[release] gnurl-7.72.0

[Nikita Gillmann]

Hi,
 
I have just released gnurl 7.72.0, following the 7.71.0, 7.71.1 and 7.72.0 releases of curl.

This release incorporates changes from the previous curl releases.
If you encounter any issues please let me know.
 
CHANGELOG for gnurl-7.72.0 released 2020-04-30 (curl 7.72.0)
------------------------------------------------------------
 
gnurl:
	No significant changes

curl:
Fixed in 7.72.0 - August 19 2020 

Changes:

• content_encoding: add zstd decoding support
• CURL_PUSH_ERROROUT: allow the push callback to fail the parent stream
• CURLINFO_EFFECTIVE_METHOD: added

Bugfixes:

• CVE-2020-8231: libcurl: wrong connect-only connection
• appveyor: collect libcurl.dll variants with prefix or suffix
• asyn-ares: correct some bad comments
• bearssl: fix build with disabled proxy support
• buildconf: avoid array concatenation in die()
• buildconf: retire ares buildconf invocation
• checksrc: ban gmtime/localtime
• checksrc: invoke script with -D to find .checksrc proper
• CI/azure: install libssh2 for use with msys2-based builds
• CI/azure: unconditionally enable warnings-as-errors with autotools
• CI/macos: enable warnings as errors for CMake builds
• CI/macos: set minimum macOS version
• CI/macos: unconditionally enable warnings-as-errors with autotools
• CI: Add muse CI analyzer
• cirrus-ci: upgrade 11-STABLE to 11.4
• CMake: don't complain about missing nroff
• CMake: fix test for warning suppressions
• cmake: fix windows xp build
• configure.ac: Sort features name in summary
• configure: allow disabling warnings
• configure: cleanup wolfssl + pkg-config conflicts when cross compiling.
• configure: show zstd "no" in summary when built without it
• connect: remove redundant message about connect failure
• curl-config: ignore REQUIRE_LIB_DEPS in --libs output
• curl.1: add a few missing valid exit codes
• curl: add %{method} to the -w variables
• curl: improve the existing file check with -J
• curl_multi_setopt: fix compiler warning "result is always false"
• curl_version_info.3: CURL_VERSION_KERBEROS4 is deprecated
• CURLINFO_CERTINFO.3: fix typo
• CURLOPT_NOBODY.3: clarify what setting to 0 means
• docs: add date of 7.20 to CURLM_CALL_MULTI_PERFORM mentions
• docs: Add video link to docs/CONTRIBUTE.md
• docs: change "web site" to "website"
• docs: clarify MAX_SEND/RECV_SPEED functionality
• docs: Update a few leftover mentions of DarwinSSL
• doh: remove redundant cast
• file2memory: use a define instead of -1 unsigned value
• ftp: don't do ssl_shutdown instead of ssl_close
• ftpserver: don't verify SMTP MAIL FROM names
• getinfo: reset retry-after value in initinfo
• gnutls: repair the build with `CURL_DISABLE_PROXY`
• gtls: survive not being able to get name/issuer
• h2: repair trailer handling
• http2: close the http2 connection when no more requests may be sent
• http2: fix nghttp2_strerror -> nghttp2_http2_strerror in debug messages
• libssh2: s/ssherr/sftperr/
• libtest/Makefile.am: add -no-undefined for libstubgss for Cygwin
• md(4|5): don't use deprecated macOS functions
• mprintf: Fix dollar string handling
• mprintf: Fix stack overflows
• multi: Condition 'extrawait' is always true
• multi: Remove 10-year old out-commented code
• multi: remove two checks always true
• multi: update comment to say easyp list is linear
• multi_remove_handle: close unused connect-only connections
• ngtcp2: adapt to error code rename
• ngtcp2: adjust to recent sockaddr updates
• ngtcp2: update to modified qlog callback prototype
• nss: fix build with disabled proxy support
• ntlm: free target_info before (re-)malloc
• openssl: fix build with LibreSSL < 2.9.1
• page-header: provide protocol details in the curl.1 man page
• quiche: handle calling disconnect twice
• runtests.pl: treat LibreSSL and BoringSSL as OpenSSL
• runtests: move the gnutls-serv tests to a dynamic port
• runtests: move the smbserver to use a dynamic port number
• runtests: move the TELNET server to a dynamic port
• runtests: run the DICT server on a random port number
• runtests: run the http2 tests on a random port number
• runtests: support dynamicly base64 encoded sections in tests
• setopt: unset NOBODY switches to GET if still HEAD
• smtp_parse_address: handle blank input string properly
• socks: use size_t for size variable
• strdup: remove the odd strlen check
• test1119: verify stdout in the test
• test1139: make it display the difference on test failures
• test1140: compare stdout
• test1908: treat file as text
• tests/FILEFORMAT.md: mention %HTTP2PORT
• tests/sshserver.pl: fix compatibility with OpenSSH for Windows
• TLS naming: fix more Winssl and Darwinssl leftovers
• tls-max.d: this option is only for TLS-using connections
• tlsv1.3.d. only for TLS-using connections
• tool_doswin: Simplify Windows version detection
• tool_getparam: make --krb option work again
• TrackMemory tests: ignore realloc and free in getenv.c
• transfer: fix data_pending for builds with both h2 and h3 enabled
• transfer: fix memory-leak with CURLOPT_CURLU in a duped handle
• transfer: move retrycount from connect struct to easy handle
• travis/script.sh: fix use of `-n' with unquoted envvar
• travis: add ppc64le and s390x builds
• travis: update quiche builds for new boringssl layout
• url: fix CURLU and location following
• url: silence MSVC warning
• util: silence conversion warnings
• win32: Add Curl_verify_windows_version() to curlx
• WIN32: stop forcing narrow-character API
• windows: add unicode to feature list
• windows: disable Unix Sockets for old mingw

Fixed in 7.71.1 - July 1 2020

Bugfixes:

• cirrus-ci: disable FreeBSD 13 (again)
• Curl_inet_ntop: always check the return code
• CURLOPT_READFUNCTION.3: provide the upload data size up front
• DYNBUF.md: fix a typo: trail => tail
• escape: make the URL decode able to reject only %00-bytes
• escape: zero length input should return a zero length output
• examples/multithread.c: call curl_global_cleanup()
• http2: set the correct URL in pushed transfers
• http: fix proxy auth with blank password
• mbedtls: fix build with disabled proxy support
• ngtcp2: sync with current master
• openssl: Fix compilation on Windows when ngtcp2 is enabled
• Revert "multi: implement wait using winsock events"
• sendf: improve the message on client write errors
• terminology: call them null-terminated strings
• tool_cb_hdr: Fix etag warning output and return code
• url: allow user + password to contain "control codes" for HTTP(S)
• vtls: compare cert blob when finding a connection to reuse

Fixed in 7.71.0 - June 24 2020

Changes:

• CURLOPT_SSL_OPTIONS: optional use of Windows' CA store (with openssl)
• setopt: add CURLOPT_PROXY_ISSUERCERT(_BLOB) for coherency
• setopt: support certificate options in memory with struct curl_blob
• tool: Add option --retry-all-errors to retry on any error

Bugfixes:

• *_sspi: fix bad uses of CURLE_NOT_BUILT_IN
• all: fix codespell errors
• altsvc: bump to h3-29
• altsvc: fix 'dsthost' may be used uninitialized in this function
• altsvc: fix parser for lines ending with CRLF
• altsvc: remove the num field from the altsvc struct
• appveyor: add non-debug plain autotools-based build
• appveyor: disable flaky test 1501 and ignore broken 1056
• appveyor: disable test 1139 instead of ignoring it
• asyn-*: remove support for never-used NULL entry pointers
• azure: use matrix strategy to avoid configuration redundancy
• build: disable more code/data when built without proxy support
• buildconf: remove -print from the find command that removes files
• checksrc: enhance the ASTERISKSPACE and update code accordingly
• CI/macos: fix 'is already installed' errors by using bundle
• cirrus: disable SFTP and SCP tests
• CMake: add ENABLE_ALT_SVC option
• CMake: add HTTP/3 support (ngtcp2+nghttp3, quiche)
• CMake: add libssh build support
• CMake: do not build test programs by default
• CMake: fix runtests.pl with CMake, add new test targets
• CMake: ignore INTERFACE_LIBRARY targets for pkg-config file
• CMake: rebuild Makefile.inc.cmake when Makefile.inc changes
• CODE_REVIEW.md: how to do code reviews in curl
• configure: fix pthread check with static boringssl
• configure: for wolfSSL, check for the DES func needed for NTLM
• configure: only strip first -L from LDFLAGS
• configure: repair the check if argv can be written to
• configure: the wolfssh backend does not provide SCP
• connect: improve happy eyeballs handling
• connect: make happy eyeballs work for QUIC (again)
• curl.1: Quote globbed URLs
• curl: remove -J "informational" written on stdout
• Curl_addrinfo: use one malloc instead of three
• CURLINFO_ACTIVESOCKET.3: clarify the description
• doc: add missing closing parenthesis in CURLINFO_SSL_VERIFYRESULT.3
• doc: Rename VERSIONS to VERSIONS.md as it already has Markdown syntax
• docs/HTTP3: add qlog to the quiche build instruction
• docs/options-in-versions: which version added each cmdline option
• docs: unify protocol lists
• dynbuf: introduce internal generic dynamic buffer functions
• easy: fix dangling pointer on easy_perform fail
• examples/ephiperfifo: turn off interval when setting timerfd
• examples/http2-down/upload: add error checks
• examples: remove asiohiper.cpp
• FILEFORMAT: add more features that tests can depend on
• FILEFORMAT: describe verify/stderr
• ftp: make domore_getsock() return the secondary socket properly
• ftp: mark return-ignoring calls to Curl_GetFTPResponse with (void)
• ftp: shut down the secondary connection properly when SSL is used
• GnuTLS: Backend support for CURLINFO_SSL_VERIFYRESULT
• hostip: make Curl_printable_address not return anything
• hostip: on macOS avoid DoH when given a numerical IP address
• http2: keep trying to send pending frames after req.upload_done
• http2: simplify and clean up trailer handling
• HTTP3.md: clarify cargo build directory
• http: move header storage to Curl_easy from connectdata
• libcurl.pc: Merge Libs.private into Libs for static-only builds
• libssh2: improved error output for wrong quote syntax
• libssh2: keep sftp errors as 'unsigned long'
• libssh2: set the expected total size in SCP upload init
• libtest/cmake: Remove commented code
• list-only.d: this option existed already in 4.0
• manpage: add three missing environment variables
• multi: add defensive check on data->multi->num_alive
• multi: implement wait using winsock events
• ngtcp2: cleanup memory when failing to connect
• ngtcp2: fix build with current ngtcp2 master implementing draft 28
• ngtcp2: fix happy eyeballs quic connect crash
• ngtcp2: introduce qlog support
• ngtcp2: never call fprintf() in lib code in release version
• ngtcp2: update with recent API changes
• ntlm: enable NTLM support with wolfSSL
• OpenSSL: have CURLOPT_CRLFILE imply CURLSSLOPT_NO_PARTIALCHAIN
• openssl: set FLAG_TRUSTED_FIRST unconditionally
• projects: Add crypt32.lib to dependencies for all OpenSSL configs
• quiche: clean up memory properly when failing to connect
• quiche: enable qlog output
• quiche: update SSLKEYLOGFILE support
• Revert "buildconf: use find -execdir"
• Revert "ssh: ignore timeouts during disconnect"
• runtests: remove sleep calls
• runtests: show elapsed test time with higher precision (ms)
• select: always use Sleep in Curl_wait_ms on Win32
• select: fix overflow protection in Curl_socket_check
• sendf: make failf() use the mvsnprintf() return code
• server/sws: fix asan warning on use of uninitialized variable
• server/util: fix logmsg format using curl_off_t argument
• sha256: fixed potentially uninitialized variable
• share: don not set the share flag it something fails
• sockfilt: make select_ws stop waiting on exit signal event
• socks: detect connection close during handshake
• socks: fix expected length of SOCKS5 reply
• socks: remove unreachable breaks in socks.c and mime.c
• source cleanup: remove all custom typedef structs
• test1167: fixes in badsymbols.pl
• test1177: look for curl.h in source directory
• test1238: avoid tftpd being busy for tests shortly following
• test613.pl: make tests 613 and 614 work with OpenSSH for Windows
• test75: Remove precheck test
• tests: add https-proxy support to the test suite
• tests: add support for SSH server variant specific transfer paths
• tests: add two simple tests for --login-options
• tests: make test 1248 + 1249 use %NOLISTENPORT
• tests: pick a random port number for SSH
• tests: run stunnel for HTTPS and FTPS on dynamic ports
• timeouts: change millisecond timeouts to timediff_t from time_t
• timeouts: move ms timeouts to timediff_t from int and long
• tool: fixup a few --help descriptions
• tool: support UTF-16 command line on Windows
• tool_cfgable: free login_options at exit
• tool_getparam: -i is not OK if -J is used
• tool_getparam: fix memory leak in parse_args
• tool_operate: fixed potentially uninitialized variables
• tool_paramhlp: fixed potentially uninitialized strtol() variable
• transfer: close connection after excess data has been read
• travis: add "qlog" as feature in the quiche build
• travis: Add ngtcp2 and quiche tests for CMake
• travis: upgrade to bionic, clang-9, improve readability
• typecheck-gcc.h: CURLINFO_PRIVATE does not need a 'char *'
• unit1604.c: fix implicit conv from 'SANITIZEcode' to 'CURLcode'
• url: accept "any length" credentials for proxy auth
• url: alloc the download buffer at transfer start
• url: make the updated credentials URL-encoded in the URL
• url: reject too long input when parsing credentials
• url: sort the protocol schemes in rough popularity order
• urlapi: accept :: as a valid IPv6 address
• urldata: leave the HTTP method untouched in the set.* struct
• urlglob: treat literal IPv6 addresses with zone IDs as a host name
• user-agent.d: spell out what happens given a blank argument
• vauth/cleartext: fix theoretical integer overflow
• version.d: expanded and alpha-sorted
• vtls: Extract and simplify key log file handling from OpenSSL
• wolfssl: add SSLKEYLOGFILE support
• wording: avoid blacklist/whitelist stereotypes
• write-out.d: added "response_code"

CHECKSUMS
---------

SHA1 (gnurl-7.72.0.tar.gz) = 81feb97a7dba6a1b7e804410f9b02d62d23e07c0
SHA1 (gnurl-7.72.0.tar.Z) = 358e7b950f8c407c7f621b82359966ec1bdd5ac2
SHA1 (gnurl-7.72.0.pax.Z) = 358e7b950f8c407c7f621b82359966ec1bdd5ac2
SHA512 (gnurl-7.72.0.tar.gz) = 7dc28b5647d85f9e9c5b71c3b80f73572bf162e5c093ff8c407c1c2765a9ac839fcb8a0d6ff38c6f7ec0bbb0104137bfc39e4af0a48a593b845a61b22d108234
SHA512 (gnurl-7.72.0.tar.Z) = b68474750b6020ee4d82ec477c4c37b597eb74a688691e075d89422a72eca9a74600023bf4015c8e6a25e1a034df306010b137cce49a87c3faa08a117c5e37a5
SHA512 (gnurl-7.72.0.pax.Z) = b68474750b6020ee4d82ec477c4c37b597eb74a688691e075d89422a72eca9a74600023bf4015c8e6a25e1a034df306010b137cce49a87c3faa08a117c5e37a5
RMD160 (gnurl-7.72.0.tar.gz) = 562f04d2ca5bba05e63cd8cc46572d258f561164
RMD160 (gnurl-7.72.0.tar.Z) = 340adb9bdf8e80c24c511ef7a5241f70e382da62
RMD160 (gnurl-7.72.0.pax.Z) = 340adb9bdf8e80c24c511ef7a5241f70e382da62


DOWNLOADS
---------

The files can be be found as usual on the gnu ftp and ftpmirrors in
the gnunet subfolder, ie https://ftp.gnu.org/gnu/gnunet/ usually.

0xD6B570842F7E7F8D.asc
Description: application/pgp-keys