Your message dated Fri, 17 Jul 2026 09:32:05 +0000
with message-id <[email protected]>
and subject line Bug#1137539: fixed in curl 8.14.1-2+deb13u5
has caused the Debian Bug report #1137539,
regarding curl: OpenSSL engine support regression from bookworm to trixie
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1137539: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1137539
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: curl
Version: 8.14.1-2+deb13u3
Severity: normal
Dear Maintainer,
the version of curl in trixie 8.14.1-2+deb13u3 is missing
https://github.com/curl/curl/commit/17f2a220a99db30bacd66df4df677dfb0a18b405
This means that any attempt to use private keys via OpenSSL engines
(e.g. PKCS#11 via libengine-pkcs11-openssl) fails without a error
message. Compared to bookworm, that's a regression.
The version in trixie-backports 8.19.0-1~bpo13+1 contains the fix and
works fine.
Could you pick the fix for trixie as well?
Thanks,
Jan Lübbe
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (990, 'stable-updates'), (990, 'stable-security'), (990,
'stable'), (500, 'oldstable-updates'), (500, 'oldstable-security'), (500,
'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.19.13+deb13-amd64 (SMP w/128 CPU threads; PREEMPT)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages curl depends on:
ii libc6 2.41-12+deb13u3
ii libcurl4t64 8.14.1-2+deb13u3
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
Versions of packages curl recommends:
ii bash-completion 1:2.16.0-7
curl suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: curl
Source-Version: 8.14.1-2+deb13u5
Done: Samuel Henrique <[email protected]>
We believe that the bug you reported is fixed in the latest version of
curl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Samuel Henrique <[email protected]> (supplier of updated curl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 12 Jul 2026 14:17:22 -0700
Source: curl
Architecture: source
Version: 8.14.1-2+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: Debian Curl Maintainers <[email protected]>
Changed-By: Samuel Henrique <[email protected]>
Closes: 1137539
Changes:
curl (8.14.1-2+deb13u5) trixie; urgency=medium
.
[ Carlos Henrique Lima Melara ]
* d/p/CVE-2026-3784.patch: remove trailing whitespace from patch
.
[ Samuel Henrique ]
* d/p/openssl_fix_openssl_engines.patch: New patch to fix engine support
(closes: #1137539)
Checksums-Sha1:
c847a67c7c516a58e14af2507f4d6d93acc58f8a 3263 curl_8.14.1-2+deb13u5.dsc
d84a4b8baf1baaca33e31e809f5e770deb727c2f 4250332 curl_8.14.1.orig.tar.gz
c892a3257a40081f754b33e6a10eca2453860307 488 curl_8.14.1.orig.tar.gz.asc
9708df4a0ed6fd56339c4152252e7ad2d26126e3 72312
curl_8.14.1-2+deb13u5.debian.tar.xz
74f836603c79c934d7aeac10976694b2ec7435b4 12737
curl_8.14.1-2+deb13u5_amd64.buildinfo
Checksums-Sha256:
9a9a2c95cdc8b5d76892c70858f25eaf2dc0b0a475a1e43e0b4ad428414752df 3263
curl_8.14.1-2+deb13u5.dsc
6766ada7101d292b42b8b15681120acd68effa4a9660935853cf6d61f0d984d4 4250332
curl_8.14.1.orig.tar.gz
39cc2ec8ddc39d04e3e7101bbed46d858d0875cbb297a6bfa20959fa2bc7d5c7 488
curl_8.14.1.orig.tar.gz.asc
ebdfcfab1c2001c7a539fe2a4044dbf666a544393f191bedce9ee2d07c4ea925 72312
curl_8.14.1-2+deb13u5.debian.tar.xz
2ae9532d59c39ca5975f974b44cb5bceda33203bee2105e0479b7fe882daa16f 12737
curl_8.14.1-2+deb13u5_amd64.buildinfo
Files:
be68351e4d3a4d094e77331b05a4a317 3263 web optional curl_8.14.1-2+deb13u5.dsc
745dfc1da8c44eb9ce6ede16fd102c32 4250332 web optional curl_8.14.1.orig.tar.gz
e90da3c198bfec67be08392e2a974103 488 web optional curl_8.14.1.orig.tar.gz.asc
7372cbf30b98b036c5e37828552f9b6c 72312 web optional
curl_8.14.1-2+deb13u5.debian.tar.xz
20d5651ac8dc3fe362559d0781d71964 12737 web optional
curl_8.14.1-2+deb13u5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEBdtqg34QX0sdAsVfu6n6rcz7RwcFAmpUUCgACgkQu6n6rcz7
Rwe7ARAAuZcnPXYemSs0oRv9FIXWJtZEzwh/jExIKaaOpziW1FYd11Kz0s4LWd6z
AQDu5Qt8H4BNl5VbQPFhhJiDOBekFo03QqaUtqn7luM/wPEmvroYCkM0ao3E97lA
k3MM8+c33X/nD+N+6SP17WG8jEKb6oruch51ukGRE7nKSjgAZXpQIdFueogFxSxC
beGefi94NSVQjjnJwiaEMDrY6GQuwq9id40SZSS8Fuf6hYxt86dn69e6d2QZPJku
5bp5HpBXLRCcPgttIK0DnUQah6/PGj2KdEJDD82zTHkigOIVvZuXMAkRXMqYl8kl
OecPrnjkEwfI4jxR5QQ+u2W14l5DdCA+GyoyiSAKoPJCX4K+kKe1TQ9WWm4uz7d/
ypOSspGLhi+mQ3ZDbKKC5VDry/jBABtb1z8S4Vd/S6GqT0HUo5rP/lHPVsp3d6S4
mmp0o4bUzuDCJYKt/b+5rTw0K37hmgVOWVrS/pZnGUwebVme7+A9xt3NBrERXxb4
842CMO8aFrVONnBtJTne9htgTEl+53fh800XrPHVDPQzNmwUO9mfijO/QOHeEMJq
2pNEFDR/hgPgxiLVaCoJQ7hsAZ9KXRfzeGl56fifjr+7ziE4VN1+L5h6GK1cwkCk
NUXL32VD5ceXx46Yar2JMKIxTBUCDf/sp1rR9Iixbah/Rh2An94=
=0Gfg
-----END PGP SIGNATURE-----
pgpJ0oyTI7veQ.pgp
Description: PGP signature
--- End Message ---
