GHA: bump github/codeql-action and msys2/setup-msys2

- bump github/codeql-action from 3.25.13 to 3.25.15

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3

GHA: bump github/codeql-action and msys2/setup-msys2

- bump github/codeql-action from 3.25.13 to 3.25.15

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.13 to 3.25.15.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2d790406f505036ef40ecba973cc774a50395aac...afb54ba388a7dca6ecae48f608c4ff05ff4cc77a)

---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Closes #14300

- bump msys2/setup-msys2 from 2.23.0 to 2.24.0

Bumps [msys2/setup-msys2](https://github.com/msys2/setup-msys2) from 2.23.0 to 2.24.0.
- [Release notes](https://github.com/msys2/setup-msys2/releases)
- [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/msys2/setup-msys2/compare/d0e80f58dffbc64f6a3a1f43527d469b4fc7b6c8...5df0ca6cbf14efcd08f8d5bd5e049a3cc8e07fd2)

---
updated-dependencies:
- dependency-name: msys2/setup-msys2
dependency-type: direct:production
update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Closes #14301

show more ...

x509asn1: clean up GTime2str

Co-authored-by: Stefan Eissing
Reported-by: Dov Murik

Closes #14307

tool_operate: more defensive socket code

- use 'struct sockaddr' to getsockname() and its sa_family member

- use 'curl_socklen_t' instead of 'socklen_t'

- check for AF_INET

tool_operate: more defensive socket code

- use 'struct sockaddr' to getsockname() and its sa_family member

- use 'curl_socklen_t' instead of 'socklen_t'

- check for AF_INET6 to exist instead assuming it does

Should be generally more portable.

Reported-by: Harry Sintonen
Closes #14304

show more ...

configure: limit `__builtin_available` test to Darwin

This feature test always fails on non-Apple systems. (For Apple targets
it's supported by llvm and Apple clang.)

Syncs beha

configure: limit `__builtin_available` test to Darwin

This feature test always fails on non-Apple systems. (For Apple targets
it's supported by llvm and Apple clang.)

Syncs behaviour with CMake.

Follow-up to cfd6f43d6ca7e57670b422bab7bbf10221a2cf3e #14127
Cherry-picked from #14097
Closes #14196

show more ...

RELEASE-NOTES: synced

CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching

and add a few more see-also

Closes #14302

cmake: detect `libssh` via `pkg-config`

Also:
- fix broken libssh `pkg-config` behaviour on old Linux.
(when found, `LIBSSH_LINK_LIBRARIES` remains undefined.)

- delete ma

cmake: detect `libssh` via `pkg-config`

Also:
- fix broken libssh `pkg-config` behaviour on old Linux.
(when found, `LIBSSH_LINK_LIBRARIES` remains undefined.)

- delete manual libssh config from Old Linux CI job,
it's no longer necessary.

Closes #14199

show more ...

GHA/non-native: improve, migrate x86_64 FreeBSD with tests from Cirrus CI

- run tests via `make test-ci` instead of `make check` with autotools.
- add `x86_64` job for FreeBSD, with test

GHA/non-native: improve, migrate x86_64 FreeBSD with tests from Cirrus CI

- run tests via `make test-ci` instead of `make check` with autotools.
- add `x86_64` job for FreeBSD, with tests.
It matches the existing Cirrus CI job, with these differences:
- finishes 3x faster (thanks to parallel tests enabled).
- librtmp is not enabled because it's slated for removal by FreeBSD.
(already past the removal deadline, thought the package still
installs.)
- DICT and TELNET servers fail to start. Couldn't figure out why.
It means skipping test 1450 and 1452.
- it runs more tests, e.g. websockets and ip6-localhost.
- no `pkg update -f`.
- it misses the `CRYPTOGRAPHY_DONT_BUILD_RUST=1`, `pkg delete curl`,
`chmod 777`, `sudo -u nobody` and `sysctl net.inet.tcp.blackhole`
tricks. The latter is the default in these runners, the others did
not affect results.
- set `-j0` for tests in the NetBSD job. Flaky otherwise.

Closes #14244

show more ...

cmake: detect `nettle` when building with GnuTLS

`nettle` is a direct dependency of curl, when building with GnuTLS.
Add a new `Find` module to detect it.

Also:
- GHA/macos:

cmake: detect `nettle` when building with GnuTLS

`nettle` is a direct dependency of curl, when building with GnuTLS.
Add a new `Find` module to detect it.

Also:
- GHA/macos: drop `nettle` hack no longer necessary.
- add `nettle` to `libcurl.pc`.
- also add `nettle` to `libcurl.pc` in autotools builds.

Follow-up to 781242ffa44a9f9b95b6da5ac5a1bf6372ec6257 #11967
Closes #14285

show more ...

macos: fix Apple SDK bug workaround for non-macOS targets

Turns out that MAC != OSX, despite what these names otherwise mean and
what's suggested by source code comments. "MAC" in fact m

macos: fix Apple SDK bug workaround for non-macOS targets

Turns out that MAC != OSX, despite what these names otherwise mean and
what's suggested by source code comments. "MAC" in fact means Darwin
(aka Apple), not macOS. "OSX" means macOS.

GitHub bumped the macos-14 runner default to Xcode 15.4, hitting the
llvm@15 incompatibility bug by default. Meaning the previous workaround
for the SDK bug is necessary.

This patch extend the workaround to not apply to mobile OS variants.

Follow-up to ff784af461175584c73e7e2b65af00b1a5a6f67f #14159
Reported-by: Sergey
Confirmed-by: Marcel Raad
Fixes #14269
Closes #14275

show more ...

wolfssl: CA store share fix

When sharing the x509 store in wolfSSL, always use an explicitly
constructed one, as the SSLCTX might have "only" an internal one which
is not obeying ref

wolfssl: CA store share fix

When sharing the x509 store in wolfSSL, always use an explicitly
constructed one, as the SSLCTX might have "only" an internal one which
is not obeying reference count lifetimes.

Fixes #14278
Reported-by: Alex Snast
Closes #14279

show more ...

curl: support __ss_family use on NonStop platforms

The definition of sockaddr_storage incorrectly specifies the ss_family
field as __ss_family. This fix conditionally allows builds to su

curl: support __ss_family use on NonStop platforms

The definition of sockaddr_storage incorrectly specifies the ss_family
field as __ss_family. This fix conditionally allows builds to succeed on
all NonStop platforms.

Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca>

Closes #14273

show more ...

test993: list 1000 messages over POP3

Attempt to verify issue #14201

Closes #14297

connect: fix connection shutdown for event based processing

connections being shutdown would register sockets for events, but then
never remove these sockets again. Nor would the shutdow

connect: fix connection shutdown for event based processing

connections being shutdown would register sockets for events, but then
never remove these sockets again. Nor would the shutdown effectively
been performed.

- If a socket event involves a transfer, check if that is the
connection cache internal handle and run its multi_perform()
instead (the internal handle is used for all shutdowns).
- When a timer triggers for a transfer, check also if it is
about the connection cache internal handle.
- During processing shutdowns in the connection cache, assess
the shutdown timeouts. Register a Curl_expire() of the lowest
value for the cache's internal handle.

Reported-by: Gordon Parke
Fixes #14280
Closes #14296

show more ...

tests: provide FTP directory contents in the test file

Instead of providing a fixed single synthetic response in the test
server itself. To allow us to better use *different* directory l

tests: provide FTP directory contents in the test file

Instead of providing a fixed single synthetic response in the test
server itself. To allow us to better use *different* directory listings
in different test cases. In this change, most listings remain the same
as before.

The wildcard match tests still use synthetic responses but we should fix
that as well.

Updated numerous test cases to use this.

Closes #14295

show more ...

ftpserver.pl: make POP3 LIST serve content from the test file

instead of a fixed list in the test server.

Adjust test 853 accordingly.

Closes #14293

TODO: thread-safe sharing

CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe

Sharing of these between threads are apparently also not done safely.

Ref: #14290
Reported-by: Aki Sakurai
Cl

CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe

Sharing of these between threads are apparently also not done safely.

Ref: #14290
Reported-by: Aki Sakurai
Closes #14292

show more ...

RELEASE-NOTES: synced

os400: build cli manual.

Use PASE perl to run manual generation scripts.

As PASE perl is not aware of all possible input file encoding, convert
all files to UTF-8 upon build sta

os400: build cli manual.

Use PASE perl to run manual generation scripts.

As PASE perl is not aware of all possible input file encoding, convert
all files to UTF-8 upon build start (this might be lengthy).

OS/400 terminal emulation may only offer 76 columns, thus a new -c
parameter has been added to the managen program, defining the allowed
width.

If perl is not available, omit generation and disable online manual.

Closes #14289

show more ...

example/multi-uv: remove the use of globals

- shows how to pass on local variables (better)

- start the transfers nicer (with curl_multi_socket_action)

- consistent and hel

example/multi-uv: remove the use of globals

- shows how to pass on local variables (better)

- start the transfers nicer (with curl_multi_socket_action)

- consistent and helpful function naming - to better show what functions
and callbacks that are used for what

- build warning-free with gcc -W -Wall -pedantic

Closes #14287

show more ...

runtests: fold timing details with GHA, sync `-r` tflags

- move timing details into a foldable group when run in GitHub Actions.
Spec:
https://docs.github.com/en/actions/using-wo

runtests: fold timing details with GHA, sync `-r` tflags

- move timing details into a foldable group when run in GitHub Actions.
Spec:
https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#grouping-log-lines

- enable `-r` (run time stats) option in autotools' `test-ci` target,
syncing it with cmake.

Closes #14284

show more ...

GHA/windows: increase timeout for vcpkg build step [ci skip]

Examples:
https://github.com/curl/curl/actions/runs/10102112253/job/27937088909?pr=14274
https://github.com/curl/curl/act

GHA/windows: increase timeout for vcpkg build step [ci skip]

Examples:
https://github.com/curl/curl/actions/runs/10102112253/job/27937088909?pr=14274
https://github.com/curl/curl/actions/runs/10102112253/job/27937082353?pr=14274
https://github.com/curl/curl/actions/runs/10102112253/job/27937088478?pr=14274

show more ...

GHA/macos: update comment about default Xcode on macos-14 runner [ci skip]

New default since:
https://github.com/actions/runner-images/blob/releases/macos-14-arm64/20240722/images/macos/

GHA/macos: update comment about default Xcode on macos-14 runner [ci skip]

New default since:
https://github.com/actions/runner-images/blob/releases/macos-14-arm64/20240722/images/macos/macos-14-arm64-Readme.md

show more ...

os400: workaround an IBM ASCII run-time library bug

IBM-provided ASCII function puts() does not output an expected trailing
newline: emulate the correct behavior using other functions.

os400: workaround an IBM ASCII run-time library bug

IBM-provided ASCII function puts() does not output an expected trailing
newline: emulate the correct behavior using other functions.

Closes #14281

show more ...