chore(curl): rebase Moli bindings onto upstream 0.4.51 and libcurl 8.23

.github/workflows/main.yml

@@ -21,7 +21,7 @@ jobs:
             target: x86_64-unknown-linux-gnu
           - build: ubuntu-lts
             os: ubuntu-24.04
-            rust: '1.82'
+            rust: '1.85'
             docker: linux64
             target: x86_64-unknown-linux-gnu
           - build: x86_64-beta

.github/workflows/update-curl.yml

@@ -0,0 +1,48 @@
+# This workflow automates some of the process of updating curl-sys to the latest
+# version of curl upstream.
+
+name: Update curl
+
+on:
+  schedule:
+    - cron: '0 12 * * 5'
+  workflow_dispatch:
+
+jobs:
+  update-submodule:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: true
+
+      - name: Update submodule to latest release
+        id: update
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+        run: |
+          LATEST_TAG=$(gh release view --repo curl/curl --json tagName --jq .tagName)
+          cd curl-sys/curl
+          git fetch --tags
+          git checkout $LATEST_TAG
+          echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GH_PAT }}
+          branch: update-curl-to-${{ steps.update.outputs.tag }}
+          commit-message: "chore: update curl to ${{ steps.update.outputs.tag }}"
+          title: "Update curl to ${{ steps.update.outputs.tag }}"
+          body: |
+            Update the bundled curl submodule to version ${{ steps.update.outputs.tag }}.
+
+            Changelog: <https://curl.se/ch/${{ steps.update.outputs.tag }}.html>
+
+            This PR was created in an automated fashion. Additional changes may
+            be required to get the new version of curl to work with our
+            `build.rs` script.
+          labels: curl-update

.github/workflows/websocket.yml

@@ -2,9 +2,9 @@ name: WebSocket
 
 on:
   push:
-    branches: [main, moli, moli-apple-sectrust]
+    branches: [main, moli, moli-apple-sectrust, feat/prerequest-callback]
   pull_request:
-    branches: [main, moli, moli-apple-sectrust]
+    branches: [main, moli, moli-apple-sectrust, feat/prerequest-callback]
 
 permissions:
   contents: read
@@ -24,6 +24,6 @@ jobs:
       - name: Install Rust
         run: rustup update stable --no-self-update && rustup default stable
       - name: Test HTTP and WebSocket APIs
-        run: cargo test --workspace --features static-curl,http2,brotli,websocket,ws_start_frame_8_16_0
+        run: cargo test --workspace --features static-curl,http2,brotli,apple-sectrust,websocket,ws_start_frame_8_16_0
       - name: Check native ABI
-        run: cargo run -p systest --features curl-sys/static-curl,systest/websocket,systest/ws_start_frame_8_16_0
+        run: cargo run -p systest --features curl-sys/static-curl,curl-sys/apple-sectrust,systest/websocket,systest/ws_start_frame_8_16_0

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "curl"
-version = "0.4.49"
-authors = ["Alex Crichton <alex@alexcrichton.com>"]
+version = "0.4.51"
+authors = ["Alex Crichton <alex@alexcrichton.com>", "Stephen M. Coakley <me@stephencoakley.com>"]
 license = "MIT"
 repository = "https://github.com/lexmount/curl-rust"
 homepage = "https://github.com/lexmount/curl-rust"
@@ -12,28 +12,37 @@ readme = "README.md"
 autotests = true
 edition = "2018"
 
+[badges.maintenance]
+status = "passively-maintained"
+
 [dependencies]
 libc = "0.2.42"
-curl-sys = { path = "curl-sys", version = "0.4.83", default-features = false }
+curl-sys = { path = "curl-sys", version = "0.4.89", default-features = false }
 socket2 = "0.6.0"
 
 # Unix platforms use OpenSSL for now to provide SSL functionality
 [target.'cfg(all(unix))'.dependencies]
-openssl-sys = { version = "0.9.64", optional = true }
+openssl-sys = { workspace = true, optional = true }
 openssl-probe = { version = "0.1.2", optional = true }
 
 [target.'cfg(target_env = "msvc")'.dependencies]
 schannel = "0.1.13"
-windows-sys = { version = "0.59", features = ["Win32_Foundation", "Win32_System_LibraryLoader", "Win32_Security_Cryptography"] }
+windows-sys = { workspace = true, features = ["Win32_Foundation", "Win32_System_LibraryLoader", "Win32_Security_Cryptography"] }
 
 [dev-dependencies]
 mio = "0.6"
 mio-extras = "2.0.3"
 anyhow = "1.0.31"
+static_assertions = "1.1"
 brotlic-sys = "0.2.2"
 
 [workspace]
-members = ["systest"]
+members = ["curl-sys", "systest"]
+
+[workspace.dependencies]
+cc = "1.0"
+openssl-sys = "0.9.64"
+windows-sys = ">=0.59.0, <0.62.0"
 
 [features]
 default = ["ssl"]
@@ -44,6 +53,7 @@ http2 = ["curl-sys/http2"]
 spnego = ["curl-sys/spnego"]
 rustls = ["curl-sys/rustls"]
 static-curl = ["curl-sys/static-curl"]
+apple-sectrust = ["ssl", "static-curl", "curl-sys/apple-sectrust"]
 static-ssl = ["curl-sys/static-ssl"]
 windows-static-ssl = ["static-curl", "curl-sys/windows-static-ssl"]
 force-system-lib-on-osx = ['curl-sys/force-system-lib-on-osx']

README.md

@@ -7,7 +7,8 @@ on the `moli` branch. Moli-specific changes should be based on that branch.
 
 [![Latest Version](https://img.shields.io/crates/v/curl.svg)](https://crates.io/crates/curl)
 [![Documentation](https://docs.rs/curl/badge.svg)](https://docs.rs/curl)
-[![License](https://img.shields.io/github/license/alexcrichton/curl-rust.svg)](LICENSE)
+[![License](https://img.shields.io/github/license/sagebind/curl-rust.svg)](LICENSE)
+![Maintenance](https://img.shields.io/badge/maintenance-passively--maintained-brightgreen.svg)
 [![Build](https://github.com/lexmount/curl-rust/actions/workflows/websocket.yml/badge.svg?branch=moli)](https://github.com/lexmount/curl-rust/actions/workflows/websocket.yml)
 
 ## WebSocket clients
@@ -18,7 +19,7 @@ library's protocol configuration. To use this fork throughout a workspace:
 
 ```toml
 [dependencies]
-curl = { version = "0.4.49", features = ["static-curl", "websocket"] }
+curl = { version = "0.4.51", features = ["static-curl", "websocket"] }
 
 [patch.crates-io]
 curl = { git = "https://github.com/lexmount/curl-rust", branch = "moli" }
@@ -70,14 +71,20 @@ can pause reading. System library builds do not get these fixes.
 Bundled builds also preserve application-owned `CONNECT_ONLY` sockets when
 the per-host connection limit is reached, matching the total-limit eviction
 policy. A quiet upgraded WebSocket still consumes a connection slot; a new
-transfer waits for capacity instead of evicting it. This fix is generated in
-`OUT_DIR/conncache.c`, with the same submodule and patch-location checks.
+transfer waits for capacity instead of evicting it. Bundled libcurl 8.23.0
+includes the [upstream fix](https://github.com/curl/curl/commit/9e6673fb7d55b40d18383f49f465f1bd1cfce1ee),
+so this fork compiles `conncache.c` directly without a generated patch.
+
+For bundled OpenSSL builds on Apple platforms, enable the upstream
+`apple-sectrust` feature to use the system trust store. Explicit `SSL_CERT_FILE`
+and `SSL_CERT_DIR` overrides remain supported; no certificate file is selected
+automatically when SecTrust is available.
 
 Local validation (including C structure and function ABI checks):
 
 ```sh
-cargo test --workspace --features static-curl,http2,brotli,websocket,ws_start_frame_8_16_0
-cargo run -p systest --features curl-sys/static-curl,systest/websocket,systest/ws_start_frame_8_16_0
+cargo test --workspace --features static-curl,http2,brotli,apple-sectrust,websocket,ws_start_frame_8_16_0
+cargo run -p systest --features curl-sys/static-curl,curl-sys/apple-sectrust,systest/websocket,systest/ws_start_frame_8_16_0
 ```
 
 ## Quick Start
@@ -195,13 +202,15 @@ By default, this crate will attempt to dynamically link to the system-wide
 libcurl and the system-wide SSL library. Some of this behavior can be customized
 with various Cargo features:
 
-- `ssl`: Enable SSL/TLS support using the platform-default TLS backend. On Windows this is [Schannel], on macOS [Secure Transport], and [OpenSSL] (or equivalent) on all other platforms.  Enabled by default.
+- `ssl`: Enable SSL/TLS support using the platform-default TLS backend. On Windows this is [Schannel], on macOS [Secure Transport], and [OpenSSL] (or equivalent) on all other platforms. Enabled by default.
 - `rustls` Enable SSL/TLS support via [Rustls], a well-received alternative TLS backend written in Rust. Rustls is always statically linked. Disabled by default.
 
   Note that Rustls support is experimental within Curl itself and may have significant bugs, so we don't offer any sort of stability guarantee with this feature.
+
 - `brotli`: Enable Brotli content encoding support. With vendored libcurl this uses `brotlic-sys`; with a system libcurl, the detected library must already have Brotli enabled. Disabled by default.
 - `http2`: Enable HTTP/2 support via libnghttp2. Disabled by default.
 - `static-curl`: Use a bundled libcurl version and statically link to it. Disabled by default.
+- `apple-sectrust`: Use Apple SecTrust for certificate verification with bundled libcurl and OpenSSL on Apple platforms. Implies `ssl` and `static-curl`. Disabled by default.
 - `static-ssl`: Use a bundled OpenSSL version and statically link to it. Only applies on platforms that use OpenSSL. Disabled by default.
 - `spnego`: Enable SPNEGO support. Disabled by default.
 - `upkeep_7_62_0`: Enable curl_easy_upkeep() support, introduced in curl 7.62.0. Disabled by default.
@@ -210,6 +219,7 @@ with various Cargo features:
 - `windows-static-ssl`: Enable Openssl support on Windows via the static build provided by vcpkg. Incompatible with `ssl` (use `--no-default-features`). Disabled by default.
 
   Note that to install openssl on windows via vcpkg the following commands needs to be ran:
+
   ```shell
   git clone https://github.com/microsoft/vcpkg
   cd vcpkg
@@ -241,16 +251,15 @@ against the NSS SSL library, the NSS PEM PKCS#11 module (`libnsspem.so`) needs t
 
 In order to avoid this failure you can either
 
- * install the missing library (e.g. Debian: `nss-plugin-pem`), or
- * remove the libcurl NSS development files (e.g. Debian: `libcurl4-nss-dev`) and
-   rebuild curl-rust.
+- install the missing library (e.g. Debian: `nss-plugin-pem`), or
+- remove the libcurl NSS development files (e.g. Debian: `libcurl4-nss-dev`) and
+  rebuild curl-rust.
 
 ## License
 
 The `curl-rust` crate is licensed under the MIT license, see [`LICENSE`](LICENSE) for more
 details.
 
-
 [libcurl]: https://curl.haxx.se/libcurl/
 [OpenSSL]: https://www.openssl.org/
 [Rustls]: https://github.com/ctz/rustls

build.rs

@@ -24,8 +24,12 @@ fn main() {
     };
 
     if use_openssl {
+        let apple_sectrust = env::var_os("CARGO_FEATURE_APPLE_SECTRUST").is_some()
+            && env::var("CARGO_CFG_TARGET_VENDOR").ok().as_deref() == Some("apple");
+
         // The system libcurl should have the default certificate paths configured.
-        if env::var_os("DEP_CURL_APPLE_SECTRUST").is_some() {
+        // Apple SecTrust likewise supplies the native trust anchors itself.
+        if apple_sectrust {
             println!("cargo:rustc-cfg=apple_sectrust");
         } else if env::var_os("DEP_CURL_STATIC").is_some() {
             println!("cargo:rustc-cfg=need_openssl_probe");

ci/run.sh

@@ -41,6 +41,10 @@ if [ -z "$NO_RUN" ]; then
     cargo test --target $TARGET --features static-curl,protocol-ftp $features
     cargo test --target $TARGET --features static-curl,http2 $features
 
+    case "$TARGET" in
+        *-apple-*) cargo test --target $TARGET --features apple-sectrust $features ;;
+    esac
+
     # Note that `-Clink-dead-code` is passed here to suppress `--gc-sections` to
     # help confirm that we're compiling everything necessary for curl itself.
     RUSTFLAGS=-Clink-dead-code \

curl-sys/Cargo.toml

@@ -1,17 +1,21 @@
 [package]
 name = "curl-sys"
-version = "0.4.87+curl-8.19.0"
-authors = ["Alex Crichton <alex@alexcrichton.com>"]
+version = "0.4.91+curl-8.23.0"
+authors = ["Alex Crichton <alex@alexcrichton.com>", "Stephen M. Coakley <me@stephencoakley.com>"]
 links = "curl"
 build = "build.rs"
 license = "MIT"
 repository = "https://github.com/lexmount/curl-rust"
 description = "Native bindings to the libcurl library"
 documentation = "https://docs.rs/curl-sys"
+readme = "../README.md"
 categories = ["external-ffi-bindings"]
 edition = "2018"
 exclude = ["curl/docs/", "curl/tests/"]
 
+[badges.maintenance]
+status = "passively-maintained"
+
 [lib]
 name = "curl_sys"
 path = "lib.rs"
@@ -28,17 +32,17 @@ optional = true
 features = ["no_log_capture"]
 
 [target.'cfg(all(unix))'.dependencies]
-openssl-sys = { version = "0.9.64", optional = true }
+openssl-sys = { workspace = true, optional = true }
 
 [target.'cfg(windows)'.dependencies]
-windows-sys = { version = "0.59", features = ["Win32_Networking_WinSock"] }
+windows-sys = { workspace = true, features = ["Win32_Networking_WinSock"] }
 
 [target.'cfg(target_env = "msvc")'.build-dependencies]
 vcpkg = "0.2"
 
 [build-dependencies]
+cc.workspace = true
 pkg-config = "0.3.3"
-cc = "1.0"
 
 [features]
 default = ["ssl"]
@@ -48,6 +52,7 @@ brotli = ["brotlic-sys"]
 mesalink = []
 rustls = ["rustls-ffi"]
 static-curl = []
+apple-sectrust = ["ssl", "static-curl"]
 windows-static-ssl = []
 static-ssl = ["openssl-sys/vendored"]
 spnego = []