Skip to content

feat: update curl to 8.14.1-2+deb13u4#27

Merged
Zeno-sole merged 4 commits into
masterfrom
dcbot/debian/8.14.1
Jul 24, 2026
Merged

feat: update curl to 8.14.1-2+deb13u4#27
Zeno-sole merged 4 commits into
masterfrom
dcbot/debian/8.14.1

Conversation

@deepin-community-bot

@deepin-community-bot deepin-community-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

This pull request is requested by @Zeno-sole.

Basic Information

Old Version: 8.11.0-0deepin4
New Version: 8.14.1-2+deb13u4
Old version may contain dde / deepin patches. Please review more precisely.

Potential transition

  • libcurl4 is not present in the new package.
  • libcurl3-gnutls is not present in the new package.

64-bit time_t transition

Caution

DCBot assumes this package is already gone through 64-bit time_t transition.

Patch series

--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,22 +1,26 @@
 ZZZgnutls-build.patch
 build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch
 11_omit-directories-from-config.patch
-Remove-curl-s-LDFLAGS-from-curl-config-static-libs.patch
-
-# Post 8.11.0 patches
-duphandle_also_init_netrc.patch
-setopt_fix_CURLOPT_HTTP_CONTENT_DECODING.patch
-netrc_support_large_file_longer_lines_longer_tokens.patch
-cmdline_ech_md_formatting_cleanups.patch
-libssh_when_using_IPv6_numerical_address_add_brackets.patch
-
-# Security fixes for curl 8.11.0
-cve-2025-0167.patch
-cve-2025-10148.patch
-cve-2025-13034.patch
-cve-2026-3783.patch
-cve-2026-3784.patch
-
-# Security fixes
-cve-2026-6276.patch
-cve-2026-5773.patch
+tool_getparam_fix_ftp_pasv.patch
+curl_path_make_SFTP_handle_a_path.patch
+tool_operate_fix_return_code_when_retry_is_used_but_not_triggered.patch
+cookie-don-t-treat-the-leading-slash-as-trailing.patch
+CVE-2025-10148.patch
+wcurl-Set-CURL_OPTIONS-right-before-the-url.patch
+wcurl-Fix-example-for-continue-at.patch
+wcurl-CVE-2025-11563.patch
+CVE-2025-13034.patch
+CVE-2025-14524.patch
+CVE-2025-14819.patch
+CVE-2026-1965_1.patch
+CVE-2026-1965_2.patch
+CVE-2026-3783.patch
+CVE-2026-3784.patch
+CVE-2026-3805.patch
+CVE-2026-4873.patch
+CVE-2026-5545.patch
+CVE-2026-6253.patch
+CVE-2026-5773.patch
+CVE-2026-6276.patch
+CVE-2026-7168.patch
+CVE-2026-6429.patch

@github-actions

github-actions Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

TAG Bot

TAG: 8.14.1-2+deb13u4deepin3
EXISTED: no
DISTRIBUTION: unstable

@deepin-ci-robot

deepin-ci-robot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Zeno-sole added 2 commits July 24, 2026 11:09
@Zeno-sole
chore: revert t64 changes
8ba4964 
Revert the t64 (time64) transition changes from the curl packaging.
Rename libcurl4t64 back to libcurl4 and libcurl3t64-gnutls back to
libcurl3-gnutls, including install/links/symbols/lintian-overrides
files. Remove t64-specific fields (Provides, X-Time64-Compat, Breaks)
from debian/control and update debian/rules dh_install targets.

Log: Revert t64 package naming and control fields

Influence:
1. Verify curl package builds successfully with libcurl4 and libcurl3-gnutls names
2. Confirm no t64 references remain in debian/ packaging files
3. Check that libcurl4 and libcurl3-gnutls packages install and provide correct sonames
4. Validate dependency resolution for curl, libcurl4-openssl-dev and libcurl4-gnutls-dev

chore: 还原 t64 变更

还原 curl 打包中的 t64 (time64) 过渡变更。
将 libcurl4t64 还原为 libcurl4，libcurl3t64-gnutls 还原为
libcurl3-gnutls，包括 install/links/symbols/lintian-overrides 文件。
移除 debian/control 中的 t64 相关字段 (Provides、X-Time64-Compat、Breaks)，
并更新 debian/rules 的 dh_install 目标。

Log: 还原 t64 包名及相关控制字段

Influence:
1. 验证 curl 包以 libcurl4 和 libcurl3-gnutls 名称成功构建
2. 确认 debian/ 打包文件中不再存在 t64 引用
3. 检查 libcurl4 和 libcurl3-gnutls 包安装并提供正确的 soname
4. 验证 curl、libcurl4-openssl-dev 和 libcurl4-gnutls-dev 的依赖解析

repo: curl #dcbot/debian/8.14.1
@Zeno-sole
fix: libcurl4 should not replaces itself
b70f626 
Remove libcurl4 from its own Replaces field in debian/control.
A package should not list itself in Replaces, as this causes
incorrect package replacement behavior during installation and
upgrades. Only libcurl3 should be in the Replaces field.

Log: Fix libcurl4 self-replacement in debian/control

Influence:
1. Verify libcurl4 package metadata is correct after build
2. Confirm package installation and upgrade do not trigger self-replacement
3. Check dpkg control fields validation passes without warnings

fix: libcurl4 不应替换自身

从 debian/control 的 Replaces 字段中移除 libcurl4。
包不应在 Replaces 中列出自身，否则会导致安装和升级过程中
出现错误的包替换行为。Replaces 字段应仅包含 libcurl3。

Log: 修复 debian/control 中 libcurl4 自身替换问题

Influence:
1. 验证构建后 libcurl4 包元数据正确
2. 确认包安装和升级不会触发自身替换
3. 检查 dpkg 控制字段验证无警告通过

repo: curl #dcbot/debian/8.14.1
@Zeno-sole

Zeno-sole commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

/integrate

@Zeno-sole
Zeno-sole marked this pull request as ready for review July 24, 2026 03:24
@deepin-ci-robot
deepin-ci-robot requested a review from BLumia July 24, 2026 03:24
@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown

AutoIntegrationPr Bot
auto integrate with pr url: deepin-community/Repository-Integration#4393
PrNumber: 4393
PrBranch: auto-integration-30064136825

@deepin-community-ci-bot deepin-community-ci-bot Bot mentioned this pull request Jul 24, 2026
Open
@deepin-ci-robot

deepin-ci-robot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

/hold
因为该quilt包的上游版本号变更，详情见: deepin-community/infra-settings#134

@Zeno-sole

Zeno-sole commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

curl CVE 修复状态检查 — dcbot/debian/8.14.1 分支

检查日期：2026-07-24
基线版本：8.14.1-2+deb13u4
数据来源：https://security-tracker.debian.org/tracker/

已修复（上游 8.14.1 已包含，无需补丁）— 5 个

CVE Debian tracker trixie 状态
CVE-2026-8925 fixed in 8.14.1-2+deb13u4
CVE-2026-9546 fixed in 8.14.1-2+deb13u4
CVE-2026-11352 fixed in 8.14.1-2+deb13u4
CVE-2026-11564 fixed in 8.14.1-2+deb13u4
CVE-2026-11586 fixed in 8.14.1-2+deb13u4

未修复（vulnerable），仓库其他分支有现成补丁 — 6 个

CVE 补丁来源分支
CVE-2026-8286 origin/fix-cve/CVE-2026-8286
CVE-2026-8924 origin/fix-cve/CVE-2026-8924
CVE-2026-8927 origin/fix-cve/CVE-2026-8927
CVE-2026-9079 origin/fix-cve/CVE-2026-8286
CVE-2026-9547 origin/fix-cve/CVE-2026-8286
CVE-2026-10536 origin/fix-cve/CVE-2026-8286

未修复（vulnerable），仓库中无现成补丁 — 6 个

CVE
CVE-2026-8926
CVE-2026-9080
CVE-2026-9545
CVE-2026-11856
CVE-2026-12064
CVE-2026-8932

汇总

  • 总计：17 个
  • 已修复（无需处理）：5 个
  • 未修复 + 有现成补丁：6 个
  • 未修复 + 无现成补丁：6 个

@Zeno-sole
fix(curl): conditionally disable openssl-quic for OpenSSL < 3.3.0
f3e1fc5 
The build environment has OpenSSL 3.2.4, which does not support QUIC
(requires OpenSSL >= 3.3.0). The --with-openssl-quic configure option
fails with:
  configure: error: --with-openssl-quic requires quic support and
  OpenSSL >= 3.3.0

Fix by checking OpenSSL version at build time and only enabling
--with-openssl-quic and --with-nghttp3 when OpenSSL >= 3.3.0.

Log: fix build failure when OpenSSL version < 3.3.0
Influence: debian/rules - conditional openssl-quic support
@Zeno-sole
Zeno-sole merged commit c2d9da9 into master Jul 24, 2026
6 of 9 checks passed
@deepin-ci-robot

deepin-ci-robot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hudeng-go

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hudeng-go hudeng-go hudeng-go approved these changes
@chenchongbiao chenchongbiao Awaiting requested review from chenchongbiao
@myml myml Awaiting requested review from myml
@BLumia BLumia Awaiting requested review from BLumia

Assignees

No one assigned

Labels

approved do-not-merge/hold

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@deepin-ci-robot @Zeno-sole @hudeng-go