Nice to see BearSSL being used. Definitely my favorite SSL library. No memory allocations by the lib itself. Still missing TLS1.3 though.

very interested in this project, bearssl is released as beta quality, not sure how active it is developed these days but I'm happy to get rid of the heavy openssl when possible especially for embedded devices.

out of curiosity is it no allocations because it's bring your own buffer?

Yes.

Looks interesting.

There’s also facil[0], and h20 (though the latter is more of a standalone thing, it seems).

It might be fun to try to build something on top of them in something like Chicken Scheme or Janet.

[0] https://facil.io/

h2o still is pretty modular and it's easy to for example rip out their http/1.1 parser and use it. Other projects tend to accumulate a large utils.h or similar over time wrapping every other libc function, have typedefs, macros left and right etc. so you'd either pull all this in too or spend a few days undoing everything.

Question: what is the state of thinking behind managing external dependencies in C? This project appears to just check them into source, which is pretty simple, and I am tempted to do so on my own projects. Is this the preferred method after years of not-so-popular attempts at package managers and various issues with things like CMake external sources, github submodules/subrepos or custom scripts to download source?

One approach some recommend is single file headers, which are self contained libraries that require nothing more than an include most of the time. Search "single file headers" for more info.

Package managers (haven't tried them) and vendoring (checking into source) are the other approaches I know of.

It says it works on "Linux, macOS or FreeBSD". What would you use on a microcontroller (eg. Arm)?

Code looks pristine. Very nice!

interesting project!