diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2021-06-01 16:24:00 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-06-07 08:14:25 +0200 |
| commit | 265b14d6b37c4298bd5556fabcbc37d36f911693 (patch) | |
| tree | 3c7ca96bc1ce2e859bfaa71a0d6afcad56c9f9f7 /.github | |
| parent | 9cf516adc67b67388e22bb8c33cb3fabd68f2ac6 (diff) | |
| download | curl-265b14d6b37c4298bd5556fabcbc37d36f911693.tar.gz | |
metalink: remove
Warning: this will make existing curl command lines that use metalink to
stop working.
Reasons for removal:
1. We've found several security problems and issues involving the
metalink support in curl. The issues are not detailed here. When
working on those, it become apparent to the team that several of the
problems are due to the system design, metalink library API and what
the metalink RFC says. They are very hard to fix on the curl side
only.
2. The metalink usage with curl was only very briefly documented and was
not following the "normal" curl usage pattern in several ways, making
it surprising and non-intuitive which could lead to further security
issues.
3. The metalink library was last updated 6 years ago and wasn't so
active the years before that either. An unmaintained library means
there's a security problem waiting to happen. This is probably reason
enough.
4. Metalink requires an XML parsing library, which is complex code (even
the smaller alternatives) and to this day often gets security
updates.
5. Metalink is not a widely used curl feature. In the 2020 curl user
survey, only 1.4% of the responders said that they'd are using it. In
2021 that number was 1.2%. Searching the web also show very few
traces of it being used, even with other tools.
6. The torrent format and associated technology clearly won for
downloading large files from multiple sources in parallel.
Cloes #7176
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/macos.yml | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml index 368ff0401..116d14da2 100644 --- a/.github/workflows/macos.yml +++ b/.github/workflows/macos.yml @@ -38,19 +38,19 @@ jobs: macosx-version-min: 10.9 - name: HTTP only install: nghttp2 - configure: --enable-debug --enable-maintainer-mode --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets --disable-shared --without-brotli --without-gssapi --without-libidn2 --without-libmetalink --without-libpsl --without-librtmp --without-libssh2 --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib + configure: --enable-debug --enable-maintainer-mode --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets --disable-shared --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib macosx-version-min: 10.15 - - name: SecureTransport metalink - install: nghttp2 libmetalink - configure: --enable-debug --with-secure-transport --with-libmetalink + - name: SecureTransport http2 + install: nghttp2 + configure: --enable-debug --with-secure-transport macosx-version-min: 10.8 - - name: OpenSSL metalink - install: nghttp2 openssl libmetalink - configure: --enable-debug --with-openssl=/usr/local/opt/openssl --with-libmetalink + - name: OpenSSL http2 + install: nghttp2 openssl + configure: --enable-debug --with-openssl=/usr/local/opt/openssl macosx-version-min: 10.9 - - name: LibreSSL metalink - install: nghttp2 libressl libmetalink - configure: --enable-debug --with-openssl=/usr/local/opt/libressl --with-libmetalink + - name: LibreSSL http2 + install: nghttp2 libressl + configure: --enable-debug --with-openssl=/usr/local/opt/libressl macosx-version-min: 10.9 - name: torture install: nghttp2 openssl @@ -63,7 +63,7 @@ jobs: tflags: -n -t --shallow=20 FTP macosx-version-min: 10.9 - name: macOS 10.15 - install: nghttp2 libmetalink libssh2 openssl + install: nghttp2 libssh2 openssl configure: --enable-debug --disable-ldap --with-openssl=/usr/local/opt/openssl macosx-version-min: 10.15 steps: |