curl.sh: disable RANDOM_FILE

curl.sh

@@ -404,13 +404,23 @@ _VER="$1"
     # Ensure they are set as in native builds.
     options+=' -DHAVE_WRITABLE_ARGV=1'
     if [ "${_CRT}" = 'musl' ]; then
-      options+=' -DRANDOM_FILE=/dev/urandom'  # FIXME: Disable for all MUSL targets? (Not currently supported by curl's CMake.)
       options+=' -DHAVE_POLL_FINE=1'
-    else
-      options+=' -DRANDOM_FILE=/dev/urandom'
-      if [ "${CURL_VER_}" != '8.9.1' ]; then
-        options+=' -DHAVE_POLL_FINE=1'  # No longer needed after https://github.com/curl/curl/pull/14734
-      fi
+    elif [ "${CURL_VER_}" != '8.9.1' ]; then
+      options+=' -DHAVE_POLL_FINE=1'  # No longer needed after https://github.com/curl/curl/pull/14734
+    fi
+  fi
+
+  # /dev/urandom is only necessary in libcurl in some limited cases,
+  # e.g. Rustls, and mbedTLS without built-in random support.
+  # It is also not detected in cross-builds, making Linux binaries for
+  # non-native CPUs different. For MUSL builds in particular, there is no
+  # guarantee that the build machine's `/dev/urandom` is present at runtime.
+  # For macOS builds its likely there, but also unnecessary.
+  # Disable it for all Linux and macOS builds.
+  if [ "${CURL_VER_}" != '8.9.1' ] && \
+     [ "${CURL_VER_}" != '8.10.0' ]; then
+    if [ "${_OS}" = 'linux' ] || [ "${_OS}" = 'mac' ]; then
+      options+=' -DRANDOM_FILE=OFF'
     fi
   fi