#Global macro or variable %global libpsl_version %(pkg-config --modversion libpsl 2>/dev/null || echo 0) %global libssh_version %(pkg-config --modversion libssh 2>/dev/null || echo 0) %global openssl_version %(pkg-config --modversion openssl 2>/dev/null || echo 0) %global _configure ../configure Name: curl Version: 7.71.1 Release: 40 Summary: Curl is used in command lines or scripts to transfer data License: MIT URL: https://curl.haxx.se/ Source: https://curl.haxx.se/download/curl-%{version}.tar.xz Patch101: 0101-curl-7.32.0-multilib.patch Patch102: 0102-curl-7.36.0-debug.patch Patch104: 0104-curl-7.19.7-localhost6.patch Patch105: 0105-curl-7.63.0-lib1560-valgrind.patch Patch106: 0106-curl-fix-CVE-2019-15601.patch Patch107: 0107-curl-close-unused-connect-only-connections.patch Patch108: 0108-curl-fix-CVE-2020-8231.patch Patch109: backport-CVE-2020-8284.patch Patch110: backport-CVE-2020-8285.patch Patch111: backport-CVE-2020-8286.patch Patch112: backport-CVE-2021-22876.patch Patch113: backport-CVE-2021-22890.patch Patch114: backport-CVE-2021-22897.patch Patch115: backport-CVE-2021-22898.patch Patch116: backport-CVE-2021-22924.patch Patch117: backport-CVE-2021-22925.patch Patch118: backport-CVE-2021-22926.patch Patch119: backport-CVE-2021-22945.patch Patch120: backport-0001-CVE-2021-22946.patch Patch121: backport-0002-CVE-2021-22946.patch Patch122: backport-CVE-2021-22947.patch Patch123: backport-CVE-2022-22576.patch Patch124: backport-CVE-2022-27775.patch Patch125: backport-CVE-2022-27776.patch Patch126: backport-pre-CVE-2022-27774.patch Patch127: backport-001-CVE-2022-27774.patch Patch128: backport-002-CVE-2022-27774.patch Patch129: backport-CVE-2022-27781.patch Patch130: backport-pre-CVE-2022-27782.patch Patch131: backport-CVE-2022-27782.patch Patch132: backport-CVE-2022-32205.patch Patch133: backport-CVE-2022-32206.patch Patch134: backport-CVE-2022-32207.patch Patch135: backport-CVE-2022-32208.patch Patch136: backport-fix-configure-disable-http-auth-build-error.patch Patch137: backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch Patch138: backport-CVE-2022-32221.patch Patch139: backport-CVE-2022-43552-smb-telnet-do-not-free-the-protocol-struct-in-_done.patch Patch140: backport-CVE-2023-23916.patch Patch141: backport-fix-test973-test974-test975-test976.patch Patch142: backport-CVE-2023-27533.patch Patch143: backport-CVE-2023-27534-pre1.patch Patch144: backport-CVE-2023-27534.patch Patch145: backport-CVE-2023-27538.patch Patch147: backport-CVE-2023-27535-pre1.patch Patch148: backport-CVE-2023-27535.patch Patch149: backport-CVE-2023-27536.patch Patch150: backport-after-CVE-2022-32207-to-fix-build-error-when-user-don-t-use-glibc.patch Patch151: backport-CVE-2023-28321.patch Patch152: backport-CVE-2023-28322.patch Patch153: backport-0001-CVE-2023-28320.patch Patch154: backport-0002-CVE-2023-28320.patch Patch155: backport-0003-CVE-2023-28320.patch Patch156: backport-CVE-2023-32001.patch Patch157: backport-CVE-2023-38545.patch Patch158: backport-CVE-2023-38546.patch Patch159: backport-0001-CVE-2023-46218.patch Patch160: backport-0002-CVE-2023-46218.patch Patch161: backport-0001-CVE-2023-46219.patch Patch162: backport-0002-CVE-2023-46219.patch Patch163: backport-CVE-2024-2398.patch Patch164: backport-dynbuf-provide-curlx_names-for-reuse-by-the-curl-tool.patch Patch165: backport-curl-use-curlx_dynbuf-for-realloc-when-loading-config-files.patch Patch166: backport-curl-make-file2string-use-dynbuf.patch Patch167: backport-paramhlp-fix-CRLF-stripping-files-with-d-file.patch Patch168: backport-libssh2-set-length-to-0-if-strdup-failed.patch Patch169: backport-openldap-create-ldap-URLs-correctly-for-IPv6-addresses.patch Patch170: backport-multi-avoid-memory-leak-risk.patch Patch171: backport-tool_cb_rea-limit-rate-unpause-for-T-.-uploads.patch Patch172: backport-tool_cfgable-free-proxy_-cipher13_list-on-exit.patch Patch173: backport-0001-CVE-2024-7264.patch Patch174: backport-0002-CVE-2024-7264.patch Patch175: backport-CVE-2024-8096-gtls-fix-OCSP-stapling-management.patch Patch176: backport-url-allow-DoH-transfers-to-override-max-connection-limit.patch Patch177: backport-multi-check-that-the-multi-handle-is-valid-in-curl_m.patch Patch178: backport-cookie-treat-cookie-name-case-sensitively.patch Patch179: backport-CVE-2025-0725.patch BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel BuildRequires: libidn2-devel libnghttp2-devel libpsl-devel BuildRequires: libssh-devel make openldap-devel openssh-clients openssh-server BuildRequires: openssl-devel perl-interpreter pkgconfig python3-devel sed BuildRequires: stunnel zlib-devel gnutls-utils nghttp2 perl(IO::Compress::Gzip) BuildRequires: perl(Getopt::Long) perl(Pod::Usage) perl(strict) perl(warnings) BuildRequires: perl(Cwd) perl(Digest::MD5) perl(Exporter) perl(File::Basename) BuildRequires: perl(File::Copy) perl(File::Spec) perl(IPC::Open2) perl(MIME::Base64) BuildRequires: perl(Time::Local) perl(Time::HiRes) perl(vars) Requires: libcurl = %{version}-%{release} Provides: curl-full = %{version}-%{release} webclient %description cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. %package -n libcurl Summary: A library for getting files from web servers Requires: libssh >= %{libssh_version} libpsl >= %{libpsl_version} Requires: openssl-libs >= 1:%{openssl_version} Provides: libcurl-full = %{version}-%{release} Conflicts: curl < 7.66.0-3 %description -n libcurl A library for getting files from web servers. %package -n libcurl-devel Summary: Header files for libcurl Requires: libcurl = %{version}-%{release} Provides: curl-devel = %{version}-%{release} Obsoletes: curl-devel < %{version}-%{release} %description -n libcurl-devel Header files for libcurl. %package_help %prep %autosetup -n %{name}-%{version} -p1 # make tests/*.py use Python 3 sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py # regenerate Makefile.in files aclocal -I m4 automake printf "1112\n1455\n1801\n1900\n" >> tests/data/DISABLED # adapt test 323 for updated OpenSSL sed -e 's/^35$/35,52/' -i tests/data/test323 %build install -d build-full export common_configure_opts="--cache-file=../config.cache \ --enable-symbol-hiding --enable-ipv6 --enable-threaded-resolver \ --with-gssapi --with-nghttp2 --with-ssl \ --without-libmetalink \ --with-ca-bundle=%{_sysconfdir}/pki/tls/certs/ca-bundle.crt" %global _configure ../configure # configure full build ( cd build-full %configure $common_configure_opts \ --enable-ldap \ --enable-ldaps \ --enable-manual \ --with-brotli \ --with-libidn2 \ --with-libpsl \ --with-libssh ) sed -e 's/^runpath_var=.*/runpath_var=/' \ -e 's/^hardcode_libdir_flag_spec=".*"$/hardcode_libdir_flag_spec=""/' \ -i build-full/libtool %make_build V=1 -C build-full %check # compile upstream test-cases %make_build V=1 -C build-full/tests # relax crypto policy for the test-suite to make it pass again (#1610888) export OPENSSL_SYSTEM_CIPHERS_OVERRIDE=XXX export OPENSSL_CONF= # make runtests.pl work for out-of-tree builds export srcdir=../../tests # prevent valgrind from being extremely slow (#1662656) unset DEBUGINFOD_URLS # run the upstream test-suite for curl-full for size in full; do ( cd build-${size} # we have to override LD_LIBRARY_PATH because we eliminated rpath export LD_LIBRARY_PATH="${PWD}/lib/.libs" cd tests perl -I../../tests ../../tests/runtests.pl -a -n -p -v '!flaky' ) done %install rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.{la,so} # install libcurl.m4 for devel install -D -m 644 docs/libcurl/libcurl.m4 $RPM_BUILD_ROOT%{_datadir}/aclocal/libcurl.m4 # curl file install cd build-full %make_install # install zsh completion for curl LD_LIBRARY_PATH="$RPM_BUILD_ROOT%{_libdir}:$LD_LIBRARY_PATH" %make_install -C scripts # do not install /usr/share/fish/completions/curl.fish which is also installed # by fish-3.0.2-1.module_f31+3716+57207597 and would trigger a conflict rm -rf ${RPM_BUILD_ROOT}%{_datadir}/fish rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.a rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %ldconfig_scriptlets %ldconfig_scriptlets -n libcurl %files %defattr(-,root,root) %license COPYING %{_bindir}/curl %{_datadir}/zsh %files -n libcurl %defattr(-,root,root) %{_libdir}/libcurl.so.4 %{_libdir}/libcurl.so.4.[0-9].[0-9] %files -n libcurl-devel %defattr(-,root,root) %doc docs/examples/*.c docs/examples/Makefile.example docs/INTERNALS.md %doc docs/CONTRIBUTE.md docs/libcurl/ABI.md %{_bindir}/curl-config* %{_includedir}/curl %{_libdir}/*.so %{_libdir}/pkgconfig/*.pc %{_datadir}/aclocal/libcurl.m4 %files help %defattr(-,root,root) %doc CHANGES README* %doc docs/BUGS docs/FAQ docs/FEATURES docs/RESOURCES %doc docs/TheArtOfHttpScripting docs/TODO %{_mandir}/man1/curl.1* %{_mandir}/man1/curl-config.1* %{_mandir}/man3/* %changelog * Sat Feb 08 2025 zhouyihang - 7.71.1-40 - Type:CVE - CVE:CVE-2025-0725 - SUG:NA - DESC:fix CVE-2025-0725 * Mon Dec 09 2024 zhouyihang - 7.71.1-39 - Type:bugfix - CVE:NA - SUG:NA - DESC:cookie: treat cookie name case sensitively * Sat Nov 30 2024 zhouyihang - 7.71.1-38 - Type:bugfix - CVE:NA - SUG:NA - DESC:multi: check that the multi handle is valid in curl_multi_assign * Fri Sep 20 2024 zhouyihang - 7.71.1-37 - Type:bugfix - CVE:NA - SUG:NA - DESC:url: allow DoH transfers to override max connection limit * Thu Sep 12 2024 zhouyihang - 7.71.1-36 - Type:CVE - CVE:CVE-2024-8096 - SUG:NA - DESC:fix CVE-2024-8096 * Mon Aug 05 2024 zhouyihang - 7.71.1-35 - Type:CVE - CVE:CVE-2024-7264 - SUG:NA - DESC:fix CVE-2024-7264 * Mon Jun 24 2024 zhouyihang - 7.71.1-34 - Type:bugfix - CVE:NA - SUG:NA - DESC:dynbuf: provide curlx_ names for reuse by the curl tool curl: use curlx_dynbuf for realloc when loading config files curl: make file2string use dynbuf paramhlp: fix CRLF-stripping files with "-d @file" libssh2: set length to 0 if strdup failed openldap: create ldap URLs correctly for IPv6 addresses multi: avoid memory-leak risk tool_cb_rea: limit rate unpause for -T . uploads tool_cfgable: free {proxy_}cipher13_list on exit * Fri Mar 29 2024 zhouyihang - 7.71.1-33 - Type:CVE - CVE:CVE-2024-2398 - SUG:NA - DESC:fix CVE-2024-2398 * Fri Dec 08 2023 zhouyihang - 7.71.1-32 - Type:CVE - CVE:CVE-2023-46218 CVE-2023-46219 - SUG:NA - DESC:fix CVE-2023-46218 CVE-2023-46219 * Wed Oct 11 2023 Funda Wang - 7.71.1-31 - Type:CVE - CVE:CVE-2023-38545, CVE-2023-38546 - SUG:NA - DESC:fix CVE-2023-38545, CVE-2023-38546 * Thu Jul 20 2023 zhouyihang - 7.71.1-30 - Type:CVE - CVE:CVE-2023-32001 - SUG:NA - DESC:fix CVE-2023-32001 * Sat Jun 10 2023 zhouyihang - 7.71.1-29 - Type:bugfix - CVE:NA - SUG:NA - DESC:disable valgrind in tests * Thu Jun 08 2023 xingwei - 7.71.1-28 - Type:CVE - CVE:CVE-2023-28320 - SUG:NA - DESC:fix CVE-2023-28320 * Wed May 24 2023 xingwei - 7.71.1-27 - Type:CVE - CVE:CVE-2023-28321,CVE-2023-28322 - SUG:NA - DESC:fix CVE-2023-28321,CVE-2023-28322 * Wed Apr 19 2023 gaihuiying - 7.71.1-26 - Type:bugfix - CVE:NA - SUG:NA - DESC:backport to fix build error when user don't use glibc * Tue Apr 11 2023 xingwei - 7.71.1-25 - Type:cves - CVE:CVE-2023-27536 - SUG:NA - DESC:Patch optimization for CVE-2023-27536 * Mon Mar 27 2023 xingwei - 7.71.1-24 - Type:cves - CVE:CVE-2023-27535 - SUG:NA - DESC:Fix patch optimization for CVE-2023-27535 * Thu Mar 23 2023 xingwei - 7.71.1-23 - Type:cves - CVE:CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538 - SUG:NA - DESC:fix CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538 * Thu Mar 09 2023 xinghe - 7.71.1-22 - Type:bugfix - CVE:NA - SUG:NA - DESC:enable test * Sat Feb 18 2023 xinghe - 7.71.1-21 - Type:cves - CVE:CVE-2023-23916 - SUG:NA - DESC:fix CVE-2023-23916 * Wed Dec 28 2022 zhouyihang - 7.71.1-20 - Type:cves - CVE:CVE-2022-43552 - SUG:NA - DESC:fix CVE-2022-43552 * Thu Oct 27 2022 yanglu - 7.71.1-19 - Type:cves - CVE:CVE-2022-32221 - SUG:NA - DESC:fix CVE-2022-32221 * Thu Sep 01 2022 zhouyihang - 7.71.1-18 - Type:cves - CVE:CVE-2022-35252 - SUG:NA - DESC:fix CVE-2022-35252 * Mon Jul 25 2022 gaihuiying - 7.71.1-17 - Type:bugfix - CVE:NA - SUG:NA - DESC:fix build error when add --disable-http-auth configure option * Tue Jul 05 2022 gaihuiying - 7.71.1-16 - Type:cves - CVE:CVE-2022-32207 - SUG:NA - DESC:fix CVE-2022-32207 better * Wed Jun 29 2022 gaihuiying - 7.71.1-15 - Type:cves - CVE:CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208 - SUG:NA - DESC:fix CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208 * Tue May 17 2022 gaihuiying - 7.71.1-14 - Type:cves - CVE:CVE-2022-27781 CVE-2022-27782 - SUG:NA - DESC:fix CVE-2022-27781 CVE-2022-27782 * Fri May 06 2022 gaihuiying - 7.71.1-13 - Type:cves - CVE:CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776 - SUG:NA - DESC:fix CVE-2022-22576 CVE-2022-27774 CVE-2022-27775 CVE-2022-27776 * Thu Jan 20 2022 gaoxingwang - 7.71.1-12 - Type:CVE - CVE:CVE-2021-22922 CVE-2021-22923 - SUG:NA - DESC:disable metalink to fix CVE-2021-22922 and CVE-2021-22923 * Fri Oct 8 2021 yanglu - 7.71.1-11 - Type:CVE - CVE:CVE-2021-22945 CVE-2021-22946 CVE-2021-22947 - SUG:NA - DESC:fix CVE-2021-22945 CVE-2021-22946 CVE-2021-22947 * Thu Aug 12 2021 gaihuiying - 7.71.1-10 - Type:CVE - CVE:CVE-2021-22925 CVE-2021-22926 - SUG:NA - DESC:fix CVE-2021-22925 CVE-2021-22926 * Wed Jul 28 2021 quanhongfei - 7.71.1-9 - Type:CVE - CVE:CVE-2021-22924 - SUG:NA - DESC:fix CVE-2021-22924 * Tue Jun 8 2021 gaihuiying - 7.71.1-7 - Type:CVE - CVE:CVE-2021-22897 CVE-2021-22898 - SUG:NA - DESC:fix CVE-2021-22897 CVE-2021-22898 * Mon Apr 19 2021 gaihuiying - 7.71.1-6 - Type:CVE - CVE:CVE-2021-22876 CVE-2021-22890 - SUG:NA - DESC:fix CVE-2021-22876 CVE-2021-22890 * Tue Jan 26 2021 kwb0523 - 7.71.1-5 - Type:CVE - CVE:CVE-2020-8285 CVE-2020-8286 - SUG:NA - DESC:fix CVE-2020-8285 CVE-2020-8286 * Mon Jan 18 2021 xihaochen - 7.71.1-4 - Type:CVE - CVE:CVE-2020-8284 - SUG:NA - DESC:fix CVE-2020-8284 * Tue Jan 5 2021 gaihuiying - 7.71.1-3 - Type:bugfix - ID:NA - SUG:NA - DESC:fix downgrade error * Mon Dec 28 2020 quanhongfei - 7.71.1-2 - Type:CVE - ID:NA - SUG:NA - DESC:fix CVE-2020-8231 * Fri Aug 28 2020 xiaoweiwei - 7.71.1-1 - Upgrade to 7.71.1 * Tue Aug 4 2020 hanzhijun - 7.69.1-2 - Type:cves - ID:NA - SUG:NA - DESC:fix CVE-2020-8177 CVE-2020-8169 * Fri Apr 17 2020 songnannan - 7.69.1-1 - Type:bugfix - ID:NA - SUG:NA - DESC:update to 7.69.1 * Tue Apr 14 2020 songnannan - 7.66.0-3 - Type:bugfix - ID:NA - SUG:NA - DESC:split out the libcurl and libcurl-devel package * Tue Mar 17 2020 chenzhen - 7.66.0-2 - Type:cves - ID:CVE-2019-15601 - SUG:NA - DESC:fix CVE-2019-15601 * Sat Jan 11 2020 openEuler Buildteam - 7.66.0-1 - update to 7.66.0 * Sat Dec 21 2019 openEuler Buildteam - 7.61.1-4 - Type:cves - ID:CVE-2019-5481 CVE-2019-5482 - SUG:NA - DESC:fix CVE-2019-5481 CVE-2019-5482 * Wed Sep 18 2019 guanyanjie - 7.61.1-3 - Init for openEuler