curl

curl

[Thiago Farina]

Hi,

Is it right that git uses libcurl to download while libgit2 does without it?

-- 
Thiago Farina

Re: curl

[Jeff King]

On Mon, Apr 27, 2015 at 11:49:51PM -0300, Thiago Farina wrote:

> Is it right that git uses libcurl to download while libgit2 does without it?

I'm not sure if you mean "right" as in "this statement is true" or as in
"is this a good thing that it is the case".

For the former, yes, libgit2 does not use curl.  On Windows, it can use
the native http calls (which do nice things like using the system proxy
and auth systems). On Unix, I think it is a combination of hand-rolled
code, openssl, and an imported http parser (from nginx).

Whether that is a good idea or not, I can't comment too much. From what
I have seen discussed in libgit2 issues, the stock http transport is
meant to be bare-bones (but with minimal dependencies). But it could
co-exist with a curl transport (just as it does with the WinHTTP
transport).  Maybe Carlos (cc'd) can say more.

-Peff

Re: curl

[Carlos Martín Nieto]

On Tue, 2015-04-28 at 00:57 -0400, Jeff King wrote:
> On Mon, Apr 27, 2015 at 11:49:51PM -0300, Thiago Farina wrote:
> 
> > Is it right that git uses libcurl to download while libgit2 does without it?
> 
> I'm not sure if you mean "right" as in "this statement is true" or as in
> "is this a good thing that it is the case".
> 
> For the former, yes, libgit2 does not use curl.  On Windows, it can use
> the native http calls (which do nice things like using the system proxy
> and auth systems). On Unix, I think it is a combination of hand-rolled
> code, openssl, and an imported http parser (from nginx).
> 
> Whether that is a good idea or not, I can't comment too much. From what
> I have seen discussed in libgit2 issues, the stock http transport is
> meant to be bare-bones (but with minimal dependencies). But it could
> co-exist with a curl transport (just as it does with the WinHTTP
> transport).  Maybe Carlos (cc'd) can say more.

This is accurate, though I'll add that the development version of
libgit2 now uses SecureTransport instead of OpenSSL on Mac OS X.

But this is just the default. You can replace what libgit2 will use as a
transport if you have special needs. Visual Studio use their own network
code, and the cargo package manager uses libcurl. Eventually libcurl
support will likely be added to mainline libgit2, when we find time.

   cmn

curl

[Valek, Andrej]

Hello Steve,

I have a question about curl. Would it be possible to backport some
fixes for CVEs from kirkstone to dunfell? 

CVE-2022-32221
CVE-2022-42915
CVE-2022-42916
CVE-2022-43552 
CVE-2022-43551

Thank you,
Andrej

Re: curl

[Steve Sakoman]

On Thu, Mar 9, 2023 at 5:15 AM Valek, Andrej <andrej.valek@siemens.com> wrote:

> I have a question about curl. Would it be possible to backport some
> fixes for CVEs from kirkstone to dunfell?

The curl versions in kirkstone and dunfell are different, so a direct
cherry-pick of those patches may or may not work.

If you could test cherry-picking them and then submit the patches to
the list (with your Signed-off-by added) I would be happy to take them
:-)

Steve