Commit Graph

1202 Commits

Author SHA1 Message Date
Viktor Szakats
20142f5d06
build: avoid overriding system symbols for fopen functions
By introducing wrappers for them in the curlx namespace:
`curlx_fopen()`, `curlx_fdopen()`, `curlx_fclose()`.

The undefine/redefine/`(function)()` methods broke on systems
implementing these functions as macros. E.g. AIX 32-bit's `fopen()`.

Also:
- rename `lib/fopen.*` to `lib/curl_fopen.*` (for `Curl_fopen()`)
  to make room for the newly added `curlx/fopen.h`.
- curlx: move file-related functions from `multibyte.c` to `fopen.c`.
- tests/server: stop using the curl-specific `fopen()` implementation
  on Windows. Unicode isn't used by runtests, and it isn't critical to
  run tests on longs path. It can be re-enabled if this becomes
  necessary, or if the wrapper receives a feature that's critical for
  test servers.

Reported-by: Andrew Kirillov
Bug: https://github.com/curl/curl/issues/18510#issuecomment-3274393640

Follow-up to bf7375ecc5 #18503
Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18634
2025-09-30 01:10:36 +02:00
Viktor Szakats
81a9197102
GHA/linux-old: make one cmake v3.7.2 job verbose
To show the details in cmake builds using the oldest supported version.
Use a legacy method. `--verbose` became supported later, in 3.14.

Closes #18764
2025-09-28 12:33:06 +02:00
Viktor Szakats
660d915ebd
ci: use --enable-option-checking=fatal in autotools jobs
To avoid typos and non-existing options passed to `./configure` in CI
builds.

Also delete obsolete option `--enable-test-bundles` from Circle CI jobs.

Closes #18759
2025-09-28 00:20:12 +02:00
Viktor Szakats
75d5424979
GHA/windows: tidy up Cygwin jobs
- drop unnecessary installed packages.
- sync built type name with other jobs.

Closes #18758
2025-09-27 19:03:25 +02:00
renovate[bot]
b5c9c858d5
GHA: update dependency awslabs/aws-lc to v1.61.4
Closes #18752
2025-09-27 16:31:13 +02:00
Viktor Szakats
16f721443a
GHA/linux: tidy up AWS-LC local build
To sync with other builds and to use `-B` to avoid a cmake warning and
future breakage.

Closes #18757
2025-09-27 16:29:24 +02:00
Viktor Szakats
95e50ad694
tidy-up: miscellaneous
- GHA/checkdocs: rename `spellcheck` job to `pyspelling` to say
  the exact tool used.
- GHA/checkdocs: restore a comment.
- GHA/linux: add `-B .` to a cmake configure to avoid warning, and
  future breakage.
- autotools: use correct casing for `Schannel`.
- doh: update RFC URL.
- drop redundant parenthesis.
- fix indentation, whitespace.

Closes #18756
2025-09-27 12:59:07 +02:00
Viktor Szakats
34b1e146e4
perlcheck: add script, run in CI, fix fallouts
Add script to run all Perl sources through `perl -c` to ensure no
issues, and run this script via GHA/checksrc in CI.

Fallouts:
- fix two repeated declarations.
- move `shell_quote()` from `testutil.pm` to `pathhelp.pm`, to
  avoid circular dependency in `globalconfig.pm`.

Closes #18745
2025-09-26 14:47:33 +02:00
renovate[bot]
e27853d36b
GHA: update dependency ruff and github/codeql-action
- update github/codeql-action digest to 303c0ae
- update dependency ruff to v0.13.2

Closes #18716
Closes #18734
2025-09-25 21:53:53 +02:00
Viktor Szakats
e48c1ea415
GHA: use pyspelling directly
To avoid depending on Docker Hub, an Docker image and a GitHub Action.
Also to simplify running this check on a local machine.

Pending question if Dependabot and Mend/Renovate will automatically pick
up `requirements-docs.txt`.

Also:
- enable parallel spellchecking. (also to win back the time lost with
  installing components directly from Debian and pip.)
- pin `pyspelling`.
- link to official `pyspelling` docs.

Closes #18736
2025-09-25 16:59:27 +02:00
Viktor Szakats
edbf610c6a
GHA: set HOMEBREW_NO_AUTO_UPDATE=1 for Linuxbrew
In an attempt to make `brew install` commands initialize faster.

Often this command started with 20-50 seconds of delay before this
patch. This is an attempt to make it launch faster.

Cherry-picked from #18736
2025-09-25 15:37:13 +02:00
Viktor Szakats
5b8c80684b
GHA/checksrc: drop no longer used DEBIAN_FRONTEND env
Follow-up to 7d5f8be532 #18708
Cherry-picked from #18736
2025-09-25 15:37:13 +02:00
Viktor Szakats
e08211b1ca
GHA: bump pip cryptography, relax impacket version requirement
Bump `cryptography` to a newer version that fixes two known OpenSSL
vulnerabilities reported by Dependabot.

To make it work, also allow `impacket` 0.11.0, because it allows any
pyOpenSSL version, while 0.12.0 pinned it to a single version that
happens to be incompatible with the bugfixed `cryptography` version.

Also: drop spaces from `requirements.txt` files. Bots don't add them,
though they seem to be preferred in the official documentation:
https://pip.pypa.io/en/stable/reference/requirements-file-format/

https://github.com/fortra/impacket/blob/impacket_0_11_0/requirements.txt
https://github.com/fortra/impacket/blob/impacket_0_12_0/requirements.txt

Follow-up to 7d5f8be532 #18708

Closes #18731
2025-09-25 14:22:40 +02:00
Viktor Szakats
6796147910
GHA/checksrc: run reuse directly, merge into the linters workflow
To eliminate dependencies on an Action, Docker Hub and to simplify.

Closes #18721
2025-09-25 12:06:44 +02:00
renovate[bot]
8e13e42583
GHA: update dependency ruff to v0.13.1 2025-09-25 11:42:43 +02:00
Viktor Szakats
7d5f8be532
GHA: use pip requirements.txt with pins, and more venv
- requirements.txt: shorten copyright headers.

- requirements.txt: pin packages to versions.

- GHA/windows: use `tests/requirements.txt`.
  Pick a `cryptography` package version that satifies both `impacket`
  and pytests dependencies.

- GHA/checksrc: move pip deps into a new `requirements.txt`.
  To make Dependabot detect and bump them.

- GHA/checksrc: replace apt packages for python test deps with pip
  install `tests/**/requirements.txt` to a venv.

- GHA/checksrc: use venv and drop `--break-system-packages`.

- GHA/linux: fix to actually activate venvs.
  Follow-up to 2638570241 #15578

- GHA/linux: fixup (did not cause an issue)
  Follow-up to d75785c7de #18660

- GHA: create venvs later, simplify commands.

- GHA: sync pip command-line options, e.g. drop progress-bar,
  everywhere.

Assisted-by: Dan Fandrich

Closes #18708
2025-09-25 10:45:30 +02:00
renovate[bot]
9d3f878e59
GHA: update actions/cache digest to 0057852
Closes #18710
2025-09-25 00:54:15 +02:00
Daniel Stenberg
b011e3fcfb
vssh: drop support for wolfSSH
The implementation was incomplete and lesser than the other backends. No
one ever reported a bug or requested enhancements for this, indicating
that this backend was never used.

Closes #18700
2025-09-24 22:59:33 +02:00
Viktor Szakats
22b9f77e38
GHA/curl-for-win: use DOCKER_IMAGE_STABLE
Replacing the hard-wired stable image. After this patch, it
will automatically follow upstream updates.

Follow-up to 6870bc1b35
Follow-up to 5a25df253d

Closes #18709
2025-09-24 19:00:03 +02:00
renovate[bot]
f8f84b40cc
GHA: Update ngtcp2/ngtcp2 to v1.16.0
Closes #18706
2025-09-24 14:03:44 +02:00
renovate[bot]
a99d79616b
GHA: update ngtcp2/nghttp3 to v1.12.0
Closes #18705
2025-09-24 14:03:08 +02:00
Viktor Szakats
cc157b4963
GHA/distcheck: bump timeout for the cmake integration
It may take 1.5 minutes to find the C compiler on macos with old cmake.
The build is also slow due to no unity and Ninja support.

```
Wed, 24 Sep 2025 04:56:51 GMT -- Using CMake version 3.11.4
Wed, 24 Sep 2025 04:58:01 GMT -- The C compiler identification is AppleClang 17.0.0.17000013
Wed, 24 Sep 2025 04:58:02 GMT -- Check for working C compiler: /Applications/Xcode_16.4.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang
Wed, 24 Sep 2025 04:59:33 GMT -- Check for working C compiler: /Applications/Xcode_16.4.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -- works
Wed, 24 Sep 2025 04:59:33 GMT -- Detecting C compiler ABI info
Wed, 24 Sep 2025 04:59:35 GMT -- Detecting C compiler ABI info - done
```
Ref: https://github.com/curl/curl/actions/runs/17966736478/job/51100678487?pr=18700#step:10:50

Closes #18702
2025-09-24 11:25:00 +02:00
Viktor Szakats
bdbb50a63e
GHA/dist: fix number of parallel jobs on macos runner
It was using the global parallel value in cmake integration tests, while
on macos runners, this should be lower by one, as used in other macos
jobs. Performance impact is minimal.

Follow-up to fb70812437 #16126
Closes #18701
2025-09-24 10:40:20 +02:00
renovate[bot]
135e4ec1dd
GHA: update dependency awslabs/aws-lc to v1.61.3
Closes #18690
2025-09-24 01:04:18 +02:00
Viktor Szakats
1acdf3bd64
GHA/macos: add macos-26, llvm20, gcc15, drop macos-14, gcc14
Number of combo jobs down to 22 from 24.

Also:
- update the version matrix.
- update exclusion matrix.
- include verbose compiler configuration dump.
  It makes the Apple-included, default `-I/usr/local/include` visible.
  Ref: #18683

Closes #18698
2025-09-23 20:24:21 +02:00
Viktor Szakats
67de9924eb
GHA/linux: enable libidn2 and libssh in asan job
Closes #18697
2025-09-23 13:02:52 +02:00
Viktor Szakats
b326293619
GHA/linux: fix address sanitizer error output
Same issue as seen earlier in the tsan job. Fix it the same way, by
switching to cmake to avoid autotools' libtool confusing the analyzer.
Ref: 2a46df31fd #18274

Configuration remains identical. I removed libssh2 from the installed
packages, because it was unused before, but cmake enabled it by default
and libssh2 has memory leaks:
Ref: https://github.com/curl/curl/actions/runs/17941312820/job/51018425159

Fixing:
```
/usr/bin/llvm-symbolizer-18: /home/runner/work/curl/curl/bld/lib/.libs/libcurl.so.4: no version information available (required by /usr/bin/llvm-symbolizer-18)
/usr/bin/llvm-symbolizer-18: symbol lookup error: /home/runner/work/curl/curl/bld/lib/.libs/libcurl.so.4: undefined symbol: __asan_option_detect_stack_use_after_return
==33900==WARNING: Can't read from symbolizer at fd 3
[..]
==33900==WARNING: Can't write to symbolizer at fd 6
==33900==WARNING: Failed to use and restart external symbolizer
```
Ref: https://github.com/curl/curl/actions/runs/17939949191/job/51013953675?pr=18693

Cherry-picked from #18693
Closes #18696
2025-09-23 12:39:48 +02:00
Viktor Szakats
71fc11e6bb
GHA/codeql: build units on Linux
Closes #18695
2025-09-23 11:48:02 +02:00
Viktor Szakats
d75785c7de
GHA: enable more options in static analyzer jobs
This is an effort to pass more code through clang-tidt and scan-build
static analyzers. Following CodeQL Linux jobs.

GHA/codeql:
- also build with libssh.
- disable verbose output in build steps.

GHA/linux:
- enable more build options for the clang-tidy and scan-build jobs:
  libidn2, nghttp2, ldap, kerberos, rtmp, gnutls, gsasl, rustls,
  mbedtls, wolfssl
  Use Linuxbrew where necessary.
- also enable ECH, gssapi in the scan-build job.
- fix 'scanbuild' to be 'scan-build' in the job name.

GHA/macos:
- build with Rustls in the clang-tidy job.
- add a new clang-tidy job to test HTTP/3 (with openssl + ngtcp2).
- build with libssh in one of the clang-tidy jobs.
- build with LibreSSL in the MultiSSL clang-tidy job.
- build with heimdal and kerberos in the clang-tidy jobs respectively.
- build with OpenLDAP in one clang-tidy job.
- add support for `skipall`, `skiprun` job options, and use it.

Closes #18660
2025-09-22 13:10:51 +02:00
Viktor Szakats
330129c836
GHA/linux: install zlib in all jobs by default
Cherry-picked from #18660
Closes #18672
2025-09-22 10:11:31 +02:00
Viktor Szakats
c23d7e7a98
GHA/codeql: enable ECH and HTTPS-RR
Switch to Linuxbrew c-ares to hit the minimum version.
(Ubuntu offers 1.27.0, HTTPS-RR requires 1.28.0.)

Closes #18661
2025-09-21 14:36:25 +02:00
Viktor Szakats
0513f9f878
build: show llvm/clang in platform flags and buildinfo.txt
Show these flags:
- `LLVM-CLANG` for mainline llvm/clang.
- `APPLE-CLANG` for Apple clang.
- `CLANG-CL` for clang-cl. (cmake only)

Also:
- GHA/linux: fix a job to build with clang, to match its descriptions.

Closes #18645
2025-09-21 01:59:56 +02:00
Daniel Stenberg
5ab120bc4e
krb5: drop support for Kerberos FTP
It was accidentally broken in commit 0f4c439fc7, shipped since
8.8.0 (May 2024) and yet not a single person has noticed or reported,
indicating that we might as well drop support for FTP Kerberos.

Krb5 support was added in 54967d2a3a (July 2007), and we have
been carrying the extra license information around since then for this
code. This commit removes the last traces of that code and thus we can
remove the extra copyright notices along with it.

Reported-by: Joshua Rogers
Closes #18577
2025-09-20 23:58:28 +02:00
Daniel Stenberg
cf3b9657bc
libssh2: up the minimum requirement to 1.9.0
Released on June 20 2019
2025-09-20 22:39:07 +02:00
Viktor Szakats
ca75476a5c
GHA/codeql: drop winbuild references [ci skip]
Follow-up to 8d004781a5 #18040
2025-09-20 15:07:29 +02:00
Viktor Szakats
8d004781a5
build: drop the winbuild build system
In favor of CMake.

Closes #18040
2025-09-20 01:20:25 +02:00
Viktor Szakats
b2356a3197
GHA: tidy up actions/checkout version in comments [ci skip] 2025-09-19 14:20:14 +02:00
Viktor Szakats
9618c337d1
GHA/codeql: try disabling the TRAP cache
The `cpp` CodeQL job is adding a cache entry for each run on the master
branch. One for Linux, another for Windows. Size: 68MB + 180MB = 248MB.
In one week we got 50+ such entries, almost filling the available cache
space.

Following the recommendation in an open issue thread, this patch tries
to disable this cache. Since it only affects master, the effect can only
be verified after merging.

The latest cache is picked up in PRs. The performance impact is also to
be seen after merge.

Bug: https://github.com/curl/curl/pull/18528#issuecomment-3288950880
Ref: https://github.com/github/codeql-action/pull/1172
Ref: https://github.com/github/codeql-action/issues/2030
Ref: https://github.com/github/codeql-action/issues/2885#issuecomment-2879069087

Follow-up to cc50f05370 #18528

Closes #18613
2025-09-19 11:30:39 +02:00
Viktor Szakats
cec6c1cd9c
GHA/codeql: make it run on docs updates, to verify examples
Follow-up to b4922b1295 #18564
2025-09-18 20:26:27 +02:00
Viktor Szakats
b4922b1295
GHA/codeql: enable cares, debug, build curlinfo, examples
Also build examples, out of curiousity, as an experiment, possibly
temporary. It needs around 40 seconds.

Closes #18564
2025-09-18 16:48:17 +02:00
renovate[bot]
22ac7f30ad
GHA: update openssl/openssl to v3.5.3
Closes #18566
2025-09-16 16:58:09 +02:00
Viktor Szakats
a333fd4411
GHA/codeql: enable more build options, build servers and tunits
- add HTTP/3 build with OpenSSL 3.5, nghttp3 and ngtcp2.
- enable GSASL, Heimdal, rtmp, SSLS-export.
- make one build MultiSSL with GnuTLS, mbedTLS, Rustls, wolfSSL.
- build servers (also on Windows), and tunits.
- use Linuxbrew to install build dependencies missing from Ubuntu.

Coverage is now 466 C files. (was: 446)

Closes #18557
2025-09-16 11:23:26 +02:00
renovate[bot]
98d5321530
GHA: Update nghttp2/nghttp2 to v1.67.1
Closes #18552
2025-09-15 23:16:32 +02:00
dependabot[bot]
56d3bb78be
GHA: bump actions/checkout from 4.2.2 to 5.0.0
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.2.2...08c6903cd8c0fde910a37f88322edcfb5dd907a8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Closes #18556
2025-09-15 23:15:19 +02:00
Viktor Szakats
ac24e0a80e
GHA/codeql: tidy up config names
Before this patch there was a single C config detected, named `build:`.

Closes #18555
2025-09-15 15:49:08 +02:00
Viktor Szakats
e09f45fea4
dist: do not distribute CI.md
`CI.md` slipped into the 8.15.0, 8.16.0 tarballs by accident.
Remove it again and update the checker exception.

Follow-up to fa3f889752 #17463

Closes #18549
2025-09-15 11:15:31 +02:00
Viktor Szakats
c1be5459d9
GHA/codeql: analyse Windows Schannel WinIDN build
Follow-up to cc50f05370 #18528

Closes #18545
2025-09-14 14:55:30 +02:00
Viktor Szakats
07837204cd
GHA/distcheck: disable man-db/auto-update
Make sure to not rebuild man pages after purging system curl, to make
the job faster and avoid timeouts:
```
Sun, 14 Sep 2025 10:16:28 GMT Removing curl (8.5.0-2ubuntu10.6) ...
Sun, 14 Sep 2025 10:16:28 GMT Processing triggers for man-db (2.12.0-4build2) ...
Sun, 14 Sep 2025 10:21:22 GMT (Reading database ... 218629 files and directories currently installed.)
```
Ref: https://github.com/curl/curl/actions/runs/17709785947/job/50326910814?pr=18535#step:3:19

Closes #18544
2025-09-14 14:02:32 +02:00
Viktor Szakats
83c457f9f3
GHA: document permissions as required by zizmor 1.13.0
Ref: https://github.com/zizmorcore/zizmor/pull/1131
Ref: https://docs.zizmor.sh/audits/#undocumented-permissions

Bug: https://github.com/curl/curl/pull/18539#issuecomment-3288151910

Closes #18541
2025-09-13 18:11:53 +02:00
Viktor Szakats
cc50f05370
GHA/codeql: re-enable for C with the default query pack
Earlier we used `security-extended` and tried `security-and-quality`.
Try the default to see how it works.

CodeQL no longer uses the project's Actions cache, also fixing
the previously seen repeat cache entry issue.

- switch to `manual` build. It's 3x faster than the default `autobuild`.
- enable more dependencies to increase coverage.
- docs/tests/CI.md: re-add CodeQL.

Ref: https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites
Ref: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
Ref: #16263
Ref: 173805b2e7 #15798

Closes #18528
2025-09-12 11:03:44 +02:00