Skip to content

Remove curl as an Envoy dependency #11816

@htuch

Description

@htuch

Currently we depend on libcurl for URL fetching in AWS extension common utils

static size_t curlCallback(char* ptr, size_t, size_t nmemb, void* data) {
and I think OpenCensus (@g-easy can you confirm?)

The use of curl is largely redundant, since Envoy itself can do HTTP fetch. In addition, Curl does not have a compatible threading and observability model with Envoy. The recent disclosures of CVE-2020-8169 and CVE-2020-8177 provide an example of why we should eliminate this from our trusted compute base.

Opening this tracking ticket to discuss further whether we can remove this dep.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions