From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sun, 24 Sep 2023 07:46:13 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qkHwd-008zui-1A for lore@lore.pengutronix.de; Sun, 24 Sep 2023 07:46:13 +0200 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1qkHwb-0000QE-IH; Sun, 24 Sep 2023 07:46:13 +0200 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qkHv0-0006m1-Rv; Sun, 24 Sep 2023 07:44:34 +0200 Received: from [2a0a:edc0:0:1101:1d::54] (helo=dude05.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qkHv0-008ZEe-EY; Sun, 24 Sep 2023 07:44:34 +0200 Received: from mol by dude05.red.stw.pengutronix.de with local (Exim 4.96) (envelope-from ) id 1qkHv0-000ViL-1J; Sun, 24 Sep 2023 07:44:34 +0200 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Sun, 24 Sep 2023 07:44:34 +0200 Message-Id: <20230924054434.121902-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230915175919.2719326-1-christian.melki@t2data.com> References: <20230915175919.2719326-1-christian.melki@t2data.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] libcurl: Version bump. 8.2.1 -> 8.3.0 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Christian Melki Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 8ecec82432c61630537aa95f57c413055c8f6fa8. Michael [sent from post-receive hook] On Sun, 24 Sep 2023 07:44:34 +0200, Christian Melki wrote: > Some work went in to more tweaks and making a smaller curl. > https://curl.se/changes.html#8_3_0 > > Plugs CVEs: > CVE-2023-38039 HTTP headers eat all memory > > * crypto-auth is actually gone. But instead of adding per auth > capability right now, just keep the symbol and make it behave as it used to. > Sans basic-auth that is. That was always enabled. > > * Move some options to better adapt to options filtering. > > * Make bindlocal enabled, as it used to be. > > * Make form-api dependant on mime, afaiu, this is how it works. > > Signed-off-by: Christian Melki > Message-Id: <20230915175919.2719326-1-christian.melki@t2data.com> > [mol: update host-libcurl configure options] > Signed-off-by: Michael Olbrich > > diff --git a/rules/host-libcurl.make b/rules/host-libcurl.make > index 509b6c015e46..686a3d4ab3dc 100644 > --- a/rules/host-libcurl.make > +++ b/rules/host-libcurl.make > @@ -57,7 +57,12 @@ HOST_LIBCURL_CONF_OPT := \ > --enable-pthreads \ > --disable-verbose \ > --disable-sspi \ > - --disable-crypto-auth \ > + --enable-basic-auth \ > + --disable-bearer-auth \ > + --disable-digest-auth \ > + --disable-kerberos-auth \ > + --disable-negotiate-auth \ > + --disable-aws \ > --disable-ntlm \ > --disable-ntlm-wb \ > --disable-tls-srp \ > @@ -67,23 +72,27 @@ HOST_LIBCURL_CONF_OPT := \ > --disable-http-auth \ > --disable-doh \ > --disable-mime \ > + --enable-bindlocal \ > + --disable-form-api \ > --enable-dateparse \ > --disable-netrc \ > --enable-progress-meter \ > --disable-dnsshuffle \ > --enable-get-easy-options \ > --disable-alt-svc \ > + --disable-headers-api \ > --enable-hsts \ > + --disable-websockets \ > --without-schannel \ > --without-secure-transport \ > --without-amissl \ > + --with-ssl \ > --with-openssl=$(PTXDIST_SYSROOT_HOST) \ > --without-gnutls \ > --without-mbedtls \ > --without-wolfssl \ > --without-bearssl \ > --without-rustls \ > - --without-nss \ > --without-hyper \ > --without-zlib \ > --without-brotli \ > @@ -104,6 +113,7 @@ HOST_LIBCURL_CONF_OPT := \ > --without-ngtcp2 \ > --without-nghttp3 \ > --without-quiche \ > + --without-msh3 \ > --without-zsh-functions-dir \ > --without-fish-functions-dir > > diff --git a/rules/libcurl.make b/rules/libcurl.make > index c19f828e51e5..ad615bd87f1c 100644 > --- a/rules/libcurl.make > +++ b/rules/libcurl.make > @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl > # > # Paths and names > # > -LIBCURL_VERSION := 8.2.1 > -LIBCURL_MD5 := 556576a795bdd2c7d10de6886480065f > +LIBCURL_VERSION := 8.3.0 > +LIBCURL_MD5 := 2fc6cf5cefa8b73e3826aa24befdccff > LIBCURL := curl-$(LIBCURL_VERSION) > LIBCURL_SUFFIX := tar.xz > LIBCURL_URL := https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX) > @@ -45,7 +45,6 @@ LIBCURL_CONF_OPT := \ > --enable-rt \ > --disable-ech \ > --disable-code-coverage \ > - --disable-headers-api \ > $(GLOBAL_LARGE_FILE_OPTION) \ > --$(call ptx/endis, PTXCONF_LIBCURL_HTTP)-http \ > --$(call ptx/endis, PTXCONF_LIBCURL_FTP)-ftp \ > @@ -73,7 +72,12 @@ LIBCURL_CONF_OPT := \ > --enable-pthreads \ > --$(call ptx/endis, PTXCONF_LIBCURL_VERBOSE)-verbose \ > --disable-sspi \ > - --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-crypto-auth \ > + --enable-basic-auth \ > + --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-bearer-auth \ > + --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-digest-auth \ > + --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-kerberos-auth \ > + --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-negotiate-auth \ > + --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-aws \ > --$(call ptx/endis, PTXCONF_LIBCURL_CRYPTO_AUTH)-ntlm \ > --disable-ntlm-wb \ > --enable-tls-srp \ > @@ -83,12 +87,15 @@ LIBCURL_CONF_OPT := \ > --$(call ptx/endis, PTXCONF_LIBCURL_HTTP)-http-auth \ > --disable-doh \ > --$(call ptx/endis, PTXCONF_LIBCURL_MIME)-mime \ > + --enable-bindlocal \ > + --$(call ptx/endis, PTXCONF_LIBCURL_MIME)-form-api \ > --enable-dateparse \ > --enable-netrc \ > --enable-progress-meter \ > --disable-dnsshuffle \ > --enable-get-easy-options \ > --disable-alt-svc \ > + --disable-headers-api \ > --enable-hsts \ > --disable-websockets \ > --without-schannel \ > @@ -101,7 +108,6 @@ LIBCURL_CONF_OPT := \ > --without-wolfssl \ > --without-bearssl \ > --without-rustls \ > - --without-nss \ > --without-hyper \ > --with-zlib=$(SYSROOT) \ > --without-brotli \ > @@ -122,9 +128,9 @@ LIBCURL_CONF_OPT := \ > --without-libidn2 \ > --without-nghttp2 \ > --without-ngtcp2 \ > - --without-msh3 \ > --without-nghttp3 \ > --without-quiche \ > + --without-msh3 \ > --without-zsh-functions-dir \ > --without-fish-functions-dir >