cmake, Makefile.mk: use -isystem for dep headers, silence BearSSL issues

Patch started out for working around compiler warnings in BearSSL latest
tarball release v0.6 (2018-08-14) and Apple clang 14 with CMake.

Then turned into patching CMake and `Makefile.mk` builds to use
`-isystem` instead `-I` when adding header directories for
dependencies. This avoids compiler warnings in dependency headers,
syncing behaviour with autotools.

Also:
- `Makefile.mk`: add support for BearSSL.
- delete warning suppression for mbedTLS headers. No longer necessary
  after this patch.
  Follow-up to 434db995a7 #12720

Silenced BearSSL warnings:
```
In file included from curl/lib/vtls/bearssl.c:28:
In file included from bearssl/inc/bearssl.h:127:
bearssl/inc/bearssl_hash.h:727:5: warning: 'BR_DOXYGEN_IGNORE' is not defined, evaluates to 0 [-Wundef]
    ^
bearssl/inc/bearssl_hash.h:745:5: warning: 'BR_DOXYGEN_IGNORE' is not defined, evaluates to 0 [-Wundef]
    ^
In file included from curl/lib/vtls/bearssl.c:28:
In file included from bearssl/inc/bearssl.h:136:
bearssl/inc/bearssl_ssl.h:1253:20: warning: implicit conversion loses integer precision: 'unsigned int' to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
        cc->version_min = version_min;
                        ~ ^~~~~~~~~~~
bearssl/inc/bearssl_ssl.h:1254:20: warning: implicit conversion loses integer precision: 'unsigned int' to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
        cc->version_max = version_max;
                        ~ ^~~~~~~~~~~
bearssl/inc/bearssl_ssl.h:1327:28: warning: implicit conversion loses integer precision: 'size_t' (aka 'unsigned long') to 'uint16_t' (aka 'unsigned short') [-Wimplicit-int-conversion]
        ctx->protocol_names_num = num;
                                ~ ^~~
5 warnings generated.
```

(These warnings were fixed in BearSSL Git master in 2019 via
2893441f2efd4603ddd6d7f49011bdda096a4a87 and
ecdf89770ee82dfea6186fb4369cff3d06cd852e.)

Also these two cases, which are caused by an unidentified component
(outside curl) cranking up MSVC warnings in external headers to `/W4`
when ZLIB is deselected:
https://github.com/curl/curl/pull/14859#issuecomment-2351809153

mbedTLS 3.6.1:
```
C:\vcpkg\installed\x64-windows\include\psa\crypto_struct.h(254,13): error C2220: the following warning is treated as an error [D:\a\curl\curl\bld\lib\libcurl_object.vcxproj]
  (compiling source file 'CMakeFiles/libcurl_object.dir/Unity/unity_0_c.c')
C:\vcpkg\installed\x64-windows\include\psa\crypto_struct.h(254,13): warning C4200: nonstandard extension used: zero-sized array in struct/union [D:\a\curl\curl\bld\lib\libcurl_object.vcxproj]
  (compiling source file 'CMakeFiles/libcurl_object.dir/Unity/unity_0_c.c')
```
Ref: https://github.com/curl/curl/actions/runs/10842694205/job/30107466989?pr=14859#step:10:29

nghttp3 1.5.0:
```
C:\vcpkg\installed\x64-windows\include\nghttp3\nghttp3.h(2678,1): error C2220: the following warning is treated as an error [D:\a\curl\curl\bld\lib\libcurl_object.vcxproj]
  (compiling source file 'CMakeFiles/libcurl_object.dir/Unity/unity_0_c.c')
  C:\vcpkg\installed\x64-windows\include\nghttp3\nghttp3.h(2678,1): warning C4324: 'nghttp3_pri': structure was padded due to alignment specifier [D:\a\curl\curl\bld\lib\libcurl_object.vcxproj]
  (compiling source file 'CMakeFiles/libcurl_object.dir/Unity/unity_0_c.c')
```
Ref: https://github.com/curl/curl/actions/runs/10871875297/job/30166233862?pr=14859#step:10:28

Closes #14763

CMakeLists.txt

@@ -615,7 +615,7 @@ if(CURL_USE_MBEDTLS)
   set(USE_MBEDTLS ON)
   list(APPEND CURL_LIBS ${MBEDTLS_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "mbedtls")
-  include_directories(${MBEDTLS_INCLUDE_DIRS})
+  include_directories(SYSTEM ${MBEDTLS_INCLUDE_DIRS})
 
   if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "mbedtls")
     set(_valid_default_ssl_backend TRUE)
@@ -628,7 +628,7 @@ if(CURL_USE_BEARSSL)
   set(_ssl_enabled ON)
   set(USE_BEARSSL ON)
   list(APPEND CURL_LIBS ${BEARSSL_LIBRARIES})
-  include_directories(${BEARSSL_INCLUDE_DIRS})
+  include_directories(SYSTEM ${BEARSSL_INCLUDE_DIRS})
 
   if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "bearssl")
     set(_valid_default_ssl_backend TRUE)
@@ -644,7 +644,7 @@ if(CURL_USE_WOLFSSL)
   set(USE_WOLFSSL ON)
   list(APPEND CURL_LIBS ${WOLFSSL_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "wolfssl")
-  include_directories(${WOLFSSL_INCLUDE_DIRS})
+  include_directories(SYSTEM ${WOLFSSL_INCLUDE_DIRS})
 
   if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "wolfssl")
     set(_valid_default_ssl_backend TRUE)
@@ -669,7 +669,7 @@ if(CURL_USE_GNUTLS)
   list(APPEND CURL_LIBS ${GNUTLS_LIBRARIES} ${NETTLE_LIBRARIES})
   list(APPEND CURL_LIBDIRS ${NETTLE_LIBRARY_DIRS})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "gnutls" "nettle")
-  include_directories(${GNUTLS_INCLUDE_DIRS} ${NETTLE_INCLUDE_DIRS})
+  include_directories(SYSTEM ${GNUTLS_INCLUDE_DIRS} ${NETTLE_INCLUDE_DIRS})
   link_directories(${NETTLE_LIBRARY_DIRS})
   if(NETTLE_CFLAGS)
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${NETTLE_CFLAGS}")
@@ -695,7 +695,7 @@ if(CURL_USE_RUSTLS)
   set(USE_RUSTLS ON)
   list(APPEND CURL_LIBS ${RUSTLS_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "rustls")
-  include_directories(${RUSTLS_INCLUDE_DIRS})
+  include_directories(SYSTEM ${RUSTLS_INCLUDE_DIRS})
 
   if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "rustls")
     set(_valid_default_ssl_backend TRUE)
@@ -730,7 +730,7 @@ if(CURL_BROTLI)
     set(HAVE_BROTLI ON)
     list(APPEND CURL_LIBS ${BROTLI_LIBRARIES})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libbrotlidec")
-    include_directories(${BROTLI_INCLUDE_DIRS})
+    include_directories(SYSTEM ${BROTLI_INCLUDE_DIRS})
     list(APPEND CMAKE_REQUIRED_INCLUDES ${BROTLI_INCLUDE_DIRS})
   endif()
 endif()
@@ -743,7 +743,7 @@ if(CURL_ZSTD)
     set(HAVE_ZSTD ON)
     list(APPEND CURL_LIBS ${ZSTD_LIBRARIES})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libzstd")
-    include_directories(${ZSTD_INCLUDE_DIRS})
+    include_directories(SYSTEM ${ZSTD_INCLUDE_DIRS})
   else()
     message(WARNING "zstd v1.0.0 or newer is required, disabling zstd support.")
   endif()
@@ -836,7 +836,7 @@ option(USE_NGHTTP2 "Use nghttp2 library" ON)
 if(USE_NGHTTP2)
   find_package(NGHTTP2)
   if(NGHTTP2_FOUND)
-    include_directories(${NGHTTP2_INCLUDE_DIRS})
+    include_directories(SYSTEM ${NGHTTP2_INCLUDE_DIRS})
     list(APPEND CURL_LIBS ${NGHTTP2_LIBRARIES})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libnghttp2")
   else()
@@ -864,13 +864,13 @@ if(USE_NGTCP2)
   else()
     message(FATAL_ERROR "ngtcp2 requires OpenSSL, wolfSSL or GnuTLS")
   endif()
-  include_directories(${NGTCP2_INCLUDE_DIRS})
+  include_directories(SYSTEM ${NGTCP2_INCLUDE_DIRS})
   list(APPEND CURL_LIBS ${NGTCP2_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libngtcp2")
 
   find_package(NGHTTP3 REQUIRED)
   set(USE_NGHTTP3 ON)
-  include_directories(${NGHTTP3_INCLUDE_DIRS})
+  include_directories(SYSTEM ${NGHTTP3_INCLUDE_DIRS})
   list(APPEND CURL_LIBS ${NGHTTP3_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libnghttp3")
 endif()
@@ -885,7 +885,7 @@ if(USE_QUICHE)
     message(FATAL_ERROR "quiche requires BoringSSL")
   endif()
   openssl_check_quic()
-  include_directories(${QUICHE_INCLUDE_DIRS})
+  include_directories(SYSTEM ${QUICHE_INCLUDE_DIRS})
   list(APPEND CURL_LIBS ${QUICHE_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "quiche")
   if(NOT DEFINED HAVE_QUICHE_CONN_SET_QLOG_FD)
@@ -903,7 +903,7 @@ if(USE_MSH3)
     message(FATAL_ERROR "Only one HTTP/3 backend can be selected!")
   endif()
   find_package(MSH3 REQUIRED)
-  include_directories(${MSH3_INCLUDE_DIRS})
+  include_directories(SYSTEM ${MSH3_INCLUDE_DIRS})
   list(APPEND CURL_LIBS ${MSH3_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libmsh3")
 endif()
@@ -916,7 +916,7 @@ if(USE_OPENSSL_QUIC)
 
   find_package(NGHTTP3 REQUIRED)
   set(USE_NGHTTP3 ON)
-  include_directories(${NGHTTP3_INCLUDE_DIRS})
+  include_directories(SYSTEM ${NGHTTP3_INCLUDE_DIRS})
   list(APPEND CURL_LIBS ${NGHTTP3_LIBRARIES})
   list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libnghttp3")
 endif()
@@ -972,7 +972,7 @@ if(NOT CURL_DISABLE_LDAP)
       set(CMAKE_REQUIRED_INCLUDES ${CMAKE_REQUIRED_INCLUDES_BAK})  # LDAP includes will not be used
     else()
       if(CMAKE_LDAP_INCLUDE_DIR)
-        include_directories(${CMAKE_LDAP_INCLUDE_DIR})
+        include_directories(SYSTEM ${CMAKE_LDAP_INCLUDE_DIR})
       endif()
       list(APPEND CMAKE_REQUIRED_DEFINITIONS "-DLDAP_DEPRECATED=1")
       list(APPEND CMAKE_REQUIRED_LIBRARIES ${CMAKE_LDAP_LIB})
@@ -1044,7 +1044,7 @@ if(USE_LIBIDN2 AND NOT USE_APPLE_IDN AND NOT USE_WIN32_IDN)
     set(CURL_LIBS "${LIBIDN2_LIBRARIES};${CURL_LIBS}")
     list(APPEND CURL_LIBDIRS ${LIBIDN2_LIBRARY_DIRS})
     set(LIBCURL_PC_REQUIRES_PRIVATE "libidn2;${LIBCURL_PC_REQUIRES_PRIVATE}")
-    include_directories(${LIBIDN2_INCLUDE_DIRS})
+    include_directories(SYSTEM ${LIBIDN2_INCLUDE_DIRS})
     link_directories(${LIBIDN2_LIBRARY_DIRS})
     if(LIBIDN2_CFLAGS)
       set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${LIBIDN2_CFLAGS}")
@@ -1065,7 +1065,7 @@ if(CURL_USE_LIBPSL)
     list(APPEND CURL_LIBS ${LIBPSL_LIBRARIES})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libpsl")
     list(APPEND CMAKE_REQUIRED_INCLUDES "${LIBPSL_INCLUDE_DIRS}")
-    include_directories(${LIBPSL_INCLUDE_DIRS})
+    include_directories(SYSTEM ${LIBPSL_INCLUDE_DIRS})
     set(USE_LIBPSL ON)
   else()
     message(WARNING "libpsl is enabled, but not found.")
@@ -1083,7 +1083,7 @@ if(CURL_USE_LIBSSH2)
     list(APPEND CURL_LIBS ${LIBSSH2_LIBRARIES})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libssh2")
     list(APPEND CMAKE_REQUIRED_INCLUDES "${LIBSSH2_INCLUDE_DIRS}")
-    include_directories(${LIBSSH2_INCLUDE_DIRS})
+    include_directories(SYSTEM ${LIBSSH2_INCLUDE_DIRS})
     set(USE_LIBSSH2 ON)
   endif()
 endif()
@@ -1097,7 +1097,7 @@ if(NOT USE_LIBSSH2 AND CURL_USE_LIBSSH)
     list(APPEND CURL_LIBS ${LIBSSH_LIBRARIES})
     list(APPEND CURL_LIBDIRS ${LIBSSH_LIBRARY_DIRS})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libssh")
-    include_directories(${LIBSSH_INCLUDE_DIRS})
+    include_directories(SYSTEM ${LIBSSH_INCLUDE_DIRS})
     link_directories(${LIBSSH_LIBRARY_DIRS})
     if(LIBSSH_CFLAGS)
       set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${LIBSSH_CFLAGS}")
@@ -1116,7 +1116,7 @@ if(NOT USE_LIBSSH2 AND NOT USE_LIBSSH AND CURL_USE_WOLFSSH)
     if(WOLFSSH_FOUND)
       list(APPEND CURL_LIBS ${WOLFSSH_LIBRARIES})
       list(APPEND CMAKE_REQUIRED_INCLUDES "${WOLFSSH_INCLUDE_DIRS}")
-      include_directories(${WOLFSSH_INCLUDE_DIRS})
+      include_directories(SYSTEM ${WOLFSSH_INCLUDE_DIRS})
       set(USE_WOLFSSH ON)
     endif()
   else()
@@ -1132,7 +1132,7 @@ if(CURL_USE_GSASL)
     list(APPEND CURL_LIBS ${LIBGSASL_LIBRARIES})
     list(APPEND CURL_LIBDIRS ${LIBGSASL_LIBRARY_DIRS})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libgsasl")
-    include_directories(${LIBGSASL_INCLUDE_DIRS})
+    include_directories(SYSTEM ${LIBGSASL_INCLUDE_DIRS})
     link_directories(${LIBGSASL_LIBRARY_DIRS})
     if(LIBGSASL_CFLAGS)
       set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${LIBGSASL_CFLAGS}")
@@ -1185,7 +1185,7 @@ if(CURL_USE_GSSAPI)
       endif()
     endif()
 
-    include_directories(${GSS_INCLUDE_DIRS})
+    include_directories(SYSTEM ${GSS_INCLUDE_DIRS})
     link_directories(${GSS_LIBRARY_DIRS})
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${GSS_CFLAGS}")
     set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${GSS_LDFLAGS}")
@@ -1212,7 +1212,7 @@ if(CURL_USE_LIBUV)
     list(APPEND CURL_LIBS ${LIBUV_LIBRARIES})
     list(APPEND CURL_LIBDIRS ${LIBUV_LIBRARY_DIRS})
     list(APPEND LIBCURL_PC_REQUIRES_PRIVATE "libuv")
-    include_directories(${LIBUV_INCLUDE_DIRS})
+    include_directories(SYSTEM ${LIBUV_INCLUDE_DIRS})
     link_directories(${LIBUV_LIBRARY_DIRS})
     if(LIBUV_CFLAGS)
       set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${LIBUV_CFLAGS}")

lib/CMakeLists.txt

@@ -43,7 +43,7 @@ include_directories(
   "${CMAKE_CURRENT_SOURCE_DIR}"
 )
 if(USE_ARES)
-  include_directories(${CARES_INCLUDE_DIRS})
+  include_directories(SYSTEM ${CARES_INCLUDE_DIRS})
 endif()
 
 if(BUILD_TESTING)

lib/Makefile.mk

@@ -96,7 +96,7 @@ ifneq ($(findstring -sync,$(CFG)),)
 else ifneq ($(findstring -ares,$(CFG)),)
   LIBCARES_PATH ?= $(PROOT)/../c-ares
   CPPFLAGS += -DUSE_ARES
-  CPPFLAGS += -I"$(LIBCARES_PATH)/include"
+  CPPFLAGS += -isystem "$(LIBCARES_PATH)/include"
   LDFLAGS += -L"$(LIBCARES_PATH)/lib"
   LIBS += -lcares
 endif
@@ -104,7 +104,7 @@ endif
 ifneq ($(findstring -rtmp,$(CFG)),)
   LIBRTMP_PATH ?= $(PROOT)/../librtmp
   CPPFLAGS += -DUSE_LIBRTMP
-  CPPFLAGS += -I"$(LIBRTMP_PATH)"
+  CPPFLAGS += -isystem "$(LIBRTMP_PATH)"
   LDFLAGS += -L"$(LIBRTMP_PATH)/librtmp"
   LIBS += -lrtmp
   ZLIB := 1
@@ -113,19 +113,19 @@ endif
 ifneq ($(findstring -ssh2,$(CFG)),)
   LIBSSH2_PATH ?= $(PROOT)/../libssh2
   CPPFLAGS += -DUSE_LIBSSH2
-  CPPFLAGS += -I"$(LIBSSH2_PATH)/include"
+  CPPFLAGS += -isystem "$(LIBSSH2_PATH)/include"
   LDFLAGS += -L"$(LIBSSH2_PATH)/lib"
   LIBS += -lssh2
 else ifneq ($(findstring -libssh,$(CFG)),)
   LIBSSH_PATH ?= $(PROOT)/../libssh
   CPPFLAGS += -DUSE_LIBSSH
-  CPPFLAGS += -I"$(LIBSSH_PATH)/include"
+  CPPFLAGS += -isystem "$(LIBSSH_PATH)/include"
   LDFLAGS += -L"$(LIBSSH_PATH)/lib"
   LIBS += -lssh
 else ifneq ($(findstring -wolfssh,$(CFG)),)
   WOLFSSH_PATH ?= $(PROOT)/../wolfssh
   CPPFLAGS += -DUSE_WOLFSSH
-  CPPFLAGS += -I"$(WOLFSSH_PATH)/include"
+  CPPFLAGS += -isystem "$(WOLFSSH_PATH)/include"
   LDFLAGS += -L"$(WOLFSSH_PATH)/lib"
   LIBS += -lwolfssh
 endif
@@ -136,7 +136,7 @@ ifneq ($(findstring -ssl,$(CFG)),)
   CPPFLAGS += -DCURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
   OPENSSL_INCLUDE ?= $(OPENSSL_PATH)/include
   OPENSSL_LIBPATH ?= $(OPENSSL_PATH)/lib
-  CPPFLAGS += -I"$(OPENSSL_INCLUDE)"
+  CPPFLAGS += -isystem "$(OPENSSL_INCLUDE)"
   LDFLAGS += -L"$(OPENSSL_LIBPATH)"
   OPENSSL_LIBS ?= -lssl -lcrypto
   LIBS += $(OPENSSL_LIBS)
@@ -153,7 +153,7 @@ ifneq ($(findstring -wolfssl,$(CFG)),)
   WOLFSSL_PATH ?= $(PROOT)/../wolfssl
   CPPFLAGS += -DUSE_WOLFSSL
   CPPFLAGS += -DSIZEOF_LONG_LONG=8
-  CPPFLAGS += -I"$(WOLFSSL_PATH)/include"
+  CPPFLAGS += -isystem "$(WOLFSSL_PATH)/include"
   LDFLAGS += -L"$(WOLFSSL_PATH)/lib"
   LIBS += -lwolfssl
   SSLLIBS += 1
@@ -161,16 +161,24 @@ endif
 ifneq ($(findstring -mbedtls,$(CFG)),)
   MBEDTLS_PATH ?= $(PROOT)/../mbedtls
   CPPFLAGS += -DUSE_MBEDTLS
-  CPPFLAGS += -I"$(MBEDTLS_PATH)/include"
+  CPPFLAGS += -isystem "$(MBEDTLS_PATH)/include"
   LDFLAGS += -L"$(MBEDTLS_PATH)/lib"
   LIBS += -lmbedtls -lmbedx509 -lmbedcrypto
   SSLLIBS += 1
 endif
+ifneq ($(findstring -bearssl,$(CFG)),)
+  BEARSSL_PATH ?= $(PROOT)/../bearssl
+  CPPFLAGS += -DUSE_BEARSSL
+  CPPFLAGS += -isystem "$(BEARSSL_PATH)/inc"
+  LDFLAGS += -L"$(BEARSSL_PATH)/build"
+  LIBS += -lbearssl
+  SSLLIBS += 1
+endif
 
 ifneq ($(findstring -nghttp2,$(CFG)),)
   NGHTTP2_PATH ?= $(PROOT)/../nghttp2
   CPPFLAGS += -DUSE_NGHTTP2
-  CPPFLAGS += -I"$(NGHTTP2_PATH)/include"
+  CPPFLAGS += -isystem "$(NGHTTP2_PATH)/include"
   LDFLAGS += -L"$(NGHTTP2_PATH)/lib"
   LIBS += -lnghttp2
 endif
@@ -178,13 +186,13 @@ endif
 ifeq ($(findstring -nghttp3,$(CFG))$(findstring -ngtcp2,$(CFG)),-nghttp3-ngtcp2)
   NGHTTP3_PATH ?= $(PROOT)/../nghttp3
   CPPFLAGS += -DUSE_NGHTTP3
-  CPPFLAGS += -I"$(NGHTTP3_PATH)/include"
+  CPPFLAGS += -isystem "$(NGHTTP3_PATH)/include"
   LDFLAGS += -L"$(NGHTTP3_PATH)/lib"
   LIBS += -lnghttp3
 
   NGTCP2_PATH ?= $(PROOT)/../ngtcp2
   CPPFLAGS += -DUSE_NGTCP2
-  CPPFLAGS += -I"$(NGTCP2_PATH)/include"
+  CPPFLAGS += -isystem "$(NGTCP2_PATH)/include"
   LDFLAGS += -L"$(NGTCP2_PATH)/lib"
 
   NGTCP2_LIBS ?=
@@ -207,7 +215,7 @@ ifneq ($(findstring -zlib,$(CFG))$(ZLIB),)
   ZLIB_PATH ?= $(PROOT)/../zlib
   # These CPPFLAGS are also required when compiling the curl tool via 'src'.
   CPPFLAGS += -DHAVE_LIBZ
-  CPPFLAGS += -I"$(ZLIB_PATH)/include"
+  CPPFLAGS += -isystem "$(ZLIB_PATH)/include"
   LDFLAGS += -L"$(ZLIB_PATH)/lib"
   ZLIB_LIBS ?= -lz
   LIBS += $(ZLIB_LIBS)
@@ -216,7 +224,7 @@ endif
 ifneq ($(findstring -zstd,$(CFG)),)
   ZSTD_PATH ?= $(PROOT)/../zstd
   CPPFLAGS += -DHAVE_ZSTD
-  CPPFLAGS += -I"$(ZSTD_PATH)/include"
+  CPPFLAGS += -isystem "$(ZSTD_PATH)/include"
   LDFLAGS += -L"$(ZSTD_PATH)/lib"
   ZSTD_LIBS ?= -lzstd
   LIBS += $(ZSTD_LIBS)
@@ -224,7 +232,7 @@ endif
 ifneq ($(findstring -brotli,$(CFG)),)
   BROTLI_PATH ?= $(PROOT)/../brotli
   CPPFLAGS += -DHAVE_BROTLI
-  CPPFLAGS += -I"$(BROTLI_PATH)/include"
+  CPPFLAGS += -isystem "$(BROTLI_PATH)/include"
   LDFLAGS += -L"$(BROTLI_PATH)/lib"
   BROTLI_LIBS ?= -lbrotlidec -lbrotlicommon
   LIBS += $(BROTLI_LIBS)
@@ -232,7 +240,7 @@ endif
 ifneq ($(findstring -gsasl,$(CFG)),)
   LIBGSASL_PATH ?= $(PROOT)/../gsasl
   CPPFLAGS += -DUSE_GSASL
-  CPPFLAGS += -I"$(LIBGSASL_PATH)/include"
+  CPPFLAGS += -isystem "$(LIBGSASL_PATH)/include"
   LDFLAGS += -L"$(LIBGSASL_PATH)/lib"
   LIBS += -lgsasl
 endif
@@ -240,14 +248,14 @@ endif
 ifneq ($(findstring -idn2,$(CFG)),)
   LIBIDN2_PATH ?= $(PROOT)/../libidn2
   CPPFLAGS += -DHAVE_LIBIDN2 -DHAVE_IDN2_H
-  CPPFLAGS += -I"$(LIBIDN2_PATH)/include"
+  CPPFLAGS += -isystem "$(LIBIDN2_PATH)/include"
   LDFLAGS += -L"$(LIBIDN2_PATH)/lib"
   LIBS += -lidn2
 
 ifneq ($(findstring -psl,$(CFG)),)
   LIBPSL_PATH ?= $(PROOT)/../libpsl
   CPPFLAGS += -DUSE_LIBPSL
-  CPPFLAGS += -I"$(LIBPSL_PATH)/include"
+  CPPFLAGS += -isystem "$(LIBPSL_PATH)/include"
   LDFLAGS += -L"$(LIBPSL_PATH)/lib"
   LIBS += -lpsl
 endif
@@ -259,7 +267,7 @@ endif
 
 ifneq ($(findstring -watt,$(CFG))$(MSDOS),)
   WATT_PATH ?= $(PROOT)/../watt
-  CPPFLAGS += -I"$(WATT_PATH)/inc"
+  CPPFLAGS += -isystem "$(WATT_PATH)/inc"
   LDFLAGS += -L"$(WATT_PATH)/lib"
   LIBS += -lwatt
 endif

lib/vtls/mbedtls.c

@@ -36,13 +36,6 @@
 /* Define this to enable lots of debugging for mbedTLS */
 /* #define MBEDTLS_DEBUG */
 
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-/* mbedTLS (as of v3.5.1) has a duplicate function declaration
-   in its public headers. Disable the warning that detects it. */
-#pragma GCC diagnostic ignored "-Wredundant-decls"
-#endif
-
 #include <mbedtls/version.h>
 #if MBEDTLS_VERSION_NUMBER >= 0x02040000
 #include <mbedtls/net_sockets.h>
@@ -63,10 +56,6 @@
 #  endif
 #endif
 
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
-
 #include "cipher_suite.h"
 #include "strcase.h"
 #include "urldata.h"