romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 07:33:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

metalink: remove

Browse source 
Warning: this will make existing curl command lines that use metalink to
stop working.

Reasons for removal:

1. We've found several security problems and issues involving the
   metalink support in curl. The issues are not detailed here. When
   working on those, it become apparent to the team that several of the
   problems are due to the system design, metalink library API and what
   the metalink RFC says. They are very hard to fix on the curl side
   only.

2. The metalink usage with curl was only very briefly documented and was
   not following the "normal" curl usage pattern in several ways, making
   it surprising and non-intuitive which could lead to further security
   issues.

3. The metalink library was last updated 6 years ago and wasn't so
   active the years before that either. An unmaintained library means
   there's a security problem waiting to happen. This is probably reason
   enough.

4. Metalink requires an XML parsing library, which is complex code (even
   the smaller alternatives) and to this day often gets security
   updates.

5. Metalink is not a widely used curl feature. In the 2020 curl user
   survey, only 1.4% of the responders said that they'd are using it. In
   2021 that number was 1.2%. Searching the web also show very few
   traces of it being used, even with other tools.

6. The torrent format and associated technology clearly won for
   downloading large files from multiple sources in parallel.

Cloes #7176
This commit is contained in:
Daniel Stenberg 2021-06-01 16:24:00 +02:00
parent 9cf516adc6
commit 265b14d6b3
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
48 changed files with 65 additions and 3154 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/Makefile.netware
View file

@ -6,7 +6,7 @@
# \___|\___/|_| \_\_____|
#
# Copyright (C) 2004 - 2014, Guenter Knauf
# Copyright (C) 2001 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
# Copyright (C) 2001 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
#
# This software is licensed as described in the file COPYING, which
# you should have received as part of this distribution. The terms
@ -69,11 +69,6 @@ ifndef FBOPENSSL_PATH
FBOPENSSL_PATH = ../../fbopenssl-0.4
endif
# Edit the path below to point to the base of your libmetalink package.
ifndef LIBMETALINK_PATH
LIBMETALINK_PATH = ../../libmetalink-0.1.2
endif
# Edit the path below to point to the base of your libexpat package.
ifndef LIBEXPAT_PATH
LIBEXPAT_PATH = ../../expat-2.1.0
@ -243,10 +238,6 @@ endif
ifeq ($(findstring -idn,$(CFG)),-idn)
WITH_IDN = 1
endif
ifeq ($(findstring -metalink,$(CFG)),-metalink)
WITH_METALINK = 1
WITH_SSL = 1
endif
ifeq ($(findstring -nghttp2,$(CFG)),-nghttp2)
WITH_NGHTTP2 = 1
endif
@ -301,25 +292,6 @@ ifdef WITH_NGHTTP2
INCLUDES += -I$(NGHTTP2_PATH)/include
LDLIBS += $(NGHTTP2_PATH)/lib/libnghttp2.$(LIBEXT)
endif
ifdef WITH_METALINK
CFLAGS += -DUSE_METALINK
INCLUDES += -I$(OPENSSL_PATH)/outinc_nw_$(LIBARCH_L)
INCLUDES += -I$(LIBMETALINK_PATH)/include
LDLIBS += $(LIBMETALINK_PATH)/lib/libmetalink.$(LIBEXT)
ifdef WITH_LIBEXPAT
ifeq ($(LIBARCH),LIBC)
IMPORTS += @$(LIBEXPAT_PATH)/imports/expatlbc.imp
MODULES += expatlbc
else
IMPORTS += @$(LIBEXPAT_PATH)/imports/expatlib.imp
MODULES += expatlib
endif
else
ifdef WITH_LIBXML2
IMPORTS += @$(LIBXML2_PATH)/lib/libxml2.imp
MODULES += libxml2
endif
endif
endif
ifeq ($(LIBARCH),LIBC)