Commit Graph

7424 Commits

Author SHA1 Message Date
Viktor Szakats
578ee6b79b
gcc: guard #pragma diagnostic in core code for <4.6, disable picky warnings
Extend `#pragma diagnostic push`/`pop` guards to the whole codebase
(from tests and examples only) to disable it for GCC <4.6. Rename guard
to `CURL_HAVE_DIAG` and make it include llvm/clang to be interchangeable
with `__GNUC__ || __clang__` in this context.

The above means no longer disabling certain warnings locally, so pair
this with disabling all picky warnings for GCC <4.6.

Also:
- drop global workarounds for misbehaving GCC <4.6 compiler warnings.
  Not needed with picky warnings disabled.

Reported-by: fds242 on github
Reported-by: Sergey Fedorov
Thanks-to: Orgad Shaneh
Follow-up to f07a98ae11 #20366
Fixes #20892
Fixes #20924
Closes #20902
Closes #20907
2026-03-18 11:33:37 +01:00
Daniel Stenberg
a327a5bded
netrc: refactor into smaller sub functions
Fixes #20950 - test 685 is extended for this
Closes #20932
2026-03-17 16:51:38 +01:00
Viktor Szakats
38107d3354
configure: fix --with-ngtcp2=<path> option for crypto libs
ngtcp2 1.14.0 added module dependencies to `ngtcp2_crypto_*.pc` files.
This broke certain build cases in curl, because configure was is
querying pkg-config modules by setting `PKG_CONFIG_LIBDIR` to the
directory specified via `--with-*=` options, including `--with-ngtcp2=`.
Setting `PKG_CONFIG_LIBDIR` tells pkg-config (and pkgconf) to ignore
system locations. This caused that `ngtcp2_crypto_gnutls.pc` could no
longer find its indirect dependencies, if those were present at system
locations (where they typically are). Another fallout was BoringSSL,
because it does not provide `openssl.pc` on its own, and successful
detection relied on finding a non-BoringSSL copy, typically at a system
location (also fixed in ngtcp2 main branch).

Fix `ngtcp2_crypto_*` detections to not touch `PKG_CONFIG_LIBDIR` and
instead prepend `<path>` set via `--with-ngtcp2=` to `PKG_CONFIG_PATH`.
This ensures to pick up any dependent modules from system locations.

Note the side-effect is that potentially undesired modules may be
detected this way from system locations, i.e. it makes this particular
detection less "hermetic" than the rest used in curl configure.

(Configurations using a bare `--with-ngtcp2` with no path were not
affected, and served as a workaround before this patch. It remains a
valid way of configuration after.)

Both `pkgconf` and `pkg-config` use this logic to calculate their search
directory list:
```pseudo
search = {}
if PKG_CONFIG_PATH is set
  search += PKG_CONFIG_PATH
endif
if PKG_CONFIG_LIBDIR is set (even if empty)
  search += PKG_CONFIG_LIBDIR
else
  search += built-in-pkg-config-dirs
endif
```

Refs:
https://github.com/curl/curl/pull/18028/commits (earlier attempt. Failed due to using `PKG_CONFIG_DIR` instead of the correct `PKG_CONFIG_PATH`)
c0874ce824
https://man.archlinux.org/man/pkgconf.1.en
https://manpages.debian.org/unstable/pkgconf/pkgconf.1.en.html
https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html
10e27fd63c

Bug: https://github.com/curl/curl/pull/18022#issuecomment-3120587041
Bug: https://github.com/ngtcp2/ngtcp2/pull/1689#issuecomment-3120593664
Follow-up to 04d90b5deb #20931
Follow-up to 3c64ffaff4 #18415 #18188
Follow-up to 99500660af #18028 #18022

Closes #20920
2026-03-17 14:37:53 +01:00
Viktor Szakats
32500f12c4
HTTP3.md: minor improvements
- document building curl with CMake.

- mention all supported forks in the OpenSSL section. Delete dedicated
  quictls section.

- add TLS-backend pkgconfig dir to `PKG_CONFIG_PATH` for correctness.
  OpenSSL-based ones often work without this, by finding system
  `openssl.pc`. For GnuTLS and wolfSSL this has a lesser chance. Best to
  point to them explicitly. (configure may technically be able to do
  this automatically, but it isn't implemented.)

- use `--with-ngtcp2=<path>` again, where possible.
  GnuTLS is the exception, pending fix in #20910.
  Same for BoringSSL, but not documented in `HTTP3.md`.

- replace `<somewhereN>` with `/path/to/depname` for clarity.

- move `LDFLAGS` after `./configure` for curl, to match dep builds.

- move `--with-ngtcp2` next to the TLS-backend option.

Follow-up to 1e3c2bec7e #20926
Follow-up to 3c64ffaff4 #18415 #18188
Cherry-picked from #20920

Closes #20947
2026-03-17 12:28:58 +01:00
Viktor Szakats
3525ed9b2f
ECH.md: replace double-backticks with single ones
Also fix a indent/space nits.

Closes #20937
2026-03-16 14:24:25 +01:00
Viktor Szakats
e76968e20d
curl_get_line: fix potential infinite loop when filename is a directory
Fix potential inifinite loop reading file content with `Curl_get_line()`
when a filename passed via these options are pointing to a directory
entry (on non-Windows):

- `--alt-svc` / `CURLOPT_ALTSVC`
- `-b` / `--cookie` / `CURLOPT_COOKIEFILE`
- `--hsts` / `CURLOPT_HSTS`
- `--netrc-file` / `CURLOPT_NETRC_FILE`

Fix by checking for this condition and silently skipping such filename
without attempting to read content. Add test 1713 to verify.

Mention in cookie documentation as an accepted case, also show a verbose
message when a directory is detected. Extend test 46 to verify if such
failure lets the logic continue to the next cookie file.

Reported-and-based-on-patch-by: Richard Tollerton
Fixes #20823
Closes #20826 (originally-based-on)
Follow-up to 769ccb4d42 #19140

Closes #20873
2026-03-16 11:54:43 +01:00
Viktor Szakats
6d87eb2878
cmake: add CURL_GCC_ANALYZER option, enable in CI, fix/silence
Enable in one existing Linux, macOS and Windows job.

Cost:
- Linux: +1.3 minutes.
- macOS: +1.5 minutes.
- Windows: +2.5 minutes.

Fix or silence issues found:
- conncache: silence NULL deref warning.
  ```
  lib/conncache.c:564:18: warning: dereference of NULL '*data.multi' [CWE-476] [-Wanalyzer-null-dereference]
  ```
  Ref: ede6a8e087 #19378
- http2: check pointer for NULL.
  ```
  lib/http2.c:388:7: error: dereference of NULL ‘data’ [CWE-476] [-Wanalyzer-null-dereference]
  ```
- http2: silence potential NULL deref in `cf_h2_recv`.
  ```
  lib/http2.c: In function 'cf_h2_recv':
  lib/curl_trc.h:62:15: warning: dereference of NULL 'data' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- openldap: silence deref before NULL check.
  Seen in GHA/Linux.
  ```
  lib/openldap.c: In function ‘oldap_state_mechs_resp’:
  lib/curl_trc.h:140:7: warning: check of ‘data’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  ```
- sendf: silence NULL deref false positive in `Curl_creader_set_fread`.
  It looks impossible to happen.
  ```
  lib/sendf.c:1133:7: warning: dereference of NULL 'r' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- ws: silence deref before NULL check.
  ```
  lib/ws.c: In function 'ws_send_raw_blocking':
  lib/curl_trc.h:205:7: warning: check of 'data' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  ```
- var: fix potential NULL deref
  ```
  src/var.c:216:29: warning: dereference of NULL 'envp' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- cli_hx_upload.c: fix NULL check after dereference.
  ```
  tests/libtest/cli_hx_upload.c:170:7: warning: check of '*t.method' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  ```
- unit1607, unit1609: fix theoretical NULL ptr dereference.
  ```
  tests/unit/unit1607.c:211:12: warning: dereference of NULL 'addr' [CWE-476] [-Wanalyzer-null-dereference]
  tests/unit/unit1609.c:193:12: warning: dereference of NULL 'addr' [CWE-476] [-Wanalyzer-null-dereference]
  ```
- globally disable checks triggering false positives only:
  ```
  docs/examples/externalsocket.c:135:8: warning: 'connect' on possibly invalid file descriptor 'sockfd' [-Wanalyzer-fd-use-without-check]
  lib/bufq.c:465:16: warning: infinite loop [CWE-835] [-Wanalyzer-infinite-loop] (gcc-15 Windows)
  lib/doh.c:1035:34: warning: stack-based buffer over-read [CWE-126] [-Wanalyzer-out-of-bounds] (gcc-15 macOS)
  lib/ftp.c:4022:20: warning: infinite loop [CWE-835] [-Wanalyzer-infinite-loop] (gcc-15 macOS)
  lib/http2.c:689:28: warning: buffer over-read [CWE-126] [-Wanalyzer-out-of-bounds] (gcc-15 macOS)
  lib/socketpair.c:195:5: warning: leak of file descriptor 'curl_dbg_socket(2, 1, 0, 192, "D:/a/curl/curl/lib/socketpair.c")' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_doswin.c:810:7: warning: leak of file descriptor '*tdata.socket_l' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_doswin.c:816:9: warning: leak of file descriptor '*tdata.socket_l' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_main.c:96:1: warning: leak of file descriptor 'fd[0]' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_main.c:96:1: warning: leak of file descriptor 'fd[1]' [CWE-775] [-Wanalyzer-fd-leak]
  src/tool_urlglob.c:48:17: warning: leak of 'malloc(8)' [CWE-401] [-Wanalyzer-malloc-leak]
  src/tool_writeout.c:870:3: warning: leak of FILE 'stream2' [CWE-775] [-Wanalyzer-file-leak]
  tests/libtest/lib518.c:90:1: warning: leak of FILE [CWE-775] [-Wanalyzer-file-leak]
  tests/libtest/lib537.c:87:1: warning: leak of FILE [CWE-775] [-Wanalyzer-file-leak]
  tests/server/tftpd.c:1147:10: warning: 'bind' on possibly invalid file descriptor 'sock' [-Wanalyzer-fd-use-without-check]
  tests/server/tftpd.c:1155:10: warning: 'bind' on possibly invalid file descriptor 'sock' [-Wanalyzer-fd-use-without-check]
  tests/server/tftpd.c:1259:10: warning: 'connect' on possibly invalid file descriptor '4294967295' [-Wanalyzer-fd-use-without-check]
  ```

Also:
- cmake: update clang-tidy typecheck comment.

Ref: https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html

Closes #20921
2026-03-16 11:49:34 +01:00
Viktor Szakats
04d90b5deb
configure: add option to trace pkg-config detection details
To aid debugging cases when dependency detection acts unexpectedly.
Sprung from spending days trying to figure out behavior of ngtcp2 crypto
modules and their dependencies.

You can enable by setting env `CURL_TRACE_PKG_CONFIG` to a non-empty
value. When enabled, details are logged for both successful and
unsuccessful detections. Logging of unsuccessful ones is automatically
enabled when `CURL_CI` env is set, which is the case for all CI jobs.

It works by asking for `--debug` output and grepping for lines that seem
useful for this purpose. Output is different for classic pkg-config and
pkgconf, and may depending on tool version. Also append `--print-errors`
output if any.

Examples (with pkgconf):

Fail, before:
```
checking for libngtcp2_crypto_boringssl options with pkg-config... no
configure: error: --with-ngtcp2 was specified but could not find ngtcp2_crypto_boringssl pkg-config file.
```

Fail, after:
```
checking for libngtcp2_crypto_boringssl options with pkg-config... no
configure: pkg-config --exists libngtcp2_crypto_boringssl trace:
---- begin
trying path: /home/runner/nghttp3/build/lib/pkgconfig for libngtcp2_crypto_boringssl
trying path: /home/runner/ngtcp2-boringssl/build/lib/pkgconfig for libngtcp2_crypto_boringssl
trying path: /home/runner/nghttp3/build/lib/pkgconfig for libngtcp2
trying path: /home/runner/ngtcp2-boringssl/build/lib/pkgconfig for libngtcp2
trying path: /home/runner/nghttp3/build/lib/pkgconfig for openssl
trying path: /home/runner/ngtcp2-boringssl/build/lib/pkgconfig for openssl
trying path: /home/runner/nghttp2/build/lib/pkgconfig for openssl
==== error:
Package openssl was not found in the pkg-config search path.
Perhaps you should add the directory containing `openssl.pc'
to the PKG_CONFIG_PATH environment variable
Package 'openssl', required by 'libngtcp2_crypto_boringssl', not found
---- end
configure: error: --with-ngtcp2 was specified but could not find ngtcp2_crypto_boringssl pkg-config file.
```

Success, after:
```
checking for libngtcp2_crypto_boringssl options with pkg-config... found
configure: pkg-config --exists libngtcp2_crypto_boringssl trace:
---- begin
trying path: /home/runner/awslc/build/lib/pkgconfig for libngtcp2_crypto_boringssl
trying path: /home/runner/nghttp3/build/lib/pkgconfig for libngtcp2_crypto_boringssl
trying path: /home/runner/nghttp2/build/lib/pkgconfig for libngtcp2_crypto_boringssl
trying path: /home/runner/ngtcp2/build/lib/pkgconfig for libngtcp2_crypto_boringssl
trying path: /home/runner/awslc/build/lib/pkgconfig for libngtcp2
trying path: /home/runner/nghttp3/build/lib/pkgconfig for libngtcp2
trying path: /home/runner/nghttp2/build/lib/pkgconfig for libngtcp2
trying path: /home/runner/ngtcp2/build/lib/pkgconfig for libngtcp2
trying path: /home/runner/awslc/build/lib/pkgconfig for openssl
trying path: /home/runner/awslc/build/lib/pkgconfig for libssl
trying path: /home/runner/awslc/build/lib/pkgconfig for libcrypto
---- end
```

More examples:
https://github.com/curl/curl/pull/20926#issuecomment-4064259935

If there is an externally enablable, built-in feature like this in
classic pkg-config or pkgconf, I could not find it.

Also:
- GHA/http3-linux: set `CURL_TRACE_PKG_CONFIG` to log detection details.
  H3 builds are prone to hard-to-debug dependency issues.

Ref: #20920
Follow-up to 3c64ffaff4 #18415 #18188
Follow-up to 99500660af #18028 #18022

Cherry-picked from #20926

Closes #20931
2026-03-16 11:31:01 +01:00
Martin Dürrmeier
594a9276bc
docs/lib: fix typos
Repated 'the the' and 'with with'

Closes #20933
2026-03-16 10:43:24 +01:00
Daniel Stenberg
510efa0007
HTTP3.md: drop outdated mentions of OpenSSL-QUIC
And make it a little clearer that the quiche backend is what is still
experimental.

Follow-up to 6aaac9dd38

Closes #20914
2026-03-12 23:20:47 +01:00
Viktor Szakats
56739855f3
examples: drop warning silencers no longer hit
Also:
- scope clang `-Wcast-function-type-strict` silencing, add missed `pop`.

Follow-up to d06b49d8b2 #18260

Closes #20896
2026-03-12 01:01:16 +01:00
Viktor Szakats
435eabeac8
badwords: rework exceptions, fix many of them
Also:
- support per-directory and per-upper-directory whitelist entries.
- convert badlist input grep tweak into the above format.
  (except for 'And' which had just a few hits.)
- fix many code exceptions, but do not enforce.
  (there also remain about 350 'will' uses in lib)
- fix badwords in example code, drop exceptions.
- badwords-all: convert to Perl.
  To make it usable from CMake.
- FAQ: reword to not use 'will'. Drop exception.

Closes #20886
2026-03-12 01:01:16 +01:00
Daniel Stenberg
1a4d392046
docs: minor wording tweaks
found when improving the badwords whitelisting logic
2026-03-11 08:46:01 +01:00
Daniel Stenberg
7a73be1f95
VERSIONS: add 8.19.0 2026-03-11 07:46:12 +01:00
Daniel Stenberg
3fd0d776d1
THANKS: add contributors from 8.19.0 release 2026-03-11 07:46:12 +01:00
Viktor Szakats
18e8c9f455
FAQ.md: point codeproject.com URL to archive.org copy
The original server closed down, linked page last seen on 2026-02-16.

Refs:
https://github.com/curl/curl/actions/runs/22051494128
https://web.archive.org/web/20250818150617/www.codeproject.com/info/Changes.aspx

Closes #20882
2026-03-11 01:48:21 +01:00
Felipe Mesquita
f25124338c
badwords: avoid 'simply'
It's mostly a filler word. I've read through each use of it in the code
base and did minor rephrasings when "simply" carried some meaning. The
overwhelming majority of cases, removing it improved the text
significantly. Inspired by #20793.

Closes #20822
2026-03-10 19:34:06 +01:00
Daniel Stenberg
ed7bf43a08
BUG-BOUNTY.md: minor rephrase to say there is no bug bounty
also add a brief mention to VULN-DISCLOSURE-POLICY.md

Closes #20878
2026-03-10 17:34:08 +01:00
Daniel Stenberg
8ec0e1e109
docs: fixup wording nits
Mostly sentences starting with bad words
2026-03-09 22:47:07 +01:00
Viktor Szakats
df5c6b6f54
docs: handle error in curl_global_init* examples
Also:
- call cleanup in `curl_global_init_mem()` example.

Closes #20866
2026-03-09 13:01:22 +01:00
Viktor Szakats
f6840572c4
THANKS-filter: update with a new entry
Closes #20861
2026-03-09 11:35:19 +01:00
Viktor Szakats
ccba492024
tidy-up: miscellaneous
Closes #20851
2026-03-09 11:35:19 +01:00
dbalsom
9a674ee6f7
docs: replace instances of the vague qualifier 'quite'
in documentation and comments

Closes #20841
2026-03-07 23:52:50 +01:00
Daniel Stenberg
13f48dfb52
docs: avoid starting sentences with However,
An unnecessary filling word

Closes #20834
2026-03-07 23:49:11 +01:00
Daniel Stenberg
f180818976
DEPRECATE.md: SMB and NTLM become build-time opt-in
Closes #20847
2026-03-07 14:56:08 +01:00
Daniel Stenberg
2f8fe96d6d
tests/FILEFORMAT.md: the <server> section is NOT mandatory
It can be left out if no servers are necessary.

Closes #20845
2026-03-07 14:21:46 +01:00
Daniel Stenberg
1495489c41
docs: drop basically
Another filler word

Closes #20835
2026-03-07 10:58:36 +01:00
Andrei Rybak
86ea3abd41
FAQ: syntax improvements
During conversion of `docs/FAQ` into Markdown, 'man ld' has incorrectly
kept one of its quotes when it was surrounded by backticks for inline
code formatting.  A space on the left of it was lost as well.

Fix the formatting in the new `docs/FAQ.md`.

Closes #20812
2026-03-06 23:01:47 +01:00
Daniel Stenberg
e49efce12f
synctime: fix use of uninitialized buffer on non-Windows
Follow-up to: b714c674f3

Spotted by Codex Security
Closes #20806
2026-03-06 22:49:03 +01:00
Viktor Szakats
38ee35353c
examples: improve OpenSSL certificate examples
- add/fix/synchronize error messages and comments.
- consistently return error from the callback on failure.
- fix potential leaks on OpenSSL API failures.
- fix to not pass the nul-terminator to BIO read.
- scope a variable.
- sync code/formatting between the two examples.

Closes #20807
2026-03-04 12:37:31 +01:00
Daniel Stenberg
7079f1d39c
usercertinmem: use the correct cert BIO
PEM_read_bio_PrivateKey() is called with the wrong BIO, so the private
key is not loaded.

Follow-up to 8494012196

Pointed out by Codex Security
Closes #20800
2026-03-03 23:16:08 +01:00
Daniel Stenberg
ad58e07b54
curl.h: remove CURLPROTO_MQTTS from the public header
- the value collided with the internal one used for WebSocket
- we add all new ones as internal bits
- bump to 64-bit internal type
- introduce new define for setting all protocols (CURLPROTO_64ALL)

Reported by Codex Security

Closes #20798
2026-03-03 23:14:34 +01:00
Daniel Stenberg
cc85cdf3c5
docs: avoid using the word 'magic'
It's never actually magic.

Closes #20796
2026-03-03 15:32:13 +01:00
Daniel Stenberg
b4dba346cd
stop using the word 'just'
Everywhere. In documentation and code comments.

It is almost never a good word and almost always a filler that should be
avoided.

Closes #20793
2026-03-03 15:30:22 +01:00
Daniel Stenberg
7fe5b933d8
TODO: drop the alt-svc fallback
Let's return to this subject if someone actually needs this for their
specific use case.

See #17152
Closes #20786
2026-03-02 09:18:07 +01:00
Daniel Stenberg
99bd5ed97b
HISTORY: mention that Rafael passed away much too early
Closes #20781
2026-03-01 22:42:13 +01:00
Viktor Szakats
1b35c9e1e3
cmake: rename testbins target to tt, restore internal option
To make it easy to type. The internal option is used in CI.

Follow-up to aae361242f #20708

Closes #20768
2026-03-01 00:24:47 +01:00
Florian Imdahl
006f561f6e
docs: some nitpicks
- replaced double spaces with single space where applicable
- replaced "favourite" with "favorite"
- added language identifiers to code blocks in markdown files
- added extra line after code blocks and after headings in markdown
  files

Cloes #20748
2026-02-27 23:05:37 +01:00
Daniel Stenberg
aea5552a64
INSTALL.md: fix typo
Reported-by: Nathan-M-code on github
Fixes #20766
Closes #20767
2026-02-27 22:52:03 +01:00
Viktor Szakats
ad72af4743
GHA/linux: enable clang-tidy for docs/examples
Also:
- imap-append: silence false positive (seen on Linux only).
  Follow-up to b1f853a384 #20731
  Follow-up to 725c5609ae #20723

Closes #20743
2026-02-26 19:24:32 +01:00
Daniel Stenberg
3cf86508fd
VULN-DISCLOSURE-POLICY.md: use hackerone
- bug_report.yml: use hackerone

Closes #20683
2026-02-26 07:57:19 +01:00
Viktor Szakats
aae361242f
cmake: replace internal option with a new testbins target
To allow building test binaries without test certs, replacing
`_CURL_SKIP_BUILD_CERTS` internal option with a build target that is
similar to `testdeps`, but without building the test certificates.

To make building test binaries a little bit faster, with less noisy
output, and without having to reconfigure the build.

Closes #20708
2026-02-25 22:57:02 +01:00
Viktor Szakats
af78b199b2
tidy-up: miscellaneous
- vms/curlmsg_vms.h: delete unused/commented code.
- vtls/schannel_verify: sort includes.
- typecheck-gcc.h: fix indent and alignment.
- lib/config-win32.h: drop idle `#undef`.
- spacecheck: check for stray empty lines before after curly braces.
- make literals more readable: 1048576 -> 1024 * 1024
- scope variables.
- use ISO date in a comment.
- drop redundant parentheses.
- drop empty comments.
- unfold lines.
- duplicate/stray spaces in comments.
- fix indent, whitespace, minor typos.

Closes #20690
2026-02-25 14:44:56 +01:00
Hamza Bensliman
a4ce687af2
docs: add reproducible example for generating man page
Fixes #20699
Reported-by: sammydono on github
Closes #20703
2026-02-24 23:58:37 +01:00
Daniel Stenberg
c513b1d520
DEPRECATE.md: TLS SRP support gets removed in August 2026
Closes #20697
2026-02-24 16:02:34 +01:00
Diogo Correia
9d94b1a066
docs: use dot instead of comma at end of sentences
Some sentences incorrectly ended with a command instead of a dot.

Closes #20700
2026-02-24 08:15:39 +01:00
Viktor Szakats
67298a80b3
INSTALL-CMAKE.md: document the curl build target
Can be useful to together with `testdeps` to build all binaries.

Closes #20694
2026-02-24 01:11:17 +01:00
Daniel Stenberg
57a1cc5587
URL-SYNTAX.md: fix port number mistakes for IMAP and LDAP
Reported-by: Augment code
URL: https://github.com/curl/curl/pull/20673#pullrequestreview-3838139961
Closes #20679
2026-02-23 00:01:18 +01:00
Viktor Szakats
fff9905bcf
cmake: force-disable unity for clang-tidied build targets only
Instead of globally disabling unity for all targets when clang-tidy is
enabled.

After this patch `CMAKE_UNITY_BUILD=ON` is honored for:
- static libcurl when building both static and shared separately.
- libcurlu and libcurltool internal libraries when building the test
  target.

While keeping unity disabled for the libcurl build pass running
clang-tidy, and the curl tool, also running clang-tidy.

To make clang-tidy-enabled builds finish faster when unity mode is
enabled, yet performs the same clang-tidy checks as before this patch.

Effect on:
- GHA/macos: core build: same, buils tests 5-12 seconds faster,
  with steps going down from 259 to 25.

  52s: https://github.com/curl/curl/actions/runs/22279958340/job/64448913325 ->
  47s: https://github.com/curl/curl/actions/runs/22279873606/job/64448710743

- GHA/windows (not enabled): it'd save about 1 minute, bringing total
  time barely below 10m, still one of the slowest jobs overall.
  (#20667 is trying a way for 4x speed-up (with a drawback)).

  5m21s: https://github.com/curl/curl/actions/runs/22222907068/job/64284556852 ->
  4m26s: https://github.com/curl/curl/actions/runs/22281033369/job/64451601548

Closes #20670
2026-02-22 19:16:31 +01:00
Daniel Stenberg
8e3a2a64d1
tool: improve config error messaging
- make sure that errors for specific options in config files identify
  the file, line number and shows the error about the correct option

- improve some error message wording

- add warning for leading single quote of arguments in config files
  (verified in test 1712)

- adjust test error outputs accordingly

test1712 introduces mode=warn

Use the mode="warn" attribute if the output curl warning output, as it
then makes the check without newlines and the prefix to better handle
that the lines may wrap at different points depending on the lengths of
the lines and terminal width.

Fixes #20598
Closes #20666
2026-02-22 14:56:07 +01:00
Daniel Stenberg
9ce9afa312
silent.md: also mention it shuts off warning messages
Closes #20664
2026-02-22 00:13:29 +01:00
Daniel Lublin
d4234d9f46
docs: clarify --ipv4 and --ipv6
Try to make the wording more clear. It is the addresses in the resolver
result that are affected, not anything regarding *how* resolving is
done.

Closes #20585
2026-02-20 12:50:10 +01:00
Anna Liberty
3699976b79
docs: reword explanation of --variable option
Simplify the language expaining the --variable option, reducing
repetition. Also fix some minor grammar issues and makes language for
examples more consistent.

Closes #20636
2026-02-20 12:08:52 +01:00
Viktor Szakats
c927b18d6b
INSTALL-CMAKE.md: document more settings requiring absolute paths
Cherry-picked from #20631

Closes #20637
2026-02-20 12:08:52 +01:00
Viktor Szakats
b7ecd14725
clang-tidy: replace comma-separated string with list in config
Bump required clang-tidy version to v17.0.0 for this.

Ref: https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/clang-tidy/index.html
Follow-up to 4497dbd9ac #20605

Closes #20632
2026-02-19 16:27:08 +01:00
Viktor Szakats
8712fac111
clang-tidy: drop redundant casts
Found via `readability-redundant-casting`. Prone to false positives, not
enabled.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/readability/redundant-casting.html

Closes #20630
2026-02-19 15:27:17 +01:00
Viktor Szakats
bd60df527c
clang-tidy: check readability-redundant-control-flow
Also fix fallouts.

Ref: https://clang.llvm.org/extra/clang-tidy/checks/readability/redundant-control-flow.html

Closes #20625
2026-02-19 12:44:52 +01:00
Viktor Szakats
4497dbd9ac
clang-tidy: fixes and improvements
Fix bigger and smaller kinks in how clang-tidy is configured and used.
Sync behavior more between autotools and cmake, lib/src and tests. Bump
clang-tidy minimum version and prepare logic to allow using clang-tidy
to a fuller extent.

- move clang-tidy settings from builds to a new `.clang-tidy.yml`.
  To make it easy to see and edit checks at one place. Also to allow
  using the `--checks=` option internally to silence tests-specific
  checks. (clang-tidy does not support multiple `--check=` options via
  the command-line.)
  Use explicit `--config-file=` option to point to the configuration.
- .clang-tidy.yml: link to documentation.
- suppress `clang-diagnostic-nullability-extension` due to a false
  positive in libtests with `CURL_WERROR=ON` and `PICKY_COMPILER=OFF`.
- .clang-tidy.yml: enable `portability-*`, `misc-const-correctness`.
- drop `--quiet` clang-tidy option by default to make its working a bit
  more transparent. The extra output is minimial.
- consistently use double-dashes in clang-tidy command-line options.
  Supported by clang-tidy 9.0.0+ (2019-09-19). Before this patch single
  and double were used arbitrarily.
- src/tool_parsecfg: silence false positive `clang-analyzer-unix.Stream`.
  Seen with clang 18 + clang-tidy 19 and 20 (only with autotools.)
- INTERNALS: require clang-tidy 14.0.0+. For the `--config-file` option.
- INTERNALS: recommend clang-tidy 19.1.0+, to avoid bogus
  `clang-analyzer-valist.Uninitialized` warnings. (bug details below)

autotools:

- allow configuring the clang-tidy tool via `CLANG_TIDY` env.
  Also to use in GHA to point to a suffixed clang-tody tool.
- fix to pass CFLAGS to lib, src sources.
  (keep omitting them when using a non-clang compiler.)
- fix to pass `--warnings-as-errors=*` in quotes to avoid globbing.

cmake:

- fix to not pass an empty `-I` to clang-tidy.
- fix to pass CFLAGS (picky warnings) to clang-tidy for test sources.
  (keep omitting them when using a non-clang compiler.)
- fix to disable `clang-diagnostic-unused-function` for test sources.
  (tests have static entry points, which trigger this check when
  checking them as individidual sources.)
- fix forwarding `CURL_CLANG_TIDYFLAGS` to clang-tidy.
- force disable picky warnings when running clang-tidy with a non-clang
  compiler. To not pass these flags when checking lib and src.

CI:

- GHA/linux: avoid clang-tidy bug by upgrading to v19, and drop the
  workaround.
- GHA/linux: switch to clang from gcc in the clang-tidy job. Using gcc
  doesn't allow passing CFLAGS to clang-tidy, making it less effective.
  (My guess this was one factor contributing to this job often missing
  to find certain issues compared to GHA/macos.)

I recomment using clang-tidy with a clang compiler, preferably the same
version or one that's compatible. Other cases are best effort, and may
fail if a C flag is passed to clang-tidy that it does not understand.
Picky warnings are mostly omitted when using a non-clang compiler,
reducing its usefulness.

Details and reproducer for the v18 (and earlier) clang-tidy bug,
previously affecting the GHA/linux job:

clang-tidy <=18 emits false warnings way when passing multiple C sources
at once (as done with autotools):

```sh
cat > src1.c <<EOF
#include <string.h>
static void dummy(void *p) { memcmp(p, p, 0); }
EOF

cat > src2.c <<EOF
#include <stdarg.h>
void vafunc(int option, ...)
{
  va_list param;
  va_start(param, option);
  if(option)
    (void)va_arg(param, int);
  va_end(param);
}
EOF

/opt/homebrew/opt/llvm@18/bin/clang-tidy --checks=clang-analyzer-valist.Uninitialized src1.c src2.c

# src2.c:7:11: warning: va_arg() is called on an uninitialized va_list [clang-analyzer-valist.Uninitialized]
```

Follow-up to e86542038d #17047

Closes #20605
2026-02-19 00:02:11 +01:00
Viktor Szakats
5fa5cb3825
build: fix -Wunused-macros warnings, and related tidy-ups
- fix internal macro `AN_APPLE_OS` reused between sources without
  resetting it. It may potentially have left the system sha256
  function unused.
- fix to define `WOLFSSL_OPTIONS_IGNORE_SYS` so that it always applies
  to wolfSSL headers, also during feature detection.
- md4, md5, sha256: simplify fallback logic.
- delete 20+ unused macros.
- scope or move macros to avoid `-Wunused-macros` warnings.
- examples: delete unused code.

The warning detects macros defined but not used within the same C
source. It does not warn for macros defined in headers. It also works
with unity builds, but to a lesser extent.

Closes #20593
2026-02-19 00:00:48 +01:00
Stefan Eissing
f1c9d5e484
easy: reset errorbuf on eyeballing success
Any failf() that fill the errorbuf need to be forgotten once happy
eyeballing finds a succssful winner. Because the errorbuf, once set, is
not overwritten with future error information.

Adds test_05_05 to verify.

Reported-by: Tim Friedrich Brüggemann
Fixes #20608

Closes #20613
2026-02-18 12:04:23 +01:00
Dan Fandrich
36c2c7626f libcurl-security.md: Fix typos and add a point about URLs 2026-02-17 12:38:26 -08:00
Viktor Szakats
8494012196
examples/usercertinmem: use modern OpenSSL API, drop mentions of RSA
Replacing API calls deprecated by OpenSSL 3, and also missing
from OpenSSL 3 no-deprecated builds, fixing builds with the latter:
`PEM_read_bio_RSAPrivateKey()`, `RSA_free()`,
`SSL_CTX_use_RSAPrivateKey()`

Also: rename callback to match its `cacertinmem.c` sibling.

Fixes #20595
Closes #20596
2026-02-14 14:07:55 +01:00
Viktor Szakats
20ae14a322
cmake: warn for invalid CURL_TARGET_WINDOWS_VERSION values
Also:
- INSTALL-CMAKE.md: add an example for `CURL_TARGET_WINDOWS_VERSION`.

Reported-by: nono303 on github
Ref: #20575
Closes #20582
2026-02-13 00:24:49 +01:00
Viktor Szakats
5edd79aa93
cmake: add CURL_PATCHSTAMP configuration variable, test in CI
Also:
- INSTALL-CMAKE.md: alpha sort.

Closes #20576
2026-02-12 17:29:22 +01:00
Viktor Szakats
516a0cd382
cmake: add BORINGSSL_VERSION configuration variable, test in CI
To simplify setting BoringSSL version, using:
`-DBORINGSSL_VERSION=0.20260211.0`
or
`-DBORINGSSL_VERSION=${boringssl_version}`

Previously it could be set via C flags, using complicated shell quotes:
`-DCMAKE_C_FLAGS="-DCURL_BORINGSSL_VERSION=\\\"${boringssl_version}\\\""`
(the C flags method remains, also for autotools)

It'd be nice if BoringSSL published its version not just via
`MODULE.bazel` in its source tree, but from its public headers, to make
these workarounds unnecessary.

Also:
- GHA/http3-linux: test both options.

Closes #20571
2026-02-12 16:29:49 +01:00
Viktor Szakats
61df5f466c
tidy-up: miscellaneous
- curl_ntlm_core, smtp, schannel: fix comments.
- curl_setup.h: fix to undef before define.
- tool_doswin, server/sockfilt: reduce variables scopes.
- tool_doswin: drop an interim variable.
- windows: replace `SOCKET_ERROR` with `0` to align with rest of code.
- libssh2: rename variable to align with rest of code.
- gtls, unit1398: use `#if 0`.
- curl_trc.h, curlx/inet_ntop.h: add missing parentheses in macro
  expressions.
- ldap.c: set empty macro to `do {} while(0)`.
- examples/crawler: rename a non-CURLcode `result` variable.
- CURLINFO_TLS_SESSION: drop stray colon.
- add `const` to casts where missing.
- drop unnecessary parentheses.
- fix indent.
- quote style.
- comment style.
- whitespace, newlines, fold/unfold.

Closes #20554
2026-02-12 14:52:16 +01:00
Daniel Stenberg
6d2e9926d7
docs/libcurl: unify WARNING use
Consistently use bold and colon.

Closes #20561
2026-02-11 09:43:14 +01:00
Daniel Stenberg
15a8a777b8
VULN-DISCLOSURE-POLICY.md: mention GitHub quirks
Closes #20541
2026-02-09 12:42:36 +01:00
Viktor Szakats
02c37d269c
docs: compare result against literal CURLE_OK (where missing)
Also scope to result variables.

Closes #20536
2026-02-07 19:40:45 +01:00
Viktor Szakats
85de995208
tidy-up: move literals to right-side of if expressions (where missing)
Closes #20535
2026-02-07 16:41:51 +01:00
Spenser Black
e674e84654
docs: fix grammar nitpicks
Closes #20518
2026-02-05 17:26:02 +01:00
jhauga
161be30854
curl: add -I and -i to -h important
Closes #20483
2026-02-05 17:20:29 +01:00
Daniel Stenberg
0ccaf6c835
VULN-DISCLOSURE-POLICY.md: push reports to the web form
Closes #20515
2026-02-04 12:45:51 +01:00
Viktor Szakats
a84b041281
build: tidy up curl-specific fstat calls and stat struct type
To avoid redefining the `fstat` system symbol, and to clarify
`struct_stat` is a curl symbol.

- introduce `curlx_fstat()` macro and use it.
- rename `struct_stat` to `curl_struct_stat`.

Also:
- tests: replace direct `curlx_win32_stat()` call with `curlx_stat()`.
- checksrc: disallow direct `_fstati64` and `fstat()` calls, except in
  examples.

Closes #20496
2026-02-02 18:57:13 +01:00
Viktor Szakats
9630593650
build: use more const
Mostly with `char *` types.

Also:
- mime, x509asn1, tool_operate, lib3207: drop redundant casts.
- examples/smooth-gtk-thread: add missing variable declaration.
- reduce variable scopes.
- tests/server: move `data_to_hex()` to its only user: `sws`.

Closes #20489
2026-02-02 12:32:49 +01:00
Viktor Szakats
96fa42c7c0
build: tidy up local lseek() mappings
- stop redefining system symbol `lseek`, by introducing `curl_lseek()`.
- handle AmigaOS quirk within the macro mapping.
- add missing parenthesis to `LSEEK_ERROR` values.
- tool_util: use curl `lseek` macros in `tool_ftruncate64()`.
- move `LSEEK_ERROR` to right-hand side of if expressions.
- checksrc: disallow direct uses of `_lseeki64`, `llseek`, `lseek`.

Closes #20488
2026-02-01 17:29:39 +01:00
Viktor Szakats
3003c32cb2
tidy-up: miscellaneous
- INSTALL-CMAKE.md: add missing periods, text fixes.
- md4, md5: sync variables names.
- curl_trc: sync an argument type.
- docs/examples: sync debug/trace function copies, constify, tidy-ups.
- replace commented code with `#if 0`.
- drop redundant parenthesis (macro values, `return`, around single
  variables, function calls).
- fix indentation, apply clang-format in places.

Closes #20481
2026-02-01 00:54:23 +01:00
Jay Satiro
ca5efd02b6 CURLINFO_CONTENT_LENGTH_DOWNLOAD_T.md: fix available protocols
Bug: https://curl.se/mail/lib-2026-01/0033.html
Reported-by: Tenant HellTower (Negar)
2026-01-31 14:37:29 -05:00
Dan Fandrich
3509a41494 docs: document the need for a 64-bit type and stdint.h
These are requirements above and above C89.

Ref: #20406

Closes #20384
2026-01-28 08:45:56 -08:00
Stefan Eissing
ae99d750dd
TODO: remove item about signals
With SIGPIPE handling now automatic on most platforms, remove the
TODO item again.

Closes #20447
2026-01-27 23:36:31 +01:00
Viktor Szakats
f824b4d004
INSTALL-CMAKE.md: document new static options as experimental
Follow-up to 26c39d8df1 #20015

Closes #20450
2026-01-27 15:24:28 +01:00
Billy O'Neal
af508e3641
curl_multi_perform.md: resolve inconsistency
... between curl_multi_perform and curl_multi_wait/poll documentation

The `curl_multi_perform` documentation uses integer contextual
conversion to `bool` to test the resulting `CURLMcode`, while other
functions like `curl_multi_wait` and `curl_multi_poll` test against
`CURLM_OK`. (I was initially confused by this as it looked like some
docs call curl_multi_wait/poll on error, while some called only on
success. But that was my misread, not a docs problem.)

Also fixed the example to print which function call failed; previously
an error reported by `curl_multi_perform` was printed as a failure of
`curl_multi_wait`.

Closes #20444
2026-01-27 09:07:18 +01:00
Dan Fandrich
08b31b1c8b docs: add LibreELEC to DISTROS.md 2026-01-26 12:12:05 -08:00
Daniel Stenberg
fa6a46473e
tool_cb_hdr: with -J, use the redirect name as a backup
The -J / --remote-header-name logic now records the file name part used
in the redirects so that it can use the last one as a name if no
Content-Disposition header arrives.

Add tests to verify:

1641: -J with a redirect and extract the CD contents in the second
response

1642: -J with a redirect but no Content-Disposition, use the name from
the Location: header

1643: -J with two redirects, using the last file name and also use
queries and fragments to verify them stripped off

Closes #20430
2026-01-26 12:53:03 +01:00
Daniel Stenberg
04c060b004
RELEASE-PROCEDURE.md: update future release dates 2026-01-26 12:28:25 +01:00
Daniel Stenberg
ca7ef4b817
BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026
Remove mentions of the bounty and hackerone.

Closes #20312
2026-01-26 08:26:28 +01:00
Viktor Szakats
26c39d8df1
cmke: add *_USE_STATIC_LIBS options for 9 dependencies
Via options:

- `BROTLI_USE_STATIC_LIBS`
- `CARES_USE_STATIC_LIBS`
- `LIBSSH_USE_STATIC_LIBS`
- `LIBSSH2_USE_STATIC_LIBS`
- `MBEDTLS_USE_STATIC_LIBS`
- `NGHTTP2_USE_STATIC_LIBS`
- `NGHTTP3_USE_STATIC_LIBS`
- `NGTCP2_USE_STATIC_LIBS`
- `ZSTD_USE_STATIC_LIBS`

When enabled, make a "best effort" finding static libs first and set
the "build static" macro (on Windows) as required by the dependency.

When doing `pkg-config`-based detections, make curl select the static
configuration, which shall set the "build static" macro also.

These options resemble CMake's `OPENSSL_USE_STATIC_LIBS` and
`ZLIB_USE_STATIC_LIBS` (the latter does not support `pkg-config` as of
CMake v4.2.2).

Shared/static library selection based on loose filename conventions is
fragile and prone to break if the non-static-suffixed library is found
and happens to be a shared library, or, if the linker decides to pick up
a shared copy (e.g. `.a.dll`) that shadows the static one. It may help
to provide either static or shared, but not both, on the disk, and match
that with this setting.

Experimental.

Ref: #20013
Closes #20015
2026-01-26 05:21:24 +01:00
Viktor Szakats
3aa4fbf2d4
cmake: add CURL_BUILD_EVERYTHING option
To build all targets in a single go, meaning curl and libcurl as normal,
and tests and examples in addition. To build-test everything without
running multiple cmake commands.

Enable with:
- `-DCURL_BUILD_EVERYTHING=ON`
  Special values: `QUICK` to build examples quickly for build test,
  `NOEXAMPLES` to not build examples.

A well-equipped build takes 2.8s of configure time, and 1.7s to build
everything (shared, unity, ninja, prefill), 1.4s with `QUICK`. Without
this option it takes <1s to build curl/libcurl.

Also: streamline `CURL_LINT` internal logic.

Closes #20429
2026-01-26 02:08:02 +01:00
Dan Fandrich
c585282a1c docs: Update CodeSonar link 2026-01-24 13:24:37 -08:00
Daniel Stenberg
c04ce3af0e
verbose.md: explain the { and } prefixes
The prefixes are now made as subtitles

Reported-by: Thibault de Villèle
Fixes #20386
Closes #20396
2026-01-23 14:34:44 +01:00
Viktor Szakats
b81341e8f5
tidy-up: Markdown, clang-format nits
- drop leading indent from Markdown.
- switch to Markdown section markers where missing.
- move `&&` and `||` to the end of the line (C, Perl).
- openssl: add parenthesis to an if sub-expression.
- misc clang-format nits.
- unfold Markdown links.
- SSL-PROBLEMS.md: drop stray half code-fence.

Closes #20402
2026-01-22 23:44:47 +01:00
Viktor Szakats
66ad54e46b
cmake: add CURL_DROP_UNUSED option to reduce binary sizes
To enable known linker options dropping unused, dead, code and data from
the executables built.

Useful to reduce binary sizes for curl, libcurl shared lib and apps
linking static libcurl. It's effective on both "unity" and non-unity
builds. Aligning "unity" build sizes with default, non-unity ones.

Supported platforms: Apple, MSVC, llvm/clang and GCC on all tested
platforms: Linux, BSDs, Windows, MSYS2/Cygwin, Android, MS-DOS.

Notes:
- Static libraries grow 20-30% with non-Apple toolchains.
  This effect is controlled by separate, optional compiler flags on
  non-Apple. This patch enables them automatically for public binaries
  (libcurl and curl tool), and leaves them off for internal/test ones.
- MSVC enables this option by default for 'Release' configurations.
  The curl build option has no effect on it.
- Observed effect on VS2010 is negligible. VS2012+ is recommended.
- Works with LTO, Fil-C.
- No observed/conclusive effect on build speed.
- On Windows with clang/gcc (mingw-w64/MSYS2/Cygwin) it also enables
  `-fno-asynchronous-unwind-tables` as a workaround to make
  the toolchain options actually work.
  Ref: https://sourceware.org/bugzilla/show_bug.cgi?id=11539
  Thanks-to: Andarwinux

Also:
- GHA: enable in Linux and MinGW jobs to test it. Size changes:

  - linux aws-lc H3:
    curl: 2000000 -> 1937152, libcurl.a: 2065724 -> 2716532 bytes
  - macos clang HTTP-only:
    curl: 1364376 -> 128799 bytes, libcurl.a: unchanged
  - macos llvm MultiSSL:
    curl: 410056 -> 405720, libcurl.dylib: 1350336 -> 1348480 bytes
  - mingw schannel c-ares U:
    curl: 1588736 -> 1507328, libcurl-d.a: 3322040 -> 3884746 bytes
    bld: 34 -> 35MB

- GHA: enable in MSVC and Apple jobs to reduce disk footprint, with no
  obvious downside. Size changes:

  - AppVeyor CI VS2019:
    curl: 2339840 -> 1295872, libcurl-d.dll: 3155968 -> 1900544 bytes
    bld: 161 -> 97MB
  - AppVeyor CI VS2022 clang-cl:
    curl: 2933248 -> 2332160, libcurl-d.lib: 4762688 -> 5511330 bytes
    bld: 133 -> 121MB
  - AppVeyor CI VS2022 HTTP-only:
    curl: 3514368 -> 2177024, libcurl-d.lib: 2538420 -> 3151740 bytes
    bld: 137 -> 83MB
  - GHA intel:
    curl: 2629120 -> 2023424, libcurl-d.lib: 4366652 -> 5350670 bytes
    bld: 86 -> 69MB
  - GHA arm64:
    curl: 2832896 -> 2063872, libcurl-d.lib: 4690616 -> 5597250 bytes
    bld: 82 -> 66MB

Refs:
https://maskray.me/blog/2021-02-28-linker-garbage-collection
https://web.archive.org/web/20110811230637/msdn.microsoft.com/en-us/library/bxwfs976.aspx (VS2010)
https://learn.microsoft.com/cpp/build/reference/opt-optimizations
https://learn.microsoft.com/cpp/build/reference/gy-enable-function-level-linking

Closes #20357
2026-01-22 17:08:20 +01:00
Viktor Szakats
e50aa46fb2
build: update to not need _CRT_NONSTDC_NO_DEPRECATE with MSVC
Use non-deprecated CRT function variants on Windows.

- introduce `curlx_fdopen()`, `curlx_close()` and use them. Map them to
  non-deprecated, underscored, CRT functions on Windows.

- replace `close()` uses with either `sclose()` (for sockets) or
  `curlx_close()` (for files).

- map `fileno`, `unlink`, `isatty` to their non-deprecated, underscored,
  versions on Windows.

- tool_dirhie: map `mkdir` to `_mkdir` on Windows.

- easy: use `_strdup()` on Windows, regardless of how `HAVE_STRDUP` is
  set.

- cmake: assume `HAVE_STRDUP` on Windows. To allow dropping a detection
  hack using `_CRT_NONSTDC_NO_DEPRECATE` with MSVC. Windows always has
  `_strdup()` which the code uses, but also needs `HAVE_STRDUP` defined
  to disable curl's own `strdup()` implementation.

- curl_setup.h: drop `_CRT_NONSTDC_NO_DEPRECATE` as no longer necessary.

Closes #20212
2026-01-20 23:19:54 +01:00
Stefan Eissing
3dd7f5890f
socket: check result of SO_NOSIGPIPE
New define USE_SO_NOSIGPIPE in curl_setup.h, for now set whenever
SO_NOSIGPIPE is defined. Maybe overridden in the future on systems where
this does not work.

With USE_SO_NOSIGPIPE defined, set SO_NOSIGPIPE on all sockets created
by libcurl and fail the creation when setsockopt() fails.

Closes #20370
2026-01-20 16:38:49 +01:00
Viktor Szakats
814b54d83e
tidy-up: miscellaneous
- whitespace, indent, comments, clang-format.
- openssl: move feature guards within function blocks.
- tunit: drop redundant blocks.

Closes #20361
2026-01-20 12:37:56 +01:00
Daniel Stenberg
2c6f13093e
libcurl docs: reduce 'since ...' in descriptions
Reduce mentions of libcurl versions like "since 7.xx ..." in option
descriptions to reduce clutter and make the texts easier to read. Keep
them in, or move them to, the HISTORY or DEPRECATED sections

The last version 7 release (7.88.1) shipped on Februrary 20, 2023.

Closes #20369
2026-01-20 11:22:27 +01:00
Arnav-Purushotam-CUBoulder
63baa10951
docs/INSTALL: update configure details
Note the default libpsl requirement in INSTALL and polish the TLS
library wording.

Closes #20301
2026-01-19 23:06:04 +01:00
Viktor Szakats
2d5a063121
build: merge TrackMemory (CURLDEBUG) into debug-enabled option
Drop separate `TrackMemory` (aka `CURLDEBUG`) debug feature.

After recent changes (thread-safety,
193cb00ce9, and updates leading up to
it), `TrackMemory` is unlikely to cause build or runtime issues.

To simplify builds and debug options, enable `TrackMemory`
unconditionally for debug-enabled (aka `DEBUGBUILD`) builds. Before
this patch, this was already the default, with an option to disable
it, or enable it in non-debug-enabled builds.

Note, in practice these two debug options already went hand in hand. It
was not possible to toggle them separately for a long time due to bugs,
before 59dc9f7e69 (2024-05-28) fixed it.

This patch also removes/deprecates separate knobs and feature flags for
`TrackMemory`:
- autotools: `--enable-curldebug`/`--disable-curldebug`
- cmake: `-DENABLE_CURLDEBUG=ON`/`OFF`
- C macro: `CURLDEBUG`
- libcurl: `CURL_VERSION_CURLDEBUG` symbol deprecated in favor
  of `CURL_VERSION_DEBUG`. They always return the same value after this
  patch.

Also:
- drop `TrackMemory` from `curl -V` output.
- rename internal `CURLDEBUG` macro to `CURL_MEMDEBUG` internally.
  To avoid confusion with `DEBUGBUILD`, but to keep guarding
  `TrackMemory`-related internals for readability.
- runtests: bind `TrackMemory` to debug feature. Keep it a separate
  test feature requirement, for clarity.
- CI: drop test builds for combinations of the two options.
- GHA/linux: no longer disable TrackMemory in the TSAN job.

Ref: https://github.com/curl/curl/pull/20328#issuecomment-3754528407

Closes #20331
2026-01-19 18:43:17 +01:00
Viktor Szakats
4ed578af7a
INSTALL-CMAKE.md: document Apple framework options
Also document when they are used.

Closes #20350
2026-01-19 08:55:04 +01:00
Viktor Szakats
0fdc61ffd7
INSTALL.md: suggest -Wl,-dead_strip for Apple targets
For reducing binary size. Also to remove (or greatly mitigate)
the side-effect of using "unity" builds. Similar to `-Wl,--gc-sections`
on non-Apple platforms.

For example with curl-for-win builds, macOS arm+intel:

curl (unity):                      7.7MB -> 6.8MB
libcurl.dylib (unity):             7.2MB -> 6.4MB
trurl /w static libcurl (!unity):  535KB -> 251KB (same size with unity)

Ref: c4008d658a

Closes #20346
2026-01-18 18:56:56 +01:00