Commit graph

808 commits

Author SHA1 Message Date
Viktor Szakats
91e06fde1b
cmake: fix building with CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON
This CMake global custom option tells it to find dependencies as cmake
Configs first, and only then look for `Find*` modules. This may result
in `find_package()` succeeding, but without actually creating `CURL::*`
imported targets the curl build scripts are expecting.

For dependencies with curl-specific, local, `Find*` modules, we always
want to use them, via the module detection method, and never a
Config-based detection. Ensure this by passing the `MODULE` option to
`find_package()` and `find_dependency()` to make them use `Find*`
modules unconditionally, making them work as expected with the
`CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON` option set.

curl uses local Find modules for all dependencies except OpenSSL and
ZLIB. The latter two keep using either CMake's built-in Find modules or
Config method as before this patch.

Also:

- apply the same change to `curl-config.cmake`. To fix consuming curl
  with this option set.
  Authored-by: Valerie Snyder
  Ref: #20764
  Follow-up to 16f073ef49 #16973

- GHA/distcheck: add a job testing both building and consuming curl with
  this option set. (takes 15 seconds)
  Use custom NGHTTP2 configuration for an extra twist (not required
  to trigger this issue.)
  Follow-up to fcde8d7e37 #20773

Reported-by: Valerie Snyder
Fixes #20729

Closes #20784
2026-03-03 16:33:21 +01:00
Viktor Szakats
d557c06b52
build: drop unused snprintf() feature check on Windows
Follow-up to 64f28b8f88 #20765

Closes #20790
2026-03-02 22:40:29 +01:00
Viktor Szakats
9d727e4e55
cmake: replace list(FIND) with if(var IN_LIST list)
Available since CMake v3.3.

Ref: https://cmake.org/cmake/help/latest/command/if.html#in-list

Closes #20758
2026-02-27 14:08:59 +01:00
Viktor Szakats
b56e103d4d
build: do not include wolfSSL header in curl_setup.h
To fix building tests/server with cmake and both wolfSSL and OpenSSL
enabled (MultiSSL).

tests/server do not have libcurl dependency header paths setup because
it does not use libcurl. The code however includes `curl_setup.h`, which
tried including `wolfssl/version.h` before this patch to verify if the
wolfSSL coexist feature is available. Without a header path, it failed:
```
In file included from bld/tests/server/servers.c:3:
In file included from tests/server/first.h:40:
lib/curl_setup.h:737:12: fatal error: 'wolfssl/version.h' file not found
  737 | #  include <wolfssl/version.h>
      |            ^~~~~~~~~~~~~~~~~~~
1 error generated.
```
Ref: https://github.com/curl/curl/actions/runs/22410066319/job/64880787424#step:46:76

Fix by moving the include and version check to `vtls/wolfssl.c`.

Also: add an early version check to cmake.

Follow-up to 16f073ef49 #16973
Cherry-picked from #20720

Closes #20726
2026-02-26 01:36:16 +01:00
Viktor Szakats
af78b199b2
tidy-up: miscellaneous
- vms/curlmsg_vms.h: delete unused/commented code.
- vtls/schannel_verify: sort includes.
- typecheck-gcc.h: fix indent and alignment.
- lib/config-win32.h: drop idle `#undef`.
- spacecheck: check for stray empty lines before after curly braces.
- make literals more readable: 1048576 -> 1024 * 1024
- scope variables.
- use ISO date in a comment.
- drop redundant parentheses.
- drop empty comments.
- unfold lines.
- duplicate/stray spaces in comments.
- fix indent, whitespace, minor typos.

Closes #20690
2026-02-25 14:44:56 +01:00
Viktor Szakats
fff9905bcf
cmake: force-disable unity for clang-tidied build targets only
Instead of globally disabling unity for all targets when clang-tidy is
enabled.

After this patch `CMAKE_UNITY_BUILD=ON` is honored for:
- static libcurl when building both static and shared separately.
- libcurlu and libcurltool internal libraries when building the test
  target.

While keeping unity disabled for the libcurl build pass running
clang-tidy, and the curl tool, also running clang-tidy.

To make clang-tidy-enabled builds finish faster when unity mode is
enabled, yet performs the same clang-tidy checks as before this patch.

Effect on:
- GHA/macos: core build: same, buils tests 5-12 seconds faster,
  with steps going down from 259 to 25.

  52s: https://github.com/curl/curl/actions/runs/22279958340/job/64448913325 ->
  47s: https://github.com/curl/curl/actions/runs/22279873606/job/64448710743

- GHA/windows (not enabled): it'd save about 1 minute, bringing total
  time barely below 10m, still one of the slowest jobs overall.
  (#20667 is trying a way for 4x speed-up (with a drawback)).

  5m21s: https://github.com/curl/curl/actions/runs/22222907068/job/64284556852 ->
  4m26s: https://github.com/curl/curl/actions/runs/22281033369/job/64451601548

Closes #20670
2026-02-22 19:16:31 +01:00
Viktor Szakats
4b4637a445
build: disable typecheck via the command-line instead of curl_config.h
To make it apply to examples. This in turn makes analyzers run quicker
and with fewer false positives.

It's a special disable option, having its effect via `curl/curl.h`.

Bug: https://github.com/curl/curl/pull/20649#issuecomment-3934885021
Follow-up to 9e6f1c5efb #19637

Closes #20650
2026-02-20 16:32:37 +01:00
Viktor Szakats
4497dbd9ac
clang-tidy: fixes and improvements
Fix bigger and smaller kinks in how clang-tidy is configured and used.
Sync behavior more between autotools and cmake, lib/src and tests. Bump
clang-tidy minimum version and prepare logic to allow using clang-tidy
to a fuller extent.

- move clang-tidy settings from builds to a new `.clang-tidy.yml`.
  To make it easy to see and edit checks at one place. Also to allow
  using the `--checks=` option internally to silence tests-specific
  checks. (clang-tidy does not support multiple `--check=` options via
  the command-line.)
  Use explicit `--config-file=` option to point to the configuration.
- .clang-tidy.yml: link to documentation.
- suppress `clang-diagnostic-nullability-extension` due to a false
  positive in libtests with `CURL_WERROR=ON` and `PICKY_COMPILER=OFF`.
- .clang-tidy.yml: enable `portability-*`, `misc-const-correctness`.
- drop `--quiet` clang-tidy option by default to make its working a bit
  more transparent. The extra output is minimial.
- consistently use double-dashes in clang-tidy command-line options.
  Supported by clang-tidy 9.0.0+ (2019-09-19). Before this patch single
  and double were used arbitrarily.
- src/tool_parsecfg: silence false positive `clang-analyzer-unix.Stream`.
  Seen with clang 18 + clang-tidy 19 and 20 (only with autotools.)
- INTERNALS: require clang-tidy 14.0.0+. For the `--config-file` option.
- INTERNALS: recommend clang-tidy 19.1.0+, to avoid bogus
  `clang-analyzer-valist.Uninitialized` warnings. (bug details below)

autotools:

- allow configuring the clang-tidy tool via `CLANG_TIDY` env.
  Also to use in GHA to point to a suffixed clang-tody tool.
- fix to pass CFLAGS to lib, src sources.
  (keep omitting them when using a non-clang compiler.)
- fix to pass `--warnings-as-errors=*` in quotes to avoid globbing.

cmake:

- fix to not pass an empty `-I` to clang-tidy.
- fix to pass CFLAGS (picky warnings) to clang-tidy for test sources.
  (keep omitting them when using a non-clang compiler.)
- fix to disable `clang-diagnostic-unused-function` for test sources.
  (tests have static entry points, which trigger this check when
  checking them as individidual sources.)
- fix forwarding `CURL_CLANG_TIDYFLAGS` to clang-tidy.
- force disable picky warnings when running clang-tidy with a non-clang
  compiler. To not pass these flags when checking lib and src.

CI:

- GHA/linux: avoid clang-tidy bug by upgrading to v19, and drop the
  workaround.
- GHA/linux: switch to clang from gcc in the clang-tidy job. Using gcc
  doesn't allow passing CFLAGS to clang-tidy, making it less effective.
  (My guess this was one factor contributing to this job often missing
  to find certain issues compared to GHA/macos.)

I recomment using clang-tidy with a clang compiler, preferably the same
version or one that's compatible. Other cases are best effort, and may
fail if a C flag is passed to clang-tidy that it does not understand.
Picky warnings are mostly omitted when using a non-clang compiler,
reducing its usefulness.

Details and reproducer for the v18 (and earlier) clang-tidy bug,
previously affecting the GHA/linux job:

clang-tidy <=18 emits false warnings way when passing multiple C sources
at once (as done with autotools):

```sh
cat > src1.c <<EOF
#include <string.h>
static void dummy(void *p) { memcmp(p, p, 0); }
EOF

cat > src2.c <<EOF
#include <stdarg.h>
void vafunc(int option, ...)
{
  va_list param;
  va_start(param, option);
  if(option)
    (void)va_arg(param, int);
  va_end(param);
}
EOF

/opt/homebrew/opt/llvm@18/bin/clang-tidy --checks=clang-analyzer-valist.Uninitialized src1.c src2.c

# src2.c:7:11: warning: va_arg() is called on an uninitialized va_list [clang-analyzer-valist.Uninitialized]
```

Follow-up to e86542038d #17047

Closes #20605
2026-02-19 00:02:11 +01:00
Viktor Szakats
5fa5cb3825
build: fix -Wunused-macros warnings, and related tidy-ups
- fix internal macro `AN_APPLE_OS` reused between sources without
  resetting it. It may potentially have left the system sha256
  function unused.
- fix to define `WOLFSSL_OPTIONS_IGNORE_SYS` so that it always applies
  to wolfSSL headers, also during feature detection.
- md4, md5, sha256: simplify fallback logic.
- delete 20+ unused macros.
- scope or move macros to avoid `-Wunused-macros` warnings.
- examples: delete unused code.

The warning detects macros defined but not used within the same C
source. It does not warn for macros defined in headers. It also works
with unity builds, but to a lesser extent.

Closes #20593
2026-02-19 00:00:48 +01:00
Viktor Szakats
298f73f95b
cmake: enable binutils ld workaround for all toolchains at build-time (revert)
The change was valid, but caused an annoying warning with perfectly
working non-binutils ld linkers:
```
ld: warning: ignoring duplicate libraries: 'my/path/usr/local/lib/libcrypto.a'
```
(seen with Apple clang, when using static `libcrypto.a`)

It means that for the binutil ld hack to work at consumption-time, curl
must be built with the same picky binutils (gcc) toolchain.

Reverts 795433b923 #20434

Closes #20594
2026-02-15 12:48:46 +01:00
Viktor Szakats
cf9e445e03
cmake: normalize uppercase hex winver (for display)
For display and consistency with other regexp. It did not cause harm.

Follow-up to 2100d9fde2 #12044

Closes #20586
2026-02-13 11:56:13 +01:00
Viktor Szakats
20ae14a322
cmake: warn for invalid CURL_TARGET_WINDOWS_VERSION values
Also:
- INSTALL-CMAKE.md: add an example for `CURL_TARGET_WINDOWS_VERSION`.

Reported-by: nono303 on github
Ref: #20575
Closes #20582
2026-02-13 00:24:49 +01:00
Viktor Szakats
5edd79aa93
cmake: add CURL_PATCHSTAMP configuration variable, test in CI
Also:
- INSTALL-CMAKE.md: alpha sort.

Closes #20576
2026-02-12 17:29:22 +01:00
Viktor Szakats
516a0cd382
cmake: add BORINGSSL_VERSION configuration variable, test in CI
To simplify setting BoringSSL version, using:
`-DBORINGSSL_VERSION=0.20260211.0`
or
`-DBORINGSSL_VERSION=${boringssl_version}`

Previously it could be set via C flags, using complicated shell quotes:
`-DCMAKE_C_FLAGS="-DCURL_BORINGSSL_VERSION=\\\"${boringssl_version}\\\""`
(the C flags method remains, also for autotools)

It'd be nice if BoringSSL published its version not just via
`MODULE.bazel` in its source tree, but from its public headers, to make
these workarounds unnecessary.

Also:
- GHA/http3-linux: test both options.

Closes #20571
2026-02-12 16:29:49 +01:00
Viktor Szakats
325d0e0a68
cmake: fix CURL_DROP_UNUSED accidental left always-enabled
Follow-up to 66ad54e46b #20357

Closes #20565
2026-02-11 17:01:04 +01:00
Viktor Szakats
cdfc8dc7ad
build: tidy up and simplify setmode() detection and use
- move macro to `curl_setup.h` (from curlx), and rename.
  It's required by src, test servers, libtests. Also used by unit/tunit,
  (which is fixable but this patch doesn't touch it.)
- special-case it for Windows/Cygwin/MS-DOS.
- build: drop `setmode()`/`_setmode()` detection.
  This also avoids detecting the different `setmode()` on BSDs,
  and a lot of complexity and overhead.
- use `CURL_O_BINARY`.

Follow-up to 250d613763 #15787
Follow-up to 5e70566094 #15169

Closes #20539
2026-02-08 15:47:47 +01:00
Viktor Szakats
f659b82c2a
build: make HTTP_ONLY build options also disable websockets
Closes #20525
2026-02-05 13:12:10 +01:00
Viktor Szakats
4fb5c916fd
cmake: use list(APPEND ...) where missing
Cherry-picked from #20407

Closes #20522
2026-02-05 13:12:10 +01:00
Viktor Szakats
0590753a3c
build: require POSIX strdup()
Stop detecting this function and drop the local fallback.

Let us know if this update is causing an issue.

Notes:
- on Windows `_strdup()` is required instead.
- `strdup()/_strdup()` were required before this patch to build one of
  the examples: `block_ip`.
- `strdup()/_strdup()` were required in 8.18.0 and earlier to build
  tests.

Closes #20505
2026-02-03 17:50:18 +01:00
Viktor Szakats
31a4f415af
build: tidy up and dedupe strdup functions
- de-dupe lib/src strdup/memdup functions into curlx.
- introduce `CURLX_STRDUP_LOW()` for mapping `strdup()`, and to do it at
  one place within the code, in `curl_setup.h`.
- tests/server: use `curlx_strdup()`. (Also to fix building without
  a system `strdup()`.)
- curlx/curlx.h: shorten and tidy up.
- adjust Windows build path to not need `HAVE_STRDUP`.
- build: stop detecting `HAVE_STRDUP` on Windows.

Closes #20497
2026-02-03 14:02:30 +01:00
Viktor Szakats
4f1646ef8a
cmake: skip binutils ld hack if zlib/openssl target is not IMPORTED
The binutils ld hack requires reading the targets' `LOCATION` property.
This property exists in `IMPORTED` targets. `ZLIB::ZLIB` and
`OpenSSL::Crypto` are normally `IMPORTED` targets defined by CMake's
built-in Find modules. However, in some cases (e.g. in "superbuilds"),
they may be regular targets, defined manually, without a `LOCATION`
property. To avoid a CMake warning in such case, verify if the target is
`IMPORTED` before reading this property.

This also mean that in such case the binutils/ld/gcc hack is not
enabled, and libcurl may fail linking in static mode.

https://cmake.org/cmake/help/v4.2/prop_tgt/IMPORTED.html
https://cmake.org/cmake/help/v4.2/prop_tgt/LOCATION.html

Reported-by: Tomáš Malý
Fixes #20419
Follow-up to 3e841630ec #20427
Follow-up to 16f073ef49 #16973

Closes #20486
2026-02-02 12:28:12 +01:00
Viktor Szakats
3003c32cb2
tidy-up: miscellaneous
- INSTALL-CMAKE.md: add missing periods, text fixes.
- md4, md5: sync variables names.
- curl_trc: sync an argument type.
- docs/examples: sync debug/trace function copies, constify, tidy-ups.
- replace commented code with `#if 0`.
- drop redundant parenthesis (macro values, `return`, around single
  variables, function calls).
- fix indentation, apply clang-format in places.

Closes #20481
2026-02-01 00:54:23 +01:00
Viktor Szakats
feb52be197
build: assume stdint.h
curl requires `stdint.h` from C99, and no longer builds without it since
v8.18.0 (after dropping VS2008 support). Assume it's available, drop
feature checks.

Also:
- drop duplicate `stdint.h` includes.
- introduce internal `HAVE_UINTPTR_T`, enabled by default.
- OS400: disable `HAVE_UINTPTR_T`.
- build: keep cmake pre-fill and `cmp-config.pl` exception because cmake
  and autotools both detect `stdint.h` implicitly.

Co-authored-by: Dan Fandrich
Ref: #20405
Ref: #20384
Follow-up to 2e1a045d89 #17931

Closes #20406
2026-01-28 12:05:20 +01:00
Viktor Szakats
67ad0b0d79
cmake: initialize internal CURL_INCLUDES variable
Closes #20451
2026-01-27 15:24:29 +01:00
Viktor Szakats
3aa4fbf2d4
cmake: add CURL_BUILD_EVERYTHING option
To build all targets in a single go, meaning curl and libcurl as normal,
and tests and examples in addition. To build-test everything without
running multiple cmake commands.

Enable with:
- `-DCURL_BUILD_EVERYTHING=ON`
  Special values: `QUICK` to build examples quickly for build test,
  `NOEXAMPLES` to not build examples.

A well-equipped build takes 2.8s of configure time, and 1.7s to build
everything (shared, unity, ninja, prefill), 1.4s with `QUICK`. Without
this option it takes <1s to build curl/libcurl.

Also: streamline `CURL_LINT` internal logic.

Closes #20429
2026-01-26 02:08:02 +01:00
Viktor Szakats
795433b923
cmake: enable binutils ld workaround for all toolchains at build-time
To make it available for GCC if used when consuming libcurl.

Also add comment to `curl-config.cmake` explaining why these odd targets
are defined there.

Bug: https://github.com/curl/curl/pull/20382#discussion_r2716660108
Follow-up to 3e841630ec #20427
Follow-up to ef3101d181 #20382
Follow-up to 16f073ef49 #16973

Closes #20434
2026-01-25 22:37:56 +01:00
Viktor Szakats
3e841630ec
cmake: fix logic for openssl/zlib binutils ld workaround
While working #16973, the binutils ld lib order workaround logic
regressed so that it modified the wrong target, writing into the system
`ZLIB::ZLIB` and `OpenSSL::Crypto` ones a `INTERFACE_LINK_LIBRARIES`
property, instead of creating CURL-namespaced targets. Oddly enough,
this also fixed the binutils ld lib ordering issue. It seems this
property makes CMake insert each referenced library in two more
positions (not at the very end though), which allows ld to resolve all
symbols in the cases tested in CI.

Fix by creating the indented namespaced targets, and also creating
these in `curl-config.cmake` to be available when consuming libcurl.

Note that the logic continues doing `get_target_property()` on the two
system targets above. If these targets are defined manually and miss
the `LOCATION` propery, or are defined as aliases, this command may
fail. curl expects these targets be created by CMake's `FindZLIB` and
`FindOpenSSL` built-in Find modules (or ones compatible). Ref: #20419

The binutils ld issue is reproduced by these CI jobs:
 - Linux gcc glibc (amd64, arm64)
- Windows gcc zlib-classic (x64)

Currently using this curl-for-win revision:
7d12669daf
Examples:
https://github.com/curl/curl/actions/runs/21332437230/job/61399234023?pr=20427
https://github.com/curl/curl/actions/runs/21332437230/job/61399234033?pr=20427

Comparison of lib orders, as passed by CMake to the linker:

without workaround (possibly breaking binutils `ld`):
```diff
 -framework [...]
 libssl.dylib
 libcrypto.dylib
 libz.tbd
 -lssh2 -lidn2
 libldap.tbd
 liblber.tbd
 -lbrotlidec -lbrotlicommon -lzstd -lnghttp2 -lpsl -lrtmp
 -lz
 -lssl
 -lcrypto
```

before this patch:
```diff
 -framework [...]
 libssl.dylib
 libcrypto.dylib
 libz.tbd
+libcrypto.dylib <== inserted via `INTERFACE_LINK_LIBRARIES`
+libz.tbd        <== inserted via `INTERFACE_LINK_LIBRARIES`
 -lssh2 -lidn2
 libldap.tbd
 liblber.tbd
+libcrypto.dylib <== inserted via `INTERFACE_LINK_LIBRARIES`
+ibz.tbd         <== inserted via `INTERFACE_LINK_LIBRARIES`
 -lbrotlidec -lbrotlicommon -lzstd -lnghttp2 -lpsl -lrtmp
 -lz
 -lssl
 -lcrypto
```

after this patch:
```diff
 -framework [...]
 libssl.dylib
 libcrypto.dylib
 libz.tbd
 -lssh2 -lidn2
 libldap.tbd
 liblber.tbd
 -lbrotlidec -lbrotlicommon -lzstd -lnghttp2 -lpsl -lrtmp
 -lz
 -lssl
 -lcrypto
+libcrypto.dylib <== inserted via `CURL::OpenSSL_Crypto`
+libz.tbd        <== inserted via `CURL::ZLIB`
```

Bug: https://github.com/curl/curl/pull/20382#discussion_r2716660108
Reverts: 615c43eae8
Follow-up to 16f073ef49 #16973

Closes #20427
2026-01-25 20:49:04 +01:00
Viktor Szakats
66ad54e46b
cmake: add CURL_DROP_UNUSED option to reduce binary sizes
To enable known linker options dropping unused, dead, code and data from
the executables built.

Useful to reduce binary sizes for curl, libcurl shared lib and apps
linking static libcurl. It's effective on both "unity" and non-unity
builds. Aligning "unity" build sizes with default, non-unity ones.

Supported platforms: Apple, MSVC, llvm/clang and GCC on all tested
platforms: Linux, BSDs, Windows, MSYS2/Cygwin, Android, MS-DOS.

Notes:
- Static libraries grow 20-30% with non-Apple toolchains.
  This effect is controlled by separate, optional compiler flags on
  non-Apple. This patch enables them automatically for public binaries
  (libcurl and curl tool), and leaves them off for internal/test ones.
- MSVC enables this option by default for 'Release' configurations.
  The curl build option has no effect on it.
- Observed effect on VS2010 is negligible. VS2012+ is recommended.
- Works with LTO, Fil-C.
- No observed/conclusive effect on build speed.
- On Windows with clang/gcc (mingw-w64/MSYS2/Cygwin) it also enables
  `-fno-asynchronous-unwind-tables` as a workaround to make
  the toolchain options actually work.
  Ref: https://sourceware.org/bugzilla/show_bug.cgi?id=11539
  Thanks-to: Andarwinux

Also:
- GHA: enable in Linux and MinGW jobs to test it. Size changes:

  - linux aws-lc H3:
    curl: 2000000 -> 1937152, libcurl.a: 2065724 -> 2716532 bytes
  - macos clang HTTP-only:
    curl: 1364376 -> 128799 bytes, libcurl.a: unchanged
  - macos llvm MultiSSL:
    curl: 410056 -> 405720, libcurl.dylib: 1350336 -> 1348480 bytes
  - mingw schannel c-ares U:
    curl: 1588736 -> 1507328, libcurl-d.a: 3322040 -> 3884746 bytes
    bld: 34 -> 35MB

- GHA: enable in MSVC and Apple jobs to reduce disk footprint, with no
  obvious downside. Size changes:

  - AppVeyor CI VS2019:
    curl: 2339840 -> 1295872, libcurl-d.dll: 3155968 -> 1900544 bytes
    bld: 161 -> 97MB
  - AppVeyor CI VS2022 clang-cl:
    curl: 2933248 -> 2332160, libcurl-d.lib: 4762688 -> 5511330 bytes
    bld: 133 -> 121MB
  - AppVeyor CI VS2022 HTTP-only:
    curl: 3514368 -> 2177024, libcurl-d.lib: 2538420 -> 3151740 bytes
    bld: 137 -> 83MB
  - GHA intel:
    curl: 2629120 -> 2023424, libcurl-d.lib: 4366652 -> 5350670 bytes
    bld: 86 -> 69MB
  - GHA arm64:
    curl: 2832896 -> 2063872, libcurl-d.lib: 4690616 -> 5597250 bytes
    bld: 82 -> 66MB

Refs:
https://maskray.me/blog/2021-02-28-linker-garbage-collection
https://web.archive.org/web/20110811230637/msdn.microsoft.com/en-us/library/bxwfs976.aspx (VS2010)
https://learn.microsoft.com/cpp/build/reference/opt-optimizations
https://learn.microsoft.com/cpp/build/reference/gy-enable-function-level-linking

Closes #20357
2026-01-22 17:08:20 +01:00
Viktor Szakats
e50aa46fb2
build: update to not need _CRT_NONSTDC_NO_DEPRECATE with MSVC
Use non-deprecated CRT function variants on Windows.

- introduce `curlx_fdopen()`, `curlx_close()` and use them. Map them to
  non-deprecated, underscored, CRT functions on Windows.

- replace `close()` uses with either `sclose()` (for sockets) or
  `curlx_close()` (for files).

- map `fileno`, `unlink`, `isatty` to their non-deprecated, underscored,
  versions on Windows.

- tool_dirhie: map `mkdir` to `_mkdir` on Windows.

- easy: use `_strdup()` on Windows, regardless of how `HAVE_STRDUP` is
  set.

- cmake: assume `HAVE_STRDUP` on Windows. To allow dropping a detection
  hack using `_CRT_NONSTDC_NO_DEPRECATE` with MSVC. Windows always has
  `_strdup()` which the code uses, but also needs `HAVE_STRDUP` defined
  to disable curl's own `strdup()` implementation.

- curl_setup.h: drop `_CRT_NONSTDC_NO_DEPRECATE` as no longer necessary.

Closes #20212
2026-01-20 23:19:54 +01:00
Viktor Szakats
09c9afdd71
cmake: silence silly Apple clang warnings in C89 mode, test in CI
- `stdbool.h` is also included via system headers. Disabling it from curl
  does not fix it. Silencing lots of these:
  ```
  curl/lib/curlx/warnless.h:64:1: warning: '_Bool' is a C99 extension [-Wc99-extensions]
   64 | bool curlx_sztouz(ssize_t sznum, size_t *puznum);
      | ^
  /Library/Developer/CommandLineTools/usr/lib/clang/17/include/stdbool.h:24:14: note: expanded from macro 'bool'
   24 | #define bool _Bool
      |              ^
  ```

- silence `-Wcomma` warnings.
  in favor of the global silencing approach, since a couple of more of
  these were hit (in vquic, tool1622, unit1309, unit1636), and it seems
  silly to update them all.
  Revert e8189c4420 #20362

Also:
- cmake: include C standard in 'platform flags' log line.
- GHA/macos: switch a job to C89 to verify.
- GHA/linux: show 'C89' in job names.

Ref: https://cmake.org/cmake/help/v3.7/variable/CMAKE_C_STANDARD.html

Closes #20363
2026-01-20 13:05:01 +01:00
Viktor Szakats
2d5a063121
build: merge TrackMemory (CURLDEBUG) into debug-enabled option
Drop separate `TrackMemory` (aka `CURLDEBUG`) debug feature.

After recent changes (thread-safety,
193cb00ce9, and updates leading up to
it), `TrackMemory` is unlikely to cause build or runtime issues.

To simplify builds and debug options, enable `TrackMemory`
unconditionally for debug-enabled (aka `DEBUGBUILD`) builds. Before
this patch, this was already the default, with an option to disable
it, or enable it in non-debug-enabled builds.

Note, in practice these two debug options already went hand in hand. It
was not possible to toggle them separately for a long time due to bugs,
before 59dc9f7e69 (2024-05-28) fixed it.

This patch also removes/deprecates separate knobs and feature flags for
`TrackMemory`:
- autotools: `--enable-curldebug`/`--disable-curldebug`
- cmake: `-DENABLE_CURLDEBUG=ON`/`OFF`
- C macro: `CURLDEBUG`
- libcurl: `CURL_VERSION_CURLDEBUG` symbol deprecated in favor
  of `CURL_VERSION_DEBUG`. They always return the same value after this
  patch.

Also:
- drop `TrackMemory` from `curl -V` output.
- rename internal `CURLDEBUG` macro to `CURL_MEMDEBUG` internally.
  To avoid confusion with `DEBUGBUILD`, but to keep guarding
  `TrackMemory`-related internals for readability.
- runtests: bind `TrackMemory` to debug feature. Keep it a separate
  test feature requirement, for clarity.
- CI: drop test builds for combinations of the two options.
- GHA/linux: no longer disable TrackMemory in the TSAN job.

Ref: https://github.com/curl/curl/pull/20328#issuecomment-3754528407

Closes #20331
2026-01-19 18:43:17 +01:00
Viktor Szakats
0e8683ee2a
cmake: fix variable name for Apple Security framework
Follow-up to eefd03c572 #18703

Closes #20349
2026-01-19 07:48:15 +01:00
Daniel Stenberg
6aaac9dd38
vquic: drop support for OpenSSL-QUIC
- It is slower and uses more memory than the alternatives and is only
  experimental in curl.
- We disable a few tests for OpenSSL-QUIC because of flakiness
- It gets little attention from OpenSSL and we have no expectation of the
  major flaws getting corrected anytime soon.
- No one has spoken up for keeping it
- curl users building with vanilla OpenSSL can still use QUIC through the
  means of ngtcp2

Closes #20226
2026-01-17 22:49:34 +01:00
Daniel Stenberg
6c31df453b
mqtt: initial support for MQTTS
Closes #19418
2026-01-17 22:43:36 +01:00
Viktor Szakats
1730407b74
windows: add build option to use the native CA store
With the same semantics as Apple SecTrust, in both libcurl and the curl
tool, when using non-Schannel TLS backends. In practice it means that
it makes TLS work without manually or implicitly configuring a CA bundle
`.crt` file, such as `curl-ca-bundle.crt`.

To enable:
- autotools: `--enable-ca-native`
- cmake: `-DCURL_CA_NATIVE=ON`
- CPPFLAGS: `-DCURL_CA_NATIVE`

When enabled:
- enables `CURLSSLOPT_NATIVE_CA` (libcurl) / `--ca-native`
  and `--proxy-ca-native` (curl tool) options by default.
- unsafe search for an on-disk CA bundle gets disabled by default.
  Equivalent to `--disable-ca-search` with autotools,
  `-DCURL_DISABLE_CA_SEARCH=ON` with CMake.
- build-time detection of CA bundle and CA path gets disabled. As with
  Apple SecTrust. This was already the default for Windows.
- native CA can be disabled at run-time with the `--no-ca-native`
  and/or `--no-proxy-ca-native` command-line options.

Rationale: This build option:
- has a repeat and active interest from packagers and users.
- helps integrating curl with Windows for those who need this.
- it also applies to macOS: #17525
  Shipped in curl 8.17.0.
- makes it trivial to use custom certs configured on the OS.
- frees applications/packagers/users from the task of securely
  distributing, and keeping up-to-date, a CA bundle.
- frees potentially many curl tool from configuring a CA bundle manually
  to access HTTPS (and other TLS) URLs. This is traditionally difficult
  on Windows because there is no concept of a universal, protected,
  non-world-writable, location on the file system to securely store
  a CA bundle.
- allows using modern features regardless of Windows version. Some of
  these features are not supported with Schannel (e.g. HTTP/3, ECH) on
  any Windows version.
- is necessary for HTTP/3 builds, where bootstrapping a CA bundle is not
  possible with Schannel, because MultiSSL is not an option, and HTTP/3
  is not supported with Schannel.

Ref: #16181 (previous attempt)
Ref: https://github.com/curl/curl/discussions/9348
Ref: https://github.com/curl/curl/issues/9350
Ref: https://github.com/curl/curl/pull/13111
Ref: https://github.com/microsoft/vcpkg/pull/46459#issuecomment-3162068701
Ref: 22652a5a4c #14582
Ref: eefd03c572 #18703

Closes #18279
2026-01-17 19:18:52 +01:00
Viktor Szakats
b17ef873ae
windows: bump minimum to Vista (from XP)
After this patch curl requires targeting Vista or newer, and a toolchain
with Vista support.

Supported MSVC compilers (VS2010+) all support Vista:
- VS2012+ target Win8 (or later) by default.
- VS2010 targets Win7 by default.

Supported mingw-w64 versions (v3+) all support Vista:
- mingw-w64 v9+ target Win10 by default.
- mingw-w64 v8 and older target Server 2003 (~XP) by default.
  After this patch it may be necessary to override the default Windows
  target version to Vista (or newer) via:
  autotools: `CPPFLAGS=-D_WIN32_WINNT=0x0600`
  cmake: `-DCURL_TARGET_WINDOWS_VERSION=0x0600`
- mingw-w64 v6+ allow changing the default at toolchain build-time.

Notes:
- For non-MSVC, non-mingw-w64 toolchains, `if_nametoindex` needs to be
  allowlisted in `curl_setup.h`, if they do support it.

Fixes #17985 (discussion)
Closes #18009
2026-01-17 11:41:49 +01:00
Viktor Szakats
6437bd79ae
cmake: avoid setting custom property on built-in interface targets
In some cases `ZLIB::ZLIB` and/or `OpenSSL::SSL` may be aliases, which
prevents setting a curl-specific property (.pc module name) in them:
```
CMake Error at [...]/curl/CMakeLists.txt:910 (set_target_properties):
  set_target_properties can not be used on an ALIAS target.
```

Fix by special-casing these built-in targets and manually converting
them to .pc module names, without using the targets themselves
to carry this information throughout curl's internal build logic.

Reported-by: Tomáš Malý
Fixes #20313
Follow-up to 16f073ef49 #16973
Closes #20316
2026-01-14 20:46:25 +01:00
Viktor Szakats
60ab58a8a5
cmake: replace an outlier set(var) with set(var, "")
For consistency with the rest of these expressions and readability.

Closes #20305
2026-01-14 00:55:05 +01:00
Viktor Szakats
13f0ede730
build: add curl-lint/lint targets, CURL_LINT cmake option
To run checksrc and spacecheck on the source tree. Also for cmake
to sync up with autotools' `checksrc` target.

- cmake: `curl-lint`
  With `-DCURL_LINT=ON`, checks run automatically for all targets.
- autotools: `lint`

Closes #20175
2026-01-12 16:45:24 +01:00
Daniel Stenberg
0159100f4f
lib: use (u)int64_t instead of long long
Remove config-plan9.h because it does not support 64 bit, meaning it has
not been working for years.

Closes #20233
2026-01-10 12:40:54 +01:00
Joshua Vandaële
97f518e193
cmake: reference OpenSSL and ZLIB imported targets only when enabled
This otherwise broke building on a parent with a static library which is
available but disabled (e.g. CURL_ZLIB is set to OFF but ZLIB::ZLIB
exists)

Closes #20217
2026-01-09 22:03:28 +01:00
Viktor Szakats
9552d9c0c0
build: detect and include inttypes.h again (revert)
Since not using `PRI*` macros, it isn't needed.

Follow-up to 13c1a93414 #20215
Revert 4c9e4e99c1 #20208

Closes #20225
2026-01-09 14:59:30 +01:00
Viktor Szakats
4c9e4e99c1
build: detect and include inttypes.h again
For `PRI*` printf masks for fixed-size C99 types.

Also:
- add simple fallback for `PRIu32`, `PRIx32`, if `inttypes.h` is
  missing.

Cherry-picked from #20200
Ref: #20207
Follow-up to 4701a6d2ae #19695
Ref: 60359ad504 #12275
Closes #20208
2026-01-07 16:10:23 +01:00
Viktor Szakats
532d134767
build: stop disabling strcpy checks with clang-tidy
Follow-up to 436e67f65b #20076

Closes #20084
2025-12-24 00:02:40 +01:00
Viktor Szakats
1892286086
cmake: match filename suffixes with file content
To:
- simplify recognizing CMake sources.
- ensure syntax highlighters use the correct file type.
- sync .h template filename with its autotools counterpart.

Also:
- cmakelint.sh: simplify, alpha sort the filelist.
- perlcheck.sh: simplify.

Closes #20039
2025-12-20 11:34:27 +01:00
Viktor Szakats
14d5b6c7a7
cmake: replace deprecated PERL_FOUND with Perl_FOUND
`Perl_FOUND` available since CMake v3.3.
`PERL_FOUND` deprecated since v4.2.

Ref: https://cmake.org/cmake/help/v4.2/module/FindPerl.html

Closes #20011
2025-12-17 17:56:32 +01:00
Viktor Szakats
32454b954a
localtime: detect thread-safe alternatives and use them
- add local API `toolx_localtime()` to wrap the banned function
  `localtime()`. Used from libcurl, libtests and test servers.
- auto-detect and use `localtime_r()` where available (e.g. Linux).
  Also to support multi-threading.
- use `localtime_s()` on Windows. It requires MSVC or mingw-w64 v4+.
  Also to support multi-threading.
  Use local workaround to also support mingw-w64 v3.
- add `src/toolx` to keep internal APIs used by the curl tool and tests,
  but not by libcurl. `toolx_localtime()` is the first API in it.
- replace `localtime()` calls with `toolx_localtime()`.
  Except in examples.
- note Windows XP's default `msvcrt.dll` doesn't offer secure CRT APIs.
  XP likely needs a newer version of this DLL, or may not run.
- note that `localtime()` mirrors `gmtime()`, with the difference that
  `gmtime()`'s internal wrapper lives in curlx.

Also:
- drop redundant `int` casts.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/localtime-localtime32-localtime64
https://learn.microsoft.com/cpp/c-runtime-library/reference/localtime-s-localtime32-s-localtime64-s
https://pubs.opengroup.org/onlinepubs/9799919799/functions/localtime.html
https://linux.die.net/man/3/localtime_r

Ref: #19955 (for `gmtime_r()`)
Follow-up to 54d9f060b4
Closes #19957
2025-12-16 14:30:06 +01:00
Viktor Szakats
e413a38190
build: disable typecheck for analyzers and Fil-C
- cmake: automatically disable typecheck when running clang-tidy,
  to avoid possible interference, and to improve performance.

- INSTALL-CMAKE: document both this, and unity=off for clang-tidy.

- GHA/linux: disable for some static analyzers CI jobs to avoid possible
  interference.

- GHA/linux: disable in Fil-C job to improve build performance.

Follow-up to 9e6f1c5efb #19637
Follow-up to fd2ca2399e #17955

Closes #19941
2025-12-12 12:21:45 +01:00
Viktor Szakats
fe8393d7db
tidy-up: miscellaneous
- drop stray duplicate empty lines in docs, scripts, test data, include,
  examples, tests.
- drop duplicate PP parenthesis.
- curl-functions.m4: move literals to the right side in if expressions,
  to match rest of the source code.
- FAQ.md: delete language designator from an URL.
- packages: apply clang-format (OS400, VMS).
- scripts/schemetable.c: apply clang-format.
- data320: delete duplicate empty line that doesn't change the outcome.
- spacecheck: extend to check for duplicate empty lines
  (with exceptions.)
- fix whitespace nits

Closes #19936
2025-12-12 04:18:48 +01:00
Viktor Szakats
163705db75
windows: assume USE_WIN32_LARGE_FILES
All Windows platforms support it. It was permanently enabled with most
build methods. The exception is autotools where it is enabled by
default, with an option to disable it. It changed the build in a few
places for rarely tested code paths, but not bringing other advantages
(and used some 64-bit APIs anyway). This patch makes autotools'
`--disable-largefile` option a no-op for Windows.

Closes #19888
2025-12-09 19:34:13 +01:00