Commit Graph

37543 Commits

Author SHA1 Message Date
Viktor Szakats
716637520d
Makefile.am: delete RPM targets referencing non-existent files
Follow-up to bae0d473f5 #3331

Closes #20270
2026-01-12 22:19:40 +01:00
Jay Satiro
3652127e81 tool_cb_hdr: suppress header output when --out-null
This change brings --out-null more in line with the documentation which
says --out-null is expected to behave like a portable -o /dev/null.

Prior to this change curl did not suppress the header output from --head
when --out-null was used to suppress output.

Assisted-by: Daniel Stenberg
Reported-by: Andrew Kvalheim

Ref: https://curl.se/docs/manpage.html#--out-null

Fixes https://github.com/curl/curl/discussions/20235
Closes https://github.com/curl/curl/pull/20256
2026-01-12 15:36:44 -05:00
Viktor Szakats
13f0ede730
build: add curl-lint/lint targets, CURL_LINT cmake option
To run checksrc and spacecheck on the source tree. Also for cmake
to sync up with autotools' `checksrc` target.

- cmake: `curl-lint`
  With `-DCURL_LINT=ON`, checks run automatically for all targets.
- autotools: `lint`

Closes #20175
2026-01-12 16:45:24 +01:00
Viktor Szakats
9dc2552ed1
GHA/checkdocs: drop duplicate spacecheck job
No longer necessary after making GHA/checksrc also run on `*.md` file
changes.

Reported-by: Daniel Stenberg
Bug: https://github.com/curl/curl/pull/20266#issuecomment-3738955165
Follow-up to 3800a26582 #18935
Follow-up to 9acecc923d #15423
Closes #20268
2026-01-12 16:31:23 +01:00
Patrick Monnerat
67d0bfc6c2
tool_filetime: sync dummy macro signature with function prototype
Closes #20265
2026-01-12 16:29:32 +01:00
Patrick Monnerat
c326506115
rtsp: match connection_check procedure with required signature
Follow-up to e3691612ea

Closes #20265
2026-01-12 16:29:32 +01:00
Viktor Szakats
41a6eeadf6
GHA/non-native: disable FreeBSD arm CI jobs (upstream breakage)
Package manager is not finding packages.

FreeBSD 15, moving to cmake, dropping impacket, stunnel, ldap, kerberos,
could not fix it.

Closes #20267
2026-01-12 16:26:49 +01:00
Daniel Stenberg
44312b4b11
mimepost: allocate main struct on-demand
This makes the easy handle 432 bytes smaller (totally 5352 bytes on my
rather maximized Linux 64 bit build). The 440 byte mimepost struct is
now allocated only when needed.

Closes #20260
2026-01-12 16:21:02 +01:00
Daniel Stenberg
9e0b02c19c
urldata: change 'keep_post' into three distinct bitfields
Closes #20262
2026-01-12 16:20:14 +01:00
Daniel Stenberg
31fbbb322e
altsvc: only accept 17 byte dates from files
Since the date format is fixed there is no need to accept more data.

Update test355 to verify reject of too long date in alt-svc file

This test case was originally supposed to verify alt-svc loading from a
file but never did because it was done incorrectly.

Now it verifies that a too long date in the input file makes curl
disregard the entry.

Closes #20259
2026-01-12 13:49:57 +01:00
Daniel Stenberg
40fee505a0
tool_operate: split single_transfer into sub functions
To make it more manageable and less complex

Closes #20258
2026-01-12 08:42:23 +01:00
Daniel Stenberg
bd3b2a626a
libssh: simplify myssh_statemach_act()
Reduce complexity by splitting out sub functions.

Made myssh_quote_error() to reduce code duplication.

Closes #20252
2026-01-11 23:28:54 +01:00
Viktor Szakats
1b24428d62
GHA: delete disable-man-db hack, runners doing it by default now
Refs:
1f107542ae
https://github.com/actions/runner-images/pull/13268
https://github.com/actions/runner-images/issues/13213

Follow-up to 5acba8bc36 #17181

Closes #20254
2026-01-11 15:40:21 +01:00
Viktor Szakats
a6087d69a9
GHA: delete new apt sources adding the flaky distro source
CI workflows deleted apt package source `microsoft-prod.list` due to
flakiness seen in the past with those sources. Sources are still flaky
and they are now also used from `azure-cli.sources` which is included
by default by the runner images. Add it to the delete list.

Also: remove another new, unnecessary (for curl CI) package source seen
on the `ubuntu-24.04-arm` runner, for good measure, and performance.

Fixing:
```
Reading package lists...
E: Failed to fetch https://packages.microsoft.com/repos/azure-cli/dists/noble/InRelease  403  Forbidden [IP: 13.107.246.66 443]
E: The repository 'https://packages.microsoft.com/repos/azure-cli noble InRelease' is no longer signed.
Error: Process completed with exit code 100.
```
Ref: https://github.com/curl/curl/actions/runs/20896127602/job/60034941964?pr=20142#step:2:79

Follow-up to 303bb8785c #13473

Closes #20253
2026-01-11 15:25:19 +01:00
Daniel Stenberg
0596357584
wolfssl: fix build without USE_BIO_CHAIN
Reported-by: Megamouse on github
Fixes #20250
Closes #20251
2026-01-11 11:52:40 +01:00
Daniel Stenberg
2725d3cb85
altsvc: move logic from setopt into Curl_altsvc_ctrl()
To keep it all in one place.

Closes #20247
2026-01-11 10:44:43 +01:00
Viktor Szakats
219245a616
GHA: include runner CPU arch in cache keys (revert)
Turns out in practice the internal cache name contains the arch where it
matters (arm or dual-arch local builds), which is part of the cache key
string. Drop `runner.arch` to avoid two arch strings in the key.

Cache keys without an explicit arch designator mean intel.

Revert ff78af5752 #20234

Closes #20249
2026-01-11 01:42:21 +01:00
Viktor Szakats
d9fe60d457
GHA/linux: fix 'mbedtls' internal name confusion
`mbedtls-arm` and `mbedtls-prev` were matching `contains()` expressions
looking for `mbedtls`. It caused an unnecessary cache restore and an
redundant mbedtls build on bumps, and made the build flavors require
different local directory names to avoid this accidental collision.

Also drop `-threadsafe` from internal names. All local builds are.

Follow-up to 8806035344 #20240
Follow-up to 3a305831d1 #19077

Closes #20248
2026-01-11 01:01:13 +01:00
Viktor Szakats
5225e69ed9
GHA/linux: move 6 jobs with locally built dependencies to arm
All libresll jobs, wolfssl-all, and one mbedtls job.

As noted earlier, arm jobs run faster than intel ones, especially
valgrind steps that run almost twice as fast. Package install runs
slower, but this is offset by faster build and test steps, even in
non-valgrind jobs.

Follow-up to ff78af5752 #20234
Follow-up to 2b0d8dcc16 #20231

Closes #20246
2026-01-10 23:43:28 +01:00
Viktor Szakats
ff78af5752
GHA: include runner CPU arch in cache keys
To clarify the arch for cache entries, also to allow building/caching
multiple archs in parallel if necessary.

Closes #20234
2026-01-10 23:03:18 +01:00
Viktor Szakats
bfacfb2355
plan9: drop special build and orphaned references
Would need 64-bit support.

Ref: https://github.com/curl/curl/pull/20233#issuecomment-3732556015
Follow-up to 0159100f4f #20233

Closes #20243
2026-01-10 23:03:17 +01:00
Daniel Stenberg
7433a6eb3f
urldata: restore bitfield to unsigned int
Bug: https://github.com/curl/curl/pull/20209#pullrequestreview-3647160739

Reported-by: Patrick Monnerat
Follow-up to e3691612ea
Closes #20244
2026-01-10 22:42:05 +01:00
Viktor Szakats
f4b16563ab
cmake: drop unused LONG_LONG reference from Windows prefills
It's no longer used in curl.

Follow-up to 0159100f4f #20233

Closes #20241
2026-01-10 17:39:11 +01:00
Viktor Szakats
2465f7c61d
tool: improve error/warning messages when output filename sanitization fails
On MS-DOS (OOM and bad filename) and Windows (OOM only).

Given the rarity of both platform and error, we make a compromise and
return an unrelated libcurl error (43) in case of a bad output filename
on MS-DOS.

After:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/ --output out.txt
Warning: bad output filename
curl: (43) A libcurl function was given a bad argument

$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: bad output filename
curl: (43) A libcurl function was given a bad argument
```

Before:
```
$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/ --output out.txt
Warning: bad output glob
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/ --output out.txt
Warning: bad output glob
curl: (3) URL using bad/illegal format or missing URL

$ CURL_FN_SANITIZE_OOM=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: Failed to extract a filename from the URL to use for storage
curl: (27) Out of memory

$ CURL_FN_SANITIZE_BAD=1 wine curl.exe https://curl.se/index.html --globoff -O
curl: Failed to extract a filename from the URL to use for storage
curl: (3) URL using bad/illegal format or missing URL
```

Ref: #20116 (simpler reboot of)
Ref: #20113 #20121
Ref: 40c1748af5 #20198
Ref: eb7f5b71e5 #20143
Ref: 8c02407bef #20125
Fixes #20044
Closes #20199
2026-01-10 13:21:27 +01:00
Daniel Stenberg
3e1179a695
KNOWN_BUGS.md: absolute Unix domain filename for SOCKS on Windows
Closes #20236
Closes #19825
2026-01-10 13:05:46 +01:00
renovate[bot]
f1422960bf
GHA: update awslabs/aws-lc to v1.66.2
Closes #20238
2026-01-10 12:50:39 +01:00
Daniel Stenberg
0159100f4f
lib: use (u)int64_t instead of long long
Remove config-plan9.h because it does not support 64 bit, meaning it has
not been working for years.

Closes #20233
2026-01-10 12:40:54 +01:00
Viktor Szakats
8806035344
GHA/linux: fix 'libressl' internal name confusion
`libressl-filc` was matching `contains()` expressions looking for
`libressl`, causing build confusion and failure in specific cases.

Rename `libressl` to `libressl-c` to avoid this. Also rename the cache
id for consistency, though not necessary for the fix.

Bug: https://github.com/curl/curl/actions/runs/20860412340/job/59938315276
Follow-up to c262481873 #19407
Cherry-picked from #20234

Closes #20240
2026-01-10 12:36:20 +01:00
Joshua Vandaële
97f518e193
cmake: reference OpenSSL and ZLIB imported targets only when enabled
This otherwise broke building on a parent with a static library which is
available but disabled (e.g. CURL_ZLIB is set to OFF but ZLIB::ZLIB
exists)

Closes #20217
2026-01-09 22:03:28 +01:00
Viktor Szakats
2b0d8dcc16
GHA: switch 12 Linux jobs to arm64
More cost-effective and seems as fast or faster than Intel.

In particular, valgrind seems to be almost 2x fast. So fast the job pair
could fit under 10 minutes if merged again (but would be the longest in
GHA/Linux.)

Installing packages is slightly slower. The package repo is Ubuntu's
which is slower than the Azure mirror used on Intel (unless Azure is
broken, which happened a lot last year).

To add to more jobs, the locally built deps also need to be migrated.

Also:
- add workaround for failing sshd server on Linux arm runners, caused by
  world-writable `HOME` directory.

Closes #20231
2026-01-09 19:35:16 +01:00
Viktor Szakats
91c24d3e10
cmake: silence useless compiler warnings triggered by the FASTBuild generator
Silencing all of these:
```
11>/tmp/_fbuild.tmp/0x0752c383/core_2/70816E19/krb5_sspi.c:1:5: error: this style of line directive is a GNU extension [-Werror,-Wgnu-line-marker]
    1 | # 1 "<built-in>"
      |     ^
/path/to/curl/lib/vauth/krb5_sspi.c:29:6: error: this style of line directive is a GNU extension [-Werror,-Wgnu-line-marker]
   29 | # 26 "/path/to/curl/lib/vauth/krb5_sspi.c"
      |      ^
[...]
```

FASTBuild is slightly faster than Ninja in basic (single-machine, build
from scratch) cases (and can be more faster in other build cases). It
doesn't support unity builds. Maybe it can bring slightly better
performance to non-unity cmake CI jobs, in jobs having an 'install
prereq' phase already, and installing the fastbuild package being faster
than this gain. It overall seems marginal if any in curl CI. At least
for now. But it doesn't hurt if it works, and may be useful for some.

Requires CMake 4.2+.

That said this workaround may have a better place within CMake.

Refs:
https://www.kitware.com/cmake-fastbuild-distributed-cached-and-fast/
https://cmake.org/cmake/help/latest/generator/FASTBuild.html
https://github.com/fastbuild/fastbuild
https://fastbuild.org/docs/home.html

Closes #20230
2026-01-09 17:05:16 +01:00
renovate[bot]
1dedcbc35d
GHA: update dependency cloudflare/quiche to v0.24.7
Closes #20224
2026-01-09 17:05:15 +01:00
Stefan Eissing
3b261e2ad7
pytest: bump quiche version check update
Since the Lazy Lucas did not manage to get the fix merged in 0.24.7,
increase the pytest version check number in the hope that it will happen
in the next release.

Closes #20229
2026-01-09 15:47:27 +01:00
Viktor Szakats
9552d9c0c0
build: detect and include inttypes.h again (revert)
Since not using `PRI*` macros, it isn't needed.

Follow-up to 13c1a93414 #20215
Revert 4c9e4e99c1 #20208

Closes #20225
2026-01-09 14:59:30 +01:00
Daniel Stenberg
d881b91133
urldata: convert 'long' fields to fixed variable types
Makes sure they work identically cross-platform, as long varies in size
between Windows vs non-Windows. Makes Curl_easy 16 bytes smaller on 64
bit Linux.

This reduces support for the RTSP cseq counters to 32 bit (down from 63
bit previously on 64 bit non-Windows), but it is probably safe.
Implementations probably rarely support anything above 32 bits anyway
and this is how curl has worked on Windows since always.

There is now only one 'long' left in urldata.h (in the ssl_config_data
struct). That field, certverifyresult, is used to store the response
code from TLS backend code and in the OpenSSL case that function returns
an actual 'long'.

Closes #20227
2026-01-09 13:32:33 +01:00
Viktor Szakats
3402036e1a
spacecheck: exclude RELEASE-NOTES from a check 2026-01-09 09:45:30 +01:00
Viktor Szakats
df7718b5cf
curl: limit Windows-specific code to Windows builds, other tidy-ups
Prior to this patch, some Windows logic, including a Windows-specific
warning message was compiled in for all platforms.

Also:
- fix double space in warning message on UWP.
- formatting.

Follow-up to 9a2663322c #17572

Closes #20213
2026-01-09 09:42:01 +01:00
Daniel Stenberg
470e26ff6e
RELEASE-NOTES: synced
Bump to 8.18.1 tentatively
2026-01-09 07:54:36 +01:00
Daniel Stenberg
e83c82f05f
COPYING: bump copyright year range to 1996 - 2026 2026-01-08 23:19:44 +01:00
Stefan Eissing
f2d008811d
ngtcp2: stabilize recv
When receiving on a stream that already failed or has already been closed,
return the matching error code without touching the connection. In case
the connection shows errors, e.g. the server closed, those errors should
not have impact on an already failed/closed stream.

This might mitigate flakiness in pytest 07_13 where unexpected errors
occur after a successful upload.

Closes #20220
2026-01-08 22:36:38 +01:00
Daniel Stenberg
e3691612ea
urldata: switch to uint* types more widely
In particular, it turns 'unsigned long' into 'uint32_t' since the code
needs to build and run just as fine on Windows which has 32 bit longs,
so we know the code works with 32 bit field versions.

This makes Curl_easy 56 bytes smaller on my 64 bit Linux (maximized
build).

Closes #20209
2026-01-08 22:35:06 +01:00
Daniel Stenberg
97a02fade6
curl: rename a struct OutStruct field to 'regular_file'
From 's_isreg'. It explains better in plain English what it is for.

Closes #20222
2026-01-08 22:34:05 +01:00
Daniel Stenberg
8a25cf3d7c
tool_operate: remove 'else' for VMS
It seems malplaced as it then avoids the following logic when invoked
from a VMS shell and that seems unlikely to be desired.

Based on code review. I have no system to try this on.

Follow-up to f1261bcdd7
Closes #20221
2026-01-08 22:33:06 +01:00
Daniel Stenberg
2aba8f613c
urldata.h: remove two forward-declared structs not used
Closes #20206
2026-01-08 22:31:07 +01:00
Daniel Stenberg
13c1a93414
lib: remove uses of PRIu32 by adding "hack" for DJGPP
Avoid using PRIu32 and PRId32 in product source code. We don't need it.
It reduces readability. It is also inconsistent since unsigned int has
the same size and does not require the define.

DJGPP warns about using %u for uint32_t by default because it seems to
typedef it to unsigned long instead of unsigned int. Which even that is
annoying since long and int are both 32 bit on this platform.

We use our own *printf() implementation and we know this is safe.

This work-around defines uint32_t for DJGPP into unsigned int to avoid
the warnings and thus the need to use PRIu32 and PRId32.

Closes #20215
2026-01-08 14:15:47 +01:00
JimFuller-RedHat
af18d8ea1b
docs: explicitly call out Slowloris as not a security flaw
Closes #20219
2026-01-08 10:19:16 +01:00
Daniel Stenberg
7de35515d9
mprintf: drop old sprintf fallback
1. No modern systems lack snprintf()

2. If there actually exist any such systems, they get to manage without
   floating point output.

Closes #20218
2026-01-08 09:31:39 +01:00
Viktor Szakats
bb7f69f9a2
tool_dirhie: drop superfluous F_OK fallback (Windows)
Follow-up to cb5ba675a7

Closes #20214
2026-01-07 22:59:52 +01:00
Viktor Szakats
d8f6175edc
GHA/macos: switch one H3 pytest job to cmake
To:
- see if build tool makes a difference for flaky 8x pytest slowdowns.
- to make this job finished faster.

`curl -V`, number of runtests (1793) and pytests (568/159) verified
to remain the same.

Closes #20211
2026-01-07 17:34:57 +01:00
Viktor Szakats
1b9f1c2086
GHA/non-native: restore MS-DOS jobs
In `!ssl` variant.

It's useful to catch `uint32_t` mismatches with `unsigned int` or its
printf mask.

Also add Renovate version bump rule.

It takes about 1m (autotools) + 30s (cmake) in CI.

Bug: https://github.com/curl/curl/pull/20199#discussion_r2666363334
Follow-up to 8881a52ab0 #20210
Follow-up to e70436a88a #20200
Follow-up to 0630e66cb4 #18338

Closes #20204
2026-01-07 17:07:40 +01:00