Dan Fandrich [Sat, 8 Aug 2026 04:16:52 +0000 (21:16 -0700)]
libcurl.pc: add the Link.ABI and Source tags
Link.ABI is a feature of pkgconf 3.0 and indicates the ABI against which
a consumer must link the package. For libcurl, this is hard-coded as C.
Source is a URL from which to download the package tarball.
Jay Satiro [Fri, 7 Aug 2026 02:00:42 +0000 (22:00 -0400)]
api: fix printf format specifier
- Use %hu for unsigned short instead of %u.
Prior to this change some compilers could warn of an argument type
mismatch. C argument promotion rules promote the unsigned short argument
to an int, which does not match %u (unsigned int) but does match %hu
(unsigned short).
Assisted-by: Viktor Szakats
Closes https://github.com/curl/curl/pull/22511
Jay Satiro [Fri, 7 Aug 2026 03:30:50 +0000 (23:30 -0400)]
configure: clarify --enable-debug option
- Change --enable-debug help text to say it is for developing curl.
- Warn when --enable-debug is used.
This change copies the help text and warning from cmake ENABLE_DEBUG.
Also, it shortens the "for debugging curl itself" to just say "for
debugging curl".
Now it looks like this:
--enable-debug Enable curl debug features (for developing
curl)
--disable-debug Disable curl debug features
Viktor Szakats [Tue, 16 Jun 2026 11:50:51 +0000 (13:50 +0200)]
servers: drop CRT and curlx calls from `main_window_loop()` (Windows)
To simplify and to avoid the chance of potential interference or
thread-safety issues. If one these 3 Win32 API calls fail, there is
likely a serious problem, out of the code's control. Knowing
`GetLastError()` is unlikely to help.
Daniel Stenberg [Wed, 5 Aug 2026 21:40:18 +0000 (23:40 +0200)]
rtsp: refactor method handling and improve error checks
- convert the method switch() to a simple table
- avoid converting the methods from external to internal numbers, they were
the same anyway so keep the external ones, just use the old defines.
- fix range check. It wrongly used the method numbers as bitmask, which made
the check not work previously. Also error on OOM.
- Dropped the session-id check. It too wrongly did a bitmask check which was
wrong and never worked. When fixed, it broke test cases so I dropped the
entire check.
Viktor Szakats [Wed, 5 Aug 2026 07:43:57 +0000 (09:43 +0200)]
servers: drop duplicate (and interacting) ctrl handlers on Windows, add exit message
On Windows, the init code calls `SetConsoleCtrlHandler()`, and before
this patch also set handlers for all Unixy signals. Of these, `SIGBREAK`
(used on Windows-only), `SIGINT`, `SIGABRT` and `SIGTERM` were also
setting up a `SetConsoleCtrlHandler()`, in addition to the call made
directly. (The rest, `SIGHUP`, `SIGPIPE`, `SIGALRM` are either missing
the macros, or ignored by `signal()` on Windows.)
As per WINE sources, `SetConsolCtrlHandler(<h>, TRUE)` calls are
additive, which means the test server set up two console ctrl handlers.
Then the ctrl handler set directly (`ctrl_event_handler()`), was
triggering the other signal handler via `raise()`, for the 'initiate
exit' logic, which in turn triggered exiting a wait within `select_ws()`
and other loops. The Windows window handler also made use of the
`SIGTERM` event to initiate exit via `raise()` and the second signal
handler.
To simplify, de-duplicate the ctrl handlers by dropping `signal()` calls
and keeping the direct Win32 call with `ctrl_event_handler()` doing all
the signal handling on Windows. Break out the 'initiate exit' logic into
a function and call it from both Unix and Windows signal/ctrl/window
handlers. Also drop calling `raise()` on exit, because it's a no-op
without a `signal()` pair.
Also:
- drop logging the actual ctrl type number, replace with just logging
whether we handled the event, in `ctrl_event_handler()`. To avoid
using non-signal-safe functions (e.g. `fprintf()`) from the handler.
- also replace `logmsg()` with `WriteFile()` to prevent regressions.
Ref: #22045
- replace `logmsg()` with `WriteFile()` in `main_window_proc()`.
- fix to forward ctrl handling to the OS in the rare case of failed
`exit_event` initialization on startup. To swap a possible hang
(within `WaitForMultipleObjectsEx()`) with an ungraceful shutdown.
- add support for an 'exit message' string, set by signal/ctrl handlers,
and log it on app exit. To avoid the need to deal with logging within
the handlers, yet have a static trace message about the event.
Complementing the already logged signal number.
- drop stderr trace message from `exit_signal_handler()` in favor of an
exit message. runtests triggers it frequantly, which added much noise
to stderr. As a bonus, this also allows dropping the compiler warning
suppression. Reported-by: Stefan Eissing
Bug: https://github.com/curl/curl/pull/22487#issuecomment-5204092974
Follow-up to 3aae64e4fbee7c1fa408c54df18d3f631781c283 #22507
Viktor Szakats [Thu, 6 Aug 2026 09:54:04 +0000 (11:54 +0200)]
servers: drop complex and redundant signal handler output
In year 2020 the Unixy signal handler received a `logmsg()` call to log
the signal number, but at the same time it already saved it to a global
variable and logged it on exit, meaning this extra `logmsg()` was
redundant. Because `logmsg()` is not signal-safe, this call was replaced
in 2025 with signal-safe logging, but without the signal number, while
also adding complexity, spent on trying to open the log file and handle
errors. All for nothing, because the signal number was logged all along.
This patch removes all this, and simplifies it to a single, signal-safe
`write()` to STDERR to say that the signal handler triggered. This is
also non-critical, but may help debugging.
Also: point the POSIX documentation to the 2004 revision, which has a
shorter list of safe functions. (was: 2018)
Viktor Szakats [Thu, 6 Aug 2026 05:59:29 +0000 (07:59 +0200)]
servers: sync socket type global variables
Replace `ipv_inuse` and `use_ipv6` with `socket_type` and
`socket_domain` (where missing) to avoid dupliicate globals with
overlapping purposes. The replacement variables also support Unix
sockets.
Also:
- simplify/reduce IPv6 guards.
- socksd: fix to reset `socket_domain` for `--ipv4` option.
Viktor Szakats [Wed, 5 Aug 2026 17:10:52 +0000 (19:10 +0200)]
servers: drop re-registering the signal handler on modern systems
Before this patch modern systems used `sigaction()` and `SA_RESTART` to
install signal handlers, but the signal handler function itself still
made a call to the legacy `signal()` function to re-register itself
before returning.
Re-registering the handler is not necessary with `sigaction()`. It's
also undesired to use the legacy API when the modern one is available.
Fix by guarding off this call in builds that support the modern API.
Viktor Szakats [Tue, 16 Jun 2026 01:07:58 +0000 (03:07 +0200)]
servers: fix to reverse `SA_RESTART` option for `sigaction()` on modern codepath
Historically servers used the deprecated `siginterrupt()` function to
configure restart behavior on specific signals. It accepts a flag, where
1 means to remove the `SA_RESTART` option, and 0 means to enable it.
In year 2021 3fb6e5a01001b8c7dfdc33a89041178aac381a27 introduced the
modern alternative to the codebase, replacing `siginterrupt()` with
`sigaction()`. After this patch, supporting, modern, systems reacted on
the same flag, but, by accident, set the `SA_RESTART` bit when flag is
1, and did not set it when 0. This reversed the previous behavior, and
the one still used on the `siginterrupt()` legacy codepath.
Fix it by revesring the `SA_RESTART` logic for the `sigaction()`
codepath, syncing it with the pre-existing behavior.
I find it odd this did not cause any perceivable issue for 5 years, even
though it's the active one in most Unix envs.
Spotted by GitHub Code Quality, though suggesting to fix
`siginterrupt()` calls. But looking into the history, those were correct
all along.
Viktor Szakats [Fri, 31 Jul 2026 22:45:57 +0000 (00:45 +0200)]
curl_ed25519: add GnuTLS support (via nettle, hogweed)
The necessary cryptography API is provided by nettle 3.1+, via its
'hogweed' library. The minimum GnuTLS version required by curl is 3.6.5,
which requires nettle 3.4.1+, so the API is always available.
Also:
- autotools: detect and use nettle's hogweed library.
- cmake/FindNettle: add support for the hogweed library.
- GHA/http3-linux: enable in the autotools/cmake GnuTLS jobs.
Daniel Stenberg [Mon, 3 Aug 2026 12:38:38 +0000 (14:38 +0200)]
test557: test curl_mv*printf() functions
These functions were previously untested in the test suite. This is just
a set of basic invokes to make sure they work. The core of these
functions is identical and is tested already.
It comes as a transitive requirement by the minimum GnuTLS version.
Because libcurl uses nettle directly (in GnuTLS builds), I figure it is
useful to document explicitly.
dependabot[bot] [Sat, 1 Aug 2026 14:56:08 +0000 (14:56 +0000)]
GHA: bump GitHub Actions and pips
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `actions/labeler` from 6.1.0 to 7.0.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3
- update `cryptography` from 48.0.1 to 49.0.0
- update `filelock` from 3.29.0 to 3.32.0
- update `impacket` from 0.13.0 to 0.13.1
- update `pytest` from 9.0.3 to 9.1.1
- update `websockets` from 16.0 to 16.1.1
Viktor Szakats [Thu, 30 Jul 2026 12:20:59 +0000 (14:20 +0200)]
build: assume POSIX `select()` is available
This change effectively replaces an explicit compile-time #error with
a missing prototype error in environments not offering `select()`, and
saves curl-compatible systems from performing an explicit feature check.
Stefan Eissing [Wed, 29 Jul 2026 11:11:20 +0000 (13:11 +0200)]
apple-fast-udp: fix sendmsg_x partial results
When sending with sendmsg_x(), fix handling of last gso chunk being
smaller. Handle partial results correctly. Ignore SOCKEMSGSIZE by
reporting success which drops PMTUD probes into the void.
Viktor Szakats [Fri, 24 Jul 2026 22:11:21 +0000 (00:11 +0200)]
tidy-up: minor code fixes and improvements
- schannel: drop redundant parentheses.
- os400sys: drop redundant includes.
Follow-up to ebc5212dacd3db8f5315b5a2d676415848e936d5 #22374
- pytest: replace `()` with `[]` to match rest of tests.
- libtests: constify some local pointers.
- libtests: drop redundant `(long)` casts.
- lib650: use `CURL_CSTRLEN()`.
Follow-up to 59dc2bbe07c3b5889e0b380e5fa384d338d9d24e #22424
Viktor Szakats [Wed, 29 Jul 2026 21:30:51 +0000 (23:30 +0200)]
lib5004: fix memleak on OOM, check all slist append results (httpsig)
Detected by torture tests:
```
test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)]
105 functions found, but only fail 25 (23.81%)
** MEMORY FAILURE
Leak detected: memory still allocated: 99 bytes
At 6000022c9408, there is 36 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000039c8e78, there is 31 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000037dd688, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
At 6000037dd628, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit
5004: torture FAILED: function number 10 in test.
```
Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331
Also:
- enable HTTPSIG in torture tests.
- NULL check all `curl_slist_append()` results.
- apply a NULL check to sibling test 5000 also.
Viktor Szakats [Thu, 30 Jul 2026 00:24:58 +0000 (02:24 +0200)]
build: fix HTTPSIG option for unsupported TLS backends
Show a warning and force-disable HTTPSIG when the TLS backend is not
OpenSSL or wolfSSL. Before this patch this resulted in a mismatched
feature list in configure and `curl -V`.
Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows
compilers, clang-tidy, cmake.
Viktor Szakats [Wed, 29 Jul 2026 23:46:15 +0000 (01:46 +0200)]
GHA: work around Homebrew `ca-certificates` install error
Working around:
```
==> Installing libngtcp2 dependency: ca-certificates
==> Pouring ca-certificates--2026-07-16.all.bottle.1.tar.gz
Warning: The post-install step did not complete successfully
[...]
Error: Process completed with exit code 1.
```
Dan Fandrich [Tue, 28 Jul 2026 23:27:38 +0000 (16:27 -0700)]
tests: fix cert comparison with old cryptography
The fallback path for cryptography < 42 was broken by commit e13362c2
that caused a comparison between offset-naive and offset-aware
datetimes. Use the positional form of tz in datetime.now() everywhere.
Viktor Szakats [Sat, 16 May 2026 10:08:00 +0000 (12:08 +0200)]
src: improve `curlx_memzero()` internal APIs
- delete zero-and-free wrapper macros. (not yet used)
To keep it simple.
- do NULL-check in `curlx_memzero()`.
To avoid noise at call sites.
- add `curlx_strzero()` for null-terminated strings, also with
NULL-check.
Stefan Eissing [Tue, 28 Jul 2026 12:27:13 +0000 (14:27 +0200)]
websocket: pause writing and meta data fix
When writing a decoded chunk of websocket data, always flush the writer
chain so that buffered data gets delivered before the ws meta data gets
updated.
Add client writer flags CURL_CW_FLAG_BLOWUP for writer types that may
significantly enlarge write sizes. This flag causes the pause writer to
be added and shrinks the write chunk sizes. We do not want that for
content decoders like WS that do not change the size.
Add test_20_13 to check that large frames are paused/unpaused correctly
with the matching meta data.
Fixes #22413 Reported-by: Hendrik Hübner
Closes #22416
Viktor Szakats [Wed, 15 Jul 2026 00:18:30 +0000 (02:18 +0200)]
scorecard: fix `max_upload` init value in `ul_parallel()`
"In `ul_parallel`, `max_parallel` is computed using
`self._download_parallel` instead of `self._upload_parallel`. This
causes the upload parallelism to incorrectly follow the download
parallel setting. It should use `self._upload_parallel` to be consistent
with how `uploads()` computes `max_parallel`."
Viktor Szakats [Wed, 15 Jul 2026 00:28:09 +0000 (02:28 +0200)]
dnsd: fix bounds check in `read_https_alpn_part()`
"The check `i > 256` permits `i == 256` to pass through. When `i` is
then cast to `uint8_t` in `blob_add(b, (uint8_t)i)`, the value wraps to
0, silently encoding a zero-length ALPN entry instead of rejecting it.
The condition should be `i > 255` (or equivalently `i >= 256`) to
correctly reject any length that does not fit in a single byte."
Dan Fandrich [Sat, 25 Jul 2026 20:34:38 +0000 (13:34 -0700)]
tests: target Python 3.8 as the minimum Python version
This version is already two releases out of support, but is "only" 7
years old so is probably still being used in the real world. Document
this version along with some other testing dependencies. Remove code
support for earlier versions. Disable ruff checks that need a newer
version.
Dan Fandrich [Sat, 25 Jul 2026 20:23:21 +0000 (13:23 -0700)]
tests: address mutable class vars and naive datetime in Python code
Mark Python mutable class variables with ClassVar, to denote that the
danger this can cause has been considered. Since any change made to
these in any object affects all other objects, this can cause locality
errors. However, as used in the test suite, they are are never modified
and so they are annotated as being intended.
Always set a timezone in datetime objects, as mixing naive and
timezone-aware object can cause errors.
Dan Fandrich [Sat, 25 Jul 2026 21:05:01 +0000 (14:05 -0700)]
tests: use simpler constructions in Python code
* call super() without arguments
* mark an unused variable as such
* simplify by using dict getter for default values
* use writelines() when possible
* use dedent to simplify some text formatting
* avoid items() on dict in a loop when unnecessary
* replace most Python format() calls with f-strings
* use capture_output in subprocess.run
Dan Fandrich [Sat, 25 Jul 2026 20:35:51 +0000 (13:35 -0700)]
tests: change whitespace and comments in Python test code
* remove an unneeded ruff warning disable
* remove coding: utf-8 from Python code; PEP 3120 makes UTF-8 the
default encoding
* remove unusable shebang lines from Python code
* remove empty print strings
* disable warnings when file objects are stored; these instances can't
be handled with context managers
* use more consistent whitespace in Python code, fixing flake8 warnings
* set the executable bit on scorecard.py, making it easier to run
These fix ruff rules EXE001, FURB105, UP009, SIM115.
Dan Fandrich [Sat, 25 Jul 2026 20:06:38 +0000 (13:06 -0700)]
tests: improve exception handling in Python test code
* Explicitly set "check" in subprocess.run() to raise an exception
automatically, where it was done manually before
* Use contextlib.suppress to ignore exceptions
* Use custom exceptions for test errors for clarity and flexibility.
* Replace IOError with OSError
Viktor Szakats [Wed, 22 Jul 2026 23:50:06 +0000 (01:50 +0200)]
tidy-up: use more `static`, `sizeof()`, `char[]`, double-const
- make `const` data `static`, where missing and possible.
- replace `strlen()` on literal or const strings with `sizeof()`.
While the latter is optimized by popular C compiler, e.g. MSVC only
does it with `/O2`.
- replace magic numbers with `sizeof()`, where missing.
- introduce `CURL_CSTRLEN()` macro for `sizeof(char[]) - 1`.
- use `CURL_CSTRLEN()` macro.
- move `const` before integer types, where missing.
- replace `char *var` with `var[]`, where missing and possible.
- use double const, where missing.
`static const char *` -> `static const char * const`.
- lib1514: constify pointers.
- unit3205: drop redundant cast, avoid another one.
- unit1666: map `OID()` macro to identical `STRCONST()`.
projects / thirdparty / curl.git / log
