Fix lcurl dependency

Do not depend on homebrew. Use static OpenSSL with bundled CA

Author: stevschmid

.github/workflows/build-macos.yml

@@ -45,6 +45,10 @@ jobs:
           key: vcpkg-${{ hashFiles('SimpleGraphic/vcpkg.json', 'SimpleGraphic/vcpkg-configuration.json', 'vcpkg-triplets/arm64-osx-pob.cmake') }}
           restore-keys: vcpkg-
 
+      # Stop pkg-config from leaking Homebrew's openssl into the curl build.
+      - name: Isolate from Homebrew
+        run: echo "PKG_CONFIG_PATH=" >> $GITHUB_ENV
+
       - name: Configure
         run: >
           cmake -B build -DCMAKE_BUILD_TYPE=Release

.github/workflows/release-macos.yml

@@ -63,6 +63,10 @@ jobs:
           rm "$CERT_FILE"
           echo "CODESIGN_KEYCHAIN=$KEYCHAIN" >> "$GITHUB_ENV"
 
+      # Stop pkg-config from leaking Homebrew's openssl into the curl build.
+      - name: Isolate from Homebrew
+        run: echo "PKG_CONFIG_PATH=" >> $GITHUB_ENV
+
       - name: Configure
         run: >
           cmake -B build -DCMAKE_BUILD_TYPE=Release

CMakeLists.txt

@@ -140,6 +140,24 @@ install(CODE "
     endforeach()
 ")
 
+# ----- CA bundle for libcurl TLS validation -----
+# Ship Mozilla's CA bundle (the standard cacert.pem from curl.se) so libcurl
+# can validate HTTPS certs without depending on Homebrew or the user's system
+# state. Cached in the build dir; refresh by deleting the file before
+# configuring.
+set(POB_CACERT "${CMAKE_BINARY_DIR}/cacert.pem")
+if (NOT EXISTS "${POB_CACERT}")
+    file(DOWNLOAD https://curl.se/ca/cacert.pem "${POB_CACERT}"
+        TLS_VERIFY ON
+        STATUS _cacert_dl_status
+        SHOW_PROGRESS)
+    list(GET _cacert_dl_status 0 _cacert_dl_code)
+    if (NOT _cacert_dl_code EQUAL 0)
+        message(FATAL_ERROR "Failed to download cacert.pem: ${_cacert_dl_status}")
+    endif()
+endif()
+install(FILES "${POB_CACERT}" DESTINATION "${POB_RES_DEST}")
+
 # ----- Bundle the PoB Lua tree -----
 if (EXISTS "${POB_LUA_TREE}/src/Launch.lua")
     install(DIRECTORY "${POB_LUA_TREE}/src"

SimpleGraphic

@@ -286,6 +286,13 @@ int main(int argc, char** argv)
         // its own cfg files and imgui.ini away from basePath.
         setenv("POB_MAC_USER_DIR", appSupport->c_str(), 1);
 
+        // Point OpenSSL (libcurl's TLS backend) at the bundled Mozilla CA
+        // list. libcurl's OpenSSL backend calls SSL_CTX_set_default_verify_paths
+        // when no CAINFO is set on the easy handle, which honors SSL_CERT_FILE.
+        char caPath[PATH_MAX];
+        std::snprintf(caPath, sizeof(caPath), "%s/cacert.pem", bundleResourcesAbs);
+        setenv("SSL_CERT_FILE", caPath, 1);
+
         const fs::path appSrcPath = *appSupport / "src";
 
         // Prefer mac_entry.lua (the bootstrap that patches the in-app