gentoo auto-resync : 03:04:2025 - 01:34:01

4 files changed, 260 insertions, 173 deletions

diff --git a/net-misc/curl/Manifest b/net-misc/curl/Manifest
index 254ec6e9a749..761377dc552a 100644
--- a/net-misc/curl/Manifest
+++ b/net-misc/curl/Manifest
@@ -6,10 +6,10 @@ DIST curl-8.11.1.tar.xz 2751236 BLAKE2B a87ec2c78c5d6daf44eee4cf8e3ed124849d067f
 DIST curl-8.11.1.tar.xz.asc 488 BLAKE2B 53d58ebb8ab722d8394b7ce94b646c876324cd89b3e47d9129bddcfbb6db338c1dbe93a5e72a25caf7be9ddd450c2b0832cfee17beb8ba701bdeefe653235d53 SHA512 c09bedb67e83fb8ca3ad73c5bd0d92fed7fc2c26dbe5a71cccb193fd151c7219713241a9fe74baefcd1d008cfafba78142bf04cec24dd4a88d67179184d35824
 DIST curl-8.12.1.tar.xz 2768160 BLAKE2B 2b3e3d91041881c0951ad470736266105d3b9720440b808fe382baa493a30075aba52eb1d329fb1f148e27cd76290d82e121e7f4abf695f215456a10e26ade3e SHA512 88915468fa1bb7256e3dd6c9d058ada6894faa1e3e7800c7d9bfee3e8be4081ae57e7f2bf260c5342b709499fc4302ddc2d7864e25bfa3300fa07f118a3de603
 DIST curl-8.12.1.tar.xz.asc 488 BLAKE2B 2a6563609c9f7ada84ca2c7048ad9406809eef4cc958760d2ab3d1b7be58d26247e579bd025870609e80ebb00295026aae30614b84e3a81bdf3ed3dbd0f5ed70 SHA512 41fc5582935090d13940d86974fdea3ea901dd5dab156c16029a87f811d2535172c59dc8dc366f2ffc37bcf85accbecb5aa765bc7b83c2991a3ef402bf25af69
-DIST curl-8.13.0-rc3.tar.xz 2792136 BLAKE2B af18c877ca6e9fb3e75265f86b3f3416e12b4160b71de00dfb82d687f11f457faf2f7dddde557474631ac7148cada1add189ac4ed002c41745bd546309093312 SHA512 72c0e0b8b0bc9117ab911b97bab6b1502d877f5a72a34091b68e48c046e45dfd188f24f270c0200f4df3f1a70933ada00f3a73a0aa078ec2b125fa5a9294d33f
-DIST curl-8.13.0-rc3.tar.xz.asc 488 BLAKE2B 8778af342578bace6ddea93c719fb74b8a9b85ffb53938f46888c48cb9eef53bd018b4df421c2ceaecae5a8058a32b3b058e7965ba8b092eb17fef69168ab3f4 SHA512 a2d94a898824fabc1c4834f9e5719fb65311d0f218f6170e80fe1a04c6f842f9fbf589d281767ab916f668ff7087bb318b819a1fb26790640df136f335ff3b99
+DIST curl-8.13.0.tar.xz 2773628 BLAKE2B 6869634ad50f015d5c7526699034d5a3f27d9588bc32eacc8080dbd6c690f63b1f25cee40d3fdf8fd9dd8535c305ea9c5edf1d5a02bc6d9ce60fd8c88230aca0 SHA512 d266e460f162ee455b56726e5b7247b2d1aa5265ae12081513fc0c5c79e785a594097bc71d505dc9bcd2c2f6f1ff6f4bab9dbd9d120bb76d06c5be8521a8ca7d
+DIST curl-8.13.0.tar.xz.asc 488 BLAKE2B bd568ec32a44ef7c14c38e4830bcc7711dac726e950325292f1e5de76e619839685300c5afac32330127324327e71ce0d6e574f6e95bcc4a48957345152bc86a SHA512 07f79c7fd7c305c96e10a5f52797254aed7d2a1f3577c8626b8d617855ceb82634ac6787bfa0b7130a4ed72c3a9945d3c9ba5b7be54df8bafa07ded1c62ef2be
 EBUILD curl-8.11.1-r2.ebuild 11438 BLAKE2B 23fbba450554c39092a7e6b7a907f4720ca9407fceddd00dfccc4c7517c39f458365ec1e8ca74fb4f1cfe8033ba0a484d0d9a8537fd87a8ee029ad427aa9ae67 SHA512 12449882676c24b4929db4ab9fb7ce77ffd41e00e4091f7835c0434d25e1dfa613cc1d86e65ac1fc072f05d6a3aac671366727f1d04a09f48bde3af8747d013c
 EBUILD curl-8.12.1.ebuild 11629 BLAKE2B 3de0fe436f0d733fd18a93911678c4383a33cb8600ffb9e3739ce1763712971631bc410da11489ab992887c70706d83235cd214f5c03076280c999cdb1ffc05e SHA512 5536f39147536ae064d4613fb7bc76afde032d1e175355c9236838c15341df6f4a38869c4c5341f8524c522c376552e0e28b5017e428e984ef3f7fe25879935b
-EBUILD curl-8.13.0_rc3.ebuild 11758 BLAKE2B 4d0d0dcf1ebb5dcd3f922787a9769216aa3929b6383b6bd06cfb0fb20d12044265eb664a11f4d4ccca55d2d6ca37471165e4517c6faa397b89191d0a843232af SHA512 f96981715290d79319451e9438fe71898463dc8053ce72d9ccb5ad8588aeb4b552058e3cd9eba30de578cf7434aea4e8002e545ed7642d05c42b4f83e1bc3e67
-EBUILD curl-9999.ebuild 11758 BLAKE2B 4d0d0dcf1ebb5dcd3f922787a9769216aa3929b6383b6bd06cfb0fb20d12044265eb664a11f4d4ccca55d2d6ca37471165e4517c6faa397b89191d0a843232af SHA512 f96981715290d79319451e9438fe71898463dc8053ce72d9ccb5ad8588aeb4b552058e3cd9eba30de578cf7434aea4e8002e545ed7642d05c42b4f83e1bc3e67
-MISC metadata.xml 2129 BLAKE2B 89432da852617c89e67c8927a7dddf43a4b69753b201623a7d94071724bc1dd9a936cfabfce6cb224700a47d33257f4945bbb695bfde5d20b9fd4796bd712242 SHA512 8ac6fa9535920904ff70c5cadf1fe28b1e806deff5b37a5a326e9ec25d6c54cc1bf2ecbfd8843af34b26dbe270a1a3ac3ca8ec8730d62180af8237fae5ba255a
+EBUILD curl-8.13.0.ebuild 12884 BLAKE2B 67afaa65d36face2d44b5f2f425eb3a6ffbe9b3dc689c239c3ebb6800377a313099c1bbe9484ed563e0b2a4858436e221a36a3d6a33b41e21d4bb557ea703328 SHA512 f9d6085ecad1ae293bcadb9da861235ccd5865ba064e2c897426b4673f661e6dffcd6af7ff971f4a1a0cedb53caad96285ca3a16ba25ada7665ae28e54358c36
+EBUILD curl-9999.ebuild 12884 BLAKE2B 67afaa65d36face2d44b5f2f425eb3a6ffbe9b3dc689c239c3ebb6800377a313099c1bbe9484ed563e0b2a4858436e221a36a3d6a33b41e21d4bb557ea703328 SHA512 f9d6085ecad1ae293bcadb9da861235ccd5865ba064e2c897426b4673f661e6dffcd6af7ff971f4a1a0cedb53caad96285ca3a16ba25ada7665ae28e54358c36
+MISC metadata.xml 2392 BLAKE2B b00c099dddba47b3873118bde600d5ef994b35a8b0a95f3e3186f749f5fe2e31f5c5f7d52266e664c81919323b5da7c583a7666ecc1d99d0b09f8d7ca20cf1b9 SHA512 eb435d7f6fe61b7154461a0c280d7c84049a8ebdc0dd2fdd529f784072d66dacb3b20bea7437979247b002bf6f7de336e32cde0fad1b5ff1ab1198896e42a1d6
diff --git a/net-misc/curl/curl-8.13.0_rc3.ebuild b/net-misc/curl/curl-8.13.0.ebuild
index 5af80a37e9b1..bdceb348fcc7 100644
--- a/net-misc/curl/curl-8.13.0_rc3.ebuild
+++ b/net-misc/curl/curl-8.13.0.ebuild
@@ -32,17 +32,29 @@ fi
 
 LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
-IUSE="+adns +alt-svc brotli debug +ftp gnutls gopher +hsts +http2 +http3 idn +imap kerberos ldap mbedtls +openssl +pop3"
-IUSE+=" +psl +progress-meter +quic rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp +websockets zstd"
+IUSE="+adns +alt-svc brotli debug ech +ftp gnutls gopher +hsts +http2 +http3 +httpsrr idn +imap kerberos ldap"
+IUSE+=" mbedtls +openssl +pop3 +psl +quic rtmp rustls samba sasl-scram +smtp ssh ssl static-libs test"
+IUSE+=" telnet +tftp +websockets zstd"
 # These select the default tls implementation / which quic impl to use
 IUSE+=" +curl_quic_openssl curl_quic_ngtcp2 curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
 RESTRICT="!test? ( test )"
 
+# HTTPS RR is technically usable with the threaded resolver, but it still uses c-ares to
+# ask for the HTTPS RR record type; if DoH is in use the HTTPS record will be requested
+# in addition to A and AAAA records.
+
+# To simplify dependency management in the ebuild we'll require c-ares for HTTPS RR (for now?).
+# HTTPS RR in cURL is a dependency for:
+# - ECH (requires patched openssl or gnutls currently, enabled with rustls)
+# - Fetching the ALPN list which should provide a better HTTP/3 experience.
+
 # Only one default ssl / quic provider can be enabled
 # The default provider needs its USE satisfied
 # HTTP/3 and MultiSSL are mutually exclusive; it's not clear if MultiSSL offers any benefit at all in the modern day.
 # https://github.com/curl/curl/commit/65ece771f4602107d9cdd339dff4b420280a2c2e
 REQUIRED_USE="
+	ech? ( rustls )
+	httpsrr? ( adns )
 	quic? (
 		^^ (
 			curl_quic_openssl
@@ -77,7 +89,7 @@ REQUIRED_USE="
 	curl_ssl_mbedtls? ( mbedtls )
 	curl_ssl_openssl? ( openssl )
 	curl_ssl_rustls? ( rustls )
-	http3? ( alt-svc quic )
+	http3? ( alt-svc httpsrr quic )
 "
 
 # cURL's docs and CI/CD are great resources for confirming supported versions
@@ -104,6 +116,7 @@ RDEPEND="
 	)
 	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
 	ssh? ( >=net-libs/libssh2-1.2.8[${MULTILIB_USEDEP}] )
+	sasl-scram? ( >=net-misc/gsasl-2.2.0[static-libs?,${MULTILIB_USEDEP}] )
 	ssl? (
 		gnutls? (
 			app-misc/ca-certificates
@@ -115,10 +128,10 @@ RDEPEND="
 			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
 		)
 		openssl? (
-			>=dev-libs/openssl-1.0.2:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+			>=dev-libs/openssl-1.0.2:=[static-libs?,${MULTILIB_USEDEP}]
 		)
 		rustls? (
-			>=net-libs/rustls-ffi-0.14.0:=[${MULTILIB_USEDEP}]
+			>=net-libs/rustls-ffi-0.15.0:=[${MULTILIB_USEDEP}]
 		)
 	)
 	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
@@ -173,6 +186,57 @@ src_prepare() {
 	eautoreconf
 }
 
+# Generates TLS-related configure options based on USE flags.
+# Outputs options suitable for appending to a configure options array.
+_get_curl_tls_configure_opts() {
+	local tls_opts=()
+
+	local backend flag_name
+	for backend in gnutls mbedtls openssl rustls; do
+		if [[ "$backend" == "openssl" ]]; then
+			flag_name="ssl"
+			tls_opts+=( "--with-ca-path=${EPREFIX}/etc/ssl/certs")
+		else
+			flag_name="$backend"
+		fi
+
+		if use "$backend"; then
+			tls_opts+=( "--with-${flag_name}" )
+		else
+			# If a single backend is enabled, 'ssl' is required, openssl is the default / fallback
+			if ! [[ "$backend" == "openssl" ]]; then
+				tls_opts+=( "--without-${flag_name}" )
+			fi
+		fi
+	done
+
+	if use curl_ssl_gnutls; then
+		multilib_is_native_abi && einfo "Default TLS backend: gnutls"
+		tls_opts+=( "--with-default-ssl-backend=gnutls" )
+	elif use curl_ssl_mbedtls; then
+		multilib_is_native_abi && einfo "Default TLS backend: mbedtls"
+		tls_opts+=( "--with-default-ssl-backend=mbedtls" )
+	elif use curl_ssl_openssl; then
+		multilib_is_native_abi && einfo "Default TLS backend: openssl"
+		tls_opts+=( "--with-default-ssl-backend=openssl" )
+	elif use curl_ssl_rustls; then
+		multilib_is_native_abi && einfo "Default TLS backend: rustls"
+		tls_opts+=( "--with-default-ssl-backend=rustls" )
+	else
+		eerror "We can't be here because of REQUIRED_USE."
+		die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+	fi
+
+	# Explicitly Disable unimplemented b
+	tls_opts+=(
+		--without-amissl
+		--without-bearssl
+		--without-wolfssl
+	)
+
+	printf "%s\n" "${tls_opts[@]}"
+}
+
 multilib_src_configure() {
 	# We make use of the fact that later flags override earlier ones
 	# So start with all ssl providers off until proven otherwise
@@ -181,128 +245,107 @@ multilib_src_configure() {
 
 	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
 	if use ssl; then
-		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
-
-		if use gnutls; then
-			multilib_is_native_abi && einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls; then
-			multilib_is_native_abi && einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use openssl; then
-			multilib_is_native_abi && einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls; then
-			multilib_is_native_abi && einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-		if use curl_ssl_gnutls; then
-			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_openssl; then
-			multilib_is_native_abi && einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			multilib_is_native_abi && einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
-		fi
-
+		local -a tls_backend_opts
+		readarray -t tls_backend_opts < <(_get_curl_tls_configure_opts)
+		myconf+=("${tls_backend_opts[@]}")
 	else
 		myconf+=( --without-ssl )
 		einfo "SSL disabled"
 	fi
 
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+	# These configuration options are organised alphabetically by category/type
 
+	# Protocols
+	# `grep SUPPORT_PROTOCOLS=\" configure.ac | awk '{ print substr($2, 1, length($2)-1)}' | sort`
+	# Assume that anything omitted (that is not new!) is enabled by default with no deps
 	myconf+=(
-		$(use_enable alt-svc)
-		--enable-basic-auth
-		--enable-bearer-auth
-		--enable-digest-auth
-		--enable-kerberos-auth
-		--enable-negotiate-auth
-		--enable-aws
-		--enable-dict
-		--disable-ech
 		--enable-file
 		$(use_enable ftp)
 		$(use_enable gopher)
-		$(use_enable hsts)
 		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
+		$(use_enable imap) # Automatic IMAPS if TLS is enabled
 		$(use_enable ldap ldaps)
-		--enable-ntlm
+		$(use_enable ldap)
 		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
 		$(use_enable samba smb)
-		$(use_with ssh libssh2)
+		$(use_with ssh libssh2) # enables scp/sftp
+		$(use_with rtmp librtmp)
+		--enable-rtsp
 		$(use_enable smtp)
 		$(use_enable telnet)
 		$(use_enable tftp)
-		--enable-tls-srp
+		$(use_enable websockets)
+	)
+
+	# Keep various 'HTTP-flavoured' options together
+	myconf+=(
+		$(use_enable alt-svc)
+		$(use_enable hsts)
+		$(use_enable httpsrr)
+		$(use_with http2 nghttp2)
+		$(use_with http3 nghttp3)
+		$(use_with curl_quic_ngtcp2 ngtcp2)
+		$(use_with curl_quic_openssl openssl-quic)
+	)
+
+	# --enable/disable options
+	# `grep -- --enable configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
 		$(use_enable adns ares)
+		--enable-aws
+		--enable-basic-auth
+		--enable-bearer-auth
 		--enable-cookies
 		--enable-dateparse
+		--enable-dict
+		--enable-digest-auth
 		--enable-dnsshuffle
 		--enable-doh
-		--enable-symbol-hiding
+		$(use_enable ech)
 		--enable-http-auth
 		--enable-ipv6
+		--enable-kerberos-auth
 		--enable-largefile
 		--enable-manual
 		--enable-mime
+		--enable-negotiate-auth
 		--enable-netrc
-		$(use_enable progress-meter)
+		--enable-ntlm
+		--enable-progress-meter
 		--enable-proxy
+		--enable-rt
 		--enable-socketpair
 		--disable-sspi
 		$(use_enable static-libs static)
+		--enable-symbol-hiding
+		--enable-tls-srp
 		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
+	)
+
+	# --with/without options
+	# `grep -- --with configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
 		$(use_with brotli)
 		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
-		$(use_with http2 nghttp2)
 		$(use_with idn libidn2)
 		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
+		$(use_with sasl-scram libgsasl)
 		$(use_with psl libpsl)
 		--without-msh3
-		$(use_with http3 nghttp3)
-		$(use_with curl_quic_ngtcp2 ngtcp2)
-		$(use_with curl_quic_openssl openssl-quic)
 		--without-quiche
-		$(use_with rtmp librtmp)
 		--without-schannel
 		--without-secure-transport
-		--without-test-caddy
-		--without-test-httpd
-		--without-test-nghttpx
-		$(use_enable websockets)
 		--without-winidn
-		--without-wolfssl
 		--with-zlib
-		$(use_with zstd)
 		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+		$(use_with zstd)
+	)
+
+	# Test deps (disabled)
+	myconf+=(
+		--without-test-caddy
+		--without-test-httpd
+		--without-test-nghttpx
 	)
 
 	if use debug; then
@@ -319,8 +362,7 @@ multilib_src_configure() {
 
 	# Since 8.12.0 adns/c-ares and the threaded resolver are mutually exclusive
 	# This is in support of some work to enable `httpsrr` to use adns and the rest
-	# of curl to use the threaded resolver; we'll just make `httpsrr` conditional on adns
-	# when the time comes.
+	# of curl to use the threaded resolver; for us `httpsrr` is conditional on adns.
 	if use adns; then
 		myconf+=(
 			--disable-threaded-resolver
diff --git a/net-misc/curl/curl-9999.ebuild b/net-misc/curl/curl-9999.ebuild
index 5af80a37e9b1..bdceb348fcc7 100644
--- a/net-misc/curl/curl-9999.ebuild
+++ b/net-misc/curl/curl-9999.ebuild
@@ -32,17 +32,29 @@ fi
 
 LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
-IUSE="+adns +alt-svc brotli debug +ftp gnutls gopher +hsts +http2 +http3 idn +imap kerberos ldap mbedtls +openssl +pop3"
-IUSE+=" +psl +progress-meter +quic rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp +websockets zstd"
+IUSE="+adns +alt-svc brotli debug ech +ftp gnutls gopher +hsts +http2 +http3 +httpsrr idn +imap kerberos ldap"
+IUSE+=" mbedtls +openssl +pop3 +psl +quic rtmp rustls samba sasl-scram +smtp ssh ssl static-libs test"
+IUSE+=" telnet +tftp +websockets zstd"
 # These select the default tls implementation / which quic impl to use
 IUSE+=" +curl_quic_openssl curl_quic_ngtcp2 curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
 RESTRICT="!test? ( test )"
 
+# HTTPS RR is technically usable with the threaded resolver, but it still uses c-ares to
+# ask for the HTTPS RR record type; if DoH is in use the HTTPS record will be requested
+# in addition to A and AAAA records.
+
+# To simplify dependency management in the ebuild we'll require c-ares for HTTPS RR (for now?).
+# HTTPS RR in cURL is a dependency for:
+# - ECH (requires patched openssl or gnutls currently, enabled with rustls)
+# - Fetching the ALPN list which should provide a better HTTP/3 experience.
+
 # Only one default ssl / quic provider can be enabled
 # The default provider needs its USE satisfied
 # HTTP/3 and MultiSSL are mutually exclusive; it's not clear if MultiSSL offers any benefit at all in the modern day.
 # https://github.com/curl/curl/commit/65ece771f4602107d9cdd339dff4b420280a2c2e
 REQUIRED_USE="
+	ech? ( rustls )
+	httpsrr? ( adns )
 	quic? (
 		^^ (
 			curl_quic_openssl
@@ -77,7 +89,7 @@ REQUIRED_USE="
 	curl_ssl_mbedtls? ( mbedtls )
 	curl_ssl_openssl? ( openssl )
 	curl_ssl_rustls? ( rustls )
-	http3? ( alt-svc quic )
+	http3? ( alt-svc httpsrr quic )
 "
 
 # cURL's docs and CI/CD are great resources for confirming supported versions
@@ -104,6 +116,7 @@ RDEPEND="
 	)
 	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
 	ssh? ( >=net-libs/libssh2-1.2.8[${MULTILIB_USEDEP}] )
+	sasl-scram? ( >=net-misc/gsasl-2.2.0[static-libs?,${MULTILIB_USEDEP}] )
 	ssl? (
 		gnutls? (
 			app-misc/ca-certificates
@@ -115,10 +128,10 @@ RDEPEND="
 			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
 		)
 		openssl? (
-			>=dev-libs/openssl-1.0.2:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+			>=dev-libs/openssl-1.0.2:=[static-libs?,${MULTILIB_USEDEP}]
 		)
 		rustls? (
-			>=net-libs/rustls-ffi-0.14.0:=[${MULTILIB_USEDEP}]
+			>=net-libs/rustls-ffi-0.15.0:=[${MULTILIB_USEDEP}]
 		)
 	)
 	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
@@ -173,6 +186,57 @@ src_prepare() {
 	eautoreconf
 }
 
+# Generates TLS-related configure options based on USE flags.
+# Outputs options suitable for appending to a configure options array.
+_get_curl_tls_configure_opts() {
+	local tls_opts=()
+
+	local backend flag_name
+	for backend in gnutls mbedtls openssl rustls; do
+		if [[ "$backend" == "openssl" ]]; then
+			flag_name="ssl"
+			tls_opts+=( "--with-ca-path=${EPREFIX}/etc/ssl/certs")
+		else
+			flag_name="$backend"
+		fi
+
+		if use "$backend"; then
+			tls_opts+=( "--with-${flag_name}" )
+		else
+			# If a single backend is enabled, 'ssl' is required, openssl is the default / fallback
+			if ! [[ "$backend" == "openssl" ]]; then
+				tls_opts+=( "--without-${flag_name}" )
+			fi
+		fi
+	done
+
+	if use curl_ssl_gnutls; then
+		multilib_is_native_abi && einfo "Default TLS backend: gnutls"
+		tls_opts+=( "--with-default-ssl-backend=gnutls" )
+	elif use curl_ssl_mbedtls; then
+		multilib_is_native_abi && einfo "Default TLS backend: mbedtls"
+		tls_opts+=( "--with-default-ssl-backend=mbedtls" )
+	elif use curl_ssl_openssl; then
+		multilib_is_native_abi && einfo "Default TLS backend: openssl"
+		tls_opts+=( "--with-default-ssl-backend=openssl" )
+	elif use curl_ssl_rustls; then
+		multilib_is_native_abi && einfo "Default TLS backend: rustls"
+		tls_opts+=( "--with-default-ssl-backend=rustls" )
+	else
+		eerror "We can't be here because of REQUIRED_USE."
+		die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+	fi
+
+	# Explicitly Disable unimplemented b
+	tls_opts+=(
+		--without-amissl
+		--without-bearssl
+		--without-wolfssl
+	)
+
+	printf "%s\n" "${tls_opts[@]}"
+}
+
 multilib_src_configure() {
 	# We make use of the fact that later flags override earlier ones
 	# So start with all ssl providers off until proven otherwise
@@ -181,128 +245,107 @@ multilib_src_configure() {
 
 	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
 	if use ssl; then
-		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
-
-		if use gnutls; then
-			multilib_is_native_abi && einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls; then
-			multilib_is_native_abi && einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use openssl; then
-			multilib_is_native_abi && einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls; then
-			multilib_is_native_abi && einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-		if use curl_ssl_gnutls; then
-			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_openssl; then
-			multilib_is_native_abi && einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			multilib_is_native_abi && einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
-		fi
-
+		local -a tls_backend_opts
+		readarray -t tls_backend_opts < <(_get_curl_tls_configure_opts)
+		myconf+=("${tls_backend_opts[@]}")
 	else
 		myconf+=( --without-ssl )
 		einfo "SSL disabled"
 	fi
 
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+	# These configuration options are organised alphabetically by category/type
 
+	# Protocols
+	# `grep SUPPORT_PROTOCOLS=\" configure.ac | awk '{ print substr($2, 1, length($2)-1)}' | sort`
+	# Assume that anything omitted (that is not new!) is enabled by default with no deps
 	myconf+=(
-		$(use_enable alt-svc)
-		--enable-basic-auth
-		--enable-bearer-auth
-		--enable-digest-auth
-		--enable-kerberos-auth
-		--enable-negotiate-auth
-		--enable-aws
-		--enable-dict
-		--disable-ech
 		--enable-file
 		$(use_enable ftp)
 		$(use_enable gopher)
-		$(use_enable hsts)
 		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
+		$(use_enable imap) # Automatic IMAPS if TLS is enabled
 		$(use_enable ldap ldaps)
-		--enable-ntlm
+		$(use_enable ldap)
 		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
 		$(use_enable samba smb)
-		$(use_with ssh libssh2)
+		$(use_with ssh libssh2) # enables scp/sftp
+		$(use_with rtmp librtmp)
+		--enable-rtsp
 		$(use_enable smtp)
 		$(use_enable telnet)
 		$(use_enable tftp)
-		--enable-tls-srp
+		$(use_enable websockets)
+	)
+
+	# Keep various 'HTTP-flavoured' options together
+	myconf+=(
+		$(use_enable alt-svc)
+		$(use_enable hsts)
+		$(use_enable httpsrr)
+		$(use_with http2 nghttp2)
+		$(use_with http3 nghttp3)
+		$(use_with curl_quic_ngtcp2 ngtcp2)
+		$(use_with curl_quic_openssl openssl-quic)
+	)
+
+	# --enable/disable options
+	# `grep -- --enable configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
 		$(use_enable adns ares)
+		--enable-aws
+		--enable-basic-auth
+		--enable-bearer-auth
 		--enable-cookies
 		--enable-dateparse
+		--enable-dict
+		--enable-digest-auth
 		--enable-dnsshuffle
 		--enable-doh
-		--enable-symbol-hiding
+		$(use_enable ech)
 		--enable-http-auth
 		--enable-ipv6
+		--enable-kerberos-auth
 		--enable-largefile
 		--enable-manual
 		--enable-mime
+		--enable-negotiate-auth
 		--enable-netrc
-		$(use_enable progress-meter)
+		--enable-ntlm
+		--enable-progress-meter
 		--enable-proxy
+		--enable-rt
 		--enable-socketpair
 		--disable-sspi
 		$(use_enable static-libs static)
+		--enable-symbol-hiding
+		--enable-tls-srp
 		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
+	)
+
+	# --with/without options
+	# `grep -- --with configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
 		$(use_with brotli)
 		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
-		$(use_with http2 nghttp2)
 		$(use_with idn libidn2)
 		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
+		$(use_with sasl-scram libgsasl)
 		$(use_with psl libpsl)
 		--without-msh3
-		$(use_with http3 nghttp3)
-		$(use_with curl_quic_ngtcp2 ngtcp2)
-		$(use_with curl_quic_openssl openssl-quic)
 		--without-quiche
-		$(use_with rtmp librtmp)
 		--without-schannel
 		--without-secure-transport
-		--without-test-caddy
-		--without-test-httpd
-		--without-test-nghttpx
-		$(use_enable websockets)
 		--without-winidn
-		--without-wolfssl
 		--with-zlib
-		$(use_with zstd)
 		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+		$(use_with zstd)
+	)
+
+	# Test deps (disabled)
+	myconf+=(
+		--without-test-caddy
+		--without-test-httpd
+		--without-test-nghttpx
 	)
 
 	if use debug; then
@@ -319,8 +362,7 @@ multilib_src_configure() {
 
 	# Since 8.12.0 adns/c-ares and the threaded resolver are mutually exclusive
 	# This is in support of some work to enable `httpsrr` to use adns and the rest
-	# of curl to use the threaded resolver; we'll just make `httpsrr` conditional on adns
-	# when the time comes.
+	# of curl to use the threaded resolver; for us `httpsrr` is conditional on adns.
 	if use adns; then
 		myconf+=(
 			--disable-threaded-resolver
diff --git a/net-misc/curl/metadata.xml b/net-misc/curl/metadata.xml
index b3581ad82856..497d1d0d69db 100644
--- a/net-misc/curl/metadata.xml
+++ b/net-misc/curl/metadata.xml
@@ -11,6 +11,7 @@
 	</maintainer>
 	<use>
 		<flag name="alt-svc">Enable alt-svc support</flag>
+		<flag name="ech">Enable Encrypted Client Hello support</flag>
 		<flag name="ftp">Enable FTP support</flag>
 		<flag name="gnutls">Enable gnutls ssl backend</flag>
 		<flag name="gopher">Enable Gopher protocol support</flag>
@@ -18,6 +19,7 @@
 		<flag name="imap">Enable Internet Message Access Protocol support</flag>
 		<flag name="mbedtls">Enable mbedtls ssl backend</flag>
 		<flag name="http3">Enable HTTP/3 support</flag>
+		<flag name="httpsrr">Enable HTTPS Resource Record support</flag>
 		<flag name="openssl">Enable openssl ssl backend</flag>
 		<flag name="pop3">Enable Post Office Protocol 3 support</flag>
 		<flag name="progress-meter">Enable the progress meter</flag>
@@ -25,6 +27,7 @@
 		<flag name="quic">Enable support for QUIC (RFC 9000); a UDP-based protocol intended to replace TCP</flag>
 		<flag name="rtmp">Enable RTMP Streaming Media support</flag>
 		<flag name="rustls">Enable Rustls ssl backend</flag>
+		<flag name="sasl-scram">Enable snupport for additional SASL SCRAM-SHA authentication methods via <pkg>net-misc/gsasl</pkg></flag>
 		<flag name="smtp">Enable Simple Mail Transfer Protocol support</flag>
 		<flag name="ssh">Enable SSH urls in curl using libssh2</flag>
 		<flag name="ssl">Enable crypto engine support (via openssl if USE='-gnutls -nss')</flag>