Fedora Looks To Lighten Its Default Curl Packages

[phoronix]

Phoronix: Fedora Looks To Lighten Its Default Curl Packages

While curl and the cURL library are most commonly used for HTTP(S) and FTP usage, this widely-used software also supports a plethora of other network protocols. In order to save disk space by default and also exposing its cURL packages to less security bugs by default, Fedora is looking at shipping "minimal" versions by default of its cURL packages...

https://www.phoronix.com/scan.php?page=news_item&px=Fedora-Minimal-Curl-Default

[dEnigma]

In order to save disk space by default and also exposing its cURL packages to less security bugs by default, Fedora is looking at shipping "minimal" versions by default of its cURL packages.

A change proposal has been submitted for Fedora 37 that would use libcurl-minimal and curl-minimal packages by default.

That part could do with some stripping of its defaults too

[xxmitsu]

Exactly the thing I was looking for few days ago when I wanted to create a thin docker image..

[WizardGed]

This will be a pain, curl is like a Swiss army knife when dealing with networking/application issues especially in containers and curl is one of the few things I can expect in a container. I'm sure there are security benefits but for those that rely on containers from RedHat for base images that they do not modify, this will get annoyingly painful fast.

[MadeUpName]

I had no idea all that was in Curl. Making some of that optional would seem to make sense.

[coder]

I've definitely had the experience of noticing support for something in curl and I'm like WTF?? It's sometimes as if the maintainers are just looking to shoehorn everything in it they possibly can.

With that said, I sorta like the async API. It could be a little better designed, but it's nice at least to have it.

Many years ago, I had occasion to compare it with libneon, and was shocked to learn that neon was decisively faster (i.e. lower CPU overhead) at plain old HTTP. Not a big deal for most, but sometimes for some...

[uxmkt]

So.. by stripping down libcurl, applications suddenly get different behavior, and they don't necessarily know which libcurl they've got to begin with. And curl is "just" 700 KB or thereabouts. Frankly, the world would be better off if chromium, firefox et al would have their NIH protocol libraries pulled and replaced by a globally-used component (such as, but not limited to, libcurl).

[johanb]

Many of those protocols sound pretty useful. But considering that they are likely not used by many packages it sounds like a sane default to not ship support for them all.

[debrouxl]

That list of "semi-obsolete protocols and infrequently-used features" definitely contains multiple such protocols (say, DICT, GOPHER or SCP), but SFTP caught my eye: it's neither obsolete, nor infrequently used in general.

[BwackNinja]

That list of "semi-obsolete protocols and infrequently-used features" definitely contains multiple such protocols (say, DICT, GOPHER or SCP), but SFTP caught my eye: it's neither obsolete, nor infrequently used in general.

But when have you ever thought about sftp'ing a file using curl?