libcurl: add version 8.4.0 (fix CVE-2023-38545) #19769

toge · 2023-09-13T06:41:28Z

Specify library name and version: libcurl/*

I've read the contributing guidelines.
I've used a recent Conan client version close to the currently deployed.
I've tried at least one configuration locally with the conan-center hook activated.

github-actions · 2023-09-13T06:42:25Z

🤖 Beep Boop! This pull request is making changes to 'recipes/libcurl//'.

👋 @Hopobcn you might be interested. 😉

AbrilRBS

I need to ask for context on the linked issue and ask where things are regarding it before approving, thanks for brining it to my attention :)

ghost · 2023-09-15T16:15:59Z

I detected other pull requests that are modifying libcurl/all recipe:

libcurl: conan support mbedtls #20639

This message is automatically generated by https://github.com/ericLemanissier/conan-center-conflicting-prs so don't hesitate to report issues/improvements there.

toge · 2023-09-15T17:57:45Z

@RubenRBS
I think following errors are caused by that conan's issue.

CMake Error at C:/J2/w/prod-v1/bsr/7946/bbabb/.conan/data/libcurl/8.3.0/_/_/build/fa3bb3edaa54f36a50cf6abdc608eebc812e703c/build/CMakeFiles/CMakeTmp/CMakeLists.txt:22 (add_executable):
  Target "cmTC_01e0c" links to target
  "CONAN_LIB::openssl_OpenSSL_SSL_libssl_RELEASE" but the target was not
  found.  Perhaps a find_package() call is missing for an IMPORTED target, or
  an ALIAS target is missing?


CMake Error at C:/J2/w/prod-v1/bsr/7946/bbabb/.conan/data/libcurl/8.3.0/_/_/build/fa3bb3edaa54f36a50cf6abdc608eebc812e703c/build/CMakeFiles/CMakeTmp/CMakeLists.txt:22 (add_executable):
  Target "cmTC_01e0c" links to target
  "CONAN_LIB::openssl_OpenSSL_Crypto_libcrypto_RELEASE" but the target was
  not found.  Perhaps a find_package() call is missing for an IMPORTED
  target, or an ALIAS target is missing?


CMake Error at C:/J2/w/prod-v1/bsr/7946/bbabb/.conan/data/libcurl/8.3.0/_/_/build/fa3bb3edaa54f36a50cf6abdc608eebc812e703c/build/CMakeFiles/CMakeTmp/CMakeLists.txt:22 (add_executable):
  Target "cmTC_01e0c" links to target "CONAN_LIB::zlib_zlib_RELEASE" but the
  target was not found.  Perhaps a find_package() call is missing for an
  IMPORTED target, or an ALIAS target is missing?

https://c3i.jfrog.io/c3i/misc/logs/pr/19769/1-windows-visual_studio/libcurl/8.3.0//fa3bb3edaa54f36a50cf6abdc608eebc812e703c-build.txt

valgur · 2023-09-16T12:08:24Z

@RubenRBS
I think following errors are caused by that conan's issue.

CMake Error at C:/J2/w/prod-v1/bsr/7946/bbabb/.conan/data/libcurl/8.3.0/_/_/build/fa3bb3edaa54f36a50cf6abdc608eebc812e703c/build/CMakeFiles/CMakeTmp/CMakeLists.txt:22 (add_executable):
  Target "cmTC_01e0c" links to target
  "CONAN_LIB::openssl_OpenSSL_SSL_libssl_RELEASE" but the target was not
  found.  Perhaps a find_package() call is missing for an IMPORTED target, or
  an ALIAS target is missing?


CMake Error at C:/J2/w/prod-v1/bsr/7946/bbabb/.conan/data/libcurl/8.3.0/_/_/build/fa3bb3edaa54f36a50cf6abdc608eebc812e703c/build/CMakeFiles/CMakeTmp/CMakeLists.txt:22 (add_executable):
  Target "cmTC_01e0c" links to target
  "CONAN_LIB::openssl_OpenSSL_Crypto_libcrypto_RELEASE" but the target was
  not found.  Perhaps a find_package() call is missing for an IMPORTED
  target, or an ALIAS target is missing?


CMake Error at C:/J2/w/prod-v1/bsr/7946/bbabb/.conan/data/libcurl/8.3.0/_/_/build/fa3bb3edaa54f36a50cf6abdc608eebc812e703c/build/CMakeFiles/CMakeTmp/CMakeLists.txt:22 (add_executable):
  Target "cmTC_01e0c" links to target "CONAN_LIB::zlib_zlib_RELEASE" but the
  target was not found.  Perhaps a find_package() call is missing for an
  IMPORTED target, or an ALIAS target is missing?

https://c3i.jfrog.io/c3i/misc/logs/pr/19769/1-windows-visual_studio/libcurl/8.3.0//fa3bb3edaa54f36a50cf6abdc608eebc812e703c-build.txt

Huh, that's interesting. I'm getting that same error for libjpeg with MSVC in #19298. I wonder if it's related in any way.

AbrilRBS · 2023-10-03T07:57:58Z

@toge sorry for the late response, didn't see this ping until now

Where does the error come from? A previous build? the current logs seem all to be passing

toge · 2023-10-04T15:23:26Z

@RubenRBS
Above message is occured in https://c3i.jfrog.io/c3i/misc/logs/pr/19769/1-windows-visual_studio/libcurl/8.3.0//fa3bb3edaa54f36a50cf6abdc608eebc812e703c-build.txt.

To avoid it, I add small patch to dissable HAVE_SSL_SET0_WBIO.
a2b431a

dietssa · 2023-10-13T10:34:44Z

I noticed that build fails locally for me with the following configuration (buildbot cancelled execution before attempting them):
libcurl/8.4.0@ Windows, Visual Studio, Debug+Release, shared=True

The error message is:

libcurl/8.4.0@dietssa/develop (test package): Calling build()
[...]
LINK : fatal error LNK1104: cannot open file 'libcurl_imp.lib' [C:\work\git\libcurl\testbuild\test_package.vcxproj]

There is actually no .lib-file in the build folder at all.

In contrast to that, I tested the libcurl upstream cmake build for 8.4.0 as described in https://github.com/curl/curl/blob/master/docs/INSTALL.cmake and it builds the .lib-file as expected.

Diffing the full linker command line in the conan recipe build vs. upstream build showed that the linker option /DEF that is missing in case of conan recipe build. /DEF is used to pass a .def-file with EXPORTS statements, which triggers the linker to create the import library.

I suspect this is related to the following change in libcurl release 8.4.0: curl/curl#11914

In the conan recipe, we prevent this from working correctly due to a patch that removes the "CurlSymbolHiding"-logic from the upstream CMakeLists.txt:
https://github.com/conan-io/conan-center-index/blob/master/recipes/libcurl/all/conanfile.py#L332-L334

Suggested fix: Remove this patch in conanfile.py. Its marked as "suspicious" anyway ;-)
Tested locally with Windows, Visual Studio and Linux, GCC.

toge · 2023-10-15T15:40:34Z

@dietssa
Thank you for your detail investigation!
The CurlSymbolHiding is now enabled only for 8.4 to minimize the impact.
If it is not adequate, please tell me again.

Cogitri · 2023-10-16T07:21:04Z

FWIW, I also had to set HAVE_OPENSSL_SRP and HAVE_SSL_CTX_SET_QUIC_METHOD for my windows build to work.

leha-bot · 2023-11-07T19:24:17Z

This PR will close #20529.

NiuBlibing · 2023-11-08T03:19:04Z

@toge @RubenRBS Hi, is this pr ready to merge?

conan-center-bot · 2023-11-09T04:51:22Z

Conan v1 pipeline ✔️

All green in build 9 (23d17e6caa687ffe4307322e64152c44088960ed):

libcurl/8.2.0:
All packages built successfully! (All logs)
libcurl/8.2.1:
All packages built successfully! (All logs)
libcurl/8.4.0:
All packages built successfully! (All logs)
libcurl/8.1.2:
All packages built successfully! (All logs)
libcurl/7.83.1:
All packages built successfully! (All logs)
libcurl/7.79.1:
All packages built successfully! (All logs)
libcurl/8.0.1:
All packages built successfully! (All logs)
libcurl/7.80.0:
All packages built successfully! (All logs)
libcurl/7.84.0:
All packages built successfully! (All logs)
libcurl/8.1.1:
All packages built successfully! (All logs)
libcurl/7.82.0:
All packages built successfully! (All logs)
libcurl/7.88.1:
All packages built successfully! (All logs)
libcurl/7.87.0:
All packages built successfully! (All logs)
libcurl/7.78.0:
All packages built successfully! (All logs)
libcurl/7.86.0:
All packages built successfully! (All logs)
libcurl/7.85.0:
All packages built successfully! (All logs)

Conan v2 pipeline ✔️

Note: Conan v2 builds are now mandatory. Please read our discussion about it.

All green in build 9 (23d17e6caa687ffe4307322e64152c44088960ed):

libcurl/8.4.0:
All packages built successfully! (All logs)
libcurl/8.2.1:
All packages built successfully! (All logs)
libcurl/8.1.1:
All packages built successfully! (All logs)
libcurl/7.88.1:
All packages built successfully! (All logs)
libcurl/8.2.0:
All packages built successfully! (All logs)
libcurl/7.86.0:
All packages built successfully! (All logs)
libcurl/8.1.2:
All packages built successfully! (All logs)
libcurl/7.82.0:
All packages built successfully! (All logs)
libcurl/7.78.0:
All packages built successfully! (All logs)
libcurl/7.80.0:
All packages built successfully! (All logs)
libcurl/7.83.1:
All packages built successfully! (All logs)
libcurl/7.79.1:
All packages built successfully! (All logs)
libcurl/7.84.0:
All packages built successfully! (All logs)
libcurl/8.0.1:
All packages built successfully! (All logs)
libcurl/7.85.0:
All packages built successfully! (All logs)
libcurl/7.87.0:
All packages built successfully! (All logs)

uilianries

Checked the build log https://c3i.jfrog.io/c3i/misc/logs/pr/19769/7-linux-gcc/libcurl/8.4.0//f13ed95cd7c05bdadafca9cb0e33c7e261bae784-build.txt and it looks okay according these new changes.

SpaceIm · 2023-11-13T20:03:17Z

recipes/libcurl/all/conanfile.py

@@ -303,7 +303,7 @@ def _patch_autotools(self):
                                  "AC_CHECK_LIB(z,",
                                  f"AC_CHECK_LIB({zlib_name},")
            replace_in_file(self, configure_ac,
-                                  "-lz ",
+                                  "-lz",


This change may break with_zstd=True: https://github.com/curl/curl/blob/curl-8_4_0/configure.ac#L1512. There was a good reason for this extra space in pattern.

Is there an upstream proposal to add the configure script option?

libcurl: add version 8.3.0

5bf112c

prince-chrismc mentioned this pull request Sep 13, 2023

Pull Requests Ready to be Reviewed prince-chrismc/conan-center-index-pending-review#1

Open

conan-center-bot added the Failed label Sep 13, 2023

This comment has been minimized.

Sign in to view

disable HAVE_SSL_SET0_WBIO on 8.3.0

a2b431a

conan-center-bot removed the Failed label Sep 15, 2023

This comment has been minimized.

Sign in to view

AbrilRBS reviewed Sep 15, 2023

View reviewed changes

AbrilRBS self-assigned this Sep 15, 2023

ghost mentioned this pull request Sep 15, 2023

[service] Potentially conflicting recipes #3571

Closed

ghost mentioned this pull request Sep 15, 2023

Bump libcurl's zlib requirement to [>=1.2.11 <2] range #19868

Merged

3 tasks

ghost mentioned this pull request Sep 26, 2023

libcurl: add GitHub mirror & prefer .tar.xz #20157

Merged

3 tasks

ghost mentioned this pull request Oct 5, 2023

libcurl: add version 8.3.0 #20380

Closed

12 tasks

update 8.4.0

47f89f4

toge changed the title ~~libcurl: add version 8.3.0~~ libcurl: add version 8.4.0 Oct 11, 2023

toge changed the title ~~libcurl: add version 8.4.0~~ libcurl: add version 8.4.0 (fix CVE-2023-38545) Oct 11, 2023

jwatson0 mentioned this pull request Oct 12, 2023

[request] libcurl/8.4.0 #20529

Closed

enable CurlSymbolHiding in 8.4.0

903da75

conan-center-bot added the Failed label Oct 15, 2023

This comment has been minimized.

Sign in to view

fix other check_symbol_exists issues

dc79b67

ghost mentioned this pull request Oct 18, 2023

libcurl: conan support mbedtls #20639

Merged

3 tasks

copperlight mentioned this pull request Oct 18, 2023

Upgrade to libcurl >= 8.4.0 Netflix-Skunkworks/spectatord#72

Closed

toge added 2 commits October 24, 2023 02:22

Merge branch 'master' into libcurl-8.3.0

079d36a

Merge branch 'master' into libcurl-8.3.0

7982ec6

Merge branch 'master' into libcurl-8.3.0

23d17e6

conan-center-bot removed the Failed label Nov 9, 2023

jwillikers approved these changes Nov 13, 2023

View reviewed changes

uilianries approved these changes Nov 13, 2023

View reviewed changes

uilianries self-assigned this Nov 13, 2023

conan-center-bot merged commit 5a5eae0 into conan-io:master Nov 13, 2023

SpaceIm reviewed Nov 13, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

libcurl: add version 8.4.0 (fix CVE-2023-38545) #19769

libcurl: add version 8.4.0 (fix CVE-2023-38545) #19769

toge commented Sep 13, 2023

github-actions bot commented Sep 13, 2023

This comment has been minimized.

This comment has been minimized.

AbrilRBS left a comment

ghost commented Sep 15, 2023 •

edited by ghost

Loading

toge commented Sep 15, 2023

valgur commented Sep 16, 2023

AbrilRBS commented Oct 3, 2023

toge commented Oct 4, 2023

dietssa commented Oct 13, 2023 •

edited

Loading

toge commented Oct 15, 2023

This comment has been minimized.

Cogitri commented Oct 16, 2023

leha-bot commented Nov 7, 2023

NiuBlibing commented Nov 8, 2023

conan-center-bot commented Nov 9, 2023

uilianries left a comment

SpaceIm Nov 13, 2023 •

edited

Loading

johan-boule Nov 13, 2023

libcurl: add version 8.4.0 (fix CVE-2023-38545) #19769

libcurl: add version 8.4.0 (fix CVE-2023-38545) #19769

Conversation

toge commented Sep 13, 2023

github-actions bot commented Sep 13, 2023

This comment has been minimized.

This comment has been minimized.

AbrilRBS left a comment

Choose a reason for hiding this comment

ghost commented Sep 15, 2023 • edited by ghost Loading

toge commented Sep 15, 2023

valgur commented Sep 16, 2023

AbrilRBS commented Oct 3, 2023

toge commented Oct 4, 2023

dietssa commented Oct 13, 2023 • edited Loading

toge commented Oct 15, 2023

This comment has been minimized.

Cogitri commented Oct 16, 2023

leha-bot commented Nov 7, 2023

NiuBlibing commented Nov 8, 2023

conan-center-bot commented Nov 9, 2023

Conan v1 pipeline ✔️

Conan v2 pipeline ✔️

uilianries left a comment

Choose a reason for hiding this comment

SpaceIm Nov 13, 2023 • edited Loading

Choose a reason for hiding this comment

johan-boule Nov 13, 2023

Choose a reason for hiding this comment

ghost commented Sep 15, 2023 •

edited by ghost

Loading

dietssa commented Oct 13, 2023 •

edited

Loading

SpaceIm Nov 13, 2023 •

edited

Loading