strtok: use namespaced `strtok_r` macro instead of redefining it

krb5 defines `strtok_r` for Windows unconditionally in its public
header:
https://github.com/krb5/krb5/blob/dc5554394

strtok: use namespaced `strtok_r` macro instead of redefining it

krb5 defines `strtok_r` for Windows unconditionally in its public
header:
https://github.com/krb5/krb5/blob/dc5554394e5a4363b3e109623edbeb9ad6c18a62/src/include/win-mac.h#L214-L215
resulting in this warning:
```
lib\strtok.h(31,9): warning C4005: 'strtok_r': macro redefinition
C:\vcpkg\installed\x64-windows\include\win-mac.h(215,9):
see previous definition of 'strtok_r'
```

The krb5 macro collides with curl's internal definition, in case
the `strtok_r` function is undetected and falling back to a local
replacement.

Reported-by: Tal Regev
Bug: https://github.com/curl/curl/pull/15549#issuecomment-2468251761
Closes #15564

show more ...

socketpair: fix enabling `USE_EVENTFD`

Follow-up to 23fe1a52dc8a2ffd74e19b956927bbccdc07f15f #13874
Closes #15561

configure: do not echo most inherited `LDFLAGS` to config files

`libcurl.pc` `Libs.private` (since 8.11.0, and in `Libs` before 7.20.0)
and `curl-config` `--static-libs` (since 7.17.1, a

configure: do not echo most inherited `LDFLAGS` to config files

`libcurl.pc` `Libs.private` (since 8.11.0, and in `Libs` before 7.20.0)
and `curl-config` `--static-libs` (since 7.17.1, and in `Libs` between
7.7.2-7.25.0). This included all flags inherited from the environment,
in addition to those coming from dependency detections.

To avoid spilling all linker flags inherited from the environment to
the libcurl config files, this patch omits them all, except `-L`, `-F`,
`--library-path=` and `-framework` options, which are still passed.
The rationale for the exceptions is that `LIBS` is passed as-is, and
`LDFLAGS`, `LIBS` are the canonical way to pass custom libs options
to a build. `LIBS` may not work without a matching custom libpath.

This brings autotools behaviour closer to cmake, and `curl-config`
closer to `libcurl.pc`.

Follow-up to 9f56bb608ecfbb8978c6cb72a04d9e8b23162d82 #14681
Follow-up to 4c8adc8fee5e55754da3d8f8d982733a7bf3dece
Reported-by: Peter Marko
Fixes #15533
Closes #15550

show more ...

GHA/linux: fix `pip3 install impacket` breakage

An upstream update `impacket` pip package started requiring `blinker`.
An older version is shipping with Ubuntu, causing this on install:

GHA/linux: fix `pip3 install impacket` breakage

An upstream update `impacket` pip package started requiring `blinker`.
An older version is shipping with Ubuntu, causing this on install:
```
Attempting uninstall: blinker
Found existing installation: blinker 1.7.0
ERROR: Cannot uninstall blinker 1.7.0, RECORD file not found. Hint: The package was installed by debian.
```

Fix it by switching to venv and install everything separate from the
system.

The overhead is the same as using `pip --ignore-installed`, which also
installs everything from scratch.

The 3rd option is to uninstall the system `python3-blinker` package, but
it was the slowest.

Closes #15578

show more ...

os400: Fix IBMi builds

- Use a separate variable for CURL type dereference.

Prior to this change, eed3c8f4 (precedes 8.11.0), changed CURL type from
Curl_easy to void which brok

os400: Fix IBMi builds

- Use a separate variable for CURL type dereference.

Prior to this change, eed3c8f4 (precedes 8.11.0), changed CURL type from
Curl_easy to void which broke dereferences to the former.

Reported-by: Andrew Kirillov

Fixes https://github.com/curl/curl/issues/15566
Closes https://github.com/curl/curl/pull/15572

show more ...

os400: Fix IBMi EBCDIC conversion of arguments

- Fix the length of strings passed to iconv_open.

IBM's iconv_open expects parameters to be a pointer to a 32 byte
character array

os400: Fix IBMi EBCDIC conversion of arguments

- Fix the length of strings passed to iconv_open.

IBM's iconv_open expects parameters to be a pointer to a 32 byte
character array with the unused fields set to 0.

Prior to this change, since 8c62479a (precedes 8.11.0), it was
incorrectly passed pointers to smaller length const strings and curl
would fail with error "blank argument where content is expected".

Reported-by: Andrew Kirillov

Ref: https://www.ibm.com/docs/en/i/7.5?topic=ssw_ibm_i_75/apis/iconvopn.html

Fixes https://github.com/curl/curl/issues/15570
Closes https://github.com/curl/curl/pull/15574

show more ...

cmake: typo in comment [ci skip]

Follow-up to 93e6e4b823d4b62119e5d464ae733b68245772e6 #15559

GHA/macos: follow Homebrew and switch to `pkgconf`

Homebrew switched to `pkgconf`, and now pkg-config installs an extra
package. Update package list to avoid that.

The side-effe

GHA/macos: follow Homebrew and switch to `pkgconf`

Homebrew switched to `pkgconf`, and now pkg-config installs an extra
package. Update package list to avoid that.

The side-effect of `pkgconf` is that this former log message:
```
-- Package 'libcrypto', required by 'libssh2', not found
```
https://github.com/curl/curl/actions/runs/11779568834/job/32808325442#step:7:84

is replaced by this, and repeated 10 times:
```
Package libcrypto was not found in the pkg-config search path.
Perhaps you should add the directory containing `libcrypto.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libcrypto', required by 'libssh2', not found
```
https://github.com/curl/curl/actions/runs/11792711391/job/32846858320#step:7:85

Closes #15575

show more ...

cmakelint: fix to check root `CMakeLists.txt`

Closes #15565

cmake: work around `ios.toolchain.cmake` breaking feature-detections

Fix builds with CMake configured to falsely return successful detection
when using `check_function_exists()` (and `ch

cmake: work around `ios.toolchain.cmake` breaking feature-detections

Fix builds with CMake configured to falsely return successful detection
when using `check_function_exists()` (and `check_library_exists()`, and
anything based on `try_compile()` that's relying on the linker). After
such mis-detection the build fails when trying to use the feature that
doesn't in fact exist.

The mis-detection is caused by this CMake setting:
```
set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
```
It is set by default (or on conditions) when using 3rd-party toolchain:
https://github.com/leetal/ios-cmake/blob/master/ios.toolchain.cmake

After this patch the curl build overrides this setting for the duration
of feature tests, and logs a message about it.

Also preset and skip feature tests for known mis-detections:
- `connect()` in `libsocket`
- `getpass_r()`
- `eventfd()` (did not cause an issue due to a separate bug)
- `sendmmsg()` (did not cause an issue because it's Linux-only)

If mis-detections are still seen, the workaround is to force-set the
specific feature by passing `-DHAVE_*=OFF` to cmake.
Also consider passing `-DENABLE_STRICT_TRY_COMPILE=ON` for
`ios.toolchain.cmake` to fix the root cause.

Interestingly curl itself uses this setting to speed up compile-only
detections: be17f298ff508d62d493d4a8d43e56a1e2861a50 #3744

Also:
- OtherTests.cmake: restore original value of
`CMAKE_TRY_COMPILE_TARGET_TYPE`. Before this patch it reset it
to empty.
- OtherTests.cmake: unset a local variable after use, quote a string.

Follow-up to 8e345057761a8f796403923a96f2c8fd3edca647 #15164
Follow-up to 8b76a8aeb21c8ae2261147af1bddd0d4637c252c #15525
Ref: https://github.com/leetal/ios-cmake/issues/47
Ref: https://gitlab.kitware.com/cmake/cmake/-/issues/18121
Ref: https://cmake.org/cmake/help/latest/variable/CMAKE_TRY_COMPILE_TARGET_TYPE.html
Reported-by: Dan Rosser
Fixes #15557
Closes #15559

show more ...

tests: use the standard format of an IGNORED line

This is more consistent and allows Test Clutch to parse it properly.
Also, add --test-duphandle and --test-event to the runtests.pl help

tests: use the standard format of an IGNORED line

This is more consistent and allows Test Clutch to parse it properly.
Also, add --test-duphandle and --test-event to the runtests.pl help
text.

show more ...

GHA/non-native: streamline installed packages on FreeBSD

Instead of installing the cmake package which is a meta-port (includes
documentation and manpages etc) install cmake-core which i

GHA/non-native: streamline installed packages on FreeBSD

Instead of installing the cmake package which is a meta-port (includes
documentation and manpages etc) install cmake-core which is cmake itself
to save a few cpu cycles.

Also drop nghttp2 in favour of the slimmer libnghttp2.

Closes #15540

show more ...

mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions

The script's previous treatment of this meta-data was a
misunderstanding. (Added in 1ebc53df25181908) The mistrust is not fo

mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions

The script's previous treatment of this meta-data was a
misunderstanding. (Added in 1ebc53df25181908) The mistrust is not for
the root cert at this date (it would simply be removed from the bundle
then instead) but for created server certificates:

If a builtin certificate has a CKA_NSS_SERVER_DISTRUST_AFTER
timestamp before the SCT or NotBefore date of a certificate that
builtin issued, then clients can elect not to trust it.

That is however information that cannot be provided in the generated PEM
output.

Fixes #15547
Reported-by: Andrew Ayer
Closes #15552

show more ...

curl-rustls.m4: keep existing `CPPFLAGS`/`LDFLAGS` when detected

Different variable names were used in flag save and restore operations,
which could cause existing `CPPFLAGS` and `LDFLAG

curl-rustls.m4: keep existing `CPPFLAGS`/`LDFLAGS` when detected

Different variable names were used in flag save and restore operations,
which could cause existing `CPPFLAGS` and `LDFLAGS` be accidentally lost
when detecting Rustls.

Follow-up to 647e86a3efe1eea7a2a456c009cfe1eb55fe48eb #13179
Closes #15546

show more ...

build: use `_fseeki64()` on Windows, drop detections

A recent update caused CMake builds to mis-detect this symbol on iOS.
Auto-detection also seems redundant given that it's a Windows-o

build: use `_fseeki64()` on Windows, drop detections

A recent update caused CMake builds to mis-detect this symbol on iOS.
Auto-detection also seems redundant given that it's a Windows-only
function and most Windows builds were already opted-in.

Drop detections and use it in all Windows builds with large file support
enabled.

Feature history:
- pririotizing for Windows: aaacd02466f77d03b8fdc19e91a0a3ec72f4c38a #14678
- Windows opt-in cmake: 8e74c0729d0cace00a202fc6c33c1b35703e220a #11950
- Windows opt-in: aa6c94c5bf4f5caa31c0213d9cd7058c29a9b30b #11944
- use in libcurl: 9c7165e96a3a9a2d0b7059c87c699b5ca8cdae93 #11918
- use in example: 817d1c01064ac81e9609819b15738ee540ef056c

Regression from 8e345057761a8f796403923a96f2c8fd3edca647 #15164

Reported-by: Maarten Billemont
Fixes #15525
Closes #15526

show more ...

GHA: update four dependencies

- gnutls/gnutls to v3.8.8
- rojopolis/spellcheck-github-actions digest to 403efe0
- awslabs/aws-lc to v1.38.0
- github/codeql-action digest to 4f321

GHA: update four dependencies

- gnutls/gnutls to v3.8.8
- rojopolis/spellcheck-github-actions digest to 403efe0
- awslabs/aws-lc to v1.38.0
- github/codeql-action digest to 4f3212b

Closes #15487
Closes #15490
Closes #15516
Closes #15528

show more ...

libssh: when using IPv6 numerical address, add brackets

Reported-by: henrikjehgmti on github
Fixes #15522
Closes #15524

GHA/non-native: enable nghttp2 in OmniOS job

Closes #15530

ci: Update vmactions/omnios-vm digest to 16b5996

Closes #15529

RELEASE-NOTES: synced

nghttp2: use custom memory functions

Provide libcurl's memory functions as callbacks to replace nghttp2's own memory
functions. This allows custom memory callbacks provided by users of l

nghttp2: use custom memory functions

Provide libcurl's memory functions as callbacks to replace nghttp2's own memory
functions. This allows custom memory callbacks provided by users of libcurl to
be used by nghttp2 as well.

Closes #15527

show more ...

ECH: enable support for the AWS-LC backend

Extend existing ECH support for BoringSSL to its AWS-LC fork.

Also enable ECH in AWS-LC CI jobs.

```
curl 8.11.0-DEV (x86_64-

ECH: enable support for the AWS-LC backend

Extend existing ECH support for BoringSSL to its AWS-LC fork.

Also enable ECH in AWS-LC CI jobs.

```
curl 8.11.0-DEV (x86_64-pc-linux-gnu) libcurl/8.11.0-DEV AWS-LC/1.37.0 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libpsl/0.21.2
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli ECH HSTS HTTPS-proxy IPv6 Largefile libz NTLM PSL SSL threadsafe UnixSockets zstd
```

Closes #15499

show more ...

curl: --test-duphandle in debug builds runs "duphandled"

Using this option (only available in debug builds) makes curl always
call curl_easy_duphandle() on the handle before using it.

curl: --test-duphandle in debug builds runs "duphandled"

Using this option (only available in debug builds) makes curl always
call curl_easy_duphandle() on the handle before using it.

To help us catch curl_easy_duphandle() mistakes better.

Add a CI job using this.

Bonus: the previous runtests option -e is now also supported as
--test-event

Closes #15504

show more ...

macos: disable gcc `availability` workaround as needed

Homebrew gcc 14.2.0_1 fixed the issue, and the workaround is no longer
needed. Not only not needed, but the workaround is breaking

macos: disable gcc `availability` workaround as needed

Homebrew gcc 14.2.0_1 fixed the issue, and the workaround is no longer
needed. Not only not needed, but the workaround is breaking builds with
the fixed gcc.

Auto-detect the upstream fix and stop applying the local workaround if
detected.

Assisted-by: Bo Anderson
Ref: https://github.com/Homebrew/homebrew-core/issues/194778#issuecomment-2462764619
Follow-up to e91fcbac7d86292858718a0bfebad57978761af4 #14155
Closes #15508

show more ...

RELEASE-PROCEDURE.md: adjust release dates

Due to the calendar tweak with the pending patch release on December 11.