libcurl and openssl minimum requrements

[hqho]

Query/Question
What is the minimum liburl and openssl version that is needed for the SDK?

Why is this not a Bug or a feature Request?
General question

Setup (please complete the following information if applicable):

• OS: [SLES12SP3]
• IDE : [e.g. IntelliJ]
• [azure-storage-blobs_12.10.0]

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Query Added
• Setup information Added

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @EmmaZhu @Jinming-Hu @vinjiang.

[LarryOsterman]

We should support all supported OpenSSL versions, which in practice means versions greater than 3.0.

It's easier to answer the libcurl question if you can let us know which version of libcurl you're interested in targeting.

[hqho]

We are currently targeting libcurl version 7.37.0.

[LarryOsterman]

We have functionality which depends on Curl 7.77, but it is conditionally compiled on LIBCURL_VERSION_NUM. So hopefully 7.37.0 should be supported.

However, 7.37.0 is an extremely old (9 years) version and it's highly likely there are security bugs in that version so using a newer version is likely a good idea.

[hqho]

Thanks!

[herveyw-msft]

@LarryOsterman : the Storage SDK does not build with OpenSSL 3.1 because it uses deprecated MD5 API, is this being tracked? How about libcurl 8.8?

[LarryOsterman]

Reflecting an offline conversation: Current revisions of the Storage SDK build with OpenSSL 3. Older versions do not due to deprecated API changes during the OpenSSL 1->OpenSSL 3 conversion.

In @herveyw-msft's case he consumes the storage SDK via a cmake fetch-content directive (effectively pulling the Azure SDK as a submodule), the version of the storage SDK that he uses predates the OpenSSL 3 conversion, and he has challenges with newer SDKs due to additional dependencies for non-storage packages.