The viewer's live-broker client goes back to cpp-httplib, which the broker
already fetches; libcurl was only there for Kerberos, which is no longer
wanted. HTTPS comes from Mbed TLS 4.2.0, fetched and statically linked for
viewer builds only, so one TLS backend now serves Linux, Windows and macOS
(the macOS viewer previously had no TLS at all, and Linux needed host
OpenSSL >= 3.0). cpp-httplib verifies servers against the OS trust store:
the Windows certificate store, the macOS Keychain, the CA bundle on Linux.
CPPHTTPLIB_MBEDTLS_SUPPORT is set on jfjoch_viewer only, not on
httplib::httplib, so the broker stays plain HTTP. JFJochHttpReader.cpp is
the only viewer source that includes httplib.h, and the header keeps
httplib::Client opaque so <windows.h> stays out of the other viewer units.
Checked on Linux: a viewer-only build links Mbed TLS statically, with no
curl and no system libssl; a standalone client built against the same
httplib + Mbed TLS fetches from real HTTPS hosts and rejects expired,
self-signed and wrong-host certificates. Windows and macOS are untested.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
leonarski_fandClaude Opus 5.5
89207fe2bd