# Contributor: Sergei Lukin <sergej.lukin@gmail.com>
# Contributor: Valery Kartel <valery.kartel@gmail.com>
# Contributor: Łukasz Jendrysik <scadu@yandex.com>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>

# RESTRICTED: Do NOT enable the rustls or hyper backends, as they depend on Rust
# and Rust is not yet available on all architectures.  Any commit which changes
# this aport from arch=all WILL be reverted.

pkgname=curl
pkgver=8.14.1
pkgrel=3
pkgdesc="URL retrival utility and library"
url="https://curl.se/"
arch="all"
license="curl"
depends="ca-certificates-bundle"
depends_dev="
	brotli-dev
	c-ares-dev
	libidn2-dev
	libpsl-dev
	nghttp2-dev
	openssl-dev>3
	zlib-dev
	zstd-dev
	"
checkdepends="nghttp2 python3"
makedepends_host="$depends_dev"
makedepends_build="groff perl"
subpackages="$pkgname-dbg $pkgname-static $pkgname-doc $pkgname-dev libcurl"
if [ -z "$BOOTSTRAP" ] && [ -z "$APORTS_BOOTSTRAP" ]; then
	subpackages="$subpackages $pkgname-zsh-completion $pkgname-fish-completion"
fi
source="https://curl.se/download/curl-$pkgver.tar.xz
	fix-returncode-with-retry.patch
	CVE-2025-9086.patch
	CVE-2025-10148.patch
	CVE-2026-5545.patch
	CVE-2025-13034.patch
	CVE-2025-14524.patch
	CVE-2025-14819.patch
	CVE-2026-1965_1.patch
	CVE-2026-1965_2.patch
	CVE-2026-3783.patch
	CVE-2026-3784.patch
	CVE-2026-3805.patch
	CVE-2026-4873.patch
	CVE-2026-5773.patch
	CVE-2026-6253.patch
	CVE-2026-6276.patch
	CVE-2026-6429.patch
	CVE-2026-7168.patch
	CVE-2026-8286.patch
	CVE-2026-8924.patch
	CVE-2026-8927.patch
	CVE-2026-92392.patch
	"
options="net" # Required for running tests
if [ -n "$BOOTSTRAP" ] || [ -n "$APORTS_BOOTSTRAP" ]; then
	options="$options !check" # remove python3 dependency
fi
provides="wcurl=$pkgver-r$pkgrel"
replaces="wcurl"

# secfixes:
#   8.14.1-r3:
#     - CVE-2025-13034
#     - CVE-2025-14524
#     - CVE-2025-14819
#     - CVE-2026-1965_1
#     - CVE-2026-1965_2
#     - CVE-2026-3783
#     - CVE-2026-3784
#     - CVE-2026-3805
#     - CVE-2026-4873
#     - CVE-2026-5545
#     - CVE-2026-5773
#     - CVE-2026-6253
#     - CVE-2026-6276
#     - CVE-2026-6429
#     - CVE-2026-7168
#     - CVE-2026-8286
#     - CVE-2026-8924
#     - CVE-2026-8927
#     - CVE-2026-92392
#   8.14.1-r2:
#     - CVE-2025-9086
#     - CVE-2025-10148
#   8.14.1-r0:
#     - CVE-2025-5399
#   8.14.0-r0:
#     - CVE-2025-5025
#     - CVE-2025-4947
#   8.12.0-r0:
#     - CVE-2025-0167
#     - CVE-2025-0665
#     - CVE-2025-0725
#   8.11.1-r0:
#     - CVE-2024-11053
#   8.11.0-r0:
#     - CVE-2024-9681
#   8.10.0-r0:
#     - CVE-2024-8096
#   8.9.1-r0:
#     - CVE-2024-7264
#   8.9.0-r0:
#     - CVE-2024-6197
#     - CVE-2024-6874
#   8.7.1-r0:
#     - CVE-2024-2004
#     - CVE-2024-2379
#     - CVE-2024-2398
#     - CVE-2024-2466
#   8.6.0-r0:
#     - CVE-2024-0853
#   8.5.0-r0:
#     - CVE-2023-46218
#     - CVE-2023-46219
#   8.4.0-r0:
#     - CVE-2023-38545
#     - CVE-2023-38546
#   8.3.0-r0:
#     - CVE-2023-38039
#   8.1.0-r0:
#     - CVE-2023-28319
#     - CVE-2023-28320
#     - CVE-2023-28321
#     - CVE-2023-28322
#   8.0.0-r0:
#     - CVE-2023-27533
#     - CVE-2023-27534
#     - CVE-2023-27535
#     - CVE-2023-27536
#     - CVE-2023-27537
#     - CVE-2023-27538
#   7.88.0-r0:
#     - CVE-2023-23914
#     - CVE-2023-23915
#     - CVE-2023-23916
#   7.87.0-r0:
#     - CVE-2022-43551
#     - CVE-2022-43552
#   7.86.0-r0:
#     - CVE-2022-32221
#     - CVE-2022-35260
#     - CVE-2022-42915
#     - CVE-2022-42916
#   7.85.0-r0:
#     - CVE-2022-35252
#   7.84.0-r0:
#     - CVE-2022-32205
#     - CVE-2022-32206
#     - CVE-2022-32207
#     - CVE-2022-32208
#   7.83.1-r0:
#     - CVE-2022-27778
#     - CVE-2022-27779
#     - CVE-2022-27780
#     - CVE-2022-27781
#     - CVE-2022-27782
#     - CVE-2022-30115
#   7.83.0-r0:
#     - CVE-2022-22576
#     - CVE-2022-27774
#     - CVE-2022-27775
#     - CVE-2022-27776
#   7.79.0-r0:
#     - CVE-2021-22945
#     - CVE-2021-22946
#     - CVE-2021-22947
#   7.78.0-r0:
#     - CVE-2021-22922
#     - CVE-2021-22923
#     - CVE-2021-22924
#     - CVE-2021-22925
#   7.77.0-r0:
#     - CVE-2021-22898
#     - CVE-2021-22901
#   7.76.0-r0:
#     - CVE-2021-22876
#     - CVE-2021-22890
#   7.74.0-r0:
#     - CVE-2020-8284
#     - CVE-2020-8285
#     - CVE-2020-8286
#   7.72.0-r0:
#     - CVE-2020-8231
#   7.71.0-r0:
#     - CVE-2020-8169
#     - CVE-2020-8177
#   7.66.0-r0:
#     - CVE-2019-5481
#     - CVE-2019-5482
#   7.65.0-r0:
#     - CVE-2019-5435
#     - CVE-2019-5436
#   7.64.0-r0:
#     - CVE-2018-16890
#     - CVE-2019-3822
#     - CVE-2019-3823
#   7.62.0-r0:
#     - CVE-2018-16839
#     - CVE-2018-16840
#     - CVE-2018-16842
#   7.61.1-r0:
#     - CVE-2018-14618
#   7.61.0-r0:
#     - CVE-2018-0500
#   7.60.0-r0:
#     - CVE-2018-1000300
#     - CVE-2018-1000301
#   7.59.0-r0:
#     - CVE-2018-1000120
#     - CVE-2018-1000121
#     - CVE-2018-1000122
#   7.57.0-r0:
#     - CVE-2017-8816
#     - CVE-2017-8817
#     - CVE-2017-8818
#   7.56.1-r0:
#     - CVE-2017-1000257
#   7.55.0-r0:
#     - CVE-2017-1000099
#     - CVE-2017-1000100
#     - CVE-2017-1000101
#   7.54.0-r0:
#     - CVE-2017-7468
#   7.53.1-r2:
#     - CVE-2017-7407
#   7.53.0-r0:
#     - CVE-2017-2629
#   7.52.1-r0:
#     - CVE-2016-9594
#   7.51.0-r0:
#     - CVE-2016-8615
#     - CVE-2016-8616
#     - CVE-2016-8617
#     - CVE-2016-8618
#     - CVE-2016-8619
#     - CVE-2016-8620
#     - CVE-2016-8621
#     - CVE-2016-8622
#     - CVE-2016-8623
#     - CVE-2016-8624
#     - CVE-2016-8625
#   7.50.3-r0:
#     - CVE-2016-7167
#   7.50.2-r0:
#     - CVE-2016-7141
#   7.50.1-r0:
#     - CVE-2016-5419
#     - CVE-2016-5420
#     - CVE-2016-5421
#   7.36.0-r0:
#     - CVE-2014-0138
#     - CVE-2014-0139
#   0:
#     - CVE-2021-22897

build() {
	./configure \
		--build=$CBUILD \
		--host=$CHOST \
		--prefix=/usr \
		--enable-ares \
		--enable-ipv6 \
		--enable-unix-sockets \
		--enable-static \
		--with-libidn2 \
		--with-nghttp2 \
		--with-openssl \
		--with-ca-bundle=/etc/ssl/cert.pem \
		--with-ca-path=/etc/ssl/certs \
		--with-zsh-functions-dir \
		--with-fish-functions-dir \
		--disable-ldap \
		--with-pic \
		--enable-websockets \
		--without-libssh2 # https://bugs.alpinelinux.org/issues/10222
	make

	# generation of completions is not supported when cross-compiling.
	if [ -z "$BOOTSTRAP" ] && [ -z "$APORTS_BOOTSTRAP" ]; then
		make -C scripts/
	fi
}

check() {
	make -C tests
	make -j1 -C tests TFLAGS="-j$JOBS" nonflaky-test
}

package() {
	# depends on exactly the same build of libcurl
	depends="libcurl=$pkgver-r$pkgrel"

	make install DESTDIR="$pkgdir"
	if [ -z "$BOOTSTRAP" ] && [ -z "$APORTS_BOOTSTRAP" ]; then
		install -Dm644 scripts/_curl -t \
			"$pkgdir"/usr/share/zsh/site-functions/
		install -Dm644 scripts/curl.fish -t \
			"$pkgdir"/usr/share/fish/vendor_completions.d/
	fi
}

libcurl() {
	pkgdesc="The multiprotocol file transfer library"

	amove usr/lib
}

sha512sums="
7f6eae04cc23c50fc41d448aa28dfa59141018009e42c5b1e3f4e0d40c0633460b4e6eec05dfc290f7953671096abfa70a8b5443fccdd3f1be6be32ac10b31d9  curl-8.14.1.tar.xz
4324a97b532b9d9c35fa79b475aab36c2a47ad49c676c8e2129feedc279501e712fad100af76a98c3ffb8b951d8c591f4e45dee6e6e85d25189223a10aa3f733  fix-returncode-with-retry.patch
713b42dbab208402db657da6002e55d87fc9d106091293e56a51a1fb64b55d780f2e97fe95b689ee69102f11178330eac824c364a5fadb1cbfd1efe3ac3443db  CVE-2025-9086.patch
a6a5a93e121c9c754fa26a0ecf02dba33a913ba194281eb8f41f30d0ebe14e0a953a73a9d0c2d4a4f9a983951ad159c12ff54603925ff98eea78f726b55ccbbc  CVE-2025-10148.patch
d457aa6bfdecdee07147a6933d03a2a84a9863918972c526ea4a8c37e53393f848ce3fa1eb852c8249c7a2bc6747b77148dbe903b64a2e371a5ee4b283633197  CVE-2026-5545.patch
d6443fed10f5e748e818e31340fcce4c0fe00d6a88d80cbac34ee80b28dc22fc2f29764b94b6c26a64bdcdf106b5fcdac7ea7003dc4a08861dad579d61410ea3  CVE-2025-13034.patch
e17f755f42aef9a160fa04970fced4d39f88fceda4ad2b9e4831ea6a6022e0316bf4891acd304758e754d5f1a1f3febd51c8b8565afa744f7b3e40b31186fe69  CVE-2025-14524.patch
8034257d4d7e68e456d3760c0b3e05c7eeb58bfece77be9f2cdc8a27aef7bf13b70902a337ab704eff04a279e6f8334a26a79bb3df8f8ddd3dbbecaf8eeb52d9  CVE-2025-14819.patch
25d26cd9acf0e64cd6b1f29273d04f7a4b6be1ad6b64228740002ab1adc9d8df3618610ed14ee21832f5ac7205e4ac3131ab6feb21314d416ed1423b64287731  CVE-2026-1965_1.patch
f97c7f661855cf08df2c9b5dda32058ee94fe6c69a311a338432cd36cdbd792bc9023add149209a4e8ccd240d91bfcc721b536c8c7e891bd21f13ca1c8a62bae  CVE-2026-1965_2.patch
3a224099405b1b8cf9277a6703657e84e9c5bf1a99e0f293ff9e2173ee3c030b8dd43f562a03424da21a4c3bf98bb5454d866407a5a0096d5e3355c7536802b9  CVE-2026-3783.patch
9c61a841a6bf7ea1710581ec33c1f08c682333e983e574c89f7f92acde7caf03d7f03998b157668b48561c26174b120b3de54ab56bd7599e68f778889dfd63a8  CVE-2026-3784.patch
7af901eab4a1d67966495dc0eac98f160f3079b524a701f2c8127ff6f71743bc2f4a60dd901e236bd765eaf3ec33abe5adfe3654373af0cddecba8b543d60ce7  CVE-2026-3805.patch
762914637415f47721b6c840f337a23e6c0a1368fdc18071888bd0cb690255b622bf0f0f630c45c70a71e67611d400f5ca943a42be00f4d0675e58d62a94f2ef  CVE-2026-4873.patch
a1cca478c8df6bd95b911db0328bb98aeaa70db582681b6709ee2f85d5acabdf6126301d9d75d4a2b70dc7fef2444452aab1a1f48ee98809c23a94ab59910587  CVE-2026-5773.patch
464c8d7032e4908f3f0aeb5f95b04c000e46f7768af0ad0099abdba05f50e9a05b184e39a4b5700e5640497161ae96d202ae536b54e8ea4d24481e94087eda6f  CVE-2026-6253.patch
cc382c70a97e12641d1c00f5aa82211708b404fa0989e36e6cffad39a03c2ac23712312d67caca7c4c0c0eac8d81ea051e8170ded9759085ee10fae70dbac181  CVE-2026-6276.patch
653b8cd9c089108c0d663cf2c93dfe62ade138aeeed1adfceaa63209b3135084f5daf1ea1496259be9a1195fcfa7a2fc9aab79a21917d90849969edbb7370b92  CVE-2026-6429.patch
f23f959c91274d0cc325833786cd6fbb0e0b6467ad4d548ce688fc5ee8e2a6cb1b3428fd68b9276b273bd117ee13fdeb1b0f07ac73402161fac50c30da55e8a8  CVE-2026-7168.patch
8f39c95052ac9ca75302ffe449e09241be599bd62b52419113e0cddc69c155628ba0e27be6453af2c7d9df8efab983fe34a9999a7dc020f50ef513c9ab1ee898  CVE-2026-8286.patch
de749726f9473a67e8378c20ca8b68501fe9bec0142743d144504c56893751f860173c639622dcce7eed2faee37f7667b7570c8900b4fc21d07de0ef8a0fe52f  CVE-2026-8924.patch
377ee47f0a8f0c3dac86e9f295b1c404a7097f1460f53d056104ecb4fbf66448dae1827d4655180b87b147402d8a59c2b9941ba9250136e21d4eb218dfef7050  CVE-2026-8927.patch
adffd59d48385e611e3283b9a120adce6fbbd52b2e71e452b0217c10baaa2c9a967892b22be9e2b6ec627d1d87a293a60572ee874eb01e9dff68103c1fed0f7b  CVE-2026-92392.patch
"
