Installation not DESTDIR-aware

[Aethedor]

I use mbed TLS in my project, the Hiawatha webserver. When building the package, the installation of the mbed TLS library files fails. I have to patch the file library/CMakeLists.txt to make it work:

diff -ur mbedtls/library/CMakeLists.txt mbedtls/library/CMakeLists.txt
--- mbedtls/library/CMakeLists.txt      2025-10-14 18:14:11.800256300 +0200
+++ mbedtls/library/CMakeLists.txt      2026-02-21 17:34:48.801654113 +0100
@@ -362,7 +362,7 @@
                     RENAME "libmbedcrypto.so.${MBEDTLS_VERSION}"
             )
             install(CODE "
-                set(_libdir \"\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}\")
+                set(_libdir \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}\")

                 execute_process(COMMAND \"\${CMAKE_COMMAND}\" -E create_symlink
                                 \"libmbedcrypto.so.${MBEDTLS_VERSION}\"

If you want to see for your self, try the Hiawatha source: https://hiawatha.leisink.net/files/hiawatha-12.0.tar.gz The script extra/make_debian_package builds the package I was talking about. That one sets the DESTDIR environment variable.

[gilles-peskine-arm]

We removed support for DESTDIR in TF-PSA-Crypto 1.0 and Mbed TLS 4.0 as a side effect of switching to CMake as the only build system. CMake has its own way of specifying an installation prefix.

That being said, there definitely is value in supporting the very common DESTDIR convention, regardless of whether there is CMake involvement. So much that modern CMake (≥3.12) has native support of DESTDIR. So we should support that.

It would help if you could submit a patch to both TF-PSA-Crypto and mbedtls, with both the necessary changes to **/CMakeLists.txt and a new or modified test in tests/scripts/components-build-system.sh to test that it works.