GHA: bump actions/checkout from 4.1.4 to 4.1.6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.6.
- [Release notes](https://github.com/actions/checkout/re

GHA: bump actions/checkout from 4.1.4 to 4.1.6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/0ad4b8fadaa221de15dcec353f45205ec38ea70b...a5ac7e51b41094c92402da3b24376905380afc29)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Closes #13720

show more ...

pytest: add ftp upload tests

- refs #13556
- allow anon uploads on vsftpd test server
- add test_30_05 for plain upload of 1k, 100k, 1m
- add test_31_05 for SSL upload of 1k, 100

pytest: add ftp upload tests

- refs #13556
- allow anon uploads on vsftpd test server
- add test_30_05 for plain upload of 1k, 100k, 1m
- add test_31_05 for SSL upload of 1k, 100k, 1m
- verify file size and contents

Closes #13734

show more ...

test: add test1546, chunked not last transfer encoding

with more than one transfer-encoding, 'chunked' must be the last added
to the writer stack (and therefore the first to decode). RFC

test: add test1546, chunked not last transfer encoding

with more than one transfer-encoding, 'chunked' must be the last added
to the writer stack (and therefore the first to decode). RFC 9112, ch.
6.1.

Closes #13736

show more ...

test: add test1484, for HEAD with content

- test HEAD request with 'Transfer-Encoding:chunked' and
non-encoded response content
- verifies #13725

Closes #13735

RELEASE-NOTES: synced

bump to 8.8.1 for now

(lib)curl.rc: set debug flag also for `CURLDEBUG` and `UNITTESTS`

These macros also enable debug features in both libcurl and curl.
Enable `VS_FF_DEBUG` version resource flag when they a

(lib)curl.rc: set debug flag also for `CURLDEBUG` and `UNITTESTS`

These macros also enable debug features in both libcurl and curl.
Enable `VS_FF_DEBUG` version resource flag when they are set.

Closes #13730

show more ...

winbuild: fix PE version info debug flag

- Only set PE file flag VS_FF_DEBUG if curl.exe and libcurl.dll were
built with winbuild option DEBUG=yes which builds with debug info.

winbuild: fix PE version info debug flag

- Only set PE file flag VS_FF_DEBUG if curl.exe and libcurl.dll were
built with winbuild option DEBUG=yes which builds with debug info.

VS_FF_DEBUG is a PE flag (Portable Executable file flag - dll, exe, etc)
that indicates the file contains or was built with debug info.

Prior to this change when winbuild was used to build curl, curl.exe
and libcurl.dll always had VS_FF_DEBUG set, regardless of build option
DEBUG=yes/no, due to some bad logic.

Closes https://github.com/curl/curl/pull/13739

show more ...

RELEASE-NOTES: synced

THANKS: add contributors from 8.8.0

url: remove duplicate call to Curl_conncache_remove_conn when pruning

- remove unnecessary prunedead struct from prune_dead_connections
- rename extract_if_dead to prune_if_dead for clar

url: remove duplicate call to Curl_conncache_remove_conn when pruning

- remove unnecessary prunedead struct from prune_dead_connections
- rename extract_if_dead to prune_if_dead for clarity

Closes #13710

show more ...

curl_setup.h: add support for IAR compiler

Closes #13728

docs/ECH: typo/clarification

Closes #13727

hash: delete unused debug function

It had no use in the curl codebase and was also protected by the macro
`AGGRESSIVE_TEST` (renamed in 2020), also with no local reference.

Adde

hash: delete unused debug function

It had no use in the curl codebase and was also protected by the macro
`AGGRESSIVE_TEST` (renamed in 2020), also with no local reference.

Added in ca6e77083768858aa34207f8c5dce38b3c05336d (2002-11-11)

Closes #13729

show more ...

content_encoding: reject transfer-encoding after chunked

reject a response that applies a transfer-encoding after a 'chunked'
encoding. RFC 9112 ch. 6.1 required chunked to be the final

content_encoding: reject transfer-encoding after chunked

reject a response that applies a transfer-encoding after a 'chunked'
encoding. RFC 9112 ch. 6.1 required chunked to be the final encoding.

Closes #13733

show more ...

http: HEAD response body tolerance

- as reported in #13725, some servers wrongly send body bytes in
responses to a HEAD request. This used to be tolerated in curl
8.4 and before

http: HEAD response body tolerance

- as reported in #13725, some servers wrongly send body bytes in
responses to a HEAD request. This used to be tolerated in curl
8.4 and before and leads to failed transfers in newer versions.
- restore previous behaviour for HTTP/1.1 and HTTP/2:
* 1.1: do not add 'Transfer-Encoding' writers from HEAD
responses. RFC 9112 says they do not apply.
* 2: when the transfer expects 'no_body', to not report stream
resets as error when all response headers have been received.

Reported-by: Jeroen Ooms
Fixes #13725
Closes #13732

show more ...

tests: fix TFTP test 2305 on Windows

Ref: #13692
Closes #13724

openssl: revert keylog_callback support for LibreSSL

- Revert to the legacy TLS 1.2 key logging code for LibreSSL.

- Document SSLKEYLOGFILE for LibreSSL is TLS 1.2 max.

Pri

openssl: revert keylog_callback support for LibreSSL

- Revert to the legacy TLS 1.2 key logging code for LibreSSL.

- Document SSLKEYLOGFILE for LibreSSL is TLS 1.2 max.

Prior to this change if the user specified a filename in the
SSLKEYLOGFILE environment variable and was using LibreSSL 3.5.0+ then
an empty file would be created and no keys would be logged.

This is effectively a revert of e43474b4 which changed openssl.c to use
SSL_CTX_set_keylog_callback for LibreSSL 3.5.0+. Unfortunately LibreSSL
added that function only as a stub that doesn't actually do anything.

Reported-by: Gonçalo Carvalho

Fixes https://github.com/curl/curl/issues/13672
Closes https://github.com/curl/curl/pull/13682

show more ...

GHA: pin dependencies

Closes #13712

appveyor: drop unnecessary `--clean-first` cmake option

In CI all machines are fresh on startup, making the `clean` operation
unnecessary. This can save some time/energy for each job run

appveyor: drop unnecessary `--clean-first` cmake option

In CI all machines are fresh on startup, making the `clean` operation
unnecessary. This can save some time/energy for each job run.

Closes #13707

show more ...

cmake: merge two `if(BUILD_TESTING)` branches

Closes #13708

GHA: bump nghttp2 to v1.62.1

Use gcc-12 explicitly to compile C++20 source files.

Closes #13702

GHA: add NetBSD, OpenBSD, FreeBSD/arm64 and OmniOS jobs

Add these jobs to GHA:
- NetBSD, cmake-unity, clang, OpenSSL, x86_64, with tests, w/o python,
no parallelism (was flaky some

GHA: add NetBSD, OpenBSD, FreeBSD/arm64 and OmniOS jobs

Add these jobs to GHA:
- NetBSD, cmake-unity, clang, OpenSSL, x86_64, with tests, w/o python,
no parallelism (was flaky sometimes)
- OpenBSD, cmake-unity, clang, LibreSSL, x86_64, with tests,
with python, -j8, TFTP results ignored due to #13623.
- FreeBSD, cmake-unity and autotools, clang, OpenSSL, arm64
(Tests disabled for arm64, because they are slow. It's available for
x86_64 with python, -j12.)
Configuration matches our existing Cirrus CI one.
- OmniOS, autotools, gcc, OpenSSL, x86_64, with tests, -j12.

All build with websockets and examples.

Closes #13583

show more ...

GHA: disable TFTP test on native Windows

Some TFTP tests seem to enter into a loop and maybe hang?

E.g. 1007, 1009, 1238

Try fixing it by skipping all TFTP tests.

GHA: disable TFTP test on native Windows

Some TFTP tests seem to enter into a loop and maybe hang?

E.g. 1007, 1009, 1238

Try fixing it by skipping all TFTP tests.

Ref: https://github.com/curl/curl/actions/runs/9141987545/job/25137038249?pr=13698

Also drop mingw-w64 test exclusions copy-pasted from MSYS jobs.

Possibly related: cffbcc3110c1eda2e333f9cfe2e269154618793a #5364

Close #13699

show more ...

GHA: pin dependencies

Closes #13691

cmake: do not pass linker flags to the static library tool

Do not add linker flags to the global CMake static library tool (aka
"static linker") (e.g. `ar`) flags list. They don't mix we

cmake: do not pass linker flags to the static library tool

Do not add linker flags to the global CMake static library tool (aka
"static linker") (e.g. `ar`) flags list. They don't mix well. This was
only done after successfully detecting GSSAPI.

Linker flags seen on Old Linux CI:
```
-- |GSS_LINKER_FLAGS|-Wl,--enable-new-dtags -Wl,-rpath -Wl,/usr/lib/x86_64-linux-gnu/heimdal|
-- |CMAKE_STATIC_LINKER_FLAGS| -Wl,--enable-new-dtags -Wl,-rpath -Wl,/usr/lib/x86_64-linux-gnu/heimdal|
```
Ref: https://github.com/curl/curl/actions/runs/9138988036/job/25130791712#step:6:85

Causing:
```
/usr/bin/ar qc libcurltool.a -Wl,--enable-new-dtags -Wl,-rpath -Wl,/usr/lib/x86_64-linux-gnu/heimdal
CMakeFiles/curltool.dir/slist_wc.c.o CMakeFiles/curltool.dir/tool_binmode.c.o CMakeFiles/curltool.dir/tool_bname.c.o
[...]
CMakeFiles/curltool.dir/tool_writeout_json.c.o CMakeFiles/curltool.dir/tool_xattr.c.o CMakeFiles/curltool.dir/var.c.o
CMakeFiles/curltool.dir/__/lib/base64.c.o CMakeFiles/curltool.dir/__/lib/dynbuf.c.o
/usr/bin/ar: invalid option -- 'W'
Usage: /usr/bin/ar [emulation options] [-]{dmpqrstx}[abcDfilMNoPsSTuvV] [--plugin <name>] [member-name] [count] archive-file file...
/usr/bin/ar -M [<mri-script]
```
Ref: https://github.com/curl/curl/actions/runs/9138988036/job/25130791712#step:9:125

This problem is invisible at the moment because of another bug (#13698)
that misses building unit tests when not using either the
`ENABLE_DEBUG=ON` or `ENABLE_CURLDEBUG=ON` options (to set
`-DCURLDEBUG`):
```
test 1300 SKIPPED: curl lacks unittest support
```
Ref: https://github.com/curl/curl/actions/runs/9135571781/job/25123104557#step:9:2883

With that fixed, this becomes the next issue.

It's possible this bug also required an older CMake version and/or
a specific OS environment which uses linker flags in GSSAPI that are not
playing well with `ar` options, to reproduce.

Follow-up to 558814e16d84aa202c5ccc0c8108a9d728e77a58 (2014-09-25)
Ref: #13698
Closes #13697

show more ...