1
boniboyblue commented 2026-06-21 20:03:01 +00:00
Copy link

@decathorpe wrote in #120 (comment):

Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default

Note: ChangePageIncomplete. The Change linked above wasn't implemented.

You're right - I just checked the FESCO ticket and it was rejected.

@decathorpe wrote in https://forge.fedoraproject.org/atomic-desktops/tracker/issues/120#issuecomment-825687: > > Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > Note: ChangePageIncomplete. The Change linked above wasn't implemented. You're right - I just checked the FESCO ticket and it was rejected.
alexhaydock commented 2026-06-21 20:52:58 +00:00
Author
Copy link

In that case, I'll leave it up to the folk on the thread whether we should reopen this one and treat it as a bug or RFE to be implemented. After all, it is quite interesting that there's a difference between these containers and the regular Fedora ones. Not sure whether that's intentional.

For my own purposes though I think my needs might actually be better served by that upstream bug trying to just add HTTP/3 to the minimal package - which also seems like a reasonable approach.

In that case, I'll leave it up to the folk on the thread whether we should reopen this one and treat it as a bug or RFE to be implemented. After all, it is quite interesting that there's a difference between these containers and the regular Fedora ones. Not sure whether that's intentional. For my own purposes though I think my needs might actually be better served by that upstream bug trying to just add HTTP/3 to the minimal package - which also seems like a reasonable approach.
👍 3
siosm commented 2026-06-22 15:12:44 +00:00
Owner
Copy link

@decathorpe wrote in #120 (comment):

Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default

Note: ChangePageIncomplete. The Change linked above wasn't implemented.

Damned, I had missed that. I've added the rejected banner to the page.

@decathorpe wrote in https://forge.fedoraproject.org/atomic-desktops/tracker/issues/120#issuecomment-825687: > > Will this not require a change proposal similar to the original decision?: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default > > Note: ChangePageIncomplete. The Change linked above wasn't implemented. Damned, I had missed that. I've added the rejected banner to the page.
siosm commented 2026-06-22 15:20:17 +00:00
Owner
Copy link

I don't really know why the minimal build is picked over the full one.

We likely don't need the full set of features from curl in the Atomic Desktops as this is a command line tool and command line users can install tools using containers/toolbox/etc.

So in the end I would prefer that the minimal build be extended to support HTTP3 but short term we can include the full build as it's not that much bigger and it only pulls down a couple more libraries.

I don't really know why the minimal build is picked over the full one. We likely don't need the full set of features from curl in the Atomic Desktops as this is a command line tool and command line users can install tools using containers/toolbox/etc. So in the end I would prefer that the minimal build be extended to support HTTP3 but short term we can include the full build as it's not that much bigger and it only pulls down a couple more libraries.
siosm reopened this issue 2026-06-22 15:20:51 +00:00
siosm commented 2026-08-19 06:26:18 +00:00
Owner
Copy link

https://bugzilla.redhat.com/show_bug.cgi?id=2491199 has been closed so we should consider switching to the full curl build for now until this change is brought back as not having HTTP3 support is not great if this also impacts other system apps linking to curl and not just the command line.

https://bugzilla.redhat.com/show_bug.cgi?id=2491199 has been closed so we should consider switching to the full curl build for now until this change is brought back as not having HTTP3 support is not great if this also impacts other system apps linking to curl and not just the command line.
siosm closed this issue 2026-09-25 04:32:27 +00:00
siosm commented 2026-09-27 20:27:42 +00:00
Owner
Copy link

Fixed in Rawhide & F45.

Fixed in Rawhide & F45.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
docs
Related to the documentation or needs documentation

  
kind
bug
 Bug

  
kind
enhancement
 Enhancement

  
kind
package-request
 New package request

  
packaging
Issue related to or requiring changes in Fedora packages

  
release
f40
 Related to or impacting Fedora 40

  
release
f41
 Related to or impacting Fedora 41

  
release
f42
 Related to or impacting Fedora 42

  
release
f43
 Related to or impacting Fedora 43

  
release
f44
 Related to or impacting Fedora 44

  
release
f45
 Related to or impacting Fedora 45

  
release/rawhide
Related to or impacting Fedora Rawhide

  
upstream
Issue should be filed upstream

No labels
docs
kind
bug
kind
enhancement
kind
package-request
packaging
release
f40
release
f41
release
f42
release
f43
release
f44
release
f45
release/rawhide
upstream
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
siosm
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
atomic-desktops/tracker#120
No description provided.