- drop redundant casts for `CURL_UNCONST()` pointers (Windows).
- GHA/linux: delete redundant/dupe `-g` C flag in memory sanitizer job.
Spotted-by: Daniel Stenberg
- examples/http2-upload: drop local macro.
- examples/http2-upload: drop leading underscore from union name.
- examples/http2-upload: drop interim macro.
- tests/server/util: reapply patch lost in a rebase.
- sync `main()` declarations across the codebase.
Closes#22559
`pccritic` is available on the latest macOS runner revision (not every
job runs get it yet), Cygwin, MSYS2/mingw-w64 (one job, others will
follow on the next msys2/setup-msys2 Action bump). It will be
automatically used on BSDs, once they start offering it. Missing from
Linux jobs.
Also:
- GHA/windows: convert `libcurl.pc` to Unix newlines to bump score
96 to 100 in mingw-w64 jobs.
CMake-specific fix pending in: #22556
- GHA: verify with minimum `pccritic` score 94 to 100 (depending on CI
job).
- build: fill `Maintainer:` `libcurl.pc` property when run curl CI.
Issues remaining:
macOS:
```
[info ] Cflags adds an include path already on the default search path (pkgconf strips it): -I/usr/local/include (cflags/PC031)
[info ] Libs adds a library path already on the default search path (pkgconf strips it): -L/usr/local/lib (libs/PC040)
[minor ] Libs.private contains an unexpected flag: /Applications/Xcode_26.6.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.5.sdk/System/Library/Frameworks/GSS.framework (libs/PC041)
```
Windows:
```
[minor ] file uses CRLF line endings (style/PC061)
```
Ref: #22556
Follow-up to b9254da617#22548
Follow-up to 852f5d34da#22553
Follow-up to 4d9ba9fef4#22545
Follow-up to 6c7993d4d9#22536
Follow-up to 3f1c033afe#22519Closes#22543
- update `actions/checkout` from 7.0.0 to 7.0.1
- update `actions/labeler` from 6.1.0 to 7.0.0
- update `github/codeql-action/analyze` from 4.36.2 to 4.37.3
- update `github/codeql-action/init` from 4.36.2 to 4.37.3
- update `cryptography` from 48.0.1 to 49.0.0
- update `filelock` from 3.29.0 to 3.32.0
- update `impacket` from 0.13.0 to 0.13.1
- update `pytest` from 9.0.3 to 9.1.1
- update `websockets` from 16.0 to 16.1.1
Closes#22458Closes#22459
Detected by torture tests:
```
test 5004...[HTTP RFC 9421 B.2.6: Ed25519 POST with headers (RFC test vector)]
105 functions found, but only fail 25 (23.81%)
** MEMORY FAILURE
Leak detected: memory still allocated: 99 bytes
At 6000022c9408, there is 36 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000039c8e78, there is 31 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:87
At 6000037dd688, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
At 6000037dd628, there is 16 bytes.
allocated by /Users/runner/work/curl/curl/lib/slist.c:62
LIMIT /Users/runner/work/curl/curl/lib/slist.c:62 malloc reached memlimit
5004: torture FAILED: function number 10 in test.
```
Ref: https://github.com/curl/curl/actions/runs/30497660391/job/90730128599?pr=22437#step:16:2331
Also:
- enable HTTPSIG in torture tests.
- NULL check all `curl_slist_append()` results.
- apply a NULL check to sibling test 5000 also.
Co-authored-by: Daniel Stenberg
Follow-up to a55731050e#22386#21239Closes#22437
Show a warning and force-disable HTTPSIG when the TLS backend is not
OpenSSL or wolfSSL. Before this patch this resulted in a mismatched
feature list in configure and `curl -V`.
Also enable HTTPSIG in more CI jobs to cover unsupported ones, Windows
compilers, clang-tidy, cmake.
Follow-up to a55731050e#22386#21239
Cherry-picked from #22437Closes#22439
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes#22386Closes#21239
Note: Renovate strips pre-existing quotes from the YAML version value.
This breaks the bump next time its version is ending with zero(s).
Ref: 78267398e5#22143#22142Closes#22267
- updates `actions/cache` from 5.0.5 to 6.1.0
- updates `actions/checkout` from 6.0.2 to 7.0.0
- updates `github/codeql-action/analyze` from 4.36.0 to 4.36.2
- updates `github/codeql-action/init` from 4.36.0 to 4.36.2
- updates `msys2/setup-msys2` from 2.31.1 to 2.32.0
Closes#22239
In jobs that may benefit from newer tool versions (pyspelling, possibly
CodeQL, CM integration, configure-vs-cmake). Also curl-for-win to match
the curl/curl-for-win repo that also bumped. Bump some Linux jobs to add
variation. Also the rest of `check*` jobs for no particular reason other
than using the latest.
Follow-up to 8f5e4f020e#22097
Follow-up to 139ce4d37c#22096
Follow-up to e44f1a1446#22094Closes#22092
py3-impacket, py3-asn1, py3-six and py3-pycryptodomex.
Number of tests run remain 1848 / 1847 for the two jobs respectively.
Number of installed packages go from 158 to 117, and from 177 to 142
(for the two jobs respectively; using different Alpine versions).
Closes#22153
Also put the version number in quotes to avoid GHA altering the number
into `0.68` (without rightmost zero) and ending up storing that in the
`FIL_C_VERSION` env.
Hopefully Renovate will honor this on future bumps.
Do the same for the rest of `x.y` format version numbers.
Fixing:
```
env:
[...]
FIL_C_VERSION: 0.68
```
Ref: https://github.com/curl/curl/actions/runs/28006009260/job/82920767558?pr=22142#step:5:16Fixes#22142Closes#22143
Before this patch it broke clang 20/21 cmake builds on ubuntu-26.04-arm
runner, failing at the beginning of the configure stage while probing
the compiler.
Seen in the 'CM openssl clang krb5 LTO' job:
```
: && /usr/bin/clang --target=aarch64-pc-linux-gnu CMakeFiles/cmTC_3d9ae.dir/testCCompiler.c.o -o cmTC_3d9ae && :
/usr/bin/aarch64-linux-gnu-ld.bfd: cannot find crtbeginS.o: No such file or directory
/usr/bin/aarch64-linux-gnu-ld.bfd: cannot find -lgcc: No such file or directory
/usr/bin/aarch64-linux-gnu-ld.bfd: cannot find -lgcc_s: No such file or directory
```
Ref: https://github.com/curl/curl/actions/runs/27778098314/job/82195462687#step:38:66
Follow-up to 36bd807475#15242
Follow-up to 232302f88a#14382
Cherry-picked from #22092Closes#22097
Issue had been fixed in the ubuntu-24.04-arm runner image upstream.
now:
```
$ ls -l /home # on arm
drwxr-x--- 11 runner runner 4096 Jun 18 08:19 runner
$ ls -l /home # on intel
drwxr-x--- 11 runner runner 4096 Jun 18 08:19 runner
```
Follow-up to 2b0d8dcc16#20231Closes#22076
3 minutes (was: 2).
IIn the hope it fixes timeouts, assuming the Ubuntu mirrors are only
somewhat slower sometimes (and not completely stalled).
Closes#22068
Whether the install is extreme slow and will fail anyway, or only slower
sometimes, and this fixes, we will see.
Example:
```
Need to get 1159 MB of archives.
After this operation, 4463 MB of additional disk space will be used.
Get:1 https://apt.repos.intel.com/oneapi all/main all intel-oneapi-common-licensing-2023.2.0 all 2023.2.0-49462 [30.4 kB]
Get:2 https://apt.repos.intel.com/oneapi all/main all intel-oneapi-common-licensing-2026.0 all 2026.0.0-235 [30.7 kB]
[...]
Get:21 https://apt.repos.intel.com/oneapi all/main amd64 intel-oneapi-dpcpp-debugger-2023.2.0 amd64 2023.2.0-49330 [201 MB]
Error: The action 'install Intel compilers' has timed out after 2 minutes.
```
Ref: https://github.com/curl/curl/actions/runs/27683923870/job/81877924590
Follow-up to 50ff4f2927#21414Closes#22065
Also:
- GHA/http3-linux: enable deprecated APIs in openssl-prev local
OpenSSL builds. Required by h2o and its vendored dependencies.
Tried OpenSSL 4, LibreSSL 4.x, BoringSSL: all failed at one point.
- GHA/http3-linux: build h2o from source.
libuv1-dev may not be stricly required.
Tried installing libwslay-dev, but it wasn't recognized.
Also disable building h2o libs for a much smaller dist directory and
slightly faster build.
Sadly, h2o is not versioned, so I pinned to the current latest commit
at the master branch. It advertises itself as 2.3.0-DEV in pytest.
- drop redundant `libnghttp3` installs. Remains of openssl-quic builds.
Follow-up to 6aaac9dd38#20226
Note GHA/macos pytests may or not not be stable with the H3 proxy tests.
Follow-up to e78b1b3ecc#21153Closes#21789
- fix macOS locale tests to clear existing variables.
(Without this, the system-defined `LC_ALL` takes precedence, and
the custom envs in CI are ignored.)
- trigger test 1981 issue by setting `LC_TIME` to non-English, on macOS.
(On Linux it'd require explicitly installing a non-English locale, I
skipped this for simplicity.)
```
[...]
-Time: 01/Aug/2025 08:31:43.037103 +0000 UTC[CR][LF]
+Time: 01/ao%c3%bb/2025 08:31:43.037103 +0000 UTC[CR][LF]
[...]
FAIL 1981: '%time output with --write-out' HTTP, HTTP GET
```
Follow-up to 90a7732d46#21749
Follow-up to 1cc8a5235f#17988
Follow-up to c221c0ee59#17938Closes#21753
Also switch back to ftp.openbsd.org download server. More often than not
the GitHub release entry is missing the download artifacts at the time
of detecting a new version, breaking automatic bumps. We cache the
download so it does not bang the origin server with many requests.
Follow-up to 800b0bec18#19082Closes#21742Closes#21754
Also fix fallouts found.
Windows clang-tidy CI job is a little pickier than I'd prefer due to the
`_CURL_TESTS_CONCAT=ON` option used there, and all macros considered
local, thus checked by the compiler. Upside: it revealed macro usage
dynamics in tests. If too annoying, `first.h` may be opted-out from the
concat logic. Some macros may also be deleted instead of `#if 0`-ing.
Follow-up to e0e56e9ae4#21550
Follow-up to 5fa5cb3825#20593Closes#21554
