When the single use of HAVE_BORINGSSL was introduced in cd34ffa, it was used in lib/ldap.c, later moved to schannel.h in 274940d. It was used to avoid wincrypt.h redefinitions with BoringSSL + Schannel MultiSSL builds. One side effect of using HAVE_BORINGSSL (compared to OPENSSL_IS_BORINGSSL) is that it's present before including openssl.h.

Making tests now to see if this trick is still necessary. [→ Confirmed not necessary #12065 (comment).]

Issue: BoringSSL no longer compiles with curl_ngtcp2.c, after introducing SSL_CTX_set_ciphersuites into it unconditionally in aa9a6a1. BoringSSL misses this function. Disabling H3 and retesting.

BoringSSL no longer compiles with curl_ngtcp2

I tried to copy the logic from openssl.c when I did that, but then clearly I failed...

though for ngtcp2 maybe we don't need as much legacy check

diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c
index 27711ef..f01f90c 100644
--- a/lib/vquic/curl_ngtcp2.c
+++ b/lib/vquic/curl_ngtcp2.c
@@ -430,6 +430,7 @@ static CURLcode quic_ssl_ctx(SSL_CTX **pssl_ctx,
     }
   }
 
+#ifndef OPENSSL_IS_BORINGSSL
   {
     const char *ciphers13 = conn->ssl_config.cipher_list13 ?
       conn->ssl_config.cipher_list13 : QUIC_CIPHERS;
@@ -439,6 +440,7 @@ static CURLcode quic_ssl_ctx(SSL_CTX **pssl_ctx,
     }
     infof(data, "QUIC cipher selection: %s", ciphers13);
   }
+#endif
 
   /* Open the file if a TLS or QUIC backend has not done this before. */
   Curl_tls_keylog_open();

@jay: Agreed, H3 assumes LibreSSL 3.7 or quictls 3.0 (or AWC-LC, not sure when it added this function but 1.15.0 has it).

The HAVE_BORINGSSL trick is no longer needed, confirmed with a warning-free BoringSSL + Schannel build:

curl 8.4.0-DEV (x86_64-w64-mingw32) libcurl/8.4.0-DEV BoringSSL/b98ce18c (Schannel) zlib/1.2.13 brotli/1.1.0 zstd/1.5.4 WinIDN nghttp2/1.52.0
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz MultiSSL NTLM SPNEGO SSL SSPI threadsafe Unicode UnixSockets zstd