[pkgsrc/pkgsrc-2017Q4]: pkgsrc/www/curl Pullup ticket #5689 - requested by wiz

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/3a3d7f326866
branches:  pkgsrc-2017Q4
changeset: 373122:3a3d7f326866
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Wed Jan 24 19:43:13 2018 +0000

description:
Pullup ticket #5689 - requested by wiz
www/curl: security fix

Revisions pulled up:
- www/curl/Makefile                                             1.192
- www/curl/PLIST                                                1.67
- www/curl/distinfo                                             1.141
- www/curl/patches/patch-curl-config.in                         1.8

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Wed Jan 24 07:57:19 UTC 2018

   Modified Files:
        pkgsrc/www/curl: Makefile PLIST distinfo
        pkgsrc/www/curl/patches: patch-curl-config.in

   Log Message:
   curl: update to 7.58.0.

   This release includes the following changes:

    o new libssh-powered SSH SCP/SFTP back-end
    o curl-config: add --ssl-backends [10]

   This release includes the following bugfixes:

    o http2: fix incorrect trailer buffer size [40]
    o http: prevent custom Authorization headers in redirects [55]
    o travis: add boringssl build [1]
    o examples/xmlstream.c: don't switch off CURL_GLOBAL_SSL [2]
    o SSL: Avoid magic allocation of SSL backend specific data [3]
    o lib: don't export all symbols, just everything curl_* [4]
    o libssh2: send the correct CURLE error code on scp file not found
    o libssh2: return CURLE_UPLOAD_FAILED on failure to upload
    o openssl: enable pkcs12 in boringssl builds [5]
    o libssh2: remove dead code from SSH_SFTP_QUOTE [6]
    o sasl_getmesssage: make sure we have a long enough string to pass [7]
    o conncache: fix several lock issues [8]
    o threaded-shared-conn.c: new example
    o conncache: only allow multiplexing within same multi handle [9]
    o configure: check for netinet/in6.h [11]
    o URL: tolerate backslash after drive letter for FILE: [12]
    o openldap: add commented out debug possibilities [13]
    o include: get netinet/in.h before linux/tcp.h [14]
    o CONNECT: keep close connection flag in http_connect_state struct [15]
    o BINDINGS: another PostgreSQL client
    o curl: limit -# update frequency for unknown total size [16]
    o configure: add AX_CODE_COVERAGE only if using gcc [17]
    o curl.h: remove incorrect comment about ERRORBUFFER
    o openssl: improve data-pending check for https proxy [18]
    o curl: remove __EMX__ #ifdefs [19]
    o CURLOPT_PRIVATE.3: fix grammar [20]
    o sftp: allow quoted commands to use relative paths [21]
    o CURLOPT_DNS_CACHE_TIMEOUT.3: see also CURLOPT_RESOLVE
    o RESOLVE: output verbose text when trying to set a duplicate name
    o openssl: Disable file buffering for Win32 SSLKEYLOGFILE [22]
    o multi_done: prune DNS cache [23]
    o tests: update .gitignore for libtests
    o tests: mark data files as non-executable in git
    o CURLOPT_DNS_LOCAL_IP4.3: fixed the "SEE ALSO" to not self-reference
    o curl.1: documented two missing valid exit codes
    o curl.1: mention http:// and https:// as valid proxy prefixes
    o vtls: replaced getenv() with curl_getenv() [24]
    o setopt: less *or equal* than INT_MAX/1000 should be fine [25]
    o examples/smtp-mail.c: use separate defines for options and mail
    o curl: support >256 bytes warning messsages [26]
    o conncache: fix a return code
    o krb5: fix a potential access of uninitialized memory
    o rand: add a clang-analyzer work-around
    o CURLOPT_READFUNCTION.3: refer to argument with correct name [27]
    o brotli: allow compiling with version 0.6.0
    o content_encoding: rework zlib_inflate [28]
    o curl_easy_reset: release mime-related data [29]
    o examples/rtsp: fix error handling macros [30]
    o build-openssl.bat: Added support for VC15
    o build-wolfssl.bat: Added support for VC15
    o build: Added Visual Studio 2017 project files
    o winbuild: Added support for VC15
    o curl: Support size modifiers for --max-filesize [32]
    o examples/cacertinmem: ignore cert-already-exists error [33]
    o brotli: data at the end of content can be lost [34]
    o curl_version_info.3: call the argument 'age' [35]
    o openssl: fix memory leak of SSLKEYLOGFILE filename
    o build: remove HAVE_LIMITS_H check [36]
    o --mail-rcpt: fix short-text description
    o scripts: allow all perl scripts to be run directly [37]
    o progress: calculate transfer speed on milliseconds if possible [38]
    o system.h: check __LONG_MAX__ for defining curl_off_t [31]
    o easy: fix connection ownership in curl_easy_pause [39]
    o setopt: reintroduce non-static Curl_vsetopt() for OS400 support [41]
    o setopt: fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values [42]
    o configure.ac: append extra linker flags instead of prepending them [43]
    o HTTP: bail out on negative Content-Length: values [44]
    o docs: comment about CURLE_READ_ERROR returned by curl_mime_filedata
    o mime: clone mime tree upon easy handle duplication [45]
    o openssl: enable SSLKEYLOGFILE support by default [46]
    o smtp/pop3/imap_get_message: decrease the data length too... [47]
    o CURLOPT_TCP_NODELAY.3: fix typo [48]
    o SMB: fix numeric constant suffix and variable types [49]
    o ftp-wildcard: fix matching an empty string with "*[^a]" [50]
    o curl_fnmatch: only allow 5 '*' sections in a single pattern
    o openssl: fix potential memory leak in SSLKEYLOGFILE logic
    o SSH: Fix state machine for ssh-agent authentication [51]
    o examples/url2file.c: add missing curl_global_cleanup() call [52]
    o http2: don't close connection when single transfer is stopped [53]
    o libcurl-env.3: first version
    o curl: progress bar refresh, get width using ioctl() [54]
    o CONNECT_TO: fail attempt to set an IPv6 numerical without IPv6 support [56]

diffstat:

 www/curl/Makefile                     |   4 ++--
 www/curl/PLIST                        |   3 ++-
 www/curl/distinfo                     |  12 ++++++------
 www/curl/patches/patch-curl-config.in |   8 ++++----
 4 files changed, 14 insertions(+), 13 deletions(-)

diffs (71 lines):

diff -r 9ec80676424c -r 3a3d7f326866 www/curl/Makefile
--- a/www/curl/Makefile Tue Jan 23 07:48:56 2018 +0000
+++ b/www/curl/Makefile Wed Jan 24 19:43:13 2018 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.190 2017/11/29 13:56:27 wiz Exp $
+# $NetBSD: Makefile,v 1.190.2.1 2018/01/24 19:43:13 bsiegert Exp $
 
-DISTNAME=      curl-7.57.0
+DISTNAME=      curl-7.58.0
 CATEGORIES=    www
 MASTER_SITES=  https://curl.haxx.se/download/
 EXTRACT_SUFX=  .tar.bz2
diff -r 9ec80676424c -r 3a3d7f326866 www/curl/PLIST
--- a/www/curl/PLIST    Tue Jan 23 07:48:56 2018 +0000
+++ b/www/curl/PLIST    Wed Jan 24 19:43:13 2018 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.66 2017/10/04 06:32:58 wiz Exp $
+@comment $NetBSD: PLIST,v 1.66.2.1 2018/01/24 19:43:13 bsiegert Exp $
 bin/curl
 bin/curl-config
 include/curl/curl.h
@@ -397,6 +397,7 @@
 man/man3/curl_version.3
 man/man3/curl_version_info.3
 man/man3/libcurl-easy.3
+man/man3/libcurl-env.3
 man/man3/libcurl-errors.3
 man/man3/libcurl-multi.3
 man/man3/libcurl-share.3
diff -r 9ec80676424c -r 3a3d7f326866 www/curl/distinfo
--- a/www/curl/distinfo Tue Jan 23 07:48:56 2018 +0000
+++ b/www/curl/distinfo Wed Jan 24 19:43:13 2018 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.140 2017/11/29 13:56:27 wiz Exp $
+$NetBSD: distinfo,v 1.140.2.1 2018/01/24 19:43:13 bsiegert Exp $
 
-SHA1 (curl-7.57.0.tar.bz2) = 7f47469324bf22cc9ffd1d3a201aa3c76ab626b8
-RMD160 (curl-7.57.0.tar.bz2) = e50c4ff25b6208187c5a3a10a5c8675faf75f64f
-SHA512 (curl-7.57.0.tar.bz2) = f366d2e931d7aff63bac0e1f760ced32c849252947d522427ba92124566906a7e6bd081b6d1630df36895dda2a00ac4cf1bed1470740693ef47ab90c6a270377
-Size (curl-7.57.0.tar.bz2) = 2849283 bytes
+SHA1 (curl-7.58.0.tar.bz2) = 42fff9f33ad4ed9e797ee1e7c0a3cda7f8dff7ff
+RMD160 (curl-7.58.0.tar.bz2) = 61d5e9f5165f4bbeac3b81de55f27561d90a7c86
+SHA512 (curl-7.58.0.tar.bz2) = 853b945fbfe87e8dcf2186d8cc6609681b9ed3727f9f075bb434d5df07dcccc633fdf30795f6d5956e3355a5cf94a3780e4a3603b08cbd0368e44103de27085b
+Size (curl-7.58.0.tar.bz2) = 2891868 bytes
 SHA1 (patch-configure) = ba8abac55f11a53d07235e57d21ce5b32a421902
-SHA1 (patch-curl-config.in) = d0cc7bb6a5bf0b9257f40dcffce7093cc0098eb7
+SHA1 (patch-curl-config.in) = 363359665985cc14f36ddf47fc3480f1200e3533
 SHA1 (patch-lib_hostcheck.c) = 8e772d3f91cdafae17281cc19004269ece0cf308
diff -r 9ec80676424c -r 3a3d7f326866 www/curl/patches/patch-curl-config.in
--- a/www/curl/patches/patch-curl-config.in     Tue Jan 23 07:48:56 2018 +0000
+++ b/www/curl/patches/patch-curl-config.in     Wed Jan 24 19:43:13 2018 +0000
@@ -1,10 +1,10 @@
-$NetBSD: patch-curl-config.in,v 1.7 2015/08/08 02:44:16 spz Exp $
+$NetBSD: patch-curl-config.in,v 1.7.22.1 2018/01/24 19:43:13 bsiegert Exp $
 
 - make "curl-config --libs" return proper ldflags for shared libraries
 
---- curl-config.in.orig        2015-06-03 07:38:20.000000000 +0000
+--- curl-config.in.orig        2018-01-22 08:55:10.000000000 +0000
 +++ curl-config.in
-@@ -148,9 +148,9 @@ while test $# -gt 0; do
+@@ -149,9 +149,9 @@ while test $# -gt 0; do
             CURLLIBDIR=""
          fi
          if test "X@REQUIRE_LIB_DEPS@" = "Xyes"; then
@@ -15,4 +15,4 @@
 +          echo @LDFLAGS@ ${CURLLIBDIR}-lcurl
          fi
          ;;
- 
+     --ssl-backends)