runtests: add comment for handle64 pathsep requirement [ci skip]

Cherry-picked from #14949

setopt_cptr: make overflow check only done when needed

An overflow check for if the value of a curl_off_t is larger than a
size_t can hold, is only necessary if the two types are actuall

setopt_cptr: make overflow check only done when needed

An overflow check for if the value of a curl_off_t is larger than a
size_t can hold, is only necessary if the two types are actually
differently sized, now checked by the preprocessor. To avoid
"Unreachable Conditional".

Closes #15439

show more ...

GHA/windows: avoid curl.exe libtool wrapper

Avoid the `curl.exe` wrapper binary created by libtool, and run the real
`curl.exe` directly for tests and version information.

This

GHA/windows: avoid curl.exe libtool wrapper

Avoid the `curl.exe` wrapper binary created by libtool, and run the real
`curl.exe` directly for tests and version information.

This solution was used in Azure jobs. I missed it when migrating jobs
to GHA.

Applies to tests run in the `mingw, AM x86_64 c-ares U` job, which has
seen unexplained flakiness.

Ref: 354afc891df4b60b8017fc5d35a05daedb2cd812 #6049
Follow-up to e53523fef07894991c69d907a7c7794c7ada4ff4 #14859

Closes #15437

show more ...

runtests: pass single backslashes with Windows Perl

handle/handle64 requires a literal match with the filenames it's
listing.

Also:
- make handle64 log messages more unique

runtests: pass single backslashes with Windows Perl

handle/handle64 requires a literal match with the filenames it's
listing.

Also:
- make handle64 log messages more unique to help text searches.
- update a comment with Windows Perl info.

Cherry-picked from #14949
Closes #15436

show more ...

src/lib: remove redundant ternary operators

Closes #15435

lib: msnprintf tidy-ups

doh: avoid an msnprintf()

openssl: skip a superfluous return code check

Closes #15434

tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED

That error code was introduced and has been used for OpenSSL ENGINE
things and not others, so switch the other use cases over to other TLS

tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED

That error code was introduced and has been used for OpenSSL ENGINE
things and not others, so switch the other use cases over to other TLS
related error codes.

Closes #15430

show more ...

RELEASE-NOTES: synced

tests/http: add --insecure tests

Add two test cases that connection using a hostname the server has no
certificate for. First, verify that the peer verification fail, as
expected. Se

tests/http: add --insecure tests

Add two test cases that connection using a hostname the server has no
certificate for. First, verify that the peer verification fail, as
expected. Second, provide '--insecure' to test that the connection
succeeded and returned some data.

Closes #15429

show more ...

tests/scorecard: allow remote server test

New args for scorecard.py:
* --remote ip:port to run tests against a remote server
* --start-only: to only start the servers, listing their

tests/scorecard: allow remote server test

New args for scorecard.py:
* --remote ip:port to run tests against a remote server
* --start-only: to only start the servers, listing their ports

Start the server using "scorecard.py --start-only" on one machine and
then run the tests with "scorecard.py --remote ip:port" against that
machine.

Closes #15415

show more ...

CI: bump wolfSSH and wolfSSL

- wolfSSH 1.4.18
- wolfSSL 5.7.4

Closes #15427

tool_getparam: drop unused time() call

The second argument to curl_getdate() once took a time argument, but
that feature has been gone for decades, thus passing in a date there
makes

tool_getparam: drop unused time() call

The second argument to curl_getdate() once took a time argument, but
that feature has been gone for decades, thus passing in a date there
makes no difference.

Closes #15420

show more ...

appveyor: fix job names, tidy-up

- add 'Shared' to job names where missing.
- dedupe setting the default `HTTP_ONLY` env.
- fix typo in job name.

Cherry-picked from #15414

appveyor: fix job names, tidy-up

- add 'Shared' to job names where missing.
- dedupe setting the default `HTTP_ONLY` env.
- fix typo in job name.

Cherry-picked from #15414
Closes #15422

show more ...

cmake: tweaks around debug mode and hidden symbols

- emit warning for `ENABLE_DEBUG` builds.

- add words to clarify that `ENABLE_DEBUG` is meant for developing curl
itself.

cmake: tweaks around debug mode and hidden symbols

- emit warning for `ENABLE_DEBUG` builds.

- add words to clarify that `ENABLE_DEBUG` is meant for developing curl
itself.

- add comment saying `CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS=ON`
CMake option may export extra, non-curl symbols.
Ref: https://github.com/microsoft/vcpkg/issues/41761
Unexplained exports seen also in curl CI:
```
[ 742] _tcschr
[ 743] _tcsncmp
[ 744] _tcsncpy
[ 745] _tcspbrk
```
https://ci.appveyor.com/project/curlorg/curl/builds/50864041/job/lolledrg4h7hu6e4?fullLog=true#L2160
CMake extracts these symbols from `.obj` files:
https://gitlab.kitware.com/cmake/cmake/-/issues/22092#note_943718
I have not found any new MSVC option that helps fixing this without
decorating all functions in-source or maintaining a manual list of
internal function names used for tests:
https://learn.microsoft.com/cpp/build/reference/wholearchive-include-all-library-object-files

Closes #15414

show more ...

build: disable warning `-Wunreachable-code-break`

This warning remains silent in unity builds. Since we're using unity
in CI for most jobs, warnings remain undetected there.
Disable

build: disable warning `-Wunreachable-code-break`

This warning remains silent in unity builds. Since we're using unity
in CI for most jobs, warnings remain undetected there.
Disable them for all builds to avoid a surprise warning outside our CI.

The issue caught by the warning is useful for a tidy codebase, but
doesn't affect executed code. It was enabled in
84338c4de2d7c798e3c270c9610d51a4ad18a90b #12331 (2023-11-15).

llvm source: https://github.com/llvm/llvm-project/blob/fee2953f23bd8a8a71e574e6a8db08033778d3a4/clang/lib/Sema/AnalysisBasedWarnings.cpp#L125-L134
llvm issue: https://github.com/llvm/llvm-project/issues/71046

Follow-up to 7c023c3f6e2c454fbac7277d8dc038854c192d72 #15384
Closes #15416

show more ...

multi: split multi_runsingle into sub functions

Introduce five functions named after the state they serve:

- state_connect for MSTATE_CONNECT
- state_do for MSTATE_DO
- stat

multi: split multi_runsingle into sub functions

Introduce five functions named after the state they serve:

- state_connect for MSTATE_CONNECT
- state_do for MSTATE_DO
- state_performing for MSTATE_PERFORMING
- state_ratelimiting for MSTATE_RATELIMITING
- state_resolving for MSTATE_RESOLVING

Closes #15418

show more ...

lib: remove Curl_ prefix from static functions

'Curl_' is a prefix used for library global functions (cross-files).
Static functions should thus not use it.

Closes #15419

docs: clarify FTP over HTTP proxy functionality somewhat

Reported-by: newfunction

Closes #15417

cmake: fix missing spacing in log message

Follow-up to e89491e1f015bab8b4050ed73d1cedc17419336f #15337
Closes #15411

cmake: clear package version after `pkg-config` detection

`pkg_check_modules()` seems to leave `<PACKAGE>_VERSION` defined with an
empty value, if the package is not found.

When

cmake: clear package version after `pkg-config` detection

`pkg_check_modules()` seems to leave `<PACKAGE>_VERSION` defined with an
empty value, if the package is not found.

When the package is also not found in the fallback branch,
`find_package_handle_standard_args()` logs and error message. In this
message it includes the bogus empty value as: `(found version "")`:
```
Could NOT find Libssh2 (missing: LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY) (found version "")
```
https://github.com/curl/curl/actions/runs/11509727553/job/32040378958?pr=15408#step:31:99

Clear the version number to avoid the confusion:
```
Could NOT find Libssh2 (missing: LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
```
https://github.com/curl/curl/actions/runs/11510022503/job/32041149129?pr=15408#step:31:99

Seen with CMake v3.30.5.

Follow-up to 7bab201abe3915a0167c002f9308950cb8a06e4b #15193
Closes #15409

show more ...

INSTALL-CMAKE: fix punctuation and a typo [ci skip]

cmake: document `-D` and env build options

Extend `INSTALL-CMAKE` document with the list of available options,
a short description and default values.

The list may not be 100% c

cmake: document `-D` and env build options

Extend `INSTALL-CMAKE` document with the list of available options,
a short description and default values.

The list may not be 100% complete.

There are no component boundaries in CMake, so the line is blurry
between curl options, CMake options, CMake Find modules options.
I included certain CMake options that seemed useful, and/or have
dedicated use withing curl's CMake source. But, all CMake built-in
options are usable, as documented upstream in CMake.

The naming of the options has a heritage and the inconsistencies with
it, including a lack of clear namespace. This may be subject to future
updates, also after figuring out which name has special meaning within
CMake and/or CMake projects out of unwritten convention or something
more tangible.

CMake allows to initialize any internal variable via `-D`. This may be
useful to pre-initialize/override feature check results. The list
doesn't contain these, and they remain officially undocumented.

Also:
- make adjustments to keep the spellchecker happy.
- retrofit description changes to the cmake sources.
- stop documenting deprecated `Find*` variables.

Reported-by: Daniel Stenberg
Fixes https://github.com/curl/curl/discussions/14885
Closes #15388

show more ...

cmake: mark as advanced some internal Find* variables

To sync with other similar variables and hide them from cmake UIs.

Follow-up to 7bab201abe3915a0167c002f9308950cb8a06e4b #15193

cmake: mark as advanced some internal Find* variables

To sync with other similar variables and hide them from cmake UIs.

Follow-up to 7bab201abe3915a0167c002f9308950cb8a06e4b #15193
Closes #15407

show more ...

cmake: tidy up and shorten symbol hiding initialization

- drop redundant local variables.

- drop extra Intel C feature check that always returned success due
to not passing th

cmake: tidy up and shorten symbol hiding initialization

- drop redundant local variables.

- drop extra Intel C feature check that always returned success due
to not passing the tested compiler option. Nobody reported an issue
with this since 2016, suggesting the version check alone is enough.

Closes #15400

show more ...

cmake: tidy up picky warning initialization

- use CMake 3.12 syntax when available, in clang-cl branch.
Follow-up to e89491e1f015bab8b4050ed73d1cedc17419336f #15337

- rename i

cmake: tidy up picky warning initialization

- use CMake 3.12 syntax when available, in clang-cl branch.
Follow-up to e89491e1f015bab8b4050ed73d1cedc17419336f #15337

- rename internal variables to underscore-lowercase.
Follow-up to d8de4806e1463f589a1b54de1da7d6396de94d11 #14571

- update comment.

Closes #15404

show more ...