http2: fix GOAWAY message sent to server

- fix typo in GOAWAY debug message "shutown" -> "shutdown"

Closes https://github.com/curl/curl/pull/14623

buildconf.bat: fix tool_hugehelp.c generation

- Fix showhelp() function prototype in tool_hugehelp.c.cvs.

Follow-up to 9a0cf564 which added the function.

Closes https://git

buildconf.bat: fix tool_hugehelp.c generation

- Fix showhelp() function prototype in tool_hugehelp.c.cvs.

Follow-up to 9a0cf564 which added the function.

Closes https://github.com/curl/curl/pull/14622

show more ...

cmake: fixup linking libgsasl when detected via CMake-native

Found in local tests.

Follow-up to 422696f0a4f3a9e20d4ba9f12726bb066f1c34fc #14555
which added CMake-native detectio

cmake: fixup linking libgsasl when detected via CMake-native

Found in local tests.

Follow-up to 422696f0a4f3a9e20d4ba9f12726bb066f1c34fc #14555
which added CMake-native detection.

show more ...

tidy-up: spelling wolfSSL [ci skip]

mbedtls: fix incorrect macro condition mbed_dump_cert_info

Follow-up to 88cae145509c7

docs/SSLCERTS: rewrite

cleanup, modernize, refresh

Remove libcurl solutions, only do curl command lines.

Closes #14616

GHA/macos: enable brotli and zstd in autotools and cmake jobs

They were missing from macOS builds:
https://testclutch.curl.se/static/reports/feature-matrix.html

Closes #14619

version: fix shadowing a `libssh.h` symbol

```
/Users/runner/work/curl/curl/lib/version.c: In function 'curl_version_info':
/Users/runner/work/curl/curl/lib/version.c:584:15: error:

version: fix shadowing a `libssh.h` symbol

```
/Users/runner/work/curl/curl/lib/version.c: In function 'curl_version_info':
/Users/runner/work/curl/curl/lib/version.c:584:15: error: declaration of 'ssh_buffer' shadows a global declaration [-Werror=shadow]
584 | static char ssh_buffer[80];
| ^~~~~~~~~~
In file included from /Users/runner/work/curl/curl/lib/vssh/ssh.h:35,
from /Users/runner/work/curl/curl/lib/urldata.h:185,
from /Users/runner/work/curl/curl/lib/altsvc.c:32,
from /Users/runner/work/curl/curl/bld/lib/CMakeFiles/libcurl_shared.dir/Unity/unity_0_c.c:4:
/opt/homebrew/include/libssh/libssh.h:99:35: note: shadowed declaration is here
99 | typedef struct ssh_buffer_struct* ssh_buffer;
| ^~~~~~~~~~
```
Ref: https://github.com/curl/curl/actions/runs/10477958747/job/29020250670#step:9:48

Tested via #14614

Closes #14617

show more ...

ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)

For libssh, it fixes a "unity" build issue where libssh deprecation
warnings were not suppressed before this patc

ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)

For libssh, it fixes a "unity" build issue where libssh deprecation
warnings were not suppressed before this patch, because the suppression
macro was only set before just one of the two `libssh.h` includes.
If the other was compiled first in unity mode, the warnings appeared.

Seen in local curl-for-win build (`CW_CONFIG=test-x64-libssh-quictls`)
with libssh 0.11.0. (Also in a GHA/macos cmake job upcoming in #14614)

Use this opportunity to drop duplicate SSH header includes from the SSH
modules. It's enough to include them via the common `ssh.h` header.

Closes #14612

show more ...

tidy-up: spelling 'built-in'

Closes #14613

build: improve compiler version detection portability

POSIX sed doesn't support extended regular expressions, so convert a
call to the basic format. This caused a problem on AIX. Also, u

build: improve compiler version detection portability

POSIX sed doesn't support extended regular expressions, so convert a
call to the basic format. This caused a problem on AIX. Also, use the
detected sed binary name instead of hard-coding one.

show more ...

GHA/windows: add missing time limit for msys2 autotools test runs

The new mingw job (the first msys2/mingw job to run tests) is seen
hanging frequently.

Follow-up to 9f23c8f201f

GHA/windows: add missing time limit for msys2 autotools test runs

The new mingw job (the first msys2/mingw job to run tests) is seen
hanging frequently.

Follow-up to 9f23c8f201f55f1a148b41b16a5e71f3385faa5e #14541

show more ...

tests: add test_17_09_ssl_min_max

Test setting all combinations of --tlsv1.x and --tls-max.

Closes #14590

tests: improve test_17_07_ssl_ciphers

Change TLS proto version on the test httpd server to test setting
combinations of --tls13-ciphers and --ciphers.

To not let the changed con

tests: improve test_17_07_ssl_ciphers

Change TLS proto version on the test httpd server to test setting
combinations of --tls13-ciphers and --ciphers.

To not let the changed config of the httpd server bleed into the next
test, clean and reload on each test. Because a reload is slow, only
do this if the config is different than the loaded config. For this
the httpd.reload_if_config_changed() method is added.

Overloading of autouse fixtures does not seem to work. For the test
httpd server to be reloaded with a clean config in test_18_methods,
to not be affected by the config changes in test_17_ssl_use, the two
class scope fixtures of test_18_methods are now combined.

Closes #14589

show more ...

mbedtls: no longer use MBEDTLS_SSL_VERIFY_OPTIONAL

With mbedTLS if the minimum version of TLS is set to 1.3,
MBEDTLS_SSL_VERIFY_OPTIONAL is not available in client mode. See:
https:/

mbedtls: no longer use MBEDTLS_SSL_VERIFY_OPTIONAL

With mbedTLS if the minimum version of TLS is set to 1.3,
MBEDTLS_SSL_VERIFY_OPTIONAL is not available in client mode. See:
https://github.com/Mbed-TLS/mbedtls/blob/2ca6c285/library/ssl_tls.c#L1357
Also, there might be plans to remove it completely in future mbedTLS
versions.

Switch to always use MBEDTLS_SSL_VERIFY_REQUIRED. If verifypeer or
verifyhost are disabled the corresponding error flags are cleared in the
verify callback function. That is also where verification errors are
logged.

Closes #14591

show more ...

GHA: update github/codeql-action digest to 883d858

Closes #14608

cmake: migrate dependency detections to Find modules

For: libgsasl, libidn2, libssh, libuv.

The new Find modules retain using `pkg-config` natively, not as a "hint"
for the CMak

cmake: migrate dependency detections to Find modules

For: libgsasl, libidn2, libssh, libuv.

The new Find modules retain using `pkg-config` natively, not as a "hint"
for the CMake-native detection. Of the pre-existing Find modules, only
FindNettle, and FindGSS (with customized code) work this way. Align
detection code for the new modules and add version detection for the
CMake-native paths.

Also, add CMake-native detection for `libgsasl`.

The remaining outlier in `CMakeLists.txt` is GnuTLS, which has
a CMake built-in Find module, but which lacks `pkg-config` support,
required for vcpkg. It remains unchanged.

Another part-outlier is `libssh`, which keeps requiring the trick
`find_package(libssh CONFIG QUIET)` for reasons I could not yet figure
out.

Closes #14555

show more ...

cmake: add `find_package()` missing from `USE_MSH3` option

The original patch added the Find module and CMake option. But the logic
missed a `find_package(MSH3)` call to use that Find mo

cmake: add `find_package()` missing from `USE_MSH3` option

The original patch added the Find module and CMake option. But the logic
missed a `find_package(MSH3)` call to use that Find module, leaving the
referenced `MSH3_INCLUDE_DIRS`, `MSH3_LIBRARIES` variables undefined.

Blind fix.

Follow-up to 37492ebbfa24ba4e700e6655b3dbc2bdd65c894a #8517

Closes #14609

show more ...

cf-socket: prevent KEEPALIVE_FACTOR being set to 1000 for Windows

Fixes #14368
Reported-by: feelingseas on github
Closes #14606

curl: find curlrc in XDG_CONFIG_HOME without leading dot

If XDG_CONFIG_HOME is set, look for XDG_CONFIG_HOME/curlrc - without a
leading dot in the filename.

Fixes #12129
Rep

curl: find curlrc in XDG_CONFIG_HOME without leading dot

If XDG_CONFIG_HOME is set, look for XDG_CONFIG_HOME/curlrc - without a
leading dot in the filename.

Fixes #12129
Reported-by: Jat Satiro
Closes #14600

show more ...

GHA/windows: unblock TFTP MQTT WebSockets SMTP FTP tests

Run them now. Also ignore results for now.

Closes #14607

cmake: limit `pkg-config` to UNIX and MSVC+vcpkg by default

Limits `pkg-config` to UNIX and MSVC with vcpkg, by default. Compared to
curl 8.9.1, this unlocks `pkg-config` on MSVC with vc

cmake: limit `pkg-config` to UNIX and MSVC+vcpkg by default

Limits `pkg-config` to UNIX and MSVC with vcpkg, by default. Compared to
curl 8.9.1, this unlocks `pkg-config` on MSVC with vcpkg.

This condition might be updated in the future depending on where
`pkg-config` can be useful without breaking things. (e.g. to non-cross
MINGW, or all MINGW).

In the meantime everyone is free to override the default and test their
build with `pkg-config` by setting the `CURL_USE_PKGCONFIG=ON` CMake
option.

Closes #14575

show more ...

cmake: rename Find modules

- `FindCARES` -> `FindCares`
- `FindLibPSL` -> `FindLibpsl`
- `FindLibSSH2` -> `FindLibssh2`
- `FindQUICHE` -> `FindQuiche`
- `Findrustls` ->

cmake: rename Find modules

- `FindCARES` -> `FindCares`
- `FindLibPSL` -> `FindLibpsl`
- `FindLibSSH2` -> `FindLibssh2`
- `FindQUICHE` -> `FindQuiche`
- `Findrustls` -> `FindRustls`

Our convention for naming Find modules (the part after the `Find`
prefix, also called as 'package name') is:

Always start with uppercase. Follow with lowercase, unless there is
a clear preference for a stylized name. E.g. the project itself uses it
that way with a matching `<Name>Config.cmake` file, or we use it that
way elsewhere, or the name is an acronym.

Ref: #14580

Closes #14601

show more ...

cmake: fix Find module and package names

- fix BearSSL warning about name mismatch.
- fix Nettle Find module not found on Linux.
- tidy-up: drop quotes from a package name.

cmake: fix Find module and package names

- fix BearSSL warning about name mismatch.
- fix Nettle Find module not found on Linux.
- tidy-up: drop quotes from a package name.

Package names must match case-sensitively to work on all platforms:
- `find_package(<NAME> ...)` in `CMakeLists.txt`.
- `CMake/Find<NAME>.cmake` filenames.
- `find_package_handle_standard_args(<NAME> ...` in Find modules.
- `message(STATUS "Found <NAME> ...` in Find modules.
(to match the message shown by `find_package_handle_standard_args()`)

Closes #14599

show more ...

tidy-up: spelling quiche and Rustls

Closes #14605