[MacPorts] #51516: MacPorts should use a bundled copy of a newer libcurl and SSL library rather than the OS X version

[MacPorts]

#51516: MacPorts should use a bundled copy of a newer libcurl and SSL library
rather than the OS X version
--------------------------+--------------------------------
  Reporter:  ryandesign   |      Owner:  macports-tickets@…
      Type:  enhancement  |     Status:  new
  Priority:  Normal       |  Milestone:  MacPorts Future
 Component:  base         |    Version:
Resolution:               |   Keywords:
      Port:               |
--------------------------+--------------------------------

Comment (by noloader):

 Replying to [comment:73 danielluke]:
 > Replying to [comment:72 devernay]:
 > > I would even consider it a security issue at this point, since "All
 older versions [of openssl] (including 1.1.0, 1.0.2, 1.0.0 and 0.9.8) are
 now out of support and should not be used." - from
 https://www.openssl.org/source/
 > >
 > > Any software that currently ships (including MacPorts) should not use
 any of these versions, and thus not use the system's curl on older
 systems.
 >
 > The security issue is trying to run an old, unsupported macOS version
 that is no longer receiving patches from Apple. If you insist on doing
 that, you can work-around it. I don't think MacPorts should be in the
 business of providing OS patches after Apple stops, and I don't think it
 should be in the business of encouraging people to run obsolete OS
 versions.

 I don't think this position is correct. Macports specifically supports
 older versions of Apple hardware and software. Ken regularly works on
 support for the PowerPC machines, and I use the Macports support for the
 old hardware on my PowerMacs. The FAQ also includes discussions of older
 versions of OS X.

 From the FAQ under "Why do I have to install xorg-* ports?"
 (https://trac.macports.org/wiki/FAQ#x11-libs):

     This [x11 client] allows for more consistent support for
     older machines which are not as up to date (especially Tiger
     which doesn't have a pkg-config compatible X11 SDK). Most
     X11 packages in MacPorts are newer than those shipped by
     Apple and usually reflect the latest work from the ​XQuartz
     Project.

-- 
Ticket URL: <https://trac.macports.org/ticket/51516#comment:77>
MacPorts <https://www.macports.org/>
Ports system for macOS