Fedora Account System
Red Hat Associate
Red Hat Customer
Fedora, when installed with libcurl-minimal instead of full libcurl, is not capable of HTTP/3 connectivity in curl and other apps that depend on libcurl. This is the package that is shipped by default in Fedora Atomic images (see: https://forge.fedoraproject.org/atomic-desktops/tracker/issues/120) and I assume traditional Fedora desktop images too, based on: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default Based on the wording of that change request above, much of the motivation here centres around security and a desire not to ship the attack surface associated with obsolete and rarely-used protocols: "Those infrequently used protocols are less tested than the common ones and are a source of security bugs. Most users are not using those protocols anyway, so disabling them reduces the bug and attack surface." I'd argue that this makes sense for protocols like Gopher, LDAP, POP3 etc. But maybe not so much for HTTP/3, which I think an end-user would reasonably expect to be available by default on a distro like Fedora. Reproducible: Always Steps to Reproduce: 1.podman run --rm -it quay.io/fedora-ostree-desktops/silverblue:44 curl --version 2.podman run --rm -it quay.io/fedora-ostree-desktops/silverblue:44 curl --http3-only https://google.com Actual Results: 1. curl output does not show `HTTP3` 2. `curl: option --http3-only: the installed libcurl version does not support this` Expected Results: 1. curl version output should show `HTTP3` if HTTP/3 is supported 2. This should work Additional Information: Note that I am using the Fedora Atomic Silverblue container in my example above because interestingly the regular Fedora container does actually ship full libcurl. But this can be reproduced on any system with libcurl-minimal. Edit: It's been brought to my attention that the Fedora change proposal to ship `libcurl-minimal` as the default version didn't actually pass, so it's possible that the fact the Atomic Fedora distributions are shipping the minimal package is unintentional. I do think my point here stands though that if `libcurl-minimal` is going to support HTTP, then I think it's reasonable to expect that to include all current versions of HTTP.
We recently added support for HTTP/3 to the curl RPM[1]. I understand your point, but I would like to wait a bit to see how many issues and CVEs it might bring. The original idea behind curl minimal subpackages is still valid. Curl is by default available in every image, so we want as minimal a footprint as possible to avoid excessive amounts of CVEs (especially in an era when everybody is trying to use AI to find new vulnerabilities). I'll close this issue for now. [1] - https://src.fedoraproject.org/rpms/curl/pull-request/61