`pccritic` is available on the latest macOS runner revision (not every
job runs get it yet), Cygwin, MSYS2/mingw-w64 (one job, others will
follow on the next msys2/setup-msys2 Action bump). It will be
automatically used on BSDs, once they start offering it. Missing from
Linux jobs.
Also:
- GHA/windows: convert `libcurl.pc` to Unix newlines to bump score
96 to 100 in mingw-w64 jobs.
CMake-specific fix pending in: #22556
- GHA: verify with minimum `pccritic` score 94 to 100 (depending on CI
job).
- build: fill `Maintainer:` `libcurl.pc` property when run curl CI.
Issues remaining:
macOS:
```
[info ] Cflags adds an include path already on the default search path (pkgconf strips it): -I/usr/local/include (cflags/PC031)
[info ] Libs adds a library path already on the default search path (pkgconf strips it): -L/usr/local/lib (libs/PC040)
[minor ] Libs.private contains an unexpected flag: /Applications/Xcode_26.6.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.5.sdk/System/Library/Frameworks/GSS.framework (libs/PC041)
```
Windows:
```
[minor ] file uses CRLF line endings (style/PC061)
```
Ref: #22556
Follow-up to b9254da617#22548
Follow-up to 852f5d34da#22553
Follow-up to 4d9ba9fef4#22545
Follow-up to 6c7993d4d9#22536
Follow-up to 3f1c033afe#22519Closes#22543
To keep it tidy and to support properties in the template that only
appear in the generated `libcurl.pc` when filled.
E.g. `Required.private` may remain empty after #22548.
Also:
- GHA/windows: dump `libcurl.pc` to log in every job
- tidy up a pre-existing regex in the updated command.
2c22d3069a#22544
Ref: b9254da617#22548
Cherry-picked from #22543Closes#22553
Before this patch static-only libcurl builds stored the list of module
dependencies in both `Require` and `Require.private`. The new `pccritic`
tool flagged this as an issue. Having (or not) a duplicate in
`Require.private` does not change the output created by `pkgconf` and
`pkg-config`, as tested with both with and without `--static` option.
Thus, fix by deleting the private copy.
Fixing:
```
$ pccritic libcurl.pc
bld/libcurl.pc
score: 63/100 grade: D (0 critical, 0 major, 9 minor, 1 info)
[minor ] 'libssh2' appears in both Requires and Requires.private (requires/PC051)
[minor ] 'libidn2' appears in both Requires and Requires.private (requires/PC051)
[minor ] 'openssl' appears in both Requires and Requires.private (requires/PC051)
[...]
```
Ref: https://github.com/curl/curl/actions/runs/31495008715/job/93790403026#step:10:210 (macOS, CM clang OpenSSL torture)
Ref: https://github.com/curl/curl/actions/runs/31495008825/job/93790433646#step:9:216 (mingw, AM ucrt-x86_64 wolfssl c-ares U)
Follow-up to f057de5a1a#13911
Follow-up to 98e5904165#5373
Cherry-picked from #22543Closes#22548
curl already built like this in UWP mode; add a macro to allow building
regular Win32 targets too, meaning without the hidden GUI window, window
handler, and thus without support for shutting down `servers.exe`
gracefully. To test the server in CI as a plain console app and remove
one component/variable from the system, in an effort chasing flaky runs.
The graceful option was used by `taskkill` (without `-f`) in runtests,
and it has been disabled (in favor of always `-f` (forced) kill), in an
attempt to avoid taskkill hanging. Those resolved, but general CI
flakiness remained. We see `taskkill` invoked seldom per job, and in
most of these cases it doesn't find the PID requested. It means the
graceful option is not actually used since 2025-04, and rather rarely
before that. Also just today, the callback and main loop received a few
updates to avoid potentially unsafe calls and interaction with the ctrl
handler.
Not expecting anything breakthrough here. Also graceful shutdown
is a useful feature to cleanup properly and to be in sync with other
platforms.
Also: GHA/windows: enable in Windows CI jobs.
Ref: https://learn.microsoft.com/windows/console/registering-a-control-handler-function#listen-with-hidden-window-example
Follow-up to 7db9947fcf#22045
Follow-up to 9ea48811fe#22487
Follow-up to b11e0026f7#22495
Follow-up to 208b87744e#21039
Follow-up to f450f3801b#19897
Follow-up to 2701ac6a4d#19421
Follow-up to 4e203f65a1#17054Closes#22496
Replace the `timeoutlist` and time nodes for expire timers with `struct
expire_timers` that keeps a time and next array.
There is only ever one timeout per timer id and a fully dynamic list is
not needed. Do the sorting by keeping an array of 'next' indiced and a
'first' starting point.
Added tracking of splay tree status.
Fixed missing splay removal when last timeout was removed via
Curl_expire_done().
Closes#22473
- CMAKE_INSTALL.md: sync up option desc with `CMakeLists.txt`.
- sync `--enable-debug` configure text with help description.
- say `--disable-debug` is the default in help description.
Follow-up to a15cf1ea07#22512Closes#22532
To prevent creating a curl-development (aka debug-enabled, aka
`-DENABLE_DEBUG=ON`, `--enable-debug` or `DEBUGBUILD`) build without
`assert()`s. Since it may break expectations by missing to catch error
cases. Also to make it less likely to build an inherently insecure
development build by accident.
- in CMake, for non-Multi-Config builds, show this error unless Debug
configuration is set at configure-time:
```
CMake Error at CMakeLists.txt:263 (message):
Debug-enabled (aka development mode) curl requires the Debug configuration
```
Ref: https://github.com/curl/curl/actions/runs/31159065911/job/92805128331?pr=22513#step:6:56
The other 3 predefined configs (`Release`, `RelWithDebInfo`,
`MinSizeRel`) set `NDEBUG` automatically.
- or this message in other cases, e.g. when using CMake Multi-Config
with non-Debug, e.g. `--config Release`, or passed `NDEBUG` manually
with either build tools:
```
curl_setup.h(1062): fatal error C1189: #error:
"Debug-enabled builds cannot be combined with NDEBUG"
```
Ref: https://github.com/curl/curl/actions/runs/31159628749/job/92807878479#step:9:28
Also:
- INSTALL-CMAKE.md: document.
- GHA/windows: adjust CI jobs to meet the above requirement, where
missing.
Reported-by Stefan Eissing
Bug: https://github.com/curl/curl/pull/22484#discussion_r3730045572
Ref: ea98445680#13592Fixes#22481Fixes#22484Closes#22513
- decode results when individual requests are done
- makes happy eyeballing start asap
- remove doh_resp structures as no longer needed
- remove CURL_DNS_TYPE_NS, CURL_DNS_TYPE_CNAME and
CURL_DNS_TYPE_DNAME from DoH
- DoH: do not set PIPEWAIT and SSL OPTS when url starts with http:
- mark Doh master handle as dirty after every sub-request, not only the last
- Doh: start probe on AAAA before A (was the other way).
cf-dns: set EXPIRE_HAPPY_EYEBALLS timer when waiting 50ms on AAAA
result or progress will not be triggered in time.
Add debug env var CURL_DBG_HE_AAAA_AWAIT_MS to override the
default 50ms on waiting for the AAAA result to arrive.
test2100: set CURL_DBG_HE_AAAA_AWAIT_MS to 60 seconds to
provide enough time for slow CI runs to sent all DoH requests.
closes#22514
The filter only leaves comments and strings in all files using .c or .h
extensions.
It is important that the filter runs after all the other checks are done
on these files as this process destroys the files.
Fixes#22508Closes#22509
Link.ABI is a feature of pkgconf 3.0 and indicates the ABI against which
a consumer must link the package. For libcurl, this is hard-coded as C.
Source is a URL from which to download the package tarball.
Closes#22519
- Use %hu for unsigned short instead of %u.
Prior to this change some compilers could warn of an argument type
mismatch. C argument promotion rules promote the unsigned short argument
to an int, which does not match %u (unsigned int) but does match %hu
(unsigned short).
Assisted-by: Viktor Szakats
Closes https://github.com/curl/curl/pull/22511
- Change --enable-debug help text to say it is for developing curl.
- Warn when --enable-debug is used.
This change copies the help text and warning from cmake ENABLE_DEBUG.
Also, it shortens the "for debugging curl itself" to just say "for
debugging curl".
Now it looks like this:
--enable-debug Enable curl debug features (for developing
curl)
--disable-debug Disable curl debug features
Ref: https://github.com/curl/curl/issues/22481#issuecomment-5207220359
Reported-by: Viktor Szakats
Closes https://github.com/curl/curl/pull/22512
dnsd now opens UDP+TCP sockets and accepts http: DoH requests to obtain
the same, configured answers (records, delays, error codes) as over UDP.
DoH: use `async->queries_ongoing` like all other resolvers instead of
the internal `pending` counter. Fixes waiting for results.
Tests: in pytest, parameterize dnsd tests to use both DNS and DoH.
Closes#22506
And drop:
- Consider OCSP stapling by default
It is a practice that is going out-of-style, so doing this by default now
seems wrong.
- Provide callback for cert verification
We have lots of options already. Let's not do this.
Closes#22504
- convert the method switch() to a simple table
- avoid converting the methods from external to internal numbers, they were
the same anyway so keep the external ones, just use the old defines.
- fix range check. It wrongly used the method numbers as bitmask, which made
the check not work previously. Also error on OOM.
- Dropped the session-id check. It too wrongly did a bitmask check which was
wrong and never worked. When fixed, it broke test cases so I dropped the
entire check.
- split out rtsp_setup_request() from rtsp_do()
- replace the httpversion variable with a define
Closes#22505
- makes test names less complicated
- makes them less likely to wrap lines when using narrow terminals
- runtests now returns error for the test if the name is longer
- replace the "..." with a singe space
Closes#22492
On Windows, the init code calls `SetConsoleCtrlHandler()`, and before
this patch also set handlers for all Unixy signals. Of these, `SIGBREAK`
(used on Windows-only), `SIGINT`, `SIGABRT` and `SIGTERM` were also
setting up a `SetConsoleCtrlHandler()`, in addition to the call made
directly. (The rest, `SIGHUP`, `SIGPIPE`, `SIGALRM` are either missing
the macros, or ignored by `signal()` on Windows.)
As per WINE sources, `SetConsolCtrlHandler(<h>, TRUE)` calls are
additive, which means the test server set up two console ctrl handlers.
Then the ctrl handler set directly (`ctrl_event_handler()`), was
triggering the other signal handler via `raise()`, for the 'initiate
exit' logic, which in turn triggered exiting a wait within `select_ws()`
and other loops. The Windows window handler also made use of the
`SIGTERM` event to initiate exit via `raise()` and the second signal
handler.
To simplify, de-duplicate the ctrl handlers by dropping `signal()` calls
and keeping the direct Win32 call with `ctrl_event_handler()` doing all
the signal handling on Windows. Break out the 'initiate exit' logic into
a function and call it from both Unix and Windows signal/ctrl/window
handlers. Also drop calling `raise()` on exit, because it's a no-op
without a `signal()` pair.
Also:
- drop logging the actual ctrl type number, replace with just logging
whether we handled the event, in `ctrl_event_handler()`. To avoid
using non-signal-safe functions (e.g. `fprintf()`) from the handler.
- also replace `logmsg()` with `WriteFile()` to prevent regressions.
Ref: #22045
- replace `logmsg()` with `WriteFile()` in `main_window_proc()`.
- fix to forward ctrl handling to the OS in the rare case of failed
`exit_event` initialization on startup. To swap a possible hang
(within `WaitForMultipleObjectsEx()`) with an ungraceful shutdown.
- add support for an 'exit message' string, set by signal/ctrl handlers,
and log it on app exit. To avoid the need to deal with logging within
the handlers, yet have a static trace message about the event.
Complementing the already logged signal number.
- drop stderr trace message from `exit_signal_handler()` in favor of an
exit message. runtests triggers it frequantly, which added much noise
to stderr. As a bonus, this also allows dropping the compiler warning
suppression.
Reported-by: Stefan Eissing
Bug: https://github.com/curl/curl/pull/22487#issuecomment-5204092974
Follow-up to 3aae64e4fb#22507
Refs:
https://learn.microsoft.com/windows/console/setconsolectrlhandlerhttps://learn.microsoft.com/windows/console/registering-a-control-handler-functionhttps://learn.microsoft.com/cpp/c-runtime-library/reference/raisehttps://learn.microsoft.com/cpp/c-runtime-library/reference/signalhttps://gitlab.winehq.org/wine/wine/-/blob/wine-11.14/dlls/kernelbase/console.c#L1517-1526d6e817a4cc/misc/signal.cpp (L286-L348)
Follow-up to fe28fcf04c7dc8a981fa0e058776c0#5260Closes#22487
In year 2020 the Unixy signal handler received a `logmsg()` call to log
the signal number, but at the same time it already saved it to a global
variable and logged it on exit, meaning this extra `logmsg()` was
redundant. Because `logmsg()` is not signal-safe, this call was replaced
in 2025 with signal-safe logging, but without the signal number, while
also adding complexity, spent on trying to open the log file and handle
errors. All for nothing, because the signal number was logged all along.
This patch removes all this, and simplifies it to a single, signal-safe
`write()` to STDERR to say that the signal handler triggered. This is
also non-critical, but may help debugging.
Also: point the POSIX documentation to the 2004 revision, which has a
shorter list of safe functions. (was: 2018)
Follow-up to e95f509c66#16852
Follow-up to 9869f6dc5a#5218Closes#22507
To share more common code between servers, and to log the same set of
information for all of them.
Also:
- move server unix socket to global variable.
Follow-up to d1eca3861c#22501
Follow-up to 1637bbc9ce#22498Closes#22503
To sync with the rest of code which already handled `got_exit_signal`
and did the restoration on exit. Also syncing with rest of servers.
Also: turn off `keep_sigalrm` to sync with most servers.
Closes#22499
Replace `ipv_inuse` and `use_ipv6` with `socket_type` and
`socket_domain` (where missing) to avoid dupliicate globals with
overlapping purposes. The replacement variables also support Unix
sockets.
Also:
- simplify/reduce IPv6 guards.
- socksd: fix to reset `socket_domain` for `--ipv4` option.
Closes#22498
