Log message:
Pullup ticket #5825 - requested by wiz
www/curl: security update

Revisions pulled up:
- www/curl/Makefile                                             1.201
- www/curl/distinfo                                             1.146
- www/curl/patches/patch-src_tool__cb__hdr.c                    deleted

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Wed Sep  5 06:49:26 UTC 2018

   Modified Files:
   	pkgsrc/www/curl: Makefile distinfo
   Removed Files:
   	pkgsrc/www/curl/patches: patch-src_tool__cb__hdr.c

   Log message:
   curl: update to 7.61.1.

   This release includes the following bugfixes:

    o security advisory (CVE-2018-14618): NTLM password overflow via integer \ 
overflow [73]
    o CURLINFO_SIZE_UPLOAD: fix missing counter update [46]
    o CURLOPT_ACCEPT_ENCODING.3: list them comma-separated
    o CURLOPT_SSL_CTX_FUNCTION.3: might cause accidental connection reuse [72]
    o Curl_getoff_all_pipelines: improved for multiplexed [3]
    o DEPRECATE: remove release date from 7.62.0
    o HTTP: Don't attempt to needlessly decompress redirect body [30]
    o INTERNALS: require GnuTLS >= 2.11.3 [62]
    o README.md: add LGTM.com code quality grade for C/C++ [42]
    o SSLCERTS: improve the openssl command line
    o Silence GCC 8 cast-function-type warnings [47]
    o ares: check for NULL in completed-callback [3]
    o asyn-thread: Remove unused macro [40]
    o auth: only pick CURLAUTH_BEARER if we *have* a Bearer token [15]
    o auth: pick Bearer authentication whenever a token is available [15]
    o cmake: CMake config files are defining CURL_STATICLIB for static builds [54]
    o cmake: Respect BUILD_SHARED_LIBS [35]
    o cmake: Update scripts to use consistent style [9]
    o cmake: bumped minimum version to 3.4 [34]
    o cmake: link curl to the OpenSSL targets instead of lib absolute paths [34]
    o configure: conditionally enable pedantic-errors [64]
    o configure: fix for -lpthread detection with OpenSSL and pkg-config [38]
    o conn: remove the boolean 'inuse' field [3]
    o content_encoding: accept up to 4 unknown trailer bytes after raw deflate \ 
data [5]
    o cookie tests: treat files as text
    o cookies: support creation-time attribute for cookies [75]
    o curl: Fix segfault when -H @headerfile is empty [23]
    o curl: add http code 408 to transient list for --retry [78]
    o curl: fix time-of-check, time-of-use race in dir creation [71]
    o curl: use Content-Disposition before the "URL end" for -OJ [29]
    o curl: warn the user if a given file name looks like an option [56]
    o curl_threads: silence bad-function-cast warning [69]
    o darwinssl: add support for ALPN negotiation [7]
    o docs/CURLOPT_URL: fix indentation [20]
    o docs/CURLOPT_WRITEFUNCTION: size is always 1 [19]
    o docs/SECURITY-PROCESS: mention bounty, drop pre-notify
    o docs/examples: add hiperfifo example using linux epoll/timerfd [21]
    o docs: add disallow-username-in-url.d and haproxy-protocol.d to dist [50]
    o docs: clarify NO_PROXY env variable functionality [70]
    o docs: improved the manual pages of some callbacks [48]
    o docs: mention NULL is fine input to several functions [43]
    o formdata: Remove unused macro HTTPPOST_CONTENTTYPE_DEFAULT [40]
    o gopher: Do not translate `?' to `%09' [67]
    o header output: switch off all styles, not just unbold [8]
    o hostip: fix unused variable warning
    o http2: Use correct format identifier for stream_id [77]
    o http2: abort the send_callback if not setup yet [63]
    o http2: avoid set_stream_user_data() before stream is assigned [61]
    o http2: check nghttp2_session_set_stream_user_data return code [55]
    o http2: clear the drain counter in Curl_http2_done [27]
    o http2: make sure to send after RST_STREAM [58]
    o http2: separate easy handle from connections better [12]
    o http: fix for tiny "HTTP/0.9" response [51]
    o http_proxy: Remove unused macro SELECT_TIMEOUT [40]
    o lib/Makefile: only do symbol hiding if told to [32]
    o lib1502: fix memory leak in torture test [44]
    o lib1522: fix curl_easy_setopt argument type
    o libcurl-thread.3: expand somewhat on the NO_SIGNAL motivation [66]
    o mime: check Curl_rand_hex's return code [22]
    o multi: always do the COMPLETED procedure/state [3]
    o openssl: assume engine support in 1.0.0 or later [2]
    o openssl: fix debug messages [39]
    o projects: Improve Windows perl detection in batch scripts [49]
    o retry: return error if rewind was necessary but didn't happen [28]
    o reuse_conn(): memory leak - free old_conn->options [17]
    o schannel: client certificate store opening fix [68]
    o schannel: enable CALG_TLS1PRF for w32api >= 5.1
    o schannel: fix MinGW compile break [1]
    o sftp: don't send post-qoute sequence when retrying a connection [79]
    o smb: fix memory leak on early failure [26]
    o smb: fix memory-leak in URL parse error path [4]
    o smb_getsock: always wait for write socket too [11]
    o ssh-libssh: fix infinite connect loop on invalid private key [53]
    o ssh-libssh: reduce excessive verbose output about pubkey auth [53]
    o ssh-libssh: use FALLTHROUGH to silence gcc8 [76]
    o ssl: set engine implicitly when a PKCS#11 URI is provided [36]
    o sws: handle EINTR when calling select() [24]
    o system_win32: fix version checking [16]
    o telnet: Remove unused macros TELOPTS and TELCMDS [40]
    o test1143: disable MSYS2's POSIX path conversion [10]
    o test1148: disable if decimal separator is not point [65]
    o test1307: (fnmatch testing) disabled [31]
    o test1422: add required file feature [6]
    o test1531: Add timeout [41]
    o test1540: Remove unused macro TEST_HANG_TIMEOUT [40]
    o test214: disable MSYS2's POSIX path conversion for URL
    o test320: treat curl320.out file as binary [14]
    o tests/http_pipe.py: Use /usr/bin/env to find python
    o tests: Don't use Windows path %PWD for SSH tests [74]
    o tests: fixes for Windows line endlings [13]
    o tool_operate: Fix setting proxy TLS 1.3 ciphers
    o travis: build darwinssl on macos 10.12 to fix linker errors [33]
    o travis: execute "set -eo pipefail" for coverage build [45]
    o travis: run a 'make checksrc' too [25]
    o travis: update to GCC-8 [52]
    o travis: verify that man pages can be regenerated [50]
    o upload: allocate upload buffer on-demand [60]
    o upload: change default UPLOAD_BUFSIZE to 64KB [60]
    o urldata: remove unused pipe_broke struct field [57]
    o vtls: reinstantiate engine on duplicated handles [59]
    o windows: implement send buffer tuning [37]
    o wolfSSL/CyaSSL: Fix memory leak in Curl_cyassl_random [18]

   To generate a diff of this commit:
   cvs rdiff -u -r1.200 -r1.201 pkgsrc/www/curl/Makefile
   cvs rdiff -u -r1.145 -r1.146 pkgsrc/www/curl/distinfo
   cvs rdiff -u -r1.1 -r0 pkgsrc/www/curl/patches/patch-src_tool__cb__hdr.c

Log message:
Pullup ticket #5784 - requested by bsiegert
www/curl: security update

Revisions pulled up:
- www/curl/Makefile                                             1.197
- www/curl/PLIST                                                1.70
- www/curl/distinfo                                             1.144

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Wed Jul 11 18:13:26 UTC 2018

   Modified Files:
           pkgsrc/www/curl: Makefile PLIST distinfo

   Log message:
   curl: updated to 7.61.0

   Curl and libcurl 7.61.0

   This release includes the following changes:
   * getinfo: add microsecond precise timers for seven intervals
   * curl: show headers in bold, switch off with --no-styled-output
   * httpauth: add support for Bearer tokens
   * Add CURLOPT_TLS13_CIPHERS and CURLOPT_PROXY_TLS13_CIPHERS
   * curl: --tls13-ciphers and --proxy-tls13-ciphers
   * Add CURLOPT_DISALLOW_USERNAME_IN_URL
   * curl: --disallow-username-in-url

   This release includes the following bugfixes:
   * CVE-2018-0500: smtp: fix SMTP send buffer overflow
   * schannel: disable client cert option if APIs not available
   * schannel: disable manual verify if APIs not available
   * tests/libtest/Makefile: Do not unconditionally add gcc-specific flags
   * openssl: acknowledge --tls-max for default version too
   * stub_gssapi: fix 'unused parameter' warnings
   * examples/progressfunc: make it build on both new and old libcurls
   * docs: mention it is HA Proxy protocol "version 1"
   * curl_fnmatch: only allow two asterisks for matching
   * docs: clarify CURLOPT_HTTPGET
   * configure: replace a AC_TRY_RUN with CURL_RUN_IFELSE
   * configure: do compile-time SIZEOF checks instead of run-time
   * checksrc: make sure sizeof() is used *with* parentheses
   * CURLOPT_ACCEPT_ENCODING.3: add brotli and clarify a bit
   * schannel: make CAinfo parsing resilient to CR/LF
   * tftp: make sure error is zero terminated before printfing it
   * http resume: skip body if http code 416 (range error) is ignored
   * configure: add basic test of --with-ssl prefix
   * cmake: set -d postfix for debug builds
   * multi: provide a socket to wait for in Curl_protocol_getsock
   * content_encoding: handle zlib versions too old for Z_BLOCK
   * winbuild: only delete OUTFILE if it exists
   * winbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST
   * schannel: add failf calls for client certificate failures
   * cmake: Fix the test for fsetxattr and strerror_r
   * curl.1: Fix cmdline-opts reference errors
   * cmdline-opts/gen.pl: warn if mutexes: or see-also: list non-existing options
   * cmake: check for getpwuid_r
   * configure: fix ssh2 linking when built with a static mbedtls
   * psl: use latest psl and refresh it periodically
   * fnmatch: insist on escaped bracket to match
   * KNOWN_BUGS: restore text regarding 2101
   * INSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib
   * configure: override AR_FLAGS to silence warning
   * os400: implement mime api EBCDIC wrappers
   * curl.rc: embed manifest for correct Windows version detection
   * strictness: correct {infof, failf} format specifiers
   * tests: update .gitignore for libtests
   * configure: check for declaration of getpwuid_r
   * fnmatch: use the system one if available
   * CURLOPT_RESOLVE: always purge old entry first
   * multi: remove a potentially bad DEBUGF()
   * curl_addrinfo: use same #ifdef conditions in source as header
   * build: remove the Borland specific makefiles
   * axTLS: not considered fit for use
   * cmdline-opts/cert-type.d: mention "p12" as a recognized type
   * system.h: add support for IBM xlc C compiler
   * tests/libtest: Add lib1521 to nodist_SOURCES
   * mk-ca-bundle.pl: leave certificate name untouched
   * boringssl + schannel: undef X509_NAME in lib/schannel.h
   * openssl: assume engine support in 1.0.1 or later
   * cppcheck: fix warnings
   * test 46: make test pass after year 2025
   * schannel: support selecting ciphers
   * Curl_debug: remove dead printhost code
   * test 1455: unflakified
   * Curl_init_do: handle NULL connection pointer passed in
   * progress: remove a set of unused defines
   * mk-ca-bundle.pl: make -u delete certdata.txt if found not changed
   * GOVERNANCE.md: explains how this project is run
   * configure: use pkg-config for c-ares detection
   * configure: enhance ability to build with static openssl
   * maketgz: fix sed issues on OSX
   * multi: fix memory leak when stopped during name resolve
   * CURLOPT_INTERFACE.3: interface names not supported on Windows
   * url: fix dangling conn->data pointer
   * cmake: allow multiple SSL backends
   * system.h: fix for gcc on 32 bit OpenServer
   * ConnectionExists: make sure conn->data is set when "taking" a \ 
connection
   * multi: fix crash due to dangling entry in connect-pending list
   * CURLOPT_SSL_VERIFYPEER.3: Add performance note
   * netrc: use a larger buffer to support longer passwords
   * url: check Curl_conncache_add_conn return code
   * configure: Add dependent libraries after crypto
   * easy_perform: faster local name resolves by using *multi_timeout()
   * getnameinfo: not used, removed all configure checks
   * travis: add a build using the synchronous name resolver
   * CURLINFO_TLS_SSL_PTR.3: improve the example
   * openssl: allow TLS 1.3 by default
   * openssl: make the requested TLS version the *minimum* wanted
   * openssl: Remove some dead code
   * telnet: fix clang warnings
   * DEPRECATE: new doc describing planned item removals
   * example/crawler.c: simple crawler based on libxml2
   * libssh: goto DISCONNECT state on error, not SESSION_FREE
   * CMake: Remove unused functions
   * darwinssl: allow High Sierra users to build the code using GCC
   * scripts: include _curl as part of CLEANFILES
   * examples: fix -Wformat warnings
   * curl_setup: include <winerror.h> before <windows.h>
   * schannel: make more cipher options conditional
   * CMake: remove redundant and old end-of-block syntax
   * post303.d: clarify that this is an RFC violation

   To generate a diff of this commit:
   cvs rdiff -u -r1.196 -r1.197 pkgsrc/www/curl/Makefile
   cvs rdiff -u -r1.69 -r1.70 pkgsrc/www/curl/PLIST
   cvs rdiff -u -r1.143 -r1.144 pkgsrc/www/curl/distinfo