dmaketgz: accept a SOURCE_DATE_EPOCH as an second argument

to make it easier to reproduce a tarball

Closes #13573

RELEASE-NOTES: synced

h3/ngtcp2: improve error handling

- identify ngtcp2 and nghttp3 error codes that are fatal
- close quic connection on fatal errors
- refuse further filter operations once connection

h3/ngtcp2: improve error handling

- identify ngtcp2 and nghttp3 error codes that are fatal
- close quic connection on fatal errors
- refuse further filter operations once connection is closed
- confusion about the nghttp3 API. We should close the QUIC stream on
cancel and not use the nghttp3 calls intended to be invoked when the
QUIC stream was closed by the peer.

Closes #13562

show more ...

docs: fix some CURLINFO examples

- improve getinfo result check for example sections:
CURLINFO_ACTIVESOCKET, CURLINFO_LASTSOCKET, CURLINFO_SSL_VERIFYRESULT,
CURLINFO_PROXY_SSL_VE

docs: fix some CURLINFO examples

- improve getinfo result check for example sections:
CURLINFO_ACTIVESOCKET, CURLINFO_LASTSOCKET, CURLINFO_SSL_VERIFYRESULT,
CURLINFO_PROXY_SSL_VERIFYRESULT

- fix getinfo result check for example sections:
CURLINFO_NUM_CONNECTS, CURLINFO_OS_ERRNO

- fix verify result check for example sections:
CURLINFO_PROXY_SSL_VERIFYRESULT

Bug: https://github.com/curl/curl/discussions/13557#discussion-6625507
Reported-by: farazrbx@users.noreply.github.com

Closes https://github.com/curl/curl/pull/13559

show more ...

KNOWN_BUGS: gssapi library name + version is missing in curl_version_info()

Closes #13492
Closes #13570

krb5: use dynbuf

Closes #13568

managen: fix the option sort order

... it used to strip off the .d file extension to sort correctly but
ever since the extension changed to .md the operation failed and the
sort got

managen: fix the option sort order

... it used to strip off the .d file extension to sort correctly but
ever since the extension changed to .md the operation failed and the
sort got wrong.

Follow-up to 2494b8dd5175cee7f2e

Closes #13567

show more ...

GHA: repair the linux-old job

package libc6_2.28-10+deb10u2_amd64.deb changed to
libc6_2.28-10+deb10u3_amd64.deb

Closes #13564

appveyor: make gcc 6 mingw64 job build-only

This job has proven to be the flakiest of all, and it's also the oldest
Windows runner we had tests running on: 'Visual Studio 2015', that is

appveyor: make gcc 6 mingw64 job build-only

This job has proven to be the flakiest of all, and it's also the oldest
Windows runner we had tests running on: 'Visual Studio 2015', that is
running on Windows Server 2012 R2:
https://www.appveyor.com/docs/windows-images-software/

Turn off tests on this job to help stabilizing CI runs.

This was also one of the slowest running job amongst the AppVeyor CI ones.

Flakiness data:
https://testclutch.curl.se/static/reports/summary.html
Entries:
Appveyor / CMake, mingw-w64, gcc 6, Debug, x86, Schannel, Static, no-unity (curl) [current]
Appveyor / CMake, mingw-w64, gcc 6, Debug, x86, Schannel, Static (curl) [former]

Closes #13566

show more ...

unit2604: use alloc instead of overlong string const

Closes #13563

bufq: remove duplicate word in comment

Inspired by 13552.

Closes: #13554
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

lib/cf-h1-proxy: silence compiler warnings (gcc 14)

They came up ealier with gcc 12 (Windows), but apparently gcc 14 is
still reporting them, also under Linux.

```
/home/run

lib/cf-h1-proxy: silence compiler warnings (gcc 14)

They came up ealier with gcc 12 (Windows), but apparently gcc 14 is
still reporting them, also under Linux.

```
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c: In function 'cf_h1_proxy_close':
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:1060:17: warning: null pointer dereference [-Wnull-dereference]
1060 | cf->connected = FALSE;
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:1061:8: warning: null pointer dereference [-Wnull-dereference]
1061 | if(cf->ctx) {
| ~~^~~~~
In function 'tunnel_free',
inlined from 'cf_h1_proxy_destroy' at /home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:1053:3:
/home/runner/work/curl-for-win/curl-for-win/curl/lib/cf-h1-proxy.c:198:27: warning: null pointer dereference [-Wnull-dereference]
198 | struct h1_tunnel_state *ts = cf->ctx;
| ^~
```
Ref: https://github.com/curl/curl-for-win/actions/runs/8985369476/job/24679219528#step:3:6320

Fixes #13237
Closes #13555

show more ...

mbedtls: support TLS 1.3

Closes #13539

version: use msnprintf instead of strncpy

- to ensure a terminating null byte
- to avoid zero-padding the target

debug code only

Closes #13549

curl_path: make Curl_get_pathname use dynbuf

... instead of malloc and memcpy

- unit test 2604 verifies Curl_get_pathname()

Closes #13550

lib: make protocol handlers store scheme name lowercase

- saves a lowercase operation when the "[scheme]_proxy" name is
generated
- appears less "shouting"
- update test 970, 9

lib: make protocol handlers store scheme name lowercase

- saves a lowercase operation when the "[scheme]_proxy" name is
generated
- appears less "shouting"
- update test 970, 972, 1438 and 1536

Closes #13553

show more ...

lib: remove two instances of "only only" messages

Fixes #13551
Reported-by: Lucas Nussbaum
Closes #13552

asyn-thread: fix curl_global_cleanup crash in Windows

- Make sure that asynchronous resolves handled by Winsock are stopped
before WSACleanup is called.

This is implemented by

asyn-thread: fix curl_global_cleanup crash in Windows

- Make sure that asynchronous resolves handled by Winsock are stopped
before WSACleanup is called.

This is implemented by ensuring that when Curl_resolver_kill is called
(eg via multi_done) it will cancel the Winsock asynchronous resolve and
wait for the cancellation to complete. Winsock runs the asynchronous
completion routine immediately when a resolve is canceled.

Prior to this change it was possible that during curl_global_cleanup
"a DNS resolver thread created by GetAddrInfoExW did not terminate yet,
however curl is already shutting down, deinitializing Winsock with
WSACleanup() leading to an access violation."

Background:

If libcurl is built with the asynchronous threaded resolver option for
Windows then it resolves in one of two ways. For Windows 8.1 and later,
libcurl resolves by using the Winsock asynchronous resolver which does
its own thread management. For older versions of Windows, libcurl
resolves by creating a separate thread that calls getaddrinfo. This
change only affects the former and it's already handled for the latter.

Reported-by: Ch40zz@users.noreply.github.com

Fixes https://github.com/curl/curl/issues/13509
Closes https://github.com/curl/curl/pull/13518

show more ...

asyn-thread: fix Curl_thread_create result check

- Compare to curl_thread_t_null instead of 0 for error.

Currently for both supported thread libraries (pthreads and Windows)
cur

asyn-thread: fix Curl_thread_create result check

- Compare to curl_thread_t_null instead of 0 for error.

Currently for both supported thread libraries (pthreads and Windows)
curl_thread_t_null is defined as 0. However, the pattern throughout the
code is to check against curl_thread_t_null and not 0 since for
posterity some thread library may not use 0 for error.

Closes https://github.com/curl/curl/pull/13542

show more ...

curl_multibyte: remove access() function wrapper for Windows

- Remove curlx_win32_access() which was a wrapper to use access() in
Windows.

This is a follow-up to 602fc213, one

curl_multibyte: remove access() function wrapper for Windows

- Remove curlx_win32_access() which was a wrapper to use access() in
Windows.

This is a follow-up to 602fc213, one of two commits which removed
access() calls from the codebase and banned use of the function.

Closes https://github.com/curl/curl/pull/13529

show more ...

tls: Remove EXAMPLEs from deprecated options

CURLOPT_EGDSOCKET and CURLOPT_RANDOM_FILE are both completely dead
so remove their example sections since the code there is useless.
Ther

tls: Remove EXAMPLEs from deprecated options

CURLOPT_EGDSOCKET and CURLOPT_RANDOM_FILE are both completely dead
so remove their example sections since the code there is useless.
There is still a way to inject a random file for OpenSSL older than
1.1.0 but it's not what the example showed (and it's not even done
with this option) so we refrain from documenting it here.

Closes: #13540
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...

tests: Only require EXAMPLE for non-deprecated options

Manpages which document deprecated CURLOPT_ or CURLINFO_ are not
required to have an EXAMPLE section since they might effectively

tests: Only require EXAMPLE for non-deprecated options

Manpages which document deprecated CURLOPT_ or CURLINFO_ are not
required to have an EXAMPLE section since they might effectively
be dead no-ops which we don't want to trick users into believing
they can use by copying example code.

Closes: #13540
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...

EXPERIMENTAL: add graduation requirements for each feature

Starting now, experimental features should have a set of documentated
requirements of what is needed for the feature to graduat

EXPERIMENTAL: add graduation requirements for each feature

Starting now, experimental features should have a set of documentated
requirements of what is needed for the feature to graduate.

This adds requirements to all existing experiments.

Closes #13541

show more ...

misc: fix typos, quoting and spelling

Fix wording of comments, and misquotings where `' is markdown parsed
where it shouldn't be, and remove a misspelled preprocessor comment
which r

misc: fix typos, quoting and spelling

Fix wording of comments, and misquotings where `' is markdown parsed
where it shouldn't be, and remove a misspelled preprocessor comment
which really isn't needed (and removing it makes it match surrounding
code better).

Closes: #13538
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

show more ...

tests: Mark tftpd timer function as noreturn

This avoids the below compiler warning:

tftpd.c:280:1: warning: function 'timer' could be declared with
attribute 'noreturn' [-W

tests: Mark tftpd timer function as noreturn

This avoids the below compiler warning:

tftpd.c:280:1: warning: function 'timer' could be declared with
attribute 'noreturn' [-Wmissing-noreturn]

Closes: #13534
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

show more ...