Support reading from S3 directly

Change-Id: Ice18f6739a7e315bea223a2a6f634b6c4c725c11
Signed-off-by: Austin Schuh <austin.schuh@bluerivertech.com>
diff --git a/debian/BUILD b/debian/BUILD
index c920457..de5144d 100644
--- a/debian/BUILD
+++ b/debian/BUILD
@@ -504,4 +504,6 @@
 
 exports_files([
     "ssh_wrapper.sh",
+    "curl.BUILD",
+    "BUILD.zlib.bazel",
 ])
diff --git a/debian/BUILD.zlib.bazel b/debian/BUILD.zlib.bazel
new file mode 100644
index 0000000..c0f81fa
--- /dev/null
+++ b/debian/BUILD.zlib.bazel
@@ -0,0 +1,22 @@
+licenses(["notice"])  #  BSD/MIT-like license
+
+cc_library(
+    name = "zlib",
+    srcs = glob(["*.c"]),
+    hdrs = glob(["*.h"]),
+    # Use -Dverbose=-1 to turn off zlib's trace logging.
+    copts = [
+        "-w",
+        "-Dverbose=-1",
+    ],
+    includes = [
+        ".",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "z",
+    actual = ":zlib",
+    visibility = ["//visibility:public"],
+)
diff --git a/debian/aws_sdk.BUILD b/debian/aws_sdk.BUILD
new file mode 100644
index 0000000..a77f5bb
--- /dev/null
+++ b/debian/aws_sdk.BUILD
@@ -0,0 +1,354 @@
+load("@org_frc971//tools/build_rules:select.bzl", "compiler_select")
+
+cc_library(
+    name = "s3",
+    srcs = glob(["aws-cpp-sdk-s3/source/**/*.cpp"]),
+    hdrs = glob(["aws-cpp-sdk-s3/include/**/*.h"]),
+    includes = ["aws-cpp-sdk-s3/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":aws-c-auth",
+        ":core",
+    ],
+)
+
+genrule(
+    name = "gen_SDKConfig",
+    outs = ["aws-cpp-sdk-core/include/aws/core/SDKConfig.h"],
+    cmd = "echo '#undef USE_AWS_MEMORY_MANAGEMENT' > $@",
+    target_compatible_with = ["@platforms//os:linux"],
+)
+
+cc_library(
+    name = "core",
+    srcs = glob(
+        include = ["aws-cpp-sdk-core/source/**/*.cpp"],
+        exclude = [
+            "aws-cpp-sdk-core/source/utils/crypto/*/*.cpp",
+            "aws-cpp-sdk-core/source/platform/**/*.cpp",
+            "aws-cpp-sdk-core/source/platform/windows/**/*.cpp",
+            # net/*.cpp is for not-(linux or windows), so exclude everything in there.
+            "aws-cpp-sdk-core/source/net/**/*.cpp",
+            "aws-cpp-sdk-core/source/http/windows/**/*.cpp",
+        ],
+    ) + glob([
+        "aws-cpp-sdk-core/source/utils/crypto/openssl/*.cpp",
+        "aws-cpp-sdk-core/source/utils/crypto/factory/*.cpp",
+        "aws-cpp-sdk-core/source/platform/linux-shared/**/*.cpp",
+        "aws-cpp-sdk-core/source/net/linux-shared/*.cpp",
+    ]) + [
+        ":gen_SDKConfig",
+    ],
+    hdrs = glob(
+        include = ["aws-cpp-sdk-core/include/**/*.h"],
+        exclude = [
+            "aws-cpp-sdk-core/include/aws/core/utils/crypto/*/*.h",
+            "aws-cpp-sdk-core/include/aws/core/http/windows/**/*.h",
+        ],
+    ) + glob([
+        "aws-cpp-sdk-core/include/aws/core/utils/crypto/openssl/*.h",
+    ]),
+    copts = [
+        "-DAWS_SDK_VERSION_MAJOR=19",
+        "-DAWS_SDK_VERSION_MINOR=0",
+        "-DAWS_SDK_VERSION_PATCH=\"\\\"0-RC1\"\\\"",
+        "-DENABLE_OPENSSL_ENCRYPTION",
+        "-DENABLE_CURL_CLIENT",
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+        "-Wno-format-nonliteral",
+    ],
+    includes = ["aws-cpp-sdk-core/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":aws-c-auth",
+        ":aws-c-common",
+        ":aws-c-http",
+        ":crt",
+        "@boringssl//:crypto",
+        "@com_github_curl_curl//:curl",
+    ],
+)
+
+genrule(
+    name = "gen_Config",
+    outs = ["crt/aws-crt-cpp/include/aws/crt/Config.h"],
+    cmd = "echo '#define AWS_CRT_CPP_VERSION \"19.0.0-RC1\"' > $@",
+    target_compatible_with = ["@platforms//os:linux"],
+)
+
+cc_library(
+    name = "crt",
+    srcs = glob(["crt/aws-crt-cpp/source/**/*.cpp"]),
+    hdrs = glob(["crt/aws-crt-cpp/include/**/*.h"]) + [
+        ":gen_Config",
+    ],
+    copts = [
+        "-Wno-sign-compare",
+        "-Wno-cast-qual",
+    ],
+    includes = ["crt/aws-crt-cpp/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-auth",
+        ":aws-c-common",
+        ":aws-c-event-stream",
+        ":aws-c-mqtt",
+        ":aws-c-s3",
+    ],
+)
+
+genrule(
+    name = "gen_config",
+    outs = ["crt/aws-crt-cpp/crt/aws-c-common/include/aws/common/config.h"],
+    cmd = "\n".join([
+        "cat >$@ <<END",
+        "#define AWS_HAVE_GCC_OVERFLOW_MATH_EXTENSIONS 1",
+        "#define AWS_HAVE_GCC_INLINE_ASM 1",
+        "#undef AWS_HAVE_MSVC_MULX",
+        "#define AWS_HAVE_EXECINFO 1",
+        "END",
+    ]),
+    target_compatible_with = ["@platforms//os:linux"],
+)
+
+cc_library(
+    name = "aws-c-common",
+    srcs = glob([
+        "crt/aws-crt-cpp/crt/aws-c-common/source/*.c",
+        "crt/aws-crt-cpp/crt/aws-c-common/source/posix/*.c",
+    ]) + [
+        ":gen_config",
+    ] + select({
+        # See the paths in crt/aws-crt-cpp/crt/aws-c-common/CMakeLists.txt for the appropriate globs for each architecture.
+        "@//tools:cpu_k8": glob(
+            include = [
+                "crt/aws-crt-cpp/crt/aws-c-common/source/arch/intel/*.c",
+                "crt/aws-crt-cpp/crt/aws-c-common/source/arch/intel/asm/*.c",
+            ],
+            exclude = [
+                # We don't build with AVX, see crt/aws-crt-cpp/crt/aws-c-common/CMakeLists.txt for details of the macros that need to be set if this is enabled.
+                "crt/aws-crt-cpp/crt/aws-c-common/source/arch/intel/encoding_avx2.c",
+            ],
+        ),
+        "@//tools:cpu_arm64": glob([
+            "crt/aws-crt-cpp/crt/aws-c-common/source/arch/arm/asm/*.c",
+        ]),
+        "@//tools:cpu_armv7": glob([
+            "crt/aws-crt-cpp/crt/aws-c-common/source/arch/arm/asm/*.c",
+        ]),
+        "//conditions:default": [],
+    }),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-common/include/**/*.h"]),
+    copts = [
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+        "-Wno-sign-compare",
+        "-Wno-format-nonliteral",
+    ] + compiler_select({
+        "clang": [],
+        "gcc": [
+            "-Wno-old-style-declaration",
+        ],
+    }),
+    includes = ["crt/aws-crt-cpp/crt/aws-c-common/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    textual_hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-common/include/**/*.inl"]),
+)
+
+# -march=armv8-a+crc
+cc_library(
+    name = "aws-c-event-stream",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-c-event-stream/source/*.c"]) + select({
+        "@//tools:cpu_k8": glob(["crt/aws-crt-cpp/crt/aws-c-event-stream/source/intel/asm/*.c"]),
+        "@//tools:cpu_arm64": glob(["crt/aws-crt-cpp/crt/aws-c-event-stream/source/arm/*.c"]),
+        "@//tools:cpu_armv7": glob(["crt/aws-crt-cpp/crt/aws-c-event-stream/source/arm/*.c"]),
+        "//conditions:default": [],
+    }),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-event-stream/include/**/*.h"]),
+    copts = [
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-event-stream/include"],
+    deps = [
+        ":aws-c-common",
+        ":aws-c-io",
+        ":aws-checksums",
+    ],
+)
+
+cc_library(
+    name = "aws-checksums",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-checksums/source/*.c"]) + select({
+        "@//tools:cpu_k8": glob(["crt/aws-crt-cpp/crt/aws-checksums/source/intel/asm/*.c"]),
+        "@//tools:cpu_arm64": glob(["crt/aws-crt-cpp/crt/aws-checksums/source/arm/*.c"]),
+        "@//tools:cpu_armv7": glob(["crt/aws-crt-cpp/crt/aws-checksums/source/arm/*.c"]),
+        "//conditions:default": [],
+    }),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-checksums/include/**/*.h"]),
+    copts = [
+        "-Wno-cast-qual",
+        "-Wno-cast-align",
+        "-Wno-implicit-function-declaration",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-checksums/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-common",
+    ],
+)
+
+cc_library(
+    name = "aws-c-cal",
+    srcs = glob([
+        "crt/aws-crt-cpp/crt/aws-c-cal/source/*.c",
+        "crt/aws-crt-cpp/crt/aws-c-cal/source/unix/*.c",
+    ]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-cal/include/**/*.h"]),
+    copts = [
+        "-Wno-incompatible-pointer-types",
+        "-Wno-unused-function",
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-cal/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-common",
+        "@boringssl//:crypto",
+    ],
+)
+
+cc_library(
+    name = "aws-c-s3",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-c-s3/source/**/*.c"]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-s3/include/**/*.h"]),
+    copts = [
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-s3/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-auth",
+        ":aws-c-common",
+    ],
+)
+
+cc_library(
+    name = "aws-c-compression",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-c-compression/source/*.c"]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-compression/include/**/*.h"]),
+    includes = ["crt/aws-crt-cpp/crt/aws-c-compression/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-common",
+    ],
+)
+
+cc_library(
+    name = "aws-c-http",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-c-http/source/**/*.c"]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-http/include/**/*.h"]),
+    copts = [
+        "-Wno-unused-but-set-variable",
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-http/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    textual_hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-http/include/**/*.def"]),
+    deps = [
+        ":aws-c-common",
+        ":aws-c-compression",
+        ":aws-c-io",
+    ],
+)
+
+cc_library(
+    name = "aws-c-auth",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-c-auth/source/**/*.c"]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-auth/include/**/*.h"]),
+    copts = [
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-auth/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-common",
+        ":aws-c-http",
+        ":aws-c-io",
+    ],
+)
+
+cc_library(
+    name = "aws-c-mqtt",
+    srcs = glob(["crt/aws-crt-cpp/crt/aws-c-mqtt/source/**/*.c"]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-mqtt/include/**/*.h"]),
+    copts = [
+        "-Wno-cast-qual",
+        "-Wno-cast-align",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-mqtt/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-common",
+        ":aws-c-io",
+    ],
+)
+
+cc_library(
+    name = "aws-c-io",
+    srcs = glob([
+        "crt/aws-crt-cpp/crt/aws-c-io/source/*.c",
+        "crt/aws-crt-cpp/crt/aws-c-io/source/linux/*.c",
+        "crt/aws-crt-cpp/crt/aws-c-io/source/s2n/*.c",
+        "crt/aws-crt-cpp/crt/aws-c-io/source/posix/*.c",
+    ]),
+    hdrs = glob(["crt/aws-crt-cpp/crt/aws-c-io/include/**/*.h"]),
+    copts = [
+        "-DAWS_USE_EPOLL",
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+        "-Wno-sign-compare",
+        "-Wno-unused-parameter",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/aws-c-io/include"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        ":aws-c-cal",
+        ":aws-c-common",
+        ":s2n",
+    ],
+)
+
+cc_library(
+    name = "s2n",
+    srcs = glob([
+        "crt/aws-crt-cpp/crt/s2n/**/*.h",
+        "crt/aws-crt-cpp/crt/s2n/tls/**/*.c",
+        "crt/aws-crt-cpp/crt/s2n/error/**/*.c",
+        "crt/aws-crt-cpp/crt/s2n/utils/**/*.c",
+        "crt/aws-crt-cpp/crt/s2n/stuffer/**/*.c",
+        "crt/aws-crt-cpp/crt/s2n/crypto/**/*.c",
+    ]),
+    hdrs = ["crt/aws-crt-cpp/crt/s2n/api/s2n.h"],
+    copts = [
+        "-Iexternal/aws_sdk/crt/aws-crt-cpp/crt/s2n",
+        "-DS2N_NO_PQ",
+        "-Wno-unknown-pragmas",
+        "-Wno-cast-align",
+        "-Wno-cast-qual",
+        "-Wno-unused-parameter",
+        "-Wno-sign-compare",
+    ],
+    includes = ["crt/aws-crt-cpp/crt/s2n/api"],
+    target_compatible_with = ["@platforms//os:linux"],
+    deps = [
+        "@boringssl//:crypto",
+    ],
+)
diff --git a/debian/aws_sdk.patch b/debian/aws_sdk.patch
new file mode 100644
index 0000000..df613f5
--- /dev/null
+++ b/debian/aws_sdk.patch
@@ -0,0 +1,92 @@
+Submodule crt/aws-crt-cpp contains modified content
+Submodule crt/aws-c-cal contains modified content
+diff --git a/crt/aws-crt-cpp/crt/aws-c-cal/source/unix/openssl_platform_init.c b/crt/aws-crt-cpp/crt/aws-c-cal/source/unix/openssl_platform_init.c
+index 761455b..fc434ba 100644
+--- a/crt/aws-crt-cpp/crt/aws-c-cal/source/unix/openssl_platform_init.c
++++ b/crt/aws-crt-cpp/crt/aws-c-cal/source/unix/openssl_platform_init.c
+@@ -34,7 +34,7 @@ struct openssl_evp_md_ctx_table *g_aws_openssl_evp_md_ctx_table = NULL;
+ /* 1.1 */
+ extern HMAC_CTX *HMAC_CTX_new(void) __attribute__((weak)) __attribute__((used));
+ extern void HMAC_CTX_free(HMAC_CTX *) __attribute__((weak)) __attribute__((used));
+-extern int HMAC_CTX_reset(HMAC_CTX *) __attribute__((weak)) __attribute__((used));
++//extern int HMAC_CTX_reset(HMAC_CTX *) __attribute__((weak)) __attribute__((used));
+ 
+ /* 1.0.2 */
+ extern void HMAC_CTX_init(HMAC_CTX *) __attribute__((weak)) __attribute__((used));
+@@ -43,8 +43,8 @@ extern void HMAC_CTX_cleanup(HMAC_CTX *) __attribute__((weak)) __attribute__((us
+ /* common */
+ extern int HMAC_Update(HMAC_CTX *, const unsigned char *, size_t) __attribute__((weak)) __attribute__((used));
+ extern int HMAC_Final(HMAC_CTX *, unsigned char *, unsigned int *) __attribute__((weak)) __attribute__((used));
+-extern int HMAC_Init_ex(HMAC_CTX *, const void *, int, const EVP_MD *, ENGINE *) __attribute__((weak))
+-__attribute__((used));
++//extern int HMAC_Init_ex(HMAC_CTX *, const void *, int, const EVP_MD *, ENGINE *) __attribute__((weak))
++//__attribute__((used));
+ 
+ /* libcrypto 1.1 stub for init */
+ static void s_hmac_ctx_init_noop(HMAC_CTX *ctx) {
+@@ -393,9 +393,9 @@ void aws_cal_platform_init(struct aws_allocator *allocator) {
+         }
+     }
+ 
+-    if (!CRYPTO_get_id_callback()) {
+-        CRYPTO_set_id_callback(s_id_fn);
+-    }
++    //if (!CRYPTO_get_id_callback()) {
++        //CRYPTO_set_id_callback(s_id_fn);
++    //}
+ }
+ 
+ void aws_cal_platform_clean_up(void) {
+@@ -408,9 +408,9 @@ void aws_cal_platform_clean_up(void) {
+         aws_mem_release(s_libcrypto_allocator, s_libcrypto_locks);
+     }
+ 
+-    if (CRYPTO_get_id_callback() == s_id_fn) {
+-        CRYPTO_set_id_callback(NULL);
+-    }
++    //if (CRYPTO_get_id_callback() == s_id_fn) {
++        //CRYPTO_set_id_callback(NULL);
++    //}
+ }
+ #if !defined(__GNUC__) || (__GNUC__ >= 4 && __GNUC_MINOR__ > 1)
+ #    pragma GCC diagnostic pop
+Submodule crt/s2n contains modified content
+diff --git a/crt/aws-crt-cpp/crt/s2n/utils/s2n_asn1_time.c b/crt/aws-crt-cpp/crt/s2n/utils/s2n_asn1_time.c
+index 84dbc6df..d3566b81 100755
+--- a/crt/aws-crt-cpp/crt/s2n/utils/s2n_asn1_time.c
++++ b/crt/aws-crt-cpp/crt/s2n/utils/s2n_asn1_time.c
+@@ -46,7 +46,7 @@ typedef enum parser_state {
+ } parser_state;
+ 
+ static inline long get_gmt_offset(struct tm *t) {
+-#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__ANDROID__) || defined(ANDROID) || defined(__APPLE__) && defined(__MACH__)
++#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__ANDROID__) || defined(ANDROID) || defined(__APPLE__) && defined(__MACH__) || defined(__USE_MISC)
+     return t->tm_gmtoff;
+ #else
+     return t->__tm_gmtoff;
+diff --git a/crt/aws-crt-cpp/crt/s2n/utils/s2n_init.c b/crt/aws-crt-cpp/crt/s2n/utils/s2n_init.c
+index 0f79f959..ae8122fb 100644
+--- a/crt/aws-crt-cpp/crt/s2n/utils/s2n_init.c
++++ b/crt/aws-crt-cpp/crt/s2n/utils/s2n_init.c
+@@ -45,7 +45,7 @@ int s2n_init(void)
+     GUARD_POSIX(s2n_security_policies_init());
+     GUARD_POSIX(s2n_config_defaults_init());
+     GUARD_POSIX(s2n_extension_type_init());
+-    GUARD_AS_POSIX(s2n_pq_init());
++    //GUARD_AS_POSIX(s2n_pq_init());
+ 
+     S2N_ERROR_IF(atexit(s2n_cleanup_atexit) != 0, S2N_ERR_ATEXIT);
+ 
+diff --git a/crt/aws-crt-cpp/crt/aws-c-common/include/aws/common/private/lookup3.inl b/crt/aws-crt-cpp/crt/aws-c-common/include/aws/common/private/lookup3.inl
+index 0f79f959..ae8122fb 100644
+--- a/crt/aws-crt-cpp/crt/aws-c-common/include/aws/common/private/lookup3.inl
++++ b/crt/aws-crt-cpp/crt/aws-c-common/include/aws/common/private/lookup3.inl
+@@ -533,7 +533,7 @@
+      * "CPROVER check pop". The masking trick does make the hash noticably
+      * faster for short strings (like English words).
+      */
+-#ifndef VALGRIND
++#if !defined(VALGRIND) && !__has_feature(address_sanitizer) && !__has_feature(memory_sanitizer)
+ #ifdef CBMC
+ #    pragma CPROVER check push
+ #    pragma CPROVER check disable "pointer"
diff --git a/debian/curl.BUILD b/debian/curl.BUILD
new file mode 100644
index 0000000..95edb78
--- /dev/null
+++ b/debian/curl.BUILD
@@ -0,0 +1,766 @@
+# This is based on:
+#   https://github.com/googleapis/google-cloud-cpp/blob/v1.26.1/bazel/curl.BUILD
+# which is based on:
+#   https://github.com/tensorflow/tensorflow/blob/51d480498b07346b8b6e2ee3fbd3dc486f60ed96/third_party/curl.BUILD
+# Description:
+#   curl is a tool for talking to web servers.
+
+licenses(["notice"])  # MIT/X derivative license
+
+exports_files(["COPYING"])
+
+config_setting(
+    name = "windows",
+    values = {"cpu": "x64_windows"},
+    visibility = ["//visibility:public"],
+)
+
+config_setting(
+    name = "linux_x86_64",
+    constraint_values = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+    ],
+)
+
+config_setting(
+    name = "linux_arm64",
+    constraint_values = [
+        "@platforms//cpu:arm64",
+        "@platforms//os:linux",
+    ],
+)
+
+config_setting(
+    name = "linux_armv7",
+    constraint_values = [
+        "@platforms//cpu:armv7",
+        "@platforms//os:linux",
+    ],
+)
+
+config_setting(
+    name = "macos",
+    values = {"cpu": "darwin"},
+    visibility = ["//visibility:public"],
+)
+
+# On Linux, libcurl needs to know, at compile time, the location for the
+# Certificate Authority (CA) bundle file. By default we dynamically guess the
+# location for most common Linux distribution, but this guessing makes the build
+# not cacheable.
+#
+# In our CI builds we define the CA bundle location using a --define option.
+# This makes the CI results more amenable to caching, at the cost of "some"
+# complexity in this BUILD file.
+#
+# Note that builds issued by developers in the command-line should continue to
+# work, it is just that the build results are less cacheable than they make
+# wish.
+
+# First convert the --define ca_bundle_style=... option into a config_setting
+# rule:
+config_setting(
+    name = "ca_bundle_style_is_redhat",
+    define_values = {
+        "ca_bundle_style": "redhat",
+    },
+)
+
+config_setting(
+    name = "ca_bundle_style_is_debian",
+    define_values = {
+        "ca_bundle_style": "debian",
+    },
+)
+
+# This just generates a header file with the right value for the CURL_CA_BUNDLE
+# macro. The file is included by curl_config.h if the macro is *not* provided
+# in the build line using -DCURL_CA_BUNDLE=<some-path>:
+genrule(
+    name = "gen-ca-bundle-linux",
+    outs = ["include/curl_ca_bundle_location.h"],
+    cmd = """
+      if [ -f /etc/fedora-release ]; then
+        echo '#define CURL_CA_BUNDLE "/etc/pki/tls/certs/ca-bundle.crt"'
+      elif [ -f /etc/redhat-release ]; then
+        echo '#define CURL_CA_BUNDLE "/etc/pki/tls/certs/ca-bundle.crt"'
+      elif [ -f /etc/debian_version ]; then
+        echo '#define CURL_CA_BUNDLE "/etc/ssl/certs/ca-certificates.crt"'
+      elif [ -f /etc/arch-release ]; then
+        echo '#define CURL_CA_BUNDLE "/etc/ssl/certs/ca-certificates.crt"'
+      else
+        >&2 echo "Unknown platform, cannot guess location of CA bundle"
+        exit 1
+      fi >$@
+    """,
+)
+
+# This is the default depending to define CURL_CA_BUNDLE on Linux, it is tagged
+# as `no-cache` because the output on one host cannot be used in another host.
+cc_library(
+    name = "define-ca-bundle-location-guess",
+    hdrs = ["include/curl_ca_bundle_location.h"],
+    tags = ["no-cache"],
+)
+
+# This library is used on redhat-like hosts (RHEL, CentOS, and Fedora for
+# example), because all such hosts use the same value, we can cache this
+# library.
+cc_library(
+    name = "define-ca-bundle-location-redhat",
+    hdrs = [],
+    defines = ["""CURL_CA_BUNDLE='"/etc/pki/tls/certs/ca-bundle.crt"'"""],
+    tags = [],
+)
+
+# This library is used on debian-like hosts (Debian, and Ubuntu for example),
+# because all such hosts use the same value, we can cache this library.
+cc_library(
+    name = "define-ca-bundle-location-debian",
+    hdrs = [],
+    defines = ["""CURL_CA_BUNDLE='"/etc/ssl/certs/ca-certificates.crt"'"""],
+    tags = [],
+)
+
+# This library uses the `ca_bundle_style*` config setting to branch the
+# dependency
+cc_library(
+    name = "define-ca-bundle-location-linux",
+    deps = select({
+        ":ca_bundle_style_is_redhat": [":define-ca-bundle-location-redhat"],
+        ":ca_bundle_style_is_debian": [":define-ca-bundle-location-debian"],
+        "//conditions:default": [":define-ca-bundle-location-guess"],
+    }),
+)
+
+# Finally, on Windows and macOS we do not need to define CURL_CA_BUNDLE at all,
+# so on those platforms we skip the branch of the dependencies altogether.
+cc_library(
+    name = "define-ca-bundle-location",
+    deps = select({
+        ":windows": [],
+        ":macos": [],
+        "//conditions:default": [":define-ca-bundle-location-linux"],
+    }),
+)
+
+CURL_WIN_COPTS = [
+    "/Iexternal/com_github_curl_curl/lib",
+    "/DBUILDING_LIBCURL",
+    "/DHAVE_CONFIG_H",
+    "/DCURL_DISABLE_FTP",
+    "/DCURL_DISABLE_NTLM",
+    "/DCURL_DISABLE_PROXY",
+    "/DHAVE_LIBZ",
+    "/DHAVE_ZLIB_H",
+    # Defining _USING_V110_SDK71_ is hackery to defeat curl's incorrect
+    # detection of what OS releases we can build on with VC 2012. This
+    # may not be needed (or may have to change) if the WINVER setting
+    # changes in //third_party/msvc/vc_12_0/CROSSTOOL.
+    "/D_USING_V110_SDK71_",
+]
+
+CURL_WIN_SRCS = [
+    "lib/asyn-thread.c",
+    "lib/inet_ntop.c",
+    "lib/system_win32.c",
+    "lib/x509asn1.c",
+    "lib/vtls/schannel.c",
+    "lib/vtls/schannel_verify.c",
+    "lib/idn_win32.c",
+]
+
+cc_library(
+    name = "curl",
+    srcs = [
+        "include/curl_config.h",
+        "lib/amigaos.h",
+        "lib/arpa_telnet.h",
+        "lib/asyn.h",
+        "lib/asyn-ares.c",
+        "lib/base64.c",
+        "lib/config-win32.h",
+        "lib/conncache.c",
+        "lib/conncache.h",
+        "lib/connect.c",
+        "lib/connect.h",
+        "lib/content_encoding.c",
+        "lib/content_encoding.h",
+        "lib/cookie.c",
+        "lib/cookie.h",
+        "lib/curl_addrinfo.c",
+        "lib/curl_addrinfo.h",
+        "lib/curl_base64.h",
+        "lib/curl_ctype.c",
+        "lib/curl_ctype.h",
+        "lib/curl_des.h",
+        "lib/curl_endian.h",
+        "lib/curl_fnmatch.c",
+        "lib/curl_fnmatch.h",
+        "lib/curl_gethostname.c",
+        "lib/curl_gethostname.h",
+        "lib/curl_gssapi.h",
+        "lib/curl_hmac.h",
+        "lib/curl_ldap.h",
+        "lib/curl_md4.h",
+        "lib/curl_md5.h",
+        "lib/curl_memory.h",
+        "lib/curl_memrchr.c",
+        "lib/curl_memrchr.h",
+        "lib/curl_multibyte.c",
+        "lib/curl_multibyte.h",
+        "lib/curl_ntlm_core.h",
+        "lib/curl_ntlm_wb.h",
+        "lib/curl_printf.h",
+        "lib/curl_rtmp.c",
+        "lib/curl_rtmp.h",
+        "lib/curl_sasl.c",
+        "lib/curl_sasl.h",
+        "lib/curl_sec.h",
+        "lib/curl_setup.h",
+        "lib/curl_setup_once.h",
+        "lib/curl_sha256.h",
+        "lib/curl_sspi.c",
+        "lib/curl_sspi.h",
+        "lib/curl_threads.c",
+        "lib/curl_threads.h",
+        "lib/curlx.h",
+        "lib/dict.h",
+        "lib/dotdot.c",
+        "lib/dotdot.h",
+        "lib/easy.c",
+        "lib/easyif.h",
+        "lib/escape.c",
+        "lib/escape.h",
+        "lib/file.h",
+        "lib/fileinfo.c",
+        "lib/fileinfo.h",
+        "lib/formdata.c",
+        "lib/formdata.h",
+        "lib/ftp.h",
+        "lib/ftplistparser.h",
+        "lib/getenv.c",
+        "lib/getinfo.c",
+        "lib/getinfo.h",
+        "lib/gopher.h",
+        "lib/hash.c",
+        "lib/hash.h",
+        "lib/hmac.c",
+        "lib/hostasyn.c",
+        "lib/hostcheck.c",
+        "lib/hostcheck.h",
+        "lib/hostip.c",
+        "lib/hostip.h",
+        "lib/hostip4.c",
+        "lib/hostip6.c",
+        "lib/hostsyn.c",
+        "lib/http.c",
+        "lib/http.h",
+        "lib/http2.c",
+        "lib/http2.h",
+        "lib/http_chunks.c",
+        "lib/http_chunks.h",
+        "lib/http_digest.c",
+        "lib/http_digest.h",
+        "lib/http_negotiate.h",
+        "lib/http_ntlm.h",
+        "lib/http_proxy.c",
+        "lib/http_proxy.h",
+        "lib/if2ip.c",
+        "lib/if2ip.h",
+        "lib/imap.h",
+        "lib/inet_ntop.h",
+        "lib/inet_pton.c",
+        "lib/inet_pton.h",
+        "lib/krb5.c",
+        "lib/llist.c",
+        "lib/llist.h",
+        "lib/md4.c",
+        "lib/md5.c",
+        "lib/memdebug.c",
+        "lib/memdebug.h",
+        "lib/mime.c",
+        "lib/mime.h",
+        "lib/mprintf.c",
+        "lib/multi.c",
+        "lib/multihandle.h",
+        "lib/multiif.h",
+        "lib/netrc.c",
+        "lib/netrc.h",
+        "lib/non-ascii.h",
+        "lib/nonblock.c",
+        "lib/nonblock.h",
+        "lib/nwlib.c",
+        "lib/nwos.c",
+        "lib/parsedate.c",
+        "lib/parsedate.h",
+        "lib/pingpong.h",
+        "lib/pingpong.c",
+        "lib/pop3.h",
+        "lib/progress.c",
+        "lib/progress.h",
+        "lib/quic.h",
+        "lib/rand.c",
+        "lib/rand.h",
+        "lib/rename.h",
+        "lib/rename.c",
+        "lib/rtsp.c",
+        "lib/rtsp.h",
+        "lib/security.c",
+        "lib/select.c",
+        "lib/select.h",
+        "lib/sendf.c",
+        "lib/sendf.h",
+        "lib/setopt.c",
+        "lib/setopt.h",
+        "lib/setup-os400.h",
+        "lib/setup-vms.h",
+        "lib/sha256.c",
+        "lib/share.c",
+        "lib/share.h",
+        "lib/sigpipe.h",
+        "lib/slist.c",
+        "lib/slist.h",
+        "lib/smb.h",
+        "lib/smtp.h",
+        "lib/sockaddr.h",
+        "lib/socketpair.h",
+        "lib/socketpair.c",
+        "lib/socks.c",
+        "lib/socks.h",
+        "lib/speedcheck.c",
+        "lib/speedcheck.h",
+        "lib/splay.c",
+        "lib/splay.h",
+        "lib/strcase.c",
+        "lib/strcase.h",
+        "lib/strdup.c",
+        "lib/strdup.h",
+        "lib/strerror.c",
+        "lib/strerror.h",
+        "lib/strtok.c",
+        "lib/strtok.h",
+        "lib/strtoofft.c",
+        "lib/strtoofft.h",
+        "lib/system_win32.h",
+        "lib/telnet.h",
+        "lib/tftp.h",
+        "lib/timeval.c",
+        "lib/timeval.h",
+        "lib/transfer.c",
+        "lib/transfer.h",
+        "lib/url.c",
+        "lib/url.h",
+        "lib/urldata.h",
+        "lib/vauth/cleartext.c",
+        "lib/vauth/cram.c",
+        "lib/vauth/digest.c",
+        "lib/vauth/digest.h",
+        "lib/vauth/ntlm.h",
+        "lib/vauth/oauth2.c",
+        "lib/vauth/vauth.c",
+        "lib/vauth/vauth.h",
+        "lib/version.c",
+        "lib/vssh/ssh.h",
+        "lib/vtls/bearssl.h",
+        "lib/vtls/gskit.h",
+        "lib/vtls/gtls.h",
+        "lib/vtls/mbedtls.h",
+        "lib/vtls/nssg.h",
+        "lib/vtls/openssl.h",
+        "lib/vtls/schannel.h",
+        "lib/vtls/vtls.c",
+        "lib/vtls/vtls.h",
+        "lib/vtls/wolfssl.h",
+        "lib/warnless.c",
+        "lib/warnless.h",
+        "lib/wildcard.c",
+        "lib/wildcard.h",
+        "lib/x509asn1.h",
+        "lib/psl.h",
+        "lib/psl.c",
+        "lib/vtls/sectransp.h",
+        "lib/vtls/mesalink.h",
+        "lib/vtls/mesalink.c",
+        "lib/curl_get_line.h",
+        "lib/curl_get_line.c",
+        "lib/urlapi-int.h",
+        "lib/urlapi.c",
+        "lib/altsvc.h",
+        "lib/altsvc.c",
+        "lib/doh.h",
+        "lib/doh.c",
+    ] + select({
+        ":macos": [
+            "lib/vtls/sectransp.c",
+        ],
+        ":windows": CURL_WIN_SRCS,
+        "//conditions:default": [
+            "lib/vtls/openssl.c",
+        ],
+    }),
+    hdrs = [
+        "include/curl/curl.h",
+        "include/curl/curlver.h",
+        "include/curl/easy.h",
+        "include/curl/mprintf.h",
+        "include/curl/multi.h",
+        "include/curl/stdcheaders.h",
+        "include/curl/system.h",
+        "include/curl/typecheck-gcc.h",
+        "include/curl/urlapi.h",
+    ],
+    copts = select({
+        ":windows": CURL_WIN_COPTS,
+        "//conditions:default": [
+            "-Iexternal/com_github_curl_curl/lib",
+            "-D_GNU_SOURCE",
+            "-DBUILDING_LIBCURL",
+            "-DHAVE_CONFIG_H",
+            "-DCURL_DISABLE_FTP",
+            "-DCURL_DISABLE_NTLM",  # turning it off in configure is not enough
+            "-DHAVE_LIBZ",
+            "-DHAVE_ZLIB_H",
+            "-Wno-string-plus-int",
+            "-Wno-cast-qual",
+            "-Wno-format-nonliteral",
+            "-Wno-tautological-type-limit-compare",
+        ],
+    }) + select({
+        ":macos": [
+            "-fno-constant-cfstrings",
+        ],
+        "//conditions:default": [],
+    }),
+    defines = ["CURL_STATICLIB"] + select({
+        ":windows": [
+            # See curl.h for discussion of write size and Windows
+            "CURL_MAX_WRITE_SIZE=16384",
+        ],
+        "//conditions:default": [
+            "CURL_MAX_WRITE_SIZE=65536",
+        ],
+    }),
+    includes = ["include"],
+    linkopts = select({
+        ":macos": [
+            "-Wl,-framework",
+            "-Wl,CoreFoundation",
+            "-Wl,-framework",
+            "-Wl,Security",
+        ],
+        ":windows": [
+            "-DEFAULTLIB:ws2_32.lib",
+            "-DEFAULTLIB:advapi32.lib",
+            "-DEFAULTLIB:crypt32.lib",
+            "-DEFAULTLIB:Normaliz.lib",
+        ],
+        "//conditions:default": [
+            "-lrt",
+        ],
+    }),
+    visibility = ["//visibility:public"],
+    deps = [
+        # Use the same version of zlib that gRPC does.
+        "@zlib//:zlib",
+        ":define-ca-bundle-location",
+    ] + select({
+        ":windows": [],
+        "//conditions:default": [
+            "@boringssl//:ssl",
+        ],
+    }),
+)
+
+genrule(
+    name = "configure",
+    outs = ["include/curl_config.h"],
+    cmd = "\n".join([
+        "cat <<'EOF' >$@",
+        "#ifndef EXTERNAL_CURL_INCLUDE_CURL_CONFIG_H_",
+        "#define EXTERNAL_CURL_INCLUDE_CURL_CONFIG_H_",
+        "",
+        "#if !defined(_WIN32) && !defined(__APPLE__)",
+        "#  include <openssl/opensslv.h>",
+        "#  if defined(OPENSSL_IS_BORINGSSL)",
+        "#    define HAVE_BORINGSSL 1",
+        "#  endif",
+        "#endif",
+        "",
+        "#if defined(_WIN32)",
+        "#  include \"lib/config-win32.h\"",
+        "#  define BUILDING_LIBCURL 1",
+        "#  define CURL_DISABLE_CRYPTO_AUTH 1",
+        "#  define CURL_DISABLE_DICT 1",
+        "#  define CURL_DISABLE_FILE 1",
+        "#  define CURL_DISABLE_GOPHER 1",
+        "#  define CURL_DISABLE_IMAP 1",
+        "#  define CURL_DISABLE_LDAP 1",
+        "#  define CURL_DISABLE_LDAPS 1",
+        "#  define CURL_DISABLE_POP3 1",
+        "#  define CURL_PULL_WS2TCPIP_H 1",
+        "#  define CURL_DISABLE_SMTP 1",
+        "#  define CURL_DISABLE_TELNET 1",
+        "#  define CURL_DISABLE_TFTP 1",
+        "#  define CURL_PULL_WS2TCPIP_H 1",
+        "#  define USE_WINDOWS_SSPI 1",
+        "#  define USE_WIN32_IDN 1",
+        "#  define USE_SCHANNEL 1",
+        "#  define WANT_IDN_PROTOTYPES 1",
+        "#elif defined(__APPLE__)",
+        "#  define HAVE_FSETXATTR_6 1",
+        "#  define HAVE_SETMODE 1",
+        "#  define HAVE_SYS_FILIO_H 1",
+        "#  define HAVE_SYS_SOCKIO_H 1",
+        "#  define OS \"x86_64-apple-darwin15.5.0\"",
+        "#  define USE_SECTRANSP 1",
+        "#else",
+        "#  if !defined(CURL_CA_BUNDLE)",
+        "#    include \"include/curl_ca_bundle_location.h\"",
+        "#  endif  // CURL_CA_BUNDLE",
+        "#  define GETSERVBYPORT_R_ARGS 6",
+        "#  define GETSERVBYPORT_R_BUFSIZE 4096",
+        "#  define HAVE_BORINGSSL 1",
+        "#  define HAVE_CLOCK_GETTIME_MONOTONIC 1",
+        "#  define HAVE_CONNECT 1",
+        "#  define HAVE_CRYPTO_CLEANUP_ALL_EX_DATA 1",
+        "#  define HAVE_FSETXATTR_5 1",
+        "#  define HAVE_GETHOSTBYADDR_R 1",
+        "#  define HAVE_GETHOSTBYADDR_R_8 1",
+        "#  define HAVE_GETHOSTBYNAME_R 1",
+        "#  define HAVE_GETHOSTBYNAME_R_6 1",
+        "#  define HAVE_GETSERVBYPORT_R 1",
+        "#  define HAVE_LIBSSL 1",
+        "#  define HAVE_MALLOC_H 1",
+        "#  define HAVE_MSG_NOSIGNAL 1",
+        "#  define HAVE_OPENSSL_CRYPTO_H 1",
+        "#  define HAVE_OPENSSL_ERR_H 1",
+        "#  define HAVE_OPENSSL_PEM_H 1",
+        "#  define HAVE_OPENSSL_PKCS12_H 1",
+        "#  define HAVE_OPENSSL_RSA_H 1",
+        "#  define HAVE_OPENSSL_SSL_H 1",
+        "#  define HAVE_OPENSSL_X509_H 1",
+        "#  define HAVE_RAND_EGD 1",
+        "#  define HAVE_RAND_STATUS 1",
+        "#  define HAVE_SSL_GET_SHUTDOWN 1",
+        "#  define HAVE_TERMIOS_H 1",
+        "#  define OS \"x86_64-pc-linux-gnu\"",
+        "#  define RANDOM_FILE \"/dev/urandom\"",
+        "#  define USE_OPENSSL 1",
+        "#endif",
+        "",
+        "#if !defined(_WIN32)",
+        "#  define CURL_DISABLE_DICT 1",
+        "#  define CURL_DISABLE_FILE 1",
+        "#  define CURL_DISABLE_GOPHER 1",
+        "#  define CURL_DISABLE_IMAP 1",
+        "#  define CURL_DISABLE_LDAP 1",
+        "#  define CURL_DISABLE_LDAPS 1",
+        "#  define CURL_DISABLE_POP3 1",
+        "#  define CURL_DISABLE_SMTP 1",
+        "#  define CURL_DISABLE_TELNET 1",
+        "#  define CURL_DISABLE_TFTP 1",
+        "#  define CURL_EXTERN_SYMBOL __attribute__ ((__visibility__ (\"default\")))",
+        "#  define ENABLE_IPV6 1",
+        "#  define GETHOSTNAME_TYPE_ARG2 size_t",
+        "#  define GETNAMEINFO_QUAL_ARG1 const",
+        "#  define GETNAMEINFO_TYPE_ARG1 struct sockaddr *",
+        "#  define GETNAMEINFO_TYPE_ARG2 socklen_t",
+        "#  define GETNAMEINFO_TYPE_ARG46 socklen_t",
+        "#  define GETNAMEINFO_TYPE_ARG7 int",
+        "#  define HAVE_ALARM 1",
+        "#  define HAVE_ALLOCA_H 1",
+        "#  define HAVE_ARPA_INET_H 1",
+        "#  define HAVE_ARPA_TFTP_H 1",
+        "#  define HAVE_ASSERT_H 1",
+        "#  define HAVE_BASENAME 1",
+        "#  define HAVE_BOOL_T 1",
+        "#  define HAVE_CONNECT 1",
+        "#  define HAVE_DLFCN_H 1",
+        "#  define HAVE_ERRNO_H 1",
+        "#  define HAVE_FCNTL 1",
+        "#  define HAVE_FCNTL_H 1",
+        "#  define HAVE_FCNTL_O_NONBLOCK 1",
+        "#  define HAVE_FDOPEN 1",
+        "#  define HAVE_FORK 1",
+        "#  define HAVE_FREEADDRINFO 1",
+        "#  define HAVE_FREEIFADDRS 1",
+        "#  if !defined(__ANDROID__)",
+        "#    define HAVE_FSETXATTR 1",
+        "#  endif",
+        "#  define HAVE_FTRUNCATE 1",
+        "#  define HAVE_GAI_STRERROR 1",
+        "#  define HAVE_GETADDRINFO 1",
+        "#  define HAVE_GETADDRINFO_THREADSAFE 1",
+        "#  define HAVE_GETEUID 1",
+        "#  define HAVE_GETHOSTBYADDR 1",
+        "#  define HAVE_GETHOSTBYNAME 1",
+        "#  define HAVE_GETHOSTNAME 1",
+        "#  if !defined(__ANDROID__)",
+        "#    define HAVE_GETIFADDRS 1",
+        "#  endif",
+        "#  define HAVE_GETNAMEINFO 1",
+        "#  define HAVE_GETPEERNAME 1",
+        "#  define HAVE_GETPPID 1",
+        "#  define HAVE_GETPROTOBYNAME 1",
+        "#  define HAVE_GETPWUID 1",
+        "#  if !defined(__ANDROID__)",
+        "#    define HAVE_GETPWUID_R 1",
+        "#  endif",
+        "#  define HAVE_GETRLIMIT 1",
+        "#  define HAVE_GETSOCKNAME 1",
+        "#  define HAVE_GETTIMEOFDAY 1",
+        "#  define HAVE_GMTIME_R 1",
+        "#  if !defined(__ANDROID__)",
+        "#    define HAVE_IFADDRS_H 1",
+        "#  endif",
+        "#  define HAVE_IF_NAMETOINDEX 1",
+        "#  define HAVE_INET_ADDR 1",
+        "#  define HAVE_INET_NTOP 1",
+        "#  define HAVE_INET_PTON 1",
+        "#  define HAVE_INTTYPES_H 1",
+        "#  define HAVE_IOCTL 1",
+        "#  define HAVE_IOCTL_FIONBIO 1",
+        "#  define HAVE_IOCTL_SIOCGIFADDR 1",
+        "#  define HAVE_LIBGEN_H 1",
+        "#  define HAVE_LIBZ 1",
+        "#  define HAVE_LIMITS_H 1",
+        "#  define HAVE_LL 1",
+        "#  define HAVE_LOCALE_H 1",
+        "#  define HAVE_LOCALTIME_R 1",
+        "#  define HAVE_LONGLONG 1",
+        "#  define HAVE_MEMORY_H 1",
+        "#  define HAVE_NETDB_H 1",
+        "#  define HAVE_NETINET_IN_H 1",
+        "#  define HAVE_NETINET_TCP_H 1",
+        "#  define HAVE_NET_IF_H 1",
+        "#  define HAVE_PERROR 1",
+        "#  define HAVE_PIPE 1",
+        "#  define HAVE_POLL 1",
+        "#  define HAVE_POLL_FINE 1",
+        "#  define HAVE_POLL_H 1",
+        "#  define HAVE_POSIX_STRERROR_R 1",
+        "#  define HAVE_PWD_H 1",
+        "#  define HAVE_RECV 1",
+        "#  define HAVE_SELECT 1",
+        "#  define HAVE_SEND 1",
+        "#  define HAVE_SETJMP_H 1",
+        "#  define HAVE_SETLOCALE 1",
+        "#  define HAVE_SETRLIMIT 1",
+        "#  define HAVE_SETSOCKOPT 1",
+        "#  define HAVE_SGTTY_H 1",
+        "#  define HAVE_SIGACTION 1",
+        "#  define HAVE_SIGINTERRUPT 1",
+        "#  define HAVE_SIGNAL 1",
+        "#  define HAVE_SIGNAL_H 1",
+        "#  define HAVE_SIGSETJMP 1",
+        "#  define HAVE_SIG_ATOMIC_T 1",
+        "#  define HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1",
+        "#  define HAVE_SOCKET 1",
+        "#  define HAVE_SOCKETPAIR 1",
+        "#  define HAVE_STDBOOL_H 1",
+        "#  define HAVE_STDINT_H 1",
+        "#  define HAVE_STDIO_H 1",
+        "#  define HAVE_STDLIB_H 1",
+        "#  define HAVE_STRCASECMP 1",
+        "#  define HAVE_STRDUP 1",
+        "#  define HAVE_STRERROR_R 1",
+        "#  define HAVE_STRINGS_H 1",
+        "#  define HAVE_STRING_H 1",
+        "#  define HAVE_STRNCASECMP 1",
+        "#  define HAVE_STRSTR 1",
+        "#  define HAVE_STRTOK_R 1",
+        "#  define HAVE_STRTOLL 1",
+        "#  define HAVE_STRUCT_SOCKADDR_STORAGE 1",
+        "#  define HAVE_STRUCT_TIMEVAL 1",
+        "#  define HAVE_SYS_IOCTL_H 1",
+        "#  define HAVE_SYS_PARAM_H 1",
+        "#  define HAVE_SYS_POLL_H 1",
+        "#  define HAVE_SYS_RESOURCE_H 1",
+        "#  define HAVE_SYS_SELECT_H 1",
+        "#  define HAVE_SYS_SOCKET_H 1",
+        "#  define HAVE_SYS_STAT_H 1",
+        "#  define HAVE_SYS_TIME_H 1",
+        "#  define HAVE_SYS_TYPES_H 1",
+        "#  define HAVE_SYS_UIO_H 1",
+        "#  define HAVE_SYS_UN_H 1",
+        "#  define HAVE_SYS_WAIT_H 1",
+        "#  define HAVE_SYS_XATTR_H 1",
+        "#  define HAVE_TIME_H 1",
+        "#  define HAVE_UNAME 1",
+        "#  define HAVE_UNISTD_H 1",
+        "#  define HAVE_UTIME 1",
+        "#  define HAVE_UTIME_H 1",
+        "#  define HAVE_VARIADIC_MACROS_C99 1",
+        "#  define HAVE_VARIADIC_MACROS_GCC 1",
+        "#  define HAVE_WRITABLE_ARGV 1",
+        "#  define HAVE_WRITEV 1",
+        "#  define HAVE_ZLIB_H 1",
+        "#  define LT_OBJDIR \".libs/\"",
+        "#  define PACKAGE \"curl\"",
+        "#  define PACKAGE_BUGREPORT \"a suitable curl mailing list: https://curl.haxx.se/mail/\"",
+        "#  define PACKAGE_NAME \"curl\"",
+        "#  define PACKAGE_STRING \"curl -\"",
+        "#  define PACKAGE_TARNAME \"curl\"",
+        "#  define PACKAGE_URL \"\"",
+        "#  define PACKAGE_VERSION \"-\"",
+        "#  define RECV_TYPE_ARG1 int",
+        "#  define RECV_TYPE_ARG2 void *",
+        "#  define RECV_TYPE_ARG3 size_t",
+        "#  define RECV_TYPE_ARG4 int",
+        "#  define RECV_TYPE_RETV ssize_t",
+        "#  define RETSIGTYPE void",
+        "#  define SELECT_QUAL_ARG5",
+        "#  define SELECT_TYPE_ARG1 int",
+        "#  define SELECT_TYPE_ARG234 fd_set *",
+        "#  define SELECT_TYPE_ARG5 struct timeval *",
+        "#  define SELECT_TYPE_RETV int",
+        "#  define SEND_QUAL_ARG2 const",
+        "#  define SEND_TYPE_ARG1 int",
+        "#  define SEND_TYPE_ARG2 void *",
+        "#  define SEND_TYPE_ARG3 size_t",
+        "#  define SEND_TYPE_ARG4 int",
+        "#  define SEND_TYPE_RETV ssize_t",
+        "#  define SIZEOF_INT 4",
+        "#  define SIZEOF_SHORT 2",
+        "#  define STDC_HEADERS 1",
+        "#  define STRERROR_R_TYPE_ARG3 size_t",
+        "#  define TIME_WITH_SYS_TIME 1",
+        "#  define VERSION \"-\"",
+        "#  ifndef _DARWIN_USE_64_BIT_INODE",
+        "#    define _DARWIN_USE_64_BIT_INODE 1",
+        "#  endif",
+        "#endif",
+        "",
+        "#endif  // EXTERNAL_CURL_INCLUDE_CURL_CONFIG_H_",
+    ]) + "\n" + select({
+        ":linux_x86_64": "\n".join([
+            "#  define SIZEOF_LONG 8",
+            "#  define SIZEOF_OFF_T 8",
+            "#  define SIZEOF_CURL_OFF_T 8",
+            "#  define SIZEOF_SIZE_T 8",
+            "#  define SIZEOF_TIME_T 8",
+            "#  define SIZEOF_VOIDP 8",
+        ]),
+        ":linux_arm64": "\n".join([
+            "#  define SIZEOF_LONG 8",
+            "#  define SIZEOF_OFF_T 8",
+            "#  define SIZEOF_CURL_OFF_T 8",
+            "#  define SIZEOF_SIZE_T 8",
+            "#  define SIZEOF_TIME_T 8",
+            "#  define SIZEOF_VOIDP 8",
+        ]),
+        ":linux_armv7": "\n".join(
+            [
+                "#  define SIZEOF_LONG 4",
+                "#  define SIZEOF_OFF_T 4",
+                "#  define SIZEOF_CURL_OFF_T 4",
+                "#  define SIZEOF_SIZE_T 4",
+                "#  define SIZEOF_TIME_T 4",
+                "#  define SIZEOF_VOIDP 4",
+            ],
+        ),
+        "//conditions:default": "",
+    }) + "\nEOF",
+)