Re: When CURLOPT_RANGE is specified in the FTP protocol, does it ever write out-of-range data?

2025-08-07 Thread Daniel Stenberg via curl-library
On Thu, 7 Aug 2025, Yoshimasa Ohno via curl-library wrote: In the application, I am trying to specify the retrieval range in CURLOPT_RANGE and write incoming data through CURLOPT_WRITEFUNCTION. As far as I can tell, the callback to CURLOPT_WRITEFUNCTION doesn't seem to pass over data outside

Re: How to disable listening port randomisation for the test servers

2025-08-06 Thread Daniel Stenberg via curl-library
On Tue, 5 Aug 2025, Fabian Keil via curl-library wrote: Any ideas on how to best achieve the desired effect now? I can't say I have any particularly good option. That's not something we have cared about. Why is this desired for those users, what's the use case? -- / daniel.haxx.se || http

Re: Adding HTTP/3 Proxy CONNECT & MASQUE (CONNECT-UDP) Support to cURL

2025-07-30 Thread Daniel Stenberg via curl-library
On Wed, 30 Jul 2025, Aritra Basu (aritrbas) via curl-library wrote: 1. HTTP/3 proxy CONNECT support 2. MASQUE (CONNECT-UDP) support I have the code available and ready for review that implements these features (currently only for the OpenSSL QUIC stack). If there is interest and willingn

Feature window opens

2025-07-25 Thread Daniel Stenberg via curl-library
Hello friends, While we have seen a few regressions in this release, they have been deemed not important enough to trigger a patch release. As of Saturday July 26, the feature window is hereby again considered opened. We have no less than *23* pull-requests marked feature-window right now. I

[RELEASE] curl 8.15.0

2025-07-15 Thread Daniel Stenberg via curl-library
Hello team, I'm happy to announce that we have yet again put together a little curl release. Get it as always from https://curl.se Enjoy! curl and libcurl 8.15.0 Public curl releases: 269 Command line options: 269 curl_easy_setopt() options: 308 Public functions in libc

Re: rethink the bug-bounty?

2025-07-14 Thread Daniel Stenberg via curl-library
On Mon, 14 Jul 2025, Patrick Monnerat via curl-library wrote: An idea: drop hackerone (it advertises the project bounties too much) and go back to the curl-security mailing list :-) We discussed this today briefly and we more or less agreed to hold off a bit and see how it develops the coming

rethink the bug-bounty?

2025-07-14 Thread Daniel Stenberg via curl-library
Hey, Maybe it is time for us to do something else or differently in regards to the curl bug-bonty? I elaborated here: https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/ -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo

Sponsor my laptop

2025-07-12 Thread Daniel Stenberg via curl-library
Hello, We're running a small crowd-source program to give everyone a chance to help sponsor a new laptop for curl development: https://daniel.haxx.se/blog/2025/07/12/sponsor-my-laptop/ -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo

Re: Time to deprecate TLS 1.0 and 1.1 ?

2025-07-11 Thread Daniel Stenberg via curl-library
On Fri, 11 Jul 2025, Timothe Litt via curl-library wrote: bricking hardware by making it impossible to access them will not make you any friends First, if this change would *brick* a device that would be entirely because of stupid engineering and not because of curl. Then, I would to ju

Re: Time to deprecate TLS 1.0 and 1.1 ?

2025-07-10 Thread Daniel Stenberg via curl-library
On Fri, 11 Jul 2025, Christian Schmitz wrote: There may be plenty of old code around, that explicitly puts in CURL_SSLVERSION_TLSv1_0 or CURL_SSLVERSION_TLSv1_1. From a time where we had SSL v3 as default and we wanted to get better TLS 1.0 or 1.1. Right, now we can't tell if they raise the m

Time to deprecate TLS 1.0 and 1.1 ?

2025-07-10 Thread Daniel Stenberg via curl-library
Right, For all reasons, see RFC 8996 => https://datatracker.ietf.org/doc/html/rfc8996 Who would get upset? Proposed approach: 1. We change the default (CURL_SSLVERSION_DEFAULT) and v1 (CURL_SSLVERSION_TLSv1) to mean >= 1.2 in 8.16.0 (September 2025 release) 2. We give everyone six more

Release candidate 3: curl 8.15.0-rc3

2025-07-09 Thread Daniel Stenberg via curl-library
Hello, The third and last release candidate of the coming curl 8.15.0 release is now uploaded and available for testing on https://curl.se/rc/. Please take this one for a spin and verify that everything seems to work as they should. All the new features for the pending release have been merged

Collaborate on next year's survey

2025-07-03 Thread Daniel Stenberg via curl-library
Hi, To better enable collaboration on the questions for the curl user survey for next year, and maybe also increase the chances that we can host them on a non-Google property, I have converted them all into markdown and put them in a brand new repository: https://github.com/curl/user-surve

The #curl user survey 2025 analysis

2025-07-03 Thread Daniel Stenberg via curl-library
Hi friends, I managed to chew through all the data, I ran the numbers and I generated the output. Enjoy: https://daniel.haxx.se/blog/2025/07/03/curl-user-survey-2025-analysis/ -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-li

Release candidate 2: curl 8.15.0-rc2

2025-06-30 Thread Daniel Stenberg via curl-library
Hello again! I just uploaded the rc2 build of the coming curl 8.15.0 release uploaded and made it available for testing on https://curl.se/rc/. Please take this one for a spin and verify that everything seems to work as they should. All the new features for the pending release have been merge

Re: libcurl socket interface and timeout (ephiperfifo  example)

2025-06-25 Thread Daniel Stenberg via curl-library
On Mon, 23 Jun 2025, Nicolas Martin via curl-library wrote: 1- multi_timer_cb It's an optimization so libcurl will ask to timeout sooner and data will be read/written without waiting for a full timeout. It's more than "an optimization". In order to function properly, to do timeouts and thi

Re: Add support for the NETRC envvar

2025-06-22 Thread Daniel Stenberg via curl-library
On Sat, 21 Jun 2025, Berthin Torres Callañaupa via curl-library wrote: I looked at the libCurl GitHub project and didn't find any discussion regarding the use the NETRC envvar as an alternative location to user's home directory .netrc file. Here's a first shot at it: https://github.com/cur

Re: Add support for the NETRC envvar

2025-06-21 Thread Daniel Stenberg via curl-library
On Sat, 21 Jun 2025, Berthin Torres Callañaupa via curl-library wrote: I'd like to start a discussion and support the NETRC environment variable since many other tools are already following the GNU inetutils Can you list some of the many tools that do this? Just to give us a picture of the la

RE: Release candidate 1: curl 8.15.0-rc1

2025-06-21 Thread Daniel Stenberg via curl-library
On Sat, 21 Jun 2025, rsbec...@nexbridge.com wrote: Just a little nit in this release... tests/servers/util.c includes in.h but does not #Include as other files do. This is needed for struct sockaddr_in6. I could do a PR for this if asked. Thanks, I made one for this: https://github.com/curl/

Feature window CLOSED

2025-06-21 Thread Daniel Stenberg via curl-library
Hello, This cycle had a short feature window and it is now closed. We now only merge bugfixes and aim for a curl 8.15.0 release on July 16. Stand by for the rc1 build. -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiqu

Release candidate 1: curl 8.15.0-rc1

2025-06-21 Thread Daniel Stenberg via curl-library
Hello friends! There is a fresh rc1 build of the coming curl 8.15.0 release uploaded and made available for testing on https://curl.se/rc/. Please consider taking this for a spin and verify that everything seems to work as they should. All the new features for the pending release have been me

Feature window opens today

2025-06-10 Thread Daniel Stenberg via curl-library
Hello friends! We open the curl feature window today. We allow and will merge features into the master branch for the coming ten days. This cycle has a shortened feature window because the cycle was first shortened by a week for scheduling reasons and then yet another week was lost when we d

[SECURITY AVISORY] curl: CVE-2025-5399: WebSocket endless loop

2025-06-03 Thread Daniel Stenberg via curl-library
WebSocket endless loop == Project curl Security Advisory, June 4 2025 - [Permalink](https://curl.se/docs/CVE-2025-5399.html) VULNERABILITY - Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcur

[RELEASE] curl and libcurl 8.14.1

2025-06-03 Thread Daniel Stenberg via curl-library
Hello! Another curl release has been packaged, signed and uploaded. Get it as always from https://curl.se/ curl and libcurl 8.14.1 Public curl releases: 268 Command line options: 269 curl_easy_setopt() options: 308 Public functions in libcurl: 96 Contributors:

Re: libcurl and nginx persistent auth behavior

2025-05-31 Thread Daniel Stenberg via curl-library
On Sat, 31 May 2025, Luke Palmer wrote: I'm sure I don't understand all of the nuance here, but in my simple testing if I disable libcurl's assumption that multiplexed connections have persistent authentication, everything appears to work. Feel free to show us with a patch/PR. Might it be a

Re: libcurl and nginx persistent auth behavior

2025-05-31 Thread Daniel Stenberg via curl-library
On Sat, 31 May 2025, Luke Palmer via curl-library wrote: To put this another way, libcurl assumes persistent authentication is present when multiplexing, and nginx does not natively implement persistent authentication at all. Thinking about it, I suspect nginx is right on this. Since different

Re: How to build curl against Apple LibreSSL

2025-05-31 Thread Daniel Stenberg via curl-library
On Fri, 30 May 2025, Conrad Kramer via curl-library wrote: This is so cool, thank you for doing this! Does it support TLS 1.3/ECH? If so, that is a big improvement over the default SecureTransport. I would hope TLS 1.3 works fine, but ECH support seems a bit away for libressl still: https://g

Re: 8.14.0 regression

2025-05-29 Thread Daniel Stenberg via curl-library
On Wed, 28 May 2025, Daniel Stenberg via curl-distros wrote: Probably reason enough for a follow-up patch release... The plan: a 8.14.1 release on June 4 -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https

8.14.0 regression

2025-05-28 Thread Daniel Stenberg via curl-library
Hey, The release is still warm but we have identified a first regression: https://github.com/curl/curl/pull/17475 Probably reason enough for a follow-up patch release... -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library E

[SECURITY ADVISORY] curl: No QUIC certificate pinning with wolfSSL

2025-05-27 Thread Daniel Stenberg via curl-library
No QUIC certificate pinning with wolfSSL Project curl Security Advisory, May 28 2025 - [Permalink](https://curl.se/docs/CVE-2025-5025.html) VULNERABILITY - libcurl supports *pinning* of the server certificate public key for HTTPS transfers. D

[SECURITY ADVISORY] curl: QUIC certificate check skip with wolfSSL

2025-05-27 Thread Daniel Stenberg via curl-library
QUIC certificate check skip with wolfSSL Project curl Security Advisory, May 28 2025 - [Permalink](https://curl.se/docs/CVE-2025-4947.html) VULNERABILITY - libcurl accidentally skips the certificate verification for QUIC connections when conn

[RELEASE] curl and libcurl 8.14.0

2025-05-27 Thread Daniel Stenberg via curl-library
Hello, I'm happy to once again announce that we have shipped a new curl release. curl 8.14.0 is uploaded and is as always available at https://curl.se Enjoy! curl and libcurl 8.14.0 Public curl releases: 267 Command line options: 269 curl_easy_setopt() options: 308 Publ

[reminder] The curl user survey 2025

2025-05-26 Thread Daniel Stenberg via curl-library
Hello! Just a quick reminder: if you haven't already, please head over and fill in this year's curl survey: https://daniel.haxx.se/blog/2025/05/19/the-curl-user-survey-2025-is-up/ Thanks! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/lis

Help out in the curl project!

2025-05-26 Thread Daniel Stenberg via curl-library
Hello, What YOU can do to help out in the curl project. Things we would appreciate help and assistance with at the moment. Some things that are current. For general tips on how to get started helping out, start at [1]. ## survey Fill in the annual curl user survey [3] and make your friends do

Re: CURLOPT_FOLLOWLOCATION and request body

2025-05-26 Thread Daniel Stenberg via curl-library
On Mon, 26 May 2025, Daniel Stenberg via curl-library wrote: I just feel that we can't get into that in the CURLOPT_FOLLOWLOCATION page without it becoming a little messy. I believe those details are better documented in the CURLOPT_READFUNCTION page. I made https://github.com/curl/curl

Re: CURLOPT_FOLLOWLOCATION and request body

2025-05-26 Thread Daniel Stenberg via curl-library
On Mon, 26 May 2025, Jeroen Ooms wrote: Perhaps also worth explaining that libcurl will then error if the body was given via CURLOPT_READFUNCTION because it can only be consumed once? ... if you don't implement the seek callback, yes. I just feel that we can't get into that in the CURLOPT_FOL

Re: CURLOPT_FOLLOWLOCATION and request body

2025-05-26 Thread Daniel Stenberg via curl-library
On Mon, 26 May 2025, Jicea via curl-library wrote: I'm trying to get information on how libcurl behaves with CURLOPT_FOLLOWLOCATION and request body. Methods chosen for redirection are heavily documented, but I want to know how the request body is affected during redirection: is the initial bo

Re: CURLOPT_FOLLOWLOCATION and request body

2025-05-26 Thread Daniel Stenberg via curl-library
On Mon, 26 May 2025, jeanchristophe.am...@orange.com wrote: Thanks for the quick reply and the PR Daniel. Just to be crystal clear: does it mean that the new request retains the request body when there is no method change (for instance a POST with 308, or a redirection on a PUT request)? Yes

RE: Release candidate 3: curl 8.14.0-rc3

2025-05-21 Thread Daniel Stenberg via curl-library
On Wed, 21 May 2025, Marcel Raad wrote: For the record, as with all previous v8.14 RCs, I encountered no issues on Windows, Linux, Android, macOS, and iOS. Excellent, thanks! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-libra

Release candidate 3: curl 8.14.0-rc3

2025-05-21 Thread Daniel Stenberg via curl-library
Hello friends! In preparing for the actual release, rc3 has been uploaded and made available for testing on https://curl.se/rc/. Please consider taking this for a spin and verify that everything seems to work as they should. All the new features for the pending release have been merged and shoul

Re: Goal: reduce overall function complexity

2025-05-20 Thread Daniel Stenberg via curl-library
On Wed, 14 May 2025, Dan Fandrich via curl-library wrote: If the current few known-bad offenders are added to a whitelist, it becomes easier to ratchet this number down over time. Here's a first shot that sets the maximum allowed limit to 100, with two functions whitelisted at the moment:

The curl user survey 2025 is up

2025-05-18 Thread Daniel Stenberg via curl-library
Hello! The time has come for you to once again do your curl community duty. Run over and fill in the curl user survey and tell us about how you use curl etc. This is the only proper way we get user feedback on a wide scale so please use this opportunity to tell us what you really think. This

Let's drop Windows CE support

2025-05-18 Thread Daniel Stenberg via curl-library
My proposal: https://github.com/curl/curl/pull/17379 -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.html

Re: Goal: reduce overall function complexity

2025-05-14 Thread Daniel Stenberg via curl-library
On Wed, 14 May 2025, Daniel Stenberg via curl-library wrote: Right now, the top-10 most complex functions in production code according to this tool are (score, filename, line number, function name): 196 src/tool_operate.c(870): config2setopts I forgot to mention that we have a graph in

Re: Goal: reduce overall function complexity

2025-05-14 Thread Daniel Stenberg via curl-library
On Wed, 14 May 2025, Dan Fandrich via curl-library wrote: According to Wikipedia, McCabe suggested a limit of 10 and NIST later suggested some situations where 15 might be appropriate. So, 100 seems like a good starting point! Aggressive! We currently have no less than 326 functions scoring o

Goal: reduce overall function complexity

2025-05-14 Thread Daniel Stenberg via curl-library
Hey, Wouldn't it be cool to set a cap and make a subsequent CI job that turns red if any single function in product code is too complex? As a way to make sure we keep the code clean and readable. I'm thinking this command run on Debian in the source tree: pmccabe `find src lib -name "*.c"`

AI guidelines

2025-05-12 Thread Daniel Stenberg via curl-library
Hey, With the ever increasing AI slop rate in vulnerability reports I figure it was about time to document some kind of project policy on AI use. I need your input! https://github.com/curl/curl/pull/17325 -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.ha

Release candidate 2: curl 8.14.0-rc2

2025-05-11 Thread Daniel Stenberg via curl-library
Hello friends! In preparing for the actual release, rc2 has been uploaded and made available for testing on https://curl.se/rc/. Please consider taking this for a spin and verify that everything seems to work as they should. All the new features for the pending release have been merged and sho

Re: -cacert behaves differently on Windows and Unix. Does this matter?

2025-05-09 Thread Daniel Stenberg via curl-library
On Fri, 9 May 2025, Rod Widdowson via curl-library wrote: Let me start by stating up front that I do not profess to have any expertise in this area. This is just something I noticed while I was spelunking some code and understanding the why's would help me a lot. So if what I am saying is fl

Re: HTTPS RR in curl

2025-05-08 Thread Daniel Stenberg via curl-library
On Thu, 8 May 2025, Niall O'Reilly via curl-library wrote: - https://github.com/niallor/curl/blob/DNS-enhancements/DNS-Issues.md Two more comments: 1) the remarks about CNAME are probably only relevant for DoH? Since when using c-ares or getaddrinfo we don't really know if CNAME is even used

Re: HTTPS RR in curl

2025-05-08 Thread Daniel Stenberg via curl-library
On Thu, 8 May 2025, Niall O'Reilly via curl-library wrote: - https://github.com/niallor/curl/blob/DNS-enhancements/lib/doh.c Remember that we handle HTTPS-RR also without DoH now, so I would imagine most of your changes would end up in httpsrr.c ... -- / daniel.haxx.se || https://rock-sol

Release scheduling

2025-05-07 Thread Daniel Stenberg via curl-library
Hey, I looked in my calendar for the coming releases after 8.14.0 (May 28, 2025) and noticed that I have personal vacation plans exactly when the next one was scheduled to ship. As a result, that one is now moved one week earlier on July 16, 2025, with one week shorter feature window as a re

curlx in curl code

2025-05-07 Thread Daniel Stenberg via curl-library
FYI (The curlx functions are functions that are not part of the libcurl API but is still shared as code from the lib with the tool and tests.) At curl up 2025 we discussed "curlx as a library" and we came down with the conclusion that we should simply move all the curlx_ functions into a subd

curl up 2025 is over

2025-05-05 Thread Daniel Stenberg via curl-library
Hello, Thanks everyone who attended and those who spiced things up by participating in the livestream. Of course an extra thanks to Jim who did most of the organizing. I wrote a short piece about it on my blog: https://daniel.haxx.se/blog/2025/05/06/curl-up-2025-is-over/ Go back to the 20

Release candidate 1: curl 8.14.0-rc1

2025-05-01 Thread Daniel Stenberg via curl-library
Hello friends! As per our new tradition, we have an rc1 build of the coming curl release uploaded and made available for testing on https://curl.se/rc/. Please consider taking this for a spin and verify that everything seems to work as they should. All the new features for the pending release

Feature freeze now

2025-05-01 Thread Daniel Stenberg via curl-library
Hello, Starting now, we are in feature freeze for the pending next release due to ship on May 28, 2025. Feel free to still work on "feature PRs", just realize that they will not be merged into master until the window opens again. Typically that happens ten days after the release. Feature f

Help us out in the curl project!

2025-04-28 Thread Daniel Stenberg via curl-library
Hello friends! What YOU can do to help out in the curl project. Things we would appreciate help and assistance with at the moment. Some things that are current. For general tips on how to get started helping out, start at [1]. ## sponsor One way to greatly help the curl project is to get your

One day shorter feature window

2025-04-27 Thread Daniel Stenberg via curl-library
FYI, Due to curl up this coming weekend, I realized we are better off shortening the feature window by one day. Thus, the feature window closes for this time and 8.14.0-rc1 is relased this Friday (morning). The curl release calendar [1] is updated to reflect this. [1] = https://calendar.go

[PROPOSAL] rc git tag naming

2025-04-25 Thread Daniel Stenberg via curl-library
Hello, At the curl+distro meeting a while back we arrived at the conclusion that having tags set in git for the release candidates would make it easier for some to use them. I propose we name them 'rc-[version]-[num]', where '[version]' is the same style as the normal release tags where dots

Re: HTTPS RR in curl

2025-04-24 Thread Daniel Stenberg via curl-library
On Thu, 24 Apr 2025, Niall O'Reilly via curl-library wrote: I've just built from 29e0a8a09, and can confirm that ECH now works in the cases where I reported it didn't. Excellent. Thanks for fixing and confirming! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lis

Re: ngtcp2 with OpenSSL 3.5?

2025-04-23 Thread Daniel Stenberg via curl-library
On Wed, 23 Apr 2025, Demi Marie Obenour via curl-library wrote: Does libcurl support OpenSSL 3.5+ with ngtcp2? Right now Arch is building with OpenSSL’s QUIC API and I’m wondering if they could move to ngtcp2. This is https://gitlab.archlinux.org/archlinux/packaging/packages/curl/-/issues/12.

Re: drop deprecation markers?

2025-04-22 Thread Daniel Stenberg via curl-library
On Wed, 23 Apr 2025, Patrick Monnerat via curl-library wrote: These typechecks warning outputs get pretty damaged by the deprecation warnings, because they include checks for deprecated options. The initial code did take care of it successfully. What has changed since then? I don't think the

drop deprecation markers?

2025-04-22 Thread Daniel Stenberg via curl-library
Hello team, Someone on IRC pointed out that the typecheck-gcc checks don't work anymore. I could reproduce and I started to fix them. I have a PR pending. These typechecks warning outputs get pretty damaged by the deprecation warnings, because they include checks for deprecated options. Thi

Re: HTTPS RR in curl

2025-04-18 Thread Daniel Stenberg via curl-library
On Fri, 18 Apr 2025, Stephen Farrell via curl-library wrote: I just posted a PR [1] that seems to fix this. Probably good to get @niallor to confirm that it works in his setup too before merging. It was such an obvious fix of a mistake I merged it at once! :-) -- / daniel.haxx.se || https:/

Re: HTTPS RR in curl

2025-04-17 Thread Daniel Stenberg via curl-library
On Thu, 17 Apr 2025, Niall O'Reilly via curl-library wrote: Have I made some silly mistake, or should I open an issue or two? We have no ECH tests in the test suite so it is not unthinkable that we have broken it when we changed the HTTPS-RR logic recently. The HTTPS-RR support itself also

Feature window opens

2025-04-13 Thread Daniel Stenberg via curl-library
Hello friends. No *major* regression has been reported against 8.13.0 so we are hereby opening the feature window today. It is to remain open until May 3rd. If you have a PR ready for merge, feel free to mark me for review so that I don't miss out. Thanks! -- / daniel.haxx.se || https://

Re: framing layer error

2025-04-10 Thread Daniel Stenberg via curl-library
On Wed, 9 Apr 2025, R C via curl-library wrote: curl_easy_perform() failed: Error in the HTTP2 framing layer and...  I have no idea what that means, or how to fix that.  Any ideas? Without a lot of more details I don't think we can do much. This *typically* mean some kind of strange server b

curl distro discussion 2025

2025-04-08 Thread Daniel Stenberg via curl-library
Hello, This is just a quick reminder that we do the curl distro discussion 2025 on April 10, that is Thursday this week. I'll provide a google meet link to use on https://github.com/curl/curl/wiki/curl-distro-discussion-2025 closer to the event. See you then! -- / daniel.haxx.se || http

curl up 2025 registration is open

2025-04-05 Thread Daniel Stenberg via curl-library
Hello I just wanted to let you know that the registration form for curl up 2025 is now live and there's a link from the wiki page: https://github.com/curl/curl-up/wiki/2025 As you can also see on that page, we are slowly starting to get quite a few ideas of what to talk about there... Feel

Release candidate 3: curl 8.13.0-rc3

2025-04-05 Thread Daniel Stenberg via curl-library
Hello friends! Welcome to the third and last 8.13.0 release candidate: rc3. Now only a week left until the actual release. Please try this release candidate in your use cases and products and verify that everything works as intended. Please try the new features and options and verify that the

Re: vsock support

2025-04-04 Thread Daniel Stenberg via curl-library
On Thu, 3 Apr 2025, snek via curl-library wrote: Sorry I think there's been a misunderstanding. vsock sockets are roughly analogous to unix sockets in terms of their supported behavior. Like with unix sockets, curl could act as a client for the various http protocols that it supports. I am run

Re: [RELEASE] curl 8.13.0

2025-04-02 Thread Daniel Stenberg via curl-library
On Wed, 2 Apr 2025, Dagobert Michelsen wrote: I have a regression on Solaris 10 Sparc: It is puzzling that CloseSocket suddenly is deemed fine by configure. I made https://github.com/curl/curl/issues/16915 for it -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://li

Re: [RELEASE] curl 8.13.0

2025-04-02 Thread Daniel Stenberg via curl-library
On Wed, 2 Apr 2025, Dagobert Michelsen wrote: I have a regression on Solaris 10 Sparc: We need more details. For example the relvant details from config.log if you built with configure. -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listin

[RELEASE] curl 8.13.0

2025-04-01 Thread Daniel Stenberg via curl-library
Hello team! Welcome to a new release. Get it as always from https://curl.se/ curl and libcurl 8.13.0 Public curl releases: 266 Command line options: 268 curl_easy_setopt() options: 307 Public functions in libcurl: 96 Contributors: 3378 This release inclu

Re: Undeclared function 'eventfd error in socketpair

2025-04-01 Thread Daniel Stenberg via curl-library
On Tue, 1 Apr 2025, Abhinav Singhal wrote: Daniel, Thanks for the quick response and the fix. I’ll wait for the 8.13 release to test out your fix (as official curl releases are the only ones I’m supposed to work with). It would have been better if you had tested and verified the functionali

HTTPS RR in curl

2025-03-31 Thread Daniel Stenberg via curl-library
Hey, I wrote a short blog post about HTTPS RR in curl: https://daniel.haxx.se/blog/2025/03/31/https-rr-in-curl/ -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.html

Help us out in the curl project!

2025-03-31 Thread Daniel Stenberg via curl-library
Hello! What YOU can do to help out in the curl project. Things we would appreciate help and assistance with at the moment. For general tips on how to get started helping out, start at [4]. ## events Join our upcoming events: - the 2025 curl distro meeting [6] on April 10 - curl up 2025 [7]

Re: Undeclared function 'eventfd error in socketpair

2025-03-30 Thread Daniel Stenberg via curl-library
On Sun, 30 Mar 2025, Abhinav Singhal via curl-library wrote: I currently have curl 8.7 installed (built with openssl) and I’m trying to upgrade to 8.12.1. However, I’m running into the following error: I used your set of configure options and built current git master. I got a slightly differe

should curl_url_get "normalize" URLs?

2025-03-27 Thread Daniel Stenberg via curl-library
Hi team, The curl_url_get man page [3] says it *normalizes* retrieved URLs. Normalizing in this context means that curl would do its best to return a single consistent representation of a URL even if you would provide different variations as input. Normalizing helps apps to for example compa

Re: Some question about CVE-2022-27779

2025-03-25 Thread Daniel Stenberg via curl-library
On Tue, 25 Mar 2025, 陈星杵 via curl-library wrote: Sorry, I expressed myself incorrectly. I mean that the file in the patch was inconsistent with the file in the introduce commit.[1] [2] So let me get this clear: you are saying that the bug was introduced by changing one file and the subsequent

Re: Some question about CVE-2022-27779

2025-03-24 Thread Daniel Stenberg via curl-library
On Mon, 24 Mar 2025, 陈星杵 via curl-library wrote: I hope this email finds you well. I apologize for the interruption, but I recently noticed that the CURL website provides both the commit that introduced CVE-2022-27779[1] and the corresponding patch. However, the MD5 checksums of the modified f

Release candidate 2: curl 8.13.0-rc2

2025-03-17 Thread Daniel Stenberg via curl-library
Hello friends! Welcome to the second 8.13.0 release candidate: rc2. Please try this release candidate in your use cases and products and verify that everything works as intended. Please try the new features and options and verify that they work the way they are documented, and maybe also the wa

Re: How should I edit my programm to provide successfull execution of my request to the private server

2025-03-11 Thread Daniel Stenberg via curl-library
On Tue, 11 Mar 2025, Владислав Коробов via curl-library wrote: curl -k -X GET -H 'Authorization: Bearer nokey'   https://:/api/ccu/online Drop "-X GET" there and you get a better command line: See https://daniel.haxx.se/blog/2015/09/11/unnecessary-use-of-curl-x/ Then, an easy way to convert

Release candidate 1: curl 8.13.0-rc1

2025-03-08 Thread Daniel Stenberg via curl-library
Hello friends! Welcome to the first 8.13.0 release candidate: rc1. Today is the first day of the feature freeze, meaning that all changes and new features that are introduced in the pending release have been merged already and should work. Please try this release candidate in your use cases and

Feature freeze starting now

2025-03-08 Thread Daniel Stenberg via curl-library
Hello team, The feature window is closed, feature freeze is entered. We now only merge bugfixes until the pending next release. curl 8.13.0 is planned to ship on April 2. -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library E

Re: Some question about vulnerability

2025-03-06 Thread Daniel Stenberg via curl-library
On Fri, 7 Mar 2025, 陈星杵 via curl-library wrote: regarding CVE-2022-43551[2], you mentioned that earlier versions might not be vulnerable due to HSTS feature was not enabled by default and was labled as experimental. So I'm wondering what the significance of doing this work is. For the reason,

Re: Release Candidates - was Help us out in the curl project

2025-02-28 Thread Daniel Stenberg via curl-library
On Fri, 28 Feb 2025, Daniel Stenberg via curl-library wrote: I made an image illustrating the release cycle with the release candiates added: ... and described with some more words on my blog: https://daniel.haxx.se/blog/2025/02/28/adding-curl-release-candidates/ -- / daniel.haxx.se

Re: Release Candidates - was Help us out in the curl project

2025-02-28 Thread Daniel Stenberg via curl-library
On Sun, 9 Feb 2025, Daniel Stenberg via curl-library wrote: I'm not going to overwork this, so the release candidates are simply going to be named x.y.x-rcN. A curl 1.2.3-rc2 release is then going to look like this After some more thinking I believe going with three release candidates

Re: Not always using CURLOPT_CUSTOMREQUEST on redirects

2025-02-27 Thread Daniel Stenberg via curl-library
On Tue, 25 Feb 2025, Daniel Stenberg via curl-library wrote: I propose [1] we add a way to change this: by adding a second bit for CURLOPT_FOLLOWLOCATION called CURLFOLLOW_OBEYCODE. It instructs libcurl that the response code should be adhered rather than ignored when following redirects

Not always using CURLOPT_CUSTOMREQUEST on redirects

2025-02-25 Thread Daniel Stenberg via curl-library
Hey, One of the longest running problems with using CURLOPT_CUSTOMREQUEST + CURLOPT_FOLLOWLOCATION has been the fact that the custom method is set for *all* subsequent requests even on redirects, independently of the specific response code that is returned. Because that's how it was once done

roadmap 2025

2025-02-25 Thread Daniel Stenberg via curl-library
FYI, Next week I'll do a short talk about what I want to see in curl over the coming year. https://daniel.haxx.se/blog/2025/02/25/the-curl-roadmap-webinar-2025/ -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette

Feature window: OPEN

2025-02-22 Thread Daniel Stenberg via curl-library
Hello, As of now, the fature window is open for the next two weeks. One week shorten than normal. If you have a PR pending for merge and you think it is ready, please make sure there is no merge conflicts and feel free to mark me for review. The window closes again on March 8, when we will

Re: HTTPS RR side of things

2025-02-22 Thread Daniel Stenberg via curl-library
On Fri, 21 Feb 2025, Ryan Carsten Schmidt wrote: A compatibility implementation of res_nquery is in gnulib, in case that is palatable: https://www.gnu.org/software/gnulib/manual/html_node/res_005fnquery.html Thanks, but I don't think that's a very attractive route for us: - it is GPL licens

curl-distros meeting 2025?

2025-02-22 Thread Daniel Stenberg via curl-library
Hello! In March 2024 we had an online curl distro meeting [1]. From my personal point of view I think it was productive and I got the impression we all improved curl in distros a little bit thanks to this. I want to propose that we do it again [2]. A two hour online meeting with just a set o

Re: HTTPS RR side of things

2025-02-21 Thread Daniel Stenberg via curl-library
On Fri, 21 Feb 2025, Niall O'Reilly wrote: I wonder whether you've considered res_nquery(), the non-blocking successor to res_query()? I see it in glibc; I haven't looked in Apple or BSD land. Building without having to install an extra package (such as c-ares) might be attractive. Perhaps th

Re: HTTPS RR side of things

2025-02-21 Thread Daniel Stenberg via curl-library
On Thu, 20 Feb 2025, Niall O'Reilly wrote: Goal: design data structure and related APIs for making HTTPS/SVCB data, as well as what getaddrinfo() provides, available, as simply as possible, to an application. Additionally: since getaddrinfo() is such a beast to replace reliably, curl will co

Re: HTTPS RR side of things

2025-02-20 Thread Daniel Stenberg via curl-library
On Thu, 20 Feb 2025, Niall O'Reilly wrote: Possible name: getBETTERinfo Goal: design data structure and related APIs for making HTTPS/SVCB data, as well as what getaddrinfo() provides, available, as simply as possible, to an application. Isn't this pretty much what is already being attempte

curl up 2025 talks

2025-02-20 Thread Daniel Stenberg via curl-library
Hellom We have started to add talks/sessions for curl up 2025. We would love to see more names represented in the list. We would love more voices and opinions. We would love newcomers as well as old users. We all benefit from getting more angles and more aspects brought forward. We are alway

Re: Shipping wcurl in curl tarballs?

2025-02-18 Thread Daniel Stenberg via curl-library
On Sun, 9 Feb 2025, Samuel Henrique via curl-library wrote: I would like to understand where you stand on the idea of shipping wcurl bundled in the curl release tarball. As wcurl is a small and simple script that is not expected to change rapidly, it would be a no-brainer to just add it to th

Re: CLOSESOCKETFUNCTION not always called in multi

2025-02-18 Thread Daniel Stenberg via curl-library
On Tue, 18 Feb 2025, Malcolm Matalka via curl-library wrote: After this thread I talked to Daniel and your analysis is exactly correct. These are other sockets that the multi interface is working with, not sockets associated with an handle. One solution is to "--disable-socketpair", as you sa

  1   2   3   4   5   6   7   8   9   10   >