macos: disable gcc `availability` workaround as needed

Homebrew gcc 14.2.0_1 fixed the issue, and the workaround is no longer
needed. Not only not needed, but the workaround is breaking

macos: disable gcc `availability` workaround as needed

Homebrew gcc 14.2.0_1 fixed the issue, and the workaround is no longer
needed. Not only not needed, but the workaround is breaking builds with
the fixed gcc.

Auto-detect the upstream fix and stop applying the local workaround if
detected.

Assisted-by: Bo Anderson
Ref: https://github.com/Homebrew/homebrew-core/issues/194778#issuecomment-2462764619
Follow-up to e91fcbac7d86292858718a0bfebad57978761af4 #14155
Closes #15508

show more ...

RELEASE-PROCEDURE.md: adjust release dates

Due to the calendar tweak with the pending patch release on December 11.

cmake: drop cmake args list from `buildinfo.txt`

Collecting the args list has the undesired side-effect of silencing
CMake warnings about unused variables passed via the command-line.

cmake: drop cmake args list from `buildinfo.txt`

Collecting the args list has the undesired side-effect of silencing
CMake warnings about unused variables passed via the command-line.

Drop it till a better method is found to retrieve them.

Reported-by: Kai Pastor
Ref: https://github.com/curl/curl/pull/14936#issuecomment-2460350977
Follow-up to 1fdea1684602a1ae2870c67b5f3e8fd34f63da95 #14802
Closes #15501

show more ...

GHA/macos: let gcc dictate the configured Apple SDK

As discovered earlier, Homebrew gcc is built against a specific Apple
SDK version and doesn't work when matched up with a different ve

GHA/macos: let gcc dictate the configured Apple SDK

As discovered earlier, Homebrew gcc is built against a specific Apple
SDK version and doesn't work when matched up with a different version,
e.g. the one advertised as default by the macos runner image.

Before this patch this was resolved with brute force by zapping the
hack-layer gcc component to avoid the bad interference. This worked
for us, but it's fragile, accidental and doesn't translate to
real-world build environments. Thus, impractical.

Avoid this by explicitly selecting the SDK version gcc was built for and
meant to be used with, as shown by `gcc --print-sysroot`.

It assumes that the gcc binaries preinstalled on the runner images
always ship with the SDK version they reference. It also assumes
this works with and without `brew update`.

Also:
- add 4 quick build-only jobs to test all gcc/macos combos.
- list SDKs offered via CommandLineTools.

Suggested-by: Bo Anderson
Ref: https://github.com/Homebrew/homebrew-core/issues/194778#issuecomment-2462764619

Follow-up to c349bd668c91f2484ae21c0f361ddf497143093c #14097
Closes #15518

show more ...

GHA: add `apt update` where missing

To mitigate this kind of (repeat) errors:
```
Err:14 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 python3-werkzeug all 3.0.1-3u

GHA: add `apt update` where missing

To mitigate this kind of (repeat) errors:
```
Err:14 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 python3-werkzeug all 3.0.1-3ubuntu0.1
404 Not Found [IP: 40.81.13.82 80]
E: Failed to fetch http://azure.archive.ubuntu.com/ubuntu/pool/main/p/python-werkzeug/python3-werkzeug_3.0.1-3ubuntu0.1_all.deb
Fetched 10.4 MB in 4s (2593 kB/s)
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
```
https://github.com/curl/curl/actions/runs/11732257460/job/32684111508#step:3:74

Follow-up to 842f88434f627c0330e263a3881b2d9438786b32 #15082
Closes #15519

show more ...

TODO: consider OCSP stapling by default

Suggested-by: Nicolas F.
Closes #15483
Closes #15521

vtls: fix compile warning when ALPN is not available

Ref: https://curl.se/mail/lib-2024-11/0013.html

Closes #15515

cmdline/ech.md: formatting cleanups

Reported-by: Samuel Henrique
Fixes #15506
Closes #15517

netrc: support large file, longer lines, longer tokens

Regression from 3b43a05e000aa8f6 (shipped in 8.11.0)

Reported-by: Moritz
Fixes #15513
Closes #15514

setopt: fix CURLOPT_HTTP_CONTENT_DECODING

Regression from 30da1f5974d34841b30c4f (shipped in 8.11.0)

Fixes #15511
Closes #15510

RELEASE-NOTES: synced

Bump to 8.11.1

mbedtls: call psa_crypt_init() in global init

Run mbedtls' psa_crypt_init() in the general global init, optionally
protected by mbedtls locks when available.

CI: when building m

mbedtls: call psa_crypt_init() in global init

Run mbedtls' psa_crypt_init() in the general global init, optionally
protected by mbedtls locks when available.

CI: when building mbedtls, enabled thread safety

Reported-by: wxiaoguang on github
Fixes #15500
Closes #15505

show more ...

duphandle: also init netrc

The netrc init was only done in the Curl_open, meaning that a duplicated
handle would not get inited properly.

Added test 2309 to verify. It does netr

duphandle: also init netrc

The netrc init was only done in the Curl_open, meaning that a duplicated
handle would not get inited properly.

Added test 2309 to verify. It does netrc auth with a duplicated handle.

Regression from 3b43a05e000aa8f65bda513f733a

Reported-by: tranzystorekk on github
Fixes #15496
Closes #15503

show more ...

cookie: treat cookie name case sensitively

Extend test 31 to verify

Reported-by: delogicsreal on github
Fixes #15492
Closes #15493

RELEASE-NOTES: synced

Release time

THANKS: contributors from the 8.11.0 release

GHA/non-native: fix installing OpenLDAP on OpenBSD

Also:
- drop failing manual install of perl. It's there by default now.
- add link to OpenBSD package management FAQ page.

GHA/non-native: fix installing OpenLDAP on OpenBSD

Also:
- drop failing manual install of perl. It's there by default now.
- add link to OpenBSD package management FAQ page.

Closes #15491

show more ...

GHA/macos: drop WebSockets from job names

It's enabled in all jobs by default now.

Follow-up to cd63629733895c273b5ece82483d37114355f2ce #15076

RELEASE-NOTES: update cmake LDAP-related entry [ci skip]

Reported-by: Kai Pastor
Bug: https://github.com/curl/curl/pull/15255#issuecomment-2457558219
Follow-up to 2c90f7f69e117543a9f

RELEASE-NOTES: update cmake LDAP-related entry [ci skip]

Reported-by: Kai Pastor
Bug: https://github.com/curl/curl/pull/15255#issuecomment-2457558219
Follow-up to 2c90f7f69e117543a9f0102bb89112125f0032bd #15255

show more ...

mbedtls: remove failf() use from mbedtls_random

Since data can be NULL in here, calling failf() can be bad. This should
also be a terribly rare error so the lack of error message for thi

mbedtls: remove failf() use from mbedtls_random

Since data can be NULL in here, calling failf() can be bad. This should
also be a terribly rare error so the lack of error message for this
should be manageable.

Reported-by: wxiaoguang on github
Fixes #15485
Closes #15486

show more ...

wolfssl: coexist with openssl, further work

Build wolfSSL master with

./configure --prefix=/path --enable-ip-alt-name --enable-quic
--enable-earlydata --enable-psk --enable-open

wolfssl: coexist with openssl, further work

Build wolfSSL master with

./configure --prefix=/path --enable-ip-alt-name --enable-quic
--enable-earlydata --enable-psk --enable-opensslcoexist

and configure curl with openssl + wolfssl. Normal tests run.

pytest session resumption fails, as wolfssl does not handle the
new_session callback without opensslextra right now.

Closes #15481

show more ...

RELEASE-NOTES: synced

wolfssl: no more use of the OpenSSL API

Allows curl to build with a wolfSSL built without its OpenSSL API.

It should allow curl to (soon?) build with *both* wolfSSL and OpenSSL

wolfssl: no more use of the OpenSSL API

Allows curl to build with a wolfSSL built without its OpenSSL API.

It should allow curl to (soon?) build with *both* wolfSSL and OpenSSL

This change makes curl use its own sha256 implementaion when built with
wolfSSL: room for improvement.

Closes #15480

show more ...

ci: update dependency wolfSSL/wolfssh to v1.4.19

Closes #15476

openssl: extend the OpenSSL error messages

Previously there were three error situations that only added the (unhelpful)
OpenSSL error strings, now we prefix those with a short explanatio

openssl: extend the OpenSSL error messages

Previously there were three error situations that only added the (unhelpful)
OpenSSL error strings, now we prefix those with a short explanation for the
error situation.

Reported-by: Jeroen Ooms
Fixes #15473
Closes #15474

show more ...