From: "Paul Smedley" <gnuports@2rosenthals.com>
Received: from [192.168.100.201] (HELO mail.2rosenthals.com)
  by 2rosenthals.com (CommuniGate Pro SMTP 5.4.10)
  with ESMTP id 11700623 for gnuports@2rosenthals.com; Fri, 03 Jan 2025 16:17:22 -0500
Received: from [192.168.200.201] (port=44683 helo=mail2.2rosenthals.com)
	by mail.2rosenthals.com with esmtp (Exim 4.97.1)
	(envelope-from <paul@smedley.id.au>)
	id 1tTp2c-000000000ts-1Yu8
	for gnuports@2rosenthals.com;
	Fri, 03 Jan 2025 16:17:10 -0500
Received: from vps.smedley.id.au ([142.171.106.2]:38840)
	by mail2.2rosenthals.com with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.97.1)
	(envelope-from <paul@smedley.id.au>)
	id 1tTp2U-000000004wY-1cAo
	for gnuports@2rosenthals.com;
	Fri, 03 Jan 2025 16:17:02 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=smedley.id.au;
	s=default; t=1735939022;
	bh=vy7eoHVjOkYJHel4s+BFsLGaHjOQa0WXs4/xLGVCba0=;
	h=Date:Subject:To:References:From:In-Reply-To:From;
	b=VxNLS9iKKXdMgxpX1B5wag/7F8ocNFkHnHSjMU93whCQkOqoKUDn2FKjhZgbbrkkG
	 /r21u9/doYM8/RnVG1hgDHVmy/4vlBCR9Y0+J0ESeIiJVINEx2cHoKjM5uFthDN/vg
	 UAbrFyr/pbdIcTJ7HDhSrJtNHd90q7DQ1uCu9uZPruoN4hOkOoNyg9/M02bWJ/05O0
	 HaDJ5bQ8pn0A9k7v1pNW1lssr9ybu2dUUguYbW2nX4l5UvdThtsNdeYI0C2IDGnNeE
	 QrhgUM6OqwjwBpr+bnRgKy5NvFBxD3pMmljWj8IAHdmBa6xCjvc6EQMQh4c9/FYQV4
	 UzGmCuxMJjg1A==
Received: from [IPV6:2400:a848:4041:0:24b7:34d8:4237:c728] (unknown [IPv6:2400:a848:4041:0:24b7:34d8:4237:c728])
	(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
	 key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256)
	(No client certificate requested)
	by vps.smedley.id.au (Postfix) with ESMTPSA id 9CD192003E
	for <gnuports@2rosenthals.com>; Sat,  4 Jan 2025 07:47:01 +1030 (ACDT)
Message-ID: <062fdd44-1313-4fb4-be4e-f5efbabde2c9@smedley.id.au>
Date: Sat, 4 Jan 2025 07:46:51 +1030
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [GNU Ports] cURL vulnerabilities
To: GNU Ports for eCS Mailing List <gnuports@2rosenthals.com>
References: <list-11700411@2rosenthals.com>
 <3adea6bc-e344-47bd-8970-3a6bcbc6f9a0@smedley.id.au>
 <list-11700553@2rosenthals.com> <list-11700589@2rosenthals.com>
 <list-11700591@2rosenthals.com> <list-11700620@2rosenthals.com>
Content-Language: en-US
In-Reply-To: <list-11700620@2rosenthals.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hey Lewis,

On 4/1/25 07:37, Lewis G Rosenthal wrote:
> On 01/03/25 03:49 pm, Paul Smedley wrote:
>> Hey again,
>>
>> On 4/1/25 07:17, Lewis G Rosenthal wrote:
>>> Hi...
>>>
>>> On 01/03/25 03:21 pm, Paul Smedley wrote:
>>>> Hi Again,
>>>>
>>>> On 4/1/25 06:38, Paul Smedley wrote:
>>>>> Hey Lewis,
>>>>>
>>>>> On 4/1/25 04:24, Lewis G Rosenthal wrote:
>>>>>> Trying to build 8.11.1 (latest), I didn't get very far (nothing 
>>>>>> useful). Before I dive into it, I was just wondering if anyone 
>>>>>> else had had any greater success. 7.75.0 seems quite outdated for 
>>>>>> something with security implications.
>>>>>>
>>>>> I got configure to run, let's see if I get a curl.exe
>>>>>
>>>> Untested.... https://smedley.id.au/tmp/curl-8.11.1-os2-20250104.zip
>>>>
>>>
>>> :-D
>>>
>>> Somehow, every time I ask a question here, someone actually does the 
>>> work for me. The upside is I get what I want, but the downside is 
>>> that my own skills don't get any better. LOL
>>>
>>> Thanks, Paul. I'll give this a whirl right now and see what we get.
>>>
>> If you prefer... https://smedley.id.au/curl-8.11.1-os2-20250104b.zip 
>> has a curl4.dll rather than being statically linked, so should be 
>> able to be used with other apps.
>>
>
> Hmmm... Neither package seems to have an exe, however.

<sigh> there was definitely an exe when I built it, make install just 
decided not to copy it over I guess.

https://smedley.id.au/curl-8.11.1-os2-20250104b.zip is refreshed now.

>
>> What issues were you having building it?
>>
>
> Perhaps the setup is not what I'm getting. Seeing configure.ac in the 
> root of the source tree, I ran autoconf, first. This got me:
>
> # autoconf
> configure.ac:24: error: possibly undefined macro: dnl
>       If this token and others are legitimate, please use 
> m4_pattern_allow.
>       See the Autoconf documentation.
> configure.ac:43: error: possibly undefined macro: AM_MAINTAINER_MODE
> configure.ac:47: error: possibly undefined macro: AM_CONDITIONAL
> configure.ac:73: error: possibly undefined macro: AC_MSG_ERROR
> configure.ac:97: error: possibly undefined macro: AC_MSG_RESULT
> configure.ac:617: error: possibly undefined macro: AM_COND_IF
> configure.ac:677: error: possibly undefined macro: AC_DEFINE
>
> Not taking the time to research any of that, I forged ahead, now that 
> I had a configure script, I forged ahead, without any options:
>
> # ./configure
> ./configure: 2743: ./configure: XC_OVR_ZZ50: not found
> ./configure: 2744: ./configure: XC_OVR_ZZ60: not found
> ./configure: 2745: ./configure: CURL_OVERRIDE_AUTOCONF: not found
> ./configure: 2753: ./configure: AM_MAINTAINER_MODE: not found
> ./configure: 2756: ./configure: CURL_CHECK_OPTION_DEBUG: not found
> ./configure: 2757: ./configure: Syntax error: word unexpected 
> (expecting ")")
>
> At that point, I figured I'd ask if there was a newer build available. 
> :-)
>
> I guess I could disable some stuff to get this working. I just haven't 
> taken the time to look any further (yet).
>
My first build was with stock configure from the tar.xz

I then re-ran autotools... (man I have autotools)

aclocal

autoheader

automake

libtoolize --force

autoconf

and re-ran configure to get the DLL.