new upstream release - 8.18.0

Related: #2408809

0001-curl-8.11.1-eventfd.patch

@@ -1,31 +0,0 @@
-From 17c06b1ed19147d9e641ad5bcd672e8bce451b46 Mon Sep 17 00:00:00 2001
-From: Andy Pan <i@andypan.me>
-Date: Thu, 12 Dec 2024 12:48:56 +0000
-Subject: [PATCH] async-thread: avoid closing eventfd twice
-
-When employing eventfd for socketpair, there is only one file
-descriptor. Closing that fd twice might result in fd corruption.
-Thus, we should avoid closing the eventfd twice, following the
-pattern in lib/multi.c.
-
-Fixes #15725
----
- lib/asyn-thread.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/lib/asyn-thread.c b/lib/asyn-thread.c
-index a58e4b790494ab..32d496b107cb0a 100644
---- a/lib/asyn-thread.c
-+++ b/lib/asyn-thread.c
-@@ -195,9 +195,11 @@ void destroy_thread_sync_data(struct thread_sync_data *tsd)
-    * close one end of the socket pair (may be done in resolver thread);
-    * the other end (for reading) is always closed in the parent thread.
-    */
-+#ifndef USE_EVENTFD
-   if(tsd->sock_pair[1] != CURL_SOCKET_BAD) {
-     wakeup_close(tsd->sock_pair[1]);
-   }
-+#endif
- #endif
-   memset(tsd, 0, sizeof(*tsd));
- }

0002-curl-8.11.1-TLS-check-connection-for-SSL-use-not-handler.patch

@@ -1,227 +0,0 @@
-From b876aeb3f5d5c6539102f0575c0ec1d116388337 Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Fri, 17 Jan 2025 11:57:00 +0100
-Subject: [PATCH] TLS: check connection for SSL use, not handler
-
-Protocol handler option PROTOPT_SSL is used to setup a connection
-filters. Once that is done, used `Curl_conn_is_ssl()` to check if
-a connection uses SSL.
-
-There may be other reasons to add SSL to a connection, e.g. starttls.
-
-Closes #16034
-
-(cherry picked from commit 25b445e4796bcbf9f842de686a8c384b30f6c2a2)
----
- lib/cf-socket.c      |  2 +-
- lib/ftp.c            |  2 +-
- lib/http.c           |  8 ++++----
- lib/http_negotiate.c |  3 ++-
- lib/imap.c           |  2 +-
- lib/ldap.c           |  3 ++-
- lib/openldap.c       |  2 +-
- lib/pop3.c           |  2 +-
- lib/smb.c            |  2 +-
- lib/smtp.c           |  2 +-
- lib/url.c            | 12 ++++++------
- 11 files changed, 21 insertions(+), 19 deletions(-)
-
-diff --git a/lib/cf-socket.c b/lib/cf-socket.c
-index 497a3b965..de0c8a3ba 100644
---- a/lib/cf-socket.c
-+++ b/lib/cf-socket.c
-@@ -1282,7 +1282,7 @@ static int do_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
- 
-     rc = connect(ctx->sock, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
- #elif defined(MSG_FASTOPEN) /* old Linux */
--    if(cf->conn->given->flags & PROTOPT_SSL)
-+    if(Curl_conn_is_ssl(cf->conn, cf->sockindex))
-       rc = connect(ctx->sock, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
-     else
-       rc = 0; /* Do nothing */
-diff --git a/lib/ftp.c b/lib/ftp.c
-index 16ab0af0d..5137ddca4 100644
---- a/lib/ftp.c
-+++ b/lib/ftp.c
-@@ -3154,7 +3154,7 @@ static CURLcode ftp_connect(struct Curl_easy *data,
- 
-   PINGPONG_SETUP(pp, ftp_statemachine, ftp_endofresp);
- 
--  if(conn->handler->flags & PROTOPT_SSL) {
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-     /* BLOCKING */
-     result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, done);
-     if(result)
-diff --git a/lib/http.c b/lib/http.c
-index 35e708551..8e9f0a52e 100644
---- a/lib/http.c
-+++ b/lib/http.c
-@@ -2526,7 +2526,7 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done)
-     goto fail;
-   }
- 
--  if(!(conn->handler->flags&PROTOPT_SSL) &&
-+  if(!Curl_conn_is_ssl(conn, FIRSTSOCKET) &&
-      conn->httpversion < 20 &&
-      (data->state.httpwant == CURL_HTTP_VERSION_2)) {
-     /* append HTTP2 upgrade magic stuff to the HTTP request if it is not done
-@@ -2672,7 +2672,7 @@ CURLcode Curl_http_header(struct Curl_easy *data,
-   case 'A':
- #ifndef CURL_DISABLE_ALTSVC
-     v = (data->asi &&
--         ((data->conn->handler->flags & PROTOPT_SSL) ||
-+         (Curl_conn_is_ssl(data->conn, FIRSTSOCKET) ||
- #ifdef DEBUGBUILD
-           /* allow debug builds to circumvent the HTTPS restriction */
-           getenv("CURL_ALTSVC_HTTP")
-@@ -2938,7 +2938,7 @@ CURLcode Curl_http_header(struct Curl_easy *data,
- #ifndef CURL_DISABLE_HSTS
-     /* If enabled, the header is incoming and this is over HTTPS */
-     v = (data->hsts &&
--         ((conn->handler->flags & PROTOPT_SSL) ||
-+         (Curl_conn_is_ssl(conn, FIRSTSOCKET) ||
- #ifdef DEBUGBUILD
-            /* allow debug builds to circumvent the HTTPS restriction */
-            getenv("CURL_HSTS_HTTP")
-@@ -4160,7 +4160,7 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
-       infof(data, "set pseudo header %s to %s", HTTP_PSEUDO_SCHEME, scheme);
-     }
-     else {
--      scheme = (data->conn && data->conn->handler->flags & PROTOPT_SSL) ?
-+      scheme = Curl_conn_is_ssl(data->conn, FIRSTSOCKET) ?
-         "https" : "http";
-     }
-   }
-diff --git a/lib/http_negotiate.c b/lib/http_negotiate.c
-index 5d76bddf7..f031d0abc 100644
---- a/lib/http_negotiate.c
-+++ b/lib/http_negotiate.c
-@@ -27,6 +27,7 @@
- #if !defined(CURL_DISABLE_HTTP) && defined(USE_SPNEGO)
- 
- #include "urldata.h"
-+#include "cfilters.h"
- #include "sendf.h"
- #include "http_negotiate.h"
- #include "vauth/vauth.h"
-@@ -109,7 +110,7 @@ CURLcode Curl_input_negotiate(struct Curl_easy *data, struct connectdata *conn,
- #endif
-   /* Check if the connection is using SSL and get the channel binding data */
- #if defined(USE_SSL) && defined(HAVE_GSSAPI)
--  if(conn->handler->flags & PROTOPT_SSL) {
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-     Curl_dyn_init(&neg_ctx->channel_binding_data, SSL_CB_MAX_SIZE + 1);
-     result = Curl_ssl_get_channel_binding(
-       data, FIRSTSOCKET, &neg_ctx->channel_binding_data);
-diff --git a/lib/imap.c b/lib/imap.c
-index e424cdb05..df9dc343b 100644
---- a/lib/imap.c
-+++ b/lib/imap.c
-@@ -1390,7 +1390,7 @@ static CURLcode imap_multi_statemach(struct Curl_easy *data, bool *done)
-   struct connectdata *conn = data->conn;
-   struct imap_conn *imapc = &conn->proto.imapc;
- 
--  if((conn->handler->flags & PROTOPT_SSL) && !imapc->ssldone) {
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET) && !imapc->ssldone) {
-     bool ssldone = FALSE;
-     result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-     imapc->ssldone = ssldone;
-diff --git a/lib/ldap.c b/lib/ldap.c
-index 2cbdb9c21..7dd40acef 100644
---- a/lib/ldap.c
-+++ b/lib/ldap.c
-@@ -78,6 +78,7 @@
- 
- #include "urldata.h"
- #include <curl/curl.h>
-+#include "cfilters.h"
- #include "sendf.h"
- #include "escape.h"
- #include "progress.h"
-@@ -346,7 +347,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
-   }
- 
-   /* Get the URL scheme (either ldap or ldaps) */
--  if(conn->given->flags & PROTOPT_SSL)
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET))
-     ldap_ssl = 1;
-   infof(data, "LDAP local: trying to establish %s connection",
-         ldap_ssl ? "encrypted" : "cleartext");
-diff --git a/lib/openldap.c b/lib/openldap.c
-index 8c4af22be..9676ad3d0 100644
---- a/lib/openldap.c
-+++ b/lib/openldap.c
-@@ -571,7 +571,7 @@ static CURLcode oldap_connect(struct Curl_easy *data, bool *done)
-   ldap_set_option(li->ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
- 
- #ifdef USE_SSL
--  if(conn->handler->flags & PROTOPT_SSL)
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET))
-     return oldap_ssl_connect(data, OLDAP_SSL);
- 
-   if(data->set.use_ssl) {
-diff --git a/lib/pop3.c b/lib/pop3.c
-index db6ec04c7..83dd64cda 100644
---- a/lib/pop3.c
-+++ b/lib/pop3.c
-@@ -1110,7 +1110,7 @@ static CURLcode pop3_multi_statemach(struct Curl_easy *data, bool *done)
-   struct connectdata *conn = data->conn;
-   struct pop3_conn *pop3c = &conn->proto.pop3c;
- 
--  if((conn->handler->flags & PROTOPT_SSL) && !pop3c->ssldone) {
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET) && !pop3c->ssldone) {
-     bool ssldone = FALSE;
-     result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-     pop3c->ssldone = ssldone;
-diff --git a/lib/smb.c b/lib/smb.c
-index a72ece62a..a2c82df5e 100644
---- a/lib/smb.c
-+++ b/lib/smb.c
-@@ -840,7 +840,7 @@ static CURLcode smb_connection_state(struct Curl_easy *data, bool *done)
- 
-   if(smbc->state == SMB_CONNECTING) {
- #ifdef USE_SSL
--    if((conn->handler->flags & PROTOPT_SSL)) {
-+    if(Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-       bool ssl_done = FALSE;
-       result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssl_done);
-       if(result && result != CURLE_AGAIN)
-diff --git a/lib/smtp.c b/lib/smtp.c
-index d854d364f..c7fb0a4ca 100644
---- a/lib/smtp.c
-+++ b/lib/smtp.c
-@@ -1286,7 +1286,7 @@ static CURLcode smtp_multi_statemach(struct Curl_easy *data, bool *done)
-   struct connectdata *conn = data->conn;
-   struct smtp_conn *smtpc = &conn->proto.smtpc;
- 
--  if((conn->handler->flags & PROTOPT_SSL) && !smtpc->ssldone) {
-+  if(Curl_conn_is_ssl(conn, FIRSTSOCKET) && !smtpc->ssldone) {
-     bool ssldone = FALSE;
-     result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &ssldone);
-     smtpc->ssldone = ssldone;
-diff --git a/lib/url.c b/lib/url.c
-index 436edd891..de200e1dd 100644
---- a/lib/url.c
-+++ b/lib/url.c
-@@ -958,12 +958,12 @@ static bool url_match_conn(struct connectdata *conn, void *userdata)
-     return FALSE;
- #endif
- 
--  if((needle->handler->flags&PROTOPT_SSL) !=
--     (conn->handler->flags&PROTOPT_SSL))
--    /* do not do mixed SSL and non-SSL connections */
--    if(get_protocol_family(conn->handler) !=
--       needle->handler->protocol || !conn->bits.tls_upgraded)
--      /* except protocols that have been upgraded via TLS */
-+  if((!(needle->handler->flags&PROTOPT_SSL) !=
-+      !Curl_conn_is_ssl(conn, FIRSTSOCKET)) &&
-+     !(get_protocol_family(conn->handler) == needle->handler->protocol &&
-+       conn->bits.tls_upgraded))
-+    /* Deny `conn` if it is not fit for `needle`'s SSL needs,
-+     * UNLESS `conn` is the same protocol family and was upgraded to SSL. */
-       return FALSE;
- 
- #ifndef CURL_DISABLE_PROXY
--- 
-2.48.1
-

0101-curl-7.32.0-multilib.patch

@@ -1,6 +1,6 @@
-From 7efcd412447fc41bded2f9621edf0ab4701c9b14 Mon Sep 17 00:00:00 2001
+From 6bb4e674cdc953f5c0048aa84172539900725166 Mon Sep 17 00:00:00 2001
 From: Jan Macku <jamacku@redhat.com>
-Date: Wed, 11 Dec 2024 09:28:12 +0100
+Date: Tue, 16 Dec 2025 10:04:40 +0100
 Subject: [PATCH] prevent multilib conflicts on the curl-config script
 
 ---
@@ -10,10 +10,10 @@ Subject: [PATCH] prevent multilib conflicts on the curl-config script
  3 files changed, 9 insertions(+), 19 deletions(-)
 
 diff --git a/curl-config.in b/curl-config.in
-index e89c256..9fb1a33 100644
+index a1c8185875..bb43ca8335 100644
 --- a/curl-config.in
 +++ b/curl-config.in
-@@ -75,7 +75,7 @@ while test "$#" -gt 0; do
+@@ -74,7 +74,7 @@ while test "$#" -gt 0; do
      ;;
  
    --cc)
@@ -22,29 +22,29 @@ index e89c256..9fb1a33 100644
      ;;
  
    --prefix)
-@@ -155,16 +155,7 @@ while test "$#" -gt 0; do
+@@ -149,16 +149,7 @@ while test "$#" -gt 0; do
      ;;
  
    --libs)
--    if test "X@libdir@" != 'X/usr/lib' -a "X@libdir@" != 'X/usr/lib64'; then
--      CURLLIBDIR="-L@libdir@ "
+-    if test "@libdir@" != '/usr/lib' && test "@libdir@" != '/usr/lib64'; then
+-      curllibdir="-L@libdir@ "
 -    else
--      CURLLIBDIR=''
+-      curllibdir=''
 -    fi
--    if test 'X@ENABLE_SHARED@' = 'Xno'; then
--      echo "${CURLLIBDIR}-lcurl @LIBCURL_PC_LIBS_PRIVATE@"
+-    if test '@ENABLE_SHARED@' = 'no'; then
+-      echo "${curllibdir}-lcurl @LIBCURL_PC_LIBS_PRIVATE@"
 -    else
--      echo "${CURLLIBDIR}-lcurl"
+-      echo "${curllibdir}-lcurl"
 -    fi
 +    echo '-lcurl'
      ;;
  
    --ssl-backends)
-@@ -172,16 +163,12 @@ while test "$#" -gt 0; do
+@@ -166,16 +157,12 @@ while test "$#" -gt 0; do
      ;;
  
    --static-libs)
--    if test 'X@ENABLE_STATIC@' != 'Xno'; then
+-    if test '@ENABLE_STATIC@' != 'no'; then
 -      echo "@libdir@/libcurl.@libext@ @LIBCURL_PC_LDFLAGS_PRIVATE@ @LIBCURL_PC_LIBS_PRIVATE@"
 -    else
 -      echo 'curl was built with static libraries disabled' >&2
@@ -61,11 +61,11 @@ index e89c256..9fb1a33 100644
  
    *)
 diff --git a/docs/curl-config.md b/docs/curl-config.md
-index 4dfaab6..f4e847e 100644
+index 12ad245b79..fa0e03d273 100644
 --- a/docs/curl-config.md
 +++ b/docs/curl-config.md
 @@ -87,7 +87,9 @@ no, one or several names. If more than one name, they appear comma-separated.
- ## --static-libs
+ ## `--static-libs`
  
  Shows the complete set of libs and other linker options you need in order to
 -link your application with libcurl statically. (Added in 7.17.1)
@@ -73,10 +73,10 @@ index 4dfaab6..f4e847e 100644
 +packages do not provide any static libraries, thus cannot be linked statically.
 +(Added in 7.17.1)
  
- ## --version
+ ## `--version`
  
 diff --git a/libcurl.pc.in b/libcurl.pc.in
-index c0ba524..f3645e1 100644
+index c0ba5244a8..f3645e1748 100644
 --- a/libcurl.pc.in
 +++ b/libcurl.pc.in
 @@ -28,6 +28,7 @@ libdir=@libdir@
@@ -88,5 +88,5 @@ index c0ba524..f3645e1 100644
  Name: libcurl
  URL: https://curl.se/
 -- 
-2.47.1
+2.52.0
 

0102-curl-7.84.0-test3026.patch

@@ -1,71 +0,0 @@
-From 6e470567ca691a7b20334f1b9a5b309053d714b7 Mon Sep 17 00:00:00 2001
-From: Jan Macku <jamacku@redhat.com>
-Date: Wed, 22 May 2024 13:03:43 +0200
-Subject: [PATCH 2/2] test3026: disable valgrind
-
-It fails on x86_64 with:
-```
- Use --max-threads=INT to specify a larger number of threads
- and rerun valgrind
- valgrind: the 'impossible' happened:
-    Max number of threads is too low
- host stacktrace:
- ==174357==    at 0x58042F5A: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x58043087: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x580432EF: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x58043310: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x58099E77: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x580E67E9: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x5809D59D: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x5809901A: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x5809B0B6: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- ==174357==    by 0x580E4050: ??? (in /usr/libexec/valgrind/memcheck-amd64-linux)
- sched status:
-   running_tid=1
- Thread 1: status = VgTs_Runnable syscall 56 (lwpid 174357)
- ==174357==    at 0x4A07816: clone (in /usr/lib64/libc.so.6)
- ==174357==    by 0x4A08720: __clone_internal (in /usr/lib64/libc.so.6)
- ==174357==    by 0x4987ACF: create_thread (in /usr/lib64/libc.so.6)
- ==174357==    by 0x49885F6: pthread_create@@GLIBC_2.34 (in /usr/lib64/libc.so.6)
- ==174357==    by 0x1093B5: test.part.0 (lib3026.c:64)
- ==174357==    by 0x492454F: (below main) (in /usr/lib64/libc.so.6)
- client stack range: [0x1FFEFFC000 0x1FFF000FFF] client SP: 0x1FFEFFC998
- valgrind stack range: [0x1002BAA000 0x1002CA9FFF] top usage: 11728 of 1048576
-[...]
-```
----
- tests/data/test3026     | 3 +++
- tests/libtest/lib3026.c | 4 ++--
- 2 files changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/tests/data/test3026 b/tests/data/test3026
-index ee9b30678..dd582c3e5 100644
---- a/tests/data/test3026
-+++ b/tests/data/test3026
-@@ -41,5 +41,8 @@ none
- <errorcode>
- 0
- </errorcode>
-+<valgrind>
-+disable
-+</valgrind>
- </verify>
- </testcase>
-diff --git a/tests/libtest/lib3026.c b/tests/libtest/lib3026.c
-index 7e914010e..39374f5bc 100644
---- a/tests/libtest/lib3026.c
-+++ b/tests/libtest/lib3026.c
-@@ -145,8 +145,8 @@ CURLcode test(char *URL)
-     results[i] = CURL_LAST; /* initialize with invalid value */
-     res = pthread_create(&tids[i], NULL, run_thread, &results[i]);
-     if(res) {
--      fprintf(stderr, "%s:%d Couldn't create thread, errno %d\n",
--              __FILE__, __LINE__, res);
-+      fprintf(stderr, "%s:%d Couldn't create thread, i=%u, errno %d\n",
-+              __FILE__, __LINE__, i, res);
-       tid_count = i;
-       test_failure = (CURLcode)-1;
-       goto cleanup;
--- 
-2.45.1
-

0104-curl-7.88.0-tests-warnings.patch

@@ -1,30 +0,0 @@
-From ebee18be05631494263bb6be249501eb8874e07a Mon Sep 17 00:00:00 2001
-From: Jan Macku <jamacku@redhat.com>
-Date: Wed, 24 Jul 2024 15:15:11 +0200
-Subject: [PATCH] Revert "runtests: consider warnings fatal and error on them"
-
-While it might be useful for upstream developers, it is not so useful
-for downstream consumers.
-
-This reverts upstream commit 22f795c834cfdbacbb1b55426028a581e3cf67a8.
----
- tests/runtests.pl | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/tests/runtests.pl b/tests/runtests.pl
-index 9cc9ef1..c9a1c5d 100755
---- a/tests/runtests.pl
-+++ b/tests/runtests.pl
-@@ -57,8 +57,7 @@
- # given, this won't be a problem.
- 
- use strict;
--# Promote all warnings to fatal
--use warnings FATAL => 'all';
-+use warnings;
- use 5.006;
- use POSIX qw(strftime);
- 
--- 
-2.45.2
-

0105-curl-8.11.1-test616.patch

@@ -1,48 +0,0 @@
-From 82baec8c7cd40361585d8793dfe4531f7aad30e3 Mon Sep 17 00:00:00 2001
-From: Jan Macku <jamacku@redhat.com>
-Date: Wed, 11 Dec 2024 13:16:12 +0100
-Subject: [PATCH] test616: disable valgrind
-
-Valgrind disable was removed in upstream in https://github.com/curl/curl/commit/c91c37b6e87ceee760b7bb334c8e97e03ee93e93#diff-e01fd8774cf5b26329c7dc7dc03ec49745469205f3d501ced72c9d133455d5e7L35
-But test 616 is still failing under valgrind, so disable valgrind for this test.
-
-```
- valgrind ERROR ==188588== 144 bytes in 1 blocks are definitely lost in loss record 1 of 1
-==188588==    at 0x484B133: calloc (vg_replace_malloc.c:1675)
-==188588==    by 0x4BB7575: ??? (in /usr/lib64/libssh.so.4.10.1)
-==188588==    by 0x4BB8CC6: sftp_fstat (in /usr/lib64/libssh.so.4.10.1)
-==188588==    by 0x48EEAFB: myssh_statemach_act (libssh.c:1610)
-==188588==    by 0x48F1B9D: myssh_multi_statemach.lto_priv.0 (libssh.c:2095)
-==188588==    by 0x48BA971: UnknownInlinedFun (multi.c:1643)
-==188588==    by 0x48BA971: UnknownInlinedFun (multi.c:2314)
-==188588==    by 0x48BA971: multi_runsingle (multi.c:2768)
-==188588==    by 0x48BCCA4: curl_multi_perform (multi.c:3016)
-==188588==    by 0x4884E4A: UnknownInlinedFun (easy.c:701)
-==188588==    by 0x4884E4A: UnknownInlinedFun (easy.c:796)
-==188588==    by 0x4884E4A: curl_easy_perform (easy.c:815)
-==188588==    by 0x10C12B: UnknownInlinedFun (tool_operate.c:2902)
-==188588==    by 0x10C12B: UnknownInlinedFun (tool_operate.c:3127)
-==188588==    by 0x10C12B: UnknownInlinedFun (tool_operate.c:3249)
-==188588==    by 0x10C12B: main (tool_main.c:271)
-==188588==
-```
----
- tests/data/test616 | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/tests/data/test616 b/tests/data/test616
-index f76c68a..0ebc734 100644
---- a/tests/data/test616
-+++ b/tests/data/test616
-@@ -32,5 +32,8 @@ SFTP retrieval of empty file
- #
- # Verify data after the test has been "shot"
- <verify>
-+<valgrind>
-+disable
-+</valgrind>
- </verify>
- </testcase>
--- 
-2.47.1
-

curl.spec

@@ -4,45 +4,37 @@
 # Change the bcond to 0 to turn off ENGINE support by default
 %bcond openssl_engine_support %[%{defined fedora} || 0%{?rhel} < 10]
 
+# HTTP/3 support
+# This is using ngtcp2 with OpenSSL 3.5 QUIC support instead of curl's
+# experimental native OpenSSL 3.5 support.
+%bcond http3 %[0%{?fedora} >= 43]
+
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
-Version: 8.11.1
-Release: 4%{?dist}
+Version: 8.18.0
+Release: 1%{?dist}
 License: curl
-Source0: https://curl.se/download/%{name}-%{version}.tar.xz
-Source1: https://curl.se/download/%{name}-%{version}.tar.xz.asc
+Source0: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz
+Source1: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz.asc
 # The curl download page ( https://curl.se/download.html ) links
 # to Daniel's address page https://daniel.haxx.se/address.html for the GPG Key,
 # which points to the GPG key as of April 7th 2016 of https://daniel.haxx.se/mykey.asc
 Source2: mykey.asc
 
-# Fix crash with Unexpected error 9 on netlink descriptor 10
-# https://bugzilla.redhat.com/show_bug.cgi?id=2332350
-# https://github.com/curl/curl/issues/15725
-# https://github.com/curl/curl/pull/15727
-Patch1: 0001-curl-8.11.1-eventfd.patch
-
-# Fix https://bugzilla.redhat.com/show_bug.cgi?id=2324130#c7
-Patch2: 0002-curl-8.11.1-TLS-check-connection-for-SSL-use-not-handler.patch
-
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
-# test3026: disable valgrind
-Patch102: 0102-curl-7.84.0-test3026.patch
-
-# do not fail on warnings in the upstream test driver
-Patch104: 0104-curl-7.88.0-tests-warnings.patch
-
-# test616: disable valgrind
-Patch105: 0105-curl-8.11.1-test616.patch
-
 Provides: curl-full = %{version}-%{release}
 # do not fail when trying to install curl-minimal after drop
 Provides: curl-minimal = %{version}-%{release}
 Provides: webclient
 URL: https://curl.se/
 
+%if 0%{?fedora}
+# instead of bundled wcurl utility, recommend wcurl package
+Recommends: wcurl
+%endif
+
 # The reason for maintaining two separate packages for curl is no longer valid.
 # The curl-minimal is currently almost identical to curl-full, so let's drop curl-minimal.
 # For more details, see https://bugzilla.redhat.com/show_bug.cgi?id=2262096
@@ -56,13 +48,20 @@ BuildRequires: groff
 BuildRequires: krb5-devel
 BuildRequires: libidn2-devel
 BuildRequires: libnghttp2-devel
+%if %{with http3}
+BuildRequires: libnghttp3-devel
+%endif
 BuildRequires: libpsl-devel
 BuildRequires: libssh-devel
 BuildRequires: libtool
 BuildRequires: make
+%if %{with http3}
+BuildRequires: ngtcp2-crypto-ossl-devel
+%endif
 BuildRequires: openldap-devel
 BuildRequires: openssh-clients
 BuildRequires: openssh-server
+BuildRequires: openssl
 BuildRequires: openssl-devel
 %if %{with openssl_engine_support} && 0%{?fedora} >= 41
 BuildRequires:  openssl-devel-engine
@@ -153,6 +152,10 @@ Requires: libcurl%{?_isa} >= %{version}-%{release}
 # to ensure that we have the necessary symbols available (#2144277)
 %global libnghttp2_version %(pkg-config --modversion libnghttp2 2>/dev/null || echo 0)
 
+# require at least the version of libnghttp3 that we were built against,
+# to ensure that we have the necessary symbols available
+%global libnghttp3_version %(pkg-config --modversion libnghttp3 2>/dev/null || echo 0)
+
 # require at least the version of libpsl that we were built against,
 # to ensure that we have the necessary symbols available (#1631804)
 %global libpsl_version %(pkg-config --modversion libpsl 2>/dev/null || echo 0)
@@ -161,6 +164,10 @@ Requires: libcurl%{?_isa} >= %{version}-%{release}
 # to ensure that we have the necessary symbols available (#525002, #642796)
 %global libssh_version %(pkg-config --modversion libssh 2>/dev/null || echo 0)
 
+# require at least the version of ngtcp2 that we were built against,
+# to ensure that we have the necessary symbols available
+%global ngtcp2_version %(pkg-config --modversion libngtcp2 2>/dev/null || echo 0)
+
 # require at least the version of openssl-libs that we were built against,
 # to ensure that we have the necessary symbols available (#1462184, #1462211)
 # (we need to translate 3.0.0-alpha16 -> 3.0.0-0.alpha16 and 3.0.0-beta1 -> 3.0.0-0.beta1 though)
@@ -177,8 +184,14 @@ resume, proxy tunneling and a busload of other useful tricks.
 %package -n libcurl
 Summary: A library for getting files from web servers
 Requires: libnghttp2%{?_isa} >= %{libnghttp2_version}
+%if %{with http3}
+Requires: libnghttp3%{?_isa} >= %{libnghttp3_version}
+%endif
 Requires: libpsl%{?_isa} >= %{libpsl_version}
 Requires: libssh%{?_isa} >= %{libssh_version}
+%if %{with http3}
+Requires: ngtcp2%{?_isa} >= %{ngtcp2_version}
+%endif
 Requires: openssl-libs%{?_isa} >= 1:%{openssl_version}
 Provides: libcurl-full = %{version}-%{release}
 Provides: libcurl-full%{?_isa} = %{version}-%{release}
@@ -223,7 +236,7 @@ be installed.
 
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
-%autosetup -p1
+%autosetup -n %{name}-%{version_no_tilde} -p1
 
 # disable test 1801
 # <https://github.com/bagder/curl/commit/21e82bd6#commitcomment-12226582>
@@ -318,7 +331,11 @@ export common_configure_opts="          \
         --enable-websockets             \
         --with-brotli                   \
         --with-libpsl                   \
-        --with-libssh
+        --with-libssh                   \
+%if %{with http3}
+        --with-nghttp3                  \
+        --with-ngtcp2                   \
+%endif
 )
 
 # avoid using rpath
@@ -380,6 +397,11 @@ rm -rf ${RPM_BUILD_ROOT}%{_datadir}/fish
 
 rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 
+# do not install bundled wcurl utility
+# it is provided by the wcurl package
+rm -f ${RPM_BUILD_ROOT}%{_bindir}/wcurl
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
+
 %ldconfig_scriptlets -n libcurl
 
 %ldconfig_scriptlets -n libcurl-minimal
@@ -389,9 +411,10 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %doc README
 %doc docs/BUGS.md
 %doc docs/DISTROS.md
-%doc docs/FAQ
+%doc docs/FAQ.md
 %doc docs/FEATURES.md
-%doc docs/TODO
+%doc docs/KNOWN_BUGS.md
+%doc docs/TODO.md
 %doc docs/TheArtOfHttpScripting.md
 %{_bindir}/curl
 %{_mandir}/man1/curl.1*
@@ -419,6 +442,106 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
+* Wed Jan 07 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-1
+- new upstream release
+
+* Mon Jan 05 2026 Jan Macku <jamacku@redhat.com> - 8.18.0~rc3-1
+- new upstream release candidate
+
+* Tue Dec 16 2025 Jan Macku <jamacku@redhat.com> - 8.18.0~rc2-1
+- new upstream release candidate
+- reenable valgrind on test 616
+
+* Tue Dec 09 2025 Jan Macku <jamacku@redhat.com> - 8.18.0~rc1-1
+- new upstream release candidate
+- drop upstreamed patches
+
+* Sun Dec 07 2025 Aleksei Bavshin <alebastr@fedoraproject.org> - 8.17.0-5
+- Enable HTTP/3 support with ngtcp2
+
+* Thu Dec 04 2025 Jan Macku <jamacku@redhat.com> - 8.17.0-4
+- apply upstream patches for valgrind issues in HTTP/3 (#2408809)
+
+* Thu Nov 13 2025 Jan Macku <jamacku@redhat.com> - 8.17.0-3
+- recommend wcurl package instead of bundled wcurl utility
+
+* Thu Nov 13 2025 Jan Macku <jamacku@redhat.com> - 8.17.0-2
+- remove bundled wcurl utility that was added in 8.14.0~rc1, use wcurl package instead
+
+* Mon Nov 10 2025 Jan Macku <jamacku@redhat.com> - 8.17.0-1
+- new upstream release
+
+* Thu Oct 30 2025 Jan Macku <jamacku@redhat.com> - 8.17.0~rc3-1
+- new upstream release candidate
+
+* Tue Oct 21 2025 Jan Macku <jamacku@redhat.com> - 8.17.0~rc2-1
+- new upstream release candidate
+
+* Mon Oct 13 2025 Jan Macku <jamacku@redhat.com> - 8.17.0~rc1-1
+- new upstream release candidate
+
+* Wed Sep 10 2025 Jan Macku <jamacku@redhat.com> - 8.16.0-1
+- new upstream release
+
+* Wed Sep 03 2025 Jan Macku <jamacku@redhat.com> - 8.16.0~rc3-1
+- new upstream release candidate
+
+* Tue Aug 26 2025 Jan Macku <jamacku@redhat.com> - 8.16.0~rc2-1
+- new upstream release candidate
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 8.15.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jul 16 2025 Jan Macku <jamacku@redhat.com> - 8.15.0-1
+- new upstream release
+
+* Thu Jul 10 2025 Jan Macku <jamacku@redhat.com> - 8.15.0~rc3-1
+- new upstream release candidate
+
+* Mon Jun 30 2025 Jan Macku <jamacku@redhat.com> - 8.15.0~rc2-1
+- new upstream release candidate
+
+* Mon Jun 23 2025 Jan Macku <jamacku@redhat.com> - 8.15.0~rc1-1
+- new upstream release candidate
+
+* Wed Jun 04 2025 Jan Macku <jamacku@redhat.com> - 8.14.1-1
+- new upstream release
+- drop: 0001-curl-8.14.0-multi-fix-add_handle-resizing.patch (no longer needed)
+
+* Wed May 28 2025 Jan Macku <jamacku@redhat.com> - 8.14.0-1
+- new upstream release, which fixes the following vulnerabilities
+    CVE-2025-5025 - No QUIC certificate pinning with wolfSSL
+    CVE-2025-4947 - QUIC certificate check skip with wolfSSL
+- fix regression: curl_multi_add_handle() returning OOM when using more than 400 handles
+
+* Fri May 02 2025 Jan Macku <jamacku@redhat.com> - 8.14.0~rc1-1
+- new upstream release candidate
+- new utility: wcurl which lets you download URLs without having to remember any parameters
+
+* Wed Apr 02 2025 Jan Macku <jamacku@redhat.com> - 8.13.0-1
+- new upstream release
+- add build time dependency on openssl (required by tests)
+
+* Wed Mar 26 2025 Jan Macku <jamacku@redhat.com> - 8.13.0~rc3-1
+- new upstream release candidate
+- drop: 0102-curl-7.84.0-test3026.patch (no longer needed)
+
+* Tue Mar 18 2025 Jan Macku <jamacku@redhat.com> - 8.13.0~rc2-1
+- new upstream release candidate
+
+* Thu Mar 13 2025 Jan Macku <jamacku@redhat.com> - 8.13.0~rc1-2
+- fix --cert parameter (#2351531)
+
+* Mon Mar 10 2025 Jan Macku <jamacku@redhat.com> - 8.13.0~rc1-1
+- new upstream release candidate
+
+* Wed Feb 05 2025 Jan Macku <jamacku@redhat.com> - 8.12.0-1
+- new upstream release, which fixes the following vulnerabilities
+    CVE-2025-0725 - gzip integer overflow
+    CVE-2025-0665 - eventfd double close
+    CVE-2025-0167 - netrc and default credential leak
+- drop upstreamed patches
+
 * Fri Jan 31 2025 Jan Macku <jamacku@redhat.com> - 8.11.1-4
 - TLS: check connection for SSL use, not handler (#2324130#c7)
 

sources

@@ -1,2 +1,2 @@
-SHA512 (curl-8.11.1.tar.xz) = 7c7c47a49505575b610c56b455f0919ea5082a993bf5483eeb258ead167aadb87078d626b343b417dcfc5439c53556425c8fb4fe3b01b53a87b47c01686a3e57
-SHA512 (curl-8.11.1.tar.xz.asc) = c09bedb67e83fb8ca3ad73c5bd0d92fed7fc2c26dbe5a71cccb193fd151c7219713241a9fe74baefcd1d008cfafba78142bf04cec24dd4a88d67179184d35824
+SHA512 (curl-8.18.0.tar.xz) = 50c7a7b0528e0019697b0c59b3e56abb2578c71d77e4c085b56797276094b5611718c0a9cb2b14db7f8ab502fcf8f42a364297a3387fae3870a4d281484ba21c
+SHA512 (curl-8.18.0.tar.xz.asc) = 07e08d1bb3f8bf20b3d22f37fbc19c49c0d9ee4ea9d92da76fa8a9de343023e1b5d416ccc6535a4ff98b08b30eb9334fd856227e37564f6bcd542aa81bced152

tests/non-root-user-download/runtest.sh

@@ -31,9 +31,9 @@
 
 PACKAGE="curl"
 
-FTP_URL=ftp://ftp.fi.muni.cz/pub/linux/fedora/linux/releases/38/Everything/x86_64/iso/Fedora-Everything-38-1.6-x86_64-CHECKSUM
-HTTP_URL=https://archives.fedoraproject.org/pub/fedora/linux/releases/38/Everything/x86_64/iso/Fedora-Everything-38-1.6-x86_64-CHECKSUM
-CONTENT=4d042dedc8886856db10bc882074b84dcce52f829ea7b3f31d8031db8d84df20
+FTP_URL=ftp://ftp.fi.muni.cz/pub/linux/fedora/linux/releases/42/Everything/x86_64/iso/Fedora-Everything-42-1.1-x86_64-CHECKSUM
+HTTP_URL=https://archives.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/iso/Fedora-Everything-42-1.1-x86_64-CHECKSUM
+CONTENT=1bd6ab4798983c2fe4a210f9c4ca135fed453d6142ba852c1f8d5fba22e113ab
 PASSWORD=pAssw0rd
 OPTIONS=""
 rlIsRHEL 7 && OPTIONS="--insecure"