Builder curl-threaded-solaris10-sparc Build #3547

Results:

Failed runtest

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-curl-threaded-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 40 secs )
   1. stdio
2. Runtest './tests/testcurl.pl --nogitpull ...' failed ( 5 hrs, 47 mins, 48 secs )
   1. stdio
   2. resultlog
3. Mail result 'cat resultlog ...' ( 1 secs )
   1. stdio

Build Properties:

Forced Build Properties:

Responsible Users:

1. Dan Fandrich

   danohnoyoudont@coneharvesters.com
2. Daniel Stenberg

   danielohnoyoudont@haxx.se
3. Stefan Eissing

   stefanohnoyoudont@eissing.org
4. Viktor Szakats

   commitohnoyoudont@vsz.me

Timing:

All Changes:

:

1. Change #263262

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 09:55:25
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	d888a53e14597f0fd252f14d8595b1e9adb7bcf5

   Comments

   libssh: path length precaution
   Make sure the string is non-zero before indexing it -1. Right now, the
   path is always non-zero length so this is more for (future) safety
   reasons.
   
   Closes #21193

   Changed files

   • lib/vssh/libssh.c

2. Change #263264

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 10:22:35
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	93e80c75b419cc6ec5639404b11773ee58e63073

   Comments

   hsts: accept 10K entries in the list
   Up from 1K.
   
   Reduces the risk that someone could flush the list by tricking a user to
   do many transfers to new hostnames.
   
   Document the limit.
   
   Follow-up to 03a792b186da7fdfbe4b85b022d7
   
   Closes #21200

   Changed files

   • docs/HSTS.md
   • docs/cmdline-opts/hsts.md
   • docs/libcurl/opts/CURLOPT_HSTS.md
   • lib/hsts.h
   • tests/data/test1674
   • tests/unit/unit1674.c

3. Change #263270

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 10:50:23
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	b27e828b938777b75cf627093e1c9c9d4af2cbd2

   Comments

   url: init req.no_body in DO so that it works for h2 push
   req.no_body was only initialized in Curl_connect, while HTTP/2 server
   push adds a duplicated handle via Curl_multi_add_perform and calls
   Curl_init_do with conn==NULL, never invoking Curl_connect.
   
   Verify it by amending test 1620
   
   Found by Codex Security
   
   Closes #21194

   Changed files

   • lib/url.c
   • tests/unit/unit1620.c

4. Change #263296

   Category	curl
   Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
   Changed at	Thu 02 Apr 2026 13:14:29
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	33e43985b8f3b9e66691d06e70be0395849856cd

   Comments

   url: improve connection reuse on negotiate
   Check state of negotiate to allow proper connection reuse.
   
   Closes #21203

   Changed files

   • lib/url.c

5. Change #263297

   Category	curl
   Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
   Changed at	Thu 02 Apr 2026 13:15:53
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	99d5b908781f452a1c2b549d53e0c9b96ed3942f

   Comments

   asyn-thrdd: item cleanup using resolv_id
   Now that we support multiple async operations at the same transfer,
   fix the thread queue cleanup to match not only the mid but also the
   resolv_id.
   
   Found by Codex Security
   
   Closes #21202

   Changed files

   • lib/asyn-thrdd.c

6. Change #263312

   Category	curl
   Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
   Changed at	Thu 02 Apr 2026 16:40:26
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	e127f8ce843e1c070c0ca2074c10dcc01081a395

   Comments

   GHA/windows: drop building with libssh
   Bumping `msys2/setup-msys2` from 2.30.0 to 2.31.0 also brought libssh
   0.12.0 (after 0.11.3). libssh has been long known for loading OpenSSH
   configuration from disk insecurely on Windows. 0.12.0 brings some fixes
   to this (CVE-2025-14821), which in turn may be changing its behavior on
   the default GH Windows runner to fail all curl SCP/SFTP tests.
   
   Detecting what is the exact root cause, then defining exact runtime
   conditions for it is difficult and fragile. Same for changing these
   libssh defaults (if at all possible.)
   
   But, since configuration loading remains insecure and broken on Windows
   even after the mitigations made by 0.12.0 [0], this patch removes libssh
   from the Windows CI job using it previously.
   
   If someone figures out how to run in CI, it can be readded, though in
   general, using libssh on Windows seems to be less than ideal.
   
   [0] https://github.com/curl/curl-for-win/blob/0e4bd38a5b90f6431b4c145ed094940b4d6b6c0d/libssh.sh#L11-L94
   
   Refs:
   https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
   https://github.com/msys2/MINGW-packages/commit/91382507d5df17d89c074a1469bf3725a9602ff5
   #21199 (unsuccessful fix attempts)
   
   Bug: https://github.com/curl/curl/pull/21195#issuecomment-4173085194
   Follow-up to fcf946e8461b68840e4afb39711a52c9bf622a10 #21195
   
   Closes #21204

   Changed files

   • .github/workflows/windows.yml

7. Change #263319

   Category	curl
   Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
   Changed at	Thu 02 Apr 2026 17:00:05
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	dc20c91e04d17267d52dc8242d65f1d455666598

   Comments

   GHA/windows: switch back to the canonical Cygwin mirror
   The spare one is at the time of this patch inaccessible.
   
   Follow-up to fb5541c28bdc7761c50423335f44b698d36caef1 #20583
   
   Closes #21207

   Changed files

   • .github/workflows/windows.yml

8. Change #263321

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Thu 02 Apr 2026 18:01:20
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	e65ba1bd349a7affb09275a442b6a0837df079d9

   Comments

   hsts: make the HSTS read callback handle name dupes
   Now the logic for handling name duplicates and picking the longest
   expiry and strictest subdomain is the same for the callback as for when
   reading from file.
   
   Also strip trailing dots from the hostname added by the callback.
   
   A minor side-effect is that the hostname provided by the callback can
   now enable subdomains by starting the name with a dot, but we discourage
   using such hostnames in documentation.
   
   Amended test 1915 to verify.
   
   Closes #21201

   Changed files

   • docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md
   • lib/hsts.c
   • tests/data/test1915
   • tests/libtest/lib1915.c

9. Change #263330

   Category	curl
   Changed by	Dan Fandrich <danohnoyoudont@coneharvesters.com>
   Changed at	Thu 02 Apr 2026 19:11:42
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	c54a3319ad19c991f6d7b09f6f782de19c65d187

   Comments

   CI: Fix or remove obsolete files in labeler config
   Add a few more paths, too.

   Changed files

   • .github/labeler.yml