no way to use /etc/ssl/certs system trust directory with GnuTLS

[dangowrt]

When building with GnuTLS, curl doesn't utilize GnuTLS' system trust nor does it support to use a CA path at build time 1 nor at run-time, though defined at least for recent versions of GnuTLS in 2.
This is odd, as it leaves users of distributions not shipping a certificate bundle (which could be used using --cacert) but only come with a bunch of files in /etc/ssl/certs/ without any option to get working TLS with curl and GnuTLS out-of-the-box.

[ghedo]

nor does it support to use a CA path at build time 1 nor at run-time

This is just not true. You can use the --with-ca-path=/etc/ssl/certs configure option at build time and the CURLOPT_CAPATH option at runtime to set the CA path. I should know, since I wrote the code to support this. In fact the official Debian packages do set --with-ca-path with the GnuTLS flavour at build time just fine.

[ghedo]

though defined at least for recent versions of GnuTLS in 2

Although yes, it does require GnuTLS 3.3.6 or later (your patch also requires at least GnuTLS 3.0.10)

[ghedo]

at least GnuTLS 3.0.10

Sorry, I meant 3.0.20.

[dangowrt]

I see, that was by commit 5a1614c which is quite recent. I'll see if cherry-picking that instead also solves the issue.

[dangowrt]

I added GnuTLS version check and updated the pull-request, see https://github.com/dangowrt/curl/commit/03dcd3c085b4c22c5788fab345f6acd68d3b64d0
Using --with-ca-path indeed works after 5a1614c on recent-enough GnuTLS.