[ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[Cygwin curl Maintainer]

The following *TEST* packages have been released in the Cygwin distribution:

* curl			7.86
* libcurl4		7.86
* libcurl-devel		7.86
* libcurl-doc		7.86
* mingw64-x86_64-curl	7.86
* mingw64-i686-curl	7.86

Command line tool and Library supporting transferring files with
URL syntax, using FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, and
FILE, SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form
based upload, proxies, cookies, user+password authentication (Basic,
Digest, NTLM, Negotiate...), file transfer resume, proxy tunneling and a
busload of other useful tricks.

For more information see the project home page:

	https://curl.se/

As there are multiple components and many changes each release please
see below or read /usr/share/doc/curl/RELEASE-NOTES after installation;
for complete details of changes since the previous Cygwin release see:

	/usr/share/doc/curl/CHANGES
or
	https://curl.se/changes.html


Please test these packages as extensively as possible (especially if you
are a Cygwin package maintainer) as libcurl is used in many libraries
and utilities.
Package maintainers should install this test release and rerun checks
of as many libraries and packages depending on libcurl as possible. 
Test releases of gsasl and libgsasl18 2.2 are available and the latter
is required for this release.

Checks of curl itself after installing these packages run with no issues.
I have it locally installed so it is getting used by commands, scripts,
cron jobs, and cygport builds, and has and is getting frequent exercise
with no apparent issues so far.
If no issues are reported within a couple of weeks the package will be
upgraded to current.



curl and libcurl		7.86	2022-10-26

 Public curl releases:		 211
 Command line options:		 248
 curl_easy_setopt() options:	 300
 Public functions in libcurl:	  91
 Contributors:			2733

This release includes the following changes:

* Websockets: initial support
* NPN: remove support for and use of

Planned upcoming removals include:

* NSS in 8.0.0 (March 2023)
* Support for systems without 64 bit data types in August 2023

See https://curl.se/dev/deprecate.html for details

This release includes the following known bugs:

* see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)

This release includes the following bugfixes:

* altsvc: reject bad port numbers
* altsvc: use 'h3' for h3
* amiga: do not hardcode openssl/zlib into the os config
* amiga: set SIZEOF_CURL_OFF_T=8 by default
* amigaos: add missing curl header
* asyn-ares: set hint flags when calling ares_getaddrinfo
* autotools: allow --enable-symbol-hiding with windows
* autotools: allow unix sockets on Windows
* autotools: reduce brute-force when detecting recv/send arg list
* aws_sigv4: fix header computation
* bearssl: make it proper C89 compliant
* CI/GHA: cancel outdated CI runs on new PR changes
* CI/GHA: merge msh3 and openssl3 builds into linux workflow
* cirrus-ci: add macOS build with m1
* cirrus: use make LDFLAGS=-all-static instead of curl_LDFLAGS
* cli tool: do not use disabled protocols
* cmake: add missing inet_ntop check
* cmake: add the check of HAVE_SOCKETPAIR
* cmake: define BUILDING_LIBCURL in lib/CMakeLists, not config.h
* cmake: delete duplicate HAVE_GETADDRINFO test
* cmake: enable more detection on Windows
* cmake: fix original MinGW builds
* cmake: improve usability of CMake build as a sub-project
* cmake: set HAVE_GETADDRINFO_THREADSAFE on Windows
* cmake: set HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID on Windows
* cmake: sync HAVE_SIGNAL detection with autotools
* cmdline/docs: add a required 'multi' keyword for each option
* configure: correct the wording when checking grep -E
* configure: deprecate builds with small curl_off_t
* configure: fail if '--without-ssl' + explicit parameter for an ssl lib
* configure: the ngtcp2 option should default to 'no'
* connect: change verbose IPv6 address:port to [address]:port
* connect: fix builds without AF_INET6
* connect: fix Curl_updateconninfo for TRNSPRT_UNIX
* connect: fix the wrong error message on connect failures
* content_encoding: use writer struct subclasses for different encodings
* cookie: reject cookie names or content with TAB characters
* ctype: remove all use of <ctype.h>, use our own versions
* curl-compilers.m4: for gcc + want warnings, set gnu89 standard
* curl-compilers.m4: use -O2 as default optimize for clang
* curl-wolfssl.m4: error out if wolfSSL is not usable
* curl.h: fix mention of wrong error code in comment
* curl/add_file_name_to_url: use the libcurl URL parser
* curl/add_parallel_transfers: better error handling
* curl/get_url_file_name: use libcurl URL parser
* curl: warn for --ssl use, considered insecure
* curl_ctype: convert to macros-only
* curl_easy_pause.3: unpausing is as fast as possible
* curl_escape.3: fix typo
* curl_setup: disable use of FLOSS for 64-bit NonStop builds
* curl_setup: include curl.h after platform setup headers
* curl_setup: include only system.h instead of curl.h
* curl_strequal.3: fix argument typo
* curl_url_set.3: document CURLU_APPENDQUERY proper
* CURLMOPT_PIPELINING.3: dedup manpage xref
* CURLOPT_ACCEPT_ENCODING.3: remove "four" as they are five
* CURLOPT_AUTOREFERER.3: highlight the privacy leak risk
* CURLOPT_COOKIEFILE: insist on "" for enable-without-file
* CURLOPT_COOKIELIST.3: fix formatting mistake
* CURLOPT_DNS_INTERFACE.3: mention it works for almost all protocols
* CURLOPT_MIMEPOST.3: add an (inline) example
* CURLOPT_POSTFIELDS.3: refer to CURLOPT_MIMEPOST
* CURLOPT_PROXY_SSLCERT_BLOB.3: this is for HTTPS proxies
* CURLOPT_WILDCARDMATCH.3: Fix backslash escaping under single quotes
* CURLSHOPT_UNLOCKFUNC.3: the callback has no 'access' argument
* DEPRECATE.md: Support for systems without 64 bit data types
* docs/examples: avoid deprecated options in examples where possible
* docs/INSTALL: update Android Instructions for newer NDKs
* docs/libcurl/symbols-in-versions: add several missing symbols
* docs: 100+ spellfixes
* docs: correct missing uppercase in Markdown files
* docs: document more server names for test files
* docs: fix deprecation versions inconsistencies
* docs: make sure libcurl opts examples pass in long arguments
* docs: remove mentions of deprecated '--without-openssl' parameter
* docs: tag curl options better in man pages
* docs: tell about disabled protocols in CURLOPT_*PROTOCOLS_STR.
* docs: update sourceforge project links
* easy: fix the #include order
* easy: fix the altsvc init for curl_easy_duphandle
* easy_lock: check for HAVE_STDATOMIC_H as well
* examples/chkspeed: improve portability
* formdata: fix warning: 'CURLformoption' is promoted to 'int'
* ftp: ignore a 550 response to MDTM
* ftp: remove redundant if
* functypes: provide the recv and send arg and return types
* getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
* GHA: build tests in a separate step from the running of them
* GHA: run proselint on markdown files
* github: initial CODEOWNERS setup for CI configuration
* header: define public API functions as extern c
* headers: reset the requests counter at transfer start
* hostip: guard PF_INET6 use
* hostip: lazily wait to figure out if IPv6 works until needed
* http, vauth: always provide Curl_allow_auth_to_host() functionality
* http2: make nghttp2 less picky about field whitespace
* HTTP3.md: update Caddy example
* http: try parsing Retry-After: as a number first
* http_proxy: restore the protocol pointer on error
* httpput-postfields.c: shorten string for C89 compliance
* ldap: delete stray CURL_HAS_MOZILLA_LDAP reference
* lib1560: extended to verify detect/reject of unknown schemes
* lib517: fix C89 constant signedness
* lib: add missing limits.h includes
* lib: add required Win32 setup definitions in setup-win32.h
* lib: prepare the incoming of additional protocols
* lib: sanitize conditional exclusion around MIME
* lib: set more flags in config-win32.h
* lib: the number four in a sequence is the "fourth"
* libssh: if sftp_init fails, don't get the sftp error code
* Makefile.m32: deduplicate build rules
* Makefile.m32: drop CROSSPREFIX and our CC/AR defaults
* Makefile.m32: exclude libs & libpaths for shared mode exes
* Makefile.m32: fix regression with tool_hugehelp
* Makefile.m32: major rework
* Makefile.m32: reintroduce CROSSPREFIX and -W -Wall
* Makefile.m32: support more options
* manpage-syntax.pl: all libcurl option symbols should be \fI-tagged
* manpages: Fix spelling of "allows to" -> "allows one to"
* misc: ISSPACE() => ISBLANK()
* misc: use the term "null-terminate" consistently
* mprintf: reject two kinds of precision for the same argument
* mprintf: use snprintf if available
* mqtt: return error for too long topic
* mqtt: spell out CONNECT in comments
* msh3: change the static_assert to make the code C89
* netrc: compare user name case sensitively
* netrc: replace fgets with Curl_get_line
* netrc: use the URL-decoded user
* ngtcp2: fix build errors due to changes in ngtcp2 library
* ngtcp2: fix C89 compliance nit
* noproxy: support proxies specified using cidr notation
* openssl: make certinfo available for QUIC
* README.md: add GHA status badges for Linux and macOS builds
* RELEASE-PROCEDURE.md: mention patch releases
* resolve: make forced IPv4 resolve only use A queries
* runtests: fix uninitialized value on ignored tests
* schannel: ban server ALPN change during recv renegotiation
* schannel: don't reset recv/send function pointers on renegotiation
* schannel: when importing PFX, disable key persistence
* scripts: use `grep -E` instead of `egrep`
* setopt: use the handler table for protocol name to number conversions
* setopt: when POST is set, reset the 'upload' field
* setup-win32: no longer define UNICODE/_UNICODE implicitly
* single_transfer: use the libcurl URL parser when appending query parts
* smb: replace CURL_WIN32 with WIN32
* strcase: add and use Curl_timestrcmp
* strerror: improve two URL API error messages
* symbol-scan.pl: also check for LIBCURL* symbols
* symbol-scan.pl: scan and verify .3 man pages
* symbols-in-versions: add missing LIBCURL* symbols
* symbols-in-versions: CURLOPT_ENCODING is deprecated since 7.21.6
* test1119: scan all public headers
* test1275: verify uppercase after period in markdown
* test972: verify the output without using external tool
* tests/certs/scripts: insert standard curl source headers
* tests/Makefile: remove run time stats from ci-test
* tests: avoid CreateThread if _beginthreadex is available
* tests: fix tag syntax errors in test files
* tests: skip mime/form tests when mime is not built-in
* tidy-up: delete parallel/unused feature flags
* tidy-up: delete unused HAVE_STRUCT_POLLFD
* TODO: provide the error body from a CONNECT response
* tool: avoid generating ambiguous escaped characters in --libcurl
* tool: remove dead code
* tool: reorganize function c_escape around a dynbuf
* tool_hugehelp: make hugehelp a blank macro when disabled
* tool_main: exit at once if out of file descriptors
* tool_operate: avoid a few #ifdefs for disabled-libcurl builds
* tool_operate: more transfer cleanup after parallel transfer fail
* tool_operate: prevent over-queuing in parallel mode
* tool_operate: reduce errorbuffer allocs
* tool_paramhelp: asserts verify maximum sizes for string loading
* tool_paramhelp: make the max argument a 'double'
* tool_progress: remove 'Qd' from the parallel progress bar
* tool_setopt: use better English in --libcurl source comments
* tool_xattr: save the original URL, not the final redirected one
* unit test 1655: make it C89-compliant
* url: a zero-length userinfo part in the URL is still a (blank) user
* url: allow non-HTTPS HSTS-matching for debug builds
* url: rename function due to name-clash in Watt-32
* url: use IDN decoded names for HSTS checks
* urlapi: detect scheme better when not guessing
* urlapi: fix parsing URL without slash with CURLU_URLENCODE
* urlapi: leaner with fewer allocs
* urlapi: reject more bad characters from the host name field
* winbuild/MakefileBuild.vc: handle spaces in libssh(2) include paths
* winbuild: use NMake batch-rules for compilation
* windows: add .rc support to autotools builds
* windows: adjust name of two internal public functions
* windows: autotools .rc warnings fixup
* wolfSSL: fix session management bug.

Re: [ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[Achim Gratz]

Cygwin curl Maintainer writes:
> The following *TEST* packages have been released in the Cygwin distribution:
>
> * curl			7.86
> * libcurl4		7.86
[…]

When building packages that depend on other new packages, these need to
be installed properly on the build system, i.e. have well-formed entries
in /etc/setup/installed.db and the corresponding package list file(s) so
that the dependencies can be determined by cygport.  Otherwise you'd
have to explicitly list these dependencies when building the package,
but then there's the risk you'll forget it when the next update comes
around.  This would have prevented the problem with the original release
and also ensure that this package can get installed without having to
select libgsasl18 manually for installation.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Waldorf MIDI Implementation & additional documentation:
http://Synth.Stromeko.net/Downloads.html#WaldorfDocs

Re: [ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[Lemures Lemniscati]

On Tue, 01 Nov 2022 15:24:14 -0600, Cygwin curl Maintainer
> The following *TEST* packages have been released in the Cygwin distribution:
> 
> * curl			7.86
> * libcurl4		7.86

Hi,

Thank you for maintaining the packages

I failed to get https://cygwin.com/index.html by curl:

==========
$ uname -svrmo; cygcheck -c curl libcurl4 libgsasl18 ca-certificates; rm -f index.html; curl -O https://cygwin.com/index.html; ls -l index.html
CYGWIN_NT-10.0-22621 3.3.6-341.x86_64 2022-09-05 11:15 UTC x86_64 Cygwin
Cygwin Package Information
Package              Version         Status
ca-certificates      2022.2.54-3     OK
curl                 7.86.0-1        OK
libcurl4             7.86.0-1        OK
libgsasl18           2.2.0-1         OK
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
ls: cannot access 'index.html': No such file or directory
==========

I don't know whether the result is expeced.
If so, is there any help?

Lem

Re: [ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[Lemures Lemniscati]

On Wed, 2 Nov 2022 22:10:18 -0400, gs-cygwin.com <gs-cygwin.com@gluelogic.com>
Re: [ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)
> On Thu, Nov 03, 2022 at 10:38:13AM +0900, Lemures Lemniscati wrote:
> > I failed to get https://cygwin.com/index.html by curl:
> > 
> > ==========
> > $ uname -svrmo; cygcheck -c curl libcurl4 libgsasl18 ca-certificates; rm -f index.html; curl -O https://cygwin.com/index.html; ls -l index.html
> > CYGWIN_NT-10.0-22621 3.3.6-341.x86_64 2022-09-05 11:15 UTC x86_64 Cygwin
> > Cygwin Package Information
> > Package              Version         Status
> > ca-certificates      2022.2.54-3     OK
> > curl                 7.86.0-1        OK
> > libcurl4             7.86.0-1        OK
> > libgsasl18           2.2.0-1         OK
> >   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
> >                                  Dload  Upload   Total   Spent    Left  Speed
> >   0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
> > curl: (60) SSL certificate problem: unable to get local issuer certificate
> > More details here: https://curl.se/docs/sslcerts.html
> > 
> > curl failed to verify the legitimacy of the server and therefore could not
> > establish a secure connection to it. To learn more about this situation and
> > how to fix it, please visit the web page mentioned above.
> > ls: cannot access 'index.html': No such file or directory
> > ==========
> > 
> > I don't know whether the result is expeced.
> > If so, is there any help?
> 
> Lem: did this work for you with an older version of curl?
> 
> Please use 'curl -v -O https://cygwin.com/index.html' and identify the
> server with which you are having trouble. There is more than one server.
> 
> Cheers, Glenn

I guess it could work in June 2022.
But reverting upto curl-7.81.0 doesn't improve the situation.

Lem

========
$ curl -V
curl 7.81.0 (x86_64-pc-cygwin) libcurl/7.81.0 OpenSSL/1.1.1s zlib/1.2.13 brotli/1.0.9 zstd/1.5.2 libidn2/2.3.4 libpsl/0.21.1 (+libidn2/2.3.1) libssh2/1.10.0 nghttp2/1.50.0 libgsasl/1.10.0 OpenLDAP/2.6.3
Release-Date: 2022-01-05
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli Debug gsasl GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP TrackMemory UnixSockets zstd

$ curl -v -O https://cygwin.com/index.html
* STATE: INIT => CONNECT handle 0x80008eb28; line 1835 (connection #-5000)
* Added connection 0. The cache now contains 1 members
* STATE: CONNECT => RESOLVING handle 0x80008eb28; line 1881 (connection #0)
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* family0 == v4, family1 == v6
*   Trying 8.43.85.97:443...
* STATE: RESOLVING => CONNECTING handle 0x80008eb28; line 1965 (connection #0)
* Connected to cygwin.com (8.43.85.97) port 443 (#0)
* STATE: CONNECTING => PROTOCONNECT handle 0x80008eb28; line 2028 (connection #0)
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* Didn't find Session ID in cache for host HTTPS://cygwin.com:443
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* STATE: PROTOCONNECT => PROTOCONNECTING handle 0x80008eb28; line 2048 (connection #0)
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [70 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [1023 bytes data]
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
} [2 bytes data]
* SSL certificate problem: unable to get local issuer certificate
* multi_done: status: 60 prem: 1 done: 0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* The cache now contains 0 members
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
========

Re: [ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[ASSI]

Lemures Lemniscati writes:
> curl: (60) SSL certificate problem: unable to get local issuer certificate
> More details here: https://curl.se/docs/sslcerts.html
>
> curl failed to verify the legitimacy of the server and therefore could not
> establish a secure connection to it. To learn more about this situation and
> how to fix it, please visit the web page mentioned above.
> ls: cannot access 'index.html': No such file or directory
> ==========
>
> I don't know whether the result is expeced.
> If so, is there any help?

Try to run update-ca-trust as the user that originally did the installation.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Factory and User Sound Singles for Waldorf Blofeld:
http://Synth.Stromeko.net/Downloads.html#WaldorfSounds

Re: [ANNOUNCEMENT] Test: curl, libcurl{4, -devel, -doc}, mingw64-{x86_64, i686}-curl 7.86 (TEST)

[Brian Inglis]

On Thu, 03 Nov 2022 08:36:59 +0100, ASSI wrote:
> Lemures Lemniscati writes:
>> curl: (60) SSL certificate problem: unable to get local issuer certificate
>> More details here: https://curl.se/docs/sslcerts.html
>>
>> curl failed to verify the legitimacy of the server and therefore could not
>> establish a secure connection to it. To learn more about this situation and
>> how to fix it, please visit the web page mentioned above.
>> ls: cannot access 'index.html': No such file or directory
>> ==========
>>
>> I don't know whether the result is expeced.
>> If so, is there any help?

> Try to run update-ca-trust as the user that originally did the installation.

I think Achim is referring to the fix to an earlier issue, where there were 
similar problems with ca-certificates after p11-kit removed write permission to 
the directory /etc/pki/ca-trust/extracted/pem/directory-hash, so update-ca-trust 
failed when run in the postinstall script.

Check:

$ grep -B1 'chmod' /usr/bin/update-ca-trust
# p11-kit removes write permission to the directory
chmod u+w $DEST/pem/directory-hash
--
/usr/bin/ln -s ../tls-ca-bundle.pem $DEST/pem/directory-hash/ca-bundle.crt
chmod a-w $DEST/pem/directory-hash

You may have to check /etc/pki/ca-trust/extracted/pem/directory-hash permissions 
with ls -l, getfacl, and

$ icacls `cygpath -m /etc/pki/ca-trust/extracted/pem/directory-hash`

if there is still an issue, and fix any permissions issues, or run setup to 
upgrade or reinstall ca-certificates and ...-letsencrypt.

-- 
Take care. Thanks, Brian Inglis			Calgary, Alberta, Canada

La perfection est atteinte			Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter	not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer	but when there is no more to cut
			-- Antoine de Saint-Exupéry