OS400: fix shellcheck warnings in scripts

- use `$()` instead of backticks, and re-arrange double-quotes inside.
- add missing `|| exit 1` to `cd` calls. (could be dropped by using `set

OS400: fix shellcheck warnings in scripts

- use `$()` instead of backticks, and re-arrange double-quotes inside.
- add missing `|| exit 1` to `cd` calls. (could be dropped by using `set -eu`.)
- add `-n` to a few `if`s.
- shorten redirections by using `{} >` (as shellcheck recommended).
- silence warnings where variables were detected as unused (SC2034).
- a couple misc updates to silence warnings.
- switch to bash shebang for `-ot` feature.
- split two lines to unbreak syntax highlighting in my editor. (`$(expr \`, `$(dirname \`)

Also enable CI checks for OS/400 shell scripts.

Ref: #13307
Closes #13309

show more ...

lib: add Curl_xfer_write_resp_hd

Add method in protocol handlers to allow writing of a single,
0-terminated header line. Avoids parsing and copying these lines.

Closes #13165

llist: add Curl_llist_append()

- use for better readability in all places where the "insert_next"
actually performs an append to the list
- add some tests in unit1300

Clos

llist: add Curl_llist_append()

- use for better readability in all places where the "insert_next"
actually performs an append to the list
- add some tests in unit1300

Closes #13336

show more ...

gnutls: lazy init the trust settings

- delay loading of trust anchors and CRLs after the ClientHello
has been sent off
- add tracing to IO operations
- on IO errors, return the

gnutls: lazy init the trust settings

- delay loading of trust anchors and CRLs after the ClientHello
has been sent off
- add tracing to IO operations
- on IO errors, return the CURLcode of the underlying filter

Closes #13339

show more ...

http_negotiate: fix `CURL_DISABLE_PROXY` build

`proxyuserpwd` was removed from `dynamically_allocated_data` in commit
f46385d36df.

Closes https://github.com/curl/curl/pull/13334

quic: fixup duplicate static function name (for cmake unity)

Visible in daily curl-for-win builds:
https://github.com/curl/curl-for-win/actions/runs/8621925870

```
lib/vquic

quic: fixup duplicate static function name (for cmake unity)

Visible in daily curl-for-win builds:
https://github.com/curl/curl-for-win/actions/runs/8621925870

```
lib/vquic/curl_ngtcp2.c:1916:12: error: redefinition of 'ossl_new_session_cb'
static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
^
lib/vtls/openssl.c:2978:12: note: previous definition is here
static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
^
```
https://github.com/curl/curl-for-win/actions/runs/8621925870/job/23631885439#step:3:6965

Follow-up to 3210101088dfa3d6a125d213226b092f2f866722 #13172
Closes #13332

show more ...

appveyor: make VS2010 job build-only, enable Schannel, fix compiler warnings

Tests were consistently flaky for a while.

Also fix compiler warnings in `CertOpenStore()` calls for old

appveyor: make VS2010 job build-only, enable Schannel, fix compiler warnings

Tests were consistently flaky for a while.

Also fix compiler warnings in `CertOpenStore()` calls for old MSVC compilers:
```
C:/projects/curl/lib/vtls/schannel.c(688):
warning C4306: 'type cast' : conversion from 'int' to 'LPCSTR' of greater size
C:/projects/curl/lib/vtls/schannel_verify.c(642):
warning C4306: 'type cast' : conversion from 'int' to 'LPCSTR' of greater size
```
Ref: https://ci.appveyor.com/project/curlorg/curl/builds/49580310/job/ywu2y44kymgc0nif#L106

Closes #13330

show more ...

projects: drop MSVC project files for recent versions

We encourage users to generate visual studio project files using CMake.

We keep project files in git for ancient visual studio

projects: drop MSVC project files for recent versions

We encourage users to generate visual studio project files using CMake.

We keep project files in git for ancient visual studio versions that
cmake cannot generate files for, but we no longer ship the project files
in the tarballs.

appveyor: switch VisualStudioSolution job to VC12 (Visual Studio 2013)

Co-Authored-by: Viktor Szakats
Co-Authored-by: Jay Satiro

Closes #13311

show more ...

cmake: use namespaced custom target names

Rename custom target to namespaced (unique) names to avoid colliding
with 3rd-party projects (e.g. libzip) built together with curl.

Re

cmake: use namespaced custom target names

Rename custom target to namespaced (unique) names to avoid colliding
with 3rd-party projects (e.g. libzip) built together with curl.

Reported-by: hammlee96 on github
Fixes #13324
Closes #13326

show more ...

appveyor: re-enable OpenSSL 3, bump to 3.2.1

Ref: b62454a875d70f93ab5347c050903596feb45a23 #13266
Closes #13329

CI: upgrade openssl version to 3.3.0 for openssl-quic

Closes #13328

RELEASE-NOTES: synced

Bump to 8.8.0-DEV

curl_multi_waitfds.md: add protocol mention

Follow-up to 02beac6bb6b

lib: add curl_multi_waitfds

New function call, similar to curl_multi_fdset()

Closes #13135

dist: verify tarball reproducibility in CI

Closes #13327

tests: stabilitze test_02_23*

- h2-download now always opens the output file on first write callback
invocation, if it will pause the transfer or not.
- Checks on output files then

tests: stabilitze test_02_23*

- h2-download now always opens the output file on first write callback
invocation, if it will pause the transfer or not.
- Checks on output files then does not depend on the amount of data curl
has collected for the first write.

Closes #13323

show more ...

tls: fix compile issues on old-linux CI

Follow-up to 3210101088dfa
Closes #13325

dist: add reproducible dir entries to tarballs

In the initial implementation of reproducible tarballs, they were
missing directory entries, while .zip archives had them. It meant
tha

dist: add reproducible dir entries to tarballs

In the initial implementation of reproducible tarballs, they were
missing directory entries, while .zip archives had them. It meant
that on extracting the tarball, on-disk directory entries got the
current timestamp.

This patch fixes this by including directory entries in the tarball,
with reproducible timestamps. It also moves sorting inside tar,
to ensure reproducible directory entry timestamps on extract
(without the need of `--delay-directory-restore` option, when
extracting with GNU tar. BSD tar got that right by default.)

GNU tar 1.28 (2014-07-28) introduced `--sort=`.

Ref: https://github.com/curl/curl/pull/13299#discussion_r1555957350
Follow-up to 860cd5fc2dc8e165fadd2c19a9b7c73b3ae5069d #13299
Closes #13322

show more ...

tls: use shared init code for TCP+QUIC

Closes #13172

.mailmap: update Gisle's preferred email

doc: pytest `--repeat` -> `--count`

Pytest doesn't have a `--repeat` option, but it does have a `--count`
option.

```
--count=COUNT Number of times to repeat each te

doc: pytest `--repeat` -> `--count`

Pytest doesn't have a `--repeat` option, but it does have a `--count`
option.

```
--count=COUNT Number of times to repeat each test
```

Closes #13218

show more ...

src/Makefile.am: access curl.txt using a relative path, not abs

... to make it work when mounted using different mount points. Like when
generated/used inside and outside of a docker ima

src/Makefile.am: access curl.txt using a relative path, not abs

... to make it work when mounted using different mount points. Like when
generated/used inside and outside of a docker image.

Closes #13320

show more ...

build: remove MacOSX-Framework script

I don't think this is much used these days.

Also remove the libcurl.plist file used (only) by this script

Closes #13313

release-tools.sh: store the timestamp and release tag too

When maketgz invokes this script to generate the docs/RELEASE-TOOLS.md
file that gets bundled in the release, it now also passes

release-tools.sh: store the timestamp and release tag too

When maketgz invokes this script to generate the docs/RELEASE-TOOLS.md
file that gets bundled in the release, it now also passes on the exact
timestamp and version number so that those details also get mentioned in
the document. They will help users reproduce an identical tarball.

Closes #13319

show more ...

GHA: disable permissions where missing

Reviewed-by: Daniel Stenberg
Closes #13306