fix: Windows toolchain compatibility (curl 8.21 re-vendor, endless reconfigure loop) (#4355)

## Problem

Windows builds break with a current local toolchain (Scoop LLVM 22.1.8,
CMake 4.4.0, VS 2026), in two independent ways:

1. The build stops at curl's deliberate guard: `#error "no non-blocking
method was found/used/set"` in `third-party/curl/lib/nonblock.c`.
2. From the second configure onward, `cmake --build` re-runs CMake in an
endless loop (observed 42 consecutive reconfigure cycles in a single
build). Likely the same mechanism behind the "endlessly building" VS
2026 note in `docs/setup/dev/vs.md`.

## Root cause

1. `third-party/curl/CMake/CurlTests.c` passes `int *` to
`ioctlsocket()`, whose third parameter is `u_long *`. Clang 22 promotes
`-Wincompatible-pointer-types` to a hard error in C, so the
`HAVE_IOCTLSOCKET_FIONBIO` try_compile silently fails and
`curl_config.h` never defines it. Upstream CI does not see this because
the windows-2022 runner image ships an older LLVM. GCC 14 promotes the
same warning to a hard error, which is very likely the `CurlTests.c.obj`
failure reported from MSYS2 in open-goal/jak-project#3551. Upstream curl
hit the identical problem with GCC 14 and fixed the probe in curl 8.8.0
(curl/curl#13578).
2. The root CMakeLists copies the build tree's `compile_commands.json`
into `<src>/build/` for clangd using `configure_file()`, which registers
its input as a configure dependency. CMake rewrites
`compile_commands.json` late in every generation, after
`CTestTestfile.cmake` and `cmake_install.cmake` (outputs of the same
Ninja regen rule), so once the dependency is registered the rule is
deterministically dirty and every `ninja` invocation re-runs CMake. A
pristine first configure is safe (the file does not exist yet, so the
`if(EXISTS ...)` guard skips the copy), which is why the loop looks
machine- or IDE-specific.

## Fix

1. Per review, re-vendor `third-party/curl` at the `curl-8_21_0` tag
(previously `curl-8_3_0`), which carries the upstream probe fix plus two
years of upstream development; `vendor.yaml` updated to match.
Adjustments the version jump forced:
- curl 8.15 removed the native macOS Secure Transport backend
(`CURL_USE_SECTRANSP`), so macOS now builds curl against OpenSSL like
Linux. The two macOS workflows install Homebrew `openssl@3` and export
`OPENSSL_ROOT_DIR` (keg-only), and the macOS setup docs gained the same
two lines.
- `CURL_BROTLI` / `CURL_ZSTD` switched to AUTO-detection in curl 8.10;
pinned OFF to keep the previous no-compression behavior and avoid
silently linking whatever the CI images happen to have.
- curl's new top-level `BUILD_EXAMPLES` cache option (default ON) leaked
into discord-rpc's identically named option and broke configure at a
nonexistent `examples/send-presence` directory; pinned OFF ahead of the
third-party subdirectories.

The diff is dominated by the mechanical tag-tree swap under
`third-party/curl` (linguist-vendored, collapsed in review). The
hand-written changes are `CMakeLists.txt`, the two macOS workflows,
`docs/setup/system/macos.md`, and `vendor.yaml`.
2. Swap `configure_file()` for `file(COPY ...)`: the same clangd copy
with no configure dependency registered. (`file(COPY_FILE ...
ONLY_IF_DIFFERENT)` would be cleaner still but requires CMake 3.21,
above the declared `cmake_minimum_required(VERSION 3.10)`.)

## Test plan

- [x] Fresh `cmake --preset Release-windows-clang` (LLVM 22, no cache
seeding) completes and logs `Enabled SSL backends: Schannel`; the
FIONBIO probe passes without the previous `#error`
- [x] Full Windows Release build from scratch in the branch worktree
(all 1422 targets)
- [x] goalc-test suite: 1509 passed, 0 failed
- [x] Second consecutive configure with `compile_commands.json` present:
the regen rule in `build.ninja` has no `compile_commands.json` input;
`<src>/build/compile_commands.json` is still refreshed for clangd
- [x] Repeated `ninja` invocations after a full build no longer re-run
CMake
- [x] macOS Intel and ARM CI green (first exercise of the OpenSSL
backend switch)

---

I work off a self-hosted forge, so this GitHub account is quiet; the
configure logs and ninja dirty-node traces from the investigation are
available if anyone wants the raw data.

(AI-assisted)

.github/workflows/macos-build-arm.yaml

@@ -29,10 +29,12 @@ jobs:
           HOMEBREW_NO_INSTALL_CLEANUP: 1
           HOMEBREW_NO_ANALYTICS: 1
         run: |
-          if ! brew install ninja nasm; then
+          if ! brew install ninja nasm openssl@3; then
             brew update
-            brew install ninja nasm
+            brew install ninja nasm openssl@3
           fi
+          # keg-only, so give CMake's FindOpenSSL an explicit hint
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
 
       - name: Setup sccache
         uses: hendrikmuhs/ccache-action@v1.2.23

.github/workflows/macos-build.yaml

@@ -39,10 +39,12 @@ jobs:
           HOMEBREW_NO_INSTALL_CLEANUP: 1
           HOMEBREW_NO_ANALYTICS: 1
         run: |
-          if ! brew install ninja nasm; then
+          if ! brew install ninja nasm openssl@3; then
             brew update
-            brew install ninja nasm
+            brew install ninja nasm openssl@3
           fi
+          # keg-only, so give CMake's FindOpenSSL an explicit hint
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
 
       - name: Setup sccache
         uses: hendrikmuhs/ccache-action@v1.2.23

CMakeLists.txt

@@ -26,10 +26,13 @@ else()
 endif()
 
 # For clangd
+# file(COPY), not configure_file(): configure_file registers its input as a
+# configure dependency, putting the ever-rewritten compile_commands.json into
+# the Ninja regen rule and causing an endless reconfigure loop.
 if (EXISTS "${CMAKE_CURRENT_BINARY_DIR}/compile_commands.json" )
-    configure_file(
+    file(COPY
         "${CMAKE_CURRENT_BINARY_DIR}/compile_commands.json"
-        "${PROJECT_SOURCE_DIR}/build/compile_commands.json")
+        DESTINATION "${PROJECT_SOURCE_DIR}/build")
 endif()
 
 # NOTE - for SDL, i think SDL3 regressed this - https://github.com/libsdl-org/SDL/pull/6455
@@ -213,18 +216,24 @@ set(CURL_USE_LIBSSH2 OFF)
 # but this is another part of libcurl we probably don't need (multi-threading/parallelism)
 set(CURL_USE_LIBPSL OFF)
 set(CURL_ZLIB OFF)
+# these default to AUTO since curl 8.10 and would silently pick up system libs
+set(CURL_BROTLI OFF)
+set(CURL_ZSTD OFF)
+# curl's BUILD_EXAMPLES cache option (default ON) would otherwise leak into
+# discord-rpc's identically named option and break its examples add_subdirectory
+set(BUILD_EXAMPLES OFF)
 # suddenly became enabled on macOS atleast, only needed for unicode URLs
 # wasn't being properly statically linked
 set(USE_LIBIDN2 OFF)
 if(WIN32)
     set(CURL_USE_SCHANNEL ON) # native Windows SSL support
-elseif(APPLE)
-    set(CURL_USE_SECTRANSP ON) # native macOS SSL support
 else()
+    # curl 8.15 removed the native macOS backend (CURL_USE_SECTRANSP), so macOS
+    # uses OpenSSL like linux (Homebrew openssl@3, see the macOS build workflows)
     if(STATICALLY_LINK)
         set(OPENSSL_USE_STATIC_LIBS TRUE)
     endif()
-    set(CURL_USE_OPENSSL ON) # not native, but seems to be the best choice for linux
+    set(CURL_USE_OPENSSL ON)
 endif()
 include_directories(third-party/curl/include)
 if(STATICALLY_LINK)

docs/setup/system/macos.md

@@ -17,7 +17,8 @@ softwareupdate --install-rosetta
 ## Building for x86_64
 
 ```bash
-brew install cmake nasm ninja go-task clang-format
+brew install cmake nasm ninja go-task clang-format openssl@3
+export OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)
 cmake -B build --preset=Release-macos-x86_64-clang
 cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 ```
@@ -25,7 +26,8 @@ cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 ## Building for ARM64 (experimental, unsupported)
 
 ```bash
-brew install cmake ninja go-task clang-format
+brew install cmake ninja go-task clang-format openssl@3
+export OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)
 cmake -B build --preset=Release-macos-arm64-clang
 cmake --build build --parallel $((`sysctl -n hw.logicalcpu`))
 ```

third-party/curl/.azure-pipelines.yml

@@ -1,315 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# https://dev.azure.com/daniel0244/curl/_build?view=runs
-#
-# Azure Pipelines configuration:
-# https://aka.ms/yaml
-
-trigger:
-  branches:
-    include:
-    - 'master'
-    - '*/ci'
-  paths:
-    exclude:
-    - '.circleci/*'
-    - '.cirrus.yml'
-    - '.github/*'
-    - '.github/workflows/*'
-    - 'appveyor.yml'
-    - 'packages/*'
-    - 'plan9/*'
-
-pr:
-  branches:
-    include:
-    - 'master'
-  paths:
-    exclude:
-    - '.circleci/*'
-    - '.cirrus.yml'
-    - '.github/*'
-    - '.github/workflows/*'
-    - 'appveyor.yml'
-    - 'packages/*'
-    - 'plan9/*'
-
-stages:
-
-##########################################
-### Linux jobs first
-##########################################
-
-- stage: linux
-  dependsOn: []
-  jobs:
-  - job: ubuntu
-    # define defaults to make sure variables are always expanded/replaced
-    variables:
-      install: ''
-      configure: ''
-      tests: '!433'
-    timeoutInMinutes: 60
-    pool:
-      vmImage: 'ubuntu-latest'
-    strategy:
-      matrix:
-        default:
-          name: default
-          install:
-          configure: --enable-debug --with-openssl
-        disable_ipv6:
-          name: w/o IPv6
-          configure: --disable-ipv6 --with-openssl
-        disable_http_smtp_imap:
-          name: w/o HTTP/SMTP/IMAP
-          configure: --disable-http --disable-smtp --disable-imap --without-ssl
-        disable_thredres:
-          name: sync resolver
-          configure: --disable-threaded-resolver --with-openssl
-        https_only:
-          name: HTTPS only
-          configure: --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --with-openssl
-        torture:
-          name: torture
-          install: libnghttp2-dev
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl
-          tests: -n -t --shallow=25 !FTP
-    steps:
-    - script: sudo apt-get update && sudo apt-get install -y stunnel4 python3-impacket libzstd-dev libbrotli-dev $(install)
-      displayName: 'apt install'
-      retryCountOnTaskFailure: 3
-
-    - script: autoreconf -fi && ./configure --enable-warnings --enable-werror $(configure)
-      displayName: 'configure $(name)'
-
-    - script: make V=1 && make V=1 examples && cd tests && make V=1
-      displayName: 'compile'
-      env:
-        MAKEFLAGS: "-j 2"
-
-    - script: make V=1 test-ci
-      displayName: 'test'
-      env:
-        AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
-        TFLAGS: "-ac /usr/bin/curl -r $(tests)"
-
-- stage: distcheck
-  dependsOn: []
-  jobs:
-  - job: ubuntu
-    timeoutInMinutes: 30
-    pool:
-      vmImage: 'ubuntu-latest'
-    steps:
-    - script: autoreconf -fi && ./configure --without-ssl
-      displayName: 'configure $(name)'
-
-    - script: make && ./maketgz 99.98.97
-      displayName: 'make tarball'
-
-    - script: |
-        tar xf curl-99.98.97.tar.gz
-        cd curl-99.98.97
-        ./configure --prefix=$HOME/temp --without-ssl
-        make
-        make TFLAGS=1 test
-        make install
-        # basic check of the installed files
-        cd ..
-        bash scripts/installcheck.sh $HOME/temp
-        rm -rf curl-99.98.97
-
-      displayName: 'verify in-tree configure build'
-
-    - script: |
-        # verify out-of-tree build
-        tar xf curl-99.98.97.tar.gz
-        touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
-        mkdir build
-        cd build
-        ../curl-99.98.97/configure --without-ssl
-        make
-        make TFLAGS='-p 1 1139' test
-        # verify cmake build
-        cd ..
-        rm -rf curl-99.98.97
-
-      displayName: 'verify out-of-tree configure build'
-
-    - script: |
-        tar xf curl-99.98.97.tar.gz
-        cd curl-99.98.97
-        mkdir build
-        cd build
-        cmake ..
-        make
-
-      displayName: 'verify out-of-tree cmake build'
-
-- stage: scanbuild
-  dependsOn: []
-  jobs:
-  - job: ubuntu
-    timeoutInMinutes: 30
-    pool:
-      vmImage: 'ubuntu-latest'
-    steps:
-    - script: sudo apt-get update && sudo apt-get install -y clang-tools clang libssl-dev libssh2-1-dev libpsl-dev libbrotli-dev libzstd-dev
-      displayName: 'apt install'
-      retryCountOnTaskFailure: 3
-
-    - script: autoreconf -fi
-      displayName: 'autoreconf'
-
-    - script: scan-build ./configure --enable-debug --enable-werror --with-openssl --with-libssh2
-      displayName: 'configure'
-      env:
-        CC: "clang"
-        CCX: "clang++"
-
-    - script: scan-build --status-bugs make
-      displayName: 'make'
-
-    - script: scan-build --status-bugs make examples
-      displayName: 'make examples'
-
-##########################################
-### Windows jobs below
-##########################################
-
-- stage: windows
-  dependsOn: []
-  variables:
-    agent.preferPowerShellOnContainers: true
-  jobs:
-  - job: msys
-    # define defaults to make sure variables are always expanded/replaced
-    variables:
-      container_img: ''
-      container_cmd: ''
-      configure: ''
-      tests: ''
-    timeoutInMinutes: 120
-    pool:
-      vmImage: 'windows-2019'
-    strategy:
-      matrix:
-        v2_mingw32_openssl:
-          name: 32-bit OpenSSL/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --with-libssh2 --with-openssl
-          tests: "~571"
-        v2_mingw64_openssl:
-          name: 64-bit OpenSSL/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh2 --with-openssl
-          tests: "~571"
-        v2_mingw64_libssh:
-          name: 64-bit OpenSSL/libssh
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh-devel mingw-w64-x86_64-libssh
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh --with-openssl
-          tests: "~571 ~614"
-        v1_mingw:
-          name: 32-bit (legacy)
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-pc-mingw32 --build=i686-pc-mingw32 --prefix=/mingw --enable-debug --without-ssl --with-mingw1-deprecated
-          tests: "!203 !1143"
-        v1_mingw32:
-          name: 32-bit w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw32:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --without-zlib --without-ssl
-          tests: "!203 !1143"
-        v1_mingw64:
-          name: 64-bit w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw64:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --without-zlib --without-ssl
-          tests: "!203 !1143"
-        v2_mingw32_schannel:
-          name: 32-bit Schannel/SSPI/WinIDN/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
-          tests: "~571"
-        v2_mingw64_schannel:
-          name: 64-bit Schannel/SSPI/WinIDN/libssh2
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
-          container_cmd: C:\msys64\usr\bin\sh
-          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
-          tests: "~571"
-        v1_mingw_schannel:
-          name: 32-bit Schannel/SSPI/WinIDN (legacy)
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-pc-mingw32 --build=i686-pc-mingw32 --prefix=/mingw --enable-debug --enable-sspi --with-schannel --with-winidn --with-mingw1-deprecated
-          tests: "!203 !305 !311 !312 !313 !404 !1143 !2033 !2035 !2038 !2041 !2042 !2048 !2070 !2079 !2087 !3023 !3024"
-        v1_mingw32_schannel:
-          name: 32-bit Schannel/SSPI/WinIDN w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw32:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib
-          tests: "!203 !1143"
-        v1_mingw64_schannel:
-          name: 64-bit Schannel/SSPI/WinIDN w/o zlib
-          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw64:ltsc2019
-          container_cmd: C:\MinGW\msys\1.0\bin\sh
-          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64  --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib
-          tests: "!203 !1143"
-    container:
-      image: $(container_img)
-      env:
-        MSYS2_PATH_TYPE: inherit
-    steps:
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && $(prepare)"
-      displayName: 'prepare'
-      condition: variables.prepare
-      retryCountOnTaskFailure: 3
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && autoreconf -fi && ./configure $(configure)"
-      displayName: 'configure $(name)'
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 && make V=1 examples && cd tests && make V=1"
-      displayName: 'compile'
-      env:
-        MAKEFLAGS: "-j 2"
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 install && PATH=/usr/bin:/bin find . -type f -path '*/.libs/*.exe' -print -execdir mv -t .. {} \;"
-      displayName: 'install'
-
-    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 test-ci"
-      displayName: 'test'
-      env:
-        AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
-        TFLAGS: "-ac /usr/bin/curl.exe !IDN !SCP ~612 ~1056 $(tests)"

third-party/curl/.circleci/config.yml

@@ -24,115 +24,10 @@
 
 # View these jobs in the browser: https://app.circleci.com/pipelines/github/curl/curl
 
-# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/2.0/configuration-reference
+# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/configuration-reference/
 version: 2.1
 
 commands:
-  configure:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-werror --with-openssl
-
-  configure-openssl-no-verbose:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-verbose --enable-werror --with-openssl
-
-  configure-no-proxy:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-proxy --enable-werror --with-openssl
-
-  configure-macos-normal:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-debug:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libssh2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl --with-libssh2=/opt/homebrew/opt/libssh2 --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libssh-c-ares:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --with-libssh --enable-ares --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libssh:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --with-libssh --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-c-ares:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --without-ssl --enable-ares --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-http-only:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-maintainer-mode --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets --disable-shared --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib --enable-debug CFLAGS='-Wno-vla -mmacosx-version-min=10.15'
-
-  configure-macos-securetransport-http2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-secure-transport CFLAGS='-Wno-vla -mmacosx-version-min=10.8'
-
-  configure-macos-openssl-http2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-libressl-http2:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix libressl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-torture:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --disable-shared --disable-threaded-resolver --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
-  configure-macos-torture-ftp:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --enable-warnings --enable-websockets --disable-shared --disable-threaded-resolver --with-openssl --enable-debug PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" CFLAGS='-Wno-vla -mmacosx-version-min=10.9'
-
   install-cares:
     steps:
       - run:
@@ -143,6 +38,7 @@ commands:
     steps:
       - run:
           command: |
+            export DEBIAN_FRONTEND=noninteractive
             sudo apt-get update && sudo apt-get install -y libssh-dev
 
   install-deps:
@@ -150,127 +46,86 @@ commands:
       - run:
           command: |
             sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip
-            sudo python3 -m pip install impacket
+            python3 -m venv ~/venv
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
 
-  install-deps-brew:
+  configure:
     steps:
       - run:
           command: |
-            # Drop libressl as long as we're not trying to build it
-            echo libtool autoconf automake pkg-config nghttp2 libssh2 openssl libssh c-ares | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-            while [ $? -eq 0 ]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-            sudo python3 -m pip install impacket
+            autoreconf -fi
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-warnings \
+              --with-openssl \
+              || { tail -1000 config.log; false; }
+
+  configure-no-proxy:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror \
+              --with-openssl --disable-proxy \
+              || { tail -1000 config.log; false; }
 
   configure-libssh:
     steps:
       - run:
           command: |
             autoreconf -fi
-            ./configure --enable-warnings --enable-werror --with-openssl --with-libssh
-
-  install-wolfssl:
-    steps:
-      - run:
-          command: |
-            WOLFSSL_VER=5.6.0
-            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
-            tar -xzf v$WOLFSSL_VER-stable.tar.gz
-            cd wolfssl-$WOLFSSL_VER-stable
-            ./autogen.sh
-            ./configure --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
-            make install
-
-  install-wolfssh:
-    steps:
-      - run:
-          command: |
-            WOLFSSH_VER=1.4.12
-            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssh/archive/v$WOLFSSH_VER-stable.tar.gz
-            tar -xzf v$WOLFSSH_VER-stable.tar.gz
-            cd wolfssh-$WOLFSSH_VER-stable
-            ./autogen.sh
-            ./configure --with-wolfssl=$HOME/wssl --prefix=$HOME/wssh --enable-scp --enable-sftp --disable-examples
-            make install
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-warnings \
+              --with-openssl --with-libssh \
+              || { tail -1000 config.log; false; }
 
   configure-cares:
     steps:
       - run:
           command: |
             autoreconf -fi
-            ./configure --enable-warnings --enable-werror --with-openssl --enable-ares
-
-  configure-wolfssh:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            LDFLAGS="-Wl,-rpath,$HOME/wssh/lib" ./configure --enable-warnings --enable-werror --with-wolfssl=$HOME/wssl --with-wolfssh=$HOME/wssh
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-warnings \
+              --with-openssl --enable-ares \
+              || { tail -1000 config.log; false; }
 
   configure-cares-debug:
     steps:
       - run:
           command: |
             autoreconf -fi
-            ./configure --enable-debug --enable-werror --with-openssl --enable-ares
+            ./configure --disable-dependency-tracking --enable-option-checking=fatal --enable-unity --enable-werror --enable-debug \
+              --with-openssl --enable-ares \
+              || { tail -1000 config.log; false; }
 
   build:
     steps:
       - run: make -j3 V=1
+      - run: src/curl --disable --version
       - run: make -j3 V=1 examples
 
-  build-macos:
-    steps:
-      - run: make -j7 V=1
-      - run: make -j7 V=1 examples
-
   test:
     steps:
-      - run: make -j3 V=1 test-ci
-
-  test-macos:
-    steps:
-      - run: make -j7 V=1 test-ci
-
-  test-torture:
-    steps:
-      - run: make -j5 V=1 test-ci TFLAGS="-n -t --shallow=25 !FTP"
-
-  test-torture-ftp:
-    steps:
-      - run: make -j5 V=1 test-ci TFLAGS="-n -t --shallow=20 FTP"
+      - run:
+          command: |
+            source ~/venv/bin/activate
+            # Revert a CircleCI-specific local setting that makes test 1459
+            # return 67 (CURLE_LOGIN_DENIED) instead of the
+            # expected 60 (CURLE_PEER_FAILED_VERIFICATION).
+            echo 'StrictHostKeyChecking yes' >> ~/.ssh/config
+            make -j3 V=1 test-ci TFLAGS='-j14'
 
 executors:
   ubuntu:
     machine:
-      image: ubuntu-2004:202010-01
+      image: ubuntu-2204:2025.09.1
 
 jobs:
   basic:
     executor: ubuntu
     steps:
       - checkout
+      - install-deps
       - configure
       - build
       - test
 
-  no-verbose:
-    executor: ubuntu
-    steps:
-      - checkout
-      - install-deps
-      - configure-openssl-no-verbose
-      - build
-
-  wolfssh:
-    executor: ubuntu
-    steps:
-      - checkout
-      - install-deps
-      - install-wolfssl
-      - install-wolfssh
-      - configure-wolfssh
-      - build
-
   no-proxy:
     executor: ubuntu
     steps:
@@ -284,6 +139,7 @@ jobs:
     executor: ubuntu
     steps:
       - checkout
+      - install-deps
       - install-cares
       - configure-cares
       - build
@@ -293,6 +149,7 @@ jobs:
     executor: ubuntu
     steps:
       - checkout
+      - install-deps
       - install-libssh
       - configure-libssh
       - build
@@ -300,162 +157,27 @@ jobs:
 
   arm:
     machine:
-      image: ubuntu-2004:202101-01
+      image: ubuntu-2204:2025.09.1
     resource_class: arm.medium
     steps:
       - checkout
+      - install-deps
       - configure
       - build
       - test
 
   arm-cares:
     machine:
-      image: ubuntu-2004:202101-01
+      image: ubuntu-2204:2025.09.1
     resource_class: arm.medium
     steps:
       - checkout
+      - install-deps
       - install-cares
       - configure-cares-debug
       - build
       - test
 
-  # TODO: All builds with "macos.x86.medium.gen2" must be changed to
-  # "macos.m1.medium.gen1" in January 2024 because the former will be removed
-  # (the names should also be changed from macos-x86-* to macos-arm-*).  We
-  # want the M1 (ARM) machines anyway, for platform diversity.
-  # See https://circleci.com/docs/configuration-reference/#macos-execution-environment
-  macos-x86-normal:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-normal
-      - build-macos
-      - test-macos
-
-  macos-x86-debug:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-debug
-      - build-macos
-      - test-macos
-
-  macos-x86-libssh2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libssh2
-      - build-macos
-      - test-macos
-
-  macos-x86-libssh-c-ares:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libssh-c-ares
-      - build-macos
-      - test-macos
-
-  macos-x86-libssh:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libssh
-      - build-macos
-      - test-macos
-
-  macos-x86-c-ares:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-c-ares
-      - build-macos
-      - test-macos
-
-  macos-x86-http-only:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-http-only
-      - build-macos
-      - test-macos
-
-  macos-x86-http-securetransport-http2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-securetransport-http2
-      - build-macos
-      - test-macos
-
-  macos-x86-http-openssl-http2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-openssl-http2
-      - build-macos
-      - test-macos
-
-  macos-x86-http-libressl-http2:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-libressl-http2
-      - build-macos
-      - test-macos
-
-  macos-x86-http-torture:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-torture
-      - build-macos
-      - test-torture
-
-  macos-x86-http-torture-ftp:
-    macos:
-      xcode: 15.0.0
-    resource_class: macos.x86.medium.gen2
-    steps:
-      - checkout
-      - install-deps-brew
-      - configure-macos-torture-ftp
-      - build-macos
-      - test-torture-ftp
-
 workflows:
   x86-openssl:
     jobs:
@@ -473,14 +195,6 @@ workflows:
     jobs:
       - no-proxy
 
-  openssl-no-verbose:
-    jobs:
-      - no-verbose
-
-  wolfssl-wolfssh:
-    jobs:
-      - wolfssh
-
   arm-openssl:
     jobs:
       - arm
@@ -488,53 +202,3 @@ workflows:
   arm-openssl-c-ares:
     jobs:
       - arm-cares
-
-  macos-x86-normal:
-    jobs:
-      - macos-x86-normal
-
-  macos-x86-debug:
-    jobs:
-      - macos-x86-debug
-
-  macos-x86-libssh2:
-    jobs:
-      - macos-x86-libssh2
-
-  macos-x86-libssh-c-ares:
-    jobs:
-      - macos-x86-libssh-c-ares
-
-  macos-x86-libssh:
-    jobs:
-      - macos-x86-libssh
-
-  macos-x86-c-ares:
-    jobs:
-      - macos-x86-c-ares
-
-  macos-x86-http-only:
-    jobs:
-      - macos-x86-http-only
-
-  macos-x86-http-securetransport-http2:
-    jobs:
-      - macos-x86-http-securetransport-http2
-
-  macos-x86-http-openssl-http2:
-    jobs:
-      - macos-x86-http-openssl-http2
-
-  # There are problem linking with LibreSSL on the CI boxes that prevent this
-  # from working.
-  #macos-x86-http-libressl-http2:
-  #  jobs:
-  #    - macos-x86-http-libressl-http2
-
-  macos-x86-http-torture:
-    jobs:
-      - macos-x86-http-torture
-
-  macos-x86-http-torture-ftp:
-    jobs:
-      - macos-x86-http-torture-ftp

third-party/curl/.cirrus.yml

@@ -1,85 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# https://cirrus-ci.com/github/curl/curl
-#
-# Cirrus CI configuration:
-# https://cirrus-ci.org/guide/writing-tasks/
-
-freebsd_task:
-  skip: "changesIncludeOnly(
-    '**/CMakeLists.txt',
-    '.azure-pipelines.yml',
-    '.circleci/**',
-    '.github/**',
-    'appveyor.yml',
-    'CMake/**',
-    'packages/**',
-    'plan9/**',
-    'projects/**',
-    'winbuild/**'
-    )"
-
-  name: FreeBSD
-
-  matrix:
-    - name: FreeBSD 13.2
-      freebsd_instance:
-        image_family: freebsd-13-2
-
-  env:
-    CIRRUS_CLONE_DEPTH: 10
-    CRYPTOGRAPHY_DONT_BUILD_RUST: 1
-    MAKEFLAGS: -j 3
-
-  pkginstall_script:
-    - pkg update -f
-    - pkg install -y autoconf automake libtool pkgconf brotli openldap24-client heimdal libpsl libssh2 openssh-portable libidn2 librtmp libnghttp2 nghttp2 stunnel py39-openssl py39-impacket py39-cryptography
-    - pkg delete -y curl
-  configure_script:
-    - autoreconf -fi
-    # Building with the address sanitizer is causing unexplainable test issues due to timeouts
-    #- case `uname -r` in
-    #    12.2*)
-    #    export CC=clang;
-    #    export CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g";
-    #    export CXXFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g";
-    #    export LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer" ;;
-    #  esac
-    - ./configure --prefix="${HOME}"/install --enable-debug --with-openssl --with-libssh2 --with-brotli --with-gssapi --with-libidn2 --enable-manual --enable-ldap --enable-ldaps --with-librtmp --with-libpsl --with-nghttp2 || { tail -300 config.log; false; }
-  compile_script:
-    - make V=1 && make V=1 examples && cd tests && make V=1
-  test_script:
-    # blackhole?
-    - sysctl net.inet.tcp.blackhole
-    # make sure we don't run blackhole != 0
-    - sudo sysctl net.inet.tcp.blackhole=0
-    # Some tests won't run if run as root so run them as another user.
-    # Make directories world writable so the test step can write wherever it needs.
-    - find . -type d -exec chmod 777 {} \;
-    # The OpenSSH server instance for the testsuite cannot be started on FreeBSD,
-    # therefore the SFTP and SCP tests are disabled right away from the beginning.
-    #
-    - sudo -u nobody make V=1 TFLAGS="-n !SFTP !SCP" test-ci
-  install_script:
-    - make V=1 install

third-party/curl/.clang-tidy.yml

@@ -0,0 +1,59 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+---
+# https://clang.llvm.org/extra/clang-tidy/
+
+# https://clang.llvm.org/extra/clang-tidy/checks/list.html
+Checks:
+  - clang-analyzer-*
+  - -clang-analyzer-optin.performance.Padding
+  - -clang-analyzer-security.ArrayBound  # due to false positives with clang-tidy v21.1.0+
+  - -clang-analyzer-security.insecureAPI.bzero  # for FD_ZERO() (seen on macOS)
+  - -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling
+  - -clang-diagnostic-nullability-extension
+  - bugprone-assert-side-effect
+  - bugprone-assignment-in-if-condition
+  - bugprone-chained-comparison
+  - bugprone-dynamic-static-initializers
+  - bugprone-invalid-enum-default-initialization
+  - bugprone-macro-parentheses
+  - bugprone-macro-repeated-side-effects
+  - bugprone-misplaced-operator-in-strlen-in-alloc
+  - bugprone-misplaced-pointer-arithmetic-in-alloc
+  - bugprone-not-null-terminated-result
+  - bugprone-posix-return
+  - bugprone-redundant-branch-condition
+  - bugprone-signed-char-misuse
+  - bugprone-sizeof-expression
+  - bugprone-suspicious-enum-usage
+  - bugprone-suspicious-memset-usage
+  - bugprone-suspicious-missing-comma
+  - bugprone-suspicious-realloc-usage
+  - bugprone-suspicious-semicolon
+  # bugprone-unchecked-string-to-number-conversion  # needs converting sscanf to strtol or curlx_str_*
+  - misc-const-correctness
+  - misc-header-include-cycle
+  # misc-redundant-expression  # undesired hits due to system macros, e.g. due to POLLIN == POLLRDNORM | POLLRDBAND, then or-ing all three
+  - portability-*
+  - readability-duplicate-include
+  # readability-else-after-return
+  # readability-enum-initial-value
+  # readability-function-cognitive-complexity
+  - readability-inconsistent-declaration-parameter-name
+  # readability-misleading-indentation  # too many false positives and oddball/conditional source
+  - readability-named-parameter
+  # readability-redundant-casting  # false positives in types that change from platform to platform, even with IgnoreTypeAliases: true
+  - readability-redundant-control-flow
+  - readability-redundant-declaration
+  - readability-redundant-function-ptr-dereference
+  - readability-redundant-parentheses
+  - readability-redundant-preprocessor
+  - readability-suspicious-call-argument
+  - readability-uppercase-literal-suffix
+
+CheckOptions:
+  misc-header-include-cycle.IgnoredFilesList: 'curl/curl.h'
+  readability-inconsistent-declaration-parameter-name.Strict: true
+
+HeaderFilterRegex: '.*'  # Default in v22.1.0+

third-party/curl/.dcignore

@@ -1,7 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-tests/**
-docs/**
-docs/examples/**

third-party/curl/.editorconfig

@@ -0,0 +1,18 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+indent_style = space
+trim_trailing_whitespace = true
+
+[*.{c,h}]
+indent_size = 2
+max_line_length = 79
+
+[*.{pl,pm}]
+indent_size = 4

third-party/curl/.gitattributes

@@ -2,8 +2,6 @@
 #
 # SPDX-License-Identifier: curl
 
-*.dsw -crlf
-buildconf eol=lf
 configure.ac eol=lf
 *.m4 eol=lf
 *.in eol=lf
@@ -11,8 +9,6 @@ configure.ac eol=lf
 *.sh eol=lf
 *.[ch] whitespace=tab-in-indent
 
-# Batch files (bat,btm,cmd) must be run with CRLF line endings.
+# Batch files must be run with CRLF line endings.
 # Refer to https://github.com/curl/curl/pull/6442
 *.bat text eol=crlf
-*.btm text eol=crlf
-*.cmd text eol=crlf

third-party/curl/.github/CONTRIBUTING.md

@@ -4,26 +4,19 @@ Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 SPDX-License-Identifier: curl
 -->
 
-How to contribute to curl
-=========================
+# How to contribute to curl
 
-Join the community
-------------------
+## Join the community
 
- 1. Click 'watch' on the GitHub repo
+1. Click 'watch' on the GitHub repo
+2. Subscribe to the suitable [mailing lists](https://curl.se/mail/)
 
- 2. Subscribe to the suitable [mailing lists](https://curl.se/mail/)
+## Read [CONTRIBUTE](/docs/CONTRIBUTE.md)
 
-Read [CONTRIBUTE](../docs/CONTRIBUTE.md)
----------------------------------------
+## Send your suggestions using one of these methods:
 
-Send your suggestions using one of these methods:
--------------------------------------------------
+1. in a mail to the mailing list
+2. as a [pull request](https://github.com/curl/curl/pulls)
+3. as an [issue](https://github.com/curl/curl/issues)
 
- 1. in a mail to the mailing list
-
- 2. as a [pull request](https://github.com/curl/curl/pulls)
-
- 3. as an [issue](https://github.com/curl/curl/issues)
-
-/ The curl team!
+/ The curl team

third-party/curl/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -2,8 +2,8 @@
 #
 # SPDX-License-Identifier: curl
 
-name: Bug Report
-description: Create a report to help us improve
+name: Bug Report on code
+description: Tell us about your problem with curl or libcurl
 
 body:
   - type: markdown
@@ -13,12 +13,18 @@ body:
 
         Only file bugs here! Ask questions on the mailing lists https://curl.se/mail/
 
-        **SECURITY RELATED?** Post it here: https://hackerone.com/curl
+        **SECURITY RELATED?** Submit here: https://hackerone.com/curl
 
-        There are collections of known issues to be aware of:
+  - type: markdown
+    attributes:
+      value: "
+        > [!IMPORTANT]
 
-        - https://curl.se/docs/knownbugs.html
-        - https://curl.se/docs/todo.html
+        > If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice."
 
   - type: textarea
     id: reproducer
@@ -40,7 +46,7 @@ body:
       label: curl/libcurl version
       description: |
         Please paste the output of `curl -V` here.
-      placeholder: 'curl 8.2.0'
+      placeholder: 'curl 8.18.0'
     validations:
       required: true
 

third-party/curl/.github/ISSUE_TEMPLATE/config.yml

@@ -4,12 +4,15 @@
 
 blank_issues_enabled: false
 contact_links:
+  - name: Ask a question (without email)
+    url: https://github.com/curl/curl/discussions
+    about: Use the Discussion forum here on GitHub
+  - name: Ask a question (using email)
+    url: https://curl.se/mail/
+    about: Send question to the suitable mailing list
+  - name: Commercial support
+    url: https://curl.se/support.html
+    about: Pay for fast quality support for and help with curl/libcurl
   - name: Feature request
     url: https://curl.se/mail/
     about: To propose new features or enhancements, please bring that discussion to a suitable curl mailing list.
-  - name: Question
-    url: https://curl.se/mail/
-    about: Questions should go to the mailing list
-  - name: Commercial support
-    url: https://curl.se/support.html
-    about: Several companies are offering paid support for curl/libcurl

third-party/curl/.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,43 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Bug Report on documentation
+description: Problems, errors, mistakes or typos in documentation.
+labels: documentation
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+
+        Only file documentation bugs here! Ask questions on the mailing lists https://curl.se/mail/
+
+  - type: markdown
+    attributes:
+      value: "
+        > [!IMPORTANT]
+
+        > If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice."
+
+  - type: textarea
+    id: source
+    attributes:
+      label: Specify which documentation you found a problem with
+      description: |
+        Include function name, URL, tarball version and all other relevant
+        details that identify the documentation source.
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+    validations:
+      required: true

third-party/curl/.github/dependabot.yml

@@ -0,0 +1,38 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    cooldown:
+      default-days: 7
+    groups:
+      gha-dependencies:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: 'GHA:'
+
+  - package-ecosystem: 'pip'
+    directories:
+      - '.github/scripts'
+      - 'tests'
+    schedule:
+      interval: 'monthly'
+    cooldown:
+      default-days: 7
+      semver-major-days: 15
+      semver-minor-days: 7
+      semver-patch-days: 3
+    groups:
+      pip-dependencies:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: 'GHA:'

third-party/curl/.github/labeler.yml

@@ -7,297 +7,563 @@
 # triaging, but is intended to add labels to the easy cases. If the matching
 # language becomes more powerful, more cases should be able to be handled.
 #
-# The biggest low-hanging problem is this:
-# It looks like there's no way of specifying that a label be added if *all* the
-# files match *any* one of a number of globs. This feature request is tracked
-# in https://github.com/actions/labeler/issues/423
+# Labels are added in two ways: the any-glob-to-all-files ones are added if all
+# the files fit into the category, and the any-glob-to-any-file ones are added
+# as long as any file matches. The first ones are for "major" categories (the
+# PR is all about that one topic, like HTTP/3), while the second ones are
+# "addendums" that give useful information about a PR that is really mostly
+# something else (e.g. CI if the PR also touches CI jobs).
+#
+# N.B. any-glob-to-all-files is misnamed; it acts like one-glob-to-all-files.
+# Therefore, to get any-glob-to-all-files semantics with multiple matching
+# patterns, they must be joined with commas to a single string surrounded by
+# braces. For example: '{lib/**,src/**}'.
+#
+# See https://github.com/actions/labeler/ for documentation on this file.
+---
+
+appleOS:
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/macos.yml,\
+              lib/config-mac.h,\
+              lib/macos*,\
+              lib/vtls/apple.*,\
+              m4/curl-apple-sectrust.m4\
+              }"
 
 authentication:
-- all: ['docs/mk-ca-bundle.1']
-- all: ['docs/libcurl/opts/CURLINFO_HTTPAUTH*']
-- all: ['docs/libcurl/opts/CURLINFO_PROXYAUTH*']
-- all: ['docs/libcurl/opts/CURLOPT_KRB*']
-- all: ['docs/libcurl/opts/CURLOPT_SASL*']
-- all: ['docs/libcurl/opts/CURLOPT_SERVICE_NAME*']
-- all: ['docs/libcurl/opts/CURLOPT_USERNAME*']
-- all: ['docs/libcurl/opts/CURLOPT_USERPWD*']
-- all: ['docs/libcurl/opts/CURLOPT_XOAUTH*']
-- all: ['lib/*gssapi*']
-- all: ['lib/*krb5*']
-- all: ['lib/*ntlm*']
-- all: ['lib/curl_sasl.*']
-- all: ['lib/http_aws*']
-- all: ['lib/http_digest.*']
-- all: ['lib/http_negotiate.*']
-- all: ['lib/vauth/**']
-- all: ['tests/server/fake_ntlm.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindGSS.cmake,\
+              CMake/FindLibgsasl.cmake,\
+              docs/internals/CREDENTIALS.md,\
+              docs/libcurl/opts/CURLINFO_HTTPAUTH*,\
+              docs/libcurl/opts/CURLINFO_PROXYAUTH*,\
+              docs/libcurl/opts/CURLOPT_KRB*,\
+              docs/libcurl/opts/CURLOPT_SASL*,\
+              docs/libcurl/opts/CURLOPT_SERVICE_NAME*,\
+              docs/libcurl/opts/CURLOPT_USERNAME*,\
+              docs/libcurl/opts/CURLOPT_USERPWD*,\
+              docs/libcurl/opts/CURLOPT_XOAUTH*,\
+              lib/*gssapi*,\
+              lib/*ntlm*,\
+              lib/creds.*,\
+              lib/curl_ntlm*,\
+              lib/curl_sasl.*,\
+              lib/http_aws*,\
+              lib/http_digest.*,\
+              lib/http_negotiate.*,\
+              lib/http_ntlm.*,\
+              lib/vauth/**\
+              }"
 
 build:
-- all: ['**/CMakeLists.txt']
-- all: ['**/Makefile.am']
-- all: ['**/Makefile.inc']
-- all: ['**/Makefile.mk']
-- all: ['**/*.m4']
-- all: ['**/*.mk']
-- all: ['lib/libcurl*.in']
-- all: ['CMake/**']
-- all: ['configure.ac']
-- all: ['m4/**']
-- all: ['MacOSX-Framework']
-- all: ['packages/**']
-- all: ['plan9/**']
-- all: ['projects/**']
-- all: ['winbuild/**']
-- all: ['libcurl.def']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              **/CMakeLists.txt,\
+              **/Makefile.am,\
+              **/Makefile.inc,\
+              **/*.m4,\
+              *.m4,\
+              docs/INSTALL-CMAKE.md,\
+              lib/curl_config-cmake.h.in,\
+              lib/libcurl*.in,\
+              CMake/**,\
+              CMakeLists.txt,\
+              configure.ac,\
+              m4/**,\
+              Makefile.*,\
+              projects/**,\
+              lib/libcurl.def,\
+              tests/cmake/**\
+              }"
 
 CI:
-- any: ['.azure-pipelines.yml']
-- any: ['.circleci/**']
-- any: ['.cirrus.yml']
-- any: ['.github/**']
-- any: ['appveyor.yml']
-- any: ['tests/azure.pm']
-- any: ['tests/appveyor.pm']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - '.circleci/**'
+              - '.github/**'
+              - 'appveyor.*'
+              - 'scripts/ci*'
+              - 'tests/azure.pm'
+              - 'tests/appveyor.pm'
+              - 'tests/CI.md'
 
 cmake:
-- all: ['**/CMakeLists.txt']
-- all: ['CMake/**']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              **/CMakeLists.txt,\
+              CMake/**,\
+              docs/INSTALL-CMAKE.md,\
+              lib/curl_config-cmake.h.in,\
+              tests/cmake/**\
+              }"
 
 cmdline tool:
-- any: ['docs/cmdline-opts/**']
-- any: ['src/**']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - 'docs/cmdline-opts/**'
+              - 'src/**'
 
 connecting & proxies:
-- all: ['docs/CONNECTION-FILTERS.md']
-- all: ['docs/libcurl/opts/CURLINFO_CONNECT*']
-- all: ['docs/libcurl/opts/CURLINFO_PROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_ADDRESS*']
-- all: ['docs/libcurl/opts/CURLOPT_CONNECT*']
-- all: ['docs/libcurl/opts/CURLOPT_HAPROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_OPENSOCKET*']
-- all: ['docs/libcurl/opts/CURLOPT_PRE_PROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_PROXY*']
-- all: ['docs/libcurl/opts/CURLOPT_SOCKOPT*']
-- all: ['docs/libcurl/opts/CURLOPT_SOCKS*']
-- all: ['docs/libcurl/opts/CURLOPT_TCP*']
-- all: ['docs/libcurl/opts/CURLOPT_TIMEOUT*']
-- all: ['lib/cf-*proxy.*']
-- all: ['lib/cf-socket.*']
-- all: ['lib/cfilters.*']
-- all: ['lib/conncache.*']
-- all: ['lib/connect.*']
-- all: ['lib/http_proxy.*']
-- all: ['lib/if2ip.*']
-- all: ['lib/noproxy.*']
-- all: ['lib/socks.*']
-- all: ['tests/server/socksd.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/happy-eyeballs*,\
+              docs/cmdline-opts/ipv*,\
+              docs/cmdline-opts/*proxy*,\
+              docs/internals/CONNECTION-FILTERS.md,\
+              docs/examples/ipv6.c,\
+              docs/libcurl/opts/CURLINFO_CONNECT*,\
+              docs/libcurl/opts/CURLINFO_PROXY*,\
+              docs/libcurl/opts/CURLOPT_ADDRESS*,\
+              docs/libcurl/opts/CURLOPT_CONNECT*,\
+              docs/libcurl/opts/CURLOPT_HAPROXY*,\
+              docs/libcurl/opts/CURLOPT_OPENSOCKET*,\
+              docs/libcurl/opts/CURLOPT_PRE_PROXY*,\
+              docs/libcurl/opts/CURLOPT_PROXY*,\
+              docs/libcurl/opts/CURLOPT_SOCKOPT*,\
+              docs/libcurl/opts/CURLOPT_SOCKS*,\
+              docs/libcurl/opts/CURLOPT_TCP*,\
+              docs/libcurl/opts/CURLOPT_TIMEOUT*,\
+              lib/cf-https-connect.*,\
+              lib/cf-ip-happy.*,\
+              lib/cf-*proxy.*,\
+              lib/cf-socket.*,\
+              lib/cfilters.*,\
+              lib/conncache.*,\
+              lib/connect.*,\
+              lib/http_proxy.*,\
+              lib/if2ip.*,\
+              lib/proxy.*,\
+              lib/socks.*,\
+              src/tool_cb_soc.*,\
+              tests/http/*proxy*,\
+              tests/http/*socks*,\
+              tests/server/socksd.c\
+              }"
 
 cookies:
-- all: ['docs/HTTP-COOKIES.md']
-- all: ['docs/libcurl/opts/CURLINFO_COOKIE*']
-- all: ['docs/libcurl/opts/CURLOPT_COOKIE*']
-- all: ['lib/cookie.*']
-- all: ['lib/psl.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindLibpsl.cmake,\
+              docs/HTTP-COOKIES.md,\
+              docs/cmdline-opts/cookie*,\
+              docs/cmdline-opts/junk-session-cookies.md,\
+              docs/libcurl/opts/CURLINFO_COOKIE*,\
+              docs/libcurl/opts/CURLOPT_COOKIE*,\
+              docs/examples/cookie_interface.c,\
+              lib/cookie.*,\
+              lib/psl.*\
+              }"
 
 cryptography:
-- all: ['docs/CIPHERS.md']
-- all: ['docs/RUSTLS.md']
-- all: ['docs/libcurl/opts/CURLOPT_EGDSOCKET*']
-- all: ['lib/*sha256*']
-- all: ['lib/curl_des.*']
-- all: ['lib/curl_hmac.*']
-- all: ['lib/curl_md?.*']
-- all: ['lib/md?.*']
-- all: ['lib/rand.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/CIPHERS.md,\
+              docs/RUSTLS.md,\
+              docs/libcurl/opts/CURLOPT_EGDSOCKET*,\
+              lib/*sha256*,\
+              lib/*sha512*,\
+              lib/curl_hmac.*,\
+              lib/curl_md?.*,\
+              lib/curl_ntlm_core.*,\
+              lib/md?.*,\
+              lib/rand.*\
+              }"
 
 DICT:
-- all: ['lib/dict.*']
-- all: ['tests/dictserver.py']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/dict.*,\
+              tests/dictserver.py\
+              }"
 
 documentation:
-- all: ['**/*.md']
-- all: ['**/*.txt', '!**/CMakeLists.txt']
-- all: ['**/*.1']
-- all: ['**/*.3']
-- all: ['CHANGES']
-- all: ['docs/**', '!docs/examples/**']
-- all: ['GIT-INFO']
-- all: ['LICENSES/**']
-- all: ['README']
-- all: ['RELEASE-NOTES']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/checkdocs.yml,\
+              .github/scripts/pyspelling*,\
+              .github/scripts/requirements-docs.txt,\
+              .github/scripts/requirements-proselint.txt,\
+              .github/scripts/typos*,\
+              .github/scripts/verify-examples.pl,\
+              .github/scripts/verify-synopsis.pl,\
+              **/*.md,\
+              **/*.txt,\
+              **/*.1,\
+              CHANGES.md,\
+              docs/**,\
+              LICENSES/**,\
+              README,\
+              RELEASE-NOTES,\
+              scripts/badwords.*,\
+              scripts/cd*,\
+              scripts/mdlinkcheck,\
+              scripts/nroff2cd,\
+              scripts/release-notes.pl\
+              }"
+          - all-globs-to-all-files:
+              # negative matches
+              - '!**/CMakeLists.txt'
+              - '!**/Makefile.am'
 
 FTP:
-- all: ['docs/libcurl/opts/CURLINFO_FTP*']
-- all: ['docs/libcurl/opts/CURLOPT_FTP*']
-- all: ['docs/libcurl/opts/CURLOPT_WILDCARDMATCH*']
-- all: ['lib/curl_fnmatch.*']
-- all: ['lib/curl_range.*']
-- all: ['lib/ftp*']
-- all: ['tests/ftp*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/ftp*,\
+              docs/libcurl/opts/CURLINFO_FTP*,\
+              docs/libcurl/opts/CURLOPT_FTP*,\
+              docs/libcurl/opts/CURLOPT_WILDCARDMATCH*,\
+              docs/examples/ftp*,\
+              lib/curl_fnmatch.*,\
+              lib/curl_range.*,\
+              lib/ftp*,\
+              tests/ftp*,\
+              tests/http/*ftpd*,\
+              tests/http/testenv/*ftpd*,\
+              tests/libtest/*_ftp_*\
+              }"
 
 GOPHER:
-- all: ['lib/gopher*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/gopher*\
+              }"
 
 HTTP:
-- all: ['docs/HSTS.md']
-- all: ['docs/HTTP-COOKIES.md']
-- all: ['docs/libcurl/opts/CURLINFO_COOKIE*']
-- all: ['docs/libcurl/opts/CURLOPT_COOKIE*']
-- all: ['docs/libcurl/opts/CURLINFO_HTTP_**']
-- all: ['docs/libcurl/opts/CURLINFO_REDIRECT*']
-- all: ['docs/libcurl/opts/CURLINFO_REFER*']
-- all: ['docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*']
-- all: ['docs/libcurl/opts/CURLOPT_HSTS*']
-- all: ['docs/libcurl/opts/CURLOPT_HTTP*']
-- all: ['docs/libcurl/opts/CURLOPT_POST.*']
-- all: ['docs/libcurl/opts/CURLOPT_POSTFIELD*']
-- all: ['docs/libcurl/opts/CURLOPT_POSTREDIR*']
-- all: ['docs/libcurl/opts/CURLOPT_REDIR*']
-- all: ['docs/libcurl/opts/CURLOPT_REFER*']
-- all: ['docs/libcurl/opts/CURLOPT_TRAILER*']
-- all: ['docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*']
-- all: ['lib/cf-https*']
-- all: ['lib/cf-h1*']
-- all: ['lib/cf-h2*']
-- all: ['lib/cookie.*']
-- all: ['lib/http*']
-- all: ['tests/http*']
-- all: ['tests/http-server.pl']
-- all: ['tests/http/*']
-- all: ['tests/nghttp*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/HTTPSRR.md,\
+              docs/HSTS.md,\
+              docs/examples/hsts*,\
+              docs/examples/http-*,\
+              docs/examples/httpput*,\
+              docs/examples/https*,\
+              docs/examples/*post*,\
+              docs/HTTP-COOKIES.md,\
+              docs/libcurl/opts/CURLINFO_COOKIE*,\
+              docs/libcurl/opts/CURLINFO_HTTP*,\
+              docs/libcurl/opts/CURLINFO_REDIRECT*,\
+              docs/libcurl/opts/CURLINFO_REFER*,\
+              docs/libcurl/opts/CURLOPT_COOKIE*,\
+              docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*,\
+              docs/libcurl/opts/CURLOPT_HSTS*,\
+              docs/libcurl/opts/CURLOPT_HTTP*,\
+              docs/libcurl/opts/CURLOPT_POST.*,\
+              docs/libcurl/opts/CURLOPT_POSTFIELD*,\
+              docs/libcurl/opts/CURLOPT_POSTREDIR*,\
+              docs/libcurl/opts/CURLOPT_REDIR*,\
+              docs/libcurl/opts/CURLOPT_REFER*,\
+              docs/libcurl/opts/CURLOPT_TRAILER*,\
+              docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*,\
+              lib/cf-https*,\
+              lib/cf-h1*,\
+              lib/cf-h2*,\
+              lib/cookie.*,\
+              lib/hsts.*,\
+              lib/http*,\
+              tests/http*,\
+              tests/http-server.pl,\
+              tests/http/*,\
+              tests/nghttp*\
+              }"
 
 HTTP/2:
-- all: ['docs/HTTP2.md']
-- all: ['docs/libcurl/opts/CURLOPT_STREAM*']
-- all: ['lib/http2*']
-- all: ['tests/http2-server.pl']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindNGHTTP2.cmake,\
+              CMake/FindQuiche.cmake,\
+              docs/libcurl/opts/CURLOPT_STREAM*,\
+              docs/examples/http2*,\
+              lib/http2*,\
+              tests/http2-server.pl\
+              }"
 
 HTTP/3:
-- all: ['.github/workflows/ngtcp2*']
-- all: ['.github/workflows/quiche*']
-- all: ['docs/HTTP3.md']
-- all: ['lib/vquic/**']
-- all: ['tests/http3-server.pl']
-- all: ['tests/nghttpx.conf']
-
-Hyper:
-- all: ['docs/HYPER.md']
-- all: ['lib/c-hyper.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/http3-linux.yml,\
+              CMake/FindNGHTTP3.cmake,\
+              CMake/FindNGTCP2.cmake,\
+              docs/cmdline-opts/proxy-http3.md,\
+              docs/HTTP3.md,\
+              docs/examples/http3*,\
+              lib/cf-h3-proxy.*,\
+              lib/vquic/**,\
+              tests/http3-server.pl,\
+              tests/nghttpx.conf,\
+              tests/http/*httpsrr*\
+              }"
 
 IMAP:
-- all: ['lib/imap*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/imap*,\
+              docs/examples/imap*\
+              }"
 
 LDAP:
-- all: ['lib/*ldap*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/*ldap*\
+              }"
 
 libcurl API:
-- all: ['docs/libcurl/ABI.md']
-- any: ['include/curl/**']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - 'docs/libcurl/ABI.md'
+              - 'docs/libcurl/curl_*.md'
+              - 'include/curl/**'
+
+logging:
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/trace*,\
+              docs/libcurl/curl_global_trace*,\
+              lib/curl_trc*,\
+              tests/http/test_15_tracing.py\
+              }"
 
 MIME:
-- all: ['docs/libcurl/curl_mime_*']
-- all: ['docs/libcurl/opts/CURLOPT_MIME*']
-- all: ['lib/mime*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/libcurl/curl_form*,\
+              docs/libcurl/curl_mime_*,\
+              docs/libcurl/opts/CURLOPT_MIME*,\
+              docs/libcurl/opts/CURLOPT_HTTPPOST*,\
+              lib/formdata*,\
+              lib/mime*,\
+              src/tool_formparse.*\
+              }"
 
 MQTT:
-- all: ['docs/MQTT.md']
-- all: ['lib/mqtt*']
-- all: ['tests/server/mqttd.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/internals/MQTT.md,\
+              lib/mqtt*,\
+              tests/server/mqttd.c\
+              }"
 
 name lookup:
-- all: ['docs/libcurl/opts/CURLINFO_NAMELOOKUP*']
-- all: ['docs/libcurl/opts/CURLOPT_DNS*']
-- all: ['docs/libcurl/opts/CURLOPT_DOH*']
-- all: ['docs/libcurl/opts/CURLOPT_RESOLVE*']
-- all: ['lib/asyn*']
-- all: ['lib/curl_gethostname.*']
-- all: ['lib/doh*']
-- all: ['lib/host*']
-- all: ['lib/idn*']
-- all: ['lib/inet_pton.*']
-- all: ['lib/socketpair*']
-- all: ['tests/server/resolve.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindLibidn2.cmake,\
+              docs/cmdline-opts/doh*,\
+              docs/cmdline-opts/dns*,\
+              docs/examples/resolve.c,\
+              docs/internals/THRDPOOL-AND-QUEUE.md,\
+              docs/libcurl/opts/CURLINFO_NAMELOOKUP*,\
+              docs/libcurl/opts/CURLOPT_DNS*,\
+              docs/libcurl/opts/CURLOPT_DOH*,\
+              docs/libcurl/opts/CURLOPT_RESOLVE*,\
+              lib/*addrinfo*,\
+              lib/asyn*,\
+              lib/cf-dns.*,\
+              lib/curl_gethostname.*,\
+              lib/dns*,\
+              lib/doh*,\
+              lib/host*,\
+              lib/idn*,\
+              lib/socketpair*,\
+              lib/thrdpool.*,\
+              lib/thrdqueue.*,\
+              tests/http/testenv/dnsd.*,\
+              tests/http/*httpsrr*,\
+              tests/http/*resolve.py,\
+              tests/server/dnsd.c,\
+              tests/server/resolve.c\
+              }"
 
 POP3:
-- all: ['lib/pop3.*']
-
-RTMP:
-- all: ['lib/curl_rtmp.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/examples/pop3*,\
+              lib/pop3.*\
+              }"
 
 RTSP:
-- all: ['docs/libcurl/opts/CURLINFO_RTSP*']
-- all: ['docs/libcurl/opts/CURLOPT_RTSP*']
-- all: ['lib/rtsp.*']
-- all: ['tests/rtspserver.pl']
-- all: ['tests/server/rtspd.c']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/libcurl/opts/CURLINFO_RTSP*,\
+              docs/libcurl/opts/CURLOPT_RTSP*,\
+              lib/rtsp.*,\
+              tests/rtspserver.pl,\
+              tests/server/rtspd.c\
+              }"
 
 SCP/SFTP:
-- all: ['docs/libcurl/opts/CURLOPT_SSH*']
-- all: ['lib/vssh/**']
-- all: ['tests/sshhelp.pm']
-- all: ['tests/sshserver.pl']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindLibssh.cmake,\
+              CMake/FindLibssh2.cmake,\
+              docs/cmdline-opts/knownhosts.md,\
+              docs/libcurl/opts/CURLOPT_SSH*,\
+              docs/examples/sftp*,\
+              lib/vssh/**,\
+              tests/sshhelp.pm,\
+              tests/sshserver.pl,\
+              tests/http/*scp*,\
+              tests/http/*sftp*,\
+              tests/http/testenv/sshd.py\
+              }"
 
 script:
-- all: ['**/*.pl']
-- all: ['**/*.sh']
-- all: ['curl-config.in']
-- all: ['docs/curl-config.1']
-- all: ['docs/mk-ca-bundle.1']
-- all: ['docs/THANKS-filter']
-- all: ['scripts/**']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              **/*.pl,\
+              **/*.sh,\
+              curl-config.in,\
+              docs/curl-config.md,\
+              docs/mk-ca-bundle.md,\
+              docs/wcurl.md,\
+              docs/THANKS-filter,\
+              scripts/**\
+              }"
 
 SMB:
-- all: ['lib/smb.*']
-- all: ['tests/smbserver.py']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/smb.*,\
+              tests/smbserver.py\
+              }"
 
 SMTP:
-- all: ['docs/libcurl/opts/CURLOPT_MAIL*']
-- all: ['lib/smtp.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/cmdline-opts/mail*,\
+              docs/examples/smtp-*,\
+              docs/libcurl/opts/CURLOPT_MAIL*,\
+              lib/smtp.*\
+              }"
 
 tests:
-- any: ['tests/**']
+  - all:
+      - changed-files:
+          - any-glob-to-any-file:
+              - 'docs/tests/**'
+              - 'tests/**'
 
 TFTP:
-- all: ['lib/tftp.*']
-- all: ['tests/tftpserver.pl']
-- all: ['tests/server/tftp*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              lib/tftp.*,\
+              tests/tftpserver.pl,\
+              tests/server/tftp*\
+              }"
 
 TLS:
-- all: ['docs/SSL*']
-- all: ['docs/libcurl/opts/CURLINFO_CA*']
-- all: ['docs/libcurl/opts/CURLINFO_CERT*']
-- all: ['docs/libcurl/opts/CURLINFO_SSL*']
-- all: ['docs/libcurl/opts/CURLINFO_TLS*']
-- all: ['docs/libcurl/opts/CURLOPT_CA*']
-- all: ['docs/libcurl/opts/CURLOPT_CERT*']
-- all: ['docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*']
-- all: ['docs/libcurl/opts/CURLOPT_SSL*']
-- all: ['docs/libcurl/opts/CURLOPT_TLS*']
-- all: ['docs/libcurl/opts/CURLOPT_USE_SSL*']
-- all: ['lib/vtls/**']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              CMake/FindGnuTLS.cmake,\
+              CMake/FindMbedTLS.cmake,\
+              CMake/FindWolfSSL.cmake,\
+              CMake/FindRustls.cmake,\
+              docs/CIPHERS-TLS12.md,\
+              docs/SSL*,\
+              docs/cmdline-opts/dump-ca-embed.md,\
+              docs/cmdline-opts/*cert*,\
+              docs/cmdline-opts/*ssl*,\
+              docs/cmdline-opts/*tls*,\
+              docs/examples/ssl*,\
+              docs/examples/*ssl.*,\
+              docs/examples/*tls.*,\
+              docs/internals/TLS-SESSIONS.md,\
+              docs/libcurl/curl_global_sslset*,\
+              docs/libcurl/curl_easy_ssls*,\
+              docs/libcurl/opts/CURLINFO_CA*,\
+              docs/libcurl/opts/CURLINFO_CERT*,\
+              docs/libcurl/opts/CURLINFO_EARLYDATA*,\
+              docs/libcurl/opts/CURLINFO_SSL*,\
+              docs/libcurl/opts/CURLINFO_TLS*,\
+              docs/libcurl/opts/CURLOPT_CA*,\
+              docs/libcurl/opts/CURLOPT_CERT*,\
+              docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*,\
+              docs/libcurl/opts/CURLOPT_SSL*,\
+              docs/libcurl/opts/CURLOPT_TLS*,\
+              docs/libcurl/opts/CURLOPT_USE_SSL*,\
+              lib/vtls/**,\
+              m4/curl-gnutls.m4,\
+              m4/curl-mbedtls.m4,\
+              m4/curl-openssl.m4,\
+              m4/curl-rustls.m4,\
+              m4/curl-schannel.m4,\
+              m4/curl-wolfssl.m4,\
+              src/tool_ssls.*\
+              }"
 
 URL:
-- all: ['docs/libcurl/curl_url*']
-- all: ['docs/URL-SYNTAX.md']
-- all: ['include/curl/urlapi.h']
-- all: ['lib/urlapi*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/libcurl/curl_url*,\
+              docs/URL-SYNTAX.md,\
+              docs/examples/parseurl*,\
+              include/curl/urlapi.h,\
+              lib/urlapi*\
+              }"
 
 WebSocket:
-- all: ['docs/WEBSOCKET.md*']
-- all: ['docs/libcurl/curl_ws_*']
-- all: ['docs/libcurl/libcurl-ws.3']
-- all: ['docs/libcurl/opts/CURLOPT_WS_*']
-- all: ['include/curl/websockets.h']
-- all: ['lib/ws.*']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              docs/internals/WEBSOCKET.md,\
+              docs/examples/websocket*,\
+              docs/libcurl/curl_ws_*,\
+              docs/libcurl/libcurl-ws*,\
+              docs/libcurl/opts/CURLOPT_WS_*,\
+              include/curl/websockets.h,\
+              lib/ws.*,\
+              tests/http/test_20_websockets.py,\
+              tests/http/testenv/ws*,\
+              tests/libtest/cli_ws*\
+              }"
 
 Windows:
-- all: ['CMake/Platforms/WindowsCache.cmake']
-- all: ['lib/*win32*']
-- all: ['lib/curl_multibyte.*']
-- all: ['lib/rename.*']
-- all: ['lib/vtls/schannel*']
-- all: ['m4/curl-schannel.m4']
-- all: ['projects/**']
-- all: ['src/tool_doswin.c']
-- all: ['winbuild/**']
-- all: ['libcurl.def']
+  - all:
+      - changed-files:
+          - any-glob-to-all-files: "{\
+              .github/workflows/windows.yml,\
+              appveyor.*,\
+              CMake/win32-cache.cmake,\
+              lib/*win32*,\
+              lib/curlx/fopen.*,\
+              lib/curlx/multibyte.*,\
+              lib/curlx/winapi.*,\
+              lib/libcurl.def,\
+              lib/vtls/schannel*,\
+              m4/curl-schannel.m4,\
+              projects/Windows/**,\
+              src/tool_doswin.c\
+              }"

third-party/curl/.github/pull_request_template.md

@@ -0,0 +1,8 @@
+<!--
+        IMPORTANT:
+        If you cannot understand or explain your work without using
+        Artificial Intelligence (AI) then do not file here. Do not paste
+        massive AI generated explanations. We accept the use of AI as long as
+        it is digestible. Please explain your issues or improvements briefly
+        and clearly in your own human voice.
+-->

third-party/curl/.github/scripts/cleancmd.pl

@@ -0,0 +1,130 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Input: cmdline docs markdown files, they get modified *in place*
+#
+# Strip off the leading meta-data/header part, remove all known curl symbols
+# and long command line options. Also clean up whatever else the spell checker
+# might have a problem with that we still deem is fine.
+#
+
+use strict;
+use warnings;
+
+my @asyms;
+
+open(S, "<./docs/libcurl/symbols-in-versions")
+    or die "cannot find symbols-in-versions";
+while(<S>) {
+    if(/^([^ ]*) /) {
+        push @asyms, $1;
+    }
+}
+close(S);
+
+# init the opts table with "special" options not easy to figure out
+my @aopts = (
+    '--ftp-ssl-reqd', # old alias
+    );
+
+open(O, "<./docs/options-in-versions")
+    or die "cannot find options-in-versions";
+while(<O>) {
+    chomp;
+    if(/^([^ ]+)/) {
+        my $o = $1;
+        push @aopts, $o;
+        if($o =~ /^--no-(.*)/) {
+            # for the --no options, also make one without it
+            push @aopts, "--$1";
+        }
+        elsif($o =~ /^--disable-(.*)/) {
+            # for the --disable options, also make the special ones
+            push @aopts, "--$1";
+            push @aopts, "--no-$1";
+        }
+    }
+}
+close(O);
+
+open(C, "<./.github/scripts/spellcheck.curl")
+    or die "cannot find spellcheck.curl";
+while(<C>) {
+    if(/^\#/) {
+        next;
+    }
+    chomp;
+    if(/^([^ ]+)/) {
+        push @asyms, $1;
+    }
+}
+close(C);
+
+# longest symbols first
+my @syms = sort { length($b) <=> length($a) } @asyms;
+
+# longest cmdline options first
+my @opts = sort { length($b) <=> length($a) } @aopts;
+
+sub process {
+    my ($f) = @_;
+
+    my $ignore = 0;
+    my $sepcount = 0;
+    my $out;
+    my $line = 0;
+    open(F, "<$f") or die;
+
+    while(<F>) {
+        $line++;
+        if(/^---/ && ($line == 1)) {
+            $ignore = 1;
+            next;
+        }
+        elsif(/^---/ && $ignore) {
+            $ignore = 0;
+            next;
+        }
+        next if($ignore);
+
+        my $l = $_;
+
+        # strip out backticked words
+        $l =~ s/`[^`]+`//g;
+
+        # **bold**
+        $l =~ s/\*\*(\S.*?)\*\*//g;
+        # *italics*
+        $l =~ s/\*(\S.*?)\*//g;
+
+        # strip out https URLs, we do not want them spellchecked
+        $l =~ s!https://[a-z0-9\#_/.-]+!!gi;
+
+        # strip links, both name and target
+        $l =~ s/(\[.*?\])\(.*?\)//g;
+        $out .= $l;
+    }
+    close(F);
+
+    # cut out all known curl cmdline options
+    map { $out =~ s/$_//g; } (@opts);
+
+    # cut out all known curl symbols
+    map { $out =~ s/\b$_\b//g; } (@syms);
+
+    if(!$ignore) {
+        open(O, ">$f") or die;
+        print O $out;
+        close(O);
+    }
+}
+
+my @filemasks = @ARGV;
+open(my $git_ls_files, '-|', 'git', 'ls-files', '--', @filemasks) or die "Failed running git ls-files: $!";
+while(my $f = <$git_ls_files>) {
+    chomp $f;
+    process($f);
+}
+close $git_ls_files;

third-party/curl/.github/scripts/cleanspell.pl

@@ -1,79 +0,0 @@
-#!/usr/bin/perl
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Input: a libcurl nroff man page
-# Output: the same file, minus the SYNOPSIS and the EXAMPLE sections
-#
-
-my $f = $ARGV[0];
-my $o = $ARGV[1];
-
-open(F, "<$f") or die;
-open(O, ">$o") or die;
-
-my $ignore = 0;
-while(<F>) {
-    if($_ =~ /^.SH (SYNOPSIS|EXAMPLE|\"SEE ALSO\"|SEE ALSO)/) {
-        $ignore = 1;
-    }
-    elsif($ignore && ($_ =~ /^.SH/)) {
-        $ignore = 0;
-    }
-    elsif(!$ignore) {
-        # filter out mentioned CURLE_ names
-        $_ =~ s/CURL(M|SH|U|H)code//g;
-        $_ =~ s/CURL_(READ|WRITE)FUNC_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_CSELECT_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_DISABLE_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_FORMADD_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_HET_DEFAULT//g;
-        $_ =~ s/CURL_IPRESOLVE_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_PROGRESSFUNC_CONTINUE//g;
-        $_ =~ s/CURL_REDIR_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_RTSPREQ_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_TIMECOND_[A-Z0-9_]*//g;
-        $_ =~ s/CURL_VERSION_[A-Z0-9_]*//g;
-        $_ =~ s/CURLALTSVC_[A-Z0-9_]*//g;
-        $_ =~ s/CURLAUTH_[A-Z0-9_]*//g;
-        $_ =~ s/CURLE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFORM_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTP_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTPAUTH_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTPMETHOD_[A-Z0-9_]*//g;
-        $_ =~ s/CURLFTPSSL_[A-Z0-9_]*//g;
-        $_ =~ s/CURLGSSAPI_[A-Z0-9_]*//g;
-        $_ =~ s/CURLHEADER_[A-Z0-9_]*//g;
-        $_ =~ s/CURLINFO_[A-Z0-9_]*//g;
-        $_ =~ s/CURLM_[A-Z0-9_]*//g;
-        $_ =~ s/CURLMIMEOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLMOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPIPE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPROTO_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPROXY_[A-Z0-9_]*//g;
-        $_ =~ s/CURLPX_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSHE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSHOPT_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSSH_[A-Z0-9_]*//g;
-        $_ =~ s/CURLSSLBACKEND_[A-Z0-9_]*//g;
-        $_ =~ s/CURLU_[A-Z0-9_]*//g;
-        $_ =~ s/CURLUE_[A-Z0-9_]*//g;
-        $_ =~ s/CURLUPART_[A-Z0-9_]*//g;
-        $_ =~ s/CURLUSESSL_[A-Z0-9_]*//g;
-        $_ =~ s/curl_global_(init_mem|sslset|cleanup)//g;
-        $_ =~ s/curl_(strequal|strnequal|formadd|waitfd|formget|getdate|formfree)//g;
-        $_ =~ s/curl_easy_(nextheader|duphandle)//g;
-        $_ =~ s/curl_multi_fdset//g;
-        $_ =~ s/curl_mime_(subparts|addpart|filedata|data_cb)//g;
-        $_ =~ s/curl_ws_(send|recv|meta)//g;
-        $_ =~ s/curl_url_(dup)//g;
-        $_ =~ s/curl_pushheader_by(name|num)//g;
-        $_ =~ s/libcurl-(env|ws)//g;
-        $_ =~ s/(^|\W)((tftp|https|http|ftp):\/\/[a-z0-9\-._~%:\/?\#\[\]\@!\$&'()*+,;=]+)//gi;
-        print O $_;
-    }
-}
-close(F);
-close(O);

third-party/curl/.github/scripts/cmp-config.pl

@@ -0,0 +1,136 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my $autotools = $ARGV[0];
+my $cmake = $ARGV[1];
+
+if(!$cmake) {
+    print "Usage: cmp-config <config1> <config2.h>\n";
+    exit;
+}
+
+# this lists complete lines that are removed from the output if matching
+my %remove = (
+    '#define CURL_EXTERN_SYMBOL' => 1,
+    '#define CURL_OS "Linux"' => 1,
+    '#define CURL_OS "x86_64-pc-linux-gnu"' => 1,
+    '#define GETHOSTNAME_TYPE_ARG2 int' => 1,
+    '#define GETHOSTNAME_TYPE_ARG2 size_t' => 1,
+    '#define HAVE_BROTLI 1' => 1,
+    '#define HAVE_BROTLI_DECODE_H 1' => 1,
+    '#define HAVE_DLFCN_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_GENERIC_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_KRB5_H 1' => 1,
+    '#define HAVE_INTTYPES_H 1' => 1,
+    '#define HAVE_LDAP_H 1' => 1,
+    '#define HAVE_LDAP_SSL 1' => 1,
+    '#define HAVE_LIBBROTLIDEC 1' => 1,
+    '#define HAVE_LIBPSL_H 1' => 1,
+    '#define HAVE_LIBSOCKET 1' => 1,
+    '#define HAVE_LIBSSH' => 1,
+    '#define HAVE_LIBSSH2 1' => 1,
+    '#define HAVE_LIBSSL 1' => 1,
+    '#define HAVE_LIBZSTD 1' => 1,
+    '#define HAVE_NGHTTP2_NGHTTP2_H 1' => 1,
+    '#define HAVE_NGHTTP3_NGHTTP3_H 1' => 1,
+    '#define HAVE_NGTCP2_NGTCP2_CRYPTO_H 1' => 1,
+    '#define HAVE_NGTCP2_NGTCP2_H 1' => 1,
+    '#define HAVE_OPENSSL_CRYPTO_H 1' => 1,
+    '#define HAVE_OPENSSL_ERR_H 1' => 1,
+    '#define HAVE_OPENSSL_PEM_H 1' => 1,
+    '#define HAVE_OPENSSL_RSA_H 1' => 1,
+    '#define HAVE_OPENSSL_SSL_H 1' => 1,
+    '#define HAVE_QUICHE_H 1' => 1,
+    '#define HAVE_SSL_SET_QUIC_TLS_CBS 1' => 1,
+    '#define HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT 1' => 1,
+    '#define HAVE_STDINT_H 1' => 1,
+    '#define HAVE_STDIO_H 1' => 1,
+    '#define HAVE_STDLIB_H 1' => 1,
+    '#define HAVE_STRING_H 1' => 1,
+    '#define HAVE_SYS_STAT_H 1' => 1,
+    '#define HAVE_SYS_XATTR_H 1' => 1,
+    '#define HAVE_UNICODE_UIDNA_H 1' => 1,
+    '#define HAVE_WOLFSSL_SET_QUIC_USE_LEGACY_CODEPOINT 1' => 1,
+    '#define HAVE_ZSTD 1' => 1,
+    '#define HAVE_ZSTD_H 1' => 1,
+    '#define LT_OBJDIR ".libs/"' => 1,
+    '#define NEED_LBER_H 1' => 1,
+    '#define PACKAGE "curl"' => 1,
+    '#define PACKAGE_BUGREPORT "a suitable curl mailing list: https://curl.se/mail/"' => 1,
+    '#define PACKAGE_NAME "curl"' => 1,
+    '#define PACKAGE_STRING "curl -"' => 1,
+    '#define PACKAGE_TARNAME "curl"' => 1,
+    '#define PACKAGE_URL ""' => 1,
+    '#define PACKAGE_VERSION "-"' => 1,
+    '#define VERSION "-"' => 1,
+    '#define _FILE_OFFSET_BITS 64' => 1,
+    );
+
+sub filter {
+    my ($line) = @_;
+    if(!$remove{$line}) {
+        return "$line\n";
+    }
+    $remove{$line}++;
+    return "";
+}
+
+sub grepit {
+    my ($input, $output) = @_;
+    my @defines;
+    # first get all the #define lines
+    open(F, "<$input");
+    while(<F>) {
+        if($_ =~ /^#def/) {
+            chomp;
+            push @defines, $_;
+        }
+    }
+    close(F);
+
+    open(O, ">$output");
+
+    # output the sorted list through the filter
+    foreach my $d(sort @defines) {
+        print O filter($d);
+    }
+    close(O);
+}
+
+grepit($autotools, "/tmp/autotools");
+grepit($cmake, "/tmp/cmake");
+
+foreach my $v (keys %remove) {
+    if($remove{$v} == 1) {
+        print "Ignored, never matched line: $v\n";
+    }
+}
+
+# return the exit code from diff
+exit system('diff', ('-u', '/tmp/autotools', '/tmp/cmake')) >> 8;

third-party/curl/.github/scripts/cmp-pkg-config.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# Sort list of libs, libpaths, cflags found in libcurl.pc and curl-config files,
+# then diff the autotools and cmake generated ones.
+
+sort_lists() {
+  prevline=''
+  section=''
+  while IFS= read -r l; do
+    if [[ "${prevline}" =~ (--cc|--configure) ]]; then  # curl-config
+      echo "<IGNORED>"
+    else
+      # libcurl.pc
+      if [[ "${l}" =~ ^(Requires|Libs|Cflags)(\.private)?:\ (.+)$ ]]; then
+        if [ "${BASH_REMATCH[1]}" = 'Requires' ]; then
+          # Spec does not allow duplicates here:
+          # https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html#Requires:
+          # "You may only mention the same package one time on the Requires: line"
+          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ',' '\n' | sort | tr '\n' ' ')"
+        else
+          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
+        fi
+        l="${BASH_REMATCH[1]}${BASH_REMATCH[2]}: ${val}"
+      # curl-config
+      elif [[ "${section}" =~ (--libs|--static-libs) && "${l}" =~ ^( *echo\ \")(.+)(\")$ ]]; then
+        val="$(printf '%s' "${BASH_REMATCH[2]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
+        l="${BASH_REMATCH[1]}${val}${BASH_REMATCH[3]}"
+        section=''
+      fi
+      echo "${l}"
+    fi
+    # curl-config
+    prevline="${l}"
+    if [[ "${l}" =~ --[a-z-]+\) ]]; then
+      section="${BASH_REMATCH[0]}"
+    fi
+  done < "$1"
+}
+
+am=$(mktemp -t autotools.XXX); sort_lists "$1" > "${am}"
+cm=$(mktemp -t cmake.XXX)    ; sort_lists "$2" > "${cm}"
+diff -u "${am}" "${cm}"
+res="$?"
+rm -r -f "${am}" "${cm}"
+
+exit "${res}"

third-party/curl/.github/scripts/codespell-ignore.words

@@ -0,0 +1,21 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+anonymou
+aNULL
+bu
+clen
+CNA
+hel
+htpts
+inout
+PASE
+passwor
+perfec
+proxys
+seh
+ser
+strat
+te
+UE
+WONT

third-party/curl/.github/scripts/codespell.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git ls-files -z | xargs -0 -r \
+codespell \
+  --skip '.github/scripts/pyspelling.words' \
+  --skip '.github/scripts/typos.toml' \
+  --skip 'docs/THANKS' \
+  --skip 'projects/OS400/*' \
+  --skip 'projects/vms/*' \
+  --skip 'RELEASE-NOTES' \
+  --skip 'scripts/wcurl' \
+  --skip 'tests/unit/unit1625.c' \
+  --ignore-regex '.*spellchecker:disable-line' \
+  --ignore-words '.github/scripts/codespell-ignore.words' \
+  --

third-party/curl/.github/scripts/distfiles.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# Compare git repo files with tarball files and report a mismatch
+# after excluding exceptions.
+
+set -eu
+
+gitonly=".git*
+^.*
+^appveyor.*
+^GIT-INFO.md
+^README.md
+^renovate.json
+^REUSE.toml
+^SECURITY.md
+^LICENSES/*
+^docs/examples/adddocsref.pl
+^docs/tests/CI.md
+^docs/THANKS-filter
+^projects/Windows/*
+^scripts/contributors.sh
+^scripts/contrithanks.sh
+^scripts/delta
+^scripts/installcheck.sh
+^scripts/release-notes.pl
+^scripts/singleuse.pl"
+
+tarfiles="$(mktemp)"
+gitfiles="$(mktemp)"
+
+tar -tf "$1" \
+  | sed -E 's|^[^/]+/||g' \
+  | grep -v -E '(/|^)$' \
+  | sort > "${tarfiles}"
+
+git -C "${2:-.}" ls-files \
+  | grep -v -E "($(printf '%s' "${gitonly}" | tr $'\n' '|' | sed -e 's|\.|\\.|g' -e 's|\*|.+|g'))$" \
+  | sort > "${gitfiles}"
+
+dif="$(diff -u "${tarfiles}" "${gitfiles}" | tail -n +3 || true)"
+
+rm -rf "${tarfiles:?}" "${gitfiles:?}"
+
+echo 'Only in tarball:'
+echo "${dif}" | grep '^-' || true
+echo
+
+echo 'Missing from tarball:'
+if echo "${dif}" | grep '^+'; then
+  exit 1
+fi

third-party/curl/.github/scripts/pyspelling.yaml

@@ -0,0 +1,33 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Docs: https://facelessuser.github.io/pyspelling/configuration/
+# Docs: https://github.com/UnicornGlobal/spellcheck-github-actions
+matrix:
+  - name: Markdown
+    expect_match: false
+    apsell:
+      mode: en
+    dictionary:
+      wordlists:
+        - wordlist.txt
+      output: wordlist.dic
+      encoding: utf-8
+    pipeline:
+      - pyspelling.filters.markdown:
+          markdown_extensions:
+            - markdown.extensions.extra:
+      - pyspelling.filters.html:
+          comments: true
+          attributes:
+            - title
+            - alt
+          ignores:
+            - ':matches(code, pre)'
+            - 'code'
+            - 'pre'
+            - 'strong'
+            - 'em'
+    sources:
+      - '**/*.md|!docs/BINDINGS.md|!docs/DISTROS.md|!docs/CIPHERS-TLS12.md|!docs/wcurl.md|!tests/data/data*.md'

third-party/curl/.github/scripts/randcurl.pl

@@ -0,0 +1,251 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Input: number of seconds to run.
+#
+# 1. Figure out all existing command line options
+# 2. Generate random command line using supported options
+# 3. Run the command line
+# 4. Verify that it does not return an unexpected return code
+# 5. Iterate until the time runs out
+#
+# Do the same with regular command lines as well as reading the options from a
+# -K config file
+#
+# BEWARE: this may create a large amount of files using random names in the
+# directory where it runs.
+#
+
+use strict;
+use warnings;
+
+my $curl = "../src/curl";
+my $url = "localhost:7777"; # not listening to this
+
+my $seconds = $ARGV[0];
+if($ARGV[1]) {
+    $curl = $ARGV[1];
+}
+
+if(!$seconds) {
+    $seconds = 10;
+}
+print "Run $curl for $seconds seconds\n";
+
+my @opt;
+my %arg;
+my %uniq;
+my %allrc;
+
+my $totalargs = 0;
+my $totalcmds = 0;
+
+my $counter = 0xabcdef + time();
+sub getnum {
+    my ($max) = @_;
+    return int(rand($max));
+}
+
+sub storedata {
+    my ($short, $long, $arg) = @_;
+    push @opt, "-$short" if($short);
+    push @opt, "--$long";
+
+    if($arg =~ /^</) {
+        # these take an argument
+        $arg{"-$short"} = $arg if($short);
+        $arg{"--$long"} = $arg;
+    }
+}
+
+sub getoptions {
+    my @all = qx($curl --help all);
+    for my $o (@all) {
+        chomp $o;
+        if($o =~ /^ -(.), --([^ ]*) (.*)/) {
+            storedata($1, $2, $3);
+        }
+        elsif($o =~ /^     --([^ ]*) (.*)/) {
+            storedata("", $1, $2);
+        }
+    }
+}
+
+# this adds a fake randomly generated command line option
+sub addarg {
+    my $nice = "abcdefhijklmnopqrstuvwqxyz".
+        "ABCDEFHIJKLMNOPQRSTUVWQXYZ".
+        "0123456789-";
+    my $len = getnum(20) + 2;
+    my $o;
+    for (1 .. $len) {
+        $o .= substr($nice, getnum(length($nice)), 1);
+    }
+    return "--$o";
+}
+
+sub randarg {
+    my $nice = "abcdefhijklmnopqrstuvwqxyz".
+        "ABCDEFHIJKLMNOPQRSTUVWQXYZ".
+        "0123456789".
+        ",-?#$%!@ ";
+    my $len = getnum(20);
+    my $o = '';
+    for (1 .. $len) {
+        $o .= substr($nice, getnum(length($nice)), 1);
+    }
+    return "\'$o\'";
+}
+
+getoptions();
+
+my $nopts = scalar(@opt);
+
+my %useropt = (
+    '-U' => 1,
+    '-u' => 1,
+    '--user' => 1,
+    '--proxy-user' => 1);
+
+my %commonrc = (
+    '0' => 1,
+    '1' => 1,
+    '2' => 1,
+    '26' => 1,
+    );
+
+sub runone {
+    my $a;
+    my $nargs = getnum(60) + 1;
+
+    $totalargs += $nargs;
+    $totalcmds++;
+    for (1 .. $nargs) {
+        my $o = getnum($nopts);
+        my $option = $opt[$o];
+        my $ar = "";
+        $uniq{$option}++;
+        if($arg{$option}) {
+            $ar = " ".randarg();
+
+            if($useropt{$option}) {
+                # append password to avoid prompting
+                $ar .= ":".randarg();
+            }
+        }
+        $a .= sprintf(" %s%s", $option, $ar);
+    }
+    if(getnum(100) < 15) {
+        # add a fake arg
+        $a .= " ".addarg();
+    }
+
+    my $cmd = "$curl$a $url";
+
+    my $rc = system("$cmd >curl-output 2>&1 </dev/null -M 0.1") >> 8;
+    #my $rc = system("valgrind -q $cmd >/dev/null 2>&1 </dev/null -M 0.1") >> 8;
+
+    $allrc{$rc}++;
+
+    #print "CMD: $cmd\n";
+    if(!$commonrc{$rc}) {
+        print "CMD: $cmd\n";
+        print "RC: $rc\n";
+        print "== curl-output == \n";
+        open(D, "<curl-output");
+        my @out = <D>;
+        print @out;
+        close(D);
+        exit;
+    }
+}
+
+sub runconfig {
+    my $a;
+    my $nargs = getnum(80) + 1;
+
+    open(C, ">config");
+
+    $totalargs += $nargs;
+    $totalcmds++;
+    for (1 .. $nargs) {
+        my $o = getnum($nopts);
+        my $option = $opt[$o];
+        my $ar = "";
+        $uniq{$option} = 0 if(!exists $uniq{$option});
+        $uniq{$option}++;
+        if($arg{$option}) {
+            $ar = " ".randarg();
+
+            if($useropt{$option}) {
+                # append password
+                $ar .= ":".randarg();
+            }
+        }
+        $a .= sprintf("\n%s%s", $option, $ar);
+    }
+    if(getnum(100) < 15) {
+        # add a fake arg
+        $a .= "\n".addarg();
+    }
+
+    print C "$a\n";
+    close(C);
+
+    my $cmd = "$curl -K config $url";
+
+    my $rc = system("$cmd >curl-output 2>&1 </dev/null -M 0.1") >> 8;
+
+    $allrc{$rc}++;
+
+    if(!$commonrc{$rc}) {
+        print "CMD: $cmd\n";
+        print "RC: $rc\n";
+        print "== config == \n";
+        open(D, "<config");
+        my @all = <D>;
+        print @all;
+        close(D);
+        print "\n== curl-output == \n";
+        open(D, "<curl-output");
+        my @out = <D>;
+        print @out;
+        close(D);
+        exit 2;
+    }
+}
+
+# run curl command lines using -K
+my $end = time() + $seconds / 2;
+my $c = 0;
+print "Running command lines\n";
+do {
+    runconfig();
+    $c++;
+} while(time() <= $end);
+print "$c command lines\n";
+
+# run curl command lines
+$end = time() + $seconds / 2;
+$c = 0;
+print "Running config lines\n";
+do {
+    runone();
+    $c++;
+} while(time() <= $end);
+
+print "$c config line uses\n";
+
+print "Recorded exit codes:\n";
+for my $rc (keys %allrc) {
+    printf " %2d: %d times\n", $rc, $allrc{$rc};
+}
+printf "Number or command lines tested:\n".
+    " $totalcmds (%.1f/second)\n", $totalcmds/$seconds;
+printf "Number or command line options tested:\n".
+    " $totalargs (average %.1f per command line)\n",
+    $totalargs/$totalcmds;
+printf "Number or different options tested:\n".
+    " %u out of %u\n", scalar(keys %uniq), $nopts;

third-party/curl/.github/scripts/requirements-docs.txt

@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+pyspelling==2.12.1

third-party/curl/.github/scripts/requirements-proselint.txt

@@ -0,0 +1,5 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+proselint==0.16.0

third-party/curl/.github/scripts/requirements.txt

@@ -0,0 +1,8 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+cmakelang==0.6.13
+codespell==2.4.2
+reuse==6.2.0
+ruff==0.15.16

third-party/curl/.github/scripts/shellcheck-ci.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+# Required: yq
+
+set -eu
+
+export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
+
+# GHA
+git ls-files '.github/workflows/*.yml' | while read -r f; do
+  echo "Verifying ${f}..."
+  {
+    echo '#!/usr/bin/env bash'
+    echo 'set -eu'
+    yq eval '.. | select(has("run") and (.run | type == "!!str")) | .run + "\ntrue\n"' "${f}"
+  } | sed -E 's|\$\{\{ .+ \}\}|GHA_EXPRESSION|g' | shellcheck -
+done
+
+# Circle CI
+git ls-files '.circleci/*.yml' | while read -r f; do
+  echo "Verifying ${f}..."
+  {
+    echo '#!/usr/bin/env bash'
+    echo 'set -eu'
+    yq eval '.. | select(has("command") and (.command | type == "!!str")) | .command + "\ntrue\n"' "${f}"
+  } | shellcheck -
+done

third-party/curl/.github/scripts/shellcheck.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git grep -z -l -E '^#!(/usr/bin/env bash|/bin/sh|/bin/bash)' | xargs -0 -r \
+shellcheck --exclude=1091,2248 \
+  --enable=avoid-nullary-conditions,deprecate-which \
+  --

third-party/curl/.github/scripts/spellcheck.curl

@@ -0,0 +1,153 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# common variable types + structs
+# callback typedefs
+# public functions names
+# some man page names
+curl_fileinfo
+curl_forms
+curl_hstsentry
+curl_httppost
+curl_index
+curl_khkey
+curl_pushheaders
+curl_waitfd
+CURLcode
+CURLformoption
+CURLHcode
+CURLMcode
+CURLMsg
+CURLSHcode
+CURLUcode
+curl_calloc_callback
+curl_chunk_bgn_callback
+curl_chunk_end_callback
+curl_conv_callback
+curl_debug_callback
+curl_fnmatch_callback
+curl_formget_callback
+curl_free_callback
+curl_hstsread_callback
+curl_hstswrite_callback
+curl_ioctl_callback
+curl_malloc_callback
+curl_multi_timer_callback
+curl_opensocket_callback
+curl_prereq_callback
+curl_progress_callback
+curl_push_callback
+curl_read_callback
+curl_realloc_callback
+curl_resolver_start_callback
+curl_seek_callback
+curl_socket_callback
+curl_sockopt_callback
+curl_ssl_ctx_callback
+curl_strdup_callback
+curl_trailer_callback
+curl_write_callback
+curl_xferinfo_callback
+curl_strequal
+curl_strnequal
+curl_mime_init
+curl_mime_free
+curl_mime_addpart
+curl_mime_name
+curl_mime_filename
+curl_mime_type
+curl_mime_encoder
+curl_mime_data
+curl_mime_filedata
+curl_mime_data_cb
+curl_mime_subparts
+curl_mime_headers
+curl_formadd
+curl_formget
+curl_formfree
+curl_getdate
+curl_getenv
+curl_version
+curl_easy_escape
+curl_escape
+curl_easy_unescape
+curl_unescape
+curl_free
+curl_global_init
+curl_global_init_mem
+curl_global_cleanup
+curl_global_trace
+curl_global_sslset
+curl_slist_append
+curl_slist_free_all
+curl_getdate
+curl_share_init
+curl_share_setopt
+curl_share_cleanup
+curl_version_info
+curl_easy_strerror
+curl_share_strerror
+curl_easy_pause
+curl_easy_ssls_import
+curl_easy_ssls_export
+curl_easy_init
+curl_easy_setopt
+curl_easy_perform
+curl_easy_cleanup
+curl_easy_getinfo
+curl_easy_duphandle
+curl_easy_reset
+curl_easy_recv
+curl_easy_send
+curl_easy_upkeep
+curl_easy_header
+curl_easy_nextheader
+curl_mprintf
+curl_mfprintf
+curl_msprintf
+curl_msnprintf
+curl_mvprintf
+curl_mvfprintf
+curl_mvsprintf
+curl_mvsnprintf
+curl_maprintf
+curl_mvaprintf
+curl_multi_init
+curl_multi_add_handle
+curl_multi_remove_handle
+curl_multi_fdset
+curl_multi_waitfds
+curl_multi_wait
+curl_multi_poll
+curl_multi_wakeup
+curl_multi_perform
+curl_multi_cleanup
+curl_multi_info_read
+curl_multi_strerror
+curl_multi_socket
+curl_multi_socket_action
+curl_multi_socket_all
+curl_multi_timeout
+curl_multi_setopt
+curl_multi_assign
+curl_multi_get_handles
+curl_multi_get_offt
+curl_multi_notify_disable
+curl_multi_notify_enable
+curl_pushheader_bynum
+curl_pushheader_byname
+curl_easy_option_by_name
+curl_easy_option_by_id
+curl_easy_option_next
+curl_url
+curl_url_cleanup
+curl_url_dup
+curl_url_get
+curl_url_set
+curl_url_strerror
+curl_ws_recv
+curl_ws_send
+curl_ws_meta
+libcurl-env
+libcurl-ws

third-party/curl/.github/scripts/spellcheck.words

@@ -1,909 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-ABI
-accessor
-ACK
-AES
-AIA
-AIX
-al
-Alessandro
-allocator
-alnum
-ALPN
-Altera
-ALTSVC
-amiga
-AmigaOS
-AmiSSL
-anyauth
-anycast
-apache
-Apache
-API
-APIs
-APOP
-AppVeyor
-archivers
-Archos
-Arntsen
-Aros
-ascii
-asynch
-AsynchDNS
-atime
-auth
-autobuild
-autobuilds
-Autoconf
-Automake
-Autotools
-autotools
-AVR
-AWS
-AWS-LC
-axTLS
-backend
-backends
-backoff
-backticks
-Baratov
-basename
-bashrc
-BDFL
-BearSSL
-Benoit
-BeOS
-bitmask
-bitwise
-Björn
-Bjørn
-bool
-boolean
-BoringSSL
-boringssl
-Boukris
-Broadcom
-brotli
-bufq
-bufref
-bugfix
-bugfixes
-buildable
-buildbot
-buildconf
-Caddy
-calloc
-CAPA
-capath
-CCC
-CDN
-CentOS
-CFLAGS
-CGI's
-CHACHA
-chacha
-Chaffraix
-changelog
-changeset
-CharConv
-charset
-charsets
-checksrc
-checksums
-chgrp
-chmod
-chown
-ChromeOS
-CI's
-CIDR
-CIFS
-CLA
-CLAs
-cleartext
-CLI
-clientp
-cliget
-closesocket
-CMake
-cmake
-cmake's
-CMakeLists
-CodeQL
-codeql
-CODESET
-codeset
-Comcast
-Config
-config
-conncache
-connectdata
-CookieInfo
-Coverity
-CPUs
-CR
-CRL
-CRLF
-crt
-crypto
-cryptographic
-cryptographically
-CSEQ
-CSeq
-csh
-cshrc
-CTRL
-cURL
-CURLcode
-CURLE
-CURLH
-curlimages
-curlrc
-curltest
-customizable
-CVE
-CVSS
-CWD
-CWE
-cyassl
-Cygwin
-daniel
-datatracker
-Debian
-decrypt
-deepcode
-DELE
-DER
-deselectable
-destructor
-detections
-dev
-devcpp
-DevOps
-devtools
-DHCP
-dir
-distro
-distro's
-distros
-DJGPP
-dlist
-DLL
-dll
-DLLs
-DNS
-dns
-dnsop
-DoH
-doxygen
-drftpd
-dsa
-Dudka
-Dymond
-dynbuf
-EAGAIN
-EBCDIC
-ECC
-ECDHE
-ECH
-ECONNREFUSED
-eCOS
-EFnet
-EGD
-EHLO
-EINTR
-else's
-encodings
-enctype
-endianness
-Engler
-enum
-epoll
-EPRT
-EPSV
-ERRNO
-errno
-ESNI
-et
-etag
-ETag
-ETags
-exe
-executables
-EXPN
-extensibility
-failsafe
-Falkeborn
-Fandrich
-Fastly
-fcpp
-Fedora
-Feltzing
-ffi
-filesize
-filesystem
-FLOSS
-fnmatch
-formpost
-formposts
-Fortnite
-FOSS
-FPL
-fread
-FreeBSD
-FreeDOS
-FreeRTOS
-freshmeat
-Frexx
-FS
-fseek
-FTPing
-fuzzer
-fwrite
-Garmin
-gcc
-GCM
-gdb
-Genode
-Gentoo
-Gergely
-getaddrinfo
-getenv
-gethostbyname
-gethostname
-Getinfo
-getinfo
-GETing
-getpwuid
-ggcov
-Ghedini
-Gisle
-Glesys
-globbed
-globbing
-gmail
-GnuTLS
-gnutls
-Golemon
-GOST
-GPG
-GPL
-GPLed
-Greear
-groff
-GSKit
-gskit
-GSS
-GSSAPI
-GTFO
-Guenter
-Gunderson
-Gustafsson
-gzip
-Gzipped
-gzipped
-HackerOne
-HackerOne's
-HAProxy
-HardenedBSD
-Hards
-Haxx
-haxx
-Heimdal
-HELO
-HH
-HMAC
-Hoersken
-Holme
-homebrew
-hostname
-hostnames
-Housley
-Hruska
-HSTS
-hsts
-HTC
-html
-http
-HTTPAUTH
-httpd
-HTTPD
-httpget
-HttpGet
-HTTPS
-https
-hyper's
-Högskolan
-IANA
-Icecast
-ICONV
-iconv
-IDN
-IDNA
-IETF
-ietf
-ifdef
-ifdefed
-Ifdefs
-ifdefs
-IIS
-ILE
-Illumos
-IMAP
-imap
-IMAPS
-imaps
-impacket
-init
-initializer
-inlined
-interop
-interoperable
-interoperates
-IoT
-ipadOS
-IPCXN
-IPv
-IPv4
-IPv4/6
-IPv6
-IRIs
-IRIX
-Itanium
-iX
-Jakub
-Jiri
-jo
-jpeg
-jq
-JSON
-json
-Julien
-Kamil
-Kaufmann
-kB
-KDE
-keepalive
-Keil
-kerberos
-Keychain
-keychain
-KiB
-kickstart
-Kirei
-Knauf
-kqueue
-Krb
-krb
-Kubernetes
-Kuhrt
-Kungliga
-Largefile
-LDAP
-ldap
-LDAPS
-ldaps
-LF
-LGTM
-libbrotlidec
-libc
-libcurl
-libcurl's
-libcurls
-libera
-libev
-libevent
-libgsasl
-libidn
-libnssckbi
-libnsspem
-libpsl
-Libre
-libre
-LibreSSL
-libressl
-librtmp
-libs
-libssh
-libSSH
-libssh2
-Libtool
-libuv
-libWebSocket
-libz
-libzstd
-LineageOS
-linux
-ln
-localhost
-LOGDIR
-logfile
-lookups
-loopback
-LPRT
-LSB
-lseek
-Lua
-lwIP
-macdef
-macOS
-macos
-Makefile
-makefiles
-malloc
-mallocs
-maprintf
-Marek
-Mavrogiannopoulos
-Mbed
-mbedTLS
-Meglio
-memdebug
-MesaLink
-mesalink
-Metalink
-mfprintf
-Michal
-Micrium
-MicroBlaze
-MicroOS
-mingw
-MinGW
-MINIX
-misconfigured
-Mishyn
-mitigations
-MITM
-mk
-mkdir
-mktime
-Monnerat
-monospace
-MorphOS
-MPE
-MPL
-mprintf
-MQTT
-mqtt
-mqtts
-MSB
-MSGSENT
-msh
-MSIE
-msnprintf
-msprintf
-msquic
-mstate
-MSVC
-MSYS
-msys
-mtime
-mTLS
-MUA
-multicwd
-multiparts
-MultiSSL
-mumbo
-musedev
-mutex
-mvaprintf
-mvfprintf
-mvprintf
-mvsnprintf
-mvsprintf
-MX
-Nagel
-Nagle
-NAMELOOKUP
-Natively
-NATs
-nc
-NCR
-NDK
-NEC
-Necko
-NetBSD
-netrc
-netstat
-Netware
-NFS
-nghttp
-nghttpx
-ngtcp
-Nikos
-Nios
-nitems
-NixOS
-NLST
-nmake
-nmemb
-nocwd
-NODELAY
-NonStop
-NOOP
-Novell
-NPN
-nroff
-nslookup
-NSS
-nss
-NTLM
-NTLMUSER
-NTLMv
-NUM
-NuttX
-OAuth
-objcopy
-OCSP
-Ok
-OpenBSD
-OpenLDAP
-OpenRISC
-OpenSSF
-OpenSSF's
-OpenSSH
-OpenSSL
-OpenStep
-openSUSE
-openwall
-Orbis
-ORing
-Osipov
-OSS
-pac
-pacman
-parser's
-parsers
-PASE
-PASV
-PEM
-pem
-perl
-permafailing
-PINGs
-pipelining
-PKCS
-pkcs
-PKGBUILD
-PKI
-pluggable
-PolarSSL
-Polhem
-pollset
-POSIX
-Postfix
-POSTing
-POSTs
-PowerShell
-pre
-prebuilt
-precompiled
-prepend
-prepended
-prepending
-prepends
-preprocess
-preprocessed
-Preprocessing
-preprocessor
-Prereq
-PRET
-pretransfer
-printf
-printf's
-PSL
-pthreads
-PTR
-ptr
-punycode
-PWD
-pwd
-py
-pycurl
-pytest
-Pytest
-QNX
-QoS
-Qubes
-QUIC
-quictls
-quicwg
-Raad
-radix
-RAS
-RBS
-ReactOS
-README
-realloc
-Realtime
-rebase
-RECV
-recv
-Redhat
-redirections
-redirs
-redistributable
-Redox
-reentrant
-Referer
-referer
-reinitializes
-Relatedly
-repo
-reprioritized
-resending
-resends
-RETR
-retransmit
-retrigger
-RHEL
-RICS
-Rikard
-rmdir
-ROADMAP
-Roadmap
-Rockbox
-roffit
-RPG
-RSA
-RTMP
-rtmp
-RTMPE
-RTMPS
-RTMPT
-RTMPTE
-RTMPTS
-RTOS
-RTP
-RTSP
-rtsp
-RTT
-runtests
-runtime
-Ruslan
-rustc
-rustls
-Sagula
-SanDisk
-SAS
-SASL
-Satiro
-Schannel
-Schindelin
-SCO
-SCP
-scp
-SDK
-se
-SEB
-SEK
-selectable
-Serv
-setopt
-setsockopt
-setuid
-SFTP
-sftp
-sha
-SHOUTcast
-SIGALRM
-SIGCHLD
-SIGPIPE
-singlecwd
-SINIX
-Sintonen
-sizeof
-SLE
-slist
-sln
-SMB
-smb
-SMBS
-smbs
-SMBv
-SMTP
-smtp
-smtps
-SMTPS
-SNI
-socketopen
-socketpair
-sockopt
-SOCKOPT
-SOCKSv
-Solaris
-SONAME
-Soref
-SPARC
-SPDX
-SPNEGO
-Spotify
-sprintf
-src
-SRP
-SRWLOCK
-SSL
-ssl
-SSLeay
-SSLKEYLOGFILE
-sslv
-SSLv
-SSLVERSION
-SSPI
-stackoverflow
-STARTTLS
-STARTTRANSFER
-stateful
-statvfs
-stderr
-stdin
-stdout
-Steinar
-Stenberg
-STOR
-strcat
-strcpy
-strdup
-strerror
-strlen
-strncat
-struct
-structs
-Structs
-stunnel
-subdirectories
-subdirectory
-submitters
-substring
-substrings
-SunOS
-SunSSH
-superset
-svc
-svcb
-Svyatoslav
-Swisscom
-sws
-Symbian
-symlink
-symlinks
-syntaxes
-Szakats
-TABs
-Tatsuhiro
-TBD
-TCP
-tcpdump
-Tekniska
-testability
-TFTP
-tftp
-Tizen
-TLS
-tlsv
-TLSv
-TODO
-Tomtom
-toolchain
-toolchains
-toolset
-toplevel
-TPF
-TrackMemory
-transcode
-Tru
-Tse
-Tsujikawa
-TTL
-tvOS
-txt
-typedef
-typedefed
-Ubuntu
-ucLinux
-UDP
-UI
-UID
-UIDL
-Ultrix
-Unary
-unassign
-UNC
-uncompress
-unencoded
-unencrypted
-unescape
-Unglobbed
-UNICOS
-unix
-UnixSockets
-UnixWare
-unlink
-unpause
-unpaused
-unpauses
-unpausing
-unsanitized
-Unshare
-unsharing
-untrusted
-UPN
-upstreaming
-URI
-URIs
-url
-URL's
-urlencoded
-urlget
-USD
-userdata
-Userinfo
-userinfo
-USERPROFILE
-UTF
-UX
-valgrind
-Vanem
-vararg
-VC
-vcpkg
-vexxhost
-Viktor
-VM
-VMS
-VMware
-VRF
-VRFY
-VSE
-vsprintf
-vt
-vtls
-vxWorks
-wakeup
-Warta
-watchOS
-WAV
-WB
-web page
-WebDAV
-WebOS
-WebSocket
-WEBSOCKET
-WHATWG
-whitespace
-Whitespaces
-winbind
-WinBind
-winbuild
-winidn
-WinIDN
-WinLDAP
-WinSock
-winsock
-WinSSL
-winssl
-Wireshark
-wolfSSH
-wolfSSL
-WS
-WSS
-www
-Xbox
-XDG
-xdigit
-Xilinx
-XP
-Xtensa
-XYZ
-Youtube
-YYYY
-YYYYMMDD
-Zakrzewski
-Zitzmann
-zlib
-zsh
-zstd
-Zuul
-zuul

third-party/curl/.github/scripts/spellcheck.yaml

@@ -1,32 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Docs: https://github.com/UnicornGlobal/spellcheck-github-actions
-matrix:
-- name: Markdown
-  expect_match: false
-  apsell:
-    mode: en
-  dictionary:
-    wordlists:
-    - wordlist.txt
-    output: wordlist.dic
-    encoding: utf-8
-  pipeline:
-  - pyspelling.filters.markdown:
-      markdown_extensions:
-      - markdown.extensions.extra:
-  - pyspelling.filters.html:
-      comments: true
-      attributes:
-      - title
-      - alt
-      ignores:
-      - ':matches(code, pre)'
-      - 'code'
-      - 'pre'
-      - 'strong'
-      - 'em'
-  sources:
-  - '**/*.md|!docs/BINDINGS.md'

third-party/curl/.github/scripts/trimmarkdownheader.pl

@@ -0,0 +1,44 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Given: a libcurl curldown man page
+# Outputs: the same file, minus the header
+#
+
+use strict;
+use warnings;
+
+my $f = $ARGV[0] || '';
+
+open(F, "<$f") or die;
+
+my @out;
+my $line = 0;
+my $hideheader = 0;
+
+while(<F>) {
+    if($hideheader) {
+        if(/^---/) {
+            # end if hiding
+            $hideheader = 0;
+        }
+        push @out, "\n"; # replace with blank
+        next;
+    }
+    elsif(!$line++ && /^---/) {
+        # starts with a header, strip off the header
+        $hideheader = 1;
+        push @out, "\n"; # replace with blank
+        next;
+    }
+    push @out, $_;
+}
+close(F);
+
+open(O, ">$f") or die;
+for my $l (@out) {
+    print O $l;
+}
+close(O);

third-party/curl/.github/scripts/typos.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git ls-files | typos \
+  --isolated \
+  --force-exclude \
+  --config '.github/scripts/typos.toml' \
+  --file-list -

third-party/curl/.github/scripts/typos.toml

@@ -0,0 +1,36 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+[default]
+extend-ignore-identifiers-re = [
+  "^(ba|fo|pn|PN|UE)$",
+  "^(CNA|cpy|ser)$",
+  "^(ECT0|ECT1|HELO|htpts|mport|PASE)$",
+  "^[A-Za-z0-9_-]*(EDE|GOST)[A-Z0-9_-]*$",  # ciphers
+  "^0x[0-9a-fA-F]+FUL$",  # unsigned long hex literals ending with 'F'
+   "^[0-9a-zA-Z+]{64,}$",  # possibly base64
+  "^(eyeballers|HELO_smtp|Januar|optin|passin|perfec|SMTP_HELO)$",
+  "^(clen|req_clen|smtp_perform_helo|smtp_state_helo_resp|Tru64|_stati64)$",
+  "(_ccontains|_controllen|O_WRONLY|secur32)",
+  "proxys",  # this should be limited to tests/http/*. Short for secure proxy.
+]
+
+extend-ignore-re = [
+  ".*spellchecker:disable-line",
+]
+
+[files]
+extend-exclude = [
+  ".github/scripts/codespell-ignore.words",
+  ".github/scripts/pyspelling.words",
+  "docs/THANKS",
+  "projects/OS400/*",
+  "projects/vms/*",
+  "projects/Windows/tmpl/curl.vcxproj",
+  "projects/Windows/tmpl/libcurl.vcxproj",
+  "RELEASE-NOTES",
+  "scripts/wcurl",
+  "tests/data/test*",
+  "tests/unit/unit1625.c",
+]

third-party/curl/.github/scripts/verify-examples.pl

@@ -0,0 +1,106 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my @files = @ARGV;
+my $cfile = "test.c";
+my $check = "./scripts/checksrc.pl";
+my $error = 0;
+
+if(!@files || $files[0] eq "-h") {
+    print "Usage: verify-examples [markdown pages]\n";
+    exit;
+}
+
+sub testcompile {
+    my $rc = system('gcc -c test.c -I include -W -Wall -pedantic -Werror ' .
+        '-Wno-unused-parameter -Wno-unused-but-set-variable ' .
+        '-DCURL_ALLOW_OLD_MULTI_SOCKET -DCURL_DISABLE_DEPRECATION') >> 8;
+    return $rc;
+}
+
+sub checksrc {
+    my $rc = system($check, ('test.c')) >> 8;
+    return $rc;
+}
+
+sub extract {
+    my($f) = @_;
+    my $syn = 0;
+    my $l = 0;
+    my $iline = 0;
+    my $fail = 0;
+    open(F, "<$f") or die "failed opening input file $f : $!";
+    open(O, ">$cfile") or die "failed opening output file $cfile : $!";
+    print O "#include <curl/curl.h>\n";
+    while(<F>) {
+        $iline++;
+        if(/^# EXAMPLE/) {
+            $syn = 1
+        }
+        elsif($syn == 1) {
+            if(/^~~~/) {
+                $syn++;
+                print O "/* !checksrc! disable BANNEDFUNC all */\n";  # for fopen()
+                print O "/* !checksrc! disable COPYRIGHT all */\n";
+                print O "/* !checksrc! disable UNUSEDIGNORE all */\n";
+                printf O "#line %d \"$f\"\n", $iline + 1;
+            }
+        }
+        elsif($syn == 2) {
+            if(/^~~~/) {
+                last;
+            }
+            # two backslashes become one
+            $_ =~ s/\\\\/\\/g;
+            print O $_;
+            $l++;
+        }
+    }
+    close(F);
+    close(O);
+
+    return ($fail ? 0 : $l);
+}
+
+my $count = 0;
+for my $m (@files) {
+    #print "Verify $m\n";
+    my $out = extract($m);
+    if($out) {
+      $error |= testcompile($m);
+      $error |= checksrc($m);
+    }
+    $count++;
+}
+if(!$error) {
+    print "Verified $count man pages ok\n";
+}
+else {
+    print "Detected problems\n";
+}
+exit $error;

third-party/curl/.github/scripts/verify-synopsis.pl

@@ -0,0 +1,87 @@
+#!/usr/bin/env perl
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+use strict;
+use warnings;
+
+my @files = @ARGV;
+my $cfile = "test.c";
+
+if(!@files || $files[0] eq "-h") {
+    print "Usage: verify-synopsis [man pages]\n";
+    exit;
+}
+
+sub testcompile {
+    my $rc = system('gcc -c test.c -I include -W -Wall -pedantic -Werror ' .
+        '-DCURL_ALLOW_OLD_MULTI_SOCKET -DCURL_DISABLE_TYPECHECK') >> 8;
+    return $rc;
+}
+
+sub extract {
+    my($f) = @_;
+    my $syn = 0;
+    my $l = 0;
+    my $iline = 0;
+    open(F, "<$f");
+    open(O, ">$cfile");
+    while(<F>) {
+        $iline++;
+        if(/^# SYNOPSIS/) {
+            $syn = 1
+        }
+        elsif($syn == 1) {
+            if(/^\~\~\~/) {
+                $syn++;
+                print O "#line $iline \"$f\"\n";
+            }
+        }
+        elsif($syn == 2) {
+            if(/^\~\~\~/) {
+                last;
+            }
+            # turn the vararg argument into vararg
+            $_ =~ s/, parameter\)\;/, ...);/;
+            print O $_;
+            $l++;
+        }
+    }
+    close(F);
+    close(O);
+
+    if($syn < 2) {
+        print STDERR "Found no synopsis in $f\n";
+        return 1;
+    }
+
+    return 0;
+}
+
+my $error;
+for my $m (@files) {
+    $error |= extract($m);
+    $error |= testcompile($m);
+}
+exit $error;

third-party/curl/.github/scripts/yamlcheck.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+set -eu
+
+cd "$(dirname "${0}")"/../..
+
+git ls-files '*.yaml' '*.yml' -z | xargs -0 -r \
+yamllint \
+  --format standard \
+  --strict \
+  --config-data .github/scripts/yamlcheck.yaml \
+  --

third-party/curl/.github/scripts/yamlcheck.yaml

@@ -0,0 +1,17 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+#
+# Docs: https://yamllint.readthedocs.io/en/stable/configuration.html
+
+extends: default
+
+rules:
+  line-length:
+    max: 500
+    level: warning
+
+  braces: disable
+  commas: disable
+  comments: disable
+  document-start: disable

third-party/curl/.github/stale.yml

@@ -6,7 +6,7 @@
 daysUntilStale: 180
 # Number of days of inactivity before a stale issue is closed
 daysUntilClose: 14
-# Issues with these labels will never be considered stale
+# Issues with these labels are never considered stale
 exemptLabels:
   - pinned
   - security
@@ -15,7 +15,7 @@ staleLabel: stale
 # Comment to post when marking an issue as stale. Set to `false` to disable
 markComment: >
   This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
+  recent activity. It is closed if no further activity occurs. Thank you
   for your contributions.
 # Comment to post when closing a stale issue. Set to `false` to disable
 closeComment: false

third-party/curl/.github/workflows/appveyor-status.yml

@@ -2,9 +2,9 @@
 #
 # SPDX-License-Identifier: curl
 
-name: AppVeyor Status Report
+name: 'AppVeyor Status Report'
 
-on:
+'on':
   status
 
 concurrency:
@@ -15,20 +15,22 @@ permissions: {}
 
 jobs:
   split:
-    runs-on: ubuntu-latest
+    name: 'split'
+    runs-on: ubuntu-24.04-arm
     if: ${{ github.event.sender.login == 'appveyor[bot]' }}
     permissions:
-      statuses: write
+      statuses: write  # To update build statuses
     steps:
-      - name: Create individual AppVeyor build statuses
+      - name: 'Create individual AppVeyor build statuses'
         if: ${{ github.event.sha && github.event.target_url }}
         env:
           APPVEYOR_COMMIT_SHA: ${{ github.event.sha }}
           APPVEYOR_TARGET_URL: ${{ github.event.target_url }}
           APPVEYOR_REPOSITORY: ${{ github.event.repository.full_name }}
+          DO_NOT_TRACK: '1'  # for gh
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo ${APPVEYOR_TARGET_URL} | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s | \
+          echo "${APPVEYOR_TARGET_URL}" | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s -- | \
             jq -c '.build.jobs[] | {target_url: ($target_url + "/job/" + .jobId),
                                     context: (.name | sub("^(Environment: )?"; "AppVeyor / ")),
                                     state: (.status | sub("queued"; "pending")
@@ -37,5 +39,5 @@ jobs:
                                                     | sub("failed"; "failure")
                                                     | sub("cancelled"; "error")),
                                     description: .status}' \
-                --arg target_url ${APPVEYOR_TARGET_URL} | tee /dev/stderr | parallel --pipe -j 1 -N 1 \
-              gh api --silent --input - repos/${APPVEYOR_REPOSITORY}/statuses/${APPVEYOR_COMMIT_SHA}
+                --arg target_url "${APPVEYOR_TARGET_URL}" | tee /dev/stderr | parallel --pipe -j 1 -N 1 \
+              gh api --silent --input - "repos/${APPVEYOR_REPOSITORY}/statuses/${APPVEYOR_COMMIT_SHA}"

third-party/curl/.github/workflows/awslc.yml

@@ -1,152 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux AWS-LC
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: awslc-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-  awslc-version: 1.13.0
-
-jobs:
-  autoconf:
-    name: awslc (autoconf)
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 30
-
-    steps:
-    - run: |
-        sudo apt-get update --yes
-        sudo apt-get install --yes libtool autoconf automake pkg-config stunnel4
-        # ensure we don't pick up openssl in this build
-        sudo apt remove --yes libssl-dev
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - name: cache awslc
-      uses: actions/cache@v3
-      id: cache-awslc
-      env:
-        cache-name: cache-awslc
-      with:
-        path: /home/runner/awslc
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
-
-    - name: build awslc
-      if: steps.cache-awslc.outputs.cache-hit != 'true'
-      run: |
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-          https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
-        tar xzf v${{ env.awslc-version }}.tar.gz
-        mkdir aws-lc-${{ env.awslc-version }}-build
-        cd aws-lc-${{ env.awslc-version }}-build
-        cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }}
-        cmake --build . --parallel
-        cmake --install .
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: |
-        mkdir build
-        cd build
-        ../configure --enable-warnings --enable-werror --with-openssl=$HOME/awslc
-        cd ..
-      name: 'configure out-of-tree'
-
-    - run: make -C build V=1
-      name: 'make'
-
-    - run: make -C build V=1 examples
-      name: 'make examples'
-
-    - run: make -C build V=1 -C tests
-      name: 'make tests'
-
-    - run: make -C build V=1 test-ci
-      name: 'run tests'
-
-  cmake:
-    name: awslc (cmake)
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 15
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install cmake stunnel4
-        # ensure we don't pick up openssl in this build
-        sudo apt remove --yes libssl-dev
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - name: cache awslc
-      uses: actions/cache@v3
-      id: cache-awslc
-      env:
-        cache-name: cache-awslc
-      with:
-        path: /home/runner/awslc
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
-
-    - name: build awslc
-      if: steps.cache-awslc.outputs.cache-hit != 'true'
-      run: |
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-          https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
-        tar xzf v${{ env.awslc-version }}.tar.gz
-        mkdir aws-lc-${{ env.awslc-version }}-build
-        cd aws-lc-${{ env.awslc-version }}-build
-        cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }}
-        cmake --build . --parallel
-        cmake --install .
-
-    - uses: actions/checkout@v3
-
-    # CMAKE_COMPILE_WARNING_AS_ERROR is available in cmake 3.24 or later
-    - run: cmake -Bbuild -DOPENSSL_ROOT_DIR=$HOME/awslc -DBUILD_SHARED_LIBS=ON -DCMAKE_COMPILE_WARNING_AS_ERROR=ON .
-      name: 'cmake generate out-of-tree'
-
-    - run: cmake --build build --parallel
-      name: 'cmake build'
-
-    - run: cmake --install build --prefix $HOME/curl --strip
-      name: 'cmake install'

third-party/curl/.github/workflows/checkdocs.yml

@@ -0,0 +1,135 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# This workflow contains tests that operate on documentation files only. Some
+# checks modify the source so they cannot be combined into a single job.
+
+name: 'Docs'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - '.github/workflows/checkdocs.yml'
+      - '.github/scripts/**'
+      - 'scripts/**'
+      - '**.md'
+      - 'docs/*'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '.github/workflows/checkdocs.yml'
+      - '.github/scripts/**'
+      - 'scripts/**'
+      - '**.md'
+      - 'docs/*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  # config file help: https://github.com/amperser/proselint/
+  proselint:
+    name: 'proselint'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r .github/scripts/requirements-proselint.txt
+
+      - name: 'trim headers off all *.md files'
+        run: git ls-files '*.md' -z | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
+
+      - name: 'check prose'
+        run: |
+          cat <<JSON > ~/.proselintrc.json
+          {
+            "checks": {
+              "annotations.misc": false,
+              "lexical_illusions": false,
+              "misc.annotations": false,
+              "redundancy.misc.garner": false,
+              "security.password": false,
+              "spelling.ve_of": false,
+              "typography.diacritical_marks": false,
+              "typography.symbols": false
+            }
+          }
+          JSON
+          source ~/venv/bin/activate
+          git ls-files README '*.md' -z | grep -Evz '(CHECKSRC|DISTROS|CURLOPT_INTERFACE|interface)\.md' | xargs -0 proselint check --
+
+      - name: 'check special prose'  # For CHECKSRC and files with aggressive exclamation mark needs
+        run: |
+          cat <<JSON > ~/.proselintrc.json
+          {
+            "checks": {
+              "annotations.misc": false,
+              "lexical_illusions": false,
+              "typography.diacritical_marks": false,
+              "typography.punctuation.exclamation": false,
+              "typography.symbols": false
+            }
+          }
+          JSON
+          source ~/venv/bin/activate
+          proselint check docs/internals/CHECKSRC.md docs/libcurl/opts/CURLOPT_INTERFACE.md docs/cmdline-opts/interface.md
+
+  pyspelling:
+    name: 'pyspelling'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'trim all *.md files in docs/'
+        run: .github/scripts/cleancmd.pl 'docs/*.md'
+
+      - name: 'install'
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install aspell aspell-en
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r .github/scripts/requirements-docs.txt
+
+      - name: 'check spelling'
+        run: |
+          source ~/venv/bin/activate
+          # setup the custom wordlist
+          grep -v '^#' .github/scripts/pyspelling.words > wordlist.txt
+          aspell --version
+          pyspelling --version
+          pyspelling --verbose --jobs 5 --config .github/scripts/pyspelling.yaml
+
+  synopsis-man-examples:
+    name: 'synopsis, man-examples'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'verify synopsis'
+        run: .github/scripts/verify-synopsis.pl docs/libcurl/curl*.md
+
+      - name: 'verify examples'
+        run: .github/scripts/verify-examples.pl docs/libcurl/curl*.md docs/libcurl/opts/*.md

third-party/curl/.github/workflows/checksrc.yml

@@ -0,0 +1,214 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# This workflow contains checks at the source code level only.
+
+name: 'Source'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  checksrc:
+    name: 'checksrc'
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'check'
+        run: scripts/checksrc-all.pl
+
+  linters:
+    name: 'spellcheck, linters, REUSE'
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary \
+            -r .github/scripts/requirements.txt \
+            -r tests/http/requirements.txt \
+            -r tests/requirements.txt
+
+      - name: 'REUSE check'
+        run: |
+          source ~/venv/bin/activate
+          reuse lint
+
+      - name: 'codespell'
+        run: |
+          source ~/venv/bin/activate
+          codespell --version
+          .github/scripts/codespell.sh
+
+      - name: 'typos'
+        timeout-minutes: 2
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install typos-cli
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          typos --version
+          .github/scripts/typos.sh
+
+      - name: 'cmakelint'
+        run: |
+          source ~/venv/bin/activate
+          scripts/cmakelint.sh
+
+      - name: 'perlcheck'
+        run: |
+          scripts/perlcheck.sh
+
+      - name: 'ruff'
+        run: |
+          source ~/venv/bin/activate
+          scripts/pythonlint.sh
+
+  pytype:
+    name: 'pytype'
+    runs-on: ubuntu-24.04-arm  # pytype is discontinued and requires python 3.8-3.12
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'install prereqs'
+        run: |
+          python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary pytype==2024.10.11 \
+            -r .github/scripts/requirements.txt \
+            -r tests/http/requirements.txt \
+            -r tests/requirements.txt
+
+      - name: 'check'
+        run: |
+          source ~/venv/bin/activate
+          find . -name '*.py' -exec pytype -j auto -k -- {} +
+
+  complexity:
+    name: 'complexity and function sizes'
+    runs-on: ubuntu-slim
+    timeout-minutes: 3
+    steps:
+      - name: 'install pmccabe'
+        timeout-minutes: 2
+        run: |
+          ls -l /etc/apt/sources.list.d
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install pmccabe
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'check function complexity'
+        run: ./scripts/top-complexity
+
+      - name: 'check function lengths'
+        run: ./scripts/top-length
+
+  xmllint:
+    name: 'xmllint'
+    runs-on: ubuntu-slim
+    timeout-minutes: 3
+    steps:
+      - name: 'install prereqs'
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install libxml2-utils
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'check'
+        run: git grep -z -i -l -E '^<\?xml' | xargs -0 -r xmllint --output /dev/null
+
+  miscchecks:
+    name: 'misc checks'
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - name: 'install prereqs'
+        timeout-minutes: 2
+        run: /home/linuxbrew/.linuxbrew/bin/brew install actionlint shellcheck zizmor
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'zizmor GHA'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          zizmor --persona pedantic .github/workflows/*.yml .github/dependabot.yml
+
+      - name: 'zizmor GHA (auditor, warning-only)'
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          zizmor --persona auditor .github/workflows/*.yml .github/dependabot.yml || true
+
+      - name: 'actionlint'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
+          actionlint --version
+          actionlint --ignore matrix --ignore ubuntu-26.04 .github/workflows/*.yml
+
+      - name: 'shellcheck CI'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          shellcheck --version
+          .github/scripts/shellcheck-ci.sh
+
+      - name: 'shellcheck'
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+          shellcheck --version
+          .github/scripts/shellcheck.sh
+
+      - name: 'spacecheck'
+        run: scripts/spacecheck.pl
+
+      - name: 'yamlcheck'
+        run: .github/scripts/yamlcheck.sh
+
+      - name: 'badwords'
+        run: scripts/badwords-all

third-party/curl/.github/workflows/checkurls.yml

@@ -0,0 +1,43 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'URLs'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+  pull_request:
+    branches:
+      - master
+  schedule:
+    - cron: '10 5 * * *'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  linkcheck:
+    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
+    name: 'linkcheck'
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'mdlinkcheck (dry run)'
+        if: ${{ github.event_name != 'schedule' }}
+        run: ./scripts/mdlinkcheck --dry-run
+
+      - name: 'mdlinkcheck'
+        if: ${{ github.event_name == 'schedule' }}
+        run: ./scripts/mdlinkcheck

third-party/curl/.github/workflows/codeql-analysis.yml

@@ -1,80 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: CodeQL
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'docs/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'docs/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
-  schedule:
-    - cron: '0 0 * * 4'
-
-concurrency:
-  group: ${{ github.workflow }}
-
-permissions: {}
-
-jobs:
-  codeql:
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: cpp
-        queries: security-extended
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2

third-party/curl/.github/workflows/codeql.yml

@@ -0,0 +1,142 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'CodeQL'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'projects/**'
+      - 'tests/data/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'projects/**'
+      - 'tests/data/**'
+  schedule:
+    - cron: '0 0 * * 4'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  gha_python:
+    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
+    name: 'GHA and Python'
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # To create/update security events
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'initialize'
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: actions, python
+          queries: security-extended
+
+      - name: 'perform analysis'
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+
+  c:
+    if: ${{ github.repository_owner == 'curl' || github.event_name != 'schedule' }}
+    name: 'C'
+    runs-on: ${{ matrix.platform == 'Linux' && 'ubuntu-latest' || 'windows-2022' }}
+    permissions:
+      security-events: write  # To create/update security events
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [Linux, Windows]
+    env:
+      MATRIX_PLATFORM: '${{ matrix.platform }}'
+    steps:
+      - name: 'install prereqs'
+        if: ${{ matrix.platform == 'Linux' }}
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libpsl-dev libbrotli-dev libidn2-dev libssh2-1-dev libssh-dev \
+            libnghttp2-dev libldap-dev libkrb5-dev libgnutls28-dev libwolfssl-dev
+          /home/linuxbrew/.linuxbrew/bin/brew install c-ares gsasl libnghttp3 libngtcp2 mbedtls rustls-ffi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'delete test input C files'
+        shell: bash
+        run: find tests/data -name '*.c' -delete
+
+      - name: 'initialize'
+        # https://github.com/github/codeql-action/blob/main/init/action.yml
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: cpp
+          build-mode: manual
+          trap-caching: false
+
+      - name: 'build'
+        timeout-minutes: 10
+        shell: bash
+        run: |
+          if [ "${MATRIX_PLATFORM}" = 'Windows' ]; then
+            cmake -B . -DBUILD_SHARED_LIBS=OFF -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+              -DCMAKE_VS_GLOBALS=TrackFileAccess=false \
+              -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF -DUSE_WIN32_IDN=ON
+            cmake --build . --verbose
+            src/Debug/curl.exe --disable --version
+          else
+            eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+
+            export PKG_CONFIG_PATH
+
+            # MultiSSL
+            PKG_CONFIG_PATH="$(brew --prefix c-ares)/lib/pkgconfig:$(brew --prefix mbedtls)/lib/pkgconfig:$(brew --prefix rustls-ffi)/lib/pkgconfig:$(brew --prefix gsasl)/lib/pkgconfig"
+            cmake -B _bld1 -G Ninja -DCURL_DISABLE_TYPECHECK=ON -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
+              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DCURL_USE_WOLFSSL=ON \
+              -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DUSE_ECH=ON -DENABLE_ARES=ON \
+              -DCURL_DISABLE_VERBOSE_STRINGS=ON
+            cmake --build _bld1
+            cmake --build _bld1 --target testdeps
+            cmake --build _bld1 --target curl-examples-build
+
+            # HTTP/3
+            PKG_CONFIG_PATH="$(brew --prefix libnghttp3)/lib/pkgconfig:$(brew --prefix libngtcp2)/lib/pkgconfig:$(brew --prefix gsasl)/lib/pkgconfig"
+            cmake -B _bld2 -G Ninja -DCURL_DISABLE_TYPECHECK=ON -DCURL_WERROR=ON \
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR="$(brew --prefix openssl)" -DUSE_NGTCP2=ON \
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON \
+              -DCURL_USE_GSASL=ON -DCURL_USE_GSSAPI=ON -DUSE_SSLS_EXPORT=ON -DUSE_PROXY_HTTP3=ON
+            cmake --build _bld2
+            cmake --build _bld2 --target testdeps
+            cmake --build _bld2 --target curl-examples-build
+
+            _bld1/src/curl --disable --version
+            _bld2/src/curl --disable --version
+          fi
+
+      - name: 'perform analysis'
+        # https://github.com/github/codeql-action/blob/main/analyze/action.yml
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

third-party/curl/.github/workflows/configure-vs-cmake.yml

@@ -0,0 +1,194 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'configure-vs-cmake'
+'on':
+  push:
+    branches:
+      - master
+    paths:
+      - '*.ac'
+      - '**/*.m4'
+      - '**/CMakeLists.txt'
+      - 'CMake/**'
+      - 'lib/curl_config-cmake.h.in'
+      - 'tests/cmake/**'
+      - '.github/scripts/cmp-config.pl'
+      - '.github/workflows/configure-vs-cmake.yml'
+
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '*.ac'
+      - '**/*.m4'
+      - '**/CMakeLists.txt'
+      - 'CMake/**'
+      - 'lib/curl_config-cmake.h.in'
+      - 'tests/cmake/**'
+      - '.github/scripts/cmp-config.pl'
+      - '.github/workflows/configure-vs-cmake.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
+
+jobs:
+  check-linux:
+    name: 'Linux'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'run configure --with-openssl'
+        run: |
+          autoreconf -fi
+          export PKG_CONFIG_DEBUG_SPEW=1
+          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl
+
+      - name: 'run cmake'
+        run: cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_LIBPSL=OFF
+
+      - name: 'configure log'
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'cmake log'
+        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'dump generated files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::AM ${f}"; grep -v '^#' bld-am/"${f}" || true; echo '::endgroup::'
+            echo "::group::CM ${f}"; grep -v '^#' bld-cm/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'compare generated curl_config.h files'
+        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
+
+      - name: 'compare generated libcurl.pc files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
+
+      - name: 'compare generated curl-config files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
+
+  check-macos:
+    name: 'macOS'
+    runs-on: macos-latest
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 2
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install automake libtool; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
+
+      - name: 'toolchain versions'
+        run: echo '::group::brew packages installed'; ls -l /opt/homebrew/opt; echo '::endgroup::'
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'run configure --with-openssl'
+        run: |
+          autoreconf -fi
+          export PKG_CONFIG_DEBUG_SPEW=1
+          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl --disable-ldap --with-brotli --with-zstd --with-apple-sectrust
+
+      - name: 'run cmake'
+        run: |
+          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_LIBPSL=OFF -DCURL_DISABLE_LDAP=ON \
+            -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
+            -DCURL_USE_LIBSSH2=OFF -DUSE_APPLE_SECTRUST=ON
+
+      - name: 'configure log'
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'cmake log'
+        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'dump generated files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::AM ${f}"; grep -v '^#' bld-am/"${f}" || true; echo '::endgroup::'
+            echo "::group::CM ${f}"; grep -v '^#' bld-cm/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'compare generated curl_config.h files'
+        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
+
+      - name: 'compare generated libcurl.pc files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
+
+      - name: 'compare generated curl-config files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
+
+  check-windows:
+    name: 'Windows'
+    runs-on: ubuntu-latest
+    env:
+      TRIPLET: 'x86_64-w64-mingw32'
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 1
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install gcc-mingw-w64-x86-64-win32
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'run configure --with-schannel'
+        run: |
+          autoreconf -fi
+          export PKG_CONFIG_DEBUG_SPEW=1
+          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-schannel --without-libpsl --host="${TRIPLET}"
+
+      - name: 'run cmake'
+        run: |
+          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_CMAKECONFIG=OFF -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF \
+            -DCMAKE_SYSTEM_NAME=Windows \
+            -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
+            -DCMAKE_C_COMPILER="${TRIPLET}-gcc"
+
+      - name: 'configure log'
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'cmake log'
+        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'dump generated files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::AM ${f}"; grep -v '^#' bld-am/"${f}" || true; echo '::endgroup::'
+            echo "::group::CM ${f}"; grep -v '^#' bld-cm/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'compare generated curl_config.h files'
+        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
+
+      - name: 'compare generated libcurl.pc files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
+
+      - name: 'compare generated curl-config files'
+        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config

third-party/curl/.github/workflows/curl-for-win.yml

@@ -0,0 +1,199 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+---
+name: 'curl-for-win'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CW_NOGET: 'curl trurl'
+  CW_MAP: '0'
+  CW_JOBS: '5'
+  CW_NOPKG: '1'
+  DO_NOT_TRACK: '1'
+
+jobs:
+  linux-glibc-gcc:
+    name: 'Linux gcc glibc (amd64, arm64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-linux-a64-x64-gcc'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          export CW_CCSUFFIX='-15'
+          export CW_GCCSUFFIX='-12'
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN_STABLE}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN_STABLE}" \
+            sh -c ./_ci-linux-debian.sh
+
+  linux-glibc-gcc-minimal:  # use gcc to minimize installed packages
+    name: 'Linux gcc glibc minimal (amd64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-prefill-zero-osnotls-osnoidn-nohttp-nocurltool-linux-x64-gcc'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN}" \
+            sh -c ./_ci-linux-debian.sh
+
+  linux-musl-llvm:
+    name: 'Linux llvm MUSL (amd64, riscv64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-linux-musl-r64-x64'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          export CW_CCSUFFIX='-19'
+          export CW_GCCSUFFIX='-14'
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN_STABLE}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN_STABLE}" \
+            sh -c ./_ci-linux-debian.sh
+
+  mac-clang:
+    name: 'macOS clang cares (x86_64)'
+    runs-on: macos-latest
+    timeout-minutes: 10
+    env:
+      CW_JOBS: '4'
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-mac-x64-cares'
+          export CW_REVISION="${GITHUB_SHA}"
+          sh -c ./_ci-mac-homebrew.sh
+
+  win-llvm:
+    name: 'Windows llvm (x64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-win-x64-noWINE'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN}" \
+            sh -c ./_ci-linux-debian.sh
+
+  win-gcc-zlibold-x64:
+    name: 'Windows gcc zlib-classic (x64)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: 'curl'
+          fetch-depth: 8
+      - name: 'build'
+        run: |
+          git clone --depth 1 https://github.com/curl/curl-for-win
+          mv curl-for-win/* .
+          export CW_CONFIG='-main-werror-unitybatch-nocertdata-win-x64-gcc-zlibold-noWINE'
+          export CW_REVISION="${GITHUB_SHA}"
+          . ./_versions.sh
+          sudo podman image trust set --type reject default
+          sudo podman image trust set --type accept docker.io/library
+          time podman pull "${OCI_IMAGE_DEBIAN}"
+          podman images --digests
+          time podman run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
+            --env-file <(env | grep -a -E \
+              '^(CW_|DO_NOT_TRACK|GITHUB_)') \
+            "${OCI_IMAGE_DEBIAN}" \
+            sh -c ./_ci-linux-debian.sh

third-party/curl/.github/workflows/distcheck.yml

@@ -0,0 +1,409 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'dist'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+  pull_request:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CURL_TEST_MIN: 1500
+  DO_NOT_TRACK: '1'
+  MAKEFLAGS: -j 5
+
+jobs:
+  maketgz-and-verify-in-tree:
+    name: 'AM in-tree & maketgz'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'remove preinstalled curl libcurl4{-doc}'
+        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
+
+      - name: 'autoreconf'
+        run: autoreconf -fi
+
+      - name: 'configure'
+        run: ./configure --without-ssl --without-libpsl
+
+      - name: 'make'
+        run: make V=1
+
+      - name: 'maketgz'
+        run: SOURCE_DATE_EPOCH=1711526400 ./scripts/maketgz 99.98.97
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: 'release-tgz'
+          path: 'curl-99.98.97.tar.gz'
+          retention-days: 1
+
+      - name: 'configure build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          ./configure --prefix="$HOME"/temp --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl
+          make
+          make test-ci
+          make install
+          popd
+          # basic check of the installed files
+          bash scripts/installcheck.sh "$HOME"/temp
+          rm -rf curl-99.98.97
+
+  verify-out-of-tree-docs:
+    name: 'AM out-of-tree docs'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'configure build & docs'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
+          mkdir build
+          pushd build
+          ../curl-99.98.97/configure --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl
+          make
+          make test-ci
+          popd
+          rm -rf build
+          rm -rf curl-99.98.97
+
+  verify-out-of-tree-autotools-debug:
+    name: 'AM out-of-tree (debug)'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          mkdir build
+          pushd build
+          ../configure --prefix="$PWD"/curl-install --enable-option-checking=fatal --enable-werror --without-ssl --enable-debug --without-libpsl
+          make
+          make test-ci
+          make install
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+          popd
+          scripts/checksrc-all.pl
+
+  verify-out-of-tree-autotools:
+    name: 'AM out-of-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          mkdir build
+          pushd build
+          ../configure --prefix="$PWD"/curl-install --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl ac_cv_path_PERL=
+          make
+          make install
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+          popd
+
+  verify-in-tree-autotools:
+    name: 'AM in-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          ./configure --prefix="$PWD"/curl-install --enable-option-checking=fatal --enable-werror --without-ssl --without-libpsl ac_cv_path_PERL=
+          make
+          make install
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+
+  verify-out-of-tree-cmake:
+    name: 'CM out-of-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          cmake -B build -DCMAKE_INSTALL_PREFIX="$PWD"/curl-install -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DPERL_EXECUTABLE=
+          cmake --build build
+          cmake --install build
+          export LD_LIBRARY_PATH="$PWD/curl-install/lib:$LD_LIBRARY_PATH"
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+
+  verify-in-tree-cmake:
+    name: 'CM in-tree !perl'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'build & install'
+        run: |
+          echo "::stop-commands::$(uuidgen)"
+          tar xvf curl-99.98.97.tar.gz
+          pushd curl-99.98.97
+          cmake . -G Ninja -DCMAKE_INSTALL_PREFIX="$PWD"/curl-install -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DPERL_EXECUTABLE=
+          cmake --build .
+          cmake --install .
+          export LD_LIBRARY_PATH="$PWD/curl-install/lib:$LD_LIBRARY_PATH"
+          curl-install/bin/curl --disable --version
+          curl-install/bin/curl --manual | wc -l | grep -v '^ *0$'
+
+  missing-files:
+    name: 'missing files'
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    needs: maketgz-and-verify-in-tree
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: 'release-tgz'
+
+      - name: 'detect files missing from release tarball'
+        run: .github/scripts/distfiles.sh curl-99.98.97.tar.gz
+
+  reproducible-releases:
+    name: 'reproducible releases'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'remove preinstalled curl libcurl4{-doc}'
+        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
+
+      - name: 'generate release tarballs'
+        run: ./scripts/dmaketgz 9.10.11
+
+      - name: 'verify release tarballs'
+        run: |
+          mkdir _verify
+          mv curl-9.10.11.tar.gz _verify
+          cd _verify
+          ../scripts/verify-release curl-9.10.11.tar.gz
+
+  cmake-integration:
+    name: 'CM integration ${{ matrix.image }}'
+    runs-on: ${{ matrix.image }}
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: ${{ contains(matrix.image, 'windows') && 'msys2 {0}' || 'bash' }}
+    env:
+      CC: ${{ !contains(matrix.image, 'windows') && 'clang' || '' }}
+      MAKEFLAGS: ${{ contains(matrix.image, 'macos') && '-j 4' || '-j 5' }}
+      MATRIX_IMAGE: '${{ matrix.image }}'
+      TESTOPTS: ${{ contains(matrix.image, 'macos') && '-D_CURL_PREFILL=ON' || '' }} ${{ contains(matrix.image, 'windows') && '-DCMAKE_UNITY_BUILD_BATCH_SIZE=30' || '' }}
+      OLD_CMAKE_VERSION: 3.19.8
+      OLD_CMAKE_SHA256_LINUX_ARM: 807f5afb2a560e00af9640e496d5673afefc2888bf0ed076412884a5ebb547a1
+      OLD_CMAKE_SHA256_MACOS_UNI: 0976d23d982af05dcbfb3aa34fcb62ead43bea27f0e3bb95222f2a78161423f2
+      OLD_CMAKE_SHA256_WIN_INTEL: 2a30877a3d6b50da305b289f4d1c03befdfaeb2edba02a563c681e883d810380
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [ubuntu-24.04-arm, macos-latest, windows-2022]
+    steps:
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        if: ${{ contains(matrix.image, 'windows') }}
+        with:
+          msystem: mingw64
+          release: false
+          update: false
+          cache: false
+          path-type: inherit
+          install: >-
+            mingw-w64-x86_64-zlib mingw-w64-x86_64-zstd mingw-w64-x86_64-libpsl mingw-w64-x86_64-libssh2 mingw-w64-x86_64-nghttp2 mingw-w64-x86_64-openssl
+
+      - name: 'install prereqs'
+        timeout-minutes: 3
+        run: |
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            cd ~
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-win64-x64.zip" --output pkg.bin
+            sha256sum pkg.bin && sha256sum pkg.bin | grep -qwF -- "${OLD_CMAKE_SHA256_WIN_INTEL}" && unzip -q pkg.bin && rm -f pkg.bin
+            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-win64-x64/bin/cmake.exe > ~/old-cmake-path.txt
+          elif [[ "${MATRIX_IMAGE}" = *'ubuntu'* ]]; then
+            sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+            sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+            sudo apt-get -o Dpkg::Use-Pty=0 update
+            sudo apt-get -o Dpkg::Use-Pty=0 install libpsl-dev libssl-dev
+            cd ~
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-Linux-aarch64.tar.gz" --output pkg.bin
+            sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OLD_CMAKE_SHA256_LINUX_ARM}" && tar -xzf pkg.bin && rm -f pkg.bin
+            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-Linux-aarch64/bin/cmake > ~/old-cmake-path.txt
+          else
+            brew install libpsl openssl
+            cd ~
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --location --proto-redir =https "https://github.com/Kitware/CMake/releases/download/v${OLD_CMAKE_VERSION}/cmake-${OLD_CMAKE_VERSION}-macos-universal.tar.gz" --output pkg.bin
+            sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OLD_CMAKE_SHA256_MACOS_UNI}" && tar -xzf pkg.bin && rm -f pkg.bin
+            printf '%s' ~/cmake-"${OLD_CMAKE_VERSION}"-macos-universal/CMake.app/Contents/bin/cmake > ~/old-cmake-path.txt
+          fi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'via ExternalProject'
+        if: ${{ !contains(matrix.image, 'ubuntu') }}
+        run: ./tests/cmake/test.sh ExternalProject ${TESTOPTS}
+      - name: 'via FetchContent'
+        run: ./tests/cmake/test.sh FetchContent ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via add_subdirectory'
+        run: ./tests/cmake/test.sh add_subdirectory ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package'
+        run: ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package (C++)'
+        if: ${{ contains(matrix.image, 'ubuntu') }}
+        run: TEST_CMAKE_FLAGS=-DTEST_CPP=ON ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+      - name: 'via find_package (PREFER_CONFIG=ON)'
+        if: ${{ contains(matrix.image, 'windows') }}
+        run: |
+          export TEST_CMAKE_FLAGS_PROVIDER='-DCMAKE_FIND_PACKAGE_PREFER_CONFIG=ON -DCURL_ZSTD=OFF'
+          TEST_CMAKE_FLAGS_PROVIDER+=' -DNGHTTP2_INCLUDE_DIR=C:/msys64/mingw64/include -DNGHTTP2_LIBRARY=C:/msys64/mingw64/lib/libnghttp2.dll.a'
+          export TEST_CMAKE_FLAGS_CONSUMER="${TEST_CMAKE_FLAGS_PROVIDER}"
+          ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+
+      - name: 'via ExternalProject (old cmake)'
+        if: ${{ contains(matrix.image, 'ubuntu') }}
+        run: |
+          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
+          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
+            export CFLAGS='-arch arm64'
+          fi
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
+            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc'
+          fi
+          ./tests/cmake/test.sh ExternalProject ${TESTOPTS}
+
+      - name: 'via add_subdirectory OpenSSL (old cmake)'
+        run: |
+          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
+          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
+            export CFLAGS='-arch arm64'
+            export TEST_CMAKE_FLAGS='-DCURL_USE_LIBPSL=OFF'  # auto-detection does not work with old-cmake
+          fi
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
+            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
+          fi
+          ./tests/cmake/test.sh add_subdirectory ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+
+      - name: 'via find_package OpenSSL (old cmake)'
+        run: |
+          export TEST_CMAKE_CONSUMER; TEST_CMAKE_CONSUMER="$(cat ~/old-cmake-path.txt)"
+          if [[ "${MATRIX_IMAGE}" = *'macos'* ]]; then
+            export CFLAGS='-arch arm64'
+            export TEST_CMAKE_FLAGS='-DCURL_USE_LIBPSL=OFF'  # auto-detection does not work with old-cmake
+          fi
+          if [[ "${MATRIX_IMAGE}" = *'windows'* ]]; then
+            export TEST_CMAKE_GENERATOR='MSYS Makefiles'
+            export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
+          fi
+          ./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
+
+  verify-tarball-downloads:
+    name: 'Verify tarball downloads'
+    runs-on: ubuntu-slim
+    timeout-minutes: 2
+    steps:
+      - name: 'download and import GPG key'
+        env:
+          CURL_GPG_ID: 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2
+        run: |
+          for keyserver in \
+            https://keyserver.ubuntu.com/ \
+            https://pgpkeys.eu/ \
+          ; do
+            echo "--- Downloading from ${keyserver}..."
+            if curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+               "${keyserver}pks/lookup?op=get&options=mr&exact=on&search=0x${CURL_GPG_ID}" \
+               | gpg --batch --keyserver-options timeout=15 --display-charset utf-8 --keyid-format 0xlong --import --status-fd 1 2>&1; then
+              break
+            fi
+          done
+
+      - name: 'download and verify tarballs'
+        run: |
+          echo "--- Detecting latest curl tarball version..."
+          curl_version="$(curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused https://curl.se/info.json \
+            | jq --raw-output .Version)"
+
+          for suffix in .tar.bz2 .tar.gz .tar.xz .zip; do
+            echo "--- Downloading ${curl_version} ${suffix}..."
+            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+              --output pkg.bin "https://curl.se/download/curl-${curl_version}${suffix}" \
+              --output pkg.sig "https://curl.se/download/curl-${curl_version}${suffix}.asc"
+            echo "--- Verifying ${curl_version} ${suffix}..."
+            gpg --batch --keyserver-options timeout=15 --display-charset utf-8 --keyid-format 0xlong --verify-options show-primary-uid-only \
+              --verify pkg.sig pkg.bin 2>&1
+            echo '---'
+          done

third-party/curl/.github/workflows/fuzz.yml

@@ -2,49 +2,45 @@
 #
 # SPDX-License-Identifier: curl
 
-name: Fuzzer
+name: 'Fuzzer'
 
-on:
+'on':
   push:
     branches:
-    - master
-    - '*/ci'
+      - master
+      - '*/ci'
     paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'Dockerfile'
+      - 'projects/**'
+      - 'tests/data/**'
   pull_request:
     branches:
-    - master
+      - master
     paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'tests/data/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'Dockerfile'
+      - 'projects/**'
+      - 'tests/data/**'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  # Hard-coded workflow name to avoid colliding with curl-fuzzer's group
+  group: curl-fuzz-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
 permissions: {}
 
+env:
+  DO_NOT_TRACK: '1'
+
 jobs:
   Fuzzing:
-    uses: curl/curl-fuzzer/.github/workflows/ci.yml@master
+    uses: curl/curl-fuzzer/.github/workflows/ci.yml@master  # zizmor: ignore[unpinned-uses]

third-party/curl/.github/workflows/hacktoberfest-accepted.yml

@@ -1,67 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Hacktoberfest
-
-on:
-  # this must not ever run on any other branch than master
-  push:
-    branches:
-    - master
-
-concurrency:
-  # this should not run in parallel, so just run one at a time
-  group: ${{ github.workflow }}
-
-permissions: {}
-
-jobs:
-  # add hacktoberfest-accepted label to PRs opened starting from September 30th
-  # till November 1st which are closed via commit reference from master branch.
-  merged:
-    runs-on: ubuntu-latest
-    permissions:
-      # requires issues AND pull-requests write permissions to edit labels on PRs!
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 100
-
-      - name: Check whether repo participates in Hacktoberfest
-        run: |
-          gh config set prompt disabled && echo "label=$(
-            gh repo view --json repositoryTopics --jq '.repositoryTopics[].name' | grep '^hacktoberfest$')" >> $GITHUB_OUTPUT
-        id: check
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Search relevant commit message lines starting with Closes/Merges
-        run: |
-          git log --format=email ${{ github.event.before }}..${{ github.event.after }} | \
-            grep -Ei "^Close[sd]? " | sort | uniq | tee log
-        if: steps.check.outputs.label == 'hacktoberfest'
-
-      - name: Search for Number-based PR references
-        run: |
-          grep -Eo "#([0-9]+)" log | cut -d# -f2 | sort | uniq | xargs -t -n1 -I{} \
-            gh pr view {} --json number,createdAt \
-              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
-            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
-              gh pr edit {} --add-label 'hacktoberfest-accepted'
-        if: steps.check.outputs.label == 'hacktoberfest'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Search for URL-based PR references
-        run: |
-          grep -Eo "github.com/(.+)/(.+)/pull/([0-9]+)" log | sort | uniq | xargs -t -n1 -I{} \
-            gh pr view "https://{}" --json number,createdAt \
-              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
-            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
-              gh pr edit {} --add-label 'hacktoberfest-accepted'
-        if: steps.check.outputs.label == 'hacktoberfest'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

third-party/curl/.github/workflows/http3-linux.yml

@@ -0,0 +1,894 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: 'Linux HTTP/3'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1850
+  DO_NOT_TRACK: '1'
+  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
+  AWSLC_VERSION: 5.0.0
+  # renovate: datasource=github-tags depName=google/boringssl versioning=semver registryUrl=https://github.com
+  BORINGSSL_VERSION: 0.20260616.0
+  # renovate: datasource=github-tags depName=gnutls/nettle versioning=semver registryUrl=https://github.com
+  NETTLE_VERSION: 3.10.2
+  # renovate: datasource=github-tags depName=gnutls/gnutls versioning=semver extractVersion=^nettle_?(?<version>.+)_release_.+$ registryUrl=https://github.com
+  GNUTLS_VERSION: 3.8.11
+  # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
+  LIBRESSL_VERSION: 4.3.2
+  # renovate: datasource=github-releases depName=openssl/openssl versioning=semver extractVersion=^openssl-(?<version>.+)$ registryUrl=https://github.com
+  OPENSSL_VERSION: 4.0.1
+  # manually bumped
+  OPENSSL_PREV_VERSION: 3.6.2
+  OPENSSL_PREV_SHA256: aaf51a1fe064384f811daeaeb4ec4dce7340ec8bd893027eee676af31e83a04f
+  # renovate: datasource=github-tags depName=cloudflare/quiche versioning=semver registryUrl=https://github.com
+  QUICHE_VERSION: 0.29.2
+  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
+  WOLFSSL_VERSION: 5.9.1
+  # renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
+  NGHTTP3_VERSION: 1.16.0
+  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
+  NGTCP2_VERSION: 1.23.0
+  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
+  NGHTTP2_VERSION: 1.69.0
+  # no tagged releases
+  H2O_VERSION: 11b0cfa2771e3ccad4a852e72473e4e278ab1de7 # 2026-05-28
+  H2O_SHA256: 5ae1bd7b09970d7d49c41fa68193e24da04c2a7ac5581fbe2affc79200b0721f
+
+jobs:
+  build-cache:
+    name: 'Build caches'
+    runs-on: ubuntu-26.04
+
+    steps:
+      - name: 'cache awslc'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: ~/awslc/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
+
+      - name: 'cache boringssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-boringssl
+        env:
+          cache-name: cache-boringssl
+        with:
+          path: ~/boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
+
+      - name: 'cache nettle'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nettle
+        env:
+          cache-name: cache-nettle
+        with:
+          path: ~/nettle/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}
+
+      - name: 'cache gnutls'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-gnutls
+        env:
+          cache-name: cache-gnutls
+        with:
+          path: ~/gnutls/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}
+
+      - name: 'cache libressl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl
+        env:
+          cache-name: cache-libressl
+        with:
+          path: ~/libressl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
+
+      - name: 'cache openssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-http3-no-deprecated
+        env:
+          cache-name: cache-openssl-http3-no-deprecated
+        with:
+          path: ~/openssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
+
+      - name: 'cache openssl-prev'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-prev-http3
+        env:
+          cache-name: cache-openssl-prev-http3
+        with:
+          path: ~/openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}
+
+      - name: 'cache wolfssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl
+        env:
+          cache-name: cache-wolfssl
+        with:
+          path: ~/wolfssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
+
+      - name: 'cache nghttp3'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp3
+        env:
+          cache-name: cache-nghttp3
+        with:
+          path: ~/nghttp3/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}
+
+      - name: 'cache ngtcp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2
+        env:
+          cache-name: cache-ngtcp2
+        with:
+          path: ~/ngtcp2/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
+            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}"
+
+      - name: 'cache ngtcp2 boringssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-boringssl
+        env:
+          cache-name: cache-ngtcp2-boringssl
+        with:
+          path: ~/ngtcp2-boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}
+
+      - name: 'cache ngtcp2 openssl-prev'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-openssl-prev
+        env:
+          cache-name: cache-ngtcp2-openssl-prev
+        with:
+          path: ~/ngtcp2-openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
+
+      - name: 'cache nghttp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp2
+        env:
+          cache-name: cache-nghttp2
+        with:
+          path: ~/nghttp2/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
+            ${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}"
+
+      - name: 'cache h2o'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-h2o
+        env:
+          cache-name: cache-h2o
+        with:
+          path: ~/h2o/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.H2O_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}"
+
+      - id: settings
+        if: >-
+          ${{ !steps.cache-awslc.outputs.cache-hit ||
+              !steps.cache-boringssl.outputs.cache-hit ||
+              !steps.cache-nettle.outputs.cache-hit ||
+              !steps.cache-gnutls.outputs.cache-hit ||
+              !steps.cache-libressl.outputs.cache-hit ||
+              !steps.cache-openssl-http3-no-deprecated.outputs.cache-hit ||
+              !steps.cache-openssl-prev-http3.outputs.cache-hit ||
+              !steps.cache-wolfssl.outputs.cache-hit ||
+              !steps.cache-nghttp3.outputs.cache-hit ||
+              !steps.cache-ngtcp2-boringssl.outputs.cache-hit ||
+              !steps.cache-ngtcp2-openssl-prev.outputs.cache-hit ||
+              !steps.cache-ngtcp2.outputs.cache-hit ||
+              !steps.cache-nghttp2.outputs.cache-hit ||
+              !steps.cache-h2o.outputs.cache-hit }}
+
+        run: echo 'needs-build=true' >> "$GITHUB_OUTPUT"
+
+      - name: 'install build prereqs'
+        if: ${{ steps.settings.outputs.needs-build == 'true' }}
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libtool autoconf automake pkgconf \
+            libbrotli-dev libzstd-dev zlib1g-dev \
+            libev-dev \
+            libuv1-dev \
+            libc-ares-dev \
+            libp11-kit-dev autopoint bison gperf gtk-doc-tools libtasn1-bin  # for GnuTLS
+
+      - name: 'build awslc'
+        if: ${{ !steps.cache-awslc.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "aws-lc-${AWSLC_VERSION}"
+          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/awslc/build
+          cmake --build .
+          cmake --install .
+
+      - name: 'build boringssl'
+        if: ${{ !steps.cache-boringssl.outputs.cache-hit }}
+        run: |
+          mkdir boringssl-src
+          cd boringssl-src
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://boringssl.googlesource.com/boringssl/+archive/${BORINGSSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cmake -B . -G Ninja -DBUILD_SHARED_LIBS=ON -DBUILD_TESTING=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/boringssl/build
+          cmake --build .
+          cmake --install .
+
+      - name: 'build nettle'
+        if: ${{ !steps.cache-nettle.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://ftpmirror.gnu.org/nettle/nettle-${NETTLE_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "nettle-${NETTLE_VERSION}"
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix=/home/runner/nettle/build \
+            --disable-static --disable-openssl --disable-documentation
+          make install
+
+      - name: 'build gnutls'
+        if: ${{ !steps.cache-gnutls.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://www.gnupg.org/ftp/gcrypt/gnutls/v${GNUTLS_VERSION%.*}/gnutls-${GNUTLS_VERSION}.tar.xz" --output pkg.bin
+          sha256sum pkg.bin && tar -xJf pkg.bin && rm -f pkg.bin
+          cd "gnutls-${GNUTLS_VERSION}"
+          autoreconf -fi
+          # required: libp11-kit-dev libev-dev autopoint bison gperf gtk-doc-tools libtasn1-bin
+          ./configure --disable-dependency-tracking --prefix=/home/runner/gnutls/build \
+            PKG_CONFIG_PATH=/home/runner/nettle/build/lib64/pkgconfig \
+            LDFLAGS=-Wl,-rpath,/home/runner/nettle/build/lib64 \
+            --with-included-libtasn1 --with-included-unistring \
+            --disable-guile --disable-doc --disable-tests --disable-tools
+          make install
+
+      - name: 'build libressl'
+        if: ${{ !steps.cache-libressl.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "libressl-${LIBRESSL_VERSION}"
+          cmake -B . -G Ninja -DLIBRESSL_APPS=OFF -DLIBRESSL_TESTS=OFF -DCMAKE_INSTALL_PREFIX=/home/runner/libressl/build
+          cmake --build .
+          cmake --install .
+
+      - name: 'build openssl'
+        if: ${{ !steps.cache-openssl-http3-no-deprecated.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
+          cd openssl
+          ./config --prefix="$PWD"/build --libdir=lib no-makedepend no-apps no-docs no-tests no-deprecated
+          make
+          make -j1 install_sw
+
+      - name: 'build openssl-prev'
+        if: ${{ !steps.cache-openssl-prev-http3.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_PREV_VERSION}/openssl-${OPENSSL_PREV_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${OPENSSL_PREV_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "openssl-${OPENSSL_PREV_VERSION}"
+          ./config --prefix=/home/runner/openssl-prev/build --libdir=lib no-makedepend no-apps no-docs no-tests
+          make
+          make -j1 install_sw
+
+      - name: 'build wolfssl'
+        if: ${{ !steps.cache-wolfssl.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${WOLFSSL_VERSION}-stable" https://github.com/wolfSSL/wolfssl
+          cd wolfssl
+          ./autogen.sh
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-all --enable-quic \
+            --disable-benchmark --disable-crypttests --disable-examples
+          make
+          make install
+
+      - name: 'build nghttp3'
+        if: ${{ !steps.cache-nghttp3.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGHTTP3_VERSION}" https://github.com/ngtcp2/nghttp3
+          cd nghttp3
+          git submodule update --init --depth 1
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only
+          make
+          make install
+
+      - name: 'build ngtcp2'
+        if: ${{ !steps.cache-ngtcp2.outputs.cache-hit }}
+        # building twice to get crypto libs for ossl, libressl and awslc installed
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2
+          cd ngtcp2
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            PKG_CONFIG_PATH=/home/runner/libressl/build/lib/pkgconfig \
+            --with-openssl
+          make install
+          make clean
+          export PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/nettle/build/lib64/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/gnutls/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/wolfssl/build/lib/pkgconfig
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            --with-openssl --with-gnutls --with-wolfssl --with-boringssl \
+            BORINGSSL_LIBS='-L/home/runner/awslc/build/lib -lssl -lcrypto' \
+            BORINGSSL_CFLAGS='-I/home/runner/awslc/build/include'
+          make install
+
+      - name: 'build ngtcp2 openssl-prev'
+        if: ${{ !steps.cache-ngtcp2-openssl-prev.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl-prev
+          cd ngtcp2-openssl-prev
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            PKG_CONFIG_PATH=/home/runner/openssl-prev/build/lib/pkgconfig \
+            --with-openssl
+          make install
+
+      - name: 'build ngtcp2 boringssl'
+        if: ${{ !steps.cache-ngtcp2-boringssl.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGTCP2_VERSION}" https://github.com/ngtcp2/ngtcp2 ngtcp2-boringssl
+          cd ngtcp2-boringssl
+          autoreconf -fi
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-lib-only \
+            --with-openssl=no --with-boringssl \
+            BORINGSSL_LIBS='-L/home/runner/boringssl/build/lib -lssl -lcrypto' \
+            BORINGSSL_CFLAGS='-I/home/runner/boringssl/build/include'
+          make install
+
+      - name: 'build nghttp2'
+        if: ${{ !steps.cache-nghttp2.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "v${NGHTTP2_VERSION}" https://github.com/nghttp2/nghttp2
+          cd nghttp2
+          git submodule update --init --depth 1
+          autoreconf -fi
+          # required (for nghttpx application): libc-ares-dev libev-dev zlib1g-dev
+          # optional (for nghttpx application): libbrotli-dev
+          export PKG_CONFIG_PATH=/home/runner/openssl/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/nghttp3/build/lib/pkgconfig
+          PKG_CONFIG_PATH+=:/home/runner/ngtcp2/build/lib/pkgconfig
+          ./configure --disable-dependency-tracking --prefix="$PWD"/build --enable-app --enable-http3 \
+            LDFLAGS=-Wl,-rpath,/home/runner/openssl/build/lib \
+            --with-libbrotlienc --with-libbrotlidec
+          make install
+
+      - name: 'build h2o'
+        if: ${{ !steps.cache-h2o.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/h2o/h2o/archive/${H2O_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${H2O_SHA256}" && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "h2o-${H2O_VERSION}"
+          cmake -B . -G Ninja -DWITHOUT_LIBS=ON -DOPENSSL_ROOT_DIR=/home/runner/openssl-prev/build -DCMAKE_INSTALL_PREFIX=/home/runner/h2o/build
+          cmake --build .
+          cmake --install .
+
+  linux:
+    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
+    needs: build-cache
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+    env:
+      CURL_TRACE_PKG_CONFIG: '1'
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_INSTALL_PACKAGES: '${{ matrix.build.install_packages }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - name: 'awslc'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/awslc/build/lib
+            PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            # Intentionally using bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' to test this way of configuration, in addition to '--with-ngtcp2=<path>' in other jobs.
+            configure: >-
+              --with-openssl=/home/runner/awslc/build --with-ngtcp2 --enable-ssls-export
+
+          - name: 'awslc'
+            PKG_CONFIG_PATH: /home/runner/awslc/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/awslc/build -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
+              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON
+
+          - name: 'boringssl'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/boringssl/build/lib
+            PKG_CONFIG_PATH: /home/runner/boringssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/runner/boringssl/build --with-ngtcp2=/home/runner/ngtcp2-boringssl/build --enable-ssls-export
+
+          - name: 'boringssl'
+            PKG_CONFIG_PATH: "\
+              /home/runner/boringssl/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/ngtcp2-boringssl/build/lib/pkgconfig:\
+              /home/runner/nghttp2/build/lib/pkgconfig"
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/boringssl/build -DUSE_NGTCP2=ON -DBUILD_SHARED_LIBS=OFF
+              -DCMAKE_UNITY_BUILD=ON
+
+          - name: 'gnutls'
+            install_packages: libp11-kit-dev libssh-dev
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib -Wl,-rpath,/home/runner/nettle/build/lib64 -Wl,-rpath,/home/runner/ngtcp2/build/lib
+            PKG_CONFIG_PATH: /home/runner/nettle/build/lib64/pkgconfig:/home/runner/gnutls/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-gnutls=/home/runner/gnutls/build --with-ngtcp2=/home/runner/ngtcp2/build --with-libssh --enable-ssls-export
+
+          - name: 'gnutls'
+            install_packages: libp11-kit-dev libssh-dev
+            LDFLAGS: -Wl,-rpath,/home/runner/gnutls/build/lib
+            PKG_CONFIG_PATH: "\
+              /home/runner/nettle/build/lib64/pkgconfig:\
+              /home/runner/gnutls/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/ngtcp2/build/lib/pkgconfig:\
+              /home/runner/nghttp2/build/lib/pkgconfig"
+            generate: >-
+              -DCURL_USE_GNUTLS=ON -DUSE_NGTCP2=ON -DCURL_USE_LIBSSH=ON
+              -DCMAKE_UNITY_BUILD=ON
+
+          - name: 'libressl'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/libressl/build/lib
+            PKG_CONFIG_PATH: /home/runner/libressl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            # Intentionally using '--with-ngtcp2=<path>' to test this way of configuration, in addition to bare '--with-ngtcp2' + 'PKG_CONFIG_PATH' in other jobs.
+            configure: >-
+              --with-openssl=/home/runner/libressl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ssls-export
+              --enable-unity
+
+          - name: 'libressl'
+            PKG_CONFIG_PATH: /home/runner/libressl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/libressl/build -DUSE_NGTCP2=ON
+
+          - name: 'openssl'
+            tflags: '--min=1700'
+            LDFLAGS: -Wl,-rpath,/home/runner/openssl/build/lib
+            PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/runner/openssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --enable-ssls-export --enable-proxy-http3
+
+          - name: 'openssl'
+            install_steps: skipall
+            PKG_CONFIG_PATH: /home/runner/openssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/openssl/build -DUSE_NGTCP2=ON
+              -DCURL_DISABLE_LDAP=ON
+              -DUSE_ECH=ON -DUSE_PROXY_HTTP3=ON
+              -DCMAKE_UNITY_BUILD=ON
+
+          - name: 'openssl-prev'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/openssl-prev/build/lib
+            PKG_CONFIG_PATH: "\
+              /home/runner/openssl-prev/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/nghttp2-openssl-prev/build/lib/pkgconfig"
+            configure: >-
+              --with-openssl=/home/runner/openssl-prev/build --with-ngtcp2=/home/runner/ngtcp2-openssl-prev/build --enable-ssls-export
+
+          - name: 'openssl-prev'
+            tflags: '--min=1700'
+            PKG_CONFIG_PATH: "\
+              /home/runner/openssl-prev/build/lib/pkgconfig:\
+              /home/runner/nghttp3/build/lib/pkgconfig:\
+              /home/runner/ngtcp2-openssl-prev/build/lib/pkgconfig:\
+              /home/runner/nghttp2/build/lib/pkgconfig"
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/openssl-prev/build -DUSE_NGTCP2=ON
+              -DCURL_DISABLE_LDAP=ON
+
+          - name: 'quiche'
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/quiche/target/release
+            PKG_CONFIG_PATH: /home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/runner/quiche/boringssl
+              --with-quiche=/home/runner/quiche/target/release
+              --with-ca-fallback
+              --enable-unity
+
+          - name: 'quiche'
+            PKG_CONFIG_PATH: /home/runner/nghttp2/build/lib/pkgconfig:/home/runner/quiche/target/release
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/home/runner/quiche/boringssl
+              -DUSE_QUICHE=ON
+              -DCURL_CA_FALLBACK=ON
+
+          - name: 'wolfssl'
+            install_packages: libssh2-1-dev
+            install_steps: skipall
+            LDFLAGS: -Wl,-rpath,/home/runner/wolfssl/build/lib
+            PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            configure: >-
+              --with-wolfssl=/home/runner/wolfssl/build --with-ngtcp2=/home/runner/ngtcp2/build --enable-ech --with-libssh2 --enable-ssls-export
+              --enable-unity
+
+          - name: 'wolfssl'
+            install_packages: libssh2-1-dev
+            tflags: '--min=1900'
+            PKG_CONFIG_PATH: /home/runner/wolfssl/build/lib/pkgconfig:/home/runner/nghttp3/build/lib/pkgconfig:/home/runner/ngtcp2/build/lib/pkgconfig:/home/runner/nghttp2/build/lib/pkgconfig
+            generate: >-
+              -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON
+              -DUSE_ECH=ON
+
+    steps:
+      - name: 'install prereqs'
+        timeout-minutes: 2
+        env:
+          INSTALL_PACKAGES: >-
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4 ' || '' }}
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') &&
+              'apache2 apache2-dev libnghttp2-dev vsftpd dante-server libev-dev' || '' }}
+
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install \
+            libtool autoconf automake pkgconf \
+            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libidn2-0-dev libldap-dev libuv1-dev valgrind \
+            ${INSTALL_PACKAGES} \
+            ${MATRIX_INSTALL_PACKAGES}
+
+      - name: 'cache awslc'
+        if: ${{ contains(matrix.build.name, 'awslc') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: ~/awslc/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache boringssl'
+        if: ${{ contains(matrix.build.name, 'boringssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-boringssl
+        env:
+          cache-name: cache-boringssl
+        with:
+          path: ~/boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.BORINGSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache nettle'
+        if: ${{ contains(matrix.build.name, 'gnutls') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nettle
+        env:
+          cache-name: cache-nettle
+        with:
+          path: ~/nettle/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NETTLE_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache gnutls'
+        if: ${{ contains(matrix.build.name, 'gnutls') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-gnutls
+        env:
+          cache-name: cache-gnutls
+        with:
+          path: ~/gnutls/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.GNUTLS_VERSION }}-${{ env.NETTLE_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache libressl'
+        if: ${{ contains(matrix.build.name, 'libressl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl
+        env:
+          cache-name: cache-libressl
+        with:
+          path: ~/libressl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache openssl'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-http3-no-deprecated
+        env:
+          cache-name: cache-openssl-http3-no-deprecated
+        with:
+          path: ~/openssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache openssl-prev'
+        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-openssl-prev-http3
+        env:
+          cache-name: cache-openssl-prev-http3
+        with:
+          path: ~/openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.OPENSSL_PREV_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache wolfssl'
+        if: ${{ contains(matrix.build.name, 'wolfssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-wolfssl
+        env:
+          cache-name: cache-wolfssl
+        with:
+          path: ~/wolfssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache nghttp3'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp3
+        env:
+          cache-name: cache-nghttp3
+        with:
+          path: ~/nghttp3/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP3_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache ngtcp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2
+        env:
+          cache-name: cache-ngtcp2
+        with:
+          path: ~/ngtcp2/build
+          key: "${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_VERSION }}-\
+            ${{ env.LIBRESSL_VERSION }}-${{ env.AWSLC_VERSION }}-${{ env.NETTLE_VERSION }}-${{ env.GNUTLS_VERSION }}-${{ env.WOLFSSL_VERSION }}"
+          fail-on-cache-miss: true
+
+      - name: 'cache ngtcp2 boringssl'
+        if: ${{ contains(matrix.build.name, 'boringssl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-boringssl
+        env:
+          cache-name: cache-ngtcp2-boringssl
+        with:
+          path: ~/ngtcp2-boringssl/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.BORINGSSL_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache ngtcp2 openssl-prev'
+        if: ${{ contains(matrix.build.name, 'openssl-prev') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-ngtcp2-openssl-prev
+        env:
+          cache-name: cache-ngtcp2-openssl-prev
+        with:
+          path: ~/ngtcp2-openssl-prev/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGTCP2_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache nghttp2'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-nghttp2
+        env:
+          cache-name: cache-nghttp2
+        with:
+          path: ~/nghttp2/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.NGHTTP2_VERSION }}-${{ env.OPENSSL_VERSION }}-${{ env.NGTCP2_VERSION }}-${{ env.NGHTTP3_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache h2o'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-h2o
+        env:
+          cache-name: cache-h2o
+        with:
+          path: ~/h2o/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.H2O_VERSION }}-${{ env.OPENSSL_PREV_VERSION }}
+          fail-on-cache-miss: true
+
+      - name: 'cache quiche'
+        if: ${{ contains(matrix.build.name, 'quiche') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-quiche
+        env:
+          cache-name: cache-quiche
+        with:
+          path: ~/quiche
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.QUICHE_VERSION }}
+
+      - name: 'build quiche and boringssl'
+        if: ${{ contains(matrix.build.name, 'quiche') && !steps.cache-quiche.outputs.cache-hit }}
+        run: |
+          cd ~
+          git clone --quiet --depth 1 --branch "${QUICHE_VERSION}" --recursive https://github.com/cloudflare/quiche
+          cd quiche
+          cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
+          ln -s libquiche.so target/release/libquiche.so.0
+          cd ..
+          mkdir -p quiche/boringssl/lib
+          find quiche/target/release \( -name libcrypto.a -o -name libssl.a \) -exec ln -vnf -- '{}' quiche/boringssl/lib \;
+          find quiche/target/release/build/boring-sys-*/out/boringssl/src -maxdepth 1 \( -name include \) -exec ln -vsf -- '../../{}' quiche/boringssl \;
+
+          # include dir
+          # /home/runner/quiche/boringssl/include
+          # lib dir
+          # /home/runner/quiche/boringssl/lib
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          LDFLAGS: '${{ matrix.build.LDFLAGS }}'
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+          MATRIX_PKG_CONFIG_PATH: '${{ matrix.build.PKG_CONFIG_PATH }}'
+        run: |
+          [ -n "${MATRIX_PKG_CONFIG_PATH}" ] && export PKG_CONFIG_PATH="${MATRIX_PKG_CONFIG_PATH}"
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            [[ "${MATRIX_GENERATE}" = *'boringssl'* ]] && options=" -DBORINGSSL_VERSION=${BORINGSSL_VERSION}"
+            cmake -B bld -G Ninja \
+              -DCMAKE_C_COMPILER_TARGET="$(uname -m)-unknown-linux-gnu" -DBUILD_STATIC_LIBS=ON \
+              -DCURL_WERROR=ON -DENABLE_DEBUG=ON \
+              -DCURL_USE_LIBUV=ON -DCURL_ENABLE_NTLM=ON \
+              -DTEST_NGHTTPX=/home/runner/nghttp2/build/bin/nghttpx \
+              -DH2O=/home/runner/h2o/build/bin/h2o \
+              -DHTTPD_NGHTTPX=/home/runner/nghttp2/build/bin/nghttpx \
+              ${MATRIX_GENERATE} ${options}
+          else
+            [[ "${MATRIX_CONFIGURE}" = *'boringssl'* ]] && export CPPFLAGS="-DCURL_BORINGSSL_VERSION=\\\"${BORINGSSL_VERSION}\\\""
+            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror --enable-debug --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libuv --enable-ntlm \
+              --with-test-h2o=/home/runner/h2o/build/bin/h2o \
+              --with-test-nghttpx=/home/runner/nghttp2/build/bin/nghttpx \
+              ${MATRIX_CONFIGURE}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'test configs'
+        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.so.*' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+          bld/src/curl --disable -V
+
+      - name: 'build tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'install test prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          python3 -m venv ~/venv
+          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        env:
+          TFLAGS: '${{ matrix.build.tflags }}'
+        run: |
+          TFLAGS+=' -n'
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'run tests (valgrind)'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          export TFLAGS='-j6 --min=4 HTTP/3'
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'install pytest prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          [ -d ~/venv ] || python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt
+
+      - name: 'run pytest (event based)'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        env:
+          CURL_TEST_EVENT: 1
+          PYTEST_ADDOPTS: '--color=yes'
+          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
+        run: |
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-pytest-ci
+          else
+            make -C bld V=1 pytest-ci
+          fi

third-party/curl/.github/workflows/label.yml

@@ -2,27 +2,34 @@
 #
 # SPDX-License-Identifier: curl
 
-# This workflow will triage pull requests and apply a label based on the
+# This workflow triages pull requests and applies a label based on the
 # paths that are modified in the pull request.
 #
-# To use this workflow, you will need to set up a .github/labeler.yml
-# file with configuration.  For more information, see:
-# https://github.com/actions/labeler
+# To use this workflow, you need to set up a .github/labeler.yml file with
+# configuration.  For more information, see: https://github.com/actions/labeler
 
-name: Labeler
-on: [pull_request_target]
+name: 'Labeler'
+
+'on': [pull_request_target]  # zizmor: ignore[dangerous-triggers]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  DO_NOT_TRACK: '1'
 
 jobs:
   label:
-
-    runs-on: ubuntu-latest
+    name: 'Labeler'
+    runs-on: ubuntu-slim
     permissions:
-      contents: read
-      pull-requests: write
+      contents: read        # To comply with https://github.com/actions/labeler documentation
+      pull-requests: write  # To edit labels on PRs
 
     steps:
-    - uses: actions/labeler@v4
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
-        # Workaround for actions/labeler#112
-        sync-labels: ''
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        with:
+          repo-token: '${{ secrets.GITHUB_TOKEN }}'

third-party/curl/.github/workflows/linkcheck.yml

@@ -1,36 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Markdown links
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths:
-    - '.github/workflows/linkcheck.yml'
-    - '**.md'
-  pull_request:
-    branches:
-    - master
-    paths:
-    - '.github/workflows/linkcheck.yml'
-    - '**.md'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  # Docs: https://github.com/marketplace/actions/markdown-link-check
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
-      with:
-        use-quiet-mode: 'yes'

third-party/curl/.github/workflows/linux-old.yml

@@ -0,0 +1,185 @@
+# Copyright (C) Daniel Fandrich, <dan@coneharvesters.com>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Compile on an old version of Linux that has barely the minimal build
+# requirements for CMake. This tests that curl is still usable on really
+# outdated systems.
+#
+# Debian stretch is chosen as it closely matches some of the oldest major
+# versions we support (especially cmake); see docs/INTERNALS.md and it
+# is still supported (as of this writing).
+# stretch has ELTS support from Freexian until 2027-06-30
+# For ELTS info see https://www.freexian.com/lts/extended/docs/how-to-use-extended-lts/
+# The Debian key expires 2025-05-20, after which package signature
+# verification may need to be disabled.
+# httrack is one of the smallest downloaders, needed to bootstrap ELTS,
+# and doesn not conflict with the curl we are building.
+
+name: 'Linux Old'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1560
+  DEBIAN_FRONTEND: noninteractive
+  DO_NOT_TRACK: '1'
+
+jobs:
+  cmake-autotools:
+    name: 'autotools & cmake'
+    runs-on: ubuntu-latest
+    container: debian:stretch-20220622-slim@sha256:c5cd3ffceeb25b683bf5111ea89bf8049a177e00fb237235d48076a19cc80097
+
+    steps:
+      - name: 'install prereqs'
+        # Remember, this shell is dash, not bash
+        run: |
+          sed -E -i -e s@[a-z]+\.debian\.org/@archive.debian.org/debian-archive/@ -e '/ stretch-updates /d' /etc/apt/sources.list
+          apt-get -o Dpkg::Use-Pty=0 update
+          # See comment above if this fails after 2025-05-20
+          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends httrack
+          httrack --get https://deb.freexian.com/extended-lts/pool/main/f/freexian-archive-keyring/freexian-archive-keyring_2022.06.08_all.deb
+          sha256sum freexian-archive-keyring_2022.06.08_all.deb && dpkg -i freexian-archive-keyring_2022.06.08_all.deb
+          echo 'deb http://deb.freexian.com/extended-lts stretch-lts main contrib non-free' | tee /etc/apt/sources.list.d/extended-lts.list
+          apt-get -o Dpkg::Use-Pty=0 update
+          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends \
+            make automake autoconf libtool ninja-build gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libkrb5-dev libldap2-dev stunnel4
+          # GitHub's actions/checkout needs newer glibc and libstdc++. The latter also depends on
+          # gcc-8-base, but it does not actually seem used in our situation and is not available in
+          # the main repo, so force the install.
+          httrack --get https://deb.freexian.com/extended-lts/pool/main/g/glibc/libc6_2.28-10+deb10u5_amd64.deb
+          httrack --get https://deb.freexian.com/extended-lts/pool/main/g/gcc-8/libstdc++6_8.3.0-6_amd64.deb
+          sha256sum libc6_*_amd64.deb libstdc++6_*_amd64.deb && dpkg -i --force-depends libc6_*_amd64.deb libstdc++6_*_amd64.deb
+
+      - name: 'install prereqs (cmake)'
+        env:
+          CMAKE_VERSION: 3.18.0  # Earliest version supported by curl
+          CMAKE_SHA256: 4d9a9d3351161073a67e49366d701b6fa4b0343781982dc5eef08a02a750d403
+        run: |
+          cd ~
+          fn="cmake-${CMAKE_VERSION}-linux-x86_64"
+          httrack --get "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}/${fn}.tar.gz"
+          sha256sum "${fn}".tar*.gz | tee /dev/stderr | grep -qwF -- "${CMAKE_SHA256}" && tar -xf "${fn}".tar*.gz && rm -f "${fn}".tar*.gz
+          mv "cmake-${CMAKE_VERSION}-Linux-x86_64" cmake
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'CM build-only configure (out-of-tree)'
+        run: |
+          ~/cmake/bin/cmake -B bld-1 -G Ninja -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
+            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF
+
+      - name: 'CM build-only build'
+        run: |
+          ~/cmake/bin/cmake --build bld-1 --verbose
+          ~/cmake/bin/cmake --install bld-1 --verbose
+
+      - name: 'CM build-only curl -V'
+        run: bld-1/src/curl --disable --version
+
+      - name: 'CM build-only configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld-1/CMakeFiles/CMake*.log 2>/dev/null || true
+
+      - name: 'CM build-only curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld-1/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld-1/lib/curl_config.h | sort || true
+
+      # when this job can get libssh 0.9.0 or greater, this should get that enabled again
+      # when this job can get c-ares 1.16.0 or greater, this should get that enabled again
+
+      - name: 'CM configure (out-of-tree, zstd, gssapi)'
+        run: |
+          ~/cmake/bin/cmake -B bld-oldie -G Ninja -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
+            -DCURL_ENABLE_SSL=OFF -DENABLE_ARES=OFF -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF \
+            -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON
+
+      - name: 'CM configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld-oldie/CMakeFiles/CMake*.log 2>/dev/null || true
+
+      - name: 'CM curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld-oldie/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld-oldie/lib/curl_config.h | sort || true
+
+      - name: 'CM build'
+        run: ~/cmake/bin/cmake --build bld-oldie
+
+      - name: 'CM curl -V'
+        run: bld-oldie/src/curl --disable --version
+
+      - name: 'CM install'
+        run: ~/cmake/bin/cmake --install bld-oldie
+
+      - name: 'CM build tests'
+        run: ~/cmake/bin/cmake --build bld-oldie --target testdeps
+
+      - name: 'CM run tests'
+        run: ~/cmake/bin/cmake --build bld-oldie --target test-ci
+
+      - name: 'CM build examples'
+        run: ~/cmake/bin/cmake --build bld-oldie --target curl-examples-build
+
+      - name: 'AM autoreconf'
+        run: autoreconf -fi
+
+      - name: 'AM configure (out-of-tree, zstd, gssapi)'
+        run: |
+          mkdir bld-am
+          cd bld-am
+          ../configure --prefix="$PWD"/../curl-install-am --enable-unity --enable-warnings --enable-werror --disable-shared \
+            --disable-dependency-tracking --enable-option-checking=fatal \
+            --without-ssl --disable-ares --without-libssh2 --with-zstd --with-gssapi
+
+      - name: 'AM configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld-am/config.log 2>/dev/null || true
+
+      - name: 'AM curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld-am/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld-am/lib/curl_config.h | sort || true
+
+      - name: 'AM build'
+        run: make -C bld-am
+
+      - name: 'AM curl -V'
+        run: bld-am/src/curl --disable --version
+
+      - name: 'AM install'
+        run: make -C bld-am install
+
+      - name: 'AM build tests'
+        run: make -C bld-am/tests all

third-party/curl/.github/workflows/linux32.yml

@@ -1,93 +0,0 @@
-# Copyright (C) Dan Fandrich
-#
-# SPDX-License-Identifier: curl
-
-name: Linux 32-bit
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-
-jobs:
-  linux-i686:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-22.04'
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: Linux i686
-          install_packages: gcc-11-i686-linux-gnu libssl-dev:i386 zlib1g-dev:i386 libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386
-          configure: --enable-debug --enable-websockets --with-openssl --host=i686-linux-gnu CC=i686-linux-gnu-gcc-11 PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CPPFLAGS=-I/usr/include/i386-linux-gnu LDFLAGS=-L/usr/lib/i386-linux-gnu
-
-    steps:
-    - run: |
-        sudo dpkg --add-architecture i386
-        sudo apt-get update -y
-        sudo apt-get install -y --no-install-suggests --no-install-recommends libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install_packages }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs'
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: ./src/curl -V
-      name: 'check curl -V output'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"

third-party/curl/.github/workflows/macos.yml

@@ -2,36 +2,28 @@
 #
 # SPDX-License-Identifier: curl
 
-name: macOS
+name: 'macOS'
 
-on:
+'on':
   push:
     branches:
-    - master
-    - '*/ci'
+      - master
+      - '*/ci'
     paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
   pull_request:
     branches:
-    - master
+      - master
     paths-ignore:
-    - '**/*.md'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -39,201 +31,753 @@ concurrency:
 
 permissions: {}
 
+# Apple APIs and the macos-version-min value required to avoid deprecation
+# warnings with llvm/clang, and/or the feature getting enabled at build-time
+# or runtime:
+#
+# - 10.7   Lion (2011)          - GSS (build-time, deprecated MIT Kerberos shim)
+# - 10.9   Mavericks (2013)     - LDAP (build-time, deprecated), memset_s(), OCSP (runtime)
+# - 10.11  El Capitan (2015)    - connectx() (runtime)
+# - 10.12  Sierra (2016)        - clock_gettime() (build-time, runtime)
+# - 10.14  Mojave (2018)        - SecTrustEvaluateWithError() (runtime)
+
 env:
-  DEVELOPER_DIR: /Applications/Xcode_14.0.1.app/Contents/Developer
-  MAKEFLAGS: -j 5
+  CURL_CI: github
+  CURL_TEST_MIN: 1750
+  DO_NOT_TRACK: '1'
+  MAKEFLAGS: -j 4
+  LDFLAGS: -w  # suppress 'object file was built for newer macOS version than being linked' warnings
 
 jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'macos-latest'
-    timeout-minutes: 90
+  ios:
+    name: "iOS, ${{ (matrix.build.generator && format('CM-{0}', matrix.build.generator)) || (matrix.build.generate && 'CM' || 'AM' )}} ${{ matrix.build.name }} arm64"
+    runs-on: macos-latest
+    timeout-minutes: 10
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
+      CC: 'clang'
+      LDFLAGS: ''
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_OPTIONS: ${{ matrix.build.options }}
+      # renovate: datasource=github-tags depName=libressl/portable versioning=semver registryUrl=https://github.com
+      LIBRESSL_VERSION: 4.3.1
     strategy:
       fail-fast: false
       matrix:
         build:
-        - name: normal
-          install: nghttp2
-          configure: --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: debug
-          install: nghttp2
-          configure: --enable-debug --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: libssh2
-          install: nghttp2 libssh2
-          configure: --enable-debug --with-libssh2 --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: libssh-c-ares
-          install: openssl nghttp2 libssh
-          configure: --enable-debug --with-libssh --with-openssl=/usr/local/opt/openssl --enable-ares --enable-websockets
-          macosx-version-min: 10.9
-        - name: libssh
-          install: openssl nghttp2 libssh
-          configure: --enable-debug --with-libssh --with-openssl=/usr/local/opt/openssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: c-ares
-          install: nghttp2
-          configure: --enable-debug --enable-ares --without-ssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: HTTP only
-          install: nghttp2
-          configure: |
-            --enable-debug \
-            --enable-maintainer-mode \
-            --disable-alt-svc \
-            --disable-dict \
-            --disable-file \
-            --disable-ftp \
-            --disable-gopher \
-            --disable-imap \
-            --disable-ldap \
-            --disable-pop3 \
-            --disable-rtmp \
-            --disable-rtsp \
-            --disable-scp \
-            --disable-sftp \
-            --disable-shared \
-            --disable-smb \
-            --disable-smtp \
-            --disable-telnet \
-            --disable-tftp \
-            --disable-unix-sockets \
-            --without-brotli \
-            --without-gssapi \
-            --without-libidn2 \
-            --without-libpsl \
-            --without-librtmp \
-            --without-libssh2 \
-            --without-nghttp2 \
-            --without-ntlm-auth \
-            --without-ssl \
-            --without-zlib \
-            --without-zstd
-          macosx-version-min: 10.15
-        - name: SecureTransport http2
-          install: nghttp2
-          configure: --enable-debug --with-secure-transport --enable-websockets
-          macosx-version-min: 10.8
-        - name: gcc SecureTransport
-          configure: CC=gcc-12 --enable-debug --with-secure-transport --enable-websockets
-          macosx-version-min: 10.8
-        - name: OpenSSL http2
-          install: nghttp2 openssl
-          configure: --enable-debug --with-openssl=/usr/local/opt/openssl --enable-websockets
-          macosx-version-min: 10.9
-        - name: LibreSSL http2
-          install: nghttp2 libressl
-          configure: --enable-debug --with-openssl=/usr/local/opt/libressl --enable-websockets
-          macosx-version-min: 10.9
-        - name: torture
-          install: nghttp2 openssl
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/usr/local/opt/openssl --enable-websockets
-          tflags: -n -t --shallow=25 !FTP
-          macosx-version-min: 10.9
-        - name: torture-ftp
-          install: nghttp2 openssl
-          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/usr/local/opt/openssl --enable-websockets
-          tflags: -n -t --shallow=20 FTP
-          macosx-version-min: 10.9
-        - name: macOS 10.15
-          install: nghttp2 libssh2 openssl
-          configure: --enable-debug --disable-ldap --with-openssl=/usr/local/opt/openssl --enable-websockets
-          macosx-version-min: 10.15
+          - name: 'libressl'
+            install_steps: libressl
+            configure: --with-openssl=/Users/runner/libressl --without-libpsl
+
+          - name: 'libressl'
+            install_steps: libressl
+            # FIXME: Could not make OPENSSL_ROOT_DIR work. CMake seems to prepend sysroot to it.
+            generator: Xcode
+            xcode: ''  # default Xcode. Set it once to silence actionlint.
+            options: --config Debug
+            generate: >-
+              -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED=OFF
+              -DMACOSX_BUNDLE_GUI_IDENTIFIER=se.curl
+              -DOPENSSL_INCLUDE_DIR=/Users/runner/libressl/include
+              -DOPENSSL_SSL_LIBRARY=/Users/runner/libressl/lib/libssl.a
+              -DOPENSSL_CRYPTO_LIBRARY=/Users/runner/libressl/lib/libcrypto.a
+              -DCURL_USE_LIBPSL=OFF -DCURL_ENABLE_NTLM=ON
+
     steps:
-    - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-      name: 'brew bundle'
+      - name: 'brew install'
+        if: ${{ matrix.build.configure }}
+        timeout-minutes: 5
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install automake libtool; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
 
-    # Run this command with retries because of spurious failures seen
-    # while running the tests, for example
-    # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
-    - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
-      name: 'brew install'
+      - name: 'toolchain versions'
+        run: |
+          command -v "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcodebuild -sdk -version | grep '^Path:' || true
+          xcrun --sdk iphoneos --show-sdk-path 2>/dev/null || true
+          xcrun --sdk iphoneos --show-sdk-version || true
+          echo '::group::compiler defaults'; echo 'int main(void) {}' | "${CC}" -v -x c -; echo '::endgroup::'
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages installed'; ls -l "$(brew --prefix)"/opt; echo '::endgroup::'
 
-    - run: |
-        case "${{ matrix.build.install }}" in
-          *openssl*)
-            ;;
-          *)
-            if test -d /usr/local/include/openssl; then
-              brew unlink openssl
-            fi;;
-        esac
-      name: 'brew unlink openssl'
+      - name: 'cache libressl'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-libressl
+        env:
+          cache-name: cache-libressl
+        with:
+          path: ~/libressl
+          key: iOS-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
 
-    - run: python3 -m pip install impacket
-      name: 'pip3 install'
+      - name: 'build libressl'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') && !steps.cache-libressl.outputs.cache-hit }}
+        run: |
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" --output pkg.bin
+          sha256sum pkg.bin && tar -xzf pkg.bin && rm -f pkg.bin
+          cd "libressl-${LIBRESSL_VERSION}"
+          cmake -B . -G Ninja \
+            -DCMAKE_INSTALL_PREFIX=/Users/runner/libressl \
+            -DCMAKE_SYSTEM_NAME=iOS \
+            -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
+            -DBUILD_SHARED_LIBS=OFF \
+            -DLIBRESSL_APPS=OFF \
+            -DLIBRESSL_TESTS=OFF
+          cmake --build .
+          cmake --install . --verbose
 
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-    - run: autoreconf -fi
-      name: 'autoreconf'
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
 
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-      env:
-        CFLAGS: "-mmacosx-version-min=${{ matrix.build.macosx-version-min }}"
+      - name: 'configure'
+        env:
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+          MATRIX_GENERATOR: '${{ matrix.build.generator }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            # https://cmake.org/cmake/help/latest/manual/cmake-toolchains.7.html#cross-compiling-for-ios-tvos-visionos-or-watchos
+            [ -n "${MATRIX_GENERATOR}" ] && options="-G ${MATRIX_GENERATOR}"
+            cmake -B bld -G Ninja -D_CURL_PREFILL=ON \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+              -DCMAKE_SYSTEM_NAME=iOS \
+              -DUSE_APPLE_IDN=ON \
+              ${MATRIX_GENERATE} ${options}
+          else
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CFLAGS="-isysroot $(xcrun --sdk iphoneos --show-sdk-path 2>/dev/null)" \
+              --host=aarch64-apple-darwin \
+              --with-apple-idn \
+              ${MATRIX_CONFIGURE}
+          fi
 
-    - run: make V=1
-      name: 'make'
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
 
-    - run: make V=1 examples
-      name: 'make examples'
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
 
-    - run: make V=1 -C tests
-      name: 'make tests'
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld ${MATRIX_OPTIONS} --parallel 4 --verbose
+          else
+            make -C bld V=1
+          fi
 
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }} ~1452"
+      - name: 'curl info'
+        run: |
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 stat -f '%10z bytes: %N' --
 
-  cmake:
-    name: cmake ${{ matrix.compiler.CC }} ${{ matrix.build.name }}
-    runs-on: 'macos-latest'
-    env: ${{ matrix.compiler }}
+      - name: 'build tests'
+        if: ${{ matrix.build.generate }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld ${MATRIX_OPTIONS} --parallel 4 --target testdeps --verbose
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build.generate }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld ${MATRIX_OPTIONS} --parallel 4 --target curl-examples-build --verbose
+          else
+            make -C bld examples V=1
+          fi
+
+  macos:
+    name: "${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.compiler }} ${{ matrix.build.name }}"
+    runs-on: ${{ matrix.build.image || 'macos-15' }}
+    timeout-minutes: 15
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
+      CC: '${{ matrix.build.compiler }}'
+      MATRIX_BUILD: ${{ matrix.build.generate && 'cmake' || 'autotools' }}
+      MATRIX_COMPILER: '${{ matrix.build.compiler }}'
+      MATRIX_INSTALL: '${{ matrix.build.install }}'
+      MATRIX_INSTALL_STEPS: '${{ matrix.build.install_steps }}'
+      MATRIX_MACOS_VERSION_MIN: '${{ matrix.build.macos-version-min }}'
     strategy:
       fail-fast: false
       matrix:
-        compiler:
-        - CC: clang
-          CXX: clang++
-          CFLAGS: "-mmacosx-version-min=10.15 -Wno-deprecated-declarations"
-        - CC: gcc-12
-          CXX: g++-12
-          CFLAGS: "-mmacosx-version-min=10.15 -Wno-error=undef -Wno-error=conversion"
         build:
-        - name: OpenSSL
-          install: nghttp2 openssl
-          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON
-        - name: LibreSSL
-          install: nghttp2 libressl
-          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/libressl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DCMAKE_UNITY_BUILD=ON
-        - name: libssh2
-          install: nghttp2 openssl libssh2
-          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl -DCURL_USE_LIBSSH2=ON -DBUILD_SHARED_LIBS=ON -DBUILD_STATIC_LIBS=ON
+          - name: '!ssl !debug brotli zstd'
+            compiler: gcc-13
+            configure: --without-ssl --with-brotli --with-zstd --with-apple-idn
+            tflags: '--min=1520'
+            xcode: ''  # default Xcode. Set it once to silence actionlint.
+
+          - name: '!ssl libssh2 AppleIDN'
+            compiler: clang
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH2=ON -DUSE_APPLE_IDN=ON -DCURL_ENABLE_SSL=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+            tflags: '--min=1630'
+
+          - name: 'OpenSSL libssh c-ares'
+            compiler: clang
+            install: openssl@4 libssh
+            configure: --enable-debug --with-libssh --with-openssl=/opt/homebrew/opt/openssl@4 --enable-ech --enable-ares --with-fish-functions-dir --with-zsh-functions-dir
+
+          - name: 'OpenSSL libssh'
+            compiler: llvm@18
+            install: libssh
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+
+          - name: '!ssl HTTP-only c-ares'
+            macos-version-min: '10.15'  # Catalina (2019)
+            compiler: clang
+            tflags: '--min=960'
+            generate: >-
+              -DENABLE_DEBUG=ON -DENABLE_ARES=ON
+              -DCURL_ENABLE_SSL=OFF -DHTTP_ONLY=ON
+              -DCURL_DISABLE_ALTSVC=ON -DENABLE_UNIX_SOCKETS=OFF
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_NGHTTP2=OFF
+              -DCURL_USE_GSSAPI=OFF -DUSE_LIBIDN2=OFF -DCURL_USE_LIBPSL=OFF
+              -DCURL_BROTLI=OFF -DCURL_ZLIB=OFF -DCURL_ZSTD=OFF
+              -DBUILD_STATIC_LIBS=ON -DBUILD_SHARED_LIBS=OFF
+
+          - name: 'LibreSSL !ldap +examples'
+            compiler: clang
+            install: libressl
+            install_steps: pytest
+            generate: >-
+              -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DCURL_DISABLE_LDAP=ON -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF
+              -DCURL_USE_LIBSSH2=OFF -DCURL_ENABLE_NTLM=ON
+
+          - name: 'OpenSSL 10.15 C89'
+            macos-version-min: '10.15'
+            compiler: clang
+            install: libnghttp3 libngtcp2
+            install_steps: pytest
+            generate: >-
+              -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DUSE_NGTCP2=ON -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF -DCURL_USE_LIBSSH2=OFF
+              -DCMAKE_C_STANDARD=90 -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'OpenSSL SecTrust krb5'
+            compiler: clang
+            install: libnghttp3 libngtcp2
+            install_steps: pytest
+            configure: --enable-debug --with-openssl=/opt/homebrew/opt/openssl --with-ngtcp2 --with-apple-sectrust --enable-ntlm --enable-proxy-http3 --with-gssapi
+
+          - name: 'OpenSSL event-based'
+            compiler: clang
+            generate: -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF -DCURL_USE_LIBSSH2=OFF -DCURL_ENABLE_NTLM=ON
+            tflags: '--test-event --min=1400'
+
+          - name: 'OpenSSL gsasl AppleIDN SecTrust +examples'
+            compiler: clang
+            install: openssl@4 libnghttp3 libngtcp2 gsasl
+            generate: >-
+              -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DUSE_NGTCP2=ON -DCURL_DISABLE_VERBOSE_STRINGS=ON
+              -DUSE_APPLE_SECTRUST=ON -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'MultiSSL AppleIDN clang-tidy +examples'
+            image: macos-26
+            compiler: clang
+            install: llvm gnutls nettle libressl krb5 mbedtls gsasl rustls-ffi libssh fish
+            install_steps: skiprun
+            CFLAGS: -Wunused-macros
+            chkprefill: _chkprefill
+            generate: >-
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DCURL_DEFAULT_SSL_BACKEND=openssl
+              -DCURL_USE_GNUTLS=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_RUSTLS=ON -DENABLE_ARES=ON -DCURL_USE_GSASL=ON
+              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DUSE_APPLE_IDN=ON -DUSE_SSLS_EXPORT=ON
+              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DCURL_BROTLI=ON -DCURL_ZSTD=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/opt/homebrew/opt/llvm/bin/clang-tidy
+              -DCURL_COMPLETION_FISH=ON -DCURL_COMPLETION_ZSH=ON
+              -DCURL_ENABLE_NTLM=ON
+
+          - name: 'HTTP/3 clang-tidy'
+            image: macos-26
+            compiler: clang
+            install: llvm libnghttp3 libngtcp2 openldap krb5
+            install_steps: skipall
+            CFLAGS: -Wunused-macros
+            generate: >-
+              -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl -DUSE_NGTCP2=ON
+              -DLDAP_INCLUDE_DIR=/opt/homebrew/opt/openldap/include
+              -DLDAP_LIBRARY=/opt/homebrew/opt/openldap/lib/libldap.dylib
+              -DLDAP_LBER_LIBRARY=/opt/homebrew/opt/openldap/lib/liblber.dylib
+              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DCURL_BROTLI=ON -DCURL_ZSTD=ON
+              -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=/opt/homebrew/opt/llvm/bin/clang-tidy
+              -DCURL_ENABLE_NTLM=ON -DUSE_PROXY_HTTP3=ON
+
+          - name: 'LibreSSL openldap krb5 c-ares +examples'
+            compiler: clang
+            install: libressl krb5 openldap
+            generate: >-
+              -DENABLE_DEBUG=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/libressl -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON
+              -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DLDAP_INCLUDE_DIR=/opt/homebrew/opt/openldap/include
+              -DLDAP_LIBRARY=/opt/homebrew/opt/openldap/lib/libldap.dylib
+              -DLDAP_LBER_LIBRARY=/opt/homebrew/opt/openldap/lib/liblber.dylib
+
+          - name: 'wolfSSL !ldap brotli zstd'
+            compiler: clang
+            install: brotli wolfssl zstd
+            install_steps: pytest
+            generate: -DCURL_USE_WOLFSSL=ON -DCURL_DISABLE_LDAP=ON -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'mbedTLS !ldap brotli zstd MultiSSL AppleIDN'
+            compiler: llvm@18
+            install: brotli mbedtls zstd
+            install_steps: codeset-test1
+            generate: -DCURL_USE_MBEDTLS=ON -DCURL_DISABLE_LDAP=ON -DCURL_DEFAULT_SSL_BACKEND=mbedtls -DCURL_USE_OPENSSL=ON -DUSE_APPLE_IDN=ON -DCURL_ENABLE_NTLM=ON
+
+          - name: 'GnuTLS !ldap krb5 +examples'
+            compiler: clang
+            install: gnutls nettle krb5
+            install_steps: codeset-test2
+            generate: >-
+              -DENABLE_DEBUG=ON -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF
+              -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=/opt/homebrew/opt/krb5
+              -DCURL_DISABLE_LDAP=ON -DUSE_SSLS_EXPORT=ON
+
+          - name: 'aws-lc +analyzer'
+            compiler: gcc-15
+            install: aws-lc
+            generate: >-
+              -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/aws-lc -DUSE_ECH=ON
+              -DCURL_DISABLE_LDAP=ON -DUSE_SSLS_EXPORT=ON -DCURL_GCC_ANALYZER=ON
+
+          - name: 'Rustls'
+            compiler: clang
+            install: rustls-ffi
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_RUSTLS=ON -DUSE_ECH=ON -DCURL_DISABLE_LDAP=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '--min=1730'
+
+          - name: 'OpenSSL torture 1'
+            compiler: clang
+            install: openssl@4
+            install_steps: torture
+            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '-t --shallow=25 --min=480 1 to 500'
+
+          - name: 'OpenSSL torture 2'
+            compiler: clang
+            install: openssl@4
+            install_steps: torture
+            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '-t --shallow=25 --min=730 501 to 1250'
+
+          - name: 'OpenSSL torture 3'
+            compiler: clang
+            install: openssl@4
+            install_steps: torture
+            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@4 -DUSE_ECH=ON -DCURL_ENABLE_NTLM=ON
+            tflags: '-t --shallow=25 --min=628 1251 to 9999'
+
     steps:
-    - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-      name: 'brew bundle'
+      - name: 'brew unlink openssl'
+        if: ${{ contains(matrix.build.install, 'aws-lc') || contains(matrix.build.install, 'libressl') || contains(matrix.build.install, 'openssl@4') }}
+        run: |
+          if [ -d "$(brew --prefix)"/include/openssl ]; then
+            brew unlink openssl
+          fi
 
-    - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
-      name: 'brew install'
+      - name: 'brew install'
+        timeout-minutes: 5
+        # Run this command with retries because of spurious failures seen
+        # while running the tests, for example
+        # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
+        env:
+          INSTALL_PACKAGES: >-
+            ${{ matrix.build.generate && 'ninja' || 'automake libtool' }}
+            ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'nghttp2 stunnel' || '' }}
+            ${{ contains(matrix.build.install_steps, 'pytest') && 'caddy httpd vsftpd' || '' }}
 
-    - run: |
-        case "${{ matrix.build.install }}" in
-          *openssl*)
-            ;;
-          *)
-            if test -d /usr/local/include/openssl; then
-              brew unlink openssl
-            fi;;
-        esac
-      name: 'brew unlink openssl'
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install pkgconf libpsl libssh2 ${INSTALL_PACKAGES} ${MATRIX_INSTALL}; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
 
-    - uses: actions/checkout@v3
+      - name: 'toolchain versions'
+        run: |
+          [[ "${MATRIX_COMPILER}" = 'llvm'* ]] && CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+          [[ "${MATRIX_COMPILER}" = 'gcc'* ]] && "${CC}" --print-sysroot
+          command -v "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
+          xcrun --sdk macosx --show-sdk-version || true
+          ls -l /Library/Developer/CommandLineTools/SDKs || true
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages installed'; ls -l "$(brew --prefix)"/opt; echo '::endgroup::'
 
-    - run: cmake -S. -Bbuild -DCURL_WERROR=ON -DPICKY_COMPILER=ON ${{ matrix.build.generate }}
-      name: 'cmake generate'
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-    - run: cmake --build build
-      name: 'cmake build'
+      - name: 'autoreconf'
+        if: ${{ matrix.build.configure }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          CFLAGS: '${{ matrix.build.CFLAGS }}'
+          MATRIX_CHKPREFILL: '${{ matrix.build.chkprefill }}'
+          MATRIX_CONFIGURE: '${{ matrix.build.configure }}'
+          MATRIX_GENERATE: '${{ matrix.build.generate }}'
+        run: |
+          if [[ "${MATRIX_COMPILER}" = 'gcc'* ]]; then
+            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
+          else
+            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
+          fi
+
+          if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+            CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+            CC+=" --sysroot=${sysroot}"
+            CC+=" --target=$(uname -m)-apple-darwin"
+          fi
+
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            for _chkprefill in '' ${MATRIX_CHKPREFILL}; do
+              options=''
+              [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && options+=" -DCMAKE_OSX_DEPLOYMENT_TARGET=${MATRIX_MACOS_VERSION_MIN}"
+              [[ "${MATRIX_INSTALL_STEPS}" = *'pytest'* ]] && options+=' -DVSFTPD=NO'  # Skip ~20 tests that stretch run time by 7x on macOS
+              [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
+              cmake -B "bld${_chkprefill}" -G Ninja -D_CURL_PREFILL=ON \
+                -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
+                -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+                -DCMAKE_OSX_SYSROOT="${sysroot}" \
+                -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64e/')-apple-darwin$(uname -r)" \
+                ${MATRIX_GENERATE} ${options}
+            done
+            if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
+              echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
+              false
+            fi
+          else
+            if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+              options+=" --target=$(uname -m)-apple-darwin"
+            fi
+            if [ "${MATRIX_COMPILER}" != 'clang' ]; then
+              options+=" --with-sysroot=${sysroot}"
+              CFLAGS+=" --sysroot=${sysroot}"
+            fi
+            [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && CFLAGS+=" -mmacosx-version-min=${MATRIX_MACOS_VERSION_MIN}"
+            [[ "${MATRIX_INSTALL_STEPS}" = *'pytest'* ]] && options+=' --with-test-vsftpd=no'  # Skip ~20 tests that stretch run time by 7x on macOS
+            mkdir bld && cd bld && ../configure --prefix="$PWD"/curl-install --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-libpsl="$(brew --prefix libpsl)" \
+              ${MATRIX_CONFIGURE} ${options}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'test configs'
+        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 stat -f '%10z bytes: %N' --
+          bld/src/curl --disable --version
+
+      - name: 'curl install'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --install bld --strip
+          else
+            make -C bld V=1 install
+          fi
+
+      - name: 'build tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target testdeps
+          else
+            make -C bld V=1 -C tests
+          fi
+
+      - name: 'install test prereqs'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        run: |
+          python3 -m venv ~/venv
+          if bld/src/curl --disable -V 2>/dev/null | grep smb; then
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
+          fi
+
+      - name: 'run tests'
+        if: ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') }}
+        timeout-minutes: ${{ contains(matrix.build.install_steps, 'torture') && 20 || 10 }}
+        env:
+          TEST_TARGET: ${{ contains(matrix.build.install_steps, 'torture') && 'test-torture' || 'test-ci' }}
+          TFLAGS: '${{ matrix.build.tflags }}'
+        run: |
+          TFLAGS="-j20 ${TFLAGS}"
+          if [ "${TEST_TARGET}" != 'test-ci' ]; then
+            TFLAGS+=' --buildinfo'  # only test-ci sets this by default, set it manually for test-torture
+          fi
+          source ~/venv/bin/activate
+          if [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test1'* ]]; then
+            locale || true
+            unset LANG
+            unset LC_ALL
+            unset LC_COLLATE
+            unset LC_MESSAGES
+            unset LC_MONETARY
+            unset LC_TIME
+            export LC_CTYPE=C
+            export LC_NUMERIC=fr_FR.UTF-8
+          elif [[ "${MATRIX_INSTALL_STEPS}" = *'codeset-test2'* ]]; then
+            locale || true
+            unset LC_ALL
+            export LC_TIME=fr_FR
+          fi
+          rm -f ~/.curlrc
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target "${TEST_TARGET}"
+          else
+            make -C bld V=1 "${TEST_TARGET}"
+          fi
+
+      - name: 'install pytest prereqs'
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+        run: |
+          [ -d ~/venv ] || python3 -m venv ~/venv
+          ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/http/requirements.txt
+
+      - name: 'run pytest'
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+        env:
+          PYTEST_ADDOPTS: '--color=yes'
+          PYTEST_XDIST_AUTO_NUM_WORKERS: 4
+        run: |
+          source ~/venv/bin/activate
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-pytest-ci
+          else
+            make -C bld V=1 pytest-ci
+          fi
+
+      - name: 'build examples'
+        if: ${{ contains(matrix.build.name, '+examples') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target curl-examples-build
+          else
+            make -C bld examples V=1
+          fi
+
+  combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, built tool, combinations
+    name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }}"
+    runs-on: ${{ matrix.image }}
+    timeout-minutes: 10
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
+      CC: '${{ matrix.compiler }}'
+      MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_COMPILER: '${{ matrix.compiler }}'
+      MATRIX_IMAGE: '${{ matrix.image }}'
+      MATRIX_MACOS_VERSION_MIN: '${{ matrix.macos-version-min }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        # Sources:
+        # https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
+        # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md
+        # https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
+        compiler: [gcc-13, gcc-14, gcc-15, llvm@15, llvm@18, llvm@20, clang]
+        # Xcode support matrix as of 2025-10, with default macOS SDK versions and OS names, years:
+        # * = default Xcode on the runner.
+        # macos-14: 15.0.1, 15.1, 15.2, 15.3,*15.4
+        # macos-15:                                 16.0, 16.1, 16.2, 16.3,*16.4, 26.0
+        # macos-26:                                                         16.4 *26.0
+        # macOSSDK: 14.0,   14.2, 14.2, 14.4, 14.5, 15.0, 15.1, 15.2, 15.4, 15.5, 26.0
+        #           Sonoma (2023)                   Sequoia (2024)                Tahoe (2025)
+        # https://github.com/actions/runner-images/tree/main/images/macos
+        # https://en.wikipedia.org/wiki/MacOS_version_history
+        image: [macos-14, macos-15, macos-26]
+        xcode: ['']  # default Xcodes
+        macos-version-min: ['']
+        build: [autotools, cmake]
+        exclude:
+          # Combinations not covered by runner images:
+          - { image: macos-14, compiler: 'llvm@18' }
+          - { image: macos-14, compiler: 'llvm@20' }
+          - { image: macos-15, compiler: 'llvm@15' }
+          - { image: macos-15, compiler: 'llvm@20' }
+          - { image: macos-26, compiler: 'llvm@15' }
+          - { image: macos-26, compiler: 'llvm@18' }
+          # Covered by the main workflow
+          - { image: macos-15, compiler: 'gcc-13' }
+          - { image: macos-15, compiler: 'llvm@18' }
+          - { image: macos-15, compiler: 'clang' }
+          # Reduce build combinations, by dropping less interesting ones
+          - { image: macos-26, compiler: 'gcc-13' }
+          - { compiler: 'gcc-14' , build: cmake }
+          # Reduce autotools to only one job that is also build with cmake
+          - { compiler: 'gcc-13' , build: autotools }
+          - { compiler: 'gcc-14' , build: autotools }
+          - { compiler: 'gcc-15' , build: autotools }
+          - { compiler: 'llvm@15', build: autotools }
+          - { compiler: 'llvm@18', build: autotools }
+          - { compiler: 'llvm@20', build: autotools }
+          - { image: macos-14,     build: autotools }
+          - { image: macos-15,     build: autotools }
+    steps:
+      - name: 'install autotools'
+        if: ${{ matrix.build == 'autotools' }}
+        run: |
+          # shellcheck disable=SC2181
+          while [[ $? == 0 ]]; do
+            for i in 1 2 3; do
+              if brew install automake libtool; then
+                break 2
+              else
+                echo "Error: wait to try again: $i"
+                sleep 10
+              fi
+            done
+            false Too many retries
+          done
+
+      - name: 'toolchain versions'
+        run: |
+          [[ "${MATRIX_COMPILER}" = 'llvm'* ]] && CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+          [[ "${MATRIX_COMPILER}" = 'gcc'* ]] && "${CC}" --print-sysroot
+          command -v "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
+          xcrun --sdk macosx --show-sdk-version || true
+          ls -l /Library/Developer/CommandLineTools/SDKs || true
+          echo '::group::compiler defaults'; echo 'int main(void) {}' | "${CC}" -v -x c -; echo '::endgroup::'
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)"/opt; echo '::endgroup::'
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: autoreconf -fi
+
+      - name: 'configure / ${{ matrix.build }}'
+        run: |
+          if [ "${MATRIX_COMPILER}" = 'gcc-13' ] && [ "${MATRIX_IMAGE}" = 'macos-15' ]; then
+            # Ref: https://github.com/Homebrew/homebrew-core/issues/194778#issuecomment-2793243409
+            "$(brew --prefix gcc@13)"/libexec/gcc/aarch64-apple-darwin24/13/install-tools/mkheaders
+          fi
+
+          if [[ "${MATRIX_COMPILER}" = 'gcc'* ]]; then
+            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
+          else
+            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
+          fi
+
+          if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+            CC="$(brew --prefix "${MATRIX_COMPILER}")/bin/clang"
+            CC+=" --sysroot=${sysroot}"
+            CC+=" --target=$(uname -m)-apple-darwin"
+          fi
+
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && options+=" -DCMAKE_OSX_DEPLOYMENT_TARGET=${MATRIX_MACOS_VERSION_MIN}"
+            # would pick up nghttp2, libidn2, and libssh2
+            cmake -B bld -G Ninja -D_CURL_PREFILL=ON \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_DROP_UNUSED=ON -DCURL_WERROR=ON \
+              -DCMAKE_OSX_SYSROOT="${sysroot}" \
+              -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64e/')-apple-darwin$(uname -r)" \
+              -DCMAKE_IGNORE_PREFIX_PATH="$(brew --prefix)" \
+              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF \
+              -DCURL_USE_OPENSSL=ON \
+              -DUSE_NGHTTP2=OFF -DUSE_LIBIDN2=OFF \
+              -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF \
+              -DUSE_APPLE_IDN=ON -DUSE_APPLE_SECTRUST=ON \
+              ${options}
+          else
+            export CFLAGS
+            if [[ "${MATRIX_COMPILER}" = 'llvm'* ]]; then
+              options+=" --target=$(uname -m)-apple-darwin"
+            fi
+            if [ "${MATRIX_COMPILER}" != 'clang' ]; then
+              options+=" --with-sysroot=${sysroot}"
+              CFLAGS+=" --sysroot=${sysroot}"
+            fi
+            [ -n "${MATRIX_MACOS_VERSION_MIN}" ] && CFLAGS+=" -mmacosx-version-min=${MATRIX_MACOS_VERSION_MIN}"
+            # would pick up nghttp2, libidn2, but libssh2 is disabled by default
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --disable-docs --disable-manual \
+              --with-openssl="$(brew --prefix openssl)" \
+              --without-nghttp2 --without-libidn2 \
+              --without-libpsl \
+              --with-apple-idn --with-apple-sectrust \
+              ${options}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build / ${{ matrix.build }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: |
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -print0 | xargs -0 stat -f '%10z bytes: %N' --
+          bld/src/curl --disable --version

third-party/curl/.github/workflows/ngtcp2-linux.yml

@@ -1,279 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: ngtcp2-linux
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: ngtcp2-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-  quictls-version: 3.0.10+quic
-  gnutls-version: 3.8.0
-  wolfssl-version: master
-  nghttp3-version: v0.15.0
-  ngtcp2-version: v0.19.1
-  nghttp2-version: v1.56.0
-  mod_h2-version: v2.0.21
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: quictls
-          configure: >-
-            PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib"
-            --with-ngtcp2=$HOME/nghttpx --enable-warnings --enable-werror --enable-debug
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-            --with-openssl=$HOME/nghttpx
-        - name: gnutls
-          configure: >-
-            PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib"
-            --with-ngtcp2=$HOME/nghttpx --enable-warnings --enable-werror --enable-debug
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-            --with-gnutls=$HOME/nghttpx
-        - name: wolfssl
-          configure: >-
-            PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib"
-            --with-ngtcp2=$HOME/nghttpx --enable-warnings --enable-werror --enable-debug
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-            --with-wolfssl=$HOME/nghttpx
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 \
-          libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev \
-          nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin \
-          libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools \
-          texinfo texlive texlive-extra-utils autopoint libev-dev \
-          apache2 apache2-dev libnghttp2-dev
-      name: 'install prereqs and impacket, pytest, crypto, apache2'
-
-    - name: cache quictls
-      uses: actions/cache@v3
-      id: cache-quictls
-      env:
-        cache-name: cache-quictls
-      with:
-        path: /home/runner/quictls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.quictls-version }}
-
-    - if: steps.cache-quictls.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }} https://github.com/quictls/openssl quictls
-        cd quictls
-        ./config --prefix=$HOME/nghttpx --libdir=$HOME/nghttpx/lib
-        make
-      name: 'build quictls'
-
-    - run: |
-        cd $HOME/quictls
-        make -j1 install_sw
-      name: 'install quictls'
-
-
-    - name: cache gnutls
-      uses: actions/cache@v3
-      id: cache-gnutls
-      env:
-        cache-name: cache-gnutls
-      with:
-        path: /home/runner/gnutls
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.gnutls-version }}
-
-    - if: steps.cache-gnutls.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b ${{ env.gnutls-version }} https://github.com/gnutls/gnutls.git
-        cd gnutls
-        ./bootstrap
-        ./configure  --prefix=$HOME/nghttpx \
-          PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/nghttpx/lib -L$HOME/nghttpx/lib" \
-          --with-included-libtasn1 --with-included-unistring \
-          --disable-guile --disable-doc --disable-tests --disable-tools
-        make
-      name: 'build gnutls'
-
-    - run: |
-        cd $HOME/gnutls
-        make install
-      name: 'install gnutls'
-
-
-    - name: cache wolfssl
-      uses: actions/cache@v3
-      id: cache-wolfssl
-      env:
-        cache-name: cache-wolfssl
-      with:
-        path: /home/runner/wolfssl
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
-
-    - if: steps.cache-wolfssl.outputs.cache-hit != 'true' || ${{ env.wolfssl-version }} == 'master'
-      run: |
-        cd $HOME
-        rm -rf wolfssl
-        git clone --quiet --depth=1 -b ${{ env.wolfssl-version }} https://github.com/wolfSSL/wolfssl.git
-        cd wolfssl
-        ./autogen.sh
-        ./configure --enable-all --enable-quic --prefix=$HOME/nghttpx
-        make
-      name: 'build wolfssl'
-
-    - run: |
-        cd $HOME/wolfssl
-        make install
-      name: 'install wolfssl'
-
-
-    - name: cache nghttp3
-      uses: actions/cache@v3
-      id: cache-nghttp3
-      env:
-        cache-name: cache-nghttp3
-      with:
-        path: /home/runner/nghttp3
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.nghttp3-version }}
-
-    - if: steps.cache-nghttp3.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b ${{ env.nghttp3-version }} https://github.com/ngtcp2/nghttp3
-        cd nghttp3
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only
-        make
-      name: 'build nghttp3'
-
-    - run: |
-        cd $HOME/nghttp3
-        make install
-      name: 'install nghttp3'
-
-    # depends on all other cached libs built so far
-    - run: |
-        git clone --quiet --depth=1 -b ${{ env.ngtcp2-version }} https://github.com/ngtcp2/ngtcp2
-        cd ngtcp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only --with-openssl --with-gnutls --with-wolfssl
-        make install
-      name: 'install ngtcp2'
-
-    # depends on all other cached libs built so far
-    - run: |
-        git clone --quiet --depth=1 -b ${{ env.nghttp2-version }} https://github.com/nghttp2/nghttp2
-        cd nghttp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-http3
-        make install
-      name: 'install nghttp2'
-
-    - name: cache mod_h2
-      uses: actions/cache@v3
-      id: cache-mod_h2
-      env:
-        cache-name: cache-mod_h2
-      with:
-        path: /home/runner/mod_h2
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mod_h2-version }}
-
-    - if: steps.cache-mod_h2.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b  ${{ env.mod_h2-version }} https://github.com/icing/mod_h2
-        cd mod_h2
-        autoreconf -fi
-        ./configure
-        make
-      name: 'build mod_h2'
-
-    - run: |
-        cd $HOME/mod_h2
-        sudo make install
-      name: 'install mod_h2'
-
-    - uses: actions/checkout@v3
-
-    - run: |
-        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
-      name: 'install python test prereqs'
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-
-    - run: pytest -v tests
-      name: 'run pytest'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-        CURL_CI: github
-
-    - run: pytest -v tests
-      name: 'run pytest with slowed network'
-      env:
-        # 33% of sends are EAGAINed
-        CURL_DBG_SOCK_WBLOCK: 33
-        # only 80% of data > 10 bytes is send
-        CURL_DBG_SOCK_WPARTIAL: 80
-        CURL_CI: github

third-party/curl/.github/workflows/non-native.yml

@@ -0,0 +1,565 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+name: 'non-native'
+
+'on':
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'Dockerfile'
+      - 'projects/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  CURL_CI: github
+  CURL_TEST_MIN: 1820
+  DO_NOT_TRACK: '1'
+
+jobs:
+  cross:
+    name: "${{ matrix.os }} ${{ matrix.version }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.cc }} ${{ matrix.desc }} ${{ matrix.arch }}"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: cpa.sh {0}  # zizmor: ignore[misfeature]
+    env:
+      CC: '${{ matrix.cc }}'
+      MAKEFLAGS: -j 3
+      MATRIX_ARCH: '${{ matrix.arch }}'
+      MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_INSTALL: '${{ matrix.install }}'
+      MATRIX_OPTIONS: '${{ matrix.options }}'
+      MATRIX_OS: '${{ matrix.os }}'
+      MATRIX_VERSION: '${{ matrix.version }}'
+    strategy:
+      matrix:
+        include:
+          # https://github.com/DragonFlyBSD/DPorts
+          # { os: 'dragonflybsd', version: '6.4.2', build: 'autotools', arch: 'x86_64', cc: 'gcc'  , desc: 'openssl skiprun',
+          #   install: 'autoconf automake libtool openldap26-client libidn2',
+          #   options: '--with-openssl --enable-ldap --enable-ldaps --with-libidn2' }
+
+          # { os: 'dragonflybsd', version: '6.4.2', build: 'cmake'    , arch: 'x86_64', cc: 'gcc'  , desc: 'openssl skipall',
+          #   install: 'cmake ninja' }
+
+          # https://ports.freebsd.org/
+          - { os: 'freebsd'     , version: '15.1',  build: 'autotools', arch: 'x86_64', cc: 'clang', desc: 'openssl',
+              install: 'autoconf automake libtool krb5-devel openldap26-client libidn2 stunnel',
+              options: '--with-openssl --with-gssapi --enable-ldap --enable-ldaps --with-libidn2' }
+
+          - { os: 'freebsd'     , version: '15.1',  build: 'cmake'    , arch: 'x86_64', cc: 'clang', desc: 'openssl !unity skiprun !examples',
+              install: 'cmake-core ninja perl5 krb5-devel openldap26-client libidn2',
+              options: '-DCURL_USE_GSSAPI=ON -DCMAKE_UNITY_BUILD=OFF' }
+
+          - { os: 'freebsd'     , version: '14.3',  build: 'autotools', arch: 'arm64' , cc: 'clang', desc: 'openssl !examples',
+              install: 'autoconf automake libtool krb5-devel openldap26-client libidn2 stunnel',
+              options: '--with-openssl --with-gssapi --enable-ldap --enable-ldaps --with-libidn2' }
+
+          - { os: 'freebsd'     , version: '14.3',  build: 'cmake'    , arch: 'arm64' , cc: 'clang', desc: 'openssl',
+              install: 'cmake-core ninja perl5 krb5-devel openldap26-client libidn2 stunnel',
+              options: '-DCURL_USE_GSSAPI=ON' }
+
+          # https://app.midnightbsd.org/
+          # https://man.midnightbsd.org/cgi-bin/man.cgi/mport
+          # { os: 'midnightbsd' , version: '4.0.4', build: 'autotools' , arch: 'x86_64', cc: 'clang', desc: 'gnutls skipall !examples',
+          #   install: 'autoconf autoconf-archive automake libtool gnutls',
+          #   options: '--with-gnutls' }
+
+          - { os: 'midnightbsd' , version: '4.0.4', build: 'cmake'    , arch: 'x86_64', cc: 'clang', desc: 'gnutls skiprun',
+              install: 'cmake-core ninja perl5 gnutls openldap26-client libidn2',
+              options: '-DCURL_USE_GNUTLS=ON' }
+
+          # https://pkgsrc.se/
+          - { os: 'netbsd'      , version: '10.1' , build: 'autotools', arch: 'x86_64', cc: 'gcc'  , desc: 'openssl skipall !examples',
+              install: 'autoconf automake libtool mit-krb5',
+              options: '--with-openssl --with-gssapi' }
+
+          - { os: 'netbsd'      , version: '10.1' , build: 'cmake'    , arch: 'x86_64', cc: 'gcc'  , desc: 'openssl',
+              install: 'cmake ninja-build mit-krb5 openldap-client libidn2',
+              options: '-DCURL_USE_GSSAPI=ON' }
+
+          # https://openbsd.app/
+          # https://www.openbsd.org/faq/faq15.html
+          # https://github.com/OpenMPT/openmpt/blob/master/.github/workflows/OpenBSD-Autotools.yml
+          - { os: 'openbsd'     , version: '7.9'  , build: 'autotools', arch: 'x86_64', cc: 'clang', desc: 'libressl skipall !examples',
+              install: 'autoconf-2.72p0 automake-1.18.1 libtool',  # NOTE: also sync these versions with the autoreconf step!
+              options: '--with-openssl' }
+
+          - { os: 'openbsd'     , version: '7.9'  , build: 'cmake'    , arch: 'x86_64', cc: 'clang', desc: 'libressl',
+              install: 'cmake ninja openldap-client-- libidn2' }
+
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'setup VM'
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
+        with:
+          environment_variables: 'CC CURL_CI CURL_TEST_MIN DO_NOT_TRACK MAKEFLAGS MATRIX_ARCH MATRIX_BUILD MATRIX_INSTALL MATRIX_OPTIONS MATRIX_OS MATRIX_VERSION'
+          operating_system: '${{ matrix.os }}'
+          version: '${{ matrix.version }}'
+          architecture: '${{ matrix.arch }}'
+
+      - name: 'install prereqs'
+        run: |
+          if [ "${MATRIX_OS}" = 'dragonflybsd' ]; then
+            sudo pkg install -y pkgconf brotli libnghttp2 ${MATRIX_INSTALL}
+          elif [ "${MATRIX_OS}" = 'freebsd' ]; then
+            sudo pkg install -y pkgconf brotli libnghttp2 ${MATRIX_INSTALL}
+          elif [ "${MATRIX_OS}" = 'midnightbsd' ]; then
+            if [ "${MATRIX_BUILD}" = 'autotools' ]; then
+              sudo mport index | grep -v -E 'Downloading.+%'
+              sudo mport upgrade | grep -v -E '(Downloading.+%|^/usr/local)'
+            fi
+            sudo mport install pkgconf brotli libnghttp2 ${MATRIX_INSTALL} | grep -v -E '(Downloading.+%|^/usr/local)' || true
+          elif [ "${MATRIX_OS}" = 'netbsd' ]; then
+            sudo pkgin -y install pkg-config perl brotli libssh2 libpsl nghttp2 ${MATRIX_INSTALL}
+          elif [ "${MATRIX_OS}" = 'openbsd' ]; then
+            sudo pkg_add -I brotli libssh2 libpsl nghttp2 ${MATRIX_INSTALL}
+            if [ "${MATRIX_BUILD}" = 'autotools' ]; then
+              sudo pkg_delete -I curl  # to avoid autotools build linking against system libcurl
+            fi
+          fi
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: |
+          if [ "${MATRIX_OS}" = 'openbsd' ]; then
+            if [ "${MATRIX_VERSION}" = '7.9' ]; then
+              export AUTOCONF_VERSION=2.72
+              export AUTOMAKE_VERSION=1.18
+            fi
+          fi
+          autoreconf -fi
+
+      - name: 'configure'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja -DCMAKE_INSTALL_PREFIX="$HOME"/curl-install \
+              -DCMAKE_C_COMPILER="${CC}" \
+              -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
+              -DCURL_ENABLE_NTLM=ON ${MATRIX_OPTIONS}
+          else
+            if [ "${MATRIX_ARCH}" != 'x86_64' ]; then
+              options='--disable-manual --disable-docs'  # Slow with autotools, skip on emulated CPU
+            fi
+            mkdir bld && cd bld
+            ../configure --prefix="$HOME"/curl-install --enable-unity --enable-debug --enable-warnings --enable-werror --disable-static \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              --with-brotli --with-libssh2 --with-nghttp2  \
+              ${options} ${MATRIX_OPTIONS}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl -V'
+        run: bld/src/curl --disable --version
+
+      - name: 'curl install'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --install bld
+          else
+            make -C bld install
+          fi
+
+      - name: 'build tests'
+        if: ${{ matrix.arch == 'x86_64' && !contains(matrix.desc, 'skipall') }}  # Slow on emulated CPU
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'run tests'
+        if: ${{ matrix.arch == 'x86_64' && !contains(matrix.desc, 'skipall') && !contains(matrix.desc, 'skiprun') }}  # Slow on emulated CPU
+        run: |
+          export TFLAGS='-j8'
+          if [ "${MATRIX_OS}" = 'openbsd' ]; then
+            TFLAGS="$TFLAGS !2707"  # Skip 2707 'ws: Peculiar frame sizes' on suspicion of hangs
+          fi
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose --target test-ci
+          else
+            make -C bld V=1 test-ci
+          fi
+
+      - name: 'build examples'
+        if: ${{ !contains(matrix.desc, '!examples') }}
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+  amiga:
+    name: "AmigaOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} gcc AmiSSL m68k"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+      AMISSL_VERSION: '5.27'
+      AMISSL_SHA256: 5003bef8c5930354d16b0ce7196d71b2811891c42fad38a9238c5ce4098ad42a
+      TOOLCHAIN_VERSION: 6.5.0
+      TOOLCHAIN_SHA256: 381e227c9ef552f073771d6f851cfdf873b574f3cf5db7c1c0107ea5d7146edc
+    strategy:
+      matrix:
+        build: [autotools, cmake]
+      fail-fast: false
+    steps:
+      - name: 'cache compiler'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-compiler
+        with:
+          path: ~/opt/amiga
+          key: ${{ runner.os }}-amigaos-${{ env.TOOLCHAIN_VERSION }}-${{ env.AMISSL_VERSION }}-amd64
+
+      - name: 'install compiler'
+        if: ${{ !steps.cache-compiler.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused \
+            https://franke.ms/download/amiga-gcc.tgz --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${TOOLCHAIN_SHA256}" && tar -xf pkg.bin && rm -f pkg.bin
+          cd opt/amiga
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/jens-maus/amissl/releases/download/${AMISSL_VERSION}/AmiSSL-${AMISSL_VERSION}-SDK.lha" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${AMISSL_SHA256}" && 7z x -bd -y pkg.bin && rm -f pkg.bin
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        run: |
+          ln -s ~/opt/amiga /opt
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja \
+              -DAMIGA=1 \
+              -DCMAKE_SYSTEM_NAME=Generic \
+              -DCMAKE_SYSTEM_PROCESSOR=m68k \
+              -DCMAKE_C_COMPILER_TARGET=m68k-unknown-amigaos \
+              -DCMAKE_C_COMPILER=/opt/amiga/bin/m68k-amigaos-gcc \
+              -DCMAKE_C_FLAGS='-O0 -msoft-float -mcrt=clib2' \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_WERROR=ON \
+              -DCURL_USE_LIBPSL=OFF \
+              -DAMISSL_INCLUDE_DIR=/opt/amiga/AmiSSL/Developer/include \
+              -DAMISSL_STUBS_LIBRARY=/opt/amiga/AmiSSL/Developer/lib/AmigaOS3/libamisslstubs.a \
+              -DAMISSL_AUTO_LIBRARY=/opt/amiga/AmiSSL/Developer/lib/AmigaOS3/libamisslauto.a
+          else
+            autoreconf -fi
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CC=/opt/amiga/bin/m68k-amigaos-gcc \
+              AR=/opt/amiga/bin/m68k-amigaos-ar \
+              RANLIB=/opt/amiga/bin/m68k-amigaos-ranlib \
+              --host=m68k-amigaos \
+              --disable-shared \
+              --without-libpsl \
+              --with-amissl \
+              LDFLAGS=-L/opt/amiga/AmiSSL/Developer/lib/AmigaOS3 \
+              CPPFLAGS=-I/opt/amiga/AmiSSL/Developer/include \
+              CFLAGS='-O0 -msoft-float -mcrt=clib2' \
+              LIBS='-lnet -lm -latomic'
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . -type f \( -name curl -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+  android:
+    name: "Android ${{ matrix.platform }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.name }} arm64"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+    strategy:
+      matrix:
+        include:
+          - { build: 'autotools', platform: '21', name: "!ssl !zstd",
+              options: '--without-ssl --without-libpsl --without-zstd' }
+
+          - { build: 'cmake'    , platform: '21', name: "!ssl !zstd",
+              options: '-DCURL_ENABLE_SSL=OFF -DCURL_USE_LIBPSL=OFF -DCURL_ZSTD=OFF' }
+
+          - { build: 'autotools', platform: '35', name: "!ssl !zstd",
+              options: '--without-ssl --without-libpsl --without-zstd' }
+
+          - { build: 'cmake'    , platform: '35', name: "!ssl !zstd",
+              options: '-DCURL_ENABLE_SSL=OFF -DCURL_USE_LIBPSL=OFF -DCURL_ZSTD=OFF' }
+
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'autoreconf'
+        if: ${{ matrix.build == 'autotools' }}
+        run: autoreconf -fi
+
+      - name: 'configure'
+        env:
+          MATRIX_OPTIONS: '${{ matrix.options }}'
+          MATRIX_PLATFORM: '${{ matrix.platform }}'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then  # https://developer.android.com/ndk/guides/cmake
+            cmake -B bld -G Ninja \
+              -DANDROID_ABI=arm64-v8a \
+              -DANDROID_PLATFORM="android-${MATRIX_PLATFORM}" \
+              -DCMAKE_TOOLCHAIN_FILE="${ANDROID_NDK_HOME}/build/cmake/android.toolchain.cmake" -DCMAKE_WARN_DEPRECATED=OFF \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_WERROR=ON \
+              ${MATRIX_OPTIONS}
+          else
+            TOOLCHAIN="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64"
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-shared \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CC="$TOOLCHAIN/bin/aarch64-linux-android${MATRIX_PLATFORM}-clang" \
+              AR="$TOOLCHAIN/bin/llvm-ar" \
+              RANLIB="$TOOLCHAIN/bin/llvm-ranlib" \
+              --host="aarch64-linux-android${MATRIX_PLATFORM}" \
+              ${MATRIX_OPTIONS}
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'dump config files'
+        run: |
+          for f in libcurl.pc curl-config; do
+            echo "::group::${f}"; grep -v '^#' bld/"${f}" || true; echo '::endgroup::'
+          done
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --verbose
+          else
+            make -C bld V=1
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . -type f \( -name curl -o -name '*.so' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . -type f \( -name curl -o -name '*.so' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi
+
+  msdos:
+    name: "MS-DOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} djgpp !ssl i586"
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      LDFLAGS: -s
+      MAKEFLAGS: -j 5
+      MATRIX_BUILD: '${{ matrix.build }}'
+      # renovate: datasource=github-releases depName=andrewwutw/build-djgpp versioning=semver-coerced registryUrl=https://github.com
+      TOOLCHAIN_VERSION: '3.4'
+      TOOLCHAIN_SHA256: 8464f17017d6ab1b2bb2df4ed82357b5bf692e6e2b7fee37e315638f3d505f00
+    strategy:
+      matrix:
+        build: [autotools, cmake]
+      fail-fast: false
+    steps:
+      - name: 'install packages'
+        timeout-minutes: 2
+        run: |
+          sudo find /etc/apt/sources.list.d -type f -not -name 'ubuntu.sources' -delete -print
+          sudo sed -i 's/priority:1/priority:9/' /etc/apt/apt-mirrors.txt; cat /etc/apt/apt-mirrors.txt
+          sudo apt-get -o Dpkg::Use-Pty=0 update
+          sudo apt-get -o Dpkg::Use-Pty=0 install libfl2
+
+      - name: 'cache compiler (djgpp)'
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        id: cache-compiler
+        with:
+          path: ~/djgpp
+          key: ${{ runner.os }}-djgpp-${{ env.TOOLCHAIN_VERSION }}-amd64
+
+      - name: 'install compiler (djgpp)'
+        if: ${{ !steps.cache-compiler.outputs.cache-hit }}
+        run: |
+          cd ~
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused \
+            --location --proto-redir =https "https://github.com/andrewwutw/build-djgpp/releases/download/v${TOOLCHAIN_VERSION}/djgpp-linux64-gcc1220.tar.bz2" --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${TOOLCHAIN_SHA256}" && tar -xjf pkg.bin && rm -f pkg.bin
+          cd djgpp
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            https://www.delorie.com/pub/djgpp/current/v2tk/wat3211b.zip --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF faa2222ab5deb2c2aac229c760bf4d45aca5379f5af97865c308a0467046b67a && unzip -q pkg.bin && rm -f pkg.bin
+          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
+            https://www.delorie.com/pub/djgpp/current/v2tk/zlb13b.zip --output pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF f3d2fa8129e7591c7e79074306d8ab91a70ec172cc01baedeae74992285dd3a3 && unzip -q pkg.bin && rm -f pkg.bin
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: 'configure'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake -B bld -G Ninja \
+              -DCMAKE_SYSTEM_NAME=DOS \
+              -DCMAKE_SYSTEM_PROCESSOR=x86 \
+              -DCMAKE_C_COMPILER_TARGET=i586-pc-msdosdjgpp \
+              -DCMAKE_C_COMPILER="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-gcc \
+              -DCMAKE_UNITY_BUILD=ON \
+              -DCURL_WERROR=ON \
+              -DCURL_ENABLE_SSL=OFF -DCURL_USE_LIBPSL=OFF \
+              -DZLIB_INCLUDE_DIR="$HOME"/djgpp/include \
+              -DZLIB_LIBRARY="$HOME"/djgpp/lib/libz.a \
+              -DWATT_ROOT="$HOME"/djgpp/net/watt
+          else
+            autoreconf -fi
+            mkdir bld && cd bld && ../configure --enable-unity --enable-warnings --enable-werror --disable-shared \
+              --disable-dependency-tracking --enable-option-checking=fatal \
+              CC="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-gcc \
+              AR="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-ar \
+              RANLIB="$HOME"/djgpp/bin/i586-pc-msdosdjgpp-ranlib \
+              WATT_ROOT="$HOME"/djgpp/net/watt \
+              --host=i586-pc-msdosdjgpp \
+              --without-ssl --without-libpsl \
+              --with-zlib="$HOME"/djgpp
+          fi
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          grep -F '#define' bld/lib/curl_config.h | sort || true
+
+      - name: 'build'
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld
+          else
+            make -C bld
+          fi
+
+      - name: 'curl info'
+        run: |
+          find . \( -name '*.exe' -o -name '*.a' \) -print0 | xargs -0 file --
+          find . \( -name '*.exe' -o -name '*.a' \) -print0 | xargs -0 stat -c '%10s bytes: %n' --
+
+      - name: 'build tests'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target testdeps
+          else
+            make -C bld -C tests
+          fi
+
+      - name: 'build examples'
+        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
+        run: |
+          if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+            cmake --build bld --target curl-examples-build
+          else
+            make -C bld examples
+          fi

third-party/curl/.github/workflows/proselint.yml

@@ -1,68 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: proselint
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths:
-    - '.github/workflows/proselint.yml'
-    - '**.md'
-  pull_request:
-    branches:
-    - master
-    paths:
-    - '.github/workflows/proselint.yml'
-    - '**.md'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: install prereqs
-      run: sudo apt-get install python3-proselint
-
-    # config file help: https://github.com/amperser/proselint/
-    - name: create proselint config
-      run: |
-        cat <<JSON > $HOME/.proselintrc
-        {
-          "checks": {
-            "typography.diacritical_marks": false,
-            "typography.symbols": false,
-            "annotations.misc": false
-          }
-        }
-        JSON
-
-    - name: check prose
-      run: a=`git ls-files '*.md' | grep -v docs/CHECKSRC.md` && proselint $a README
-
-    # This is for CHECKSRC and files with aggressive exclamation mark needs
-    - name: create second proselint config
-      run: |
-        cat <<JSON > $HOME/.proselintrc
-        {
-          "checks": {
-            "typography.diacritical_marks": false,
-            "typography.symbols": false,
-            "typography.exclamation": false,
-            "annotations.misc": false
-          }
-        }
-        JSON
-
-    - name: check special prose
-      run: a=docs/CHECKSRC.md && proselint $a

third-party/curl/.github/workflows/quiche-linux.yml

@@ -1,209 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: quiche
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: quiche-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-  openssl-version: 3.0.10+quic
-  nghttp3-version: v0.15.0
-  ngtcp2-version: v0.19.1
-  nghttp2-version: v1.56.0
-  quiche-version: 0.17.2
-  mod_h2-version: v2.0.21
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: quiche
-          install: >-
-            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev
-          install_steps: pytest
-          configure: >-
-            LDFLAGS="-Wl,-rpath,/home/runner/quiche/target/release"
-            --with-openssl=/home/runner/quiche/quiche/deps/boringssl/src
-            --enable-debug
-            --with-quiche=/home/runner/quiche/target/release
-            --with-test-nghttpx="$HOME/nghttpx/bin/nghttpx"
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
-        sudo apt-get install apache2 apache2-dev libnghttp2-dev
-      name: 'install prereqs and impacket, pytest, crypto'
-
-    - name: cache nghttpx
-      uses: actions/cache@v3
-      id: cache-nghttpx
-      env:
-        cache-name: cache-nghttpx
-      with:
-        path: /home/runner/nghttpx
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-openssl-${{ env.openssl-version }}-nghttp3-${{ env.nghttp3-version }}-ngtcp2-${{ env.ngtcp2-version }}-nghttp2-${{ env.nghttp2-version }}
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b openssl-${{ env.openssl-version }} https://github.com/quictls/openssl
-        cd openssl
-        ./config --prefix=$HOME/nghttpx --libdir=$HOME/nghttpx/lib
-        make -j1 install_sw
-      name: 'install quictls'
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.nghttp3-version }} https://github.com/ngtcp2/nghttp3
-        cd nghttp3
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only
-        make install
-      name: 'install nghttp3'
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.ngtcp2-version }} https://github.com/ngtcp2/ngtcp2
-        cd ngtcp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-lib-only --with-openssl
-        make install
-      name: 'install ngtcp2'
-
-    - if: steps.cache-nghttpx.outputs.cache-hit != 'true'
-      run: |
-        git clone --quiet --depth=1 -b ${{ env.nghttp2-version }} https://github.com/nghttp2/nghttp2
-        cd nghttp2
-        autoreconf -fi
-        ./configure --prefix=$HOME/nghttpx PKG_CONFIG_PATH="$HOME/nghttpx/lib/pkgconfig" --enable-http3
-        make install
-      name: 'install nghttp2'
-
-    - name: cache quiche
-      uses: actions/cache@v3
-      id: cache-quiche
-      env:
-        cache-name: cache-quiche
-      with:
-        path: /home/runner/quiche
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-quiche-${{ env.quiche-version }}
-
-    - if: steps.cache-quiche.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b ${{ env.quiche-version }} --recursive https://github.com/cloudflare/quiche.git
-        cd quiche
-        #### Work-around https://github.com/curl/curl/issues/7927 #######
-        #### See https://github.com/alexcrichton/cmake-rs/issues/131 ####
-        sed -i -e 's/cmake = "0.1"/cmake = "=0.1.45"/' quiche/Cargo.toml
-
-        cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
-        mkdir -v quiche/deps/boringssl/src/lib
-        ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/
-
-        # include dir
-        # /home/runner/quiche/quiche/deps/boringssl/src/include
-        # lib dir
-        # /home/runner/quiche/quiche/deps/boringssl/src/lib
-      name: 'build quiche and boringssl'
-
-    - name: cache mod_h2
-      uses: actions/cache@v3
-      id: cache-mod_h2
-      env:
-        cache-name: cache-mod_h2
-      with:
-        path: /home/runner/mod_h2
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mod_h2-version }}
-
-    - if: steps.cache-mod_h2.outputs.cache-hit != 'true'
-      run: |
-        cd $HOME
-        git clone --quiet --depth=1 -b  ${{ env.mod_h2-version }} https://github.com/icing/mod_h2
-        cd mod_h2
-        autoreconf -fi
-        ./configure
-        make
-      name: 'build mod_h2'
-
-    - run: |
-        cd $HOME/mod_h2
-        sudo make install
-      name: 'install mod_h2'
-
-    - uses: actions/checkout@v3
-
-    - run: |
-        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
-      name: 'install python test prereqs'
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-
-    - run: pytest -v tests
-      name: 'run pytest'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"
-        CURL_CI: github

third-party/curl/.github/workflows/reuse.yml

@@ -1,29 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
-#
-# SPDX-License-Identifier: curl
-
-name: REUSE compliance
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-  pull_request:
-    branches:
-    - master
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: REUSE Compliance Check
-      uses: fsfe/reuse-action@v1

third-party/curl/.github/workflows/spellcheck.yml

@@ -1,66 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: spell
-on:
-  push:
-    branches:
-    - master
-    paths:
-    - '**.md'
-    - '**.3'
-    - '**.1'
-    - '**/spellcheck.yml'
-    - '**/spellcheck.yaml'
-    - '**/wordlist.txt'
-  pull_request:
-    branches:
-    - master
-    paths:
-    - '**.md'
-    - '**.3'
-    - '**.1'
-    - '**/spellcheck.yml'
-    - '**/spellcheck.yaml'
-    - '**/wordlist.txt'
-
-permissions: {}
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-
-    - name: install pandoc
-      run: sudo apt-get install pandoc
-
-    - name: build curl.1
-      run: |
-         autoreconf -fi
-         ./configure --without-ssl
-         make -C docs
-
-    - name: strip "uncheckable" sections from .3 pages
-      run: find docs -name "*.3" -size +40c | sed 's/\.3//' | xargs -t -n1 -I OO  ./.github/scripts/cleanspell.pl OO.3 OO.33
-
-    - name: convert .3 man pages to markdown
-      run: find docs -name "*.33" -size +40c | sed 's/\.33//' | xargs -t -n1 -I OO pandoc -f man -t markdown OO.33 -o OO.md
-
-    - name: convert .1 man pages to markdown
-      run: find docs -name "*.1" -size +40c | sed 's/\.1//' | xargs -t -n1 -I OO pandoc OO.1 -o OO.md
-
-    - name: trim the curl.1 markdown file
-      run: |
-        perl -pi -e 's/^    .*//' docs/curl.md
-        perl -pi -e 's/\-\-[\a-z0-9-]*//ig' docs/curl.md
-        perl -pi -e 's!https://[a-z0-9%/.-]*!!ig' docs/curl.md
-
-    - name: setup the custom wordlist
-      run: grep -v '^#' .github/scripts/spellcheck.words >  wordlist.txt
-
-    - name: Check Spelling
-      uses: rojopolis/spellcheck-github-actions@v0
-      with:
-        config_path: .github/scripts/spellcheck.yaml

third-party/curl/.github/workflows/torture.yml

@@ -1,92 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux torture
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: torture-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: torture
-          install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-          configure: --with-openssl --enable-debug --enable-ares --enable-websockets
-          tflags: -n -t --shallow=25 !FTP
-        - name: torture-ftp
-          install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-          configure: --with-openssl --enable-debug --enable-ares
-          tflags: -n -t --shallow=20 FTP
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-torture
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"

third-party/curl/.github/workflows/wolfssl.yml

@@ -1,105 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux wolfSSL
-
-on:
-  push:
-    branches:
-    - master
-    - '*/ci'
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-  pull_request:
-    branches:
-    - master
-    paths-ignore:
-    - '**/*.md'
-    - '**/CMakeLists.txt'
-    - '.azure-pipelines.yml'
-    - '.circleci/**'
-    - '.cirrus.yml'
-    - 'appveyor.yml'
-    - 'CMake/**'
-    - 'packages/**'
-    - 'plan9/**'
-    - 'projects/**'
-    - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: wolfssl-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 3
-
-jobs:
-  autotools:
-    name: ${{ matrix.build.name }}
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-        - name: wolfssl (configured with --enable-all)
-          install:
-          configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
-          wolfssl-configure: --enable-all
-        - name: wolfssl (configured with --enable-opensslextra)
-          install:
-          configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
-          wolfssl-configure: --enable-opensslextra
-
-    steps:
-    - run: |
-        sudo apt-get update
-        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
-        sudo python3 -m pip install impacket
-      name: 'install prereqs and impacket'
-
-    - run: |
-        WOLFSSL_VER=5.6.3
-        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
-        tar -xzf v$WOLFSSL_VER-stable.tar.gz
-        cd wolfssl-$WOLFSSL_VER-stable
-        ./autogen.sh
-        ./configure --enable-tls13 ${{ matrix.build.wolfssl-configure }} --enable-harden --prefix=$HOME/wssl
-        make install
-      name: 'install wolfssl'
-
-    - uses: actions/checkout@v3
-
-    - run: autoreconf -fi
-      name: 'autoreconf'
-
-    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
-      name: 'configure'
-
-    - run: make V=1
-      name: 'make'
-
-    - run: make V=1 examples
-      name: 'make examples'
-
-    - run: make V=1 -C tests
-      name: 'make tests'
-
-    - run: make V=1 test-ci
-      name: 'run tests'
-      env:
-        TFLAGS: "${{ matrix.build.tflags }}"

third-party/curl/.gitignore

@@ -8,11 +8,15 @@
 *.exp
 *.la
 *.lib
+*.a
+*.res
 *.lo
 *.o
 *.obj
 *.pdb
 *.pyc
+*.orig
+*.rej
 *~
 .*.sw?
 .cproject
@@ -24,10 +28,8 @@
 /.vs
 /bld/
 /build/
-/builds/
 /stats/
 __pycache__
-CHANGES.dist
 Debug
 INSTALL
 Makefile
@@ -37,6 +39,9 @@ TAGS
 aclocal.m4
 aclocal.m4.bak
 autom4te.cache
+buildinfo.txt
+ca-bundle.crt
+certdata.txt
 compile
 config.cache
 config.guess
@@ -58,6 +63,7 @@ missing
 mkinstalldirs
 tags
 test-driver
+stamp-h*
 scripts/_curl
 scripts/curl.fish
 curl_fuzzer
@@ -65,3 +71,4 @@ curl_fuzzer_seed_corpus.zip
 libstandaloneengine.a
 tests/string
 tests/config
+tests/ech-log/

third-party/curl/.mailmap

@@ -1,6 +1,10 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
 Guenter Knauf <lists@gknw.net> <gk@gknw.de>
-Gisle Vanem <gisle.vanem@gmail.com> <gvanem@yahoo.no>
-Gisle Vanem <gisle.vanem@gmail.com> <gvanem@broadpark.no>
+Gisle Vanem <gvanem@yahoo.no> <gisle.vanem@gmail.com>
+Gisle Vanem <gvanem@yahoo.no> <gvanem@broadpark.no>
 Alessandro Ghedini <alessandro@ghedini.me> <alessandro@cloudflare.com>
 Alessandro Ghedini <alessandro@ghedini.me> <al3xbio@gmail.com>
 Björn Stenberg <bjorn@haxx.se>
@@ -65,7 +69,8 @@ Jessa Chandler <jessachandler@gmail.com>
 Gökhan Şengün <gsengun@linux-5d7d.site> <gokhansengun@gmai.com>
 Svyatoslav Mishyn <juef@openmailbox.org>
 Douglas Steinwand <dzs-curl@dzs.fx.org>
-James Fuller <jim@webcomposite.com>
+James Fuller <jim@webcomposite.com> <jfuller@redhat.com>
+James Fuller <jim@webcomposite.com> Jim Fuller <jim@webcomposite.com>
 Don J Olmstead <don.j.olmstead@gmail.com>
 Nicolas Sterchele <sterchelen@gmail.com>
 Sergey Raevskiy <ccik@inbox.ru>
@@ -79,8 +84,8 @@ Tobias Nyholm <tobias.nyholm@gmail.com>
 Timur Artikov <t.artikov@2gis.ru>
 Michał Antoniak <47522782+MAntoniak@users.noreply.github.com>
 Gleb Ivanovsky <gl.ivanovsky@gmail.com>
-Max Dymond <max.dymond@microsoft.com> <max.dymond@metaswitch.com>
-Max Dymond <max.dymond@microsoft.com> <cmeister2@gmail.com>
+Max Dymond <cmeister2@gmail.com> <max.dymond@metaswitch.com>
+Max Dymond <cmeister2@gmail.com> <max.dymond@microsoft.com>
 Abhinav Singh <theawless@gmail.com>
 Malik Idrees Hasan Khan <77000356+MalikIdreesHasanKhan@users.noreply.github.com>
 Yongkang Huang <hyk68691@hotmail.com>
@@ -106,3 +111,15 @@ Thomas1664 on github <46387399+Thomas1664@users.noreply.github.com>
 dengjfzh on github <dengjfzh@gmail.com>
 Brad Harder <brad.harder@gmail.com>
 Derzsi Dániel <daniel@tohka.us>
+Michael Osipov <michael.osipov@siemens.com> <1983-01-06@gmx.net>
+Michael Osipov <michael.osipov@siemens.com> <michael-o@users.sf.net>
+Christian Weisgerber <naddy@mips.inka.de> <curl-library@lists.haxx.se>
+Moritz Buhl <git@moritzbuhl.de>
+Aki Sakurai <75532970+AkiSakurai@users.noreply.github.com>
+Sinkevich Artem <artsin666@gmail.com>
+Andrew Kirillov <akirillo@uk.ibm.com>
+Stephen Farrell <stephen.farrell@cs.tcd.ie>
+Calvin Ruocco <calvin.ruocco@vector.com>
+Hamza Bensliman <benslimanhamza99@gmail.com>
+Kaixuan Li <kaixuan.li@ntu.edu.sg>
+Darren Banfi <boingball@gmail.com>

third-party/curl/.reuse/dep5

@@ -1,98 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: curl
-Upstream-Contact: Daniel Stenberg <daniel@haxx.se>
-Source: https://curl.se
-
-# Tests
-Files: tests/data/test* tests/certs/* tests/stunnel.pem tests/valgrind.supp
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Markdown documentation in docs/
-Files: docs/*.md
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Docs in docs/
-Files: docs/FAQ docs/INSTALL docs/INSTALL.cmake docs/KNOWN_BUGS docs/MAIL-ETIQUETTE docs/THANKS docs/TODO docs/cmdline-opts/page-footer docs/libcurl/curl_multi_socket_all.3 docs/libcurl/curl_strnequal.3 docs/libcurl/symbols-in-versions docs/options-in-versions
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Windows
-Files: projects/Windows/*
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: libcurl.def
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# Single files we do not want to edit directly
-Files: CHANGES
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: GIT-INFO
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: RELEASE-NOTES
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-# checksrc control files
-Files: lib/.checksrc docs/examples/.checksrc tests/libtest/.checksrc
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: lib/libcurl.plist.in
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: lib/libcurl.vers.in
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/OS400/README.OS400
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/build_vms.com
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/curl_release_note_start.txt
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/curlmsg.sdl
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/macro32_exactcase.patch
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: packages/vms/readme
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: plan9/README
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: projects/wolfssl_override.props
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: README
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: .github/ISSUE_TEMPLATE/bug_report.md
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl
-
-Files: .mailmap
-Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
-License: curl

third-party/curl/CHANGES

@@ -1,7 +0,0 @@
-See https://curl.se/changes.html for the edited and human readable online
-version of what has changed over the years in different curl releases.
-
-Generate a CHANGES file like the one present in every release like this:
-
-$ git log --pretty=fuller --no-color --date=short --decorate=full | \
-  ./scripts/log2changes.pl

third-party/curl/CHANGES.md

@@ -0,0 +1,12 @@
+<!--
+Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+
+SPDX-License-Identifier: curl
+-->
+
+In a release tarball, check the RELEASE-NOTES file for what was done in the
+most recent release. In a git check-out, that file mentions changes that have
+been done since the previous release.
+
+See the online [changelog](https://curl.se/changes.html) for the edited and
+human readable version of what has changed in different curl releases.

third-party/curl/CMake/CMakeConfigurableFile.in

@@ -1,24 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-@CMAKE_CONFIGURABLE_FILE_CONTENT@

third-party/curl/CMake/CurlSymbolHiding.cmake

@@ -21,58 +21,48 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-include(CheckCSourceCompiles)
-
-option(CURL_HIDDEN_SYMBOLS "Set to ON to hide libcurl internal symbols (=hide all symbols that aren't officially external)." ON)
+option(CURL_HIDDEN_SYMBOLS "Hide libcurl internal symbols (=hide all symbols that are not officially external)" ON)
 mark_as_advanced(CURL_HIDDEN_SYMBOLS)
 
-if(CURL_HIDDEN_SYMBOLS)
-  set(SUPPORTS_SYMBOL_HIDING FALSE)
-
-  if(CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
-    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
-  elseif(CMAKE_COMPILER_IS_GNUCC)
-    if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.4)
-      # note: this is considered buggy prior to 4.0 but the autotools don't care, so let's ignore that fact
-      set(SUPPORTS_SYMBOL_HIDING TRUE)
-      set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
-      set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
-    endif()
-  elseif(CMAKE_C_COMPILER_ID MATCHES "SunPro" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.0)
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-    set(_SYMBOL_EXTERN "__global")
-    set(_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
-  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 9.0)
-    # note: this should probably just check for version 9.1.045 but I'm not 100% sure
-    #       so let's do it the same way autotools do.
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
-    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
-    check_c_source_compiles("#include <stdio.h>
-        int main (void) { printf(\"icc fvisibility bug test\"); return 0; }" _no_bug)
-    if(NOT _no_bug)
-      set(SUPPORTS_SYMBOL_HIDING FALSE)
-      set(_SYMBOL_EXTERN "")
-      set(_CFLAG_SYMBOLS_HIDE "")
-    endif()
-  elseif(MSVC)
-    set(SUPPORTS_SYMBOL_HIDING TRUE)
-  endif()
-
-  set(HIDES_CURL_PRIVATE_SYMBOLS ${SUPPORTS_SYMBOL_HIDING})
-elseif(MSVC)
-  if(NOT CMAKE_VERSION VERSION_LESS 3.7)
-    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE) #present since 3.4.3 but broken
-    set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
-  else()
-    message(WARNING "Hiding private symbols regardless CURL_HIDDEN_SYMBOLS being disabled.")
-    set(HIDES_CURL_PRIVATE_SYMBOLS TRUE)
-  endif()
-else()
-  set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
+if(WIN32 AND ENABLE_DEBUG)
+  # We need to export internal debug functions,
+  # e.g. curl_easy_perform_ev() or curl_dbg_*(),
+  # so disable symbol hiding for debug builds and for memory tracking.
+  set(CURL_HIDDEN_SYMBOLS OFF)
+elseif(DOS OR AMIGA)
+  set(CURL_HIDDEN_SYMBOLS OFF)
 endif()
 
-set(CURL_CFLAG_SYMBOLS_HIDE ${_CFLAG_SYMBOLS_HIDE})
-set(CURL_EXTERN_SYMBOL ${_SYMBOL_EXTERN})
+set(CURL_HIDES_PRIVATE_SYMBOLS FALSE)
+set(CURL_EXTERN_SYMBOL "")
+set(CURL_CFLAG_SYMBOLS_HIDE "")
+
+if(CURL_HIDDEN_SYMBOLS)
+  if(CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
+    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+  elseif(CMAKE_C_COMPILER_ID STREQUAL "GNU")
+    if(CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 3.4)
+      # Note: This is considered buggy prior to 4.0 but the autotools do not care, so let us ignore that fact
+      set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+      set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
+      set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    endif()
+  elseif(CMAKE_C_COMPILER_ID MATCHES "SunPro" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 8.0)
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(CURL_EXTERN_SYMBOL "__global")
+    set(CURL_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
+  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND CMAKE_C_COMPILER_VERSION VERSION_GREATER_EQUAL 9.0)  # Requires 9.1.045
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
+    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+  elseif(MSVC)
+    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+  endif()
+else()
+  if(MSVC)
+    # Note: This option is prone to export non-curl extra symbols.
+    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE)
+  endif()
+endif()

third-party/curl/CMake/CurlTests.c

@@ -21,145 +21,86 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifdef TIME_WITH_SYS_TIME
-/* Time with sys/time test */
-
-#include <sys/types.h>
-#include <sys/time.h>
-#include <time.h>
-
-int
-main ()
-{
-if ((struct tm *) 0)
-return 0;
-  ;
-  return 0;
-}
-
-#endif
 
 #ifdef HAVE_FCNTL_O_NONBLOCK
-
 /* headers for FCNTL_O_NONBLOCK test */
 #include <sys/types.h>
 #include <unistd.h>
 #include <fcntl.h>
-/* */
+
 #if defined(sun) || defined(__sun__) || \
-    defined(__SUNPRO_C) || defined(__SUNPRO_CC)
-# if defined(__SVR4) || defined(__srv4__)
-#  define PLATFORM_SOLARIS
-# else
-#  define PLATFORM_SUNOS4
-# endif
+  defined(__SUNPRO_C) || defined(__SUNPRO_CC)
+#  if defined(__SVR4) || defined(__srv4__)
+#    define PLATFORM_SOLARIS
+#  else
+#    define PLATFORM_SUNOS4
+#  endif
 #endif
 #if (defined(_AIX) || defined(__xlC__)) && !defined(_AIX41)
-# define PLATFORM_AIX_V3
+#  define PLATFORM_AIX_V3
 #endif
-/* */
+
 #if defined(PLATFORM_SUNOS4) || defined(PLATFORM_AIX_V3)
 #error "O_NONBLOCK does not work on this platform"
 #endif
 
-int
-main ()
+int main(void)
 {
-      /* O_NONBLOCK source test */
-      int flags = 0;
-      if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
-          return 1;
-      return 0;
+  /* O_NONBLOCK source test */
+  int flags = 0;
+  if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
+    return 1;
+  return 0;
 }
 #endif
 
 /* tests for gethostbyname_r */
-#if defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
-#   define _REENTRANT
-    /* no idea whether _REENTRANT is always set, just invent a new flag */
-#   define TEST_GETHOSTBYFOO_REENTRANT
-#endif
 #if defined(HAVE_GETHOSTBYNAME_R_3) || \
+    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
     defined(HAVE_GETHOSTBYNAME_R_5) || \
+    defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
     defined(HAVE_GETHOSTBYNAME_R_6) || \
-    defined(TEST_GETHOSTBYFOO_REENTRANT)
+    defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
 #include <sys/types.h>
 #include <netdb.h>
 int main(void)
 {
-  char *address = "example.com";
-  int length = 0;
-  int type = 0;
+  const char *address = "example.com";
   struct hostent h;
   int rc = 0;
-#if defined(HAVE_GETHOSTBYNAME_R_3) || \
-    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
+#if   defined(HAVE_GETHOSTBYNAME_R_3) || \
+      defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
   struct hostent_data hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
       defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
       defined(HAVE_GETHOSTBYNAME_R_6) || \
       defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
   char buffer[8192];
-  int h_errnop;
   struct hostent *hp;
+  int h_errnop;
 #endif
 
 #if   defined(HAVE_GETHOSTBYNAME_R_3) || \
       defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
   rc = gethostbyname_r(address, &h, &hdata);
+  (void)hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
       defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT)
   rc = gethostbyname_r(address, &h, buffer, 8192, &h_errnop);
-  (void)hp; /* not used for test */
+  (void)hp;
+  (void)h_errnop;
 #elif defined(HAVE_GETHOSTBYNAME_R_6) || \
       defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
   rc = gethostbyname_r(address, &h, buffer, 8192, &hp, &h_errnop);
+  (void)hp;
+  (void)h_errnop;
 #endif
-
-  (void)length;
-  (void)type;
+  (void)h;
   (void)rc;
   return 0;
 }
 #endif
 
-#ifdef HAVE_SOCKLEN_T
-#ifdef _WIN32
-#include <ws2tcpip.h>
-#else
-#include <sys/types.h>
-#include <sys/socket.h>
-#endif
-int
-main ()
-{
-if ((socklen_t *) 0)
-  return 0;
-if (sizeof (socklen_t))
-  return 0;
-  ;
-  return 0;
-}
-#endif
-#ifdef HAVE_IN_ADDR_T
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <arpa/inet.h>
-
-int
-main ()
-{
-if ((in_addr_t *) 0)
-  return 0;
-if (sizeof (in_addr_t))
-  return 0;
-  ;
-  return 0;
-}
-#endif
-
 #ifdef HAVE_BOOL_T
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
@@ -167,13 +108,9 @@ if (sizeof (in_addr_t))
 #ifdef HAVE_STDBOOL_H
 #include <stdbool.h>
 #endif
-int
-main ()
+int main(void)
 {
-if (sizeof (bool *) )
-  return 0;
-  ;
-  return 0;
+  return (int)sizeof(bool *);
 }
 #endif
 
@@ -182,130 +119,94 @@ if (sizeof (bool *) )
 #include <stdarg.h>
 #include <string.h>
 #include <float.h>
-int main() { return 0; }
+int main(void)
+{
+  return 0;
+}
 #endif
+
 #ifdef HAVE_FILE_OFFSET_BITS
-#ifdef _FILE_OFFSET_BITS
-#undef _FILE_OFFSET_BITS
-#endif
-#define _FILE_OFFSET_BITS 64
 #include <sys/types.h>
- /* Check that off_t can represent 2**63 - 1 correctly.
-    We can't simply define LARGE_OFF_T to be 9223372036854775807,
-    since some C++ compilers masquerading as C compilers
-    incorrectly reject 9223372036854775807.  */
-#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
-  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
-                       && LARGE_OFF_T % 2147483647 == 1)
-                      ? 1 : -1];
-int main () { ; return 0; }
+/* Check that off_t can represent 2**63 - 1 correctly.
+   We cannot define LARGE_OFF_T to be 9223372036854775807,
+   since some C++ compilers masquerading as C compilers
+   incorrectly reject 9223372036854775807. */
+#define LARGE_OFF_T (((off_t)1 << 62) - 1 + ((off_t)1 << 62))
+static int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 &&
+                           LARGE_OFF_T % 2147483647 == 1)
+                          ? 1 : -1];
+int main(void)
+{
+  (void)off_t_is_large;
+  return 0;
+}
 #endif
+
 #ifdef HAVE_IOCTLSOCKET
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#ifdef _WIN32
+#  include <winsock2.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-/* ioctlsocket source code */
- int socket;
- unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
-
-  ;
+  /* ioctlsocket source code */
+  int socket = -1;
+  unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
+  (void)flags;
   return 0;
 }
 
 #endif
+
 #ifdef HAVE_IOCTLSOCKET_CAMEL
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
-#endif
-
-int
-main ()
+#include <proto/bsdsocket.h>
+int main(void)
 {
-
-/* IoctlSocket source code */
-    if(0 != IoctlSocket(0, 0, 0))
-      return 1;
-  ;
+  /* IoctlSocket source code */
+  if(0 != IoctlSocket(0, 0, 0))
+    return 1;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTLSOCKET_CAMEL_FIONBIO
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#include <proto/bsdsocket.h>
+#ifdef HAVE_SYS_IOCTL_H
+#  include <sys/ioctl.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-/* IoctlSocket source code */
-        long flags = 0;
-        if(0 != IoctlSocket(0, FIONBIO, &flags))
-          return 1;
-  ;
+  /* IoctlSocket source code */
+  long flags = 0;
+  if(0 != IoctlSocket(0, FIONBIO, &flags))
+    return 1;
+  (void)flags;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTLSOCKET_FIONBIO
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#ifdef _WIN32
+#  include <winsock2.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-        int flags = 0;
-        if(0 != ioctlsocket(0, FIONBIO, &flags))
-          return 1;
-
-  ;
+  unsigned long flags = 0;
+  if(0 != ioctlsocket(0, FIONBIO, &flags))
+    return 1;
+  (void)flags;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTL_FIONBIO
 /* headers for FIONBIO test */
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 #ifdef HAVE_SYS_IOCTL_H
@@ -314,29 +215,25 @@ main ()
 #ifdef HAVE_STROPTS_H
 #  include <stropts.h>
 #endif
-
-int
-main ()
+int main(void)
 {
-
-        int flags = 0;
-        if(0 != ioctl(0, FIONBIO, &flags))
-          return 1;
-
-  ;
+  int flags = 0;
+  if(0 != ioctl(0, FIONBIO, &flags))
+    return 1;
+  (void)flags;
   return 0;
 }
 #endif
+
 #ifdef HAVE_IOCTL_SIOCGIFADDR
 /* headers for FIONBIO test */
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
 #ifdef HAVE_SYS_IOCTL_H
@@ -346,156 +243,111 @@ main ()
 #  include <stropts.h>
 #endif
 #include <net/if.h>
-
-int
-main ()
+int main(void)
 {
-        struct ifreq ifr;
-        if(0 != ioctl(0, SIOCGIFADDR, &ifr))
-          return 1;
-
-  ;
+  struct ifreq ifr;
+  if(0 != ioctl(0, SIOCGIFADDR, &ifr))
+    return 1;
+  (void)ifr;
   return 0;
 }
 #endif
+
 #ifdef HAVE_SETSOCKOPT_SO_NONBLOCK
-/* includes start */
-#ifdef HAVE_WINDOWS_H
-#  ifndef WIN32_LEAN_AND_MEAN
-#    define WIN32_LEAN_AND_MEAN
-#  endif
-#  include <windows.h>
-#  ifdef HAVE_WINSOCK2_H
-#    include <winsock2.h>
-#  endif
+#ifdef _WIN32
+#  include <winsock2.h>
 #endif
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_SOCKET_H
+#ifndef _WIN32
 #  include <sys/socket.h>
 #endif
-/* includes end */
-
-int
-main ()
+int main(void)
 {
-        if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
-          return 1;
-  ;
+  if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
+    return 1;
   return 0;
 }
 #endif
+
 #ifdef HAVE_GLIBC_STRERROR_R
 #include <string.h>
 #include <errno.h>
 
-void check(char c) {}
+static void check(char c)
+{
+  (void)c;
+}
 
-int
-main () {
+int main(void)
+{
   char buffer[1024];
-  /* This will not compile if strerror_r does not return a char* */
+  /* This does not compile if strerror_r does not return a char* */
+  /* !checksrc! disable ERRNOVAR 1 */
   check(strerror_r(EACCES, buffer, sizeof(buffer))[0]);
   return 0;
 }
 #endif
+
 #ifdef HAVE_POSIX_STRERROR_R
 #include <string.h>
 #include <errno.h>
 
-/* float, because a pointer can't be implicitly cast to float */
-void check(float f) {}
+/* Float, because a pointer cannot be implicitly cast to float */
+static void check(float f)
+{
+  (void)f;
+}
 
-int
-main () {
+int main(void)
+{
   char buffer[1024];
-  /* This will not compile if strerror_r does not return an int */
+  /* This does not compile if strerror_r does not return an int */
+  /* !checksrc! disable ERRNOVAR 1 */
   check(strerror_r(EACCES, buffer, sizeof(buffer)));
   return 0;
 }
 #endif
+
 #ifdef HAVE_FSETXATTR_6
 #include <sys/xattr.h> /* header from libc, not from libattr */
-int
-main() {
+int main(void)
+{
   fsetxattr(0, 0, 0, 0, 0, 0);
   return 0;
 }
 #endif
+
 #ifdef HAVE_FSETXATTR_5
 #include <sys/xattr.h> /* header from libc, not from libattr */
-int
-main() {
-  fsetxattr(0, 0, 0, 0, 0);
+int main(void)
+{
+  fsetxattr(0, "", 0, 0, 0);
   return 0;
 }
 #endif
+
 #ifdef HAVE_CLOCK_GETTIME_MONOTONIC
 #include <time.h>
-int
-main() {
-  struct timespec ts = {0, 0};
-  clock_gettime(CLOCK_MONOTONIC, &ts);
+int main(void)
+{
+  struct timespec ts;
+  (void)clock_gettime(CLOCK_MONOTONIC, &ts);
+  (void)ts;
   return 0;
 }
 #endif
+
 #ifdef HAVE_BUILTIN_AVAILABLE
-int
-main() {
-  if(__builtin_available(macOS 10.12, *)) {}
+int main(void)
+{
+  if(__builtin_available(macOS 10.12, iOS 5.0, *)) {}
   return 0;
 }
 #endif
-#ifdef HAVE_VARIADIC_MACROS_C99
-#define c99_vmacro3(first, ...) fun3(first, __VA_ARGS__)
-#define c99_vmacro2(first, ...) fun2(first, __VA_ARGS__)
 
-int fun3(int arg1, int arg2, int arg3);
-int fun2(int arg1, int arg2);
-
-int fun3(int arg1, int arg2, int arg3) {
-  return arg1 + arg2 + arg3;
-}
-int fun2(int arg1, int arg2) {
-  return arg1 + arg2;
-}
-
-int
-main() {
-  int res3 = c99_vmacro3(1, 2, 3);
-  int res2 = c99_vmacro2(1, 2);
-  (void)res3;
-  (void)res2;
-  return 0;
-}
-#endif
-#ifdef HAVE_VARIADIC_MACROS_GCC
-#define gcc_vmacro3(first, args...) fun3(first, args)
-#define gcc_vmacro2(first, args...) fun2(first, args)
-
-int fun3(int arg1, int arg2, int arg3);
-int fun2(int arg1, int arg2);
-
-int fun3(int arg1, int arg2, int arg3) {
-  return arg1 + arg2 + arg3;
-}
-int fun2(int arg1, int arg2) {
-  return arg1 + arg2;
-}
-
-int
-main() {
-  int res3 = gcc_vmacro3(1, 2, 3);
-  int res2 = gcc_vmacro2(1, 2);
-  (void)res3;
-  (void)res2;
-  return 0;
-}
-#endif
 #ifdef HAVE_ATOMIC
-/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@@ -505,28 +357,45 @@ main() {
 #ifdef HAVE_STDATOMIC_H
 #  include <stdatomic.h>
 #endif
-/* includes end */
-
-int
-main() {
+int main(void)
+{
   _Atomic int i = 1;
   i = 0;  /* Force an atomic-write operation. */
   return i;
 }
 #endif
+
 #ifdef HAVE_WIN32_WINNT
-/* includes start */
-#ifdef WIN32
-#  include "../lib/setup-win32.h"
+#ifdef _WIN32
+#  ifndef NOGDI
+#  define NOGDI
+#  endif
+#  include <windows.h>
 #endif
-/* includes end */
 
 #define enquote(x) #x
 #define expand(x) enquote(x)
 #pragma message("_WIN32_WINNT=" expand(_WIN32_WINNT))
 
-int
-main() {
+int main(void)
+{
+  return 0;
+}
+#endif
+
+#ifdef MINGW64_VERSION
+#ifdef __MINGW32__
+#  include <_mingw.h>
+#endif
+
+#define enquote(x) #x
+#define expand(x) enquote(x)
+#pragma message("MINGW64_VERSION=" \
+  expand(__MINGW64_VERSION_MAJOR) "." \
+  expand(__MINGW64_VERSION_MINOR))
+
+int main(void)
+{
   return 0;
 }
 #endif

third-party/curl/CMake/FindBearSSL.cmake

@@ -1,32 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-find_path(BEARSSL_INCLUDE_DIRS bearssl.h)
-
-find_library(BEARSSL_LIBRARY bearssl)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(BEARSSL DEFAULT_MSG
-    BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)
-
-mark_as_advanced(BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)

third-party/curl/CMake/FindBrotli.cmake

@@ -21,23 +21,76 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-include(FindPackageHandleStandardArgs)
+# Find the brotli library
+#
+# Input variables:
+#
+# - `BROTLI_INCLUDE_DIR`:      Absolute path to brotli include directory.
+# - `BROTLICOMMON_LIBRARY`:    Absolute path to `brotlicommon` library.
+# - `BROTLIDEC_LIBRARY`:       Absolute path to `brotlidec` library.
+# - `BROTLI_USE_STATIC_LIBS`:  Configure for static brotli libraries.
+#
+# Defines:
+#
+# - `BROTLI_FOUND`:            System has brotli.
+# - `BROTLI_VERSION`:          Version of brotli.
+# - `CURL::brotli`:            brotli library target.
 
-find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")
+set(_brotli_pc_requires "libbrotlidec" "libbrotlicommon")  # order is significant: brotlidec then brotlicommon
 
-find_library(BROTLICOMMON_LIBRARY NAMES brotlicommon)
-find_library(BROTLIDEC_LIBRARY NAMES brotlidec)
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED BROTLI_INCLUDE_DIR AND
+   NOT DEFINED BROTLICOMMON_LIBRARY AND
+   NOT DEFINED BROTLIDEC_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_brotli ${_brotli_pc_requires})
+endif()
 
-find_package_handle_standard_args(Brotli
-    FOUND_VAR
-      BROTLI_FOUND
+if(_brotli_FOUND)
+  set(Brotli_FOUND TRUE)
+  set(BROTLI_FOUND TRUE)
+  set(BROTLI_VERSION ${_brotli_libbrotlicommon_VERSION})
+  if(BROTLI_USE_STATIC_LIBS)
+    set(_brotli_CFLAGS       "${_brotli_STATIC_CFLAGS}")
+    set(_brotli_INCLUDE_DIRS "${_brotli_STATIC_INCLUDE_DIRS}")
+    set(_brotli_LIBRARY_DIRS "${_brotli_STATIC_LIBRARY_DIRS}")
+    set(_brotli_LIBRARIES    "${_brotli_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Brotli (via pkg-config): ${_brotli_INCLUDE_DIRS} (found version \"${BROTLI_VERSION}\")")
+else()
+  find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")
+  if(BROTLI_USE_STATIC_LIBS)
+    find_library(BROTLICOMMON_LIBRARY NAMES "brotlicommon-static" "brotlicommon")
+    find_library(BROTLIDEC_LIBRARY NAMES "brotlidec-static" "brotlidec")
+  else()
+    find_library(BROTLICOMMON_LIBRARY NAMES "brotlicommon")
+    find_library(BROTLIDEC_LIBRARY NAMES "brotlidec")
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Brotli
     REQUIRED_VARS
+      BROTLI_INCLUDE_DIR
       BROTLIDEC_LIBRARY
       BROTLICOMMON_LIBRARY
-      BROTLI_INCLUDE_DIR
-    FAIL_MESSAGE
-      "Could NOT find Brotli"
-)
+  )
 
-set(BROTLI_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
-set(BROTLI_LIBRARIES ${BROTLICOMMON_LIBRARY} ${BROTLIDEC_LIBRARY})
+  if(BROTLI_FOUND)
+    set(_brotli_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
+    set(_brotli_LIBRARIES ${BROTLIDEC_LIBRARY} ${BROTLICOMMON_LIBRARY})
+  endif()
+
+  mark_as_advanced(BROTLI_INCLUDE_DIR BROTLIDEC_LIBRARY BROTLICOMMON_LIBRARY)
+endif()
+
+if(BROTLI_FOUND)
+  if(NOT TARGET CURL::brotli)
+    add_library(CURL::brotli INTERFACE IMPORTED)
+    set_target_properties(CURL::brotli PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_brotli_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_brotli_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_brotli_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_brotli_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_brotli_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindCARES.cmake

@@ -21,27 +21,112 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Find c-ares
-# Find the c-ares includes and library
-# This module defines
-#  CARES_INCLUDE_DIR, where to find ares.h, etc.
-#  CARES_LIBRARIES, the libraries needed to use c-ares.
-#  CARES_FOUND, If false, do not try to use c-ares.
-# also defined, but not for general use are
-# CARES_LIBRARY, where to find the c-ares library.
+# Find the c-ares library
+#
+# Input variables:
+#
+# - `CARES_INCLUDE_DIR`:      Absolute path to c-ares include directory.
+# - `CARES_LIBRARY`:          Absolute path to `cares` library.
+# - `CARES_USE_STATIC_LIBS`:  Configure for static c-ares libraries.
+#
+# Defines:
+#
+# - `CARES_FOUND`:            System has c-ares.
+# - `CARES_VERSION`:          Version of c-ares.
+# - `CURL::cares`:            c-ares library target.
 
-find_path(CARES_INCLUDE_DIR ares.h)
+set(_cares_pc_requires "libcares")
 
-set(CARES_NAMES ${CARES_NAMES} cares)
-find_library(CARES_LIBRARY
-  NAMES ${CARES_NAMES}
+if(NOT DEFINED CARES_INCLUDE_DIR AND
+   NOT DEFINED CARES_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_cares ${_cares_pc_requires})
+  endif()
+  if(NOT _cares_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(c-ares CONFIG QUIET)
+  endif()
+endif()
+
+if(_cares_FOUND)
+  set(Cares_FOUND TRUE)
+  set(CARES_FOUND TRUE)
+  set(CARES_VERSION ${_cares_VERSION})
+  if(CARES_USE_STATIC_LIBS)
+    set(_cares_CFLAGS       "${_cares_STATIC_CFLAGS}")
+    set(_cares_INCLUDE_DIRS "${_cares_STATIC_INCLUDE_DIRS}")
+    set(_cares_LIBRARY_DIRS "${_cares_STATIC_LIBRARY_DIRS}")
+    set(_cares_LIBRARIES    "${_cares_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Cares (via pkg-config): ${_cares_INCLUDE_DIRS} (found version \"${CARES_VERSION}\")")
+elseif(c-ares_CONFIG)
+  set(Cares_FOUND TRUE)
+  set(CARES_FOUND TRUE)
+  set(CARES_VERSION ${c-ares_VERSION})
+  if(CARES_USE_STATIC_LIBS)
+    set(_cares_LIBRARIES c-ares::cares_static)
+  else()
+    set(_cares_LIBRARIES c-ares::cares)
+  endif()
+  message(STATUS "Found Cares (via CMake Config): ${c-ares_CONFIG} (found version \"${CARES_VERSION}\")")
+else()
+  find_path(CARES_INCLUDE_DIR NAMES "ares.h")
+  if(CARES_USE_STATIC_LIBS)
+    set(_cares_CFLAGS "-DCARES_STATICLIB")
+    find_library(CARES_LIBRARY NAMES ${CARES_NAMES} "cares_static" "cares")
+  else()
+    find_library(CARES_LIBRARY NAMES ${CARES_NAMES} "cares")
+  endif()
+
+  unset(CARES_VERSION CACHE)
+  if(CARES_INCLUDE_DIR AND EXISTS "${CARES_INCLUDE_DIR}/ares_version.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+ARES_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+ARES_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+ARES_VERSION_PATCH[\t ]+([0-9]+).*")
+    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(CARES_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Cares
+    REQUIRED_VARS
+      CARES_INCLUDE_DIR
+      CARES_LIBRARY
+    VERSION_VAR
+      CARES_VERSION
   )
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(CARES
-    REQUIRED_VARS CARES_LIBRARY CARES_INCLUDE_DIR)
+  if(CARES_FOUND)
+    set(_cares_INCLUDE_DIRS ${CARES_INCLUDE_DIR})
+    set(_cares_LIBRARIES    ${CARES_LIBRARY})
+  endif()
 
-mark_as_advanced(
-  CARES_LIBRARY
-  CARES_INCLUDE_DIR
-  )
+  mark_as_advanced(CARES_INCLUDE_DIR CARES_LIBRARY)
+endif()
+
+if(CARES_FOUND)
+  if(WIN32)
+    list(APPEND _cares_LIBRARIES "iphlpapi")  # for if_indextoname and others
+  endif()
+
+  if(NOT TARGET CURL::cares)
+    add_library(CURL::cares INTERFACE IMPORTED)
+    set_target_properties(CURL::cares PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_cares_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_cares_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_cares_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_cares_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_cares_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindGSS.cmake

@@ -21,292 +21,244 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Try to find the GSS Kerberos library
-# Once done this will define
+# Find the GSS Kerberos library
 #
-#  GSS_ROOT_DIR - Set this variable to the root installation of GSS
+# Input variables:
 #
-# Read-Only variables:
-#  GSS_FOUND - system has the Heimdal library
-#  GSS_FLAVOUR - "MIT" or "Heimdal" if anything found.
-#  GSS_INCLUDE_DIR - the Heimdal include directory
-#  GSS_LIBRARIES - The libraries needed to use GSS
-#  GSS_LINK_DIRECTORIES - Directories to add to linker search path
-#  GSS_LINKER_FLAGS - Additional linker flags
-#  GSS_COMPILER_FLAGS - Additional compiler flags
-#  GSS_VERSION - This is set to version advertised by pkg-config or read from manifest.
-#                In case the library is found but no version info available it'll be set to "unknown"
+# - `GSS_ROOT_DIR`:  Absolute path to the root installation of GSS. (also supported as environment)
+#
+# Defines:
+#
+# - `GSS_FOUND`:     System has GSS.
+# - `GSS_VERSION`:   Version of GSS.
+# - `CURL::gss`:     GSS library target.
+#   - `INTERFACE_CURL_GSS_FLAVOR`: Custom property. "GNU" or "MIT" if detected.
 
-set(_MIT_MODNAME mit-krb5-gssapi)
-set(_HEIMDAL_MODNAME heimdal-gssapi)
+set(_gnu_modname "gss")
+set(_mit_modname "mit-krb5-gssapi")
 
 include(CheckIncludeFile)
 include(CheckIncludeFiles)
 include(CheckTypeSize)
 
-set(_GSS_ROOT_HINTS
-    "${GSS_ROOT_DIR}"
-    "$ENV{GSS_ROOT_DIR}"
-)
+set(_gss_root_hints "${GSS_ROOT_DIR}" "$ENV{GSS_ROOT_DIR}")
 
-# try to find library using system pkg-config if user didn't specify root dir
+set(_gss_CFLAGS "")
+set(_gss_LIBRARY_DIRS "")
+
+# Try to find library using system pkg-config if user did not specify root dir
 if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}")
-  if(UNIX)
+  if(CURL_USE_PKGCONFIG)
     find_package(PkgConfig QUIET)
-    pkg_search_module(_GSS_PKG ${_MIT_MODNAME} ${_HEIMDAL_MODNAME})
-    list(APPEND _GSS_ROOT_HINTS "${_GSS_PKG_PREFIX}")
-  elseif(WIN32)
-    list(APPEND _GSS_ROOT_HINTS "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
+    pkg_search_module(_gss ${_mit_modname} ${_gnu_modname})
+    list(APPEND _gss_root_hints "${_gss_PREFIX}")
+    set(_gss_version "${_gss_VERSION}")
+  endif()
+  if(WIN32)
+    list(APPEND _gss_root_hints "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
   endif()
 endif()
 
-if(NOT _GSS_FOUND) #not found by pkg-config. Let's take more traditional approach.
-  find_file(_GSS_CONFIGURE_SCRIPT
-      NAMES
-          "krb5-config"
-      HINTS
-          ${_GSS_ROOT_HINTS}
-      PATH_SUFFIXES
-          bin
-      NO_CMAKE_PATH
-      NO_CMAKE_ENVIRONMENT_PATH
-  )
+if(NOT _gss_FOUND)  # Not found by pkg-config. Let us take more traditional approach.
+  find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin" HINTS ${_gss_root_hints}
+    NO_CMAKE_PATH NO_CMAKE_ENVIRONMENT_PATH)
+  # If not found in user-supplied directories, maybe system knows better
+  find_file(_gss_configure_script NAMES "krb5-config" PATH_SUFFIXES "bin")
 
-  # if not found in user-supplied directories, maybe system knows better
-  find_file(_GSS_CONFIGURE_SCRIPT
-      NAMES
-          "krb5-config"
-      PATH_SUFFIXES
-          bin
-  )
+  if(_gss_configure_script)
 
-  if(_GSS_CONFIGURE_SCRIPT)
-    execute_process(
-          COMMAND ${_GSS_CONFIGURE_SCRIPT} "--cflags" "gssapi"
-          OUTPUT_VARIABLE _GSS_CFLAGS
-          RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-          OUTPUT_STRIP_TRAILING_WHITESPACE
-      )
-    message(STATUS "CFLAGS: ${_GSS_CFLAGS}")
-    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
-      # should also work in an odd case when multiple directories are given
-      string(STRIP "${_GSS_CFLAGS}" _GSS_CFLAGS)
-      string(REGEX REPLACE " +-I" ";" _GSS_CFLAGS "${_GSS_CFLAGS}")
-      string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _GSS_CFLAGS "${_GSS_CFLAGS}")
+    set(_gss_INCLUDE_DIRS "")
+    set(_gss_LIBRARIES "")
 
-      foreach(_flag ${_GSS_CFLAGS})
-        if(_flag MATCHES "^-I.*")
-          string(REGEX REPLACE "^-I" "" _val "${_flag}")
-          list(APPEND _GSS_INCLUDE_DIR "${_val}")
+    execute_process(COMMAND ${_gss_configure_script} "--cflags" "gssapi"
+      OUTPUT_VARIABLE _gss_cflags_raw
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
+    message(STATUS "FindGSS krb5-config --cflags: ${_gss_cflags_raw}")
+
+    if(NOT _gss_configure_failed)  # 0 means success
+      # Should also work in an odd case when multiple directories are given.
+      string(STRIP "${_gss_cflags_raw}" _gss_cflags_raw)
+      string(REGEX REPLACE " +-(I)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
+      string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _gss_cflags_raw "${_gss_cflags_raw}")
+
+      foreach(_flag IN LISTS _gss_cflags_raw)
+        if(_flag MATCHES "^-I")
+          string(REGEX REPLACE "^-I" "" _flag "${_flag}")
+          list(APPEND _gss_INCLUDE_DIRS "${_flag}")
         else()
-          list(APPEND _GSS_COMPILER_FLAGS "${_flag}")
+          list(APPEND _gss_CFLAGS "${_flag}")
         endif()
       endforeach()
     endif()
 
-    execute_process(
-        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--libs" "gssapi"
-        OUTPUT_VARIABLE _GSS_LIB_FLAGS
-        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
-    message(STATUS "LDFLAGS: ${_GSS_LIB_FLAGS}")
+    execute_process(COMMAND ${_gss_configure_script} "--libs" "gssapi"
+      OUTPUT_VARIABLE _gss_lib_flags
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
+    message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}")
 
-    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
-      # this script gives us libraries and link directories. Blah. We have to deal with it.
-      string(STRIP "${_GSS_LIB_FLAGS}" _GSS_LIB_FLAGS)
-      string(REGEX REPLACE " +-(L|l)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")
-      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")
+    if(NOT _gss_configure_failed)  # 0 means success
+      # This script gives us libraries and link directories.
+      string(STRIP "${_gss_lib_flags}" _gss_lib_flags)
+      string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
+      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
 
-      foreach(_flag ${_GSS_LIB_FLAGS})
-        if(_flag MATCHES "^-l.*")
-          string(REGEX REPLACE "^-l" "" _val "${_flag}")
-          list(APPEND _GSS_LIBRARIES "${_val}")
-        elseif(_flag MATCHES "^-L.*")
-          string(REGEX REPLACE "^-L" "" _val "${_flag}")
-          list(APPEND _GSS_LINK_DIRECTORIES "${_val}")
-        else()
-          list(APPEND _GSS_LINKER_FLAGS "${_flag}")
+      foreach(_flag IN LISTS _gss_lib_flags)
+        if(_flag MATCHES "^-l")
+          string(REGEX REPLACE "^-l" "" _flag "${_flag}")
+          list(APPEND _gss_LIBRARIES "${_flag}")
+        elseif(_flag MATCHES "^-L")
+          string(REGEX REPLACE "^-L" "" _flag "${_flag}")
+          list(APPEND _gss_LIBRARY_DIRS "${_flag}")
         endif()
       endforeach()
     endif()
 
-    execute_process(
-        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--version"
-        OUTPUT_VARIABLE _GSS_VERSION
-        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
+    execute_process(COMMAND ${_gss_configure_script} "--version"
+      OUTPUT_VARIABLE _gss_version
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
 
-    # older versions may not have the "--version" parameter. In this case we just don't care.
-    if(_GSS_CONFIGURE_FAILED)
-      set(_GSS_VERSION 0)
-    endif()
-
-    execute_process(
-        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--vendor"
-        OUTPUT_VARIABLE _GSS_VENDOR
-        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
-
-    # older versions may not have the "--vendor" parameter. In this case we just don't care.
-    if(_GSS_CONFIGURE_FAILED)
-      set(GSS_FLAVOUR "Heimdal") # most probably, shouldn't really matter
+    # Older versions may not have the "--version" parameter. In this case we do not care.
+    if(_gss_configure_failed)
+      set(_gss_version 0)
     else()
-      if(_GSS_VENDOR MATCHES ".*H|heimdal.*")
-        set(GSS_FLAVOUR "Heimdal")
-      else()
-        set(GSS_FLAVOUR "MIT")
-      endif()
+      # Strip prefix string to leave the version number only
+      string(REPLACE "Kerberos 5 release " "" _gss_version "${_gss_version}")
     endif()
 
-  else() # either there is no config script or we are on a platform that doesn't provide one (Windows?)
+    execute_process(COMMAND ${_gss_configure_script} "--vendor"
+      OUTPUT_VARIABLE _gss_vendor
+      RESULT_VARIABLE _gss_configure_failed
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
 
-    find_path(_GSS_INCLUDE_DIR
-        NAMES
-            "gssapi/gssapi.h"
-        HINTS
-            ${_GSS_ROOT_HINTS}
-        PATH_SUFFIXES
-            include
-            inc
-    )
-
-    if(_GSS_INCLUDE_DIR) #jay, we've found something
-      set(CMAKE_REQUIRED_INCLUDES "${_GSS_INCLUDE_DIR}")
-      check_include_files( "gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _GSS_HAVE_MIT_HEADERS)
-
-      if(_GSS_HAVE_MIT_HEADERS)
-        set(GSS_FLAVOUR "MIT")
-      else()
-        # prevent compiling the header - just check if we can include it
-        list(APPEND CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
-        check_include_file( "roken.h" _GSS_HAVE_ROKEN_H)
-
-        check_include_file( "heimdal/roken.h" _GSS_HAVE_HEIMDAL_ROKEN_H)
-        if(_GSS_HAVE_ROKEN_H OR _GSS_HAVE_HEIMDAL_ROKEN_H)
-          set(GSS_FLAVOUR "Heimdal")
-        endif()
-        list(REMOVE_ITEM CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
-      endif()
-    else()
-      # I'm not convinced if this is the right way but this is what autotools do at the moment
-      find_path(_GSS_INCLUDE_DIR
-          NAMES
-              "gssapi.h"
-          HINTS
-              ${_GSS_ROOT_HINTS}
-          PATH_SUFFIXES
-              include
-              inc
-      )
-
-      if(_GSS_INCLUDE_DIR)
-        set(GSS_FLAVOUR "Heimdal")
-      endif()
+    # Older versions may not have the "--vendor" parameter. In this case we do not care.
+    if(NOT _gss_configure_failed AND NOT _gss_vendor MATCHES "Heimdal|heimdal")
+      set(_gss_flavor "MIT")  # assume a default, should not really matter
     endif()
 
-    # if we have headers, check if we can link libraries
-    if(GSS_FLAVOUR)
-      set(_GSS_LIBDIR_SUFFIXES "")
-      set(_GSS_LIBDIR_HINTS ${_GSS_ROOT_HINTS})
-      get_filename_component(_GSS_CALCULATED_POTENTIAL_ROOT "${_GSS_INCLUDE_DIR}" PATH)
-      list(APPEND _GSS_LIBDIR_HINTS ${_GSS_CALCULATED_POTENTIAL_ROOT})
+  else()  # Either there is no config script or we are on a platform that does not provide one (Windows?)
 
-      if(WIN32)
-        if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/AMD64")
-          if(GSS_FLAVOUR STREQUAL "MIT")
-            set(_GSS_LIBNAME "gssapi64")
+    find_path(_gss_INCLUDE_DIRS NAMES "gssapi/gssapi.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include" "inc")
+
+    if(_gss_INCLUDE_DIRS)  # We have found something
+      set(_gss_libdir_suffixes "")
+
+      cmake_push_check_state()
+      list(APPEND CMAKE_REQUIRED_INCLUDES "${_gss_INCLUDE_DIRS}")
+      check_include_files("gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _gss_have_mit_headers)
+      cmake_pop_check_state()
+
+      if(_gss_have_mit_headers)
+        set(_gss_flavor "MIT")
+        if(WIN32)
+          if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+            list(APPEND _gss_libdir_suffixes "lib/AMD64")
+            set(_gss_libname "gssapi64")
           else()
-            set(_GSS_LIBNAME "libgssapi")
+            list(APPEND _gss_libdir_suffixes "lib/i386")
+            set(_gss_libname "gssapi32")
           endif()
         else()
-          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/i386")
-          if(GSS_FLAVOUR STREQUAL "MIT")
-            set(_GSS_LIBNAME "gssapi32")
-          else()
-            set(_GSS_LIBNAME "libgssapi")
-          endif()
-        endif()
-      else()
-        list(APPEND _GSS_LIBDIR_SUFFIXES "lib;lib64") # those suffixes are not checked for HINTS
-        if(GSS_FLAVOUR STREQUAL "MIT")
-          set(_GSS_LIBNAME "gssapi_krb5")
-        else()
-          set(_GSS_LIBNAME "gssapi")
+          list(APPEND _gss_libdir_suffixes "lib" "lib64")  # those suffixes are not checked for HINTS
+          set(_gss_libname "gssapi_krb5")
         endif()
       endif()
+    else()
+      find_path(_gss_INCLUDE_DIRS NAMES "gss.h" HINTS ${_gss_root_hints} PATH_SUFFIXES "include")
 
-      find_library(_GSS_LIBRARIES
-          NAMES
-              ${_GSS_LIBNAME}
-          HINTS
-              ${_GSS_LIBDIR_HINTS}
-          PATH_SUFFIXES
-              ${_GSS_LIBDIR_SUFFIXES}
-      )
-
+      if(_gss_INCLUDE_DIRS)
+        set(_gss_flavor "GNU")
+        set(_gss_pc_requires ${_gnu_modname})
+        set(_gss_libname "gss")
+      endif()
     endif()
+
+    # If we have headers, look up libraries
+    if(_gss_flavor)
+      set(_gss_libdir_hints ${_gss_root_hints})
+      if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+        cmake_path(GET _gss_INCLUDE_DIRS PARENT_PATH _gss_calculated_potential_root)
+      else()
+        get_filename_component(_gss_calculated_potential_root "${_gss_INCLUDE_DIRS}" DIRECTORY)
+      endif()
+      list(APPEND _gss_libdir_hints ${_gss_calculated_potential_root})
+
+      find_library(_gss_LIBRARIES NAMES ${_gss_libname} HINTS ${_gss_libdir_hints} PATH_SUFFIXES ${_gss_libdir_suffixes})
+    endif()
+  endif()
+  if(NOT _gss_flavor)
+    message(FATAL_ERROR "GNU or MIT GSS is required")
   endif()
 else()
-  if(_GSS_PKG_${_MIT_MODNAME}_VERSION)
-    set(GSS_FLAVOUR "MIT")
-    set(_GSS_VERSION _GSS_PKG_${_MIT_MODNAME}_VERSION)
+  if(_gss_MODULE_NAME STREQUAL _gnu_modname)
+    set(_gss_flavor "GNU")
+    set(_gss_pc_requires ${_gnu_modname})
+  elseif(_gss_MODULE_NAME STREQUAL _mit_modname)
+    set(_gss_flavor "MIT")
+    set(_gss_pc_requires ${_mit_modname})
   else()
-    set(GSS_FLAVOUR "Heimdal")
-    set(_GSS_VERSION _GSS_PKG_${_MIT_HEIMDAL}_VERSION)
+    message(FATAL_ERROR "GNU or MIT GSS is required")
   endif()
+  message(STATUS "Found GSS/${_gss_flavor} (via pkg-config): ${_gss_INCLUDE_DIRS} (found version \"${_gss_version}\")")
 endif()
 
-set(GSS_INCLUDE_DIR ${_GSS_INCLUDE_DIR})
-set(GSS_LIBRARIES ${_GSS_LIBRARIES})
-set(GSS_LINK_DIRECTORIES ${_GSS_LINK_DIRECTORIES})
-set(GSS_LINKER_FLAGS ${_GSS_LINKER_FLAGS})
-set(GSS_COMPILER_FLAGS ${_GSS_COMPILER_FLAGS})
-set(GSS_VERSION ${_GSS_VERSION})
+set(GSS_VERSION ${_gss_version})
 
-if(GSS_FLAVOUR)
-  if(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "Heimdal")
-    if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.amd64.manifest")
+if(NOT GSS_VERSION)
+  if(_gss_flavor STREQUAL "MIT" AND WIN32)
+    if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.24)
+      cmake_host_system_information(RESULT _mit_version QUERY WINDOWS_REGISTRY
+        "HKLM/SOFTWARE/MIT/Kerberos/SDK/CurrentVersion" VALUE "VersionString")
     else()
-      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.x86.manifest")
+      get_filename_component(_mit_version
+        "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME CACHE)
     endif()
-
-    if(EXISTS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}")
-      file(STRINGS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}" heimdal_version_str
-           REGEX "^.*version=\"[0-9]\\.[^\"]+\".*$")
-
-      string(REGEX MATCH "[0-9]\\.[^\"]+"
-             GSS_VERSION "${heimdal_version_str}")
-    endif()
-
-    if(NOT GSS_VERSION)
-      set(GSS_VERSION "Heimdal Unknown")
-    endif()
-  elseif(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "MIT")
-    get_filename_component(_MIT_VERSION "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME CACHE)
-    if(WIN32 AND _MIT_VERSION)
-      set(GSS_VERSION "${_MIT_VERSION}")
-    else()
-      set(GSS_VERSION "MIT Unknown")
+    set(GSS_VERSION "${_mit_version}")
+  elseif(_gss_flavor STREQUAL "GNU")
+    if(_gss_INCLUDE_DIRS AND EXISTS "${_gss_INCLUDE_DIRS}/gss.h")
+      set(_version_regex "#[\t ]*define[\t ]+GSS_VERSION[\t ]+\"([^\"]*)\"")
+      file(STRINGS "${_gss_INCLUDE_DIRS}/gss.h" _version_str REGEX "${_version_regex}")
+      string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+      set(GSS_VERSION "${_version_str}")
+      unset(_version_regex)
+      unset(_version_str)
     endif()
   endif()
 endif()
 
 include(FindPackageHandleStandardArgs)
-
-set(_GSS_REQUIRED_VARS GSS_LIBRARIES GSS_FLAVOUR)
-
 find_package_handle_standard_args(GSS
-    REQUIRED_VARS
-        ${_GSS_REQUIRED_VARS}
-    VERSION_VAR
-        GSS_VERSION
-    FAIL_MESSAGE
-        "Could NOT find GSS, try to set the path to GSS root folder in the system variable GSS_ROOT_DIR"
+  REQUIRED_VARS
+    _gss_flavor
+    _gss_LIBRARIES
+  VERSION_VAR
+    GSS_VERSION
+  FAIL_MESSAGE
+    "Could NOT find GSS, try to set the absolute path to GSS installation root directory in the environment variable GSS_ROOT_DIR"
 )
 
-mark_as_advanced(GSS_INCLUDE_DIR GSS_LIBRARIES)
+mark_as_advanced(
+  _gss_CFLAGS
+  _gss_FOUND
+  _gss_INCLUDE_DIRS
+  _gss_LIBRARIES
+  _gss_LIBRARY_DIRS
+  _gss_MODULE_NAME
+  _gss_PREFIX
+  _gss_version
+)
+
+if(GSS_FOUND)
+  if(NOT TARGET CURL::gss)
+    add_library(CURL::gss INTERFACE IMPORTED)
+    set_target_properties(CURL::gss PROPERTIES
+      INTERFACE_CURL_GSS_FLAVOR "${_gss_flavor}"
+      INTERFACE_LIBCURL_PC_MODULES "${_gss_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_gss_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_gss_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_gss_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_gss_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindGnuTLS.cmake

@@ -0,0 +1,92 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the GnuTLS library
+#
+# Input variables:
+#
+# - `GNUTLS_INCLUDE_DIR`:  Absolute path to GnuTLS include directory.
+# - `GNUTLS_LIBRARY`:      Absolute path to `gnutls` library.
+#
+# Defines:
+#
+# - `GNUTLS_FOUND`:        System has GnuTLS.
+# - `GNUTLS_VERSION`:      Version of GnuTLS.
+# - `CURL::gnutls`:        GnuTLS library target.
+
+set(_gnutls_pc_requires "gnutls")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED GNUTLS_INCLUDE_DIR AND
+   NOT DEFINED GNUTLS_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_gnutls ${_gnutls_pc_requires})
+endif()
+
+if(_gnutls_FOUND)
+  set(GnuTLS_FOUND TRUE)
+  set(GNUTLS_FOUND TRUE)
+  set(GNUTLS_VERSION ${_gnutls_VERSION})
+  message(STATUS "Found GnuTLS (via pkg-config): ${_gnutls_INCLUDE_DIRS} (found version \"${GNUTLS_VERSION}\")")
+else()
+  find_path(GNUTLS_INCLUDE_DIR NAMES "gnutls/gnutls.h")
+  find_library(GNUTLS_LIBRARY NAMES "gnutls" "libgnutls")
+
+  unset(GNUTLS_VERSION CACHE)
+  if(GNUTLS_INCLUDE_DIR AND EXISTS "${GNUTLS_INCLUDE_DIR}/gnutls/gnutls.h")
+    set(_version_regex "#[\t ]*define[\t ]+GNUTLS_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${GNUTLS_INCLUDE_DIR}/gnutls/gnutls.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(GNUTLS_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(GnuTLS
+    REQUIRED_VARS
+      GNUTLS_INCLUDE_DIR
+      GNUTLS_LIBRARY
+    VERSION_VAR
+      GNUTLS_VERSION
+  )
+
+  if(GNUTLS_FOUND)
+    set(_gnutls_INCLUDE_DIRS ${GNUTLS_INCLUDE_DIR})
+    set(_gnutls_LIBRARIES    ${GNUTLS_LIBRARY})
+  endif()
+
+  mark_as_advanced(GNUTLS_INCLUDE_DIR GNUTLS_LIBRARY)
+endif()
+
+if(GNUTLS_FOUND)
+  if(NOT TARGET CURL::gnutls)
+    add_library(CURL::gnutls INTERFACE IMPORTED)
+    set_target_properties(CURL::gnutls PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_gnutls_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_gnutls_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_gnutls_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_gnutls_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_gnutls_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLDAP.cmake

@@ -0,0 +1,115 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the ldap library
+#
+# Input variables:
+#
+# - `LDAP_INCLUDE_DIR`:   Absolute path to ldap include directory.
+# - `LDAP_LIBRARY`:       Absolute path to `ldap` library.
+# - `LDAP_LBER_LIBRARY`:  Absolute path to `lber` library.
+#
+# Defines:
+#
+# - `LDAP_FOUND`:         System has ldap.
+# - `LDAP_VERSION`:       Version of ldap.
+# - `CURL::ldap`:         ldap library target.
+
+set(_ldap_pc_requires "ldap" "lber")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LDAP_INCLUDE_DIR AND
+   NOT DEFINED LDAP_LIBRARY AND
+   NOT DEFINED LDAP_LBER_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_ldap ${_ldap_pc_requires})
+endif()
+
+if(_ldap_FOUND)
+  set(LDAP_FOUND TRUE)
+  set(LDAP_VERSION ${_ldap_ldap_VERSION})
+  message(STATUS "Found LDAP (via pkg-config): ${_ldap_INCLUDE_DIRS} (found version \"${LDAP_VERSION}\")")
+else()
+  set(_ldap_pc_requires "")  # Depend on pkg-config only when found via pkg-config
+
+  # On Apple the SDK LDAP gets picked up from
+  # 'MacOSX.sdk/System/Library/Frameworks/LDAP.framework/Headers', which contains
+  # ldap.h and lber.h both being stubs to include <ldap.h> and <lber.h>.
+  # This causes an infinite inclusion loop in compile. Also do this for libraries
+  # to avoid picking up the 'ldap.framework' with a full path.
+  set(_save_cmake_system_framework_path ${CMAKE_SYSTEM_FRAMEWORK_PATH})
+  set(CMAKE_SYSTEM_FRAMEWORK_PATH "")
+  find_path(LDAP_INCLUDE_DIR NAMES "ldap.h")
+  find_library(LDAP_LIBRARY NAMES "ldap")
+  find_library(LDAP_LBER_LIBRARY NAMES "lber")
+  set(CMAKE_SYSTEM_FRAMEWORK_PATH ${_save_cmake_system_framework_path})
+
+  unset(LDAP_VERSION CACHE)
+  if(LDAP_INCLUDE_DIR AND EXISTS "${LDAP_INCLUDE_DIR}/ldap_features.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_PATCH[\t ]+([0-9]+).*")
+    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(LDAP_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(LDAP
+    REQUIRED_VARS
+      LDAP_INCLUDE_DIR
+      LDAP_LIBRARY
+      LDAP_LBER_LIBRARY
+    VERSION_VAR
+      LDAP_VERSION
+  )
+
+  if(LDAP_FOUND)
+    set(_ldap_INCLUDE_DIRS ${LDAP_INCLUDE_DIR})
+    set(_ldap_LIBRARIES    ${LDAP_LIBRARY} ${LDAP_LBER_LIBRARY})
+  endif()
+
+  mark_as_advanced(LDAP_INCLUDE_DIR LDAP_LIBRARY LDAP_LBER_LIBRARY)
+endif()
+
+if(LDAP_FOUND)
+  if(NOT TARGET CURL::ldap)
+    add_library(CURL::ldap INTERFACE IMPORTED)
+    set_target_properties(CURL::ldap PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_ldap_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_ldap_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_ldap_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_ldap_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_ldap_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLibPSL.cmake

@@ -21,25 +21,72 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Try to find the libpsl library
-# Once done this will define
+# Find the libpsl library
 #
-# LIBPSL_FOUND - system has the libpsl library
-# LIBPSL_INCLUDE_DIR - the libpsl include directory
-# LIBPSL_LIBRARY - the libpsl library name
+# Input variables:
+#
+# - `LIBPSL_INCLUDE_DIR`:  Absolute path to libpsl include directory.
+# - `LIBPSL_LIBRARY`:      Absolute path to `libpsl` library.
+#
+# Defines:
+#
+# - `LIBPSL_FOUND`:        System has libpsl.
+# - `LIBPSL_VERSION`:      Version of libpsl.
+# - `CURL::libpsl`:        libpsl library target.
 
-find_path(LIBPSL_INCLUDE_DIR libpsl.h)
+set(_libpsl_pc_requires "libpsl")
 
-find_library(LIBPSL_LIBRARY NAMES psl libpsl)
-
-if(LIBPSL_INCLUDE_DIR)
-  file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" libpsl_version_str REGEX "^#define[\t ]+PSL_VERSION[\t ]+\"(.*)\"")
-  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBPSL_VERSION "${libpsl_version_str}")
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBPSL_INCLUDE_DIR AND
+   NOT DEFINED LIBPSL_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libpsl ${_libpsl_pc_requires})
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(LibPSL
-    REQUIRED_VARS LIBPSL_LIBRARY LIBPSL_INCLUDE_DIR
-    VERSION_VAR LIBPSL_VERSION)
+if(_libpsl_FOUND AND _libpsl_INCLUDE_DIRS)
+  set(Libpsl_FOUND TRUE)
+  set(LIBPSL_FOUND TRUE)
+  set(LIBPSL_VERSION ${_libpsl_VERSION})
+  message(STATUS "Found Libpsl (via pkg-config): ${_libpsl_INCLUDE_DIRS} (found version \"${LIBPSL_VERSION}\")")
+else()
+  find_path(LIBPSL_INCLUDE_DIR NAMES "libpsl.h")
+  find_library(LIBPSL_LIBRARY NAMES "psl" "libpsl")
 
-mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
+  unset(LIBPSL_VERSION CACHE)
+  if(LIBPSL_INCLUDE_DIR AND EXISTS "${LIBPSL_INCLUDE_DIR}/libpsl.h")
+    set(_version_regex "#[\t ]*define[\t ]+PSL_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBPSL_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libpsl
+    REQUIRED_VARS
+      LIBPSL_INCLUDE_DIR
+      LIBPSL_LIBRARY
+    VERSION_VAR
+      LIBPSL_VERSION
+  )
+
+  if(LIBPSL_FOUND)
+    set(_libpsl_INCLUDE_DIRS ${LIBPSL_INCLUDE_DIR})
+    set(_libpsl_LIBRARIES    ${LIBPSL_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
+endif()
+
+if(LIBPSL_FOUND)
+  if(NOT TARGET CURL::libpsl)
+    add_library(CURL::libpsl INTERFACE IMPORTED)
+    set_target_properties(CURL::libpsl PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libpsl_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libpsl_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libpsl_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libpsl_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libpsl_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLibSSH2.cmake

@@ -21,25 +21,97 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# - Try to find the libssh2 library
-# Once done this will define
+# Find the libssh2 library
 #
-# LIBSSH2_FOUND - system has the libssh2 library
-# LIBSSH2_INCLUDE_DIR - the libssh2 include directory
-# LIBSSH2_LIBRARY - the libssh2 library name
+# Input variables:
+#
+# - `LIBSSH2_INCLUDE_DIR`:      Absolute path to libssh2 include directory.
+# - `LIBSSH2_LIBRARY`:          Absolute path to `libssh2` library.
+# - `LIBSSH2_USE_STATIC_LIBS`:  Configure for static libssh2 libraries.
+#
+# Defines:
+#
+# - `LIBSSH2_FOUND`:            System has libssh2.
+# - `LIBSSH2_VERSION`:          Version of libssh2.
+# - `CURL::libssh2`:            libssh2 library target.
 
-find_path(LIBSSH2_INCLUDE_DIR libssh2.h)
+set(_libssh2_pc_requires "libssh2")
 
-find_library(LIBSSH2_LIBRARY NAMES ssh2 libssh2)
-
-if(LIBSSH2_INCLUDE_DIR)
-  file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" libssh2_version_str REGEX "^#define[\t ]+LIBSSH2_VERSION[\t ]+\"(.*)\"")
-  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBSSH2_VERSION "${libssh2_version_str}")
+if(NOT DEFINED LIBSSH2_INCLUDE_DIR AND
+   NOT DEFINED LIBSSH2_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_libssh2 ${_libssh2_pc_requires})
+  endif()
+  if(NOT _libssh2_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(libssh2 CONFIG QUIET)
+  endif()
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(LibSSH2
-    REQUIRED_VARS LIBSSH2_LIBRARY LIBSSH2_INCLUDE_DIR
-    VERSION_VAR LIBSSH2_VERSION)
+if(_libssh2_FOUND AND _libssh2_INCLUDE_DIRS)
+  set(Libssh2_FOUND TRUE)
+  set(LIBSSH2_FOUND TRUE)
+  set(LIBSSH2_VERSION ${_libssh2_VERSION})
+  if(LIBSSH2_USE_STATIC_LIBS)
+    set(_libssh2_CFLAGS       "${_libssh2_STATIC_CFLAGS}")
+    set(_libssh2_INCLUDE_DIRS "${_libssh2_STATIC_INCLUDE_DIRS}")
+    set(_libssh2_LIBRARY_DIRS "${_libssh2_STATIC_LIBRARY_DIRS}")
+    set(_libssh2_LIBRARIES    "${_libssh2_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Libssh2 (via pkg-config): ${_libssh2_INCLUDE_DIRS} (found version \"${LIBSSH2_VERSION}\")")
+elseif(libssh2_CONFIG)
+  set(Libssh2_FOUND TRUE)
+  set(LIBSSH2_FOUND TRUE)
+  set(LIBSSH2_VERSION ${libssh2_VERSION})
+  if(LIBSSH2_USE_STATIC_LIBS)
+    set(_libssh2_LIBRARIES libssh2::libssh2_static)
+  else()
+    set(_libssh2_LIBRARIES libssh2::libssh2)
+  endif()
+  message(STATUS "Found Libssh2 (via CMake Config): ${libssh2_CONFIG} (found version \"${LIBSSH2_VERSION}\")")
+else()
+  find_path(LIBSSH2_INCLUDE_DIR NAMES "libssh2.h")
+  if(LIBSSH2_USE_STATIC_LIBS)
+    find_library(LIBSSH2_LIBRARY NAMES "ssh2_static" "libssh2_static" "ssh2" "libssh2")
+  else()
+    find_library(LIBSSH2_LIBRARY NAMES "ssh2" "libssh2")
+  endif()
 
-mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
+  unset(LIBSSH2_VERSION CACHE)
+  if(LIBSSH2_INCLUDE_DIR AND EXISTS "${LIBSSH2_INCLUDE_DIR}/libssh2.h")
+    set(_version_regex "#[\t ]*define[\t ]+LIBSSH2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBSSH2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libssh2
+    REQUIRED_VARS
+      LIBSSH2_INCLUDE_DIR
+      LIBSSH2_LIBRARY
+    VERSION_VAR
+      LIBSSH2_VERSION
+  )
+
+  if(LIBSSH2_FOUND)
+    set(_libssh2_INCLUDE_DIRS ${LIBSSH2_INCLUDE_DIR})
+    set(_libssh2_LIBRARIES    ${LIBSSH2_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
+endif()
+
+if(LIBSSH2_FOUND)
+  if(NOT TARGET CURL::libssh2)
+    add_library(CURL::libssh2 INTERFACE IMPORTED)
+    set_target_properties(CURL::libssh2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libssh2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libssh2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libssh2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libssh2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libssh2_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLibbacktrace.cmake

@@ -0,0 +1,61 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libbacktrace library
+#
+# Input variables:
+#
+# - `LIBBACKTRACE_INCLUDE_DIR`:  Absolute path to libbacktrace include directory.
+# - `LIBBACKTRACE_LIBRARY`:      Absolute path to `libbacktrace` library.
+#
+# Defines:
+#
+# - `LIBBACKTRACE_FOUND`:        System has libbacktrace.
+# - `CURL::libbacktrace`:        libbacktrace library target.
+
+find_path(LIBBACKTRACE_INCLUDE_DIR NAMES "backtrace.h")
+find_library(LIBBACKTRACE_LIBRARY NAMES "backtrace" "libbacktrace")
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Libbacktrace
+  REQUIRED_VARS
+    LIBBACKTRACE_INCLUDE_DIR
+    LIBBACKTRACE_LIBRARY
+)
+
+if(LIBBACKTRACE_FOUND)
+  set(_libbacktrace_INCLUDE_DIRS ${LIBBACKTRACE_INCLUDE_DIR})
+  set(_libbacktrace_LIBRARIES    ${LIBBACKTRACE_LIBRARY})
+
+  if(NOT TARGET CURL::libbacktrace)
+    add_library(CURL::libbacktrace INTERFACE IMPORTED)
+    set_target_properties(CURL::libbacktrace PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libbacktrace_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libbacktrace_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libbacktrace_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libbacktrace_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libbacktrace_LIBRARIES}")
+  endif()
+endif()
+
+mark_as_advanced(LIBBACKTRACE_INCLUDE_DIR LIBBACKTRACE_LIBRARY)

third-party/curl/CMake/FindLibgsasl.cmake

@@ -0,0 +1,91 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libgsasl library
+#
+# Input variables:
+#
+# - `LIBGSASL_INCLUDE_DIR`:  Absolute path to libgsasl include directory.
+# - `LIBGSASL_LIBRARY`:      Absolute path to `libgsasl` library.
+#
+# Defines:
+#
+# - `LIBGSASL_FOUND`:        System has libgsasl.
+# - `LIBGSASL_VERSION`:      Version of libgsasl.
+# - `CURL::libgsasl`:        libgsasl library target.
+
+set(_libgsasl_pc_requires "libgsasl")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBGSASL_INCLUDE_DIR AND
+   NOT DEFINED LIBGSASL_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libgsasl ${_libgsasl_pc_requires})
+endif()
+
+if(_libgsasl_FOUND)
+  set(Libgsasl_FOUND TRUE)
+  set(LIBGSASL_FOUND TRUE)
+  message(STATUS "Found Libgsasl (via pkg-config): ${_libgsasl_INCLUDE_DIRS} (found version \"${LIBGSASL_VERSION}\")")
+else()
+  find_path(LIBGSASL_INCLUDE_DIR NAMES "gsasl.h")
+  find_library(LIBGSASL_LIBRARY NAMES "gsasl" "libgsasl")
+
+  unset(LIBGSASL_VERSION CACHE)
+  if(LIBGSASL_INCLUDE_DIR AND EXISTS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h")
+    set(_version_regex "#[\t ]*define[\t ]+GSASL_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBGSASL_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libgsasl
+  REQUIRED_VARS
+    LIBGSASL_INCLUDE_DIR
+    LIBGSASL_LIBRARY
+  VERSION_VAR
+    LIBGSASL_VERSION
+  )
+
+  if(LIBGSASL_FOUND)
+    set(_libgsasl_INCLUDE_DIRS ${LIBGSASL_INCLUDE_DIR})
+    set(_libgsasl_LIBRARIES    ${LIBGSASL_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBGSASL_INCLUDE_DIR LIBGSASL_LIBRARY)
+endif()
+
+if(LIBGSASL_FOUND)
+  if(NOT TARGET CURL::libgsasl)
+    add_library(CURL::libgsasl INTERFACE IMPORTED)
+    set_target_properties(CURL::libgsasl PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libgsasl_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libgsasl_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libgsasl_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libgsasl_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libgsasl_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLibidn2.cmake

@@ -0,0 +1,92 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libidn2 library
+#
+# Input variables:
+#
+# - `LIBIDN2_INCLUDE_DIR`:  Absolute path to libidn2 include directory.
+# - `LIBIDN2_LIBRARY`:      Absolute path to `libidn2` library.
+#
+# Defines:
+#
+# - `LIBIDN2_FOUND`:        System has libidn2.
+# - `LIBIDN2_VERSION`:      Version of libidn2.
+# - `CURL::libidn2`:        libidn2 library target.
+
+set(_libidn2_pc_requires "libidn2")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBIDN2_INCLUDE_DIR AND
+   NOT DEFINED LIBIDN2_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libidn2 ${_libidn2_pc_requires})
+endif()
+
+if(_libidn2_FOUND)
+  set(Libidn2_FOUND TRUE)
+  set(LIBIDN2_FOUND TRUE)
+  set(LIBIDN2_VERSION ${_libidn2_VERSION})
+  message(STATUS "Found Libidn2 (via pkg-config): ${_libidn2_INCLUDE_DIRS} (found version \"${LIBIDN2_VERSION}\")")
+else()
+  find_path(LIBIDN2_INCLUDE_DIR NAMES "idn2.h")
+  find_library(LIBIDN2_LIBRARY NAMES "idn2" "libidn2")
+
+  unset(LIBIDN2_VERSION CACHE)
+  if(LIBIDN2_INCLUDE_DIR AND EXISTS "${LIBIDN2_INCLUDE_DIR}/idn2.h")
+    set(_version_regex "#[\t ]*define[\t ]+IDN2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${LIBIDN2_INCLUDE_DIR}/idn2.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(LIBIDN2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libidn2
+    REQUIRED_VARS
+      LIBIDN2_INCLUDE_DIR
+      LIBIDN2_LIBRARY
+    VERSION_VAR
+      LIBIDN2_VERSION
+  )
+
+  if(LIBIDN2_FOUND)
+    set(_libidn2_INCLUDE_DIRS ${LIBIDN2_INCLUDE_DIR})
+    set(_libidn2_LIBRARIES    ${LIBIDN2_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBIDN2_INCLUDE_DIR LIBIDN2_LIBRARY)
+endif()
+
+if(LIBIDN2_FOUND)
+  if(NOT TARGET CURL::libidn2)
+    add_library(CURL::libidn2 INTERFACE IMPORTED)
+    set_target_properties(CURL::libidn2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libidn2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libidn2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libidn2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libidn2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libidn2_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLibssh.cmake

@@ -0,0 +1,118 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libssh library
+#
+# Input variables:
+#
+# - `LIBSSH_INCLUDE_DIR`:      Absolute path to libssh include directory.
+# - `LIBSSH_LIBRARY`:          Absolute path to `libssh` library.
+# - `LIBSSH_USE_STATIC_LIBS`:  Configure for static libssh libraries.
+#
+# Defines:
+#
+# - `LIBSSH_FOUND`:            System has libssh.
+# - `LIBSSH_VERSION`:          Version of libssh.
+# - `CURL::libssh`:            libssh library target.
+
+set(_libssh_pc_requires "libssh")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBSSH_INCLUDE_DIR AND
+   NOT DEFINED LIBSSH_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libssh ${_libssh_pc_requires})
+endif()
+
+if(_libssh_FOUND)
+  set(Libssh_FOUND TRUE)
+  set(LIBSSH_FOUND TRUE)
+  set(LIBSSH_VERSION ${_libssh_VERSION})
+  if(LIBSSH_USE_STATIC_LIBS)
+    set(_libssh_CFLAGS       "${_libssh_STATIC_CFLAGS}")
+    set(_libssh_INCLUDE_DIRS "${_libssh_STATIC_INCLUDE_DIRS}")
+    set(_libssh_LIBRARY_DIRS "${_libssh_STATIC_LIBRARY_DIRS}")
+    set(_libssh_LIBRARIES    "${_libssh_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found Libssh (via pkg-config): ${_libssh_INCLUDE_DIRS} (found version \"${LIBSSH_VERSION}\")")
+else()
+  find_path(LIBSSH_INCLUDE_DIR NAMES "libssh/libssh.h")
+  if(LIBSSH_USE_STATIC_LIBS)
+    set(_libssh_CFLAGS "-DLIBSSH_STATIC")
+    find_library(LIBSSH_LIBRARY NAMES "ssh_static" "libssh_static" "ssh" "libssh")
+  else()
+    find_library(LIBSSH_LIBRARY NAMES "ssh" "libssh")
+  endif()
+
+  unset(LIBSSH_VERSION CACHE)
+  if(LIBSSH_INCLUDE_DIR AND EXISTS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+LIBSSH_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+LIBSSH_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+LIBSSH_VERSION_MICRO[\t ]+([0-9]+).*")
+    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(LIBSSH_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libssh
+    REQUIRED_VARS
+      LIBSSH_INCLUDE_DIR
+      LIBSSH_LIBRARY
+    VERSION_VAR
+      LIBSSH_VERSION
+  )
+
+  if(LIBSSH_FOUND)
+    set(_libssh_INCLUDE_DIRS ${LIBSSH_INCLUDE_DIR})
+    set(_libssh_LIBRARIES    ${LIBSSH_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBSSH_INCLUDE_DIR LIBSSH_LIBRARY)
+endif()
+
+if(LIBSSH_FOUND)
+  if(WIN32)
+    list(APPEND _libssh_LIBRARIES "iphlpapi")  # for if_nametoindex
+  endif()
+
+  if(NOT TARGET CURL::libssh)
+    add_library(CURL::libssh INTERFACE IMPORTED)
+    set_target_properties(CURL::libssh PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libssh_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libssh_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libssh_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libssh_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libssh_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindLibuv.cmake

@@ -0,0 +1,102 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the libuv library
+#
+# Input variables:
+#
+# - `LIBUV_INCLUDE_DIR`:  Absolute path to libuv include directory.
+# - `LIBUV_LIBRARY`:      Absolute path to `libuv` library.
+#
+# Defines:
+#
+# - `LIBUV_FOUND`:        System has libuv.
+# - `LIBUV_VERSION`:      Version of libuv.
+# - `CURL::libuv`:        libuv library target.
+
+set(_libuv_pc_requires "libuv")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED LIBUV_INCLUDE_DIR AND
+   NOT DEFINED LIBUV_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_libuv ${_libuv_pc_requires})
+endif()
+
+if(_libuv_FOUND)
+  set(Libuv_FOUND TRUE)
+  set(LIBUV_FOUND TRUE)
+  set(LIBUV_VERSION ${_libuv_VERSION})
+  message(STATUS "Found Libuv (via pkg-config): ${_libuv_INCLUDE_DIRS} (found version \"${LIBUV_VERSION}\")")
+else()
+  find_path(LIBUV_INCLUDE_DIR NAMES "uv.h")
+  find_library(LIBUV_LIBRARY NAMES "uv" "libuv")
+
+  unset(LIBUV_VERSION CACHE)
+  if(LIBUV_INCLUDE_DIR AND EXISTS "${LIBUV_INCLUDE_DIR}/uv/version.h")
+    set(_version_regex1 "#[\t ]*define[\t ]+UV_VERSION_MAJOR[\t ]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[\t ]+UV_VERSION_MINOR[\t ]+([0-9]+).*")
+    set(_version_regex3 "#[\t ]*define[\t ]+UV_VERSION_PATCH[\t ]+([0-9]+).*")
+    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str2 REGEX "${_version_regex2}")
+    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str3 REGEX "${_version_regex3}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
+    set(LIBUV_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_regex3)
+    unset(_version_str1)
+    unset(_version_str2)
+    unset(_version_str3)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Libuv
+    REQUIRED_VARS
+      LIBUV_INCLUDE_DIR
+      LIBUV_LIBRARY
+    VERSION_VAR
+      LIBUV_VERSION
+  )
+
+  if(LIBUV_FOUND)
+    set(_libuv_INCLUDE_DIRS ${LIBUV_INCLUDE_DIR})
+    set(_libuv_LIBRARIES    ${LIBUV_LIBRARY})
+  endif()
+
+  mark_as_advanced(LIBUV_INCLUDE_DIR LIBUV_LIBRARY)
+endif()
+
+if(LIBUV_FOUND)
+  if(NOT TARGET CURL::libuv)
+    add_library(CURL::libuv INTERFACE IMPORTED)
+    set_target_properties(CURL::libuv PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_libuv_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_libuv_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_libuv_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_libuv_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_libuv_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindMSH3.cmake

@@ -1,70 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-#[=======================================================================[.rst:
-FindMSH3
-----------
-
-Find the msh3 library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``MSH3_FOUND``
-  System has msh3
-``MSH3_INCLUDE_DIRS``
-  The msh3 include directories.
-``MSH3_LIBRARIES``
-  The libraries needed to use msh3
-#]=======================================================================]
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_MSH3 libmsh3)
-endif()
-
-find_path(MSH3_INCLUDE_DIR msh3.h
-  HINTS
-    ${PC_MSH3_INCLUDEDIR}
-    ${PC_MSH3_INCLUDE_DIRS}
-)
-
-find_library(MSH3_LIBRARY NAMES msh3
-  HINTS
-    ${PC_MSH3_LIBDIR}
-    ${PC_MSH3_LIBRARY_DIRS}
-)
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(MSH3
-  REQUIRED_VARS
-    MSH3_LIBRARY
-    MSH3_INCLUDE_DIR
-)
-
-if(MSH3_FOUND)
-  set(MSH3_LIBRARIES    ${MSH3_LIBRARY})
-  set(MSH3_INCLUDE_DIRS ${MSH3_INCLUDE_DIR})
-endif()
-
-mark_as_advanced(MSH3_INCLUDE_DIRS MSH3_LIBRARIES)

third-party/curl/CMake/FindMbedTLS.cmake

@@ -21,16 +21,117 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-find_path(MBEDTLS_INCLUDE_DIRS mbedtls/ssl.h)
+# Find the mbedTLS library
+#
+# Input variables:
+#
+# - `MBEDTLS_INCLUDE_DIR`:      Absolute path to mbedTLS include directory.
+# - `MBEDTLS_LIBRARY`:          Absolute path to `mbedtls` library.
+# - `MBEDX509_LIBRARY`:         Absolute path to `mbedx509` library.
+# - `MBEDCRYPTO_LIBRARY`:       Absolute path to `mbedcrypto` library.
+# - `MBEDTLS_USE_STATIC_LIBS`:  Configure for static mbedTLS libraries.
+#
+# Defines:
+#
+# - `MBEDTLS_FOUND`:            System has mbedTLS.
+# - `MBEDTLS_VERSION`:          Version of mbedTLS.
+# - `CURL::mbedtls`:            mbedTLS library target.
 
-find_library(MBEDTLS_LIBRARY mbedtls)
-find_library(MBEDX509_LIBRARY mbedx509)
-find_library(MBEDCRYPTO_LIBRARY mbedcrypto)
+if(DEFINED MBEDTLS_INCLUDE_DIRS AND NOT DEFINED MBEDTLS_INCLUDE_DIR)
+  message(WARNING "MBEDTLS_INCLUDE_DIRS is deprecated, use MBEDTLS_INCLUDE_DIR instead.")
+  set(MBEDTLS_INCLUDE_DIR "${MBEDTLS_INCLUDE_DIRS}")
+  unset(MBEDTLS_INCLUDE_DIRS)
+endif()
 
-set(MBEDTLS_LIBRARIES "${MBEDTLS_LIBRARY}" "${MBEDX509_LIBRARY}" "${MBEDCRYPTO_LIBRARY}")
+set(_mbedtls_pc_requires "mbedtls" "mbedx509" "mbedcrypto")
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(MbedTLS DEFAULT_MSG
-    MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
+if(NOT DEFINED MBEDTLS_INCLUDE_DIR AND
+   NOT DEFINED MBEDTLS_LIBRARY AND
+   NOT DEFINED MBEDX509_LIBRARY AND
+   NOT DEFINED MBEDCRYPTO_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_mbedtls ${_mbedtls_pc_requires})
+  endif()
+  if(NOT _mbedtls_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(MbedTLS CONFIG QUIET)
+  endif()
+endif()
 
-mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
+if(_mbedtls_FOUND)
+  set(MbedTLS_FOUND TRUE)
+  set(MBEDTLS_FOUND TRUE)
+  set(MBEDTLS_VERSION ${_mbedtls_mbedtls_VERSION})
+  if(MBEDTLS_USE_STATIC_LIBS)
+    set(_mbedtls_CFLAGS       "${_mbedtls_STATIC_CFLAGS}")
+    set(_mbedtls_INCLUDE_DIRS "${_mbedtls_STATIC_INCLUDE_DIRS}")
+    set(_mbedtls_LIBRARY_DIRS "${_mbedtls_STATIC_LIBRARY_DIRS}")
+    set(_mbedtls_LIBRARIES    "${_mbedtls_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found MbedTLS (via pkg-config): ${_mbedtls_INCLUDE_DIRS} (found version \"${MBEDTLS_VERSION}\")")
+elseif(MbedTLS_CONFIG)
+  set(MbedTLS_FOUND TRUE)
+  set(MBEDTLS_FOUND TRUE)
+  set(MBEDTLS_VERSION ${MbedTLS_VERSION})
+  if(MBEDTLS_VERSION GREATER_EQUAL 4.0.0)
+    set(_mbedtls_LIBRARIES MbedTLS::tfpsacrypto)
+  else()
+    set(_mbedtls_LIBRARIES MbedTLS::mbedcrypto)
+  endif()
+  list(APPEND _mbedtls_LIBRARIES MbedTLS::mbedx509 MbedTLS::mbedtls)
+  message(STATUS "Found MbedTLS (via CMake Config): ${MbedTLS_CONFIG} (found version \"${MBEDTLS_VERSION}\")")
+else()
+  set(_mbedtls_pc_requires "")  # Depend on pkg-config only when found via pkg-config
+
+  find_path(MBEDTLS_INCLUDE_DIR NAMES "mbedtls/ssl.h")
+  if(MBEDTLS_USE_STATIC_LIBS)
+    find_library(MBEDTLS_LIBRARY NAMES "mbedtls_static" "libmbedtls_static" "mbedtls" "libmbedtls")
+    find_library(MBEDX509_LIBRARY NAMES "mbedx509_static" "libmbedx509_static" "mbedx509" "libmbedx509")
+    find_library(MBEDCRYPTO_LIBRARY NAMES "mbedcrypto_static" "libmbedcrypto_static" "mbedcrypto" "libmbedcrypto"
+      "tfpsacrypto_static" "libtfpsacrypto_static" "tfpsacrypto" "libtfpsacrypto")
+  else()
+    find_library(MBEDTLS_LIBRARY NAMES "mbedtls" "libmbedtls")
+    find_library(MBEDX509_LIBRARY NAMES "mbedx509" "libmbedx509")
+    find_library(MBEDCRYPTO_LIBRARY NAMES "mbedcrypto" "libmbedcrypto" "tfpsacrypto" "libtfpsacrypto")
+  endif()
+
+  unset(MBEDTLS_VERSION CACHE)
+  if(MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
+    set(_version_regex "#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"([0-9.]+)\"")
+    file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(MBEDTLS_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(MbedTLS
+    REQUIRED_VARS
+      MBEDTLS_INCLUDE_DIR
+      MBEDTLS_LIBRARY
+      MBEDX509_LIBRARY
+      MBEDCRYPTO_LIBRARY
+    VERSION_VAR
+      MBEDTLS_VERSION
+  )
+
+  if(MBEDTLS_FOUND)
+    set(_mbedtls_INCLUDE_DIRS ${MBEDTLS_INCLUDE_DIR})
+    set(_mbedtls_LIBRARIES    ${MBEDTLS_LIBRARY} ${MBEDX509_LIBRARY} ${MBEDCRYPTO_LIBRARY})
+  endif()
+
+  mark_as_advanced(MBEDTLS_INCLUDE_DIR MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
+endif()
+
+if(MBEDTLS_FOUND)
+  if(NOT TARGET CURL::mbedtls)
+    add_library(CURL::mbedtls INTERFACE IMPORTED)
+    set_target_properties(CURL::mbedtls PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_mbedtls_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_mbedtls_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_mbedtls_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_mbedtls_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_mbedtls_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindNGHTTP2.cmake

@@ -21,21 +21,96 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-include(FindPackageHandleStandardArgs)
+# Find the nghttp2 library
+#
+# Input variables:
+#
+# - `NGHTTP2_INCLUDE_DIR`:      Absolute path to nghttp2 include directory.
+# - `NGHTTP2_LIBRARY`:          Absolute path to `nghttp2` library.
+# - `NGHTTP2_USE_STATIC_LIBS`:  Configure for static nghttp2 libraries.
+#
+# Defines:
+#
+# - `NGHTTP2_FOUND`:            System has nghttp2.
+# - `NGHTTP2_VERSION`:          Version of nghttp2.
+# - `CURL::nghttp2`:            nghttp2 library target.
 
-find_path(NGHTTP2_INCLUDE_DIR "nghttp2/nghttp2.h")
+set(_nghttp2_pc_requires "libnghttp2")
 
-find_library(NGHTTP2_LIBRARY NAMES nghttp2)
+if(NOT DEFINED NGHTTP2_INCLUDE_DIR AND
+   NOT DEFINED NGHTTP2_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_nghttp2 ${_nghttp2_pc_requires})
+  endif()
+  if(NOT _nghttp2_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(nghttp2 CONFIG QUIET)
+  endif()
+endif()
 
-find_package_handle_standard_args(NGHTTP2
-    FOUND_VAR
-      NGHTTP2_FOUND
+if(_nghttp2_FOUND)
+  set(NGHTTP2_FOUND TRUE)
+  set(NGHTTP2_VERSION ${_nghttp2_VERSION})
+  if(NGHTTP2_USE_STATIC_LIBS)
+    set(_nghttp2_CFLAGS       "${_nghttp2_STATIC_CFLAGS}")
+    set(_nghttp2_INCLUDE_DIRS "${_nghttp2_STATIC_INCLUDE_DIRS}")
+    set(_nghttp2_LIBRARY_DIRS "${_nghttp2_STATIC_LIBRARY_DIRS}")
+    set(_nghttp2_LIBRARIES    "${_nghttp2_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found NGHTTP2 (via pkg-config): ${_nghttp2_INCLUDE_DIRS} (found version \"${NGHTTP2_VERSION}\")")
+elseif(nghttp2_CONFIG)
+  set(NGHTTP2_FOUND TRUE)
+  set(NGHTTP2_VERSION ${nghttp2_VERSION})
+  if(NGHTTP2_USE_STATIC_LIBS OR NOT TARGET nghttp2::nghttp2)
+    set(_nghttp2_LIBRARIES nghttp2::nghttp2_static)
+  else()
+    set(_nghttp2_LIBRARIES nghttp2::nghttp2)
+  endif()
+  message(STATUS "Found NGHTTP2 (via CMake Config): ${nghttp2_CONFIG} (found version \"${NGHTTP2_VERSION}\")")
+else()
+  find_path(NGHTTP2_INCLUDE_DIR NAMES "nghttp2/nghttp2.h")
+  if(NGHTTP2_USE_STATIC_LIBS)
+    set(_nghttp2_CFLAGS "-DNGHTTP2_STATICLIB")
+    find_library(NGHTTP2_LIBRARY NAMES "nghttp2_static" "nghttp2")
+  else()
+    find_library(NGHTTP2_LIBRARY NAMES "nghttp2" "nghttp2_static")
+  endif()
+
+  unset(NGHTTP2_VERSION CACHE)
+  if(NGHTTP2_INCLUDE_DIR AND EXISTS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h")
+    set(_version_regex "#[\t ]*define[\t ]+NGHTTP2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(NGHTTP2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(NGHTTP2
     REQUIRED_VARS
-      NGHTTP2_LIBRARY
       NGHTTP2_INCLUDE_DIR
-)
+      NGHTTP2_LIBRARY
+    VERSION_VAR
+      NGHTTP2_VERSION
+  )
 
-set(NGHTTP2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
-set(NGHTTP2_LIBRARIES ${NGHTTP2_LIBRARY})
+  if(NGHTTP2_FOUND)
+    set(_nghttp2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
+    set(_nghttp2_LIBRARIES    ${NGHTTP2_LIBRARY})
+  endif()
 
-mark_as_advanced(NGHTTP2_INCLUDE_DIRS NGHTTP2_LIBRARIES)
+  mark_as_advanced(NGHTTP2_INCLUDE_DIR NGHTTP2_LIBRARY)
+endif()
+
+if(NGHTTP2_FOUND)
+  if(NOT TARGET CURL::nghttp2)
+    add_library(CURL::nghttp2 INTERFACE IMPORTED)
+    set_target_properties(CURL::nghttp2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_nghttp2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_nghttp2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_nghttp2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_nghttp2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_nghttp2_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindNGHTTP3.cmake

@@ -21,58 +21,96 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the nghttp3 library
+#
+# Input variables:
+#
+# - `NGHTTP3_INCLUDE_DIR`:      Absolute path to nghttp3 include directory.
+# - `NGHTTP3_LIBRARY`:          Absolute path to `nghttp3` library.
+# - `NGHTTP3_USE_STATIC_LIBS`:  Configure for static nghttp3 libraries.
+#
+# Defines:
+#
+# - `NGHTTP3_FOUND`:            System has nghttp3.
+# - `NGHTTP3_VERSION`:          Version of nghttp3.
+# - `CURL::nghttp3`:            nghttp3 library target.
 
-#[=======================================================================[.rst:
-FindNGHTTP3
-----------
+set(_nghttp3_pc_requires "libnghttp3")
 
-Find the nghttp3 library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``NGHTTP3_FOUND``
-  System has nghttp3
-``NGHTTP3_INCLUDE_DIRS``
-  The nghttp3 include directories.
-``NGHTTP3_LIBRARIES``
-  The libraries needed to use nghttp3
-``NGHTTP3_VERSION``
-  version of nghttp3.
-#]=======================================================================]
-
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_NGHTTP3 libnghttp3)
+if(NOT DEFINED NGHTTP3_INCLUDE_DIR AND
+   NOT DEFINED NGHTTP3_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_nghttp3 ${_nghttp3_pc_requires})
+  endif()
+  if(NOT _nghttp3_FOUND AND CURL_USE_CMAKECONFIG)
+    find_package(nghttp3 CONFIG QUIET)
+  endif()
 endif()
 
-find_path(NGHTTP3_INCLUDE_DIR nghttp3/nghttp3.h
-  HINTS
-    ${PC_NGHTTP3_INCLUDEDIR}
-    ${PC_NGHTTP3_INCLUDE_DIRS}
-)
+if(_nghttp3_FOUND)
+  set(NGHTTP3_FOUND TRUE)
+  set(NGHTTP3_VERSION ${_nghttp3_VERSION})
+  if(NGHTTP3_USE_STATIC_LIBS)
+    set(_nghttp3_CFLAGS       "${_nghttp3_STATIC_CFLAGS}")
+    set(_nghttp3_INCLUDE_DIRS "${_nghttp3_STATIC_INCLUDE_DIRS}")
+    set(_nghttp3_LIBRARY_DIRS "${_nghttp3_STATIC_LIBRARY_DIRS}")
+    set(_nghttp3_LIBRARIES    "${_nghttp3_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found NGHTTP3 (via pkg-config): ${_nghttp3_INCLUDE_DIRS} (found version \"${NGHTTP3_VERSION}\")")
+elseif(nghttp3_CONFIG)
+  set(NGHTTP3_FOUND TRUE)
+  set(NGHTTP3_VERSION ${nghttp3_VERSION})
+  if(NGHTTP3_USE_STATIC_LIBS OR NOT TARGET nghttp3::nghttp3)
+    set(_nghttp3_LIBRARIES nghttp3::nghttp3_static)
+  else()
+    set(_nghttp3_LIBRARIES nghttp3::nghttp3)
+  endif()
+  message(STATUS "Found NGHTTP3 (via CMake Config): ${nghttp3_CONFIG} (found version \"${NGHTTP3_VERSION}\")")
+else()
+  find_path(NGHTTP3_INCLUDE_DIR NAMES "nghttp3/nghttp3.h")
+  if(NGHTTP3_USE_STATIC_LIBS)
+    set(_nghttp3_CFLAGS "-DNGHTTP3_STATICLIB")
+    find_library(NGHTTP3_LIBRARY NAMES "nghttp3_static" "nghttp3")
+  else()
+    find_library(NGHTTP3_LIBRARY NAMES "nghttp3")
+  endif()
 
-find_library(NGHTTP3_LIBRARY NAMES nghttp3
-  HINTS
-    ${PC_NGHTTP3_LIBDIR}
-    ${PC_NGHTTP3_LIBRARY_DIRS}
-)
+  unset(NGHTTP3_VERSION CACHE)
+  if(NGHTTP3_INCLUDE_DIR AND EXISTS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h")
+    set(_version_regex "#[\t ]*define[\t ]+NGHTTP3_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(NGHTTP3_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
 
-if(PC_NGHTTP3_VERSION)
-  set(NGHTTP3_VERSION ${PC_NGHTTP3_VERSION})
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(NGHTTP3
+    REQUIRED_VARS
+      NGHTTP3_INCLUDE_DIR
+      NGHTTP3_LIBRARY
+    VERSION_VAR
+      NGHTTP3_VERSION
+  )
+
+  if(NGHTTP3_FOUND)
+    set(_nghttp3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
+    set(_nghttp3_LIBRARIES    ${NGHTTP3_LIBRARY})
+  endif()
+
+  mark_as_advanced(NGHTTP3_INCLUDE_DIR NGHTTP3_LIBRARY)
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(NGHTTP3
-  REQUIRED_VARS
-    NGHTTP3_LIBRARY
-    NGHTTP3_INCLUDE_DIR
-  VERSION_VAR NGHTTP3_VERSION
-)
-
 if(NGHTTP3_FOUND)
-  set(NGHTTP3_LIBRARIES    ${NGHTTP3_LIBRARY})
-  set(NGHTTP3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
+  if(NOT TARGET CURL::nghttp3)
+    add_library(CURL::nghttp3 INTERFACE IMPORTED)
+    set_target_properties(CURL::nghttp3 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_nghttp3_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_nghttp3_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_nghttp3_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_nghttp3_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_nghttp3_LIBRARIES}")
+  endif()
 endif()
-
-mark_as_advanced(NGHTTP3_INCLUDE_DIRS NGHTTP3_LIBRARIES)

third-party/curl/CMake/FindNGTCP2.cmake

@@ -21,95 +21,167 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the ngtcp2 library
+#
+# This module accepts optional COMPONENTS to control the crypto library (these are
+# mutually exclusive):
+#
+# - BoringSSL:  Use `libngtcp2_crypto_boringssl`. (also for AWS-LC)
+# - GnuTLS:     Use `libngtcp2_crypto_gnutls`.
+# - LibreSSL:   Use `libngtcp2_crypto_libressl`. (requires ngtcp2 1.15.0+)
+# - ossl:       Use `libngtcp2_crypto_ossl`.
+# - quictls:    Use `libngtcp2_crypto_quictls`. (also for LibreSSL with ngtcp2 <1.15.0)
+# - wolfSSL:    Use `libngtcp2_crypto_wolfssl`.
+#
+# Input variables:
+#
+# - `NGTCP2_INCLUDE_DIR`:               Absolute path to ngtcp2 include directory.
+# - `NGTCP2_LIBRARY`:                   Absolute path to `ngtcp2` library.
+# - `NGTCP2_CRYPTO_BORINGSSL_LIBRARY`:  Absolute path to `ngtcp2_crypto_boringssl` library.
+# - `NGTCP2_CRYPTO_GNUTLS_LIBRARY`:     Absolute path to `ngtcp2_crypto_gnutls` library.
+# - `NGTCP2_CRYPTO_LIBRESSL_LIBRARY`:   Absolute path to `ngtcp2_crypto_libressl` library.
+# - `NGTCP2_CRYPTO_OSSL_LIBRARY`:       Absolute path to `ngtcp2_crypto_ossl` library.
+# - `NGTCP2_CRYPTO_QUICTLS_LIBRARY`:    Absolute path to `ngtcp2_crypto_quictls` library.
+# - `NGTCP2_CRYPTO_WOLFSSL_LIBRARY`:    Absolute path to `ngtcp2_crypto_wolfssl` library.
+# - `NGTCP2_USE_STATIC_LIBS`:           Configure for static ngtcp2 libraries.
+#
+# Defines:
+#
+# - `NGTCP2_FOUND`:                     System has ngtcp2.
+# - `NGTCP2_VERSION`:                   Version of ngtcp2.
+# - `NGTCP2_CRYPTO_BACKEND`:            Name of the crypto library component. (Empty if COMPONENTS was not used.)
+# - `CURL::ngtcp2`:                     ngtcp2 library target.
 
-#[=======================================================================[.rst:
-FindNGTCP2
-----------
-
-Find the ngtcp2 library
-
-This module accepts optional COMPONENTS to control the crypto library (these are
-mutually exclusive)::
-
-  OpenSSL:  Use libngtcp2_crypto_quictls
-  GnuTLS:   Use libngtcp2_crypto_gnutls
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``NGTCP2_FOUND``
-  System has ngtcp2
-``NGTCP2_INCLUDE_DIRS``
-  The ngtcp2 include directories.
-``NGTCP2_LIBRARIES``
-  The libraries needed to use ngtcp2
-``NGTCP2_VERSION``
-  version of ngtcp2.
-#]=======================================================================]
-
-if(UNIX)
-  find_package(PkgConfig QUIET)
-  pkg_search_module(PC_NGTCP2 libngtcp2)
-endif()
-
-find_path(NGTCP2_INCLUDE_DIR ngtcp2/ngtcp2.h
-  HINTS
-    ${PC_NGTCP2_INCLUDEDIR}
-    ${PC_NGTCP2_INCLUDE_DIRS}
-)
-
-find_library(NGTCP2_LIBRARY NAMES ngtcp2
-  HINTS
-    ${PC_NGTCP2_LIBDIR}
-    ${PC_NGTCP2_LIBRARY_DIRS}
-)
-
-if(PC_NGTCP2_VERSION)
-  set(NGTCP2_VERSION ${PC_NGTCP2_VERSION})
-endif()
-
+set(NGTCP2_CRYPTO_BACKEND "")
 if(NGTCP2_FIND_COMPONENTS)
-  set(NGTCP2_CRYPTO_BACKEND "")
-  foreach(component IN LISTS NGTCP2_FIND_COMPONENTS)
-    if(component MATCHES "^(BoringSSL|quictls|wolfSSL|GnuTLS)")
+  foreach(_component IN LISTS NGTCP2_FIND_COMPONENTS)
+    if(_component MATCHES "^(BoringSSL|GnuTLS|LibreSSL|ossl|quictls|wolfSSL)")
       if(NGTCP2_CRYPTO_BACKEND)
         message(FATAL_ERROR "NGTCP2: Only one crypto library can be selected")
       endif()
-      set(NGTCP2_CRYPTO_BACKEND ${component})
+      set(NGTCP2_CRYPTO_BACKEND ${_component})
     endif()
   endforeach()
 
   if(NGTCP2_CRYPTO_BACKEND)
-    string(TOLOWER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library)
-    if(UNIX)
-      pkg_search_module(PC_${_crypto_library} lib${_crypto_library})
-    endif()
-    find_library(${_crypto_library}_LIBRARY
-      NAMES
-        ${_crypto_library}
-      HINTS
-        ${PC_${_crypto_library}_LIBDIR}
-        ${PC_${_crypto_library}_LIBRARY_DIRS}
-    )
-    if(${_crypto_library}_LIBRARY)
-      set(NGTCP2_${NGTCP2_CRYPTO_BACKEND}_FOUND TRUE)
-      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library}_LIBRARY})
+    string(TOLOWER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library_lower)
+    string(TOUPPER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library_upper)
+  endif()
+endif()
+
+set(_ngtcp2_pc_requires "libngtcp2")
+if(NGTCP2_CRYPTO_BACKEND)
+  list(APPEND _ngtcp2_pc_requires "lib${_crypto_library_lower}")
+endif()
+
+set(_tried_pkgconfig FALSE)
+if(NOT DEFINED NGTCP2_INCLUDE_DIR AND
+   NOT DEFINED NGTCP2_LIBRARY)
+  if(CURL_USE_PKGCONFIG)
+    find_package(PkgConfig QUIET)
+    pkg_check_modules(_ngtcp2 ${_ngtcp2_pc_requires})
+    set(_tried_pkgconfig TRUE)
+  endif()
+  if(NOT _ngtcp2_FOUND AND CURL_USE_CMAKECONFIG AND NGTCP2_CRYPTO_BACKEND)
+    find_package(ngtcp2 CONFIG QUIET)
+    # Skip using it if the crypto library target is not available
+    if(ngtcp2_CONFIG AND
+       NOT TARGET ngtcp2::${_crypto_library_lower}_static AND
+       NOT TARGET ngtcp2::${_crypto_library_lower})
+      unset(ngtcp2_CONFIG)
     endif()
   endif()
 endif()
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(NGTCP2
-  REQUIRED_VARS
-    NGTCP2_LIBRARY
-    NGTCP2_INCLUDE_DIR
-  VERSION_VAR NGTCP2_VERSION
-  HANDLE_COMPONENTS
-)
+if(_ngtcp2_FOUND)
+  set(NGTCP2_FOUND TRUE)
+  set(NGTCP2_VERSION ${_ngtcp2_libngtcp2_VERSION})
+  if(NGTCP2_USE_STATIC_LIBS)
+    set(_ngtcp2_CFLAGS       "${_ngtcp2_STATIC_CFLAGS}")
+    set(_ngtcp2_INCLUDE_DIRS "${_ngtcp2_STATIC_INCLUDE_DIRS}")
+    set(_ngtcp2_LIBRARY_DIRS "${_ngtcp2_STATIC_LIBRARY_DIRS}")
+    set(_ngtcp2_LIBRARIES    "${_ngtcp2_STATIC_LIBRARIES}")
+  endif()
+  message(STATUS "Found NGTCP2 (via pkg-config): ${_ngtcp2_INCLUDE_DIRS} (found version \"${NGTCP2_VERSION}\")")
+elseif(ngtcp2_CONFIG)
+  set(NGTCP2_FOUND TRUE)
+  set(NGTCP2_VERSION ${ngtcp2_VERSION})
+  if(NGTCP2_USE_STATIC_LIBS OR NOT TARGET ngtcp2::ngtcp2)
+    set(_ngtcp2_LIBRARIES ngtcp2::ngtcp2_static ngtcp2::${_crypto_library_lower}_static)
+  else()
+    set(_ngtcp2_LIBRARIES ngtcp2::ngtcp2 ngtcp2::${_crypto_library_lower})
+  endif()
+  message(STATUS "Found NGTCP2 (via CMake Config): ${ngtcp2_CONFIG} (found version \"${NGTCP2_VERSION}\")")
+else()
+  find_path(NGTCP2_INCLUDE_DIR NAMES "ngtcp2/ngtcp2.h")
+  if(NGTCP2_USE_STATIC_LIBS)
+    set(_ngtcp2_CFLAGS "-DNGTCP2_STATICLIB")
+    find_library(NGTCP2_LIBRARY NAMES "ngtcp2_static" "ngtcp2")
+  else()
+    find_library(NGTCP2_LIBRARY NAMES "ngtcp2")
+  endif()
 
-if(NGTCP2_FOUND)
-  set(NGTCP2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
-  set(NGTCP2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
+  unset(NGTCP2_VERSION CACHE)
+  if(NGTCP2_INCLUDE_DIR AND EXISTS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h")
+    set(_version_regex "#[\t ]*define[\t ]+NGTCP2_VERSION[\t ]+\"([^\"]*)\"")
+    file(STRINGS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h" _version_str REGEX "${_version_regex}")
+    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
+    set(NGTCP2_VERSION "${_version_str}")
+    unset(_version_regex)
+    unset(_version_str)
+  endif()
+
+  if(NGTCP2_CRYPTO_BACKEND)
+    if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.20)
+      cmake_path(GET NGTCP2_LIBRARY PARENT_PATH _ngtcp2_library_dir)
+    else()
+      get_filename_component(_ngtcp2_library_dir "${NGTCP2_LIBRARY}" DIRECTORY)
+    endif()
+    if(NGTCP2_USE_STATIC_LIBS)
+      find_library(${_crypto_library_upper}_LIBRARY NAMES ${_crypto_library_lower}_static ${_crypto_library_lower}
+        HINTS ${_ngtcp2_library_dir})
+    else()
+      find_library(${_crypto_library_upper}_LIBRARY NAMES ${_crypto_library_lower}
+        HINTS ${_ngtcp2_library_dir})
+    endif()
+
+    if(${_crypto_library_upper}_LIBRARY)
+      set(NGTCP2_${NGTCP2_CRYPTO_BACKEND}_FOUND TRUE)
+      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library_upper}_LIBRARY})
+    endif()
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(NGTCP2
+    REQUIRED_VARS
+      NGTCP2_INCLUDE_DIR
+      NGTCP2_LIBRARY
+    VERSION_VAR
+      NGTCP2_VERSION
+    HANDLE_COMPONENTS
+  )
+
+  if(NGTCP2_FOUND)
+    set(_ngtcp2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
+    set(_ngtcp2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
+  endif()
+
+  mark_as_advanced(NGTCP2_INCLUDE_DIR NGTCP2_LIBRARY NGTCP2_CRYPTO_LIBRARY)
+
+  if(NOT NGTCP2_FOUND AND _tried_pkgconfig)  # reset variables to allow another round of detection
+    unset(NGTCP2_INCLUDE_DIR CACHE)
+    unset(NGTCP2_LIBRARY CACHE)
+  endif()
 endif()
 
-mark_as_advanced(NGTCP2_INCLUDE_DIRS NGTCP2_LIBRARIES)
+if(NGTCP2_FOUND)
+  if(NOT TARGET CURL::ngtcp2)
+    add_library(CURL::ngtcp2 INTERFACE IMPORTED)
+    set_target_properties(CURL::ngtcp2 PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_ngtcp2_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_ngtcp2_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_ngtcp2_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_ngtcp2_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_ngtcp2_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindNettle.cmake

@@ -0,0 +1,97 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# Find the nettle library
+#
+# Input variables:
+#
+# - `NETTLE_INCLUDE_DIR`:  Absolute path to nettle include directory.
+# - `NETTLE_LIBRARY`:      Absolute path to `nettle` library.
+#
+# Defines:
+#
+# - `NETTLE_FOUND`:        System has nettle.
+# - `NETTLE_VERSION`:      Version of nettle.
+# - `CURL::nettle`:        nettle library target.
+
+set(_nettle_pc_requires "nettle")
+
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED NETTLE_INCLUDE_DIR AND
+   NOT DEFINED NETTLE_LIBRARY)
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(_nettle ${_nettle_pc_requires})
+endif()
+
+if(_nettle_FOUND)
+  set(Nettle_FOUND TRUE)
+  set(NETTLE_FOUND TRUE)
+  set(NETTLE_VERSION ${_nettle_VERSION})
+  message(STATUS "Found Nettle (via pkg-config): ${_nettle_INCLUDE_DIRS} (found version \"${NETTLE_VERSION}\")")
+else()
+  find_path(NETTLE_INCLUDE_DIR NAMES "nettle/sha2.h")
+  find_library(NETTLE_LIBRARY NAMES "nettle")
+
+  unset(NETTLE_VERSION CACHE)
+  if(NETTLE_INCLUDE_DIR AND EXISTS "${NETTLE_INCLUDE_DIR}/nettle/version.h")
+    set(_version_regex1 "#[\t ]*define[ \t]+NETTLE_VERSION_MAJOR[ \t]+([0-9]+).*")
+    set(_version_regex2 "#[\t ]*define[ \t]+NETTLE_VERSION_MINOR[ \t]+([0-9]+).*")
+    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str1 REGEX "${_version_regex1}")
+    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str2 REGEX "${_version_regex2}")
+    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
+    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
+    set(NETTLE_VERSION "${_version_str1}.${_version_str2}")
+    unset(_version_regex1)
+    unset(_version_regex2)
+    unset(_version_str1)
+    unset(_version_str2)
+  endif()
+
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Nettle
+    REQUIRED_VARS
+      NETTLE_INCLUDE_DIR
+      NETTLE_LIBRARY
+    VERSION_VAR
+      NETTLE_VERSION
+  )
+
+  if(NETTLE_FOUND)
+    set(_nettle_INCLUDE_DIRS ${NETTLE_INCLUDE_DIR})
+    set(_nettle_LIBRARIES    ${NETTLE_LIBRARY})
+  endif()
+
+  mark_as_advanced(NETTLE_INCLUDE_DIR NETTLE_LIBRARY)
+endif()
+
+if(NETTLE_FOUND)
+  if(NOT TARGET CURL::nettle)
+    add_library(CURL::nettle INTERFACE IMPORTED)
+    set_target_properties(CURL::nettle PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_nettle_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_nettle_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_nettle_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_nettle_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_nettle_LIBRARIES}")
+  endif()
+endif()

third-party/curl/CMake/FindQUICHE.cmake

@@ -21,50 +21,60 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# Find the quiche library
+#
+# Input variables:
+#
+# - `QUICHE_INCLUDE_DIR`:  Absolute path to quiche include directory.
+# - `QUICHE_LIBRARY`:      Absolute path to `quiche` library.
+#
+# Defines:
+#
+# - `QUICHE_FOUND`:        System has quiche.
+# - `QUICHE_VERSION`:      Version of quiche.
+# - `CURL::quiche`:        quiche library target.
 
-#[=======================================================================[.rst:
-FindQUICHE
-----------
+set(_quiche_pc_requires "quiche")
 
-Find the quiche library
-
-Result Variables
-^^^^^^^^^^^^^^^^
-
-``QUICHE_FOUND``
-  System has quiche
-``QUICHE_INCLUDE_DIRS``
-  The quiche include directories.
-``QUICHE_LIBRARIES``
-  The libraries needed to use quiche
-#]=======================================================================]
-if(UNIX)
+if(CURL_USE_PKGCONFIG AND
+   NOT DEFINED QUICHE_INCLUDE_DIR AND
+   NOT DEFINED QUICHE_LIBRARY)
   find_package(PkgConfig QUIET)
-  pkg_search_module(PC_QUICHE quiche)
+  pkg_check_modules(_quiche ${_quiche_pc_requires})
 endif()
 
-find_path(QUICHE_INCLUDE_DIR quiche.h
-  HINTS
-    ${PC_QUICHE_INCLUDEDIR}
-    ${PC_QUICHE_INCLUDE_DIRS}
-)
+if(_quiche_FOUND)
+  set(Quiche_FOUND TRUE)
+  set(QUICHE_FOUND TRUE)
+  set(QUICHE_VERSION ${_quiche_VERSION})
+  message(STATUS "Found Quiche (via pkg-config): ${_quiche_INCLUDE_DIRS} (found version \"${QUICHE_VERSION}\")")
+else()
+  find_path(QUICHE_INCLUDE_DIR NAMES "quiche.h")
+  find_library(QUICHE_LIBRARY NAMES "quiche")
 
-find_library(QUICHE_LIBRARY NAMES quiche
-  HINTS
-    ${PC_QUICHE_LIBDIR}
-    ${PC_QUICHE_LIBRARY_DIRS}
-)
+  include(FindPackageHandleStandardArgs)
+  find_package_handle_standard_args(Quiche
+    REQUIRED_VARS
+      QUICHE_INCLUDE_DIR
+      QUICHE_LIBRARY
+  )
 
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(QUICHE
-  REQUIRED_VARS
-    QUICHE_LIBRARY
-    QUICHE_INCLUDE_DIR
-)
+  if(QUICHE_FOUND)
+    set(_quiche_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
+    set(_quiche_LIBRARIES    ${QUICHE_LIBRARY})
+  endif()
+
+  mark_as_advanced(QUICHE_INCLUDE_DIR QUICHE_LIBRARY)
+endif()
 
 if(QUICHE_FOUND)
-  set(QUICHE_LIBRARIES    ${QUICHE_LIBRARY})
-  set(QUICHE_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
+  if(NOT TARGET CURL::quiche)
+    add_library(CURL::quiche INTERFACE IMPORTED)
+    set_target_properties(CURL::quiche PROPERTIES
+      INTERFACE_LIBCURL_PC_MODULES "${_quiche_pc_requires}"
+      INTERFACE_COMPILE_OPTIONS "${_quiche_CFLAGS}"
+      INTERFACE_INCLUDE_DIRECTORIES "${_quiche_INCLUDE_DIRS}"
+      INTERFACE_LINK_DIRECTORIES "${_quiche_LIBRARY_DIRS}"
+      INTERFACE_LINK_LIBRARIES "${_quiche_LIBRARIES}")
+  endif()
 endif()
-
-mark_as_advanced(QUICHE_INCLUDE_DIRS QUICHE_LIBRARIES)