[pull] master from curl:master

.github/scripts/requirements.txt

@@ -4,6 +4,5 @@
 
 cmakelang==0.6.13
 codespell==2.4.3
-pyrefly==1.3.2
 reuse==6.2.0
 ruff==0.16.7

.github/workflows/checksrc.yml

@@ -67,12 +67,12 @@ jobs:
         background: true
         run: scripts/perlcheck.sh
 
-      - name: 'install typos-cli'
+      - name: 'install brew packages'
         background: true
         timeout-minutes: 2
         uses: $/.github/actions/pkg-install
         with:
-          brew: typos-cli
+          brew: pyrefly typos-cli
 
       - name: 'install prereqs'
         uses: $/.github/actions/pkg-install
@@ -99,16 +99,16 @@ jobs:
           source ~/venv/bin/activate
           scripts/pythonlint.sh
 
+      - name: 'wait-all'
+        wait-all:
+
       - name: 'pyrefly'
         background: true
         run: |
-          source ~/venv/bin/activate
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           cd tests/http/
           pyrefly check --python-version=3.8 --preset=basic --check-unannotated-defs --summary
 
-      - name: 'wait-all'
-        wait-all:
-
       - name: filter off code from all C and H files
         run: |
           git ls-files -z '**.[ch]' | xargs -0 -r -n1 .github/scripts/c-strip
@@ -195,13 +195,13 @@ jobs:
         timeout-minutes: 2
         uses: $/.github/actions/pkg-install
         with:
-          brew: actionlint shellcheck zizmor
+          brew: shellcheck zizmor
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - name: 'zizmor/actionlint (prepare)'
+      - name: 'zizmor (prepare)'
         # Replace custom bash-like shell designators with the standard one to make linters process them
         run: sed -i.bak -E 's/shell\x3a .+ zizmor\x3a ignore.+$/shell\x3a bash/g' .github/workflows/*.yml
 
@@ -221,25 +221,6 @@ jobs:
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           git ls-files '.github/actions/**/*.yml' '.github/dependabot.yml' '.github/workflows/*.yml' -z | xargs -0 -r zizmor --persona auditor -- || true
 
-      - name: 'actionlint'
-        background: true
-        run: |
-          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
-          export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
-          actionlint --version
-          actionlint \
-            --ignore matrix \
-            --ignore ubuntu-26.04 \
-            --ignore ubuntu-24.04-firewall \
-            --ignore xcode-27 \
-            --ignore 'unexpected key "background"' \
-            --ignore 'unexpected key "cache-mode"' \
-            --ignore 'unexpected key "wait"' \
-            --ignore 'unexpected key "wait-all"' \
-            --ignore 'must run script with "run" section' \
-            --ignore 'invalid format because ref is missing' \
-            .github/workflows/*.yml
-
       - name: 'shellcheck CI'
         background: true
         run: |

.github/workflows/linux.yml

@@ -404,6 +404,7 @@ jobs:
             install_packages: clang-22 libubsan1 libasan8 libtsan2
             install_steps: pytest
             install_steps_brew: openssl libssh2 libngtcp2 libnghttp3 c-ares
+            tflags: '!664 !665'  # MD5 support is disabled in Homebrew since libssh2 1.11.1_6
             CC: clang-22
             CFLAGS: >-
               -fsanitize=address,bounds,leak,signed-integer-overflow,undefined

.github/workflows/macos.yml

@@ -79,7 +79,6 @@ jobs:
             install_steps: libressl
             # FIXME: Could not make OPENSSL_ROOT_DIR work. CMake seems to prepend sysroot to it.
             generator: Xcode
-            xcode: ''  # default Xcode. Set it once to silence actionlint.
             options: --config Debug
             generate: >-
               -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED=OFF
@@ -235,7 +234,6 @@ jobs:
             compiler: gcc-13
             configure: --without-ssl --with-brotli --with-zstd --with-apple-idn
             tflags: '--min=1620'
-            xcode: ''  # default Xcode. Set it once to silence actionlint.
 
           - name: '!ssl libssh2 AppleIDN'
             compiler: clang

.github/workflows/windows.yml

@@ -254,6 +254,7 @@ jobs:
       LDFLAGS: -s
       MAKEFLAGS: -j 5
       MATRIX_BUILD: '${{ matrix.build }}'
+      MATRIX_ENV: '${{ matrix.env }}'
       MATRIX_OPENSSH: '${{ matrix.openssh }}'
       MATRIX_SYS: '${{ matrix.sys }}'
       MATRIX_TEST: '${{ matrix.test }}'
@@ -263,34 +264,30 @@ jobs:
           # MSYS
           - { name: '!proxy',
               build: 'cmake'    , sys: 'msys'      , env: 'x86_64'       , tflags: 'skiprun',
-              config: '-DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_DISABLE_PROXY=ON -DCURL_ENABLE_NTLM=ON',
-              install: 'openssl-devel libssh2-devel' }
+              config: '-DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF -DCURL_DISABLE_PROXY=ON -DCURL_ENABLE_NTLM=ON' }
           - { name: 'default R',
               build: 'autotools', sys: 'msys'      , env: 'x86_64'       , tflags: '',
               config: '--with-openssl --enable-httpsig --enable-ntlm',
-              install: 'openssl-devel libssh2-devel' }
+              install: 'diffutils' }  # for tests
           # MinGW
           - { name: 'default',
               build: 'autotools', sys: 'clang64'   , env: 'clang-x86_64' , tflags: 'skiprun',
-              config: '--enable-debug --with-openssl --disable-threaded-resolver --enable-static --without-zlib',
-              install: 'mingw-w64-clang-x86_64-openssl mingw-w64-clang-x86_64-libssh2' }
+              config: '--enable-debug --with-openssl --disable-threaded-resolver --enable-static --without-zlib' }
           - { name: 'wolfssl c-ares U',
               build: 'autotools', sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: '',
               config: '--enable-debug --with-wolfssl --enable-windows-unicode --enable-ares --enable-static --disable-shared --enable-ca-native --enable-ntlm',
-              install: 'mingw-w64-ucrt-x86_64-c-ares mingw-w64-ucrt-x86_64-nghttp3 mingw-w64-ucrt-x86_64-libssh2 mingw-w64-ucrt-x86_64-wolfssl' }
+              install: 'mingw-w64-ucrt-x86_64-wolfssl' }
           - { name: 'schannel c-ares U', type: 'Debug',
               build: 'cmake'    , sys: 'clang64'   , env: 'clang-x86_64' , tflags: '--min=1850',
               config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON -DCURL_DROP_UNUSED=ON',
-              install: 'mingw-w64-clang-x86_64-c-ares mingw-w64-clang-x86_64-libssh2 mingw-w64-clang-x86_64-python' }
+              install: 'mingw-w64-clang-x86_64-python' }  # for dict and telnet tests
           # MinGW torture
           - { name: 'schannel U torture 1', type: 'Debug',
               build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: '-t --shallow=13 --subset=0/2 --min=920',
-              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON',
-              install: 'mingw-w64-ucrt-x86_64-c-ares mingw-w64-ucrt-x86_64-libssh2' }
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON' }
           - { name: 'schannel U torture 2', type: 'Debug',
               build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: '-t --shallow=13 --subset=1/2 --min=900',
-              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON',
-              install: 'mingw-w64-ucrt-x86_64-c-ares mingw-w64-ucrt-x86_64-libssh2' }
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON' }
           # WARNING: libssh uses hard-coded world-writable paths (C:ProgramData/, /etc/..., ~/.ssh/)
           #          to read its configuration from, making it vulnerable to attacks on
           #          Windows. Do not use this component till there is a fix for these.
@@ -299,27 +296,23 @@ jobs:
           - { name: 'gnutls libssh', type: 'Debug', openssh: 'OpenSSH-Windows',
               build: 'cmake'    , sys: 'clang64'   , env: 'clang-x86_64' , tflags: '',
               config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_GNUTLS=ON -DENABLE_UNICODE=OFF -DUSE_NGTCP2=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON -DCURL_ENABLE_NTLM=ON',
-              install: 'mingw-w64-clang-x86_64-gnutls mingw-w64-clang-x86_64-nghttp3 mingw-w64-clang-x86_64-ngtcp2 mingw-w64-clang-x86_64-libssh unzip' }
+              install: 'mingw-w64-clang-x86_64-gnutls mingw-w64-clang-x86_64-libssh unzip' }
           - { name: 'schannel R', type: 'Release', image: 'windows-11-arm',
               build: 'cmake'    , sys: 'clangarm64', env: 'clang-aarch64', tflags: 'skiprun',
-              config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DCURL_DROP_UNUSED=ON',
-              install: 'mingw-w64-clang-aarch64-libssh2' }
+              config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DCURL_DROP_UNUSED=ON' }
           - { name: 'openssl', type: 'Debug', chkprefill: '_chkprefill',
               build: 'cmake'    , sys: 'clang64'   , env: 'clang-x86_64' , tflags: 'skiprun',
-              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_OPENSSL=ON  -DENABLE_UNICODE=OFF -DUSE_NGTCP2=ON -DUSE_PROXY_HTTP3=ON',
-              install: 'mingw-w64-clang-x86_64-openssl mingw-w64-clang-x86_64-nghttp3 mingw-w64-clang-x86_64-ngtcp2 mingw-w64-clang-x86_64-libssh2' }
+              config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_OPENSSL=ON  -DENABLE_UNICODE=OFF -DUSE_NGTCP2=ON -DUSE_PROXY_HTTP3=ON' }
           - { name: 'openssl', type: 'Release', test: 'uwp',
               build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: 'skiprun',
-              config: '-DBUILD_SHARED_LIBS=ON  -DCURL_USE_OPENSSL=ON',
-              install: 'mingw-w64-ucrt-x86_64-openssl mingw-w64-ucrt-x86_64-libssh2' }
+              config: '-DBUILD_SHARED_LIBS=ON  -DCURL_USE_OPENSSL=ON' }
           # { name: 'schannel', type: 'Release', test: 'uwp',
           #   build: 'autotools', sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: 'skiprun',
-          #   config: '--without-debug --with-schannel --disable-static',
-          #   install: 'mingw-w64-ucrt-x86_64-libssh2' }
+          #   config: '--without-debug --with-schannel --disable-static' }
           - { name: 'schannel dev debug', type: 'Debug', cppflags: '-DCURL_SCHANNEL_DEV_DEBUG', image: 'windows-2025',
               build: 'cmake'    , sys: 'ucrt64'    , env: 'ucrt-x86_64'  , tflags: 'skiprun',
               config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DCURL_USE_WOLFSSL=ON -DENABLE_UNICODE=ON -DCURL_DISABLE_HTTPSIG=OFF',
-              install: 'mingw-w64-ucrt-x86_64-libssh2 mingw-w64-ucrt-x86_64-wolfssl' }
+              install: 'mingw-w64-ucrt-x86_64-wolfssl' }
       fail-fast: false
     steps:
       - name: 'preinstalled tools'
@@ -331,27 +324,48 @@ jobs:
         with:
           msystem: ${{ matrix.sys }}
           # https://packages.msys2.org/search
+          # Packages that are used by most jobs. They each inflate cache size and come with a per-job install overhead.
+          # Add individual package requirements to the matrix `install:` entry instead.
           install: >-
-            gcc
-            ${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || 'ninja' }}
-            perl diffutils
-            zlib-devel
-            brotli-devel
-            libzstd-devel
-            libnghttp2-devel
-            libpsl-devel
-            ${{ matrix.install }}
+            gcc perl
+            zlib-devel brotli-devel libzstd-devel libpsl-devel libnghttp2-devel
+            openssl-devel libssh2-devel
 
       - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         if: ${{ matrix.sys != 'msys' }}
         with:
           msystem: ${{ matrix.sys }}
+          # Packages that are used by most jobs. They each inflate cache size and come with a per-job install overhead.
+          # Add individual package requirements to the matrix `install:` entry instead.
           install: >-
             perl diffutils
             mingw-w64-${{ matrix.env }}-cc
-            mingw-w64-${{ matrix.env }}-${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || '' }}
             mingw-w64-${{ matrix.env }}-libpsl
-            ${{ matrix.install }}
+            mingw-w64-${{ matrix.env }}-libssh2
+            mingw-w64-${{ matrix.env }}-c-ares
+            mingw-w64-${{ matrix.env }}-nghttp3
+            mingw-w64-${{ matrix.env }}-ngtcp2
+            mingw-w64-${{ matrix.env }}-openssl
+
+      - name: 'install prereqs'
+        env:
+          MATRIX_INSTALL: '${{ matrix.install }}'
+        run: |
+          # Install build tools in a separate step to avoid inflating shared cache size and being installed even if unused.
+          if [ "${MATRIX_SYS}" = 'msys' ]; then
+            if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+              pkgs='cmake ninja'
+            else
+              pkgs='autotools'
+            fi
+          else
+            if [ "${MATRIX_BUILD}" = 'cmake' ]; then
+              pkgs="mingw-w64-${MATRIX_ENV}-cmake"
+            else
+              pkgs="mingw-w64-${MATRIX_ENV}-autotools"
+            fi
+          fi
+          /usr/bin/pacman --noconfirm --noprogressbar --sync --needed ${pkgs} ${MATRIX_INSTALL}
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -368,7 +382,6 @@ jobs:
           CPPFLAGS: '${{ matrix.cppflags }}'
           MATRIX_CHKPREFILL: '${{ matrix.chkprefill }}'
           MATRIX_CONFIG: '${{ matrix.config }}'
-          MATRIX_ENV: '${{ matrix.env }}'
           MATRIX_TYPE: '${{ matrix.type }}'
           TFLAGS: '${{ matrix.tflags }}'
         run: |
@@ -514,7 +527,7 @@ jobs:
         if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
         timeout-minutes: ${{ contains(matrix.tflags, '-t') && 15 || 10 }}
         env:
-          MATRIX_ENV: '${{ matrix.env }}'
+          MATRIX_CONFIG: '${{ matrix.config }}'
           MATRIX_INSTALL: '${{ matrix.install }}'
           TFLAGS: '${{ matrix.tflags }}'
         run: |
@@ -527,14 +540,14 @@ jobs:
               unset CURL_TEST_SSH_KEYALGO  # libssh2 built with WinCNG does not support ssh-ed25519 hostkeys
               export CURL_TEST_SSH_ENABLE_KEX=diffie-hellman-group-exchange-sha256
             fi
-            if [[ "${MATRIX_INSTALL} " = *'-libssh '* && \
+            if [[ "${MATRIX_CONFIG} " = *'-DCURL_USE_LIBSSH=ON'* && \
                   "${MATRIX_ENV}" = *'x86_64'* ]]; then
               export CURL_TEST_SSH_DISABLE_KEX=mlkem768x25519-sha256  # broken with libssh 0.12.0 Windows x64
             fi
           fi
           if [ -n "${MATRIX_OPENSSH}" ]; then  # OpenSSH-Windows
             TFLAGS+=' ~601 ~603 ~617 ~619 ~621 ~641 ~665 ~2004 ~3022'  # SCP
-            if [[ "${MATRIX_INSTALL} " = *'libssh '* ]]; then
+            if [[ "${MATRIX_CONFIG} " = *'-DCURL_USE_LIBSSH=ON'* ]]; then
               TFLAGS+=' ~614'  # 'SFTP pre-quote chmod' SFTP, pre-quote, directory
             fi
           fi
@@ -638,7 +651,6 @@ jobs:
             config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DCURL_TARGET_WINDOWS_VERSION=0x0600'
             type: 'Debug'
             tflags: 'skipall'
-            chkprefill: ''  # Set it once to silence actionlint
       fail-fast: false
     steps:
       - name: 'preinstalled tools'
@@ -1000,7 +1012,7 @@ jobs:
       - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         with:
           msystem: ${{ matrix.arch == 'arm64' && 'clangarm64' || 'ucrt64' }}
-          release: ${{ contains(matrix.image, 'arm') }}
+          release: false
           cache: ${{ contains(matrix.image, 'arm') }}
           path-type: inherit
           install: >-

renovate.json

@@ -49,7 +49,6 @@
       "description": "Schedule package updates on the 10th of each month",
       "matchPackageNames": [
         "/codeql/i",
-        "/pyrefly/i",
         "/ruff/i"
       ],
       "groupName": "monthly updates by name",

tests/data/test2007

@@ -20,7 +20,7 @@ sftp
 SFTP quote rmdir command with trailing junk
 </name>
 <command>
---hostpubmd5 %SSHSRVMD5 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -Q "mkdir /tmp/test trailing_garbage"
+--hostpubsha256 %SSHSRVSHA256 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: sftp://%HOSTIP:%SSHPORT%SFTP_PWD/%LOGDIR/file%TESTNUMBER.txt -Q "mkdir /tmp/test trailing_garbage"
 </command>
 </client>