Builder curl-ares-solaris10-i386 Build #4286

Results:

Build successful

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-curl-ares-solaris10-i386' triggered this build

Steps and Logfiles:

1. git update ( 2 secs )
   1. stdio
2. Runtest './tests/testcurl.pl --nogitpull ...' ( 4 mins, 32 secs )
   1. stdio
   2. resultlog
3. Mail result 'cat resultlog ...' ( 22 secs )
   1. stdio

Build Properties:

Forced Build Properties:

Responsible Users:

1. Daniel Stenberg

   danielohnoyoudont@haxx.se
2. Stefan Eissing

   stefanohnoyoudont@eissing.org
3. Viktor Szakats

   commitohnoyoudont@vsz.me

Timing:

All Changes:

:

1. Change #263262

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 09:55:25
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	d888a53e14597f0fd252f14d8595b1e9adb7bcf5

   Comments

   libssh: path length precaution
   Make sure the string is non-zero before indexing it -1. Right now, the
   path is always non-zero length so this is more for (future) safety
   reasons.
   
   Closes #21193

   Changed files

   • lib/vssh/libssh.c

2. Change #263264

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 10:22:35
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	93e80c75b419cc6ec5639404b11773ee58e63073

   Comments

   hsts: accept 10K entries in the list
   Up from 1K.
   
   Reduces the risk that someone could flush the list by tricking a user to
   do many transfers to new hostnames.
   
   Document the limit.
   
   Follow-up to 03a792b186da7fdfbe4b85b022d7
   
   Closes #21200

   Changed files

   • docs/HSTS.md
   • docs/cmdline-opts/hsts.md
   • docs/libcurl/opts/CURLOPT_HSTS.md
   • lib/hsts.h
   • tests/data/test1674
   • tests/unit/unit1674.c

3. Change #263270

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 10:50:23
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	b27e828b938777b75cf627093e1c9c9d4af2cbd2

   Comments

   url: init req.no_body in DO so that it works for h2 push
   req.no_body was only initialized in Curl_connect, while HTTP/2 server
   push adds a duplicated handle via Curl_multi_add_perform and calls
   Curl_init_do with conn==NULL, never invoking Curl_connect.
   
   Verify it by amending test 1620
   
   Found by Codex Security
   
   Closes #21194

   Changed files

   • lib/url.c
   • tests/unit/unit1620.c

4. Change #263296

   Category	curl
   Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
   Changed at	Thu 02 Apr 2026 13:14:29
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	33e43985b8f3b9e66691d06e70be0395849856cd

   Comments

   url: improve connection reuse on negotiate
   Check state of negotiate to allow proper connection reuse.
   
   Closes #21203

   Changed files

   • lib/url.c

5. Change #263297

   Category	curl
   Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
   Changed at	Thu 02 Apr 2026 13:15:53
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	99d5b908781f452a1c2b549d53e0c9b96ed3942f

   Comments

   asyn-thrdd: item cleanup using resolv_id
   Now that we support multiple async operations at the same transfer,
   fix the thread queue cleanup to match not only the mid but also the
   resolv_id.
   
   Found by Codex Security
   
   Closes #21202

   Changed files

   • lib/asyn-thrdd.c

6. Change #263312

   Category	curl
   Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
   Changed at	Thu 02 Apr 2026 16:40:26
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	e127f8ce843e1c070c0ca2074c10dcc01081a395

   Comments

   GHA/windows: drop building with libssh
   Bumping `msys2/setup-msys2` from 2.30.0 to 2.31.0 also brought libssh
   0.12.0 (after 0.11.3). libssh has been long known for loading OpenSSH
   configuration from disk insecurely on Windows. 0.12.0 brings some fixes
   to this (CVE-2025-14821), which in turn may be changing its behavior on
   the default GH Windows runner to fail all curl SCP/SFTP tests.
   
   Detecting what is the exact root cause, then defining exact runtime
   conditions for it is difficult and fragile. Same for changing these
   libssh defaults (if at all possible.)
   
   But, since configuration loading remains insecure and broken on Windows
   even after the mitigations made by 0.12.0 [0], this patch removes libssh
   from the Windows CI job using it previously.
   
   If someone figures out how to run in CI, it can be readded, though in
   general, using libssh on Windows seems to be less than ideal.
   
   [0] https://github.com/curl/curl-for-win/blob/0e4bd38a5b90f6431b4c145ed094940b4d6b6c0d/libssh.sh#L11-L94
   
   Refs:
   https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
   https://github.com/msys2/MINGW-packages/commit/91382507d5df17d89c074a1469bf3725a9602ff5
   #21199 (unsuccessful fix attempts)
   
   Bug: https://github.com/curl/curl/pull/21195#issuecomment-4173085194
   Follow-up to fcf946e8461b68840e4afb39711a52c9bf622a10 #21195
   
   Closes #21204

   Changed files

   • .github/workflows/windows.yml