CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

[bagder]

I did this

The CMake HTTP_ONLY=ON option is documented as "Disable all protocols except HTTP" (CMakeLists.txt:538), but the implementation (CMakeLists.txt:541-557) only sets CURL_DISABLE_* flags for non-SSH protocols. It does not disable CURL_USE_LIBSSH2 or CURL_USE_LIBSSH. Since CURL_USE_LIBSSH2 defaults to ON, a build on any system with libssh2 installed produces a binary that advertises and accepts SCP and SFTP.

(Reported by Stanislav Fort)

I expected the following

HTTP_ONLY should also disable SCP and SFTP

curl/libcurl version

current git

operating system

independent

[vszakats]

Historically (according to comment) this was implemented in CMake as
a copy of the HTTP_ONLY macro in curl_setup.h. This macro also
does not disable SCP/SFTP (nor IPFS).

The CMake option is also documented as "overriding all CURL_DISABLE_*"
options, and SCP/SFTP does not have such option. (also ./configure lacks
a similar option, aside from passing the macro via CPPFLAGS, but that
skews the ./configure protocols: display.)

To fix it cleanly, I guess, SCP/SFTP would need its own disable option, and
make the HTTP_ONLY option (and macro) disable it? Or undef
USE_SSH, but in curl_setup.h this will need delicate reordering.

Personally I find this pair of options generally weird and according to Git
history they're often out of sync with this promise and with each other.
Maybe it's also an option to drop/deprecate support for them?

[bagder]

After discussions we have decided that this option is best dropped. It also has no matching configure alternative.