From 96a53c4e977eac1969b0cc3b9770181a4a497538 Mon Sep 17 00:00:00 2001
From: Halil Durak <halildrk@gmail.com>
Date: Wed, 26 Nov 2025 10:27:25 +0300
Subject: [PATCH] add an option to build libcurl with BoringSSL

---
 build.zig     | 54 +++++++++++++++++++++++++++++++++++++++++----------
 build.zig.zon |  5 +++++
 2 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/build.zig b/build.zig
index 22ebb542..d50150e9 100644
--- a/build.zig
+++ b/build.zig
@@ -46,6 +46,8 @@ pub fn build(b: *Build) !void {
         b.option([]const u8, "git_commit", "Current git commit") orelse "dev",
     );
 
+    const use_boringssl = b.option(bool, "use-boringssl", "Whether use BoringSSL (default:false)") orelse false;
+
     const target = b.standardTargetOptions(.{});
     const optimize = b.standardOptimizeOption(.{});
 
@@ -59,7 +61,7 @@ pub fn build(b: *Build) !void {
         .link_libc = true,
         .link_libcpp = true,
     });
-    try addDependencies(b, lightpanda_module, opts);
+    try addDependencies(b, lightpanda_module, opts, use_boringssl);
 
     {
         // browser
@@ -67,7 +69,7 @@ pub fn build(b: *Build) !void {
 
         // compile and install
         const exe = b.addExecutable(.{
-            .name = "lightpanda",
+            .name = if (use_boringssl) "lightpanda-boringssl" else "lightpanda-mbedtls",
             .use_llvm = true,
             .root_module = lightpanda_module,
         });
@@ -113,7 +115,7 @@ pub fn build(b: *Build) !void {
             .target = target,
             .optimize = optimize,
         });
-        try addDependencies(b, wpt_module, opts);
+        try addDependencies(b, wpt_module, opts, use_boringssl);
 
         // compile and install
         const wpt = b.addExecutable(.{
@@ -151,7 +153,7 @@ pub fn build(b: *Build) !void {
     }
 }
 
-fn addDependencies(b: *Build, mod: *Build.Module, opts: *Build.Step.Options) !void {
+fn addDependencies(b: *Build, mod: *Build.Module, opts: *Build.Step.Options, use_boringssl: bool) !void {
     try moduleNetSurf(b, mod);
     mod.addImport("build_config", opts.createModule());
 
@@ -374,16 +376,39 @@ fn addDependencies(b: *Build, mod: *Build.Module, opts: *Build.Step.Options) !vo
             mod.addCMacro("STDC_HEADERS", "1");
             mod.addCMacro("TIME_WITH_SYS_TIME", "1");
             mod.addCMacro("USE_NGHTTP2", "1");
-            mod.addCMacro("USE_MBEDTLS", "1");
+            if (use_boringssl) {
+                mod.addCMacro("USE_OPENSSL", "1");
+                mod.addCMacro("OPENSSL_IS_BORINGSSL", "1");
+            } else {
+                mod.addCMacro("USE_MBEDTLS", "1");
+            }
             mod.addCMacro("USE_THREADS_POSIX", "1");
             mod.addCMacro("USE_UNIX_SOCKETS", "1");
         }
 
         try buildZlib(b, mod);
         try buildBrotli(b, mod);
-        try buildMbedtls(b, mod);
+        if (use_boringssl) {
+            const maybe_boringssl_dep = b.lazyDependency("boringssl-zig", .{
+                .target = target,
+                .optimize = mod.optimize.?,
+                .force_pic = true,
+            });
+
+            if (maybe_boringssl_dep) |boringssl_dep| {
+                const ssl = boringssl_dep.artifact("ssl");
+                ssl.bundle_ubsan_rt = false;
+                const crypto = boringssl_dep.artifact("crypto");
+                crypto.bundle_ubsan_rt = false;
+
+                mod.linkLibrary(ssl);
+                mod.linkLibrary(crypto);
+            }
+        } else {
+            try buildMbedtls(b, mod);
+        }
         try buildNghttp2(b, mod);
-        try buildCurl(b, mod);
+        try buildCurl(b, mod, use_boringssl);
         try buildAda(b, mod);
 
         switch (target.result.os.tag) {
@@ -674,7 +699,7 @@ fn buildNghttp2(b: *Build, m: *Build.Module) !void {
     } });
 }
 
-fn buildCurl(b: *Build, m: *Build.Module) !void {
+fn buildCurl(b: *Build, m: *Build.Module, use_boringssl: bool) !void {
     const curl = b.addLibrary(.{
         .name = "curl",
         .root_module = m,
@@ -842,13 +867,22 @@ fn buildCurl(b: *Build, m: *Build.Module) !void {
             root ++ "lib/vauth/spnego_sspi.c",
             root ++ "lib/vauth/vauth.c",
             root ++ "lib/vtls/cipher_suite.c",
-            root ++ "lib/vtls/mbedtls.c",
-            root ++ "lib/vtls/mbedtls_threadlock.c",
             root ++ "lib/vtls/vtls.c",
             root ++ "lib/vtls/vtls_scache.c",
             root ++ "lib/vtls/x509asn1.c",
         },
     });
+
+    curl.addCSourceFiles(.{
+        .files = if (use_boringssl) &.{
+            root ++ "lib/vtls/openssl.c",
+            root ++ "lib/vtls/hostcheck.c",
+            root ++ "lib/vtls/keylog.c",
+        } else &.{
+            root ++ "lib/vtls/mbedtls.c",
+            root ++ "lib/vtls/mbedtls_threadlock.c",
+        },
+    });
 }
 
 pub fn buildAda(b: *Build, m: *Build.Module) !void {
diff --git a/build.zig.zon b/build.zig.zon
index 736c94ec..639b0d4b 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -13,5 +13,10 @@
             .url = "https://github.com/ada-url/ada/releases/download/v3.3.0/singleheader.zip",
             .hash = "N-V-__8AAPmhFAAw64ALjlzd5YMtzpSrmZ6KymsT84BKfB4s",
         },
+        .@"boringssl-zig" = .{
+            .url = "git+https://github.com/Syndica/boringssl-zig.git#01b27c04e42cbb50173348bf2f225b2e223ef87a",
+            .hash = "boringssl-0.1.0-VtJeWehMAAA4RNnwRnzEvKcS9rjsR1QVRw1uJrwXxmVK",
+            .lazy = true,
+        },
     },
 }