Re: Fwd: [curl] Re: configure: --with-libidn or --with-libidn2?

[ng0]

Leo Famulari <address@hidden> writes:

> On Mon, Dec 26, 2016 at 01:59:22PM +0000, ng0 wrote:
>> It seems as if curl can be build with libidn2 now and they have
>> addressed the bug which existed for a while. I will check with
>> upstream and send in a fix for our curl package once I am sure
>> that the old bug has been fixed.
>
> Which bug?
>
> In November 2016, the curl maintainers asked packagers to not link curl
> with libidn or libidn2 at all, due to security issues:
>
> https://curl.haxx.se/mail/lib-2016-11/0033.html
>

Which has since then be fixed and in a recent (not in 7.52.1
included) commit the --with-libidn2 option has been added.

My understanding of libidn2 is that there were problems with some
usecases. For example a domain name like bäcker.de would give
problems to applications such as curl. Of course this was months
ago, and I would not trust my memory on this.

-- 
♥Ⓐ  ng0
PGP keys and more: https://n0is.noblogs.org/ http://ng0.chaosnet.org