Removing ssh dependency does not remove dependency on openssl{-sys}

[DarrienG]

Via the README: https://github.com/rust-lang/git2-rs#building-on-osx-1010

If the ssh feature is enabled (and it is by default) then this library depends on libssh2 which depends on OpenSSL. To get OpenSSL working follow the openssl crate's instructions.

However disabling the feature only removes the dependency on openssh{-sys}. git2 still depends on openssl when the Cargo.toml only has the https feature:

git2 = { version = "0.13.25", default_features = false, features = [ "https" ] }

Reproducible example with git2 version: 0.13.25: https://gitlab.com/DarrienG/git-sample2/-/blob/main/Cargo.lock#L99

Is this intended? Based on the README it looked like removing ssh should have removed the openssl dependency in its entirety.

I noticed this when intending to remove the openssl dependency in one of my larger projects: https://gitlab.com/ttyperacer/terminal-typeracer/-/merge_requests/86

I can confirm there are still attempts to bind with the C library with an attempt to cross compile to Linux from macOS:

🜛 libgit-test [main] cargo zigbuild --target aarch64-unknown-linux-gnu
...
  --- stderr
  thread 'main' panicked at '

  Could not find directory of OpenSSL installation, and this `-sys` crate cannot
  proceed without this knowledge. If OpenSSL is installed and this crate had
  trouble finding it,  you can set the `OPENSSL_DIR` environment variable for the
  compilation process.

  Make sure you also have the development packages of openssl installed.
  For example, `libssl-dev` on Ubuntu or `openssl-devel` on Fedora.

  If you're in a situation where you think the directory *should* be found
  automatically, please open a bug at https://github.com/sfackler/rust-openssl
  and include information about your system as well as this message.

  $HOST = aarch64-apple-darwin
  $TARGET = aarch64-unknown-linux-gnu
  openssl-sys = 0.9.72

  ', /Users/darrien/.cargo/registry/src/github.com-1ecc6299db9ec823/openssl-sys-0.9.72/build/find_normal.rs:180:5
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
warning: build failed, waiting for other jobs to finish...
error: build failed

If it is intended that's ok, I just want to make sure I understand. It would be nice for me to remove another C dep though :)

[DarrienG]

Hmm I do see there is an option to include a vendored version of openssl and libgit which seems to do the trick for removing openssl in its entirety:

-git2 = { version = "0.13.25", default_features = false, features = [ "https" ] }
+git2 = { version = "0.13.25", default_features = false, features = [ "https", "vendored-libgit2", "vendored-openssl" ] }

It might be worth adding a section in the building for macOS section if this is the intended away for removing the need for openssl.