dgit.raspbian.org Git - curl.git/log

Merge version 7.88.1-10+rpi1+deb12u14 and 7.88.1-10+deb12u15 to produce 7.88.1-10+rpi1+deb12u15

Merge curl (7.88.1-10+deb12u15) import into refs/heads/workingbranch

Build with NSS.

Origin: vendor
Forwarded: not-needed
Reviewed-by: Alessandro Ghedini <ghedo@debian.org>
Last-Update: 2015-08-12

Gbp-Pq: Name 99_nss.patch

Build with GnuTLS.

Origin: vendor
Forwarded: not-needed
Reviewed-by: Alessandro Ghedini <ghedo@debian.org>
Last-Update: 2018-05-23

Gbp-Pq: Name 90_gnutls.patch

[PATCH] http_chunks: reset the trailer to avoid memory leak

Brought-by: dheerajsangamkar on github
URL: https://github.com/curl/curl/issues/17749

Gbp-Pq: Name 0001-http_chunks-reset-the-trailer-to-avoid-memory-leak.patch

curl_path: make SFTP handle a path like /~ properly.

... without a trailing slash.

Fixes #17534
Closes #17542

Origin: upstream, https://github.com/curl/curl/commit/0ede81dcc61844cecce8904fb4de24319afeb024
Bug: https://github.com/curl/curl/issues/17534
Last-Update: 2025-06-09

Gbp-Pq: Name fix-CVE-2023-27534-regression-2.patch

curl_path: bring back support for SFTP path ending in /~

libcurl used to do a directory listing for this case (even though the
documentation says a URL needs to end in a slash for this), but
4e2b52b5f7a3 modified the behavior.

This change brings back a directory listing for SFTP paths that are
specified exactly as /~ in the URL.

Reported-by: Pavel Mayorov
Fixes #11001
Closes #11023

Origin: upstream, https://github.com/curl/curl/commit/91b53efa4b6854dc3688f55bfb329b0cafcf5325
Bug: https://github.com/curl/curl/issues/11001
Last-Update: 2025-06-09

Gbp-Pq: Name fix-CVE-2023-27534-regression-1.patch

runtests.pl: Increase variance of random seed used for tests's port designation

Patched on Debian to add day, hour and min to the seed, e.g.: 201912091530
The version of curl we ship on bookworm is too prone to port conflicts on tests,
this is the least intrusive workaround as it makes each retry use a different seed.

Gbp-Pq: Name runtests_port_random_seed_variance.patch

Gbp-Pq: Name runtests.pl-Increase-variance-of-random-seed-used-for-tes.patch

[PATCH] setopt: clear proxy auth properties when switching

Verify with test 1588

Closes #21453

Backported-by: Samuel Henrique <samueloph@debian.org>
* lib/setopt.c: upstream's CURLOPT_PROXY case lives in a dedicated
   setopt_cptr_proxy() function; in 8.14.1 it is still inline in the
   setopt_cptr() switch. The setproxy() helper is added directly
   above setopt_cptr() and the inline Curl_setstropt() call is
   swapped for setproxy().
* lib/vauth/vauth.h: upstream's hunk also adds a no-op
   Curl_auth_is_digest_supported() macro to the CURL_DISABLE_DIGEST_AUTH
   branch, but our 8.14.1 vauth.h has no such #else branch (the file
   ends the digest block with a bare #endif). Add only the
   Curl_auth_digest_cleanup(x) no-op macro inside a new #else, which
   is the part actually needed by setproxy() in disable-digest builds.
* tests/data/test1588: regression test from upstream with two changes:
   crlf="headers" -> crlf="yes" so the 8.14.1 test runner correctly
   applies CRLF to header lines on both the server-side data and the
   expected protocol block; and the "digest" entry in <features> is
   dropped because the 8.14.1 curlinfo emits the feature toggle as
   "digest-auth" rather than "digest", so the unmodified feature gate
   would always SKIP the test on this branch. Other digest-auth tests
   (e.g. test1061) similarly do not list "digest" as a required
   feature.
* tests/libtest/lib1588.c: rewritten to use the 8.14.1 libtest
   harness (test.h / CURLcode test(char *URL) / easy_init / easy_setopt
   with goto test_cleanup) instead of upstream's newer first.h-based
   one. The init1588() helper also reuses the parent's test_cleanup
   label rather than upstream's separate init_failed label, since
   8.14.1's easy_setopt jumps directly to test_cleanup.

Backported by: Samuel Henrique <samueloph@debian.org>
* Bookworm 7.88.1: lib/setopt.c is a single Curl_vsetopt() function
   with one big switch (no setopt_cptr() sub-switch like trixie).
   Add the setproxy() helper just above Curl_vsetopt() instead, and
   replace the inline Curl_setstropt() in the CURLOPT_PROXY case
   with `result = setproxy(data, va_arg(param, char *));`.
* lib/vauth/vauth.h: bookworm uses CURL_DISABLE_CRYPTO_AUTH (the
   pre-split spelling) instead of CURL_DISABLE_DIGEST_AUTH. Add the
   no-op Curl_auth_digest_cleanup(x) macro under the matching
   #else branch.
* Drop the test additions: bookworm has neither the test1588
   xml-test infrastructure for CONNECT-based digest replay nor the
   modern libtest harness (test.h / CURLcode test(char *URL)) the
   trixie adaptation rewrote against -- backporting the test would
   require touching the test runner setup more aggressively than is
   appropriate for a stable update. The security property (proxy
   auth state cleared on CURLOPT_PROXY change) is the setproxy()
   helper itself.

Gbp-Pq: Name CVE-2026-7168.patch

[PATCH] protocol: disable connection reuse for SMB(S)

Connections should only be reused when using the same "share" (and
perhaps some additional conditions), but instead of fixing this flaw,
this change completely disables connection reuse for SMB. This protocol
is about to get dropped soon anyway.

Reported-by: Osama Hamad
Closes #21238

Backported-by: Samuel Henrique <samueloph@debian.org>
* Upstream removes PROTOPT_CONN_REUSE from the SMB and SMBS scheme
   registrations in lib/protocol.c. That flag (and the lib/protocol.c scheme
   registry itself) only exists from upstream commit
   feea96851230c7a5a11feaffa0a5e4a4d30e5e63 ("conncontrol: reuse handling", Nov
   2025) onward, so neither is present in 8.14.1. In 8.14.1 SMB connection
   reuse is instead controlled at runtime via connkeep() / connclose(), and
   lib/smb.c explicitly calls connkeep() in smb_connect() to mark SMB
   connections as eligible for reuse. Replace that connkeep() with a
   connclose() so SMB connections are marked as not-reusable, achieving the
   same effect as the upstream change.

Backported by: Samuel Henrique <samueloph@debian.org>
* Bookworm 7.88.1: same connkeep() call in smb_connect() at line
   271. Apply the same connkeep() -> connclose() swap; this version
   also lacks PROTOPT_CONN_REUSE so the runtime approach is the
   only way to express "do not reuse this connection".

Gbp-Pq: Name CVE-2026-5773.patch

[PATCH] proxy-auth: additional tests

Also eliminate the special handling for socks proxy match.

Closes #20837

Backported-by: Samuel Henrique <samueloph@debian.org>
* Refresh patch context for lib/url.c

Backported by: Samuel Henrique <samueloph@debian.org>
* Bookworm 7.88.1: same proxy_info_matches and
   socks_proxy_info_matches functions, just at line 863. Bookworm's
   proxy_info_matches still uses strcasecompare() (upstream switched
   to curl_strequal() at some point post-7.88.1), so leave that
   call alone -- only add the new Curl_timestrcmp() user/passwd
   check inside it. Keep socks_proxy_info_matches() in place and
   switch the call site at line 1214 from socks_proxy_info_matches
   to proxy_info_matches, matching the trixie minimal-diff approach.
* Drop the tests/http/test_13_proxy_auth.py and
   tests/http/testenv/curl.py hunks: bookworm has no tests/http/
   pytest infrastructure at all (those tests appeared in upstream
   later than 7.88.1).

Gbp-Pq: Name CVE-2026-3784.patch

[PATCH] http: only send bearer if auth is allowed

Verify with test 2006

Closes #20843

Backported-by: Samuel Henrique <samueloph@debian.org>
* Refresh patch context for lib/http.c
* Adapt the new tests/data/test2006: reuse the
   existing test486 as the base (similarity-copy in the diff), keep the
   test definition structurally as upstream wants but also drop the two
   now-stale "#" comment lines that already differ between upstream's and
   our test486.

Backported by: Samuel Henrique <samueloph@debian.org>
* Bookworm 7.88.1: same output_auth_headers() function, just at
   line 793 (offset +97 vs trixie). Apply only the lib/http.c hunk.
* Drop the test additions: bookworm has neither tests/data/test486
   (which trixie's test2006 was copy-derived from) nor a way to add
   it without pulling in a non-trivial amount of unrelated test
   infrastructure. The security property is the
   Curl_auth_allowed_to_host() guard itself; tests are nice-to-have.

Gbp-Pq: Name CVE-2026-3783.patch

[PATCH] openssl: toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache

Reported-by: Stanislav Fort
Closes #20009

Backported-by: Samuel Henrique <samueloph@debian.org>
* Refresh patch context for lib/vtls/openssl.c

Backported by: Samuel Henrique <samueloph@debian.org>
* Bookworm 7.88.1 names the cache struct `multi_ssl_backend_data`
   (vs `ossl_x509_share` in 8.14.1+) and the helpers `cached_x509_store_*`
   (without the `ossl_` prefix). Apply the same logic against those names.
   Replace the upstream `CURL_UNCONST(data)` macro with a plain
   `(struct Curl_easy *)data` cast since CURL_UNCONST does not exist in
   bookworm.

Gbp-Pq: Name CVE-2025-14819.patch

[PATCH] curl_sasl: if redirected, require permission to use bearer

Closes #19933

Backported-by: Samuel Henrique <samueloph@debian.org>
* Refresh patch context for lib/curl_sasl.c

Backported by: Samuel Henrique <samueloph@debian.org>
* Refresh line numbers for bookworm 7.88.1: same functions
(Curl_sasl_start and Curl_sasl_continue), -7 line offset.

Gbp-Pq: Name CVE-2025-14524.patch

[PATCH] ws: get a new mask for each new outgoing frame

Reported-by: Calvin Ruocco
Closes #18496

Backported-by: Samuel Henrique <samueloph@debian.org>
Backported-by: Alex <alex@puer-robustus.eu>
Changes:
* Refresh patch context for lib/ws.c
* Adapt return value to current function return type

Backported by: Samuel Henrique <samueloph@debian.org>

Changes:
* Apply the per-frame mask generation in ws_packethead() (bookworm
  7.88.1) rather than upstream's ws_enc_add_frame() (and trixie's
  ws_enc_write_head()), since the bookworm code path that builds the
  outgoing frame header is structurally different. On Curl_rand()
  failure return 0 -- ws_packethead() already uses 0 as the
  soft-error sentinel for buffer-too-small.
* Preserve the DEBUGBUILD CURL_WS_FORCE_ZERO_MASK escape hatch
  alongside the new per-frame mask generation, matching upstream.
* Remove the corresponding one-time mask generation in
  Curl_ws_accept(), and initialise `result` to CURLE_OK at
  declaration since it is no longer unconditionally assigned by the
  removed Curl_rand() call.

Gbp-Pq: Name CVE-2025-10148.patch

[PATCH] netrc: 'default' with no credentials is not a match

Test 486 verifies.

Reported-by: Yihang Zhou
Closes #15908

Backported by: Dr. Tobias Quathamer <toddy@debian.org>

Changes:
* Refresh patch context for lib/netrc.c
* Use tests/data/Makefile.inc to add new test instead of
tests/data/Makefile.am, because that has only been
introduced in later versions of curl.
* Replace "%LOGDIR" with "log" due to its absence in bookworm.

Gbp-Pq: Name CVE-2025-0167.patch

[PATCH] netrc: address several netrc parser flaws

- make sure that a match that returns a username also returns a
  password, that should be blank if no password is found

- fix handling of multiple logins for same host where the password/login
  order might be reversed.

- reject credentials provided in the .netrc if they contain ASCII control
  codes - if the used protocol does not support such (like HTTP and WS do)

Reported-by: Harry Sintonen
Add test 478, 479 and 480 to verify. Updated unit 1304.

Closes #15586

Backported by: Matheus Polkorny <mpolkorny@gmail.com>
Based on the work of Marc Deslauriers <marc.deslauriers@ubuntu.com>
for curl 7.81.0-1ubuntu1.20.

Changes:

- Refresh patch context.

- Adjust `%LOGDIR/` to 'log/' due to its absence in bookworm.

- Replaces the previous usage of the state_login, state_password, and
  state_our_login variables with the found_state enum, which includes the
  values NONE, LOGIN, and PASSWORD. As a result, all conditionals and memory
  management logic associated with these variables were updated.

- Updates to use password and login instead of s_password and s_login,
  which do not exist in the Bookworm version. This change preserves the
  same logic while adapting the code to the current structure.

- test478 is disabled as this version of curl does not support searching
  for a specific login in the netrc file.
  (see https://github.com/curl/curl/issues/8241)

- test480 is disabled as this version of curl does not support quoted or
  escaped strings in the netrc file.
  (see https://github.com/curl/curl/issues/8908)

- Small change in the Makefile to add a new test.

Gbp-Pq: Name CVE-2024-11053.patch

[PATCH] url: use same credentials on redirect

Previously it could lose the username and only use the password.

Added test 998 and 999 to verify.

Reported-by: Tobias Bora
Fixes #15262
Closes #15282
Backported by: Matheus Polkorny <mpolkorny@gmail.com>.

Changes:

- Refresh patch context

- Small change in the Makefile to add a new test

Gbp-Pq: Name url-use-same-credentials-on-redirect.patch

[PATCH] tests: 780 - 783, new HSTS tests

test780: verify updated HSTS data in response header

test781: HSTS update expiry, with parent includeSubDomains domain
present

test782: HSTS update expiry, with two includeSubDomains domains present

test783: HSTS update expiry, removing includesubdomains in update

Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>.

Changes:
- Adjust `tests/data/Makefile.inc` to include new HSTS tests (780 - 783).
- Updates 'Debug' to 'debug' in test data files (`test780`, `test781`,
  `test782`, `test783`) to align with curl conventions in bookworm and
  ensure consistency in feature definitions.
- Additionally, `%LOGDIR` is replaced with log in the test files due to
  its absence in curl bookworm.

Gbp-Pq: Name CVE-2024-9681-1.patch

[PATCH] hsts: improve subdomain handling

- on load, only replace existing HSTS entries if there is a full host
match

- on matching, prefer a full host match and secondary the longest tail
subdomain match

Closes #15210

Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>.

Changes:
- Refresh patch context.

Gbp-Pq: Name CVE-2024-9681-0.patch

[PATCH] gtls: fix OCSP stapling management

Reported-by: Hiroki Kurosawa
Closes #14642

Gbp-Pq: Name CVE-2024-8096.patch

x509asn1: unittests and fixes for gtime2str

Fix issues in GTime2str() and add unit test cases to verify correct
behaviour.

Follow-up to 3c914bc6801

Closes #14316

Backported to Debian by Carlos Henrique Lima Melara <charles@debian.org>.

Changes:
- In this version, GTime2str doesn't return CURLcode, so change that to NULL.
- Also change test helper function to match the correct type and pass the
correct arguments. In this version, GTime2str doesn't take struct dynbuf *.
It's aimed to not FTBFS if someone build the package with --enable-debug.

Gbp-Pq: Name CVE-2024-7264-1.patch

x509asn1: clean up GTime2str

Co-authored-by: Stefan Eissing
Reported-by: Dov Murik
Closes #14307

Backported to Debian by Carlos Henrique Lima Melara <charles@debian.org>.

Changes:
- In this version, GTime2str doesn't return CURLcode, so change that to NULL.

Gbp-Pq: Name CVE-2024-7264-0.patch

[PATCH] http2: push headers better cleanup

- provide common cleanup method for push headers

Closes #13054

Backported by: Guilherme Puida Moreira <guilherme@puida.xyz>:
* Changed h2_stream_ctx to HTTP in free_push_headers.

Gbp-Pq: Name CVE-2024-2398.patch

[PATCH] setopt: Fix disabling all protocols

When disabling all protocols without enabling any, the resulting
set of allowed protocols remained the default set. Clearing the
allowed set before inspecting the passed value from --proto make
the set empty even in the errorpath of no protocols enabled.

Co-authored-by: Dan Fandrich <dan@telarity.com>
Reported-by: Dan Fandrich <dan@telarity.com>
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Closes: #13004
Backported by: Guilherme Puida Moreira <guilherme@puida.xyz>
* Small change in the Makefile to add a new test.

Gbp-Pq: Name CVE-2024-2004.patch

[PATCH] fopen: create short(er) temporary file name

Only using random letters in the name plus a ".tmp" extension. Not by
appending characters to the final file name.

Reported-by: Maksymilian Arciemowicz
Closes #12388

Backported by: Samuel Henrique <samueloph@debian.org>:
* The function Curl_rand_alnum was renamed to Curl_rand_hex

Gbp-Pq: Name CVE-2023-46219.patch

[PATCH] cookie: lowercase the domain names before PSL checks

Reported-by: Harry Sintonen
Closes #12387

Backported by: Samuel Henrique <samueloph@debian.org>:
* Update signature of function "bad_domain"

Gbp-Pq: Name CVE-2023-46218.patch

[PATCH] cookie: remove unnecessary struct fields

Plus: reduce the hash table size from 256 to 63. It seems unlikely to
make much of a speed difference for most use cases but saves 1.5KB of
data per instance.

Closes #11862

Backported by: Samuel Henrique <samueloph@debian.org>

Gbp-Pq: Name CVE-2023-38546.patch

[PATCH] socks: return error if hostname too long for remote resolve

Prior to this change the state machine attempted to change the remote
resolve to a local resolve if the hostname was longer than 255
characters. Unfortunately that did not work as intended and caused a
security issue.

Name resolvers cannot resolve hostnames longer than 255 characters.

Bug: https://curl.se/docs/CVE-2023-38545.html

Backported by: Samuel Henrique <samueloph@debian.org>

Gbp-Pq: Name CVE-2023-38545.patch

[PATCH] http: return error when receiving too large header set

To avoid abuse. The limit is set to 300 KB for the accumulated size of
all received HTTP headers for a single response. Incomplete research
suggests that Chrome uses a 256-300 KB limit, while Firefox allows up to
1MB.

Closes #11582

Backport to Debian by Carlos Henrique Lima Melara <charlesmelara@riseup.net>

Gbp-Pq: Name CVE-2023-38039.patch

Fix Autotools not enabling OpenLDAP-specific functionality

Origin: upstream, https://github.com/curl/curl/commit/0ac6108856b9d500bc376d1d7e0b648d15499837.patch
Bug: https://github.com/curl/curl/issues/11372
Applied-Upstream: 8.2.0, https://github.com/curl/curl/commit/0ac6108856b9d500bc376d1d7e0b648d15499837
Reviewed-By: John Scott <jscott@posteo.net>
Last-Update: 2023-07-25

The non-OpenLDAP code paths are less tested, less featureful, less secure,
and omitted in the build system by accident. It has been discovered that this
also mitigates curl not being able to make LDIF output when attributes have
binary values.

Gbp-Pq: Name Use-OpenLDAP-specific-functionality.patch

[PATCH] fopen: optimize

Closes #11419

Gbp-Pq: Name CVE-2023-32001.patch

[PATCH] lib: unify the upload/method handling

By making sure we set state.upload based on the set.method value and not
independently as set.upload, we reduce confusion and mixup risks, both
internally and externally.

Closes #11017

Gbp-Pq: Name CVE-2023-28322.patch

[PATCH] hostcheck: fix host name wildcard checking

The leftmost "label" of the host name can now only match against single
'*'. Like the browsers have worked for a long time.

- extended unit test 1397 for this
- move some SOURCE variables from unit/Makefile.am to unit/Makefile.inc

Reported-by: Hiroki Kurosawa
Closes #11018

Backported to Debian by Samuel Henrique <samueloph@debian.org>

Gbp-Pq: Name CVE-2023-28321.patch

[PATCH] hostip: include easy_lock.h before using GLOBAL_INIT_IS_THREADSAFE

Since that header file is the only place that define can be defined.

Reported-by: Marc Deslauriers
Follow-up to 13718030ad4b3209

Closes #11121

Gbp-Pq: Name CVE-2023-28320-1.patch

[PATCH] hostip: add locks around use of global buffer for alarm()

When building with the sync name resolver and timeout ability we now
require thread-safety to be present to enable it.

Closes #11030

Gbp-Pq: Name CVE-2023-28320.patch

[PATCH] libssh2: free fingerprint better

Reported-by: Wei Chong Tan
Closes #11088

Gbp-Pq: Name CVE-2023-28319.patch

[PATCH] CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe

Reported-by: Hiroki Kurosawa
Closes #10732

Gbp-Pq: Name CVE-2023-27537.patch

[PATCH] url: only reuse connections with same GSS delegation

Reported-by: Harry Sintonen
Closes #10731

Gbp-Pq: Name CVE-2023-27536.patch

[PATCH] ftp: add more conditions for connection reuse

Reported-by: Harry Sintonen
Closes #10730

Gbp-Pq: Name CVE-2023-27535.patch

[PATCH] url: fix the SSH connection reuse check

Reported-by: Harry Sintonen
Closes #10735

Gbp-Pq: Name CVE-2023-27538.patch

[PATCH] curl_path: create the new path with dynbuf

Closes #10729

Gbp-Pq: Name CVE-2023-27534.patch

[PATCH] telnet: only accept option arguments in ascii

To avoid embedded telnet negotiation commands etc.

Reported-by: Harry Sintonen
Closes #10728

Backported to Debian by Samuel Henrique <samueloph@debian.org>

Gbp-Pq: Name CVE-2023-27533.patch

[PATCH] runtests: don't try to stop stunnel before trying again

Calling stopserver() before retrying stunnel due to an error would stop
the dependent server (such as HTTP) meaning stunnel would have nothing
to talk to when it came up. Don't try to force a stop when it didn't
actually start. Also, don't mark the server as bad for future use when
it starts up on a retry.

Reported-by: eaglegai at github
Tested-by: eaglegai at github
Fixes #10976

Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>.

Changes:
- Apply the changes to `runtests.pl` instead of `servers.pm`, as
`servers.pm` does not exist in this version of bookworm.

Gbp-Pq: Name dont-stop-stunnel-before-retry.patch

[PATCH] tests: add 'large-time' as a testable feature

This allows test cases to require this feature to run and to be used in
%if conditions.

Large here means larger than 32 bits. Ie does not suffer from y2038.

Closes #11696

Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>.

Changes:
- Refresh patch context

Gbp-Pq: Name large-time-testable-feature.patch

openldap: create ldap URLs correctly for IPv6 addresses

Reported-by: Sergio Durigan Junior
Fixes #13228
Closes #13235

More context:

When the user specified an IPv6 address to be used as an LDAP server,
curl will fail to properly enclose it in square brackets, which causes
the connection to fail because the host address cannot be
distinguished from the port:

$ curl -v ldap://[fd42:be5:e632:a6b3:216:3eff:feb1:5bc4]:389
...
* LDAP local: Cannot connect to ldap://fd42:be5:e632:a6b3:216:3eff:feb1:5bc4:389, Bad parameter to an ldap routine
...

Fix this by always enclosing the IPv6 address in square brackets.

Origin: upstream, https://github.com/curl/curl/commit/56935a7dada6975d5a46aa494de0af195e4e8659
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053643

Gbp-Pq: Name openldap-create-ldap-URLs-correctly-for-IPv6-addresses.patch

[PATCH] Fixing unix domain socket use in https connects.

- refs #10633, when h2/h3 eyeballing was involved, unix domain socket
configurations were not honoured
- configuring --unix-socket will disable HTTP/3 as candidate for eyeballing
- combinatino of --unix-socket and --http3-only will fail during initialisation
- adding pytest test_11 to reproduce

Gbp-Pq: Name fix-unix-domain-socket.patch

Use correct path when loading libnss{pem,ckbi}.so

Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726073

Gbp-Pq: Name Use-correct-path-when-loading-libnss-pem-ckbi-.so.patch

Remove curl's LDFLAGS from curl-config --static-libs

On current Debian bookworm, the LDFLAGS consist of
-L/usr/lib/${triplet}/mit-krb5 originating from
`pkg-config --libs-only-L mit-krb5-gssapi` from krb5-multidev, plus
some linker options that are intended for curl itself rather than for
dependent packages. None of these are really desirable, and they create
divergence between architectures that would prevent libcurl-*-dev from
being Multi-Arch: same.

The -L flag is not really needed, for the same reason that -L@libdir@
isn't. curl Build-Depends on libkrb5-dev, which doesn't need a special
-L flag to find libgssapi_krb5, and the various libcurl-*-dev packages
have Suggests on libkrb5-dev rather than on krb5-multidev for static
linking.

The other options (currently `-Wl,-z-relro -Wl,-z,now`) are intended
for libcurl itself, and if dependent packages want those options then
they should set them from their own packaging.

Bug-Debian: https://bugs.debian.org/1024668
Forwarded: not-needed
Signed-off-by: Simon McVittie <smcv@collabora.com>
Gbp-Pq: Name Remove-curl-s-LDFLAGS-from-curl-config-static-libs.patch

In order to (partially) multi-arch-ify curl-config, remove all

Origin: vendor
Bug-Debian: http://bugs.debian.org/731998
Forwarded: not-needed
Reviewed-by: Alessandro Ghedini <ghedo@debian.org>
Last-Update: 2017-01-10

mention of @includedir@ and @libdir@ from the script. On Debian, the actual
header and library directories are architecture-dependent, but will always be
in the C compiler's default search path, so -I and -L options are not
necessary (and may be harmful in multi-arch environments.)

Gbp-Pq: Name 11_omit-directories-from-config.patch

build: Divide mit-krb5-gssapi link flags between LDFLAGS and LIBS

From the comments nearby about not having --libs-only-L, it looks as
though the intention was to apply a split like this to all dependency
libraries where possible, and the only reason it was not done for
Kerberos is that krb5-config doesn't have that feature and pkg-config
was originally not supported here. For example, zlib, libssh and librtmp
all have their flags from pkg-config split in this way.

Now that pkg-config is supported here, we can do the intended split.

Signed-off-by: Simon McVittie <smcv@collabora.com>
Gbp-Pq: Name build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch

Enable zsh completion generation

Origin: vendor
Forwarded: not-needed
Reviewed-by: Alessandro Ghedini <ghedo@debian.org>
Last-Update: 2016-08-03

Gbp-Pq: Name 08_enable-zsh.patch

Work around libtool --as-needed reordering bug

Origin: vendor
Bug-Debian: http://bugs.debian.org/347650
Forwarded: not-needed
Reviewed-by: Alessandro Ghedini <ghedo@debian.org>
Last-Update: 2016-08-03

Gbp-Pq: Name 04_workaround_as_needed_bug.patch

curl (7.88.1-10+deb12u15) bookworm; urgency=medium

  * Fix 7 CVEs:
    - CVE-2025-10148
    - CVE-2025-14524
    - CVE-2025-14819
    - CVE-2026-3783
    - CVE-2026-3784
    - CVE-2026-5773
    - CVE-2026-7168

[dgit import unpatched curl 7.88.1-10+deb12u15]

Import curl_7.88.1-10+deb12u15.debian.tar.xz

[dgit import tarball curl 7.88.1-10+deb12u15 curl_7.88.1-10+deb12u15.debian.tar.xz]

Merge version 7.88.1-10+rpi1+deb12u12 and 7.88.1-10+deb12u14 to produce 7.88.1-10+rpi1+deb12u14

Merge curl (7.88.1-10+deb12u14) import into refs/heads/workingbranch