Resolve conf

.circleci/config.yml

@@ -38,28 +38,16 @@ commands:
     steps:
       - run:
           command: |
+            export DEBIAN_FRONTEND=noninteractive
             sudo apt-get update && sudo apt-get install -y libssh-dev
 
   install-deps:
     steps:
       - run:
           command: |
-            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip libpsl-dev
-            sudo python3 -m pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
-
-  install-wolfssl:
-    steps:
-      - run:
-          command: |
-            # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-            WOLFSSL_VERSION=5.8.0
-            echo "Installing wolfSSL $WOLFSSL_VERSION"
-            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 6 --retry-connrefused \
-              --location "https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VERSION-stable.tar.gz" | tar -xz
-            cd wolfssl-$WOLFSSL_VERSION-stable
-            ./autogen.sh
-            ./configure --disable-dependency-tracking --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
-            make install
+            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip
+            python3 -m venv ~/venv
+            ~/venv/bin/pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary -r tests/requirements.txt
 
   configure:
     steps:
@@ -109,16 +97,24 @@ commands:
   build:
     steps:
       - run: make -j3 V=1
+      - run: src/curl --disable --version
       - run: make -j3 V=1 examples
 
   test:
     steps:
-      - run: make -j3 V=1 test-ci TFLAGS='-j14'
+      - run:
+          command: |
+            source ~/venv/bin/activate
+            # Revert a CircleCI-specific local setting that makes test 1459
+            # return 67 (CURLE_LOGIN_DENIED) instead of the
+            # expected 60 (CURLE_PEER_FAILED_VERIFICATION).
+            echo 'StrictHostKeyChecking yes' >> ~/.ssh/config
+            make -j3 V=1 test-ci TFLAGS='-j14'
 
 executors:
   ubuntu:
     machine:
-      image: ubuntu-2004:2024.01.1
+      image: ubuntu-2204:2025.09.1
 
 jobs:
   basic:
@@ -161,7 +157,7 @@ jobs:
 
   arm:
     machine:
-      image: ubuntu-2004:2024.01.1
+      image: ubuntu-2204:2025.09.1
     resource_class: arm.medium
     steps:
       - checkout
@@ -172,7 +168,7 @@ jobs:
 
   arm-cares:
     machine:
-      image: ubuntu-2004:2024.01.1
+      image: ubuntu-2204:2025.09.1
     resource_class: arm.medium
     steps:
       - checkout

.github/dependabot.yml

@@ -2,20 +2,37 @@
 #
 # SPDX-License-Identifier: curl
 
+# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+
 version: 2
 updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'monthly'
+    cooldown:
+      default-days: 7
+    groups:
+      gha-dependencies:
+        patterns:
+          - '*'
     commit-message:
       prefix: 'GHA:'
 
   - package-ecosystem: 'pip'
     directories:
-      - '/.github/scripts'
-      - '/tests'
+      - '.github/scripts'
+      - 'tests'
     schedule:
       interval: 'monthly'
+    cooldown:
+      default-days: 7
+      semver-major-days: 15
+      semver-minor-days: 7
+      semver-patch-days: 3
+    groups:
+      pip-dependencies:
+        patterns:
+          - '*'
     commit-message:
       prefix: 'GHA:'

.github/labeler.yml

@@ -11,7 +11,7 @@
 # the files fit into the category, and the any-glob-to-any-file ones are added
 # as long as any file matches. The first ones are for "major" categories (the
 # PR is all about that one topic, like HTTP/3), while the second ones are
-# "addendums" that give useful information about a PR that's really mostly
+# "addendums" that give useful information about a PR that is really mostly
 # something else (e.g. CI if the PR also touches CI jobs).
 #
 # N.B. any-glob-to-all-files is misnamed; it acts like one-glob-to-all-files.
@@ -65,7 +65,7 @@ build:
               **/*.mk,\
               *.m4,\
               docs/INSTALL-CMAKE.md,\
-              lib/curl_config.h.cmake,\
+              lib/curl_config-cmake.h.in,\
               lib/libcurl*.in,\
               CMake/**,\
               CMakeLists.txt,\
@@ -98,7 +98,7 @@ cmake:
               **/CMakeLists.txt,\
               CMake/**,\
               docs/INSTALL-CMAKE.md,\
-              lib/curl_config.h.cmake,\
+              lib/curl_config-cmake.h.in,\
               tests/cmake/**\
               }"
 
@@ -162,9 +162,9 @@ cryptography:
               docs/libcurl/opts/CURLOPT_EGDSOCKET*,\
               lib/*sha256*,\
               lib/*sha512*,\
-              lib/curl_des.*,\
               lib/curl_hmac.*,\
               lib/curl_md?.*,\
+              lib/curl_ntlm_core.*,\
               lib/md?.*,\
               lib/rand.*\
               }"
@@ -451,6 +451,7 @@ TLS:
   - all:
       - changed-files:
           - any-glob-to-all-files: "{\
+              CMake/FindGnuTLS.cmake,\
               CMake/FindMbedTLS.cmake,\
               CMake/FindWolfSSL.cmake,\
               CMake/FindRustls.cmake,\

.github/scripts/badwords.ok

@@ -0,0 +1,7 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# whitelisted uses of bad words
+# file:[line]:rule
+docs/FAQ.md::\bwill\b

.github/scripts/badwords.pl

@@ -20,6 +20,29 @@
 my @whitelist;
 my %alt;
 my %exactcase;
+my $skip_indented = 1;
+
+if($ARGV[0] eq "-a") {
+    shift @ARGV;
+    $skip_indented = 0;
+}
+my %wl;
+if($ARGV[0] eq "-w") {
+    shift @ARGV;
+    my $file = shift @ARGV;
+    open(W, "<$file") or die "Cannot open '$file': $!";
+    while(<W>) {
+        if(/^#/) {
+            # allow #-comments
+            next;
+        }
+        if(/^([^:]*):(\d*):(.*)/) {
+            $wl{"$1:$2:$3"}=1;
+            #print STDERR "whitelisted $1:$2:$3\n";
+        }
+    }
+    close(W);
+}
 
 my @w;
 while(<STDIN>) {
@@ -30,7 +53,7 @@
     if($_ =~ /^---(.*)/) {
         push @whitelist, $1;
     }
-    elsif($_ =~ /^([^:=]*)([:=])(.*)/) {
+    elsif($_ =~ /^(.*)([:=])(.*)/) {
         my ($bad, $sep, $better)=($1, $2, $3);
         push @w, $bad;
         $alt{$bad} = $better;
@@ -50,7 +73,7 @@ sub file {
         my $in = $_;
         $l++;
         chomp $in;
-        if($in =~ /^    /) {
+        if($skip_indented && $in =~ /^    /) {
             next;
         }
         # remove the link part
@@ -67,8 +90,22 @@ sub file {
                ($in =~ /^(.*)$w/ && $case) ) {
                 my $p = $1;
                 my $c = length($p)+1;
+
+                my $ch = "$f:$l:$w";
+                if($wl{$ch}) {
+                    # whitelisted filename + line + word
+                    print STDERR "$ch found but whitelisted\n";
+                    next;
+                }
+                $ch = $f . "::" . $w;
+                if($wl{$ch}) {
+                    # whitelisted filename + word
+                    print STDERR "$ch found but whitelisted\n";
+                    next;
+                }
+
                 print STDERR  "$f:$l:$c: error: found bad word \"$w\"\n";
-                printf STDERR " %4d | $in\n", $l;
+                printf STDERR " %4d | %s\n", $l, $in;
                 printf STDERR "      | %*s^%s\n", length($p), " ",
                     "~" x (length($w)-1);
                 printf STDERR " maybe use \"%s\" instead?\n", $alt{$w};
@@ -79,9 +116,11 @@ sub file {
     close(F);
 }
 
-my @files = @ARGV;
-
-foreach my $each (@files) {
+my @filemasks = @ARGV;
+open(my $git_ls_files, '-|', 'git', 'ls-files', '--', @filemasks) or die "Failed running git ls-files: $!";
+while(my $each = <$git_ls_files>) {
+    chomp $each;
     file($each);
 }
+close $git_ls_files;
 exit $errors;

.github/scripts/badwords.txt

@@ -3,73 +3,93 @@
 # SPDX-License-Identifier: curl
 #
 back-end:backend
-e-mail:email
+\be-mail[^/]:email
 run-time:runtime
 set-up:setup
 tool chain:toolchain
 tool-chain:toolchain
 wild-card:wildcard
 wild card:wildcard
+\bthread ?safe[^."t]:thread-safe
+\bthread ?unsafe[^."t]:thread-unsafe
+multi ?thread:multi-thread
+\bit's:it is
+aren't:are not
+can't:cannot
+could've:could have
+couldn't:could not
+didn't:did not
+doesn't:does not
+don't:do not
+haven't:have not
+i'd:I would
+i'll:I will
 i'm:I am
-you've:You have
-we've:we have
-we're:we are
-we'll:we will
-we'd:we would
-they've:They have
-they're:They are
-they'll:They will
+i've:I have
+isn't:is not
+it'd:it would
+it'll:it will
+might've:might have
+needn't:need not
+should've:should have
+shouldn't:should not
+that's:that is
+there's:there is
 they'd:They would
-you've:you have
+they'll:They will
+they're:They are
+they've:They have
+this'll:this will
+wasn't:was not
+we'd:we would
+we'll:we will
+we're:we are
+we've:we have
+weren't:were not
+won't:will not
+would've:would have
+wouldn't:would not
 you'd:you would
 you'll:you will
 you're:you are
-should've:should have
-don't=do not
-could've:could have
-doesn't:does not
-isn't:is not
-aren't:are not
+you've:you have
  a html: an html
  a http: an http
  a ftp: an ftp
  a IPv4: an IPv4
  a IPv6: an IPv6
- url =URL
-internet\b=Internet
+ url [^=]=URL
+[^/]internet\b=Internet
 isation:ization
-\bit's:it is
-it'd:it would
-there's:there is
 [^.]\. And: Rewrite it somehow?
 ^(And|So|But) = Rewrite it somehow?
 \. But: Rewrite it somehow?
 \. So : Rewrite without "so" ?
- dir :directory
-can't:cannot
-that's:that is
+ dir [^=]=directory
+ Dir [^=]=Directory
+sub-director:subdirector
 web page:webpage
 host name\b:hostname
 host names\b:hostnames
-file name\b:filename
+[^;<]file name\b:filename
 file names\b:filenames
 \buser name\b:username
 \buser names\b:usernames
 \bpass phrase:passphrase
-didn't:did not
-doesn't:does not
-won't:will not
-couldn't:could not
 \bwill\b:rewrite to present tense
-\b32bit=32-bit
-\b64bit=64-bit
-32 bit\b=32-bit
-64 bit\b=64-bit
+\b32bit:32-bit
+\b64bit:64-bit
+32 bit\b:32-bit
+64 bit\b:64-bit
 64-bits:64 bits or 64-bit
 32-bits:32 bits or 32-bit
 \bvery\b:rephrase using an alternative word
 \bCurl\b=curl
+\bcURL\b=curl
 \bLibcurl\b=libcurl
+\bLibCurl\b=libcurl
 ---WWW::Curl
 ---NET::Curl
 ---Curl Corporation
+\bmanpages[^./;=&{:-]:man pages
+\bmanpage[^si./;=&{:-]:man page