appveyor.sh: move/rebase patch from appveyor.yml

CI: enable parallel testing in CI builds
The test-ci target now uses 2 processes by default, but the amount of parallelism is tuned for each CI service and build environment based on results of a number of test runs. Some CI services use super- oversubscribed build machines that can barely run the curl tests already with no parallelism without frequently failing with timing-induced failures. These continue to be run without parallelism. Other services provide two fast, unloaded cores and these run with 14 processes, which is a good default for this kind of environment. Here's a summary of the number of test processes by CI service: Appveyor - 2 (Windows MSVC), 1 (others) Azure - 2 Circle CI - 14 Cirrus - 28 (macOS), 14 (Linux), 7 (FreeBSD), 5 (macOS torture), 2 (Windows) GitHub Actions - 3 (macOS), 2 (Linux) Some of these are a bit conservative to keep timing-induced flakiness down. The net result is that the first test results should arrive only 3 minutes after a commit submission. Already merged via separate commits: - 2a7c8b27fd #14171 - 72341068a2 - efce544418 #14244 - c6cf411bac Ref: #10818 Closes #11510
2024-08-03 15:56:56 +02:00 · 2024-08-03 15:56:56 +02:00
2087 changed files with 53270 additions and 69493 deletions
--- a/.azure-pipelines.yml
+++ b/.azure-pipelines.yml
@ -0,0 +1,247 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# https://dev.azure.com/daniel0244/curl/_build?view=runs
+#
+# Azure Pipelines configuration:
+# https://aka.ms/yaml
+
+trigger:
+  branches:
+    include:
+      - 'master'
+      - '*/ci'
+  paths:
+    exclude:
+      - '.circleci/*'
+      - '.github/*'
+      - '.github/workflows/*'
+      - 'appveyor.*'
+      - 'packages/*'
+      - 'plan9/*'
+
+pr:
+  branches:
+    include:
+      - 'master'
+  paths:
+    exclude:
+      - '.circleci/*'
+      - '.github/*'
+      - '.github/workflows/*'
+      - 'appveyor.*'
+      - 'packages/*'
+      - 'plan9/*'
+
+variables:
+  MAKEFLAGS: '-j 2'
+
+stages:
+
+  ##########################################
+  ### Linux jobs first
+  ##########################################
+
+  - stage: linux
+    dependsOn: []
+    jobs:
+      - job: ubuntu
+        # define defaults to make sure variables are always expanded/replaced
+        variables:
+          install: ''
+          configure: ''
+          tests: '!433'
+        timeoutInMinutes: 60
+        pool:
+          vmImage: 'ubuntu-latest'
+        strategy:
+          matrix:
+            default:
+              name: default
+              install:
+              configure: --enable-debug --with-openssl
+            disable_ipv6:
+              name: w/o IPv6
+              configure: --disable-ipv6 --with-openssl
+            disable_http_smtp_imap:
+              name: w/o HTTP/SMTP/IMAP
+              configure: --disable-http --disable-smtp --disable-imap --without-ssl
+            disable_threadres:
+              name: sync resolver
+              configure: --disable-threaded-resolver --with-openssl
+            https_only:
+              name: HTTPS only
+              configure: --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --with-openssl
+            torture:
+              name: torture
+              install: libnghttp2-dev
+              configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl
+              tests: -n -t --shallow=25 !FTP
+        steps:
+          - script: sudo apt-get update && sudo apt-get install -y stunnel4 python3-impacket libzstd-dev libbrotli-dev libpsl-dev $(install)
+            displayName: 'apt install'
+            retryCountOnTaskFailure: 3
+
+          - script: autoreconf -fi && ./configure --disable-dependency-tracking --enable-warnings --enable-werror $(configure)
+            displayName: 'configure $(name)'
+
+          - script: make V=1 && make V=1 examples && cd tests && make V=1
+            displayName: 'compile'
+
+          - script: make V=1 test-ci
+            displayName: 'test'
+            env:
+              AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
+              TFLAGS: "-ac /usr/bin/curl -r $(tests)"
+
+  - stage: scanbuild
+    dependsOn: []
+    jobs:
+      - job: ubuntu
+        timeoutInMinutes: 30
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - script: sudo apt-get update && sudo apt-get install -y clang-tools clang libssl-dev libssh2-1-dev libpsl-dev libbrotli-dev libzstd-dev
+            displayName: 'apt install'
+            retryCountOnTaskFailure: 3
+
+          - script: autoreconf -fi
+            displayName: 'autoreconf'
+
+          - script: scan-build ./configure --disable-dependency-tracking --enable-debug --enable-werror --with-openssl --with-libssh2
+            displayName: 'configure'
+            env:
+              CC: "clang"
+              CCX: "clang++"
+
+          - script: scan-build --status-bugs make
+            displayName: 'make'
+
+          - script: scan-build --status-bugs make examples
+            displayName: 'make examples'
+
+  ##########################################
+  ### Windows jobs below
+  ##########################################
+
+  - stage: windows
+    dependsOn: []
+    variables:
+      agent.preferPowerShellOnContainers: true
+    jobs:
+      - job: msys2
+        # define defaults to make sure variables are always expanded/replaced
+        variables:
+          container_img: ''
+          container_cmd: ''
+          configure: ''
+          tests: ''
+        timeoutInMinutes: 120
+        pool:
+          vmImage: 'windows-2019'
+        strategy:
+          matrix:
+            mingw32_openssl:
+              name: 32-bit OpenSSL/libssh2
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2
+              configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32     --prefix=/mingw32 --enable-debug --enable-werror --with-libssh2 --with-openssl --without-libpsl
+              tests: "~571"
+            mingw64_openssl:
+              name: 64-bit OpenSSL/libssh2
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2
+              configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh2 --with-openssl --without-libpsl
+              tests: "~571"
+            mingw64_libssh:
+              name: 64-bit OpenSSL/libssh
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              prepare: pacman -S --needed --noconfirm --noprogressbar libssh-devel mingw-w64-x86_64-libssh
+              configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh --with-openssl --without-libpsl
+              tests: "~571 ~614"
+            mingw32:
+              name: 32-bit w/o zlib
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32     --prefix=/mingw32 --enable-debug --enable-werror --without-zlib --without-ssl --without-libpsl
+              tests: "!203 !1143"
+            mingw64:
+              name: 64-bit w/o zlib
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --without-zlib --without-ssl --without-libpsl
+              tests: "!203 !1143"
+            mingw32_schannel:
+              name: 32-bit Schannel/SSPI/WinIDN/libssh2
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2
+              configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32     --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2 --without-libpsl
+              tests: "~571"
+            mingw64_schannel:
+              name: 64-bit Schannel/SSPI/WinIDN/libssh2
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2
+              configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2 --without-libpsl
+              tests: "~571"
+            mingw32_schannel_nozlib:
+              name: 32-bit Schannel/SSPI/WinIDN w/o zlib
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32     --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib --without-libpsl
+              tests: "!203 !1143"
+            mingw64_schannel_nozlib:
+              name: 64-bit Schannel/SSPI/WinIDN w/o zlib
+              container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+              container_cmd: C:\msys64\usr\bin\sh
+              configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib --without-libpsl
+              tests: "!203 !1143"
+        container:
+          image: $(container_img)
+          env:
+            MSYS2_PATH_TYPE: inherit
+        steps:
+          - script: $(container_cmd) -l -c "cd $(echo '%cd%') && $(prepare)"
+            displayName: 'prepare'
+            condition: variables.prepare
+            retryCountOnTaskFailure: 3
+
+          - script: $(container_cmd) -l -c "cd $(echo '%cd%') && autoreconf -fi && ./configure --disable-dependency-tracking $(configure)"
+            displayName: 'configure $(name)'
+
+          - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 && make V=1 examples && cd tests && make V=1"
+            displayName: 'compile'
+
+          - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 install && PATH=/usr/bin:/bin find . -type f -path '*/.libs/*.exe' -print -execdir mv -t .. {} \;"
+            displayName: 'install'
+
+          - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 test-ci"
+            displayName: 'test'
+            env:
+              AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
+              TFLAGS: "-ac /usr/bin/curl.exe !IDN !SCP ~612 $(tests)"
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -28,6 +28,30 @@
 version: 2.1

 commands:
+  configure:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-warnings --enable-werror --with-openssl \
+              || { tail -1000 config.log; false; }
+
+  configure-openssl-no-verbose:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --disable-verbose --enable-werror --with-openssl \
+              || { tail -1000 config.log; false; }
+
+  configure-no-proxy:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --disable-proxy --enable-werror --with-openssl \
+              || { tail -1000 config.log; false; }
+
  install-cares:
    steps:
      - run:
@ -47,77 +71,46 @@ commands:
            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip libpsl-dev
            sudo python3 -m pip install impacket

+  configure-libssh:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-warnings --enable-werror --with-openssl --with-libssh \
+              || { tail -1000 config.log; false; }
+
  install-wolfssl:
    steps:
      - run:
          command: |
-            # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-            WOLFSSL_VER=5.7.6
+            source .github/scripts/VERSIONS
            echo "Installing wolfSSL $WOLFSSL_VER"
            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
            tar -xzf v$WOLFSSL_VER-stable.tar.gz
            cd wolfssl-$WOLFSSL_VER-stable
            ./autogen.sh
-            ./configure --disable-dependency-tracking --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
+            ./configure --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
            make install

  install-wolfssh:
    steps:
      - run:
          command: |
-            # renovate: datasource=github-tags depName=wolfSSL/wolfssh versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-            WOLFSSH_VER=1.4.19
+            source .github/scripts/VERSIONS
            echo "Installing wolfSSH $WOLFSSH_VER"
            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssh/archive/v$WOLFSSH_VER-stable.tar.gz
            tar -xzf v$WOLFSSH_VER-stable.tar.gz
            cd wolfssh-$WOLFSSH_VER-stable
            ./autogen.sh
-            ./configure --disable-dependency-tracking --with-wolfssl=$HOME/wssl --prefix=$HOME/wssh --enable-scp --enable-sftp --disable-term --disable-examples
+            ./configure --with-wolfssl=$HOME/wssl --prefix=$HOME/wssh --enable-scp --enable-sftp --disable-examples
            make install

-  configure:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-openssl \
-              || { tail -1000 config.log; false; }
-
-  configure-openssl-no-verbose:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror \
-              --with-openssl --disable-verbose \
-              || { tail -1000 config.log; false; }
-
-  configure-no-proxy:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror \
-              --with-openssl --disable-proxy \
-              || { tail -1000 config.log; false; }
-
-  configure-libssh:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-openssl --with-libssh \
-              || { tail -1000 config.log; false; }
-
  configure-cares:
    steps:
      - run:
          command: |
            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-openssl --enable-ares \
+            ./configure --enable-warnings --enable-werror --with-openssl --enable-ares \
              || { tail -1000 config.log; false; }

  configure-wolfssh:
@ -125,9 +118,7 @@ commands:
      - run:
          command: |
            autoreconf -fi
-            LDFLAGS="-Wl,-rpath,$HOME/wssh/lib" \
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-wolfssl=$HOME/wssl --with-wolfssh=$HOME/wssh \
+            LDFLAGS="-Wl,-rpath,$HOME/wssh/lib" ./configure --enable-warnings --enable-werror --with-wolfssl=$HOME/wssl --with-wolfssh=$HOME/wssh \
              || { tail -1000 config.log; false; }

  configure-cares-debug:
@ -135,8 +126,7 @@ commands:
      - run:
          command: |
            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-debug \
-              --with-openssl --enable-ares \
+            ./configure --enable-debug --enable-werror --with-openssl --enable-ares \
              || { tail -1000 config.log; false; }

  build:
--- a/.dcignore
+++ b/.dcignore
@ -0,0 +1,7 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+tests/**
+docs/**
+docs/examples/**
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@ -26,4 +26,4 @@ Send your suggestions using one of these methods:

 3. as an [issue](https://github.com/curl/curl/issues)

-/ The curl team
+/ The curl team!
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -4,7 +4,7 @@

 version: 2
 updates:
-  - package-ecosystem: 'github-actions'
-    directory: '/'
+  - package-ecosystem: "github-actions"
+    directory: "/"
    schedule:
-      interval: 'weekly'
+      interval: "weekly"
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -15,77 +15,34 @@
 # something else (e.g. CI if the PR also touches CI jobs).
 #
 # N.B. any-glob-to-all-files is misnamed; it acts like one-glob-to-all-files.
-# Therefore, to get any-glob-to-all-files semantics with multiple matching
-# patterns, they must be joined with commas to a single string surrounded by
-# braces. For example: '{lib/**,src/**}'.
+# Therefore, to get any-glob-to-all-files semantics, there must be a single glob
+# with all matching patterns within braces.
 #
 # See https://github.com/actions/labeler/ for documentation on this file.
---

 appleOS:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              .github/workflows/macos.yml,\
-              lib/config-mac.h,\
-              lib/macos*,\
-              lib/vtls/sectransp*,\
-              m4/curl-sectransp.m4\
-              }"
+          - any-glob-to-all-files:
+              - '{.github/workflows/macos.yml,lib/config-mac.h,lib/macos*,lib/vtls/sectransp*,m4/curl-sectransp.m4}'

 authentication:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/mk-ca-bundle.1,\
-              docs/libcurl/opts/CURLINFO_HTTPAUTH*,\
-              docs/libcurl/opts/CURLINFO_PROXYAUTH*,\
-              docs/libcurl/opts/CURLOPT_KRB*,\
-              docs/libcurl/opts/CURLOPT_SASL*,\
-              docs/libcurl/opts/CURLOPT_SERVICE_NAME*,\
-              docs/libcurl/opts/CURLOPT_USERNAME*,\
-              docs/libcurl/opts/CURLOPT_USERPWD*,\
-              docs/libcurl/opts/CURLOPT_XOAUTH*,\
-              lib/*gssapi*,\
-              lib/*krb5*,\
-              lib/*ntlm*,\
-              lib/curl_sasl.*,\
-              lib/http_aws*,\
-              lib/http_digest.*,\
-              lib/http_negotiate.*,\
-              lib/vauth/**\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/mk-ca-bundle.1,docs/libcurl/opts/CURLINFO_HTTPAUTH*,docs/libcurl/opts/CURLINFO_PROXYAUTH*,docs/libcurl/opts/CURLOPT_KRB*,docs/libcurl/opts/CURLOPT_SASL*,docs/libcurl/opts/CURLOPT_SERVICE_NAME*,docs/libcurl/opts/CURLOPT_USERNAME*,docs/libcurl/opts/CURLOPT_USERPWD*,docs/libcurl/opts/CURLOPT_XOAUTH*,lib/*gssapi*,lib/*krb5*,lib/*ntlm*,lib/curl_sasl.*,lib/http_aws*,lib/http_digest.*,lib/http_negotiate.*,lib/vauth/**,tests/server/fake_ntlm.c}'

 build:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              **/CMakeLists.txt,\
-              **/Makefile.am,\
-              **/Makefile.inc,\
-              **/*.m4,\
-              **/*.mk,\
-              *.m4,\
-              docs/INSTALL-CMAKE.md,\
-              lib/curl_config.h.cmake,\
-              lib/libcurl*.in,\
-              CMake/**,\
-              CMakeLists.txt,\
-              configure.ac,\
-              m4/**,\
-              Makefile.*,\
-              packages/**,\
-              plan9/**,\
-              projects/**,\
-              winbuild/**,\
-              lib/libcurl.def,\
-              tests/cmake/**\
-              }"
+          - any-glob-to-all-files:
+              - '{**/CMakeLists.txt,**/Makefile.am,**/Makefile.inc,**/Makefile.mk,**/*.m4,**/*.mk,*.m4,docs/INSTALL.cmake,lib/curl_config.h.cmake,lib/libcurl*.in,CMake/**,CMakeLists.txt,configure.ac,m4/**,Makefile.*,packages/**,plan9/**,projects/**,winbuild/**,libcurl.def}'

 CI:
  - all:
      - changed-files:
          - any-glob-to-any-file:
+              - '.azure-pipelines.yml'
              - '.circleci/**'
              - '.github/**'
              - 'appveyor.*'
@ -97,13 +54,8 @@ CI:
 cmake:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              **/CMakeLists.txt,\
-              CMake/**,\
-              docs/INSTALL-CMAKE.md,\
-              lib/curl_config.h.cmake,\
-              tests/cmake/**\
-              }"
+          - any-glob-to-all-files:
+              - '{**/CMakeLists.txt,CMake/**,docs/INSTALL.cmake,lib/curl_config.h.cmake}'

 cmdline tool:
  - all:
@ -115,93 +67,32 @@ cmdline tool:
 connecting & proxies:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/internals/CONNECTION-FILTERS.md,\
-              docs/examples/ipv6.c,\
-              docs/libcurl/opts/CURLINFO_CONNECT*,\
-              docs/libcurl/opts/CURLINFO_PROXY*,\
-              docs/libcurl/opts/CURLOPT_ADDRESS*,\
-              docs/libcurl/opts/CURLOPT_CONNECT*,\
-              docs/libcurl/opts/CURLOPT_HAPROXY*,\
-              docs/libcurl/opts/CURLOPT_OPENSOCKET*,\
-              docs/libcurl/opts/CURLOPT_PRE_PROXY*,\
-              docs/libcurl/opts/CURLOPT_PROXY*,\
-              docs/libcurl/opts/CURLOPT_SOCKOPT*,\
-              docs/libcurl/opts/CURLOPT_SOCKS*,\
-              docs/libcurl/opts/CURLOPT_TCP*,\
-              docs/libcurl/opts/CURLOPT_TIMEOUT*,\
-              lib/cf-*proxy.*,\
-              lib/cf-socket.*,\
-              lib/cfilters.*,\
-              lib/conncache.*,\
-              lib/connect.*,\
-              lib/http_proxy.*,\
-              lib/if2ip.*,\
-              lib/noproxy.*,\
-              lib/socks.*,\
-              tests/server/socksd.c\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/CONNECTION-FILTERS.md,docs/examples/ipv6.c,docs/libcurl/opts/CURLINFO_CONNECT*,docs/libcurl/opts/CURLINFO_PROXY*,docs/libcurl/opts/CURLOPT_ADDRESS*,docs/libcurl/opts/CURLOPT_CONNECT*,docs/libcurl/opts/CURLOPT_HAPROXY*,docs/libcurl/opts/CURLOPT_OPENSOCKET*,docs/libcurl/opts/CURLOPT_PRE_PROXY*,docs/libcurl/opts/CURLOPT_PROXY*,docs/libcurl/opts/CURLOPT_SOCKOPT*,docs/libcurl/opts/CURLOPT_SOCKS*,docs/libcurl/opts/CURLOPT_TCP*,docs/libcurl/opts/CURLOPT_TIMEOUT*,lib/cf-*proxy.*,lib/cf-socket.*,lib/cfilters.*,lib/conncache.*,lib/connect.*,lib/http_proxy.*,lib/if2ip.*,lib/noproxy.*,lib/socks.*,tests/server/socksd.c}'

 cookies:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/HTTP-COOKIES.md,\
-              docs/cmdline-opts/cookie*,\
-              docs/cmdline-opts/junk-session-cookies.md,\
-              docs/libcurl/opts/CURLINFO_COOKIE*,\
-              docs/libcurl/opts/CURLOPT_COOKIE*,\
-              docs/examples/cookie_interface.c,\
-              lib/cookie.*,\
-              lib/psl.*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/HTTP-COOKIES.md,docs/cmdline-opts/cookie*,docs/cmdline-opts/junk-session-cookies.md,docs/libcurl/opts/CURLINFO_COOKIE*,docs/libcurl/opts/CURLOPT_COOKIE*,docs/examples/cookie_interface.c,lib/cookie.*,lib/psl.*}'

 cryptography:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/CIPHERS.md,\
-              docs/RUSTLS.md,\
-              docs/libcurl/opts/CURLOPT_EGDSOCKET*,\
-              lib/*sha256*,\
-              lib/*sha512*,\
-              lib/curl_des.*,\
-              lib/curl_hmac.*,\
-              lib/curl_md?.*,\
-              lib/md?.*,\
-              lib/rand.*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/CIPHERS.md,docs/RUSTLS.md,docs/libcurl/opts/CURLOPT_EGDSOCKET*,lib/*sha256*,lib/*sha512*,lib/curl_des.*,lib/curl_hmac.*,lib/curl_md?.*,lib/md?.*,lib/rand.*}'

 DICT:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/dict.*,\
-              tests/dictserver.py\
-              }"
+          - any-glob-to-all-files:
+              - '{lib/dict.*,tests/dictserver.py}'

 documentation:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              .github/workflows/checkdocs.yml,\
-              .github/scripts/badwords.*,\
-              .github/scripts/cd2cd,\
-              .github/scripts/cd2nroff,\
-              .github/scripts/cdall.pl,\
-              .github/scripts/nroff2cd,\
-              .github/scripts/verify-examples.pl,\
-              .github/scripts/verify-synopsis.pl,\
-              **/*.md,\
-              **/*.txt,\
-              **/*.1,\
-              CHANGES.md,\
-              docs/**,\
-              LICENSES/**,\
-              README,\
-              RELEASE-NOTES,\
-              scripts/cd*\
-              }"
+          - any-glob-to-all-files:
+              - '{.github/workflows/badwords.yml,.github/workflows/man-examples.yml,.github/workflows/synopsis.yml,.github/scripts/badwords.*,.github/scripts/cd2cd,.github/scripts/cd2nroff,.github/scripts/cdall.pl,.github/scripts/nroff2cd,.github/scripts/verify-examples.pl,.github/scripts/verify-synopsis.pl,**/*.md,**/*.txt,**/*.1,CHANGES.md,docs/**,LICENSES/**,README,RELEASE-NOTES,scripts/cd*}'
          - all-globs-to-all-files:
              # negative matches
              - '!**/CMakeLists.txt'
@ -210,104 +101,50 @@ documentation:
 FTP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/opts/CURLINFO_FTP*,\
-              docs/libcurl/opts/CURLOPT_FTP*,\
-              docs/libcurl/opts/CURLOPT_WILDCARDMATCH*,\
-              docs/examples/ftp*,\
-              lib/curl_fnmatch.*,\
-              lib/curl_range.*,\
-              lib/ftp*,\
-              tests/ftp*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/libcurl/opts/CURLINFO_FTP*,docs/libcurl/opts/CURLOPT_FTP*,docs/libcurl/opts/CURLOPT_WILDCARDMATCH*,docs/examples/ftp*,lib/curl_fnmatch.*,lib/curl_range.*,lib/ftp*,tests/ftp*'

 GOPHER:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/gopher*\
-              }"
+          - any-glob-to-all-files:
+              - 'lib/gopher*'

 HTTP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/hsts*,\
-              docs/examples/http-*,\
-              docs/examples/httpput*,\
-              docs/examples/https*,\
-              docs/examples/*post*,\
-              docs/HTTP-COOKIES.md,\
-              docs/libcurl/opts/CURLINFO_COOKIE*,\
-              docs/libcurl/opts/CURLOPT_COOKIE*,\
-              docs/libcurl/opts/CURLINFO_HTTP_**,\
-              docs/libcurl/opts/CURLINFO_REDIRECT*,\
-              docs/libcurl/opts/CURLINFO_REFER*,\
-              docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*,\
-              docs/libcurl/opts/CURLOPT_HSTS*,\
-              docs/libcurl/opts/CURLOPT_HTTP*,\
-              docs/libcurl/opts/CURLOPT_POST.*,\
-              docs/libcurl/opts/CURLOPT_POSTFIELD*,\
-              docs/libcurl/opts/CURLOPT_POSTREDIR*,\
-              docs/libcurl/opts/CURLOPT_REDIR*,\
-              docs/libcurl/opts/CURLOPT_REFER*,\
-              docs/libcurl/opts/CURLOPT_TRAILER*,\
-              docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*,\
-              lib/cf-https*,\
-              lib/cf-h1*,\
-              lib/cf-h2*,\
-              lib/cookie.*,\
-              lib/hsts.*,\
-              lib/http*,\
-              tests/http*,\
-              tests/http-server.pl,\
-              tests/http/*,\
-              tests/nghttp*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/examples/hsts*,docs/examples/http-*,docs/examples/httpput*,docs/examples/https*,docs/examples/*post*,docs/HSTS.md,docs/HTTP-COOKIES.md,docs/libcurl/opts/CURLINFO_COOKIE*,docs/libcurl/opts/CURLOPT_COOKIE*,docs/libcurl/opts/CURLINFO_HTTP_**,docs/libcurl/opts/CURLINFO_REDIRECT*,docs/libcurl/opts/CURLINFO_REFER*,docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*,docs/libcurl/opts/CURLOPT_HSTS*,docs/libcurl/opts/CURLOPT_HTTP*,docs/libcurl/opts/CURLOPT_POST.*,docs/libcurl/opts/CURLOPT_POSTFIELD*,docs/libcurl/opts/CURLOPT_POSTREDIR*,docs/libcurl/opts/CURLOPT_REDIR*,docs/libcurl/opts/CURLOPT_REFER*,docs/libcurl/opts/CURLOPT_TRAILER*,docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*,lib/cf-https*,lib/cf-h1*,lib/cf-h2*,lib/cookie.*,lib/hsts.*,lib/http*,tests/http*,tests/http-server.pl,tests/http/*,tests/nghttp*}'

 HTTP/2:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindNGHTTP2.cmake,\
-              CMake/FindQuiche.cmake,\
-              docs/libcurl/opts/CURLOPT_STREAM*,\
-              docs/examples/http2*,\
-              lib/http2*,\
-              tests/http2-server.pl\
-              }"
+          - any-glob-to-all-files:
+              - '{CMake/FindNGHTTP2.cmake,CMake/FindQUICHE.cmake,docs/HTTP2.md,docs/libcurl/opts/CURLOPT_STREAM*,docs/examples/http2*,lib/http2*,tests/http2-server.pl}'

 HTTP/3:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              .github/workflows/ngtcp2*,\
-              .github/workflows/quiche*,\
-              .github/workflows/osslq*,\
-              CMake/FindMSH3.cmake,\
-              CMake/FindNGHTTP3.cmake,\
-              CMake/FindNGTCP2.cmake,\
-              docs/HTTP3.md,\
-              docs/examples/http3*,\
-              lib/vquic/**,\
-              tests/http3-server.pl,\
-              tests/nghttpx.conf\
-              }"
+          - any-glob-to-all-files:
+              - '{.github/workflows/ngtcp2*,.github/workflows/quiche*,.github/workflows/osslq*,CMake/FindMSH3.cmake,CMake/FindNGHTTP3.cmake,CMake/FindNGTCP2.cmake,docs/HTTP3.md,docs/examples/http3*,lib/vquic/**,tests/http3-server.pl,tests/nghttpx.conf}'
+
+Hyper:
+  - all:
+      - changed-files:
+          - any-glob-to-all-files:
+              - '{docs/HYPER.md,lib/c-hyper.*}'

 IMAP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/imap*,\
-              docs/examples/imap*\
-              }"
+          - any-glob-to-all-files:
+              - '{lib/imap*,docs/examples/imap*}'

 LDAP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/*ldap*\
-              }"
+          - any-glob-to-all-files:
+              - 'lib/*ldap*'

 libcurl API:
  - all:
@ -320,121 +157,68 @@ libcurl API:
 logging:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/cmdline-opts/trace*,\
-              docs/libcurl/curl_global_trace*,\
-              lib/curl_trc*,\
-              tests/http/test_15_tracing.py\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/cmdline-opts/trace*,docs/libcurl/curl_global_trace*,lib/curl_trc*,tests/http/test_15_tracing.py}'

 MIME:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/curl_form*,\
-              docs/libcurl/curl_mime_*,\
-              docs/libcurl/opts/CURLOPT_MIME*,\
-              docs/libcurl/opts/CURLOPT_HTTPPOST*,\
-              lib/formdata*,\
-              lib/mime*,\
-              src/tool_formparse.*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/libcurl/curl_form*,docs/libcurl/curl_mime_*,docs/libcurl/opts/CURLOPT_MIME*,docs/libcurl/opts/CURLOPT_HTTPPOST*,lib/formdata*,lib/mime*,src/tool_formparse.*}'

 MQTT:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/mqtt*,\
-              tests/server/mqttd.c\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/MQTT.md,lib/mqtt*,tests/server/mqttd.c}'

 name lookup:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/resolve.c,\
-              docs/libcurl/opts/CURLINFO_NAMELOOKUP*,\
-              docs/libcurl/opts/CURLOPT_DNS*,\
-              docs/libcurl/opts/CURLOPT_DOH*,\
-              docs/libcurl/opts/CURLOPT_RESOLVE*,\
-              lib/asyn*,\
-              lib/curl_gethostname.*,\
-              lib/doh*,\
-              lib/host*,\
-              lib/idn*,\
-              lib/inet_pton.*,\
-              lib/socketpair*,\
-              tests/server/resolve.c\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/examples/resolve.c,docs/libcurl/opts/CURLINFO_NAMELOOKUP*,docs/libcurl/opts/CURLOPT_DNS*,docs/libcurl/opts/CURLOPT_DOH*,docs/libcurl/opts/CURLOPT_RESOLVE*,lib/asyn*,lib/curl_gethostname.*,lib/doh*,lib/host*,lib/idn*,lib/inet_pton.*,lib/socketpair*,tests/server/resolve.c}'

 POP3:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/pop3*,\
-              lib/pop3.*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/examples/pop3*,lib/pop3.*}'

 RTMP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindLibrtmp.cmake,\
-              lib/curl_rtmp.*\
-              }"
+          - any-glob-to-all-files:
+              - 'lib/curl_rtmp.*'

 RTSP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/opts/CURLINFO_RTSP*,\
-              docs/libcurl/opts/CURLOPT_RTSP*,\
-              lib/rtsp.*,\
-              tests/rtspserver.pl,\
-              tests/server/rtspd.c\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/libcurl/opts/CURLINFO_RTSP*,docs/libcurl/opts/CURLOPT_RTSP*,lib/rtsp.*,tests/rtspserver.pl,tests/server/rtspd.c}'

 SCP/SFTP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindLibssh2.cmake,\
-              docs/libcurl/opts/CURLOPT_SSH*,\
-              docs/examples/sftp*,\
-              lib/vssh/**,\
-              tests/sshhelp.pm,\
-              tests/sshserver.pl\
-              }"
+          - any-glob-to-all-files:
+              - '{CMake/FindLibSSH2.cmake,docs/libcurl/opts/CURLOPT_SSH*,docs/examples/sftp*,lib/vssh/**,tests/sshhelp.pm,tests/sshserver.pl}'

 script:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              **/*.pl,\
-              **/*.sh,\
-              curl-config.in,\
-              docs/curl-config.1,\
-              docs/mk-ca-bundle.1,\
-              docs/THANKS-filter,\
-              scripts/**\
-              }"
+          - any-glob-to-all-files:
+              - '{**/*.pl,**/*.sh,curl-config.in,docs/curl-config.1,docs/mk-ca-bundle.1,docs/THANKS-filter,scripts/**}'

 SMB:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/smb.*,\
-              tests/smbserver.py\
-              }"
+          - any-glob-to-all-files:
+              - '{lib/smb.*,tests/smbserver.py}'

 SMTP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/smtp-*,\
-              docs/libcurl/opts/CURLOPT_MAIL*,\
-              lib/smtp.*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/examples/smtp-*,docs/libcurl/opts/CURLOPT_MAIL*,lib/smtp.*}'

 tests:
  - all:
@ -445,87 +229,29 @@ tests:
 TFTP:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/tftp.*,\
-              tests/tftpserver.pl,\
-              tests/server/tftp*\
-              }"
+          - any-glob-to-all-files:
+              - '{lib/tftp.*,tests/tftpserver.pl,tests/server/tftp*}'

 TLS:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindBearSSL.cmake,\
-              CMake/FindMbedTLS.cmake,\
-              CMake/FindWolfSSL.cmake,\
-              CMake/FindRustls.cmake,\
-              docs/examples/ssl*,\
-              docs/examples/*ssl.*,\
-              docs/examples/*tls.*,\
-              docs/SSL*,\
-              docs/libcurl/curl_global_sslset*,\
-              docs/libcurl/opts/CURLINFO_CA*,\
-              docs/libcurl/opts/CURLINFO_CERT*,\
-              docs/libcurl/opts/CURLINFO_SSL*,\
-              docs/libcurl/opts/CURLINFO_TLS*,\
-              docs/libcurl/opts/CURLOPT_CA*,\
-              docs/libcurl/opts/CURLOPT_CERT*,\
-              docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*,\
-              docs/libcurl/opts/CURLOPT_SSL*,\
-              docs/libcurl/opts/CURLOPT_TLS*,\
-              docs/libcurl/opts/CURLOPT_USE_SSL*,\
-              lib/vtls/**,\
-              m4/curl-bearssl.m4,\
-              m4/curl-gnutls.m4,\
-              m4/curl-mbedtls.m4,\
-              m4/curl-openssl.m4,\
-              m4/curl-rustls.m4,\
-              m4/curl-schannel.m4,\
-              m4/curl-sectransp.m4,\
-              m4/curl-wolfssl.m4\
-              }"
+          - any-glob-to-all-files:
+              - '{CMake/FindBearSSL.cmake,CMake/FindMbedTLS.cmake,CMake/FindWolfSSL.cmake,docs/examples/ssl*,docs/examples/*ssl.*,docs/examples/*tls.*,docs/SSL*,docs/libcurl/curl_global_sslset*,docs/libcurl/opts/CURLINFO_CA*,docs/libcurl/opts/CURLINFO_CERT*,docs/libcurl/opts/CURLINFO_SSL*,docs/libcurl/opts/CURLINFO_TLS*,docs/libcurl/opts/CURLOPT_CA*,docs/libcurl/opts/CURLOPT_CERT*,docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*,docs/libcurl/opts/CURLOPT_SSL*,docs/libcurl/opts/CURLOPT_TLS*,docs/libcurl/opts/CURLOPT_USE_SSL*,lib/vtls/**,m4/curl-bearssl.m4,m4/curl-gnutls.m4,m4/curl-mbedtls.m4,m4/curl-openssl.m4,m4/curl-rustls.m4,m4/curl-schannel.m4,m4/curl-sectransp.m4,m4/curl-wolfssl.m4}'

 URL:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/curl_url*,\
-              docs/URL-SYNTAX.md,\
-              docs/examples/parseurl*,\
-              include/curl/urlapi.h,\
-              lib/urlapi*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/libcurl/curl_url*,docs/URL-SYNTAX.md,docs/examples/parseurl*,include/curl/urlapi.h,lib/urlapi*}'

 WebSocket:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/internals/WEBSOCKET.md*,\
-              docs/examples/websocket*,\
-              docs/libcurl/curl_ws_*,\
-              docs/libcurl/libcurl-ws*,\
-              docs/libcurl/opts/CURLOPT_WS_*,\
-              include/curl/websockets.h,\
-              lib/ws.*,\
-              tests/http/clients/ws*,\
-              tests/http/test_20_websockets.py,\
-              tests/http/testenv/ws*\
-              }"
+          - any-glob-to-all-files:
+              - '{docs/WEBSOCKET.md*,docs/examples/websocket*,docs/libcurl/curl_ws_*,docs/libcurl/libcurl-ws*,docs/libcurl/opts/CURLOPT_WS_*,include/curl/websockets.h,lib/ws.*,tests/http/clients/ws*,tests/http/test_20_websockets.py,tests/http/testenv/ws*}'

 Windows:
  - all:
      - changed-files:
-          - any-glob-to-all-files: "{\
-              appveyor.*,\
-              .github/workflows/windows.yml,\
-              CMake/win32-cache.cmake,\
-              lib/*win32*,\
-              lib/curl_multibyte.*,\
-              lib/rename.*,\
-              lib/vtls/schannel*,\
-              m4/curl-schannel.m4,\
-              projects/**,\
-              src/tool_doswin.c,\
-              winbuild/**,\
-              lib/libcurl.def\
-              }"
+          - any-glob-to-all-files:
+              - '{appveyor.*,.github/workflows/windows.yml,CMake/Platforms/WindowsCache.cmake,lib/*win32*,lib/curl_multibyte.*,lib/rename.*,lib/vtls/schannel*,m4/curl-schannel.m4,projects/**,src/tool_doswin.c,winbuild/**,libcurl.def}'
--- a/.github/scripts/VERSIONS
+++ b/.github/scripts/VERSIONS
@ -0,0 +1,9 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+# renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
+WOLFSSL_VER=5.7.2
+
+# renovate: datasource=github-tags depName=wolfSSL/wolfssh versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
+WOLFSSH_VER=1.4.17
--- a/.github/scripts/badwords.pl
+++ b/.github/scripts/badwords.pl
@ -8,21 +8,13 @@
 # If separator is '=', the string will be compared case sensitively.
 # If separator is ':', the check is done case insensitively.
 #
-# To add white listed uses of bad words that are removed before checking for
-# the bad ones:
-#
-# ---(accepted word)
-#
 my $w;
 while(<STDIN>) {
    chomp;
    if($_ =~ /^#/) {
        next;
    }
-    if($_ =~ /^---(.*)/) {
-        push @whitelist, $1;
-    }
-    elsif($_ =~ /^([^:=]*)([:=])(.*)/) {
+    if($_ =~ /^([^:=]*)([:=])(.*)/) {
        my ($bad, $sep, $better)=($1, $2, $3);
        push @w, $bad;
        $alt{$bad} = $better;
@ -49,10 +41,6 @@ sub file {
        $in =~ s/(\[.*\])\(.*\)/$1/g;
        # remove backticked texts
        $in =~ s/\`.*\`//g;
-        # remove whitelisted patterns
-        for my $p (@whitelist) {
-            $in =~ s/$p//g;
-        }
        foreach my $w (@w) {
            my $case = $exactcase{$w};
            if(($in =~ /^(.*)$w/i && !$case) ||
--- a/.github/scripts/badwords.txt
+++ b/.github/scripts/badwords.txt
@ -36,7 +36,7 @@ aren't:are not
 url =URL
 internet\b=Internet
 isation:ization
-\bit's:it is
+it's:it is
 it'd:it would
 there's:there is
 [^.]\. And: Rewrite it somehow?
@ -65,9 +65,3 @@ couldn't:could not
 64 bit\b=64-bit
 64-bits:64 bits or 64-bit
 32-bits:32 bits or 32-bit
-\bvery\b:rephrase using an alternative word
-\bCurl\b=curl
-\bLibcurl\b=libcurl
---WWW::Curl
---NET::Curl
---Curl Corporation
--- a/.github/scripts/binarycheck.sums
+++ b/.github/scripts/binarycheck.sums
@ -17,7 +17,8 @@ b967734c9bfe3d7a1a7795f348f0bce4d9ba15ca9590697ef2d4d15b92822db0  ./tests/certs/
 26ee981dcb84b6a2adce601084b78e6b787b54a2a997549582a8bd42087ab51b  ./tests/data/test1426
 d640923e45809a3fe277e0af90459d82d32603aacc7b8db88754fcb335bf98df  ./tests/data/test1531
 6f51bc318104fb5fe4b6013fc4e8e1c3c8dec1819202e8ea025bdbc4bbc8c02d  ./tests/data/test1938
-33809cab2442488e5985b4939727bc4ead9fc65150f53008e3e4c93140675a94  ./tests/data/test262
+28a957ec3397881bbafd0d97879cedfd475bcd1ece903e531576affd7aa3865c  ./tests/data/test2080
+db99126801fd5e7cb0c1ec1a0078e5599038c8c07073f3d62ed51f155e0e3d38  ./tests/data/test262
 2d073a52984bab1f196d80464ea8ab6dafd887bd5fee9ed58603f8510df0c6a5  ./tests/data/test35
 4cc9fd6f31d0bb4dcb38e1565796e7ec5e48ea5ac9d3c1101de576be618786ba  ./tests/data/test463
 d655a29dcf2423b420b508c9e381b0fad0b88feb74caa8978725e22c9f7c374d  ./tests/data/test467
--- a/.github/scripts/cleancmd.pl
+++ b/.github/scripts/cleancmd.pl
@ -3,117 +3,52 @@
 #
 # SPDX-License-Identifier: curl
 #
-# Input: cmdline docs markdown files, they get modified *in place*
-#
-# Strip off the leading meta-data/header part, remove all known curl symbols
-# and long command line options. Also clean up whatever else the spell checker
-# might have a problem with that we still deem is fine.
+# Input: a cmdline docs markdown, it gets modified *in place*
 #
+# The main purpose is to strip off the leading meta-data part, but also to
+# clean up whatever else the spell checker might have a problem with that we
+# still deem is fine.

-open(S, "<./docs/libcurl/symbols-in-versions")
-    || die "can't find symbols-in-versions";
-while(<S>) {
-    if(/^([^ ]*) /) {
-        push @asyms, $1;
+my $header = 1;
+while(1) {
+    # set this if the markdown has no meta-data header to skip
+    if($ARGV[0] eq "--no-header") {
+        shift @ARGV;
+        $header = 0;
+    }
+    else {
+        last;
    }
 }
-close(S);

-# init the opts table with "special" options not easy to figure out
-my @aopts = (
-    '--ftp-ssl-reqd', # old alias
-    );
+my $f = $ARGV[0];

-open(O, "<./docs/options-in-versions")
-    || die "can't find options-in-versions";
-while(<O>) {
-    chomp;
-    if(/^([^ ]+)/) {
-        my $o = $1;
-        push @aopts, $o;
-        if($o =~ /^--no-(.*)/) {
-            # for the --no options, also make one without it
-            push @aopts, "--$1";
+open(F, "<$f") or die;
+
+my $ignore = $header;
+my $sepcount = 0;
+my @out;
+while(<F>) {
+    if(/^---/ && $header) {
+        if(++$sepcount == 2) {
+            $ignore = 0;
        }
-        elsif($o =~ /^--disable-(.*)/) {
-            # for the --disable options, also make the special ones
-            push @aopts, "--$1";
-            push @aopts, "--no-$1";
-        }
-    }
-}
-close(O);
-
-open(C, "<./.github/scripts/spellcheck.curl")
-    || die "can't find spellcheck.curl";
-while(<C>) {
-    if(/^\#/) {
        next;
    }
-    chomp;
-    if(/^([^ ]+)/) {
-        push @asyms, $1;
-    }
+    next if($ignore);
+
+    # strip out all long command line options
+    $_ =~ s/--[a-z0-9-]+//g;
+
+    # strip out https URLs, we don't want them spellchecked
+    $_ =~ s!https://[a-z0-9\#_/.-]+!!gi;
+
+    push @out, $_;
 }
-close(C);
+close(F);

-# longest symbols first
-my @syms = sort { length($b) <=> length($a) } @asyms;
-
-# longest cmdline options first
-my @opts = sort { length($b) <=> length($a) } @aopts;
-
-sub process {
-    my ($f) = @_;
-
-    my $ignore = 0;
-    my $sepcount = 0;
-    my $out;
-    my $line = 0;
-    open(F, "<$f") or die;
-
-    while(<F>) {
-        $line++;
-        if(/^---/ && ($line == 1)) {
-            $ignore = 1;
-            next;
-        }
-        elsif(/^---/ && $ignore) {
-            $ignore = 0;
-            next;
-        }
-        next if($ignore);
-
-        my $l = $_;
-
-        # strip out backticked words
-        $l =~ s/`[^`]+`//g;
-
-        # **bold**
-        $l =~ s/\*\*(\S.*?)\*\*//g;
-        # *italics*
-        $l =~ s/\*(\S.*?)\*//g;
-
-        # strip out https URLs, we don't want them spellchecked
-        $l =~ s!https://[a-z0-9\#_/.-]+!!gi;
-
-        $out .= $l;
-    }
-    close(F);
-
-    # cut out all known curl cmdline options
-    map { $out =~ s/$_//g; } (@opts);
-
-    # cut out all known curl symbols
-    map { $out =~ s/\b$_\b//g; } (@syms);
-
-    if(!$ignore) {
-        open(O, ">$f") or die;
-        print O $out;
-        close(O);
-    }
-}
-
-for my $f (@ARGV) {
-    process($f);
+if(!$ignore) {
+    open(O, ">$f") or die;
+    print O @out;
+    close(O);
 }
--- a/.github/scripts/cleanspell.pl
+++ b/.github/scripts/cleanspell.pl
@ -0,0 +1,86 @@
+#!/usr/bin/env perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Given: a libcurl curldown man page
+# Outputs: the same file, minus the SYNOPSIS and the EXAMPLE sections
+#
+
+my $f = $ARGV[0];
+
+open(F, "<$f") or die;
+
+my @out;
+my $ignore = 0;
+while(<F>) {
+    if($_ =~ /^# (SYNOPSIS|EXAMPLE)/) {
+        $ignore = 1;
+    }
+    elsif($ignore && ($_ =~ /^# [A-Z]/)) {
+        $ignore = 0;
+    }
+    elsif(!$ignore) {
+        # **bold**
+        $_ =~ s/\*\*(\S.*?)\*\*//g;
+        # *italics*
+        $_ =~ s/\*(\S.*?)\*//g;
+
+        $_ =~ s/CURL(M|SH|U|H)code//g;
+        $_ =~ s/CURL_[A-Z0-9_]*//g;
+        $_ =~ s/CURLALTSVC_[A-Z0-9_]*//g;
+        $_ =~ s/CURLAUTH_[A-Z0-9_]*//g;
+        $_ =~ s/CURLE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFORM_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTP_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTPAUTH_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTPMETHOD_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTPSSL_[A-Z0-9_]*//g;
+        $_ =~ s/CURLGSSAPI_[A-Z0-9_]*//g;
+        $_ =~ s/CURLHEADER_[A-Z0-9_]*//g;
+        $_ =~ s/CURLINFO_[A-Z0-9_]*//g;
+        $_ =~ s/CURLM_[A-Z0-9_]*//g;
+        $_ =~ s/CURLMIMEOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLMOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPIPE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPROTO_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPROXY_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPX_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSHE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSHOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSSLOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSSH_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSSLBACKEND_[A-Z0-9_]*//g;
+        $_ =~ s/CURLU_[A-Z0-9_]*//g;
+        $_ =~ s/CURLUPART_[A-Z0-9_]*//g;
+        #$_ =~ s/\bCURLU\b//g; # stand-alone CURLU
+        $_ =~ s/CURLUE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLHE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLWS_[A-Z0-9_]*//g;
+        $_ =~ s/CURLKH[A-Z0-9_]*//g;
+        $_ =~ s/CURLUPART_[A-Z0-9_]*//g;
+        $_ =~ s/CURLUSESSL_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPAUSE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLHSTS_[A-Z0-9_]*//g;
+        $_ =~ s/curl_global_([a-z_]*)//g;
+        $_ =~ s/curl_(strequal|strnequal|formadd|waitfd|formget|getdate|formfree)//g;
+        $_ =~ s/curl_easy_([a-z]*)//g;
+        $_ =~ s/curl_multi_([a-z_]*)//g;
+        $_ =~ s/curl_mime_(subparts|addpart|filedata|data_cb)//g;
+        $_ =~ s/curl_ws_(send|recv|meta)//g;
+        $_ =~ s/curl_url_(dup)//g;
+        $_ =~ s/curl_pushheader_by(name|num)//g;
+        $_ =~ s/libcurl-(env|ws)//g;
+        $_ =~ s/libcurl\\-(env|ws)//g;
+        $_ =~ s/(^|\W)((tftp|https|http|ftp):\/\/[a-z0-9\-._~%:\/?\#\[\]\@!\$&'()*+,;=\\]+)//gi;
+        push @out, $_;
+    }
+}
+close(F);
+
+open(O, ">$f") or die;
+for my $l (@out) {
+    print O $l;
+}
+close(O);
--- a/.github/scripts/cmp-pkg-config.sh
+++ b/.github/scripts/cmp-pkg-config.sh
@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-# Sort list of libs, libpaths, cflags found in libcurl.pc and curl-config files,
-# then diff the autotools and cmake generated ones.
-
-sort_lists() {
-  prevline=''
-  section=''
-  while IFS= read -r l; do
-    if [[ "${prevline}" =~ (--cc|--configure) ]]; then  # curl-config
-      echo "<IGNORED>"
-    else
-      # libcurl.pc
-      if [[ "${l}" =~ ^(Requires|Libs|Cflags)(\.private)?:\ (.+)$ ]]; then
-        if [ "${BASH_REMATCH[1]}" = 'Requires' ]; then
-          # Spec does not allow duplicates here:
-          # https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html#Requires:
-          # "You may only mention the same package one time on the Requires: line"
-          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ',' '\n' | sort | tr '\n' ' ')"
-        else
-          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
-        fi
-        l="${BASH_REMATCH[1]}${BASH_REMATCH[2]}: ${val}"
-      # curl-config
-      elif [[ "${section}" =~ (--libs|--static-libs) && "${l}" =~ ^( *echo\ \")(.+)(\")$ ]]; then
-        val="$(printf '%s' "${BASH_REMATCH[2]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
-        l="${BASH_REMATCH[1]}${val}${BASH_REMATCH[3]}"
-        section=''
-      fi
-      echo "${l}"
-    fi
-    # curl-config
-    prevline="${l}"
-    if [[ "${l}" =~ --[a-z-]+\) ]]; then
-      section="${BASH_REMATCH[0]}"
-    fi
-  done < "$1"
-}
-
-am=$(mktemp -t autotools.XXX); sort_lists "$1" > "${am}"
-cm=$(mktemp -t cmake.XXX)    ; sort_lists "$2" > "${cm}"
-diff -u "${am}" "${cm}"
-res="$?"
-rm -r -f "${am}" "${cm}"
-
-exit "${res}"
--- a/.github/scripts/distfiles.sh
+++ b/.github/scripts/distfiles.sh
@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-# Compare git repo files with tarball files and report a mismatch
-# after excluding exceptions.
-
-set -eu
-
-gitonly=".git*
-^.*
-^appveyor.*
-^buildconf
-^GIT-INFO.md
-^README.md
-^renovate.json
-^REUSE.toml
-^SECURITY.md
-^LICENSES/*
-^docs/examples/adddocsref.pl
-^docs/THANKS-filter
-^projects/Windows/*
-^scripts/ciconfig.pl
-^scripts/cijobs.pl
-^scripts/contributors.sh
-^scripts/contrithanks.sh
-^scripts/delta
-^scripts/installcheck.sh
-^scripts/release-notes.pl
-^scripts/singleuse.pl
-^tests/CI.md"
-
-tarfiles="$(mktemp)"
-gitfiles="$(mktemp)"
-
-tar -tf "$1" \
-  | sed -E 's|^[^/]+/||g' \
-  | grep -v -E '(/|^)$' \
-  | sort > "${tarfiles}"
-
-git -C "${2:-.}" ls-files \
-  | grep -v -E "($(printf '%s' "${gitonly}" | tr $'\n' '|' | sed -e 's|\.|\\.|g' -e 's|\*|.+|g'))$" \
-  | sort > "${gitfiles}"
-
-dif="$(diff -u "${tarfiles}" "${gitfiles}" | tail -n +3 || true)"
-
-rm -rf "${tarfiles:?}" "${gitfiles:?}"
-
-echo 'Only in tarball:'
-echo "${dif}" | grep '^-' || true
-echo
-
-echo 'Missing from tarball:'
-if echo "${dif}" | grep '^+'; then
-  exit 1
-fi
--- a/.github/scripts/spellcheck.curl
+++ b/.github/scripts/spellcheck.curl
@ -1,151 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# common variable types + structs
-# callback typedefs
-# public functions names
-# some man page names
-curl_fileinfo
-curl_forms
-curl_hstsentry
-curl_httppost
-curl_index
-curl_khkey
-curl_pushheaders
-curl_waitfd
-CURLcode
-CURLformoption
-CURLHcode
-CURLMcode
-CURLMsg
-CURLSHcode
-CURLUcode
-curl_calloc_callback
-curl_chunk_bgn_callback
-curl_chunk_end_callback
-curl_conv_callback
-curl_debug_callback
-curl_fnmatch_callback
-curl_formget_callback
-curl_free_callback
-curl_hstsread_callback
-curl_hstswrite_callback
-curl_ioctl_callback
-curl_malloc_callback
-curl_multi_timer_callback
-curl_opensocket_callback
-curl_prereq_callback
-curl_progress_callback
-curl_push_callback
-curl_read_callback
-curl_realloc_callback
-curl_resolver_start_callback
-curl_seek_callback
-curl_socket_callback
-curl_sockopt_callback
-curl_ssl_ctx_callback
-curl_strdup_callback
-curl_trailer_callback
-curl_write_callback
-curl_xferinfo_callback
-curl_strequal
-curl_strnequal
-curl_mime_init
-curl_mime_free
-curl_mime_addpart
-curl_mime_name
-curl_mime_filename
-curl_mime_type
-curl_mime_encoder
-curl_mime_data
-curl_mime_filedata
-curl_mime_data_cb
-curl_mime_subparts
-curl_mime_headers
-curl_formadd
-curl_formget
-curl_formfree
-curl_getdate
-curl_getenv
-curl_version
-curl_easy_escape
-curl_escape
-curl_easy_unescape
-curl_unescape
-curl_free
-curl_global_init
-curl_global_init_mem
-curl_global_cleanup
-curl_global_trace
-curl_global_sslset
-curl_slist_append
-curl_slist_free_all
-curl_getdate
-curl_share_init
-curl_share_setopt
-curl_share_cleanup
-curl_version_info
-curl_easy_strerror
-curl_share_strerror
-curl_easy_pause
-curl_easy_ssls_import
-curl_easy_ssls_export
-curl_easy_init
-curl_easy_setopt
-curl_easy_perform
-curl_easy_cleanup
-curl_easy_getinfo
-curl_easy_duphandle
-curl_easy_reset
-curl_easy_recv
-curl_easy_send
-curl_easy_upkeep
-curl_easy_header
-curl_easy_nextheader
-curl_mprintf
-curl_mfprintf
-curl_msprintf
-curl_msnprintf
-curl_mvprintf
-curl_mvfprintf
-curl_mvsprintf
-curl_mvsnprintf
-curl_maprintf
-curl_mvaprintf
-curl_multi_init
-curl_multi_add_handle
-curl_multi_remove_handle
-curl_multi_fdset
-curl_multi_waitfds
-curl_multi_wait
-curl_multi_poll
-curl_multi_wakeup
-curl_multi_perform
-curl_multi_cleanup
-curl_multi_info_read
-curl_multi_strerror
-curl_multi_socket
-curl_multi_socket_action
-curl_multi_socket_all
-curl_multi_timeout
-curl_multi_setopt
-curl_multi_assign
-curl_multi_get_handles
-curl_pushheader_bynum
-curl_pushheader_byname
-curl_multi_waitfds
-curl_easy_option_by_name
-curl_easy_option_by_id
-curl_easy_option_next
-curl_url
-curl_url_cleanup
-curl_url_dup
-curl_url_get
-curl_url_set
-curl_url_strerror
-curl_ws_recv
-curl_ws_send
-curl_ws_meta
-libcurl-env
-libcurl-ws
--- a/.github/scripts/spellcheck.words
+++ b/.github/scripts/spellcheck.words
@ -33,6 +33,7 @@ archivers
 Archos
 Arntsen
 Aros
+ascii
 asynch
 AsynchDNS
 atime
@ -43,7 +44,6 @@ Autoconf
 autoconf
 Automake
 automake
-autoreconf
 Autotools
 autotools
 AVR
@ -78,6 +78,7 @@ bugfix
 bugfixes
 buildable
 buildbot
+buildconf
 Caddy
 calloc
 CAPA
@ -121,11 +122,11 @@ CMakeLists
 CNA
 CNAME
 CNAMEs
+CodeQL
+codeql
 CODESET
 codeset
-CodeSonar
 Comcast
-commit's
 Config
 config
 conncache
@ -136,7 +137,6 @@ CPUs
 CR
 CRL
 CRLF
-crontab
 crt
 crypto
 cryptographic
@ -251,10 +251,8 @@ Feltzing
 ffi
 filesize
 filesystem
-FindCURL
 FLOSS
 fnmatch
-footguns
 formpost
 formposts
 Fortnite
@ -348,7 +346,6 @@ httpget
 HttpGet
 HTTPS
 https
-HTTPSRR
 hyper's
 Högskolan
 IANA
@ -366,7 +363,7 @@ ifdefs
 ifhost
 IIS
 ILE
-illumos
+Illumos
 IMAP
 imap
 IMAPS
@ -454,7 +451,6 @@ libz
 libzstd
 LineageOS
 linux
-lldb
 ln
 localhost
 LOGDIR
@ -600,7 +596,6 @@ Orbis
 ORing
 Osipov
 OSS
-PaaS
 pac
 pacman
 parser's
@ -669,7 +664,6 @@ ReactOS
 README
 realloc
 Realtime
-rebalances
 rebase
 RECV
 recv
@ -691,6 +685,7 @@ RETR
 retransmit
 retrigger
 RHEL
+RICS
 Rikard
 rmdir
 ROADMAP
@ -704,7 +699,6 @@ RRtype
 RSA
 RTMP
 rtmp
-rtmpdump
 RTMPE
 RTMPS
 RTMPT
@ -719,7 +713,6 @@ runtests
 runtime
 Ruslan
 rustc
-Rustls
 rustls
 Sagula
 SanDisk
@ -772,7 +765,6 @@ SOCKSv
 Solaris
 SONAME
 Soref
-SOVERSION
 SPARC
 SPDX
 SPNEGO
@ -785,7 +777,6 @@ SSL
 ssl
 SSLeay
 SSLKEYLOGFILE
-SSLS
 sslv
 SSLv
 SSLVERSION
@ -838,7 +829,6 @@ TCP
 tcpdump
 Tekniska
 testability
-testcurl
 TFTP
 tftp
 threadsafe
@ -857,7 +847,6 @@ TPF
 TrackMemory
 transcode
 Tru
-trurl
 trustless
 Tse
 Tsujikawa
@ -883,6 +872,7 @@ unescape
 Unglobbed
 Unicode
 UNICOS
+unix
 UnixSockets
 UnixWare
 unlink
@ -894,7 +884,6 @@ unsanitized
 Unshare
 unsharing
 untrusted
-unwrite
 UPN
 upstreaming
 URI
@ -917,7 +906,6 @@ VC
 vcpkg
 vexxhost
 Viktor
-Virtuozzo
 VLAN
 VM
 VMS
@ -936,7 +924,6 @@ Warta
 watchOS
 WAV
 WB
-wcurl
 web page
 WebDAV
 WebOS
@ -947,10 +934,15 @@ WHATWG
 whitespace
 Whitespaces
 winbind
+WinBind
 winbuild
+winidn
 WinIDN
 WinLDAP
+WinSock
 winsock
+WinSSL
+winssl
 Wireshark
 wolfSSH
 wolfSSL
@ -975,3 +967,6 @@ zsh
 zstd
 Zuul
 zuul
+crontab
+testcurl
+lldb
--- a/.github/scripts/spellcheck.yaml
+++ b/.github/scripts/spellcheck.yaml
@ -29,4 +29,4 @@ matrix:
            - 'strong'
            - 'em'
    sources:
-      - '**/*.md|!docs/BINDINGS.md|!docs/DISTROS.md|!docs/CIPHERS-TLS12.md'
+      - '**/*.md|!docs/BINDINGS.md|!docs/DISTROS.md'
--- a/.github/scripts/trimmarkdownheader.pl
+++ b/.github/scripts/trimmarkdownheader.pl
@ -1,41 +0,0 @@
-#!/usr/bin/env perl
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Given: a libcurl curldown man page
-# Outputs: the same file, minus the header
-#
-
-my $f = $ARGV[0];
-
-open(F, "<$f") or die;
-
-my @out;
-my $line = 0;
-my $hideheader = 0;
-
-while(<F>) {
-    if($hideheader) {
-        if(/^---/) {
-            # end if hiding
-            $hideheader = 0;
-        }
-        push @out, "\n"; # replace with blank
-        next;
-    }
-    elsif(!$line++ && /^---/) {
-        # starts with a header, strip off the header
-        $hideheader = 1;
-        push @out, "\n"; # replace with blank
-        next;
-    }
-    push @out, $_;
-}
-close(F);
-
-open(O, ">$f") or die;
-for my $l (@out) {
-    print O $l;
-}
-close(O);
--- a/.github/scripts/yamlcheck.sh
+++ b/.github/scripts/yamlcheck.sh
@ -1,13 +0,0 @@
-#!/bin/sh
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-set -eu
-
-# shellcheck disable=SC2046
-yamllint \
-  --format standard \
-  --strict \
-  --config-data "$(dirname "$0")/yamlcheck.yaml" \
-  $(git ls-files '*.yaml' '*.yml')
--- a/.github/scripts/yamlcheck.yaml
+++ b/.github/scripts/yamlcheck.yaml
@ -1,17 +0,0 @@
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-#
-# Docs: https://yamllint.readthedocs.io/en/stable/configuration.html
-
-extends: default
-
-rules:
-  line-length:
-    max: 500
-    level: warning
-
-  braces: disable
-  commas: disable
-  comments: disable
-  document-start: disable
--- a/.github/workflows/appveyor-status.yml
+++ b/.github/workflows/appveyor-status.yml
@ -4,7 +4,7 @@

 name: AppVeyor Status Report

-'on':
+on:
  status

 concurrency:
--- a/.github/workflows/awslc.yml
+++ b/.github/workflows/awslc.yml
@ -0,0 +1,153 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Linux AWS-LC
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: awslc-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+
+  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
+  awslc-version: 1.33.0
+
+jobs:
+  autoconf:
+    name: awslc (autoconf)
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 30
+
+    steps:
+      - run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get update
+          sudo apt-get install --yes libtool autoconf automake pkg-config stunnel4 libpsl-dev
+          # ensure we don't pick up openssl in this build
+          sudo apt remove --yes libssl-dev
+          sudo python3 -m pip install impacket
+        name: 'install prereqs and impacket'
+
+      - name: cache awslc
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: /home/runner/awslc
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
+
+      - name: build awslc
+        if: steps.cache-awslc.outputs.cache-hit != 'true'
+        run: |
+          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
+            https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
+          tar xzf v${{ env.awslc-version }}.tar.gz
+          mkdir aws-lc-${{ env.awslc-version }}-build
+          cd aws-lc-${{ env.awslc-version }}-build
+          cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }}
+          cmake --build . --parallel
+          cmake --install .
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - run: autoreconf -fi
+        name: 'autoreconf'
+
+      - run: |
+          mkdir build
+          cd build
+          ../configure --disable-dependency-tracking --enable-warnings --enable-werror --with-openssl=$HOME/awslc
+          cd ..
+        name: 'configure out-of-tree'
+
+      - run: make -C build V=1
+        name: 'make'
+
+      - run: make -C build V=1 examples
+        name: 'make examples'
+
+      - run: make -C build V=1 -C tests
+        name: 'make tests'
+
+      - run: make -C build V=1 test-ci
+        name: 'run tests'
+
+  cmake:
+    name: awslc (cmake)
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 15
+
+    steps:
+      - run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get update
+          sudo apt-get install cmake stunnel4
+          # ensure we don't pick up openssl in this build
+          sudo apt remove --yes libssl-dev
+          sudo python3 -m pip install impacket
+        name: 'install prereqs and impacket'
+
+      - name: cache awslc
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-awslc
+        env:
+          cache-name: cache-awslc
+        with:
+          path: /home/runner/awslc
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
+
+      - name: build awslc
+        if: steps.cache-awslc.outputs.cache-hit != 'true'
+        run: |
+          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
+            https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
+          tar xzf v${{ env.awslc-version }}.tar.gz
+          mkdir aws-lc-${{ env.awslc-version }}-build
+          cd aws-lc-${{ env.awslc-version }}-build
+          cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }}
+          cmake --build . --parallel
+          cmake --install .
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - run: cmake -Bbuild -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DOPENSSL_ROOT_DIR=$HOME/awslc -DBUILD_SHARED_LIBS=ON .
+        name: 'cmake generate out-of-tree'
+
+      - run: cmake --build build --parallel
+        name: 'cmake build'
+
+      - run: cmake --install build --prefix $HOME/curl --strip
+        name: 'cmake install'
--- a/.github/workflows/badwords.yml
+++ b/.github/workflows/badwords.yml
@ -0,0 +1,42 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: badwords
+
+on:
+  # Trigger the workflow on push or pull requests, but only for the
+  # master branch
+  push:
+    branches:
+      - master
+      - '*/ci'
+  pull_request:
+    branches:
+      - master
+
+permissions: {}
+
+jobs:
+  docs:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: check
+        run: ./.github/scripts/badwords.pl < .github/scripts/badwords.txt docs/*.md docs/libcurl/*.md docs/libcurl/opts/*.md docs/cmdline-opts/*.md docs/TODO docs/KNOWN_BUGS
+
+  source:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      # we allow some extra in source code
+      - name: trim wordlist
+        run: grep -Ev '(\\bwill| url | dir )' .github/scripts/badwords.txt > .github/scripts/source.txt
+
+      - name: check
+        run: ./.github/scripts/badwords.pl < .github/scripts/source.txt `git ls-files -- src lib include`
--- a/.github/workflows/binarycheck.yml
+++ b/.github/workflows/binarycheck.yml
@ -0,0 +1,23 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: bincheck
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: Check for binary files
+        run: ./.github/scripts/binarycheck.pl
--- a/.github/workflows/checkdocs.yml
+++ b/.github/workflows/checkdocs.yml
@ -1,159 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-# This workflow contains tests that operate on documentation files only. Some
-# checks modify the source so they cannot be combined into a single job.
-
-name: Docs
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths:
-      - '.github/workflows/checkdocs.yml'
-      - '.github/scripts/mdlinkcheck'
-      - '/scripts/**'
-      - '**.md'
-      - 'docs/*'
-  pull_request:
-    branches:
-      - master
-    paths:
-      - '.github/workflows/checkdocs.yml'
-      - '.github/scripts/**'
-      - '.github/scripts/mdlinkcheck'
-      - '**.md'
-      - 'docs/*'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  #  proselint:
-  #    runs-on: ubuntu-latest
-  #    steps:
-  #      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
-  #        with:
-  #          persist-credentials: false
-  #        name: checkout
-  #
-  #      - name: install prereqs
-  #        run: |
-  #          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-  #          sudo apt-get -o Dpkg::Use-Pty=0 update
-  #          sudo apt-get -o Dpkg::Use-Pty=0 install python3-proselint
-  #
-  #      # config file help: https://github.com/amperser/proselint/
-  #      - name: create proselint config
-  #        run: |
-  #          cat <<JSON > $HOME/.proselintrc.json
-  #          {
-  #            "checks": {
-  #              "typography.diacritical_marks": false,
-  #              "typography.symbols": false,
-  #              "annotations.misc": false,
-  #              "security.password": false,
-  #              "misc.annotations": false
-  #            }
-  #          }
-  #          JSON
-  #
-  #      - name: trim headers off all *.md files
-  #        run: git ls-files -z '*.md' | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
-  #
-  #      - name: check prose
-  #        run: git ls-files -z '*.md' | grep -Evz 'CHECKSRC.md|DISTROS.md|curl_mprintf.md|CURLOPT_INTERFACE.md|interface.md' | xargs -0 proselint README
-  #
-  #      # This is for CHECKSRC and files with aggressive exclamation mark needs
-  #      - name: create second proselint config
-  #        run: |
-  #          cat <<JSON > $HOME/.proselintrc.json
-  #          {
-  #            "checks": {
-  #              "typography.diacritical_marks": false,
-  #              "typography.symbols": false,
-  #              "typography.exclamation": false,
-  #              "lexical_illusions.misc": false,
-  #              "annotations.misc": false
-  #            }
-  #          }
-  #          JSON
-  #
-  #      - name: check special prose
-  #        run: proselint docs/internals/CHECKSRC.md docs/libcurl/curl_mprintf.md docs/libcurl/opts/CURLOPT_INTERFACE.md docs/cmdline-opts/interface.md
-
-  linkcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: Run mdlinkcheck
-        run: ./scripts/mdlinkcheck
-
-  spellcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: trim all *.md files in docs/
-        run: .github/scripts/cleancmd.pl $(find docs -name "*.md")
-
-      - name: setup the custom wordlist
-        run: grep -v '^#' .github/scripts/spellcheck.words >  wordlist.txt
-
-      - name: Check Spelling
-        uses: rojopolis/spellcheck-github-actions@ed0756273a1658136c36d26e3d0353de35b98c8b # v0
-        with:
-          config_path: .github/scripts/spellcheck.yaml
-
-  badwords-synopsis:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: badwords
-        run: .github/scripts/badwords.pl < .github/scripts/badwords.txt `git ls-files '**.md'` docs/TODO docs/KNOWN_BUGS packages/OS400/README.OS400
-
-      - name: verify-synopsis
-        run: .github/scripts/verify-synopsis.pl docs/libcurl/curl*.md
-
-  man-examples:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: render nroff versions
-        run: autoreconf -fi && ./configure --without-ssl --without-libpsl && make -C docs
-
-      - name: verify examples
-        run: .github/scripts/verify-examples.pl docs/libcurl/curl*.3 docs/libcurl/opts/*.3
-
-  miscchecks:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: spacecheck
-        run: .github/scripts/spacecheck.pl
--- a/.github/workflows/checksrc.yml
+++ b/.github/workflows/checksrc.yml
@ -1,120 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-# This workflow contains checks at the source code level only.
-
-name: Source
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'plan9/**'
-      - 'tests/data/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'plan9/**'
-      - 'tests/data/**'
-      - 'winbuild/**'
-
-permissions: {}
-
-jobs:
-  checksrc:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: check
-        run: git ls-files -z "*.[ch]" | xargs -0 -n1 ./scripts/checksrc.pl
-
-  codespell-cmakelint-pytype-ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: install
-        env:
-          DEBIAN_FRONTEND: noninteractive
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            codespell python3-pip python3-networkx python3-pydot python3-yaml \
-            python3-toml python3-markupsafe python3-jinja2 python3-tabulate \
-            python3-typing-extensions python3-libcst python3-impacket \
-            python3-websockets python3-pytest
-          python3 -m pip install --break-system-packages cmakelint==1.4.3 pytype==2024.9.13 ruff==0.6.8
-
-      - name: spellcheck
-        run: |
-          codespell \
-            --skip scripts/mk-ca-bundle.pl \
-            --skip src/tool_hugehelp.c \
-            -I .github/scripts/codespell-ignore.txt \
-            CMake include m4 scripts src lib
-
-      - name: cmakelint
-        run: scripts/cmakelint.sh
-
-      - name: pytype
-        run: find . -name '*.py' -exec pytype -j auto -k {} +
-
-      - name: ruff
-        run: ruff check --extend-select=B007,B016,C405,C416,COM818,D200,D213,D204,D401,D415,FURB129,N818,PERF401,PERF403,PIE790,PIE808,PLW0127,Q004,RUF010,SIM101,SIM117,SIM118,TRY400,TRY401
-
-  reuse:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5
-
-  miscchecks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: shellcheck
-        run: .github/scripts/shellcheck.sh
-
-      - name: spacecheck
-        run: .github/scripts/spacecheck.pl
-
-      - name: yamlcheck
-        run: .github/scripts/yamlcheck.sh
-
-      - name: binarycheck
-        run: .github/scripts/binarycheck.pl
-
-      # we allow some extra in source code
-      - name: badwords
-        run: |
-          grep -Ev '(\\bwill| url | dir )' .github/scripts/badwords.txt | \
-          .github/scripts/badwords.pl $(git ls-files -- src lib include)
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -0,0 +1,78 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'docs/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'tests/data/**'
+      - 'winbuild/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'docs/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'tests/data/**'
+      - 'winbuild/**'
+  schedule:
+    - cron: '0 0 * * 4'
+
+concurrency:
+  group: ${{ github.workflow }}
+
+permissions: {}
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3
+        with:
+          languages: cpp
+          queries: security-extended
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      # - run: |
+      #    make bootstrap
+      #    make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@ -0,0 +1,39 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Codespell
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - 'lib/**'
+      - 'src/**'
+      - 'include/**'
+  pull_request:
+    branches:
+      - master
+      - 'lib/**'
+      - 'src/**'
+      - 'include/**'
+
+permissions: {}
+
+jobs:
+  codespell:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: install
+        run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get update
+          sudo apt-get install codespell
+
+      - name: spellcheck
+        run: codespell --skip src/tool_hugehelp.c -I .github/scripts/codespell-ignore.txt include src lib
--- a/.github/workflows/configure-vs-cmake.yml
+++ b/.github/workflows/configure-vs-cmake.yml
@ -3,7 +3,7 @@
 # SPDX-License-Identifier: curl

 name: configure-vs-cmake
-'on':
+on:
  push:
    branches:
      - master
@ -11,11 +11,8 @@ name: configure-vs-cmake
      - '*.ac'
      - '**/*.m4'
      - '**/CMakeLists.txt'
-      - 'CMake/**'
      - 'lib/curl_config.h.cmake'
-      - 'tests/cmake/**'
-      - '.github/scripts/cmp-config.pl'
-      - '.github/workflows/configure-vs-cmake.yml'
+      - 'scripts/cmp-config.pl'

  pull_request:
    branches:
@ -24,126 +21,25 @@ name: configure-vs-cmake
      - '*.ac'
      - '**/*.m4'
      - '**/CMakeLists.txt'
-      - 'CMake/**'
      - 'lib/curl_config.h.cmake'
-      - 'tests/cmake/**'
-      - '.github/scripts/cmp-config.pl'
-      - '.github/workflows/configure-vs-cmake.yml'
+      - 'scripts/cmp-config.pl'

 permissions: {}

 jobs:
-  check-linux:
+  check:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

-      - name: 'run configure --with-openssl'
+      - name: run configure --with-openssl
        run: |
-          autoreconf -fi
-          export PKG_CONFIG_DEBUG_SPEW=1
-          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl --without-brotli
+           autoreconf -fi
+           ./configure --with-openssl --without-libpsl

-      - name: 'run cmake'
+      - name: run cmake
        run: |
-          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DCURL_BROTLI=OFF
+           mkdir build && cd build && cmake ..

-      - name: 'configure log'
-        run: cat bld-am/config.log 2>/dev/null || true
-
-      - name: 'cmake log'
-        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'compare generated curl_config.h files'
-        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
-
-      - name: 'compare generated libcurl.pc files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
-
-      - name: 'compare generated curl-config files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
-
-  check-macos:
-    runs-on: macos-latest
-    steps:
-      - name: 'install packages'
-        run: |
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew install libtool autoconf automake && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-
-      - name: 'toolchain versions'
-        run: |
-         echo '::group::brew packages installed'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'run configure --with-openssl'
-        run: |
-          autoreconf -fi
-          export PKG_CONFIG_DEBUG_SPEW=1
-          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl --disable-ldap --with-zstd
-
-      - name: 'run cmake'
-        run: |
-          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DCURL_DISABLE_LDAP=ON \
-            -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-            -DCURL_BROTLI=OFF \
-            -DCURL_USE_LIBSSH2=OFF
-
-      - name: 'configure log'
-        run: cat bld-am/config.log 2>/dev/null || true
-
-      - name: 'cmake log'
-        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'compare generated curl_config.h files'
-        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
-
-      - name: 'compare generated libcurl.pc files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
-
-      - name: 'compare generated curl-config files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
-
-  check-windows:
-    runs-on: ubuntu-latest
-    env:
-      TRIPLET: 'x86_64-w64-mingw32'
-    steps:
-      - name: 'install packages'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 install mingw-w64
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'run configure --with-schannel'
-        run: |
-          autoreconf -fi
-          export PKG_CONFIG_DEBUG_SPEW=1
-          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-schannel --without-libpsl --host="${TRIPLET}"
-
-      - name: 'run cmake'
-        run: |
-          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF \
-            -DCMAKE_SYSTEM_NAME=Windows \
-            -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
-            -DCMAKE_C_COMPILER="${TRIPLET}-gcc"
-
-      - name: 'configure log'
-        run: cat bld-am/config.log 2>/dev/null || true
-
-      - name: 'cmake log'
-        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'compare generated curl_config.h files'
-        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
-
-      - name: 'compare generated libcurl.pc files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
-
-      - name: 'compare generated curl-config files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
+      - name: compare generated curl_config.h files
+        run: ./scripts/cmp-config.pl lib/curl_config.h build/lib/curl_config.h
--- a/.github/workflows/curl-for-win.yml
+++ b/.github/workflows/curl-for-win.yml
@ -4,13 +4,14 @@
 ---
 name: curl-for-win

-'on':
+on:
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -22,6 +23,7 @@ name: curl-for-win
      - master
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -40,50 +42,22 @@ env:
  CW_MAP: '0'
  CW_JOBS: '5'
  CW_NOPKG: '1'
+  DOCKER_CONTENT_TRUST: '1'

 jobs:
-  linux-glibc-gcc:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-linux-a64-x64-gcc'
-          export CW_REVISION='${{ github.sha }}'
-          DOCKER_IMAGE='debian:bookworm-slim'
-          export DOCKER_CONTENT_TRUST=1
-          export CW_CCSUFFIX='-15'
-          export CW_GCCSUFFIX='-12'
-          docker trust inspect --pretty "${DOCKER_IMAGE}"
-          time docker pull "${DOCKER_IMAGE}"
-          docker images --digests
-          time docker run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
-            --env-file <(env | grep -a -E \
-              '^(CW_|GITHUB_)') \
-            "${DOCKER_IMAGE}" \
-            sh -c ./_ci-linux-debian.sh
-
  linux-musl-llvm:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
-          persist-credentials: false
          path: 'curl'
          fetch-depth: 8
      - name: 'build'
        run: |
          git clone --depth 1 https://github.com/curl/curl-for-win
          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-linux-musl-r64-x64'
+          export CW_CONFIG='-main-werror-linux-musl-x64'
          export CW_REVISION='${{ github.sha }}'
          . ./_versions.sh
          docker trust inspect --pretty "${DOCKER_IMAGE}"
@ -101,9 +75,8 @@ jobs:
    env:
      CW_JOBS: '4'
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
-          persist-credentials: false
          path: 'curl'
          fetch-depth: 8
      - name: 'build'
@ -117,9 +90,8 @@ jobs:
  win-llvm:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
-          persist-credentials: false
          path: 'curl'
          fetch-depth: 8
      - name: 'build'
@ -137,27 +109,3 @@ jobs:
              '^(CW_|GITHUB_)') \
            "${DOCKER_IMAGE}" \
            sh -c ./_ci-linux-debian.sh
-
-  win-gcc-libssh-zlibng-x86:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-win-x86-gcc-libssh1-zlibng'
-          export CW_REVISION='${{ github.sha }}'
-          . ./_versions.sh
-          docker trust inspect --pretty "${DOCKER_IMAGE}"
-          time docker pull "${DOCKER_IMAGE}"
-          docker images --digests
-          time docker run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
-            --env-file <(env | grep -a -E \
-              '^(CW_|GITHUB_)') \
-            "${DOCKER_IMAGE}" \
-            sh -c ./_ci-linux-debian.sh
--- a/.github/workflows/distcheck.yml
+++ b/.github/workflows/distcheck.yml
@ -4,7 +4,7 @@

 name: dist

-'on':
+on:
  push:
    branches:
      - master
@ -19,142 +19,129 @@ concurrency:

 permissions: {}

-env:
-  MAKEFLAGS: -j 5
-
 jobs:
  maketgz-and-verify-in-tree:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

-      - name: 'remove preinstalled curl libcurl4{-doc}'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
+      - run: sudo apt-get purge -y curl libcurl4 libcurl4-doc
+        name: 'remove preinstalled curl libcurl4{-doc}'

-      - name: 'autoreconf'
-        run: autoreconf -fi
+      - run: autoreconf -fi
+        name: 'autoreconf'

-      - name: 'configure'
-        run: ./configure --without-ssl --without-libpsl
+      - run: ./configure --without-ssl --without-libpsl
+        name: 'configure'

-      - name: 'make'
-        run: make V=1
+      - run: make V=1
+        name: 'make'

      - name: 'maketgz'
-        run: SOURCE_DATE_EPOCH=1711526400 ./scripts/maketgz 99.98.97
+        run: |
+          SOURCE_DATE_EPOCH=1711526400 ./maketgz 99.98.97

-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+      - uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4
        with:
          name: 'release-tgz'
          path: 'curl-99.98.97.tar.gz'
-          retention-days: 1

-      - name: 'verify in-tree configure build including install'
-        run: |
+      - run: |
          echo "::stop-commands::$(uuidgen)"
          tar xvf curl-99.98.97.tar.gz
          pushd curl-99.98.97
          ./configure --prefix=$HOME/temp --without-ssl --without-libpsl
-          make
-          make test-ci
-          make install
+          make -j5
+          make -j5 test-ci
+          make -j5 install
          popd
          # basic check of the installed files
          bash scripts/installcheck.sh $HOME/temp
          rm -rf curl-99.98.97
+        name: 'verify in-tree configure build including install'

  verify-out-of-tree-docs:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
    needs: maketgz-and-verify-in-tree
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
        with:
          name: 'release-tgz'

-      - name: 'verify out-of-tree configure build including docs'
-        run: |
+      - run: |
          echo "::stop-commands::$(uuidgen)"
          tar xvf curl-99.98.97.tar.gz
          touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
          mkdir build
          pushd build
          ../curl-99.98.97/configure --without-ssl --without-libpsl
-          make
-          make test-ci
+          make -j5
+          make -j5 test-ci
          popd
          rm -rf build
          rm -rf curl-99.98.97
+        name: 'verify out-of-tree configure build including docs'

  verify-out-of-tree-autotools-debug:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
    needs: maketgz-and-verify-in-tree
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
        with:
          name: 'release-tgz'

-      - name: 'verify out-of-tree autotools debug build'
-        run: |
+      - run: |
          echo "::stop-commands::$(uuidgen)"
          tar xvf curl-99.98.97.tar.gz
          pushd curl-99.98.97
          mkdir build
          pushd build
          ../configure --without-ssl --enable-debug "--prefix=${PWD}/pkg" --without-libpsl
-          make
-          make test-ci
-          make install
+          make -j5
+          make -j5 test-ci
+          make -j5 install
+        name: 'verify out-of-tree autotools debug build'

  verify-out-of-tree-cmake:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
    needs: maketgz-and-verify-in-tree
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
        with:
          name: 'release-tgz'

-      - name: 'verify out-of-tree cmake build'
-        run: |
+      - run: |
          echo "::stop-commands::$(uuidgen)"
          tar xvf curl-99.98.97.tar.gz
          pushd curl-99.98.97
-          cmake -B build -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF
-          make -C build
+          cmake -B build -DCURL_WERROR=ON
+          make -C build -j5
+        name: 'verify out-of-tree cmake build'

-  missing-files:
+  verify-cmake-test-dist:
    runs-on: ubuntu-latest
    timeout-minutes: 5
-    needs: maketgz-and-verify-in-tree
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
-        with:
-          name: 'release-tgz'
-
-      - name: 'detect files missing from release tarball'
-        run: .github/scripts/distfiles.sh curl-99.98.97.tar.gz
+      - name: 'cmake test dist'
+        run: |
+          cmake -B build -DENABLE_DIST_TEST=ON

  reproducible-releases:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

-      - name: 'remove preinstalled curl libcurl4{-doc}'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
+      - run: sudo apt-get purge -y curl libcurl4 libcurl4-doc
+        name: 'remove preinstalled curl libcurl4{-doc}'

-      - name: 'generate release tarballs'
-        run: ./scripts/dmaketgz 9.10.11
+      - run: ./scripts/dmaketgz 9.10.11
+        name: 'generate release tarballs'

      - name: 'verify release tarballs'
        run: |
@ -162,33 +149,3 @@ jobs:
          mv curl-9.10.11.tar.gz _verify
          cd _verify
          ../scripts/verify-release curl-9.10.11.tar.gz
-
-  cmake-integration:
-    name: 'cmake-integration-on-${{ matrix.image }}'
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 10
-    env:
-      CC: clang
-      CMAKE_GENERATOR: Ninja
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [ubuntu-latest, macos-latest]
-    steps:
-      - name: 'install prereqs'
-        run: |
-          if [[ '${{ matrix.image }}' = *'ubuntu'* ]]; then
-            sudo apt-get -o Dpkg::Use-Pty=0 install ninja-build libpsl-dev libssl-dev
-          else
-            brew install ninja libpsl openssl
-          fi
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-      - name: 'via FetchContent'
-        run: ./tests/cmake/test.sh FetchContent
-      - name: 'via add_subdirectory'
-        run: ./tests/cmake/test.sh add_subdirectory
-      - name: 'via find_package'
-        run: ./tests/cmake/test.sh find_package
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@ -4,7 +4,7 @@

 name: Fuzzer

-'on':
+on:
  push:
    branches:
      - master
@ -12,6 +12,7 @@ name: Fuzzer
    paths-ignore:
      - '**/*.md'
      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'CMake/**'
@ -26,6 +27,7 @@ name: Fuzzer
    paths-ignore:
      - '**/*.md'
      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'CMake/**'
--- a/.github/workflows/hacktoberfest-accepted.yml
+++ b/.github/workflows/hacktoberfest-accepted.yml
@ -4,7 +4,7 @@

 name: Hacktoberfest

-'on':
+on:
  # this must not ever run on any other branch than master
  push:
    branches:
@ -26,9 +26,8 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
-          persist-credentials: false
          fetch-depth: 100

      - name: Check whether repo participates in Hacktoberfest
@ -41,13 +40,13 @@ jobs:

      - name: Search relevant commit message lines starting with Closes/Merges
        run: |
-          git log --format=email '${{ github.event.before }}..${{ github.event.after }}' | \
-            grep -Ei '^Close[sd]? ' | sort | uniq | tee log
+          git log --format=email ${{ github.event.before }}..${{ github.event.after }} | \
+            grep -Ei "^Close[sd]? " | sort | uniq | tee log
        if: steps.check.outputs.label == 'hacktoberfest'

      - name: Search for Number-based PR references
        run: |
-          grep -Eo '#([0-9]+)' log | cut -d# -f2 | sort | uniq | xargs -t -n1 -I{} \
+          grep -Eo "#([0-9]+)" log | cut -d# -f2 | sort | uniq | xargs -t -n1 -I{} \
            gh pr view {} --json number,createdAt \
              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
@ -58,8 +57,8 @@ jobs:

      - name: Search for URL-based PR references
        run: |
-          grep -Eo 'github.com/(.+)/(.+)/pull/([0-9]+)' log | sort | uniq | xargs -t -n1 -I{} \
-            gh pr view 'https://{}' --json number,createdAt \
+          grep -Eo "github.com/(.+)/(.+)/pull/([0-9]+)" log | sort | uniq | xargs -t -n1 -I{} \
+            gh pr view "https://{}" --json number,createdAt \
              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
              gh pr edit {} --add-label 'hacktoberfest-accepted'
--- a/.github/workflows/http3-linux.yml
+++ b/.github/workflows/http3-linux.yml
@ -2,17 +2,20 @@
 #
 # SPDX-License-Identifier: curl

-name: Linux HTTP/3
+name: http3-linux

-'on':
+on:
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
+      - 'CMake/**'
      - 'packages/**'
      - 'plan9/**'
      - 'projects/**'
@ -22,8 +25,11 @@ name: Linux HTTP/3
      - master
    paths-ignore:
      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
+      - 'CMake/**'
      - 'packages/**'
      - 'plan9/**'
      - 'projects/**'
@ -39,80 +45,108 @@ permissions: {}
 env:
  MAKEFLAGS: -j 5
  # handled in renovate.json
-  openssl-version: 3.4.1
-  # handled in renovate.json
-  quictls-version: 3.3.0
+  openssl3-version: openssl-3.3.0
+  # unhandled
+  quictls-version: 3.1.4+quic
  # renovate: datasource=github-tags depName=gnutls/gnutls versioning=semver registryUrl=https://github.com
-  gnutls-version: 3.8.9
-  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-  wolfssl-version: 5.7.6
+  gnutls-version: 3.8.6
+  wolfssl-version: master
  # renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
-  nghttp3-version: 1.8.0
+  nghttp3-version: 1.4.0
  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
-  ngtcp2-version: 1.11.0
+  ngtcp2-version: 1.6.0
  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
-  nghttp2-version: 1.64.0
+  nghttp2-version: 1.62.1
  # renovate: datasource=github-tags depName=cloudflare/quiche versioning=semver registryUrl=https://github.com
-  quiche-version: 0.23.2
+  quiche-version: 0.22.0
+  # renovate: datasource=github-tags depName=icing/mod_h2 versioning=semver registryUrl=https://github.com
+  mod_h2-version: 2.0.29

 jobs:
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      wolfssl-version: ${{ steps.wolfssl-version.outputs.result }}
+
+    steps:
+      - id: wolfssl-version
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          result-encoding: string
+          script: |
+            let version = '${{ env.wolfssl-version }}'
+
+            if (version != 'master') {
+                return version
+            }
+
+            let { data: commits } = await github.rest.repos.listCommits({
+                owner: 'wolfSSL',
+                repo: 'wolfssl',
+            })
+
+            return commits[0].sha
+
  build-cache:
+    needs:
+      - setup
    runs-on: ubuntu-latest

    steps:
-      - name: 'cache quictls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache quictls
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-quictls-no-deprecated
        env:
          cache-name: cache-quictls-no-deprecated
        with:
-          path: ~/quictls/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quictls-version }}-quic1
+          path: /home/runner/quictls/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quictls-version }}

-      - name: 'cache gnutls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache gnutls
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-gnutls
        env:
          cache-name: cache-gnutls
        with:
-          path: ~/gnutls/build
+          path: /home/runner/gnutls/build
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.gnutls-version }}

-      - name: 'cache wolfssl'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache wolfssl
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-wolfssl
        env:
          cache-name: cache-wolfssl
+          wolfssl-version: ${{ needs.setup.outputs.wolfssl-version }}
        with:
-          path: ~/wolfssl/build
+          path: /home/runner/wolfssl/build
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.wolfssl-version }}

-      - name: 'cache nghttp3'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache nghttp3
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-nghttp3
        env:
          cache-name: cache-nghttp3
        with:
-          path: ~/nghttp3/build
+          path: /home/runner/nghttp3/build
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp3-version }}

-      - name: 'cache ngtcp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache ngtcp2
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-ngtcp2
        env:
          cache-name: cache-ngtcp2
        with:
-          path: ~/ngtcp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.ngtcp2-version }}-${{ env.quictls-version }}-${{ env.gnutls-version }}-${{ env.wolfssl-version }}
+          path: /home/runner/ngtcp2/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.ngtcp2-version }}

-      - name: 'cache nghttp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache nghttp2
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-nghttp2
        env:
          cache-name: cache-nghttp2
        with:
-          path: ~/nghttp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp2-version }}-${{ env.quictls-version }}-${{ env.ngtcp2-version }}-${{ env.nghttp3-version }}
+          path: /home/runner/nghttp2/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp2-version }}

      - id: settings
        if: |
@ -125,13 +159,12 @@ jobs:
        run: |
          echo 'needs-build=true' >> $GITHUB_OUTPUT

-      - name: 'install build prereqs'
+      - name: install build prerequisites
        if: steps.settings.outputs.needs-build == 'true'
        run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake pkgconf stunnel4 \
+          sudo apt-get update
+          sudo apt-get install libtool autoconf automake pkg-config stunnel4 \
            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev \
            nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin \
            libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools \
@ -140,18 +173,17 @@ jobs:
          echo 'CC=gcc-12' >> $GITHUB_ENV
          echo 'CXX=g++-12' >> $GITHUB_ENV

-      - name: 'build quictls'
-        if: steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true'
+      - if: steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true'
        run: |
          cd $HOME
-          git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }}-quic1 https://github.com/quictls/openssl quictls
+          git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }} https://github.com/quictls/openssl quictls
          cd quictls
-          ./config no-deprecated --prefix=$PWD/build --libdir=lib no-makedepend no-apps no-docs no-tests
+          ./config no-deprecated --prefix=$PWD/build --libdir=lib
          make
          make -j1 install_sw
+        name: 'build quictls'

-      - name: 'build gnutls'
-        if: steps.cache-gnutls.outputs.cache-hit != 'true'
+      - if: steps.cache-gnutls.outputs.cache-hit != 'true'
        run: |
          cd $HOME
          git clone --quiet --depth=1 -b ${{ env.gnutls-version }} https://github.com/gnutls/gnutls.git
@ -163,245 +195,212 @@ jobs:
            --disable-guile --disable-doc --disable-tests --disable-tools
          make
          make install
+        name: 'build gnutls'

-      - name: 'build wolfssl'
-        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
+      - if: steps.cache-wolfssl.outputs.cache-hit != 'true'
+        env:
+          wolfssl-version: ${{ needs.setup.outputs.wolfssl-version }}
        run: |
          cd $HOME
-          git clone --quiet --depth=1 -b v${{ env.wolfssl-version }}-stable https://github.com/wolfSSL/wolfssl.git
+          mkdir wolfssl
          cd wolfssl
+          git init
+          git remote add origin https://github.com/wolfSSL/wolfssl.git
+          git fetch origin --depth=1 ${{ env.wolfssl-version }}
+          git checkout ${{ env.wolfssl-version }}
          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-all --enable-quic \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=$PWD/build
+          ./configure --disable-dependency-tracking --enable-all --enable-quic --prefix=$PWD/build
          make
          make install
+        name: 'build wolfssl'

-      - name: 'build nghttp3'
-        if: steps.cache-nghttp3.outputs.cache-hit != 'true'
+      - if: steps.cache-nghttp3.outputs.cache-hit != 'true'
        run: |
          cd $HOME
          git clone --quiet --depth=1 -b v${{ env.nghttp3-version }} https://github.com/ngtcp2/nghttp3
          cd nghttp3
-          git submodule update --init --depth=1
+          git submodule update --init
          autoreconf -fi
-          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            PKG_CONFIG_PATH="$PWD/build/lib/pkgconfig" \
-            --enable-lib-only
+          ./configure --disable-dependency-tracking --prefix=$PWD/build PKG_CONFIG_PATH="$PWD/build/lib/pkgconfig" --enable-lib-only
          make
          make install
+        name: 'build nghttp3'

-      - name: 'build ngtcp2'
-        if: steps.cache-ngtcp2.outputs.cache-hit != 'true'
+      - if: steps.cache-ngtcp2.outputs.cache-hit != 'true'
        run: |
          cd $HOME
          git clone --quiet --depth=1 -b v${{ env.ngtcp2-version }} https://github.com/ngtcp2/ngtcp2
          cd ngtcp2
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            PKG_CONFIG_PATH="$HOME/quictls/build/lib/pkgconfig:$HOME/gnutls/build/lib/pkgconfig:$HOME/wolfssl/build/lib/pkgconfig" \
+            PKG_CONFIG_PATH="$PWD/build/lib/pkgconfig:$HOME/quictls/build/lib/pkgconfig:$HOME/gnutls/build/lib/pkgconfig:$HOME/wolfssl/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig" \
            --enable-lib-only --with-openssl --with-gnutls --with-wolfssl
          make install
+        name: 'build ngtcp2'

-      - name: 'build nghttp2'
-        if: steps.cache-nghttp2.outputs.cache-hit != 'true'
+      - if: steps.cache-nghttp2.outputs.cache-hit != 'true'
        run: |
          cd $HOME
          git clone --quiet --depth=1 -b v${{ env.nghttp2-version }} https://github.com/nghttp2/nghttp2
          cd nghttp2
          autoreconf -fi
          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            PKG_CONFIG_PATH="$HOME/quictls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig" \
+            PKG_CONFIG_PATH="$HOME/build/lib/pkgconfig:$HOME/quictls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig" \
            LDFLAGS="-Wl,-rpath,$HOME/quictls/build/lib" \
            --enable-http3
          make install
+        name: 'build nghttp2'

-  linux:
-    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
+  autotools:
+    name: ${{ matrix.build.name }}
    needs:
+      - setup
      - build-cache
    runs-on: 'ubuntu-latest'
-    timeout-minutes: 45
+    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        build:
          - name: quictls
-            PKG_CONFIG_PATH: '$HOME/quictls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/quictls/build/lib"
+              PKG_CONFIG_PATH="$HOME/quictls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/quictls/build/lib"
              --with-ngtcp2=$HOME/ngtcp2/build --enable-warnings --enable-werror --enable-debug --disable-ntlm
              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-openssl=$HOME/quictls/build --enable-ssls-export
-              --with-libuv
-
+              --with-openssl=$HOME/quictls/build
          - name: gnutls
-            PKG_CONFIG_PATH: '$HOME/gnutls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/gnutls/build/lib"
+              PKG_CONFIG_PATH="$HOME/gnutls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/gnutls/build/lib"
              --with-ngtcp2=$HOME/ngtcp2/build --enable-warnings --enable-werror --enable-debug
              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-gnutls=$HOME/gnutls/build --enable-ssls-export
-              --with-libuv
-
+              --with-gnutls=$HOME/gnutls/build
          - name: wolfssl
-            PKG_CONFIG_PATH: '$HOME/wolfssl/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/wolfssl/build/lib"
+              PKG_CONFIG_PATH="$HOME/wolfssl/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/wolfssl/build/lib"
              --with-ngtcp2=$HOME/ngtcp2/build --enable-warnings --enable-werror --enable-debug
              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
              --with-wolfssl=$HOME/wolfssl/build
-              --enable-ech --enable-ssls-export
-              --with-libuv
-
-          - name: wolfssl
-            PKG_CONFIG_PATH: '$HOME/wolfssl/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
-            generate: >-
-              -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON -DENABLE_DEBUG=ON
-              -DTEST_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DHTTPD_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DUSE_ECH=ON
-              -DCURL_USE_LIBUV=ON
-
          - name: openssl-quic
-            PKG_CONFIG_PATH: '$HOME/openssl/build/lib64/pkgconfig'
            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/openssl/build/lib64"
+              PKG_CONFIG_PATH="$HOME/openssl3/build/lib64/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/openssl3/build/lib64"
              --enable-warnings --enable-werror --enable-debug --disable-ntlm
              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-openssl=$HOME/openssl/build --with-openssl-quic
+              --with-openssl=$HOME/openssl3/build --with-openssl-quic
              --with-nghttp3=$HOME/nghttp3/build
-              --with-libuv
-
          - name: quiche
            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/quiche/target/release"
-              --with-openssl=$HOME/quiche/quiche/deps/boringssl/src
+              LDFLAGS="-Wl,-rpath,/home/runner/quiche/target/release"
+              --with-openssl=/home/runner/quiche/quiche/deps/boringssl/src
              --enable-warnings --enable-werror --enable-debug
-              --with-quiche=$HOME/quiche/target/release
+              --with-quiche=/home/runner/quiche/target/release
              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
              --with-ca-fallback
-              --with-libuv
-
-          - name: quiche
-            PKG_CONFIG_PATH: '$HOME/quiche/target/release'
-            generate: >-
-              -DOPENSSL_ROOT_DIR=$HOME/quiche/quiche/deps/boringssl/src -DENABLE_DEBUG=ON
-              -DUSE_QUICHE=ON
-              -DTEST_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DHTTPD_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DCURL_CA_FALLBACK=ON
-              -DCURL_USE_LIBUV=ON

    steps:
-      - name: 'install prereqs'
-        run: |
+      - run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake ninja-build pkgconf stunnel4 \
+          sudo apt-get update
+          sudo apt-get install libtool autoconf automake pkg-config stunnel4 \
            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev \
            nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin \
            libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools \
-            texinfo texlive texlive-extra-utils autopoint libev-dev libuv1-dev \
+            texinfo texlive texlive-extra-utils autopoint libev-dev \
            apache2 apache2-dev libnghttp2-dev vsftpd
-          python3 -m venv $HOME/venv
          echo 'CC=gcc-12' >> $GITHUB_ENV
          echo 'CXX=g++-12' >> $GITHUB_ENV
+        name: 'install prereqs and impacket, pytest, crypto, apache2'

-      - name: 'cache quictls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache quictls
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-quictls-no-deprecated
        env:
          cache-name: cache-quictls-no-deprecated
        with:
-          path: ~/quictls/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quictls-version }}-quic1
+          path: /home/runner/quictls/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quictls-version }}
          fail-on-cache-miss: true

-      - name: 'cache gnutls'
-        if: matrix.build.name == 'gnutls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache gnutls
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-gnutls
        env:
          cache-name: cache-gnutls
        with:
-          path: ~/gnutls/build
+          path: /home/runner/gnutls/build
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.gnutls-version }}
          fail-on-cache-miss: true

-      - name: 'cache wolfssl'
-        if: matrix.build.name == 'wolfssl'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache wolfssl
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-wolfssl
        env:
          cache-name: cache-wolfssl
+          wolfssl-version: ${{ needs.setup.outputs.wolfssl-version }}
        with:
-          path: ~/wolfssl/build
+          path: /home/runner/wolfssl/build
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
          fail-on-cache-miss: true

-      - name: 'cache nghttp3'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache nghttp3
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-nghttp3
        env:
          cache-name: cache-nghttp3
        with:
-          path: ~/nghttp3/build
+          path: /home/runner/nghttp3/build
          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp3-version }}
          fail-on-cache-miss: true

-      - name: 'cache ngtcp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache ngtcp2
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-ngtcp2
        env:
          cache-name: cache-ngtcp2
        with:
-          path: ~/ngtcp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.ngtcp2-version }}-${{ env.quictls-version }}-${{ env.gnutls-version }}-${{ env.wolfssl-version }}
+          path: /home/runner/ngtcp2/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.ngtcp2-version }}
          fail-on-cache-miss: true

-      - name: 'cache nghttp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      - name: cache nghttp2
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-nghttp2
        env:
          cache-name: cache-nghttp2
        with:
-          path: ~/nghttp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp2-version }}-${{ env.quictls-version }}-${{ env.ngtcp2-version }}-${{ env.nghttp3-version }}
+          path: /home/runner/nghttp2/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp2-version }}
          fail-on-cache-miss: true

-      - name: 'cache openssl'
+      - name: cache openssl3
        if: matrix.build.name == 'openssl-quic'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-openssl
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-openssl3
        env:
-          cache-name: cache-openssl
+          cache-name: cache-openssl3
        with:
-          path: ~/openssl/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.openssl-version }}
+          path: /home/runner/openssl3/build
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.openssl3-version }}

-      - name: 'install openssl'
-        if: matrix.build.name == 'openssl-quic' && steps.cache-openssl.outputs.cache-hit != 'true'
+      - name: 'install openssl3'
+        if: matrix.build.name == 'openssl-quic' && steps.cache-openssl3.outputs.cache-hit != 'true'
        run: |
-          git clone --quiet --depth=1 -b openssl-${{ env.openssl-version }} https://github.com/openssl/openssl
+          git clone --quiet --depth=1 -b ${{ env.openssl3-version }} https://github.com/openssl/openssl
          cd openssl
-          ./config --prefix=$HOME/openssl/build no-makedepend no-apps no-docs no-tests
-          make
+          ./config --prefix=$HOME/openssl3/build
          make -j1 install_sw
          cat exporters/openssl.pc

-      - name: 'cache quiche'
+      - name: cache quiche
        if: matrix.build.name == 'quiche'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-quiche
        env:
          cache-name: cache-quiche
        with:
-          path: ~/quiche
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quiche-version }}
+          path: /home/runner/quiche
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-quiche-${{ env.quiche-version }}

-      - name: 'build quiche and boringssl'
-        if: matrix.build.name == 'quiche' && steps.cache-quiche.outputs.cache-hit != 'true'
+      - if: matrix.build.name == 'quiche' && steps.cache-quiche.outputs.cache-hit != 'true'
        run: |
          cd $HOME
          git clone --quiet --depth=1 -b ${{ env.quiche-version }} --recursive https://github.com/cloudflare/quiche.git
@ -416,103 +415,63 @@ jobs:
          ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/

          # include dir
-          # $HOME/quiche/quiche/deps/boringssl/src/include
+          # /home/runner/quiche/quiche/deps/boringssl/src/include
          # lib dir
-          # $HOME/quiche/quiche/deps/boringssl/src/lib
+          # /home/runner/quiche/quiche/deps/boringssl/src/lib
+        name: 'build quiche and boringssl'

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - name: cache mod_h2
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-mod_h2
+        env:
+          cache-name: cache-mod_h2
        with:
-          persist-credentials: false
+          path: /home/runner/mod_h2
+          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.mod_h2-version }}

-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
-
-      - name: 'configure'
+      - if: steps.cache-mod_h2.outputs.cache-hit != 'true'
        run: |
-          if [ -n '${{ matrix.build.PKG_CONFIG_PATH }}' ]; then
-            export PKG_CONFIG_PATH="${{ matrix.build.PKG_CONFIG_PATH }}"
-          fi
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_C_COMPILER_TARGET=$(uname -m)-pc-linux-gnu -DBUILD_STATIC_LIBS=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              ${{ matrix.build.generate }}
-          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              ${{ matrix.build.configure }}
-          fi
+          cd $HOME
+          git clone --quiet --depth=1 -b v${{ env.mod_h2-version }} https://github.com/icing/mod_h2
+          cd mod_h2
+          autoreconf -fi
+          ./configure
+          make
+        name: 'build mod_h2'

-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+      - run: |
+          cd $HOME/mod_h2
+          sudo make install
+        name: 'install mod_h2'

-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

-      - name: 'test configs'
-        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
+      - run: |
+          sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
+        name: 'install python test prereqs'

-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose
-          else
-            make -C bld V=1
-          fi
+      - run: autoreconf -fi
+        name: 'autoreconf'

-      - name: 'check curl -V output'
-        run: bld/src/curl -V
+      - run: ./configure --disable-dependency-tracking ${{ matrix.build.configure }}
+        name: 'configure'

-      - name: 'build tests'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
+      - run: make V=1
+        name: 'make'

-      - name: 'install test prereqs'
-        run: |
-          source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/requirements.txt
+      - run: make V=1 examples
+        name: 'make examples'

-      - name: 'run tests'
+      - run: make V=1 -C tests
+        name: 'make tests'
+
+      - run: make V=1 test-ci
+        name: 'run tests'
        env:
-          TFLAGS: '${{ matrix.build.tflags }}'
-        run: |
-          source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target test-ci
-          else
-            make -C bld V=1 test-ci
-          fi
+          TFLAGS: "${{ matrix.build.tflags }}"

-      - name: 'install pytest prereqs'
-        run: |
-          source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/http/requirements.txt
-
-      - name: 'run pytest event based'
+      - run: pytest -v tests
+        name: 'run pytest'
        env:
-          CURL_TEST_EVENT: 1
+          TFLAGS: "${{ matrix.build.tflags }}"
          CURL_CI: github
-          PYTEST_ADDOPTS: '--color=yes'
-        run: |
-          source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-pytest-ci
-          else
-            make -C bld V=1 pytest-ci
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-examples
-          else
-            make -C bld V=1 examples
-          fi
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@ -10,7 +10,7 @@
 # https://github.com/actions/labeler

 name: Labeler
-'on': [pull_request_target]
+on: [pull_request_target]

 jobs:
  label:
@ -23,4 +23,4 @@ jobs:
    steps:
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
        with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
--- a/.github/workflows/linkcheck.yml
+++ b/.github/workflows/linkcheck.yml
@ -0,0 +1,41 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Markdown links
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - '.github/workflows/linkcheck.yml'
+      - '**.md'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '.github/workflows/linkcheck.yml'
+      - '**.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  # Docs: https://github.com/marketplace/actions/markdown-link-check
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        name: checkout
+
+      - name: trim the cmdline docs markdown files
+        run: find docs/cmdline-opts -name "*.md" ! -name "_*" ! -name MANPAGE.md | xargs -n1 ./.github/scripts/cleancmd.pl
+
+      - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
+        with:
+          use-quiet-mode: 'yes'
--- a/.github/workflows/linux-old.yml
+++ b/.github/workflows/linux-old.yml
@ -18,13 +18,14 @@

 name: Old Linux

-'on':
+on:
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -36,6 +37,7 @@ name: Old Linux
      - master
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -51,7 +53,7 @@ env:

 jobs:
  cmake:
-    name: linux (cmake & autoconf)
+    name: linux (cmake)
    runs-on: 'ubuntu-latest'
    container: 'debian:stretch'

@ -60,89 +62,42 @@ jobs:
        # Remember, this shell is dash, not bash
        run: |
          sed -E -i -e s@[a-z]+\.debian\.org/@archive.debian.org/debian-archive/@ -e '/ stretch-updates /d' /etc/apt/sources.list
-          apt-get -o Dpkg::Use-Pty=0 update
+          apt-get update
          # See comment above if this fails after 2025-05-20
-          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends httrack
+          apt-get install -y --no-install-suggests --no-install-recommends httrack
          httrack --get https://deb.freexian.com/extended-lts/pool/main/f/freexian-archive-keyring/freexian-archive-keyring_2022.06.08_all.deb
          dpkg -i freexian-archive-keyring_2022.06.08_all.deb
          echo 'deb http://deb.freexian.com/extended-lts stretch-lts main contrib non-free' | tee /etc/apt/sources.list.d/extended-lts.list
-          apt-get -o Dpkg::Use-Pty=0 update
-          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends cmake make automake autoconf libtool gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libssl1.0-dev libssh-dev libssh2-1-dev libc-ares-dev heimdal-dev libldap2-dev librtmp-dev stunnel4 groff
+          apt-get update
+          apt-get install -y --no-install-suggests --no-install-recommends cmake make gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libssl1.0-dev libssh-dev libssh2-1-dev libc-ares-dev heimdal-dev libldap2-dev stunnel4 groff
          # GitHub's actions/checkout needs a newer glibc. This one is the
          # latest available for buster, the next stable release after stretch.
          httrack --get https://security.debian.org/debian-security/pool/updates/main/g/glibc/libc6_2.28-10+deb10u4_amd64.deb
          dpkg -i libc6_*_amd64.deb

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: 'cmake build-only (out-of-tree, libssh2)'
        run: |
          mkdir bld-1
          cd bld-1
-          cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
-            -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=ON -DCURL_USE_LIBSSH=OFF -DUSE_LIBRTMP=ON
+          cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=ON -DCURL_USE_LIBSSH=OFF
          make install
          src/curl --disable --version

-      - name: 'cmake build-only curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld-1/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld-1/lib/curl_config.h | sort || true
-
-      # when this job can get a libssh version 0.9.0 or later, this should get
-      # that enabled again
-      - name: 'cmake generate (out-of-tree, c-ares, zstd, gssapi)'
+      - name: 'cmake generate (out-of-tree, c-ares, libssh, zstd, gssapi)'
        run: |
          mkdir bld-cares
          cd bld-cares
-          cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
-            -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_LIBRTMP=ON \
-            -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON
+          cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON -DENABLE_ARES=ON -DCURL_ZSTD=ON -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON

-      - name: 'cmake curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld-cares/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld-cares/lib/curl_config.h | sort || true
-
-      - name: 'cmake build'
+      - name: 'build'
        run: |
          make -C bld-cares
          bld-cares/src/curl --disable --version

-      - name: 'cmake install'
+      - name: 'install'
        run: make -C bld-cares install

-      - name: 'cmake build tests'
-        run: make -C bld-cares testdeps
-
-      - name: 'cmake run tests'
+      - name: 'tests'
        run: make -C bld-cares test-ci
-
-      - name: 'autoreconf'
-        run: autoreconf -if
-
-      - name: 'configure (out-of-tree, c-ares, libssh2, zstd, gssapi)'
-        run: |
-          mkdir bld-am
-          cd bld-am
-          ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-            --with-openssl --enable-ares --with-libssh2 --with-zstd --with-gssapi --with-librtmp \
-            --prefix="$PWD"/../install-am
-
-      - name: 'autoconf curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld-am/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld-am/lib/curl_config.h | sort || true
-
-      - name: 'autoconf build'
-        run: |
-          make -C bld-am
-          bld-am/src/curl --disable --version
-
-      - name: 'autoconf install'
-        run: make -C bld-am install
-
-      - name: 'autoconf build tests'
-        run: make -C bld-am/tests all
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@ -4,13 +4,14 @@

 name: Linux

-'on':
+on:
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -22,6 +23,7 @@ name: Linux
      - master
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -37,313 +39,203 @@ permissions: {}

 env:
  MAKEFLAGS: -j 5
-  CURL_CLANG_TIDYFLAGS: '-checks=-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,-clang-analyzer-valist.Uninitialized'
  # unhandled
  bearssl-version: 0.6
  # renovate: datasource=github-tags depName=libressl-portable/portable versioning=semver registryUrl=https://github.com
-  libressl-version: 4.0.0
-  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-  wolfssl-version: 5.7.6
-  # renovate: datasource=github-tags depName=wolfSSL/wolfssh versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-  wolfssh-version: 1.4.19
-  # renovate: datasource=github-tags depName=Mbed-TLS/mbedtls versioning=semver registryUrl=https://github.com
-  mbedtls-version: 3.6.2
+  libressl-version: 3.9.2
+  # renovate: datasource=github-tags depName=ARMmbed/mbedtls versioning=semver registryUrl=https://github.com
+  mbedtls-version: 3.6.0
+  # renovate: datasource=github-tags depName=icing/mod_h2 versioning=semver registryUrl=https://github.com
+  mod_h2-version: 2.0.29
  # renovate: datasource=github-tags depName=nibanks/msh3 versioning=semver registryUrl=https://github.com
  msh3-version: 0.6.0
-  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
-  awslc-version: 1.45.0
  # handled in renovate.json
-  openssl-version: 3.4.1
-  # handled in renovate.json
-  quictls-version: 3.3.0
+  openssl3-version: openssl-3.1.3
+  # unhandled
+  quictls-version: 3.1.4+quic
  # renovate: datasource=github-tags depName=rustls/rustls-ffi versioning=semver registryUrl=https://github.com
-  rustls-version: 0.14.1
+  rustls-version: 0.13.0

 jobs:
-  linux:
-    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
-    runs-on: ${{ matrix.build.image || 'ubuntu-latest' }}
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
    container: ${{ matrix.build.container }}
-    timeout-minutes: 45
+    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        build:
          - name: bearssl
-            install_packages: zlib1g-dev
+            install_packages: zlib1g-dev valgrind
            install_steps: bearssl pytest
            configure: LDFLAGS="-Wl,-rpath,$HOME/bearssl/lib" --with-bearssl=$HOME/bearssl --enable-debug
+            singleuse: --unit

-          - name: bearssl clang
+          - name: bearssl-clang
            install_packages: zlib1g-dev clang
            install_steps: bearssl
            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/bearssl/lib" --with-bearssl=$HOME/bearssl --enable-debug
+            singleuse: --unit

-          - name: libressl heimdal
-            install_packages: zlib1g-dev heimdal-dev
+          - name: libressl
+            install_packages: zlib1g-dev valgrind
            install_steps: libressl pytest
-            configure: LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --with-gssapi --enable-debug
+            configure: LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug
+            singleuse: --unit

-          - name: libressl heimdal valgrind
-            install_packages: zlib1g-dev heimdal-dev valgrind
-            install_steps: libressl pytest
-            generate: -DOPENSSL_ROOT_DIR=$HOME/libressl -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON
-
-          - name: libressl clang
+          - name: libressl-clang
            install_packages: zlib1g-dev clang
            install_steps: libressl
            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug
+            singleuse: --unit

-          - name: wolfssl-all
-            install_packages: zlib1g-dev
-            install_steps: wolfssl-all wolfssh
-            configure: LDFLAGS="-Wl,-rpath,$HOME/wolfssl-all/lib" --with-wolfssl=$HOME/wolfssl-all --with-wolfssh=$HOME/wolfssh --enable-ech --enable-debug
-
-          - name: wolfssl-opensslextra valgrind
-            install_packages: zlib1g-dev valgrind
-            install_steps: wolfssl-opensslextra
-            configure: LDFLAGS="-Wl,-rpath,$HOME/wolfssl-opensslextra/lib" --with-wolfssl=$HOME/wolfssl-opensslextra --enable-debug
-
-          - name: mbedtls valgrind
+          - name: mbedtls
            install_packages: libnghttp2-dev valgrind
            install_steps: mbedtls pytest
            configure: LDFLAGS="-Wl,-rpath,$HOME/mbedtls/lib" --with-mbedtls=$HOME/mbedtls --enable-debug
+            singleuse: --unit

-          - name: mbedtls clang
+          - name: mbedtls-clang
            install_packages: libnghttp2-dev clang
            install_steps: mbedtls
            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/mbedtls/lib" --with-mbedtls=$HOME/mbedtls --enable-debug
-
-          - name: mbedtls
-            install_packages: libnghttp2-dev
-            install_steps: mbedtls
-            PKG_CONFIG_PATH: '$HOME/mbedtls/lib/pkgconfig'  # Requires v3.6.0 or v2.28.8
-            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON
-
-          - name: mbedtls-pkg
-            install_packages: libnghttp2-dev libmbedtls-dev
-            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
-
-          - name: mbedtls-pkg !pc
-            install_packages: libnghttp2-dev libmbedtls-dev
-            install_steps: skipall
-            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_USE_PKGCONFIG=OFF
+            singleuse: --unit

          - name: msh3
-            install_packages: zlib1g-dev
+            install_packages: zlib1g-dev valgrind
            install_steps: quictls msh3
            configure: LDFLAGS="-Wl,-rpath,$HOME/msh3/lib -Wl,-rpath,$HOME/quictls/lib" --with-msh3=$HOME/msh3 --with-openssl=$HOME/quictls --enable-debug
+            singleuse: --unit

-          - name: msh3
-            install_packages: zlib1g-dev
-            install_steps: quictls msh3 skipall
-            PKG_CONFIG_PATH: '$HOME/msh3/lib/pkgconfig'  # Broken as of v0.6.0
-            generate: -DOPENSSL_ROOT_DIR=$HOME/quictls -DUSE_MSH3=ON -DMSH3_INCLUDE_DIR=$HOME/msh3/include -DMSH3_LIBRARY=$HOME/msh3/lib/libmsh3.so -DENABLE_DEBUG=ON
-
-          - name: awslc
-            install_packages: zlib1g-dev
-            install_steps: awslc
-            configure: LDFLAGS="-Wl,-rpath,$HOME/awslc/lib" --with-openssl=$HOME/awslc --enable-ech
-
-          - name: awslc
-            install_packages: zlib1g-dev
-            install_steps: awslc
-            generate: -DOPENSSL_ROOT_DIR=$HOME/awslc -DUSE_ECH=ON -DCMAKE_UNITY_BUILD=OFF
-
-          - name: openssl default
-            install_steps: pytest
-            configure: --with-openssl --enable-debug --disable-unity
-
-          - name: openssl libssh2 sync-resolver valgrind
-            install_packages: zlib1g-dev libssh2-1-dev valgrind
-            install_steps: pytest
-            configure: --with-openssl --enable-debug --disable-threaded-resolver --with-libssh2
-
-          - name: openssl
-            install_packages: zlib1g-dev
-            install_steps: pytest
-            configure: CFLAGS=-std=gnu89 --with-openssl --enable-debug
-
-          - name: openssl -O3 valgrind
+          - name: openssl3
            install_packages: zlib1g-dev valgrind
-            configure: CFLAGS=-O3 --with-openssl --enable-debug
+            install_steps: gcc-11 openssl3 pytest
+            configure: CFLAGS=-std=gnu89 LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets
+            singleuse: --unit

-          - name: openssl clang krb5
-            install_packages: zlib1g-dev libkrb5-dev clang
-            configure: CC=clang --with-openssl --with-gssapi --enable-debug --disable-docs --disable-manual
+          - name: openssl3-O3
+            install_packages: zlib1g-dev valgrind
+            install_steps: gcc-11 openssl3
+            configure: CPPFLAGS=-DCURL_WARN_SIGN_CONVERSION CFLAGS=-O3 LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets
+            singleuse: --unit

-          - name: openssl clang krb5 LTO
-            install_packages: zlib1g-dev libkrb5-dev clang
-            install_steps: skipall
-            generate: -DCURL_USE_OPENSSL=ON -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LTO=ON
-
-          - name: openssl !ipv6
-            configure: --with-openssl --disable-ipv6 --enable-debug --disable-unity
-
-          - name: openssl https-only
-            configure: >-
-              --with-openssl --enable-debug --disable-unity
-              --disable-dict --disable-gopher --disable-ldap --disable-telnet
-              --disable-imap --disable-pop3 --disable-smtp
-              --disable-rtmp --disable-rtsp
-              --disable-scp --disable-sftp --disable-tftp --disable-ftp --disable-file --disable-smb
-
-          - name: openssl torture !FTP
-            install_packages: zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON
-            tflags: -t --shallow=25 !FTP
-            torture: true
-
-          - name: openssl torture FTP
-            install_packages: zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON
-            tflags: -t --shallow=20 FTP
-            torture: true
-
-          - name: openssl i686
-            install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 librtmp-dev:i386 libssh2-1-dev:i386 libidn2-0-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386
-            configure: >-
-              PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig
-              CC=i686-linux-gnu-gcc-14
-              CPPFLAGS=-I/usr/include/i386-linux-gnu
-              LDFLAGS=-L/usr/lib/i386-linux-gnu
-              --host=i686-linux-gnu
-              --with-openssl --with-librtmp --with-libssh2 --with-libidn2 --enable-ares --enable-debug
-
-          - name: '!ssl !http !smtp !imap'
-            configure: --without-ssl --enable-debug --disable-http --disable-smtp --disable-imap --disable-unity
-
-          - name: clang-tidy
-            install_packages: clang-tidy libssl-dev libssh2-1-dev
-            install_steps: skipall
-            configure: --with-openssl --with-libssh2
-            make-custom-target: tidy
-
-          - name: scanbuild
-            install_packages: clang-tools clang libssl-dev libssh2-1-dev
-            install_steps: skipall
-            configure: --with-openssl --enable-debug --with-libssh2 --disable-unity
-            configure-prefix: CC=clang scan-build
-            make-prefix: scan-build --status-bugs
+          - name: openssl3-clang
+            install_packages: zlib1g-dev clang
+            install_steps: openssl3
+            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets
+            singleuse: --unit

          - name: address-sanitizer
            install_packages: zlib1g-dev libssh2-1-dev clang libssl-dev libubsan1 libasan8 libtsan2
            install_steps: pytest
-            configure: >-
+            configure: >
              CC=clang
              CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g"
              LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer"
              LIBS="-ldl -lubsan"
-              --with-openssl --enable-debug
-
-          - name: thread-sanitizer
-            install_packages: zlib1g-dev clang libtsan2
-            install_steps: pytest openssl-tsan
-            configure: >-
-              CC=clang
-              CFLAGS="-fsanitize=thread -g"
-              LDFLAGS="-fsanitize=thread -Wl,-rpath,$HOME/openssl/lib"
-              --with-openssl=$HOME/openssl --enable-debug
+              --with-openssl --enable-debug --enable-websockets
+            singleuse: --unit

          - name: memory-sanitizer
            install_packages: clang
-            configure: >-
+            install_steps:
+            configure: >
              CC=clang
              CFLAGS="-fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds -g"
              LDFLAGS="-fsanitize=memory"
              LIBS="-ldl"
-              --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug
+              --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug --enable-websockets
+            singleuse: --unit

          - name: event-based
-            install_packages: libssh-dev
+            install_packages: libssh-dev valgrind
            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
-            tflags: -n --test-event '!TLS-SRP'
+            tflags: -n -e '!TLS-SRP'
+            singleuse: --unit

-          - name: duphandle
-            install_packages: libssh-dev
-            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
-            tflags: -n --test-duphandle '!TLS-SRP'
-
-          - name: rustls valgrind
-            install_packages: valgrind
-            install_steps: rust rustls pytest
-            configure: --with-rustls=$HOME/rustls --enable-debug
+          - name: hyper
+            install_steps: rust hyper valgrind
+            configure: LDFLAGS="-Wl,-rpath,$HOME/hyper/target/debug" --with-openssl --with-hyper=$HOME/hyper --enable-debug --enable-websockets
+            singleuse: --unit

          - name: rustls
-            install_steps: rust rustls skipall
-            PKG_CONFIG_PATH: '$HOME/rustls/lib/pkgconfig'  # Not built as of v0.14.0
-            generate: -DCURL_USE_RUSTLS=ON -DRUSTLS_INCLUDE_DIR=$HOME/rustls/include -DRUSTLS_LIBRARY=$HOME/rustls/lib/librustls.a -DENABLE_DEBUG=ON
+            install_steps: rust rustls pytest valgrind libpsl-dev
+            configure: --with-rustls=$HOME/rustls --enable-debug
+            singleuse: --unit

-          - name: IntelC openssl
-            install_packages: zlib1g-dev libssl-dev
+          - name: Intel compiler - without SSL
+            install_packages: zlib1g-dev valgrind
+            install_steps: intel
+            configure: CC=icc --enable-debug --without-ssl
+            singleuse: --unit
+
+          - name: Intel compiler - OpenSSL
+            install_packages: zlib1g-dev libssl-dev valgrind
            install_steps: intel
            configure: CC=icc --enable-debug --with-openssl
+            singleuse: --unit

-          - name: Slackware openssl gssapi gcc
+          - name: Slackware-openssl-with-gssapi-gcc
            # These are essentially the same flags used to build the curl Slackware package
            # https://ftpmirror.infania.net/slackware/slackware64-current/source/n/curl/curl.SlackBuild
            configure: --with-openssl --with-libssh2 --with-gssapi --enable-ares --enable-static=no --without-ca-bundle --with-ca-path=/etc/ssl/certs
            # Docker Hub image that `container-job` executes in
            container: 'andy5995/slackware-build-essential:15.0'

-          - name: Alpine MUSL https-rr
-            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-threaded-resolver --enable-ares --enable-httpsrr
-            container: 'alpine:3.20'
-
-          - name: Alpine MUSL c-ares https-rr
-            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --disable-threaded-resolver --enable-ares --enable-httpsrr --disable-unity
-            container: 'alpine:3.20'
+          - name: Alpine MUSL
+            configure: --enable-debug --enable-websockets --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl
+            container: 'alpine:3.18'
+            singleuse: --unit

    steps:
-      - name: 'install prereqs'
-        if: matrix.build.container == null && !contains(matrix.build.name, 'i686')
+      - if: matrix.build.container == null
        run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake pkgconf ninja-build \
-            ${{ matrix.build.install_steps != 'skipall' && matrix.build.install_steps != 'skiprun' && 'stunnel4' || '' }} \
-            libpsl-dev libbrotli-dev libzstd-dev \
-            ${{ matrix.build.install_packages }} \
-            ${{ contains(matrix.build.install_steps, 'pytest') && 'apache2 apache2-dev libnghttp2-dev vsftpd' || '' }}
-          python3 -m venv $HOME/venv
+          sudo apt-get update
+          sudo apt-get install libtool autoconf automake pkg-config stunnel4 libpsl-dev libbrotli-dev libzstd-dev ${{ matrix.build.install_packages }}
+          sudo python3 -m pip install impacket
+        name: 'install prereqs and impacket'

-      - name: 'install prereqs'
-        if: contains(matrix.build.name, 'i686')
+      - if: startsWith(matrix.build.container, 'alpine')
        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo dpkg --add-architecture i386
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake pkgconf stunnel4 \
-            libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386 \
-            ${{ matrix.build.install_packages }}
-          python3 -m venv $HOME/venv
+          apk add --no-cache build-base autoconf automake libtool perl openssl-dev libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev heimdal-dev libpsl-dev py3-impacket py3-asn1 py3-six py3-pycryptodomex perl-time-hires openssh stunnel sudo git
+        name: 'install dependencies'

-      - name: 'install dependencies'
-        if: startsWith(matrix.build.container, 'alpine')
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: Fix kernel mmap rnd bits
+        # Asan in llvm 14 provided in ubuntu 22.04 is incompatible with
+        # high-entropy ASLR in much newer kernels that GitHub runners are
+        # using leading to random crashes: https://reviews.llvm.org/D148280
+        # See https://github.com/actions/runner-images/issues/9491
+        continue-on-error: true
+        run: sudo sysctl vm.mmap_rnd_bits=28
+
+      - if: contains(matrix.build.install_steps, 'gcc-11')
        run: |
-          apk add --no-cache build-base autoconf automake libtool perl openssl-dev \
-            libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev \
-            heimdal-dev libpsl-dev c-ares-dev \
-            py3-impacket py3-asn1 py3-six py3-pycryptodomex \
-            perl-time-hires openssh stunnel sudo git
+          sudo add-apt-repository ppa:ubuntu-toolchain-r/ppa
+          sudo apt-get update
+          sudo apt-get install gcc-11
+          sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 100
+          sudo update-alternatives --set gcc /usr/bin/gcc-11
+          gcc --version
+        name: 'install gcc-11'

-      - name: 'cache bearssl'
+      - name: cache bearssl
        if: contains(matrix.build.install_steps, 'bearssl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-bearssl
        env:
          cache-name: cache-bearssl
        with:
-          path: ~/bearssl
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.bearssl-version }}
+          path: /home/runner/bearssl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-bearssl-${{ env.bearssl-version }}

      - name: 'build bearssl'
        if: contains(matrix.build.install_steps, 'bearssl') && steps.cache-bearssl.outputs.cache-hit != 'true'
        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://bearssl.org/bearssl-${{ env.bearssl-version }}.tar.gz
+          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://bearssl.org/bearssl-${{ env.bearssl-version }}.tar.gz
          tar -xzf bearssl-${{ env.bearssl-version }}.tar.gz
          cd bearssl-${{ env.bearssl-version }}
          make
@ -351,212 +243,115 @@ jobs:
          cp inc/*.h $HOME/bearssl/include
          cp build/libbearssl.* $HOME/bearssl/lib

-      - name: 'cache libressl'
+      - name: cache libressl
        if: contains(matrix.build.install_steps, 'libressl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-libressl
        env:
          cache-name: cache-libressl
        with:
-          path: ~/libressl
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.libressl-version }}
+          path: /home/runner/libressl
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-libressl-${{ env.libressl-version }}

      - name: 'build libressl'
        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/libressl/portable/releases/download/v${{ env.libressl-version }}/libressl-${{ env.libressl-version }}.tar.gz
-          tar -xzf libressl-${{ env.libressl-version }}.tar.gz
-          cd libressl-${{ env.libressl-version }}
+          git clone --quiet --depth=1 -b v${{ env.libressl-version }} https://github.com/libressl-portable/portable.git libressl-git
+          cd libressl-git
+          ./autogen.sh
          ./configure --disable-dependency-tracking --prefix=$HOME/libressl
          make install

-      - name: 'cache wolfssl (all)'
-        if: contains(matrix.build.install_steps, 'wolfssl-all')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssl-all
-        env:
-          cache-name: cache-wolfssl-all
-        with:
-          path: ~/wolfssl-all
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
-
-      - name: 'build wolfssl (all)'
-        if: contains(matrix.build.install_steps, 'wolfssl-all') && steps.cache-wolfssl-all.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/wolfSSL/wolfssl/archive/v${{ env.wolfssl-version }}-stable.tar.gz
-          tar -xzf v${{ env.wolfssl-version }}-stable.tar.gz
-          cd wolfssl-${{ env.wolfssl-version }}-stable
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-all \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=$HOME/wolfssl-all
-          make install
-
-      - name: 'cache wolfssl (opensslextra)'
-        if: contains(matrix.build.install_steps, 'wolfssl-opensslextra')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssl-opensslextra
-        env:
-          cache-name: cache-wolfssl-opensslextra
-        with:
-          path: ~/wolfssl-opensslextra
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
-
-      - name: 'build wolfssl (opensslextra)'
-        if: contains(matrix.build.install_steps, 'wolfssl-opensslextra') && steps.cache-wolfssl-opensslextra.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/wolfSSL/wolfssl/archive/v${{ env.wolfssl-version }}-stable.tar.gz
-          tar -xzf v${{ env.wolfssl-version }}-stable.tar.gz
-          cd wolfssl-${{ env.wolfssl-version }}-stable
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-opensslextra \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=$HOME/wolfssl-opensslextra
-          make install
-
-      - name: 'cache wolfssh'
-        if: contains(matrix.build.install_steps, 'wolfssl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssh
-        env:
-          cache-name: cache-wolfssh
-        with:
-          path: ~/wolfssh
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssh-version }}-${{ env.wolfssl-version }}
-
-      - name: 'build wolfssh'
-        if: contains(matrix.build.install_steps, 'wolfssh') && steps.cache-wolfssh.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/wolfSSL/wolfssh/archive/v${{ env.wolfssh-version }}-stable.tar.gz
-          tar -xzf v${{ env.wolfssh-version }}-stable.tar.gz
-          cd wolfssh-${{ env.wolfssh-version }}-stable
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --with-wolfssl=$HOME/wolfssl-all --enable-scp --enable-sftp --disable-term \
-            --disable-examples --prefix=$HOME/wolfssh
-          make install
-
-      - name: 'cache mbedtls'
+      - name: cache mbedtls
        if: contains(matrix.build.install_steps, 'mbedtls')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-mbedtls
        env:
-          cache-name: cache-mbedtls-threadsafe
+          cache-name: cache-mbedtls
        with:
-          path: ~/mbedtls
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mbedtls-version }}
+          path: /home/runner/mbedtls
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-mbedtls-${{ env.mbedtls-version }}

      - name: 'build mbedtls'
        if: contains(matrix.build.install_steps, 'mbedtls') && steps.cache-mbedtls.outputs.cache-hit != 'true'
        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${{ env.mbedtls-version }}/mbedtls-${{ env.mbedtls-version }}.tar.bz2
-          tar -xjf mbedtls-${{ env.mbedtls-version }}.tar.bz2
-          cd mbedtls-${{ env.mbedtls-version }}
-          ./scripts/config.py set MBEDTLS_THREADING_C
-          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
-          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=$HOME/mbedtls \
-            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
-          cmake --build .
-          cmake --install .
+          git clone --quiet --depth=1 -b v${{ env.mbedtls-version }} https://github.com/ARMmbed/mbedtls
+          cd mbedtls
+          git submodule update --init
+          make DESTDIR=$HOME/mbedtls install

-      - name: 'cache openssl (thread sanitizer)'
-        if: contains(matrix.build.install_steps, 'openssl-tsan')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-openssl-tsan
+      - name: cache openssl3
+        if: contains(matrix.build.install_steps, 'openssl3')
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-openssl3
        env:
-          cache-name: cache-openssl-tsan
+          cache-name: cache-openssl3
        with:
-          path: ~/openssl
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.openssl-version }}
+          path: /home/runner/openssl3
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.openssl3-version }}

-      - name: 'build openssl (thread sanitizer)'
-        if: contains(matrix.build.install_steps, 'openssl-tsan') && steps.cache-openssl-tsan.outputs.cache-hit != 'true'
+      - name: 'install openssl3'
+        if: contains(matrix.build.install_steps, 'openssl3') && steps.cache-openssl3.outputs.cache-hit != 'true'
        run: |
-          git clone --quiet --depth=1 -b openssl-${{ env.openssl-version }} https://github.com/openssl/openssl
+          git clone --quiet --depth=1 -b ${{ env.openssl3-version }} https://github.com/openssl/openssl
          cd openssl
-          CC="clang" CFLAGS="-fsanitize=thread" LDFLAGS="-fsanitize=thread" ./config --prefix=$HOME/openssl --libdir=lib no-makedepend no-apps no-docs no-tests
-          make
+          ./config --prefix=$HOME/openssl3 --libdir=lib
          make -j1 install_sw

-      - name: 'cache quictls'
+      - name: cache quictls
        if: contains(matrix.build.install_steps, 'quictls')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-quictls
        env:
          cache-name: cache-quictls
        with:
-          path: ~/quictls
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.quictls-version }}-quic1
+          path: /home/runner/quictls
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-quictls-${{ env.quictls-version }}

      - name: 'build quictls'
        if: contains(matrix.build.install_steps, 'quictls') && steps.cache-quictls.outputs.cache-hit != 'true'
        run: |
-          git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }}-quic1 https://github.com/quictls/openssl
+          git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }} https://github.com/quictls/openssl
          cd openssl
-          ./config --prefix=$HOME/quictls --libdir=lib no-makedepend no-apps no-docs no-tests
-          make
+          ./config --prefix=$HOME/quictls --libdir=lib
          make -j1 install_sw

-      - name: 'cache msh3'
+      - name: cache msh3
        if: contains(matrix.build.install_steps, 'msh3')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
        id: cache-msh3
        env:
          cache-name: cache-msh3
        with:
-          path: ~/msh3
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.msh3-version }}
+          path: /home/runner/msh3
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-msh3-${{ env.msh3-version }}

      - name: 'build msh3'
        if: contains(matrix.build.install_steps, 'msh3') && steps.cache-msh3.outputs.cache-hit != 'true'
        run: |
-          git clone --quiet --depth=1 -b v${{ env.msh3-version }} --recursive https://github.com/nibanks/msh3
-          cd msh3
-          cmake -B . -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=$HOME/msh3
+          git clone --quiet -b v${{ env.msh3-version }} --depth=1 --recursive https://github.com/nibanks/msh3
+          cd msh3 && mkdir build && cd build
+          cmake -G 'Unix Makefiles' -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=$HOME/msh3 ..
          cmake --build .
          cmake --install .

-      - name: 'cache awslc'
-        if: contains(matrix.build.install_steps, 'awslc')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-awslc
-        env:
-          cache-name: cache-awslc
-        with:
-          path: ~/awslc
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
-
-      - name: 'build awslc'
-        if: contains(matrix.build.install_steps, 'awslc') && steps.cache-awslc.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
-          tar xzf v${{ env.awslc-version }}.tar.gz
-          mkdir aws-lc-${{ env.awslc-version }}-build
-          cd aws-lc-${{ env.awslc-version }}-build
-          cmake -G Ninja -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }} -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF
-          cmake --build .
-          cmake --install .
-
-      - name: 'cache rustls'
-        if: contains(matrix.build.install_steps, 'rustls')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-rustls
-        env:
-          cache-name: cache-rustls
-        with:
-          path: ~/rustls
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.rustls-version }}
-
-      - name: 'install rust'
-        if: contains(matrix.build.install_steps, 'rust') && steps.cache-rustls.outputs.cache-hit != 'true'
+      - if: contains(matrix.build.install_steps, 'rust')
        run: |
          cd $HOME
          curl -sSf --compressed https://sh.rustup.rs/ | sh -s -- -y
          source $HOME/.cargo/env
-          rustup toolchain install stable --profile minimal
+          rustup toolchain install nightly
+        name: 'install rust'
+
+      - name: cache rustls
+        if: contains(matrix.build.install_steps, 'rustls')
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-rustls
+        env:
+          cache-name: cache-rustls
+        with:
+          path: /home/runner/rustls
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-rustls-${{ env.rustls-version }}

      - name: 'build rustls'
        if: contains(matrix.build.install_steps, 'rustls') && steps.cache-rustls.outputs.cache-hit != 'true'
@ -565,144 +360,91 @@ jobs:
          cd rustls-ffi
          make DESTDIR=$HOME/rustls install

-      - name: 'install Intel compilers'
-        if: contains(matrix.build.install_steps, 'intel')
+      - if: contains(matrix.build.install_steps, 'hyper')
        run: |
-          curl -sSf --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | sudo tee /etc/apt/trusted.gpg.d/intel-sw.asc >/dev/null
+          cd $HOME
+          git clone --quiet --depth=1 https://github.com/hyperium/hyper.git
+          cd $HOME/hyper
+          RUSTFLAGS="--cfg hyper_unstable_ffi" cargo +nightly rustc --features client,http1,http2,ffi -Z unstable-options --crate-type cdylib
+          echo "LD_LIBRARY_PATH=$HOME/hyper/target/debug:/usr/local/lib" >> $GITHUB_ENV
+        name: 'install hyper'
+
+      - if: contains(matrix.build.install_steps, 'intel')
+        run: |
+          cd /tmp
+          curl -sSf --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | sudo apt-key add -
          sudo add-apt-repository "deb https://apt.repos.intel.com/oneapi all main"
-          sudo apt-get -o Dpkg::Use-Pty=0 install intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
+          sudo apt install --no-install-recommends intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
          source /opt/intel/oneapi/setvars.sh
          printenv >> $GITHUB_ENV
+        name: 'install Intel compilers'

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
-
-      - name: 'configure'
+      - if: contains(matrix.build.install_steps, 'pytest')
        run: |
-          [[ '${{ matrix.build.install_steps }}' = *'awslc'* ]] && sudo apt-get -o Dpkg::Use-Pty=0 purge libssl-dev
-          if [ -n '${{ matrix.build.PKG_CONFIG_PATH }}' ]; then
-            export PKG_CONFIG_PATH="${{ matrix.build.PKG_CONFIG_PATH }}"
-          fi
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_INSTALL_PREFIX="$HOME/curl" \
-              -DCMAKE_C_COMPILER_TARGET=$(uname -m)-pc-linux-gnu -DBUILD_STATIC_LIBS=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              ${{ matrix.build.generate }}
-          else
-            mkdir bld && cd bld && \
-            ${{ matrix.build.configure-prefix }} \
-            ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              ${{ matrix.build.configure }}
-          fi
+          sudo apt-get install apache2 apache2-dev libnghttp2-dev vsftpd
+          sudo python3 -m pip install -r tests/http/requirements.txt
+        name: 'install pytest and apach2-dev'

-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'test configs'
-        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
-
-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            ${{ matrix.build.make-prefix }} cmake --build bld --verbose
-          else
-            ${{ matrix.build.make-prefix }} make -C bld V=1 ${{ matrix.build.make-custom-target }}
-          fi
-
-      - name: 'single-use function check'
-        if: ${{ contains(matrix.build.configure, '--disable-unity') || contains(matrix.build.generate, '-DCMAKE_UNITY_BUILD=OFF') }}
-        run: |
-          git config --global --add safe.directory "*"
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            libcurla=bld/lib/libcurl.a
-          else
-            libcurla=bld/lib/.libs/libcurl.a
-          fi
-          ./scripts/singleuse.pl --unit ${libcurla}
-
-      - name: 'check curl -V output'
-        if: ${{ matrix.build.make-custom-target != 'tidy' }}
-        run: bld/src/curl -V
-
-      - name: 'cmake install'
-        if: ${{ matrix.build.generate }}
-        run: cmake --install bld --strip
-
-      - name: 'build tests'
-        if: ${{ matrix.build.install_steps != 'skipall' }}
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'install test prereqs'
-        if: ${{ matrix.build.install_steps != 'skipall' && matrix.build.container == null }}
-        run: |
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/requirements.txt
-
-      - name: 'run tests'
-        if: ${{ matrix.build.install_steps != 'skipall' && matrix.build.install_steps != 'skiprun' }}
-        timeout-minutes: ${{ contains(matrix.build.install_packages, 'valgrind') && 30 || 15 }}
-        run: |
-          export TFLAGS='${{ matrix.build.tflags }}'
-          if [ -z '${{ matrix.build.torture }}' ]; then
-            if [[ '${{ matrix.build.install_steps }}' = *'wolfssh'* ]]; then
-              TFLAGS+=' ~SFTP'
-            fi
-            if [[ '${{ matrix.build.install_packages }}' = *'valgrind'* ]]; then
-              TFLAGS+=' -j6'
-            fi
-            if [[ '${{ matrix.build.install_packages }}' = *'heimdal-dev'* ]]; then
-              TFLAGS+=' ~2077 ~2078'  # valgrind errors
-            fi
-          fi
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          else
-            make -C bld V=1 ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          fi
-
-      - name: 'install pytest prereqs'
-        if: contains(matrix.build.install_steps, 'pytest')
-        run: |
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/http/requirements.txt
-
-      - name: 'run pytest'
+      - name: cache mod_h2
        if: contains(matrix.build.install_steps, 'pytest')
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        id: cache-mod_h2
        env:
-          CURL_CI: github
-          PYTEST_ADDOPTS: '--color=yes'
-        run: |
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-pytest-ci
-          else
-            make -C bld V=1 pytest-ci
-          fi
+          cache-name: cache-mod_h2
+        with:
+          path: /home/runner/mod_h2
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mod_h2-version }}

-      - name: 'build examples'
-        if: ${{ matrix.build.make-custom-target != 'tidy' }}
+      - name: 'build mod_h2'
+        if: contains(matrix.build.install_steps, 'pytest') && steps.cache-mod_h2.outputs.cache-hit != 'true'
        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            ${{ matrix.build.make-prefix }} cmake --build bld --verbose --target curl-examples
-          else
-            ${{ matrix.build.make-prefix }} make -C bld V=1 examples
-          fi
+          cd $HOME
+          git clone --quiet --depth=1 -b v${{ env.mod_h2-version }} https://github.com/icing/mod_h2
+          cd mod_h2
+          autoreconf -fi
+          ./configure
+          make
+
+      - name: 'install mod_h2'
+        if: contains(matrix.build.install_steps, 'pytest')
+        run: |
+          cd $HOME/mod_h2
+          sudo make install
+
+      - run: autoreconf -fi
+        name: 'autoreconf'
+
+      - run: ./configure --disable-dependency-tracking --enable-warnings --enable-werror ${{ matrix.build.configure }}
+        name: 'configure'
+
+      - run: make V=1
+        name: 'make'
+
+      - run: |
+          git config --global --add safe.directory "*"
+          ./scripts/singleuse.pl ${{ matrix.build.singleuse }} lib/.libs/libcurl.a
+        name: single-use function check
+
+      - run: ./src/curl -V
+        name: 'check curl -V output'
+
+      - run: make V=1 examples
+        name: 'make examples'
+
+      - run: make V=1 -C tests
+        name: 'make tests'
+
+      - run: make V=1 test-ci
+        name: 'run tests'
+        env:
+          TFLAGS: "${{ matrix.build.tflags }}"
+
+      - if: contains(matrix.build.install_steps, 'pytest')
+        # run for `tests` directory, so pytest does not pick up any other
+        # packages we might have built here
+        run:
+          pytest -v tests
+        name: 'run pytest'
+        env:
+          TFLAGS: "${{ matrix.build.tflags }}"
+          CURL_CI: github
--- a/.github/workflows/linux32.yml
+++ b/.github/workflows/linux32.yml
@ -0,0 +1,92 @@
+# Copyright (C) Dan Fandrich
+#
+# SPDX-License-Identifier: curl
+
+name: Linux 32-bit
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+
+jobs:
+  linux-i686:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-22.04'
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - name: Linux i686
+            install_packages: gcc-11-i686-linux-gnu libssl-dev:i386 zlib1g-dev:i386 libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386
+            configure: --enable-debug --enable-websockets --with-openssl --host=i686-linux-gnu CC=i686-linux-gnu-gcc-11 PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig CPPFLAGS=-I/usr/include/i386-linux-gnu LDFLAGS=-L/usr/lib/i386-linux-gnu
+
+    steps:
+      - run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo dpkg --add-architecture i386
+          sudo apt-get update -y
+          sudo apt-get install -y --no-install-suggests --no-install-recommends libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install_packages }}
+          sudo python3 -m pip install impacket
+        name: 'install prereqs'
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - run: autoreconf -fi
+        name: 'autoreconf'
+
+      - run: ./configure --disable-dependency-tracking --enable-warnings --enable-werror ${{ matrix.build.configure }}
+        name: 'configure'
+
+      - run: make V=1
+        name: 'make'
+
+      - run: ./src/curl -V
+        name: 'check curl -V output'
+
+      - run: make V=1 examples
+        name: 'make examples'
+
+      - run: make V=1 -C tests
+        name: 'make tests'
+
+      - run: make V=1 test-ci
+        name: 'run tests'
+        env:
+          TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@ -4,13 +4,14 @@

 name: macOS

-'on':
+on:
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -22,6 +23,7 @@ name: macOS
      - master
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -39,321 +41,228 @@ permissions: {}
 # deprecation warnings with llvm/clang:
 #
 # - 10.7  Lion (2011)          - GSS
-# - 10.8  Mountain Lion (2012) - CFURLCreateDataAndPropertiesFromResource (used by curl Secure Transport code)
+# - 10.8  Mountain Lion (2012) - CFURLCreateDataAndPropertiesFromResource (used by curl SecureTransport code)
 # - 10.9  Maverick (2013)      - LDAP
-# - 10.14 Mojave (2018)        - Secure Transport
+# - 10.14 Mojave (2018)        - SecureTransport
 #
-# For Secure Transport, curl implements features that require a target
+# For SecureTransport, curl implements features that require a target
 # newer than the 10.8 required by `CFURLCreateDataAndPropertiesFromResource`.
+# In this case `-Wno-deprecated-declarations` still comes handy to pacify
+# deprecation warnings, though the real solution would be to avoid calling
+# that function.

 env:
-  MAKEFLAGS: -j 4
  LDFLAGS: -w  # suppress 'object file was built for newer macOS version than being linked' warnings
+  MAKEFLAGS: -j 4

 jobs:
-  macos:
-    name: "${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.build.name }}"
+  autotools:
+    name: 'AM ${{ matrix.compiler }} ${{ matrix.name }}'
    runs-on: 'macos-latest'
-    timeout-minutes: 45
+    timeout-minutes: 60
    env:
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
      CC: ${{ matrix.compiler }}
-      CFLAGS: ''
+      CFLAGS: '-mmacosx-version-min=${{ matrix.macos-version-min }}'
    strategy:
      fail-fast: false
      matrix:
-        compiler: [clang, llvm@15, gcc-12]
-        build:
-          # automake
-          - name: '!ssl !debug brotli zstd'
+        include:
+          - name: '!ssl !debug'
            compiler: clang
-            install: brotli zstd
-            configure: --without-ssl --with-brotli --with-zstd
+            configure: --without-ssl --enable-websockets
+            macos-version-min: '10.9'
          - name: '!ssl !debug'
            compiler: gcc-12
-            configure: --without-ssl
+            configure: --without-ssl --enable-websockets
+            macos-version-min: '10.9'
          - name: '!ssl'
            compiler: clang
-            configure: --enable-debug --without-ssl
-          - name: '!ssl libssh2 AppleIDN'
+            configure: --enable-debug --without-ssl --enable-websockets
+            macos-version-min: '10.9'
+          - name: '!ssl libssh2'
            compiler: clang
-            configure: --enable-debug --with-libssh2=$(brew --prefix libssh2) --without-ssl --with-apple-idn
+            configure: --enable-debug --with-libssh2=$(brew --prefix libssh2) --without-ssl --enable-websockets
+            macos-version-min: '10.9'
          - name: 'OpenSSL libssh c-ares'
            compiler: clang
            install: libssh
-            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl) --enable-ares
+            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl) --enable-ares --enable-websockets
+            macos-version-min: '10.9'
          - name: 'OpenSSL libssh'
            compiler: llvm@15
            install: libssh
-            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl)
+            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl) --enable-websockets
+            macos-version-min: '10.9'
          - name: '!ssl c-ares'
            compiler: clang
-            configure: --enable-debug --enable-ares --without-ssl
+            configure: --enable-debug --enable-ares --without-ssl --enable-websockets
+            macos-version-min: '10.9'
          - name: '!ssl HTTP-only'
            compiler: clang
-            configure: >-
-              --enable-debug
-              --disable-alt-svc --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap
-              --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp
-              --disable-shared --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets
-              --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2
+            configure: |
+              --enable-debug \
+              --disable-alt-svc --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap \
+              --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp \
+              --disable-shared --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets \
+              --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 \
              --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib --without-zstd

            macos-version-min: '10.15'  # Catalina (2019)
          - name: 'SecureTransport libssh2'
            compiler: clang
-            configure: --enable-debug --with-secure-transport --with-libssh2=$(brew --prefix libssh2)
+            configure: --enable-debug --with-secure-transport --enable-websockets --with-libssh2=$(brew --prefix libssh2)
            macos-version-min: '10.8'
          - name: 'SecureTransport libssh2 10.12'
            compiler: clang
-            configure: --enable-debug --with-secure-transport --with-libssh2=$(brew --prefix libssh2)
+            configure: --enable-debug --with-secure-transport --enable-websockets --with-libssh2=$(brew --prefix libssh2)
            macos-version-min: '10.12'  # for monotonic timers
+            cflags: '-Wno-deprecated-declarations'
          - name: 'SecureTransport libssh2'
            compiler: gcc-12
-            configure: --enable-debug --with-secure-transport --with-libssh2=$(brew --prefix libssh2)
+            configure: --enable-debug --with-secure-transport --enable-websockets --with-libssh2=$(brew --prefix libssh2)
            macos-version-min: '10.8'
-          - name: 'LibreSSL +examples'
+          - name: 'LibreSSL'
            compiler: clang
            install: libressl
-            configure: --enable-debug --with-openssl=$(brew --prefix libressl)
+            configure: --enable-debug --with-openssl=$(brew --prefix libressl) --enable-websockets
+            macos-version-min: '10.9'
          - name: 'OpenSSL'
            compiler: clang
-            configure: --enable-debug --with-openssl=$(brew --prefix openssl)
-          - name: 'OpenSSL event-based'
-            compiler: clang
-            configure: --enable-debug --with-openssl=$(brew --prefix openssl)
-            tflags: --test-event
-          - name: 'quictls libssh2 !ldap 10.15'
-            compiler: clang
-            install: quictls
-            configure: --enable-debug --disable-ldap --with-openssl=$(brew --prefix quictls) LDFLAGS="${LDFLAGS} -L$(brew --prefix quictls)/lib"
-            macos-version-min: '10.15'
-          # cmake
-          - name: 'OpenSSL gsasl rtmp AppleIDN'
-            install: gsasl rtmpdump
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DCURL_USE_GSASL=ON -DUSE_LIBRTMP=ON -DUSE_APPLE_IDN=ON
-          - name: 'OpenSSL AppleIDN clang-tidy +examples'
-            install: llvm
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DUSE_APPLE_IDN=ON -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=$(brew --prefix llvm)/bin/clang-tidy
-            clang-tidy: true
-            chkprefill: _chkprefill
-          - name: 'quictls +static libssh +examples'
-            install: quictls libssh
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix quictls) -DBUILD_STATIC_LIBS=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON
-          - name: 'SecureTransport debug'
-            generate: -DCURL_USE_SECTRANSP=ON -DENABLE_DEBUG=ON
-            macos-version-min: '10.8'
-          - name: 'LibreSSL !ldap heimdal c-ares +examples'
-            install: libressl heimdal
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix libressl) -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=$(brew --prefix heimdal) -DCURL_DISABLE_LDAP=ON
-          - name: 'wolfSSL !ldap brotli zstd'
-            install: brotli wolfssl zstd
-            generate: -DCURL_USE_WOLFSSL=ON -DCURL_DISABLE_LDAP=ON -DUSE_ECH=ON
-          - name: 'mbedTLS openldap brotli zstd'
-            install: brotli mbedtls zstd openldap
-            generate: -DCURL_USE_MBEDTLS=ON -DLDAP_INCLUDE_DIR="$(brew --prefix openldap)/include" -DLDAP_LIBRARY="$(brew --prefix openldap)/lib/libldap.dylib" -DLDAP_LBER_LIBRARY="$(brew --prefix openldap)/lib/liblber.dylib"
-          - name: 'GnuTLS !ldap krb5'
-            install: gnutls nettle krb5
-            generate: -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=$(brew --prefix krb5) -DCURL_DISABLE_LDAP=ON -DUSE_SSLS_EXPORT=ON
+            configure: --enable-debug --with-openssl=$(brew --prefix openssl) --enable-websockets
+            macos-version-min: '10.9'
          - name: 'OpenSSL torture !FTP'
-            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=$(brew --prefix openssl)
-            tflags: -t --shallow=25 !FTP
-            torture: true
+            compiler: clang
+            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=$(brew --prefix openssl) --enable-websockets
+            tflags: -n -t --shallow=25 !FTP
+            macos-version-min: '10.9'
          - name: 'OpenSSL torture FTP'
-            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=$(brew --prefix openssl)
-            tflags: -t --shallow=20 FTP
-            torture: true
-        exclude:
-          - { compiler: llvm@15, build: { macos-version-min: '10.15' } }
-          - { compiler: llvm@15, build: { torture: true } }
-          - { compiler: gcc-12, build: { torture: true } }
-          - { compiler: llvm@15, build: { clang-tidy: true } }
-          - { compiler: gcc-12, build: { clang-tidy: true } }
-          # opt out jobs from combinations that have the compiler set manually
-          - { compiler: llvm@15, build: { compiler: 'clang' } }
-          - { compiler: llvm@15, build: { compiler: 'gcc-12' } }
-          - { compiler: gcc-12, build: { compiler: 'clang' } }
-          - { compiler: gcc-12, build: { compiler: 'llvm@15' } }
-          - { compiler: clang, build: { compiler: 'gcc-12' } }
-          - { compiler: clang, build: { compiler: 'llvm@15' } }
-
+            compiler: clang
+            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=$(brew --prefix openssl) --enable-websockets
+            tflags: -n -t --shallow=20 FTP
+            macos-version-min: '10.9'
+          - name: 'OpenSSL libssh2 !ldap 10.15'
+            compiler: clang
+            configure: --enable-debug --disable-ldap --with-openssl=$(brew --prefix openssl) --enable-websockets
+            macos-version-min: '10.15'
    steps:
      - name: 'brew install'
        # Run this command with retries because of spurious failures seen
        # while running the tests, for example
        # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
        run: |
-          echo ${{ matrix.build.generate && 'ninja' || 'automake libtool' }} \
-            pkgconf libpsl libssh2 \
-            ${{ !matrix.build.clang-tidy && 'libnghttp2 stunnel' || '' }} \
-            ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+          echo libtool autoconf automake pkg-config libpsl libssh2 nghttp2 openssl ${{ matrix.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done

      - name: 'brew unlink openssl'
-        if: ${{ contains(matrix.build.install, 'libressl') || contains(matrix.build.install, 'quictls') }}
        run: |
-          if test -d $(brew --prefix)/include/openssl; then
-            brew unlink openssl
-          fi
+          case "${{ matrix.install }}" in
+            *openssl*)
+              (
+                cd $(brew --prefix openssl)/lib/pkgconfig/
+                for i in libssl.pc libcrypto.pc; do
+                  sudo cp $i $i.orig
+                  sudo sed s,libdir=$(brew --prefix)'/Cellar/openssl@3/3.3.0$',libdir=$(brew --prefix)/Cellar/openssl@3/3.3.0/lib,g < $i.orig > /tmp/$i
+                  sudo cp /tmp/$i $i
+                  cat $i
+                done
+              )
+              ;;
+            *)
+              if test -d $(brew --prefix)/include/openssl; then
+                brew unlink openssl
+              fi;;
+          esac
+
+      - name: 'pip3 install'
+        run: |
+          python3 -m venv $HOME/venv
+          source $HOME/venv/bin/activate
+          python3 -m pip install impacket
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: 'toolchain versions'
        run: |
          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && "${CC}" --print-sysroot
+          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && \
+            grep -h -r -E -o '.+[0-9.]+\.sdk/' "$(dirname "$("${CC}" -print-libgcc-file-name)")/include-fixed" | sed -E 's/^\t+//g' | tr -d '"' | sort -u || true
          which "${CC}"; "${CC}" --version || true
          xcodebuild -version || true
-          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
-          xcrun --sdk macosx --show-sdk-version || true
-          ls -l /Library/Developer/CommandLineTools/SDKs || true
+          xcrun -sdk macosx --show-sdk-path 2>/dev/null || true
          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages installed'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'

      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
        run: autoreconf -fi

      - name: 'configure'
        run: |
+          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
+          CFLAGS+=' ${{ matrix.cflags }}'
          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
-          else
-            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
+            libgccdir="$(dirname "$("${CC}" -print-libgcc-file-name)")"
+            echo '::group::gcc include-fixed details'; find "${libgccdir}/include-fixed" | sort; echo '::endgroup::'
+            for f in dispatch os AvailabilityInternal.h stdio.h; do
+              if [ -r "${libgccdir}/include-fixed/${f}" ]; then
+                echo "Zap gcc hack: '${libgccdir}/include-fixed/${f}'"
+                mv "${libgccdir}/include-fixed/${f}" "${libgccdir}/include-fixed/${f}-BAK"
+              fi
+            done
          fi
-
          if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-            CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-            CC+=" --sysroot=${sysroot}"
+            options+=" --target=$(uname -m)-apple-darwin"
            CC+=" --target=$(uname -m)-apple-darwin"
          fi
-
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            for _chkprefill in '' ${{ matrix.build.chkprefill }}; do
-              options=''
-              [ -n '${{ matrix.build.macos-version-min }}' ] && options+=' -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.build.macos-version-min }}'
-              [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
-              cmake -B "bld${_chkprefill}" -G Ninja -D_CURL_PREFILL=ON \
-                -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-                -DCMAKE_OSX_SYSROOT="${sysroot}" \
-                -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-                ${{ matrix.build.generate }} ${options}
-            done
-            if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
-              echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
-              false
-            fi
-          else
-            export CFLAGS
-            if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-              options+=" --target=$(uname -m)-apple-darwin"
-            fi
-            if [ '${{ matrix.compiler }}' != 'clang' ]; then
-              options+=" --with-sysroot=${sysroot}"
-              CFLAGS+=" --sysroot=${sysroot}"
-            fi
-            [ -n '${{ matrix.build.macos-version-min }}' ] && CFLAGS+=' -mmacosx-version-min=${{ matrix.build.macos-version-min }}'
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              --with-libpsl=$(brew --prefix libpsl) \
-              ${{ matrix.build.configure }} ${options}
+          if [ '${{ matrix.compiler }}' != 'clang' ]; then
+            options+=" --with-sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
+            CFLAGS+=" --sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
          fi
+          mkdir bld && cd bld && ../configure --enable-warnings --enable-werror \
+            --disable-dependency-tracking \
+            --with-libpsl=$(brew --prefix libpsl) \
+            ${{ matrix.configure }} ${options}

      - name: 'configure log'
        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+        run: cat bld/config.log || true

      - name: 'curl_config.h'
        run: |
          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
+          cat bld/lib/curl_config.h | grep -F '#define' | sort || true

-      - name: 'build-cert'
-        if: contains(matrix.build.generate, '-DCURL_USE_SECTRANSP=ON') || contains(matrix.build.configure, '--with-secure-transport')
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --target clean-certs
-            cmake --build bld --target build-certs --parallel 1
-          else
-            make -C bld/tests/certs clean-certs
-            make -C bld/tests/certs build-certs -j1
-          fi
-
-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose
-          else
-            make -C bld V=1
-          fi
+      - name: 'make'
+        run: make -C bld V=1

      - name: 'curl version'
        run: bld/src/curl --disable --version

-      - name: 'build tests'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
+      - name: 'make examples'
+        run: make -C bld V=1 examples

-      - name: 'install test prereqs'
-        if: ${{ !matrix.build.clang-tidy }}
-        run: |
-          python3 -m venv $HOME/venv
-          source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/requirements.txt
+      - name: 'make tests'
+        run: make -C bld V=1 -C tests

      - name: 'run tests'
-        if: ${{ !matrix.build.clang-tidy }}
-        timeout-minutes: ${{ matrix.build.torture && 20 || 10 }}
        run: |
-          export TFLAGS='-j20 ${{ matrix.build.tflags }}'
-          if [ -z '${{ matrix.build.torture }}' ]; then
-            TFLAGS+=' ~2037 ~2041'  # flaky
-            if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-              TFLAGS+=' ~1156 ~1539'  # HTTP Content-Range, Content-Length
-              if [[ -n '${{ matrix.build.configure }}' || \
-                    '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-                TFLAGS+=' ~2100'  # 2100:'HTTP GET using DoH' https://github.com/curl/curl/actions/runs/9942146678/job/27462937524#step:15:5059
-              fi
-              if [[ '${{ matrix.build.configure }}' = *'--with-secure-transport'* || \
-                    '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-                TFLAGS+=' ~HTTP/2'  # 2400 2401 2402 2403 2404 2406, Secure Transport + nghttp2
-              else
-                TFLAGS+=' ~2402 ~2404'  # non-Secure Transport + nghttp2
-              fi
-            fi
-            if [[ '${{ matrix.build.configure }}' = *'--with-secure-transport'* || \
-                  '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-              TFLAGS+=' ~313'  # Secure Transport does not support crl file
-              TFLAGS+=' ~1631 ~1632'  # Secure Transport is not able to shutdown ftp over https gracefully yet
+          export TFLAGS='${{ matrix.tflags }} -j10'
+          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
+            TFLAGS+=' ~RTSP'  # 567 568 569 570 571 572 577 689 3100
+            TFLAGS+=' ~1156 ~1539'  # HTTP Content-Range, Content-Length
+            if [[ '${{ matrix.configure }}' = *'--with-secure-transport'* ]]; then
+              TFLAGS+=' ~2100'  # 2100:'HTTP GET using DoH' https://github.com/curl/curl/actions/runs/9942146678/job/27462937524#step:15:5059
+              TFLAGS+=' ~HTTP/2'  # 2400 2401 2402 2403 2404 2406, SecureTransport + nghttp2
+            else
+              TFLAGS+=' ~2402 ~2404'  # non-SecureTransport + nghttp2
            fi
          fi
-          source $HOME/venv/bin/activate
          rm -f $HOME/.curlrc
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --target ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          else
-            make -C bld V=1 ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          fi
+          make -C bld V=1 test-ci

-      - name: 'build examples'
-        if: ${{ contains(matrix.build.name, '+examples') }}
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-examples
-          else
-            make -C bld examples V=1
-          fi
-
-  combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, Secure Transport/not, built tool, combinations
-    if: true  # Set to `true` to enable this test matrix. It runs quickly.
-    name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }} ${{ matrix.config }}"
-    runs-on: ${{ matrix.image }}
+  cmake:
+    name: 'CM ${{ matrix.compiler }} ${{ matrix.build.name }}'
+    runs-on: 'macos-latest'
    timeout-minutes: 10
    env:
      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
@ -361,75 +270,201 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        config: [SecureTransport]  # also: OpenSSL
-        compiler: [gcc-12, gcc-13, gcc-14, llvm@15, llvm@18, clang]
-        # Xcode support matrix as of 2024-07, with default macOS SDK versions and OS names, years:
-        # * = default Xcode on the runner.
-        # macos-13: 14.1, 14.2, 14.3.1, 15.0.1, 15.1,*15.2
-        # macos-14:                     15.0.1, 15.1, 15.2, 15.3,*15.4
-        # macos-15:                                                    *16.0, 16.1
-        # macOSSDK: 13.0, 13.1, 13.3,   14.0,   14.2, 14.2, 14.4, 14.5, 15.0, 15.1
-        #           Ventura (2022)      Sonoma (2023)                   Sequoia (2024)
-        # https://github.com/actions/runner-images/tree/main/images/macos
-        # https://en.wikipedia.org/wiki/MacOS_version_history
-        image: [macos-13, macos-14, macos-15]
-        # Can skip these to reduce jobs:
-        #   15.1 has the same default macOS SDK as 15.2 and identical test result.
-        #   14.1, 15.4 not revealing new fallouts.
-        #xcode: ['14.1', '14.2', '14.3.1', '15.0.1', '15.1', '15.2', '15.3', '15.4', '16.0', '16.1']  # all Xcode
-        #xcode: ['14.1', '14.2', '14.3.1', '15.0.1'        , '15.2', '15.3', '15.4', '16.0', '16.1']  # all SDK
-        #xcode: [        '14.2', '14.3.1', '15.0.1'        , '15.2', '15.3'        , '16.0'        ]  # coverage
-        xcode: ['']  # default Xcodes
-        macos-version-min: ['']
-        build: [autotools, cmake]
+        compiler: [clang, llvm@15, gcc-12]
+        build:
+          - name: 'OpenSSL ws gsasl AppleIDN'
+            install: gsasl
+            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DCURL_USE_GSASL=ON -DUSE_APPLE_IDN=ON -DENABLE_WEBSOCKETS=ON
+            macos-version-min: '10.9'
+            tflags: '~1034 ~1035'  # AppleIDN issues: https://github.com/curl/curl/issues/14176
+          - name: 'OpenSSL +static'
+            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DBUILD_STATIC_LIBS=ON
+            macos-version-min: '10.9'
+          - name: 'SecureTransport ws debug+'
+            generate: -DCURL_USE_SECTRANSP=ON -DENABLE_WEBSOCKETS=ON -DENABLE_DEBUG=ON -DENABLE_CURLDEBUG=ON
+            macos-version-min: '10.8'
+          - name: 'LibreSSL !ldap'
+            install: libressl
+            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix libressl) -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DBUILD_EXAMPLES=ON
+            macos-version-min: '10.15'
+          - name: 'wolfSSL !ldap'
+            install: wolfssl
+            generate: -DCURL_USE_WOLFSSL=ON -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON
+            macos-version-min: '10.15'
+          - name: 'GnuTLS !ldap'
+            install: gnutls nettle
+            generate: -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON
+            macos-version-min: '10.15'
        exclude:
-          # Combinations uncovered by runner images:
-          - { image: macos-13, xcode: '15.3'   }
-          - { image: macos-13, xcode: '15.4'   }
-          - { image: macos-13, xcode: '16.0'   }
-          - { image: macos-13, xcode: '16.1'   }
-          - { image: macos-14, xcode: '14.1'   }
-          - { image: macos-14, xcode: '14.2'   }
-          - { image: macos-14, xcode: '14.3.1' }
-          - { image: macos-14, xcode: '16.0'   }
-          - { image: macos-14, xcode: '16.1'   }
-          - { image: macos-15, xcode: '14.1'   }
-          - { image: macos-15, xcode: '14.2'   }
-          - { image: macos-15, xcode: '14.3.1' }
-          - { image: macos-15, xcode: '15.0.1' }
-          - { image: macos-15, xcode: '15.1'   }
-          - { image: macos-15, xcode: '15.2'   }
-          - { image: macos-15, xcode: '15.3'   }
-          - { image: macos-15, xcode: '15.4'   }
-          - { image: macos-13, compiler: 'llvm@18' }
-          - { image: macos-14, compiler: 'llvm@18' }
-          - { image: macos-15, compiler: 'llvm@15' }
-          # Reduce build combinations, by dropping less interesting ones
-          - { compiler: gcc-12, config: SecureTransport }
-          - { compiler: gcc-13, build: cmake }
-          - { compiler: gcc-14, build: autotools }
+          - { compiler: llvm@15, build: { macos-version-min: '10.15' } }
+          - { compiler: llvm@15, build: { macos-version-min: '10.9' } }
    steps:
-      - name: 'install autotools'
-        if: ${{ matrix.build == 'autotools' }}
+      - name: 'brew install'
        run: |
-          echo automake libtool | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+          echo libtool autoconf automake pkg-config libpsl libssh2 nghttp2 openssl ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done

+      - name: 'brew unlink openssl'
+        run: |
+          case "${{ matrix.build.install }}" in
+            *openssl*)
+              ;;
+            *)
+              if test -d $(brew --prefix)/include/openssl; then
+                brew unlink openssl
+              fi;;
+          esac
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
      - name: 'toolchain versions'
        run: |
          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && "${CC}" --print-sysroot
+          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && \
+            grep -h -r -E -o '.+[0-9.]+\.sdk/' "$(dirname "$("${CC}" -print-libgcc-file-name)")/include-fixed" | sed -E 's/^\t+//g' | tr -d '"' | sort -u || true
          which "${CC}"; "${CC}" --version || true
          xcodebuild -version || true
-          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
-          xcrun --sdk macosx --show-sdk-version || true
-          ls -l /Library/Developer/CommandLineTools/SDKs || true
+          xcrun -sdk macosx --show-sdk-path 2>/dev/null || true
          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - name: 'cmake configure'
+        run: |
+          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
+          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
+            libgccdir="$(dirname "$("${CC}" -print-libgcc-file-name)")"
+            echo '::group::gcc include-fixed details'; find "${libgccdir}/include-fixed" | sort; echo '::endgroup::'
+            for f in dispatch os AvailabilityInternal.h stdio.h; do
+              if [ -r "${libgccdir}/include-fixed/${f}" ]; then
+                echo "Zap gcc hack: '${libgccdir}/include-fixed/${f}'"
+                mv "${libgccdir}/include-fixed/${f}" "${libgccdir}/include-fixed/${f}-BAK"
+              fi
+            done
+          fi
+          cmake -B bld -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
+            -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.build.macos-version-min }} \
+            "-DCMAKE_C_COMPILER_TARGET=$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
+            -DUSE_NGHTTP2=ON \
+            ${{ matrix.build.generate }}
+
+      - name: 'configure log'
+        if: ${{ !cancelled() }}
+        run: cat bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+
+      - name: 'curl_config.h'
+        run: |
+          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
+          cat bld/lib/curl_config.h | grep -F '#define' | sort || true
+
+      - name: 'cmake build'
+        run: make -C bld VERBOSE=1
+
+      - name: 'curl version'
+        run: bld/src/curl --disable --version
+
+      - name: 'cmake build tests'
+        run: make -C bld testdeps
+
+      - name: 'cmake run tests'
+        run: |
+          export TFLAGS='${{ matrix.build.tflags }} -j10'
+          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
+            TFLAGS+=' ~RTSP'  # 567 568 569 570 571 572 577 689 3100
+            TFLAGS+=' ~1156 ~1539'  # HTTP Content-Range, Content-Length
+            if [[ '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
+              TFLAGS+=' ~2100'  # 2100:'HTTP GET using DoH' https://github.com/curl/curl/actions/runs/9942146678/job/27462937524#step:15:5059
+              TFLAGS+=' ~HTTP/2'  # 2400 2401 2402 2403 2404 2406, SecureTransport + nghttp2
+            else
+              TFLAGS+=' ~2402 ~2404'  # non-SecureTransport + nghttp2
+            fi
+          fi
+          rm -f $HOME/.curlrc
+          make -C bld test-ci
+
+  combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, SecureTransport/not, built tool, combinations
+    if: true  # Set to `true` to enable this test matrix. It runs quickly.
+    name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }} ${{ matrix.config }}"
+    runs-on: ${{ matrix.image }}
+    timeout-minutes: 30
+    env:
+      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
+      CC: ${{ matrix.compiler }}
+    strategy:
+      fail-fast: false
+      matrix:
+        config: [SecureTransport]  # also: OpenSSL
+        compiler: [gcc-11, gcc-12, gcc-13, gcc-14, llvm@15, clang]
+        # Xcode support matrix as of 2024-07, with default macOS SDK versions and OS names, years:
+        # * = default Xcode on the runner.
+        # macos-12: 13.1, 13.2.1, 13.3.1, 13.4.1, 14.0.1, 14.1,*14.2
+        # macos-13:                                       14.1, 14.2, 14.3.1,*15.0.1, 15.1, 15.2
+        # macos-14:                                                   14.3.1, 15.0.1, 15.1, 15.2, 15.3,*15.4, 16.0
+        # macOSSDK: 12.0, 12.1,   12.3,   12.3,   12.3,   13.0, 13.1, 13.3,   14.0,   14.2, 14.2, 14.4, 14.5, 15.0
+        #           Monterey (2021)                       Ventura (2022)      Sonoma (2023)                   Sequoia (2024)
+        # https://github.com/actions/runner-images/tree/main/images/macos
+        # https://en.wikipedia.org/wiki/MacOS_version_history
+        image: [macos-12, macos-13, macos-14]
+        # Can skip these to reduce jobs:
+        #   13.1, 13.2.1 are fairly old.
+        #   13.3.1, 14.0.1 have the same default macOS SDK as 13.4.1 and identical test results.
+        #   15.1 has the same default macOS SDK as 15.2 and identical test result.
+        #   14.1, 15.4 not revealing new fallouts.
+        #xcode: ['13.1', '13.2.1', '13.3.1', '13.4.1', '14.0.1', '14.1', '14.2', '14.3.1', '15.0.1', '15.1', '15.2', '15.3', '15.4', '16.0']  # all Xcode
+        #xcode: ['13.1', '13.2.1', '13.4.1', '14.1', '14.2', '14.3.1', '15.0.1', '15.2', '15.3', '15.4', '16.0']  # all SDK
+        #xcode: ['13.4.1', '14.2', '14.3.1', '15.0.1', '15.2', '15.3', '16.0']  # coverage
+        xcode: ['']  # default Xcodes
+        macos-version-min: ['10.8']
+        build: [autotools, cmake]
+        exclude:
+          # Combinations uncovered by runner images:
+          - { image: macos-12, xcode: '14.3.1' }
+          - { image: macos-12, xcode: '15.0.1' }
+          - { image: macos-12, xcode: '15.1'   }
+          - { image: macos-12, xcode: '15.2'   }
+          - { image: macos-12, xcode: '15.3'   }
+          - { image: macos-12, xcode: '15.4'   }
+          - { image: macos-12, xcode: '16.0'   }
+          - { image: macos-13, xcode: '13.1'   }
+          - { image: macos-13, xcode: '13.2.1' }
+          - { image: macos-13, xcode: '13.3.1' }
+          - { image: macos-13, xcode: '13.4.1' }
+          - { image: macos-13, xcode: '14.0.1' }
+          - { image: macos-13, xcode: '15.3'   }
+          - { image: macos-13, xcode: '15.4'   }
+          - { image: macos-13, xcode: '16.0'   }
+          - { image: macos-14, xcode: '13.1'   }
+          - { image: macos-14, xcode: '13.2.1' }
+          - { image: macos-14, xcode: '13.3.1' }
+          - { image: macos-14, xcode: '13.4.1' }
+          - { image: macos-14, xcode: '14.0.1' }
+          - { image: macos-14, xcode: '14.1'   }
+          - { image: macos-14, xcode: '14.2'   }
+          # Reduce build combinations, by dropping less interesting ones
+          - { compiler: gcc-11, build: autotools }
+          - { compiler: gcc-11, image: macos-14 }
+          - { compiler: gcc-12, config: SecureTransport }
+          - { compiler: gcc-13, build: cmake }
+          - { compiler: gcc-13, image: macos-13 }
+          - { compiler: gcc-14, config: SecureTransport }
+    steps:
+      - name: 'install autotools'
+        if: ${{ matrix.build == 'autotools' }}
+        run: |
+          echo autoconf automake libtool openssl | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: 'toolchain versions'
+        run: |
+          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
+          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && \
+            grep -h -r -E -o '.+[0-9.]+\.sdk/' "$(dirname "$("${CC}" -print-libgcc-file-name)")/include-fixed" | sed -E 's/^\t+//g' | tr -d '"' | sort -u || true
+          which "${CC}"; "${CC}" --version || true
+          xcodebuild -version || true
+          xcrun -sdk macosx --show-sdk-path 2>/dev/null || true
+          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
+          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'

      - name: 'autoreconf'
        if: ${{ matrix.build == 'autotools' }}
@ -437,50 +472,132 @@ jobs:

      - name: 'configure / ${{ matrix.build }}'
        run: |
+          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
+
+          # gcc ships with an `include-fixed` header set, which overrides SDK
+          # headers with the intent of making them compatible with gcc. The
+          # source for these headers is:
+          #   https://github.com/gcc-mirror/gcc/tree/master/fixincludes
+          # with extra Apple-specific patches applied from here for Homebrew:
+          #   https://github.com/iains/gcc-12-branch
+          #
+          # They pass through a generator phase at build-time which seems to
+          # pick the SDK installed on the build machine (maintained by the
+          # Homebrew project in our case) and patches it according to a set
+          # of rules in `inclhack.def`.
+          #
+          # Homebrew builds and ships different binaries for different macOS
+          # versions and CPUs, built on machines using the same OS version as
+          # the target one. Each of these machines have a particular version
+          # of Apple CommandLineTools with a default SDK version installed with
+          # them.
+          #
+          # Then this binary gets installed onto the end-user machine,
+          # matching the OS version at the time of installation.
+          #
+          # The problem with this approach is that the SDK version picked up
+          # at gcc build-time has a high chance of being or becoming out of
+          # sync with actual SDK installed on the end-user machine. This
+          # can happen after upgrading the OS, Xcode, selecting an SDK version
+          # manually, or other reasons.
+          #
+          # When the SDK versions do not match, the gcc hacks, instead of
+          # improving compatibility the SDK, are actively _breaking_
+          # compatibility, in an unexpected, hard to diagnose way.
+          #
+          # The SDK version used for gcc-hacks is not advertised. We can
+          # extract the major SDK version from the generated gcc-hack header
+          # files, assuming someone knows what to look for and where.
+          #
+          # Basically it also means that the same `gcc-N` Homebrew package
+          # behaves differently depending on the OS it was built on. Causing
+          # an explosion of build combination. It may also mean that a minor
+          # gcc version bump is built against a different SDK version, and due
+          # to the extra patch for the hack applied by Homebrew, there may
+          # be extra changes as well.
+          #
+          # For GHA runners, it means that the default Xcode + OS combo is
+          # broken in 8 out of 12 combinations (66%) have an SDK mismatch,
+          # and 9 fail to build (75%). These are the 3 lucky default
+          # combinations that worked to build curl:
+          #   macos-14 + Xcode 15.0.1 + gcc-11, gcc-12, gcc-14
+          #
+          # Of all possible valid GHA runner, gcc, manually selected Xcode
+          # combinations, 40% are broken.
+          #
+          # Compared to mainline llvm: llvm ships the same binaries regardless
+          # of build-OS or environent, it contains no SDK-version-specific
+          # hacks, and has no 3rd party patches. This still leaves some
+          # occasional issues, but works much closer to expectations.
+          #
+          # Some of these hacks are helpful, in particular for fixing this
+          # issue via math.h:
+          #   /Applications/Xcode_14.3.1.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/math.h:53:5: error: #error "Unsupported value of
+          #      53 | #   error "Unsupported value of __FLT_EVAL_METHOD__."
+          #
+          # Errors seen in available CI combinations:
+          #   error: two or more data types in declaration specifiers # fatal error: AvailabilityInternalLegacy.h: No such file or directory
+          #     gcc-11, gcc-13 + macos-14 + Xcode 14.3.1
+          #   error: two or more data types in declaration specifiers
+          #     gcc-13 + macos-12 + Xcode 14.1, 14.2
+          #     gcc-13 + Xcode 15.0.1, 15.1, 5.2
+          #   error: expected ';' before 'extern'
+          #     gcc-11, gcc-12, gcc-14 + macos-12 + Xcode 14.1, 14.2
+          #   error: unknown type name 'dispatch_queue_t'
+          #     gcc-11, gcc-12 + macos-13 + Xcode 15.0.1, 15.1, 15.2
+          #   error: type defaults to 'int' in declaration of 'DISPATCH_DECL_FACTORY_CLASS_SWIFT' [-Wimplicit-int]
+          #     gcc-14 macos-13 Xcode 15.0.1, 15.1, 15.2
+          #   error: unknown type name 'FILE'
+          #     Xcode 16.0
+          #
+          # Unbreak Homebrew gcc builds by moving problematic SDK header overlay
+          # directories/files out of the way:
          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
-          else
-            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
+            # E.g.:
+            #   $(brew --prefix)/Cellar/gcc@11/11.4.0/lib/gcc/11/gcc/aarch64-apple-darwin23/11/include-fixed
+            #   $(brew --prefix)/Cellar/gcc@11/11.4.0/lib/gcc/11/gcc/x86_64-apple-darwin21/11/include-fixed
+            #   $(brew --prefix)/Cellar/gcc/14.1.0_1/lib/gcc/14/gcc/x86_64-apple-darwin21/14/include-fixed
+            libgccdir="$(dirname "$("${CC}" -print-libgcc-file-name)")"
+            echo '::group::gcc include-fixed details'; find "${libgccdir}/include-fixed" | sort; echo '::endgroup::'
+            patch_out='dispatch os AvailabilityInternal.h'
+            patch_out+=' stdio.h'  # for Xcode 16 error: unknown type name 'FILE'
+            for f in ${patch_out}; do
+              if [ -r "${libgccdir}/include-fixed/${f}" ]; then
+                echo "Zap gcc hack: '${libgccdir}/include-fixed/${f}'"
+                mv "${libgccdir}/include-fixed/${f}" "${libgccdir}/include-fixed/${f}-BAK"
+              fi
+            done
          fi

-          if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-            CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-            CC+=" --sysroot=${sysroot}"
-            CC+=" --target=$(uname -m)-apple-darwin"
-          fi
-
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=' -DCURL_USE_OPENSSL=ON'
-            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' -DCURL_USE_SECTRANSP=ON'
-            [ -n '${{ matrix.macos-version-min }}' ] && options+=' -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.macos-version-min }}'
-            # would pick up nghttp2, libidn2, and libssh2
-            cmake -B bld -D_CURL_PREFILL=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              -DCMAKE_OSX_SYSROOT="${sysroot}" \
-              -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-              -DCMAKE_IGNORE_PREFIX_PATH="$(brew --prefix)" \
-              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF \
-              -DUSE_NGHTTP2=OFF -DUSE_LIBIDN2=OFF \
-              -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF \
-              ${options}
-          else
+          if [ '${{ matrix.build }}' = 'autotools' ]; then
            export CFLAGS
            if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
              options+=" --target=$(uname -m)-apple-darwin"
+              CC+=" --target=$(uname -m)-apple-darwin"
            fi
            if [ '${{ matrix.compiler }}' != 'clang' ]; then
-              options+=" --with-sysroot=${sysroot}"
-              CFLAGS+=" --sysroot=${sysroot}"
+              options+=" --with-sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
+              CFLAGS+=" --sysroot=$(xcrun -sdk macosx --show-sdk-path 2>/dev/null)"
            fi
            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=" --with-openssl=$(brew --prefix openssl)"
            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' --with-secure-transport'
-            [ -n '${{ matrix.macos-version-min }}' ] && CFLAGS+=' -mmacosx-version-min=${{ matrix.macos-version-min }}'
+            CFLAGS+=' -mmacosx-version-min=${{ matrix.macos-version-min }}'
            # would pick up nghttp2, libidn2, but libssh2 is disabled by default
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
+            mkdir bld && cd bld && ../configure --enable-warnings --enable-werror \
              --disable-dependency-tracking \
              --disable-docs --disable-manual \
              --without-nghttp2 --without-libidn2 \
-              --without-libpsl \
+              ${options}
+          else
+            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=' -DCURL_USE_OPENSSL=ON'
+            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' -DCURL_USE_SECTRANSP=ON'
+            # would pick up nghttp2, libidn2, and libssh2
+            cmake -B bld -DCMAKE_UNITY_BUILD=ON -DCURL_WERROR=ON \
+              -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.macos-version-min }} \
+              "-DCMAKE_IGNORE_PREFIX_PATH=$(brew --prefix)" \
+              "-DCMAKE_C_COMPILER_TARGET=$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
+              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF \
+              -DUSE_APPLE_IDN=OFF \
              ${options}
          fi

@ -491,7 +608,7 @@ jobs:
      - name: 'curl_config.h'
        run: |
          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
+          cat bld/lib/curl_config.h | grep -F '#define' | sort || true

      - name: 'build / ${{ matrix.build }}'
        run: make -C bld V=1 VERBOSE=1
--- a/.github/workflows/man-examples.yml
+++ b/.github/workflows/man-examples.yml
@ -0,0 +1,37 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: manpage examples
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - 'docs/libcurl/curl_*.3'
+      - 'docs/libcurl/opts/*.3'
+      - '.github/scripts/verify-examples.pl'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'docs/libcurl/curl_*.3'
+      - 'docs/libcurl/opts/*.3'
+      - '.github/scripts/verify-examples.pl'
+
+permissions: {}
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: render nroff versions
+        run: autoreconf -fi && ./configure --without-ssl --without-libpsl && make -C docs
+
+      - name: verify examples
+        run: ./.github/scripts/verify-examples.pl docs/libcurl/curl*.3 docs/libcurl/opts/*.3
--- a/.github/workflows/non-native.yml
+++ b/.github/workflows/non-native.yml
@ -4,13 +4,14 @@

 name: non-native

-'on':
+on:
  push:
    branches:
      - master
      - '*/ci'
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -22,6 +23,7 @@ name: non-native
      - master
    paths-ignore:
      - '**/*.md'
+      - '.azure-pipelines.yml'
      - '.circleci/**'
      - 'appveyor.*'
      - 'packages/**'
@ -37,689 +39,167 @@ permissions: {}

 jobs:
  netbsd:
-    name: 'NetBSD, CM clang openssl ${{ matrix.arch }}'
+    name: 'NetBSD (cmake, openssl, clang)'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 30
    strategy:
      matrix:
        arch: ['x86_64']
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - name: 'cmake'
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
+        uses: cross-platform-actions/action@cdc9ee69ef84a5f2e59c9058335d9c57bcb4ac86 # v0.25.0
        with:
          operating_system: 'netbsd'
-          version: '10.1'
+          version: '10.0'
          architecture: ${{ matrix.arch }}
          run: |
            # https://pkgsrc.se/
-            time sudo pkgin -y install cmake ninja-build pkg-config perl brotli heimdal openldap-client libssh2 libidn2 libpsl nghttp2 py311-impacket
-            time cmake -B bld -G Ninja \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
+            sudo pkgin -y install cmake pkg-config perl brotli heimdal openldap-client libssh2 libidn2 libpsl nghttp2  # python311 py311-impacket
+            cmake -B bld \
+              -DCMAKE_UNITY_BUILD=ON \
              -DCURL_WERROR=ON \
-              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
+              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug -DCMAKE_RUNTIME_OUTPUT_DIRECTORY_DEBUG= \
+              -DBUILD_EXAMPLES=ON \
+              -DENABLE_WEBSOCKETS=ON \
              -DCURL_USE_OPENSSL=ON \
-              -DCURL_USE_GSSAPI=ON \
+              -DCURL_BROTLI=ON -DUSE_NGHTTP2=ON -DCURL_USE_GSSAPI=ON \
              || { cat bld/CMakeFiles/CMake*.yaml; false; }
-            echo '::group::curl_config.h (raw)'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' bld/lib/curl_config.h | sort || true; echo '::endgroup::'
-            time cmake --build bld
+            cmake --build bld --config Debug --parallel 3
            bld/src/curl --disable --version
            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time cmake --build bld --target testdeps
-              export TFLAGS='-j4'
-              time cmake --build bld --target test-ci
+              cmake --build bld --config Debug --parallel 3 --target testdeps
+              export TFLAGS='-j0'  # flakies: ~389 ~392 ~TFTP and more
+              cmake --build bld --config Debug --target test-ci
            fi
-            echo '::group::build examples'
-            time cmake --build bld --target curl-examples
-            echo '::endgroup::'

  openbsd:
-    name: 'OpenBSD, CM clang libressl ${{ matrix.arch }}'
+    name: 'OpenBSD (cmake, libressl, clang)'
    runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 30
    strategy:
      matrix:
        arch: ['x86_64']
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - name: 'cmake'
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
+        uses: cross-platform-actions/action@cdc9ee69ef84a5f2e59c9058335d9c57bcb4ac86 # v0.25.0
        with:
          operating_system: 'openbsd'
          version: '7.5'
          architecture: ${{ matrix.arch }}
          run: |
            # https://openbsd.app/
-            # https://www.openbsd.org/faq/faq15.html
-            time sudo pkg_add cmake ninja brotli openldap-client-- libssh2 libidn2 libpsl nghttp2 python3 py3-impacket
-            time cmake -B bld -G Ninja \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
+            sudo pkg_add cmake perl brotli openldap-client libssh2 libidn2 libpsl nghttp2 python3 py3-impacket
+            cmake -B bld \
+              -DCMAKE_UNITY_BUILD=ON \
              -DCURL_WERROR=ON \
-              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
+              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug -DCMAKE_RUNTIME_OUTPUT_DIRECTORY_DEBUG= \
+              -DBUILD_EXAMPLES=ON \
+              -DENABLE_WEBSOCKETS=ON \
              -DCURL_USE_OPENSSL=ON \
+              -DCURL_BROTLI=ON -DUSE_NGHTTP2=ON \
              || { cat bld/CMakeFiles/CMake*.yaml; false; }
-            echo '::group::curl_config.h (raw)'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' bld/lib/curl_config.h | sort || true; echo '::endgroup::'
-            time cmake --build bld
+            cmake --build bld --config Debug --parallel 3
            bld/src/curl --disable --version
            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time cmake --build bld --target testdeps
-              export TFLAGS='-j8 ~3017 ~TFTP ~FTP'  # FIXME: TFTP requests executed twice? Related: `curl: (69) TFTP: Access Violation`?
-              time cmake --build bld --target test-ci
+              cmake --build bld --config Debug --parallel 3 --target testdeps
+              export TFLAGS='-j8 ~3017 ~TFTP'  # FIXME: TFTP requests executed twice? Related: `curl: (69) TFTP: Access Violation`?
+              cmake --build bld --config Debug --target test-ci
            fi
-            echo '::group::build examples'
-            time cmake --build bld --target curl-examples
-            echo '::endgroup::'

  freebsd:
-    name: "FreeBSD, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} openssl${{ matrix.desc }} ${{ matrix.arch }}"
+    name: 'FreeBSD (${{ matrix.build }}, openssl, ${{ matrix.compiler }}, ${{ matrix.arch }})'
    runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 60
    strategy:
      matrix:
        include:
          - { build: 'autotools', arch: 'x86_64', compiler: 'clang' }
-          - { build: 'cmake'    , arch: 'x86_64', compiler: 'clang', options: '-DCMAKE_UNITY_BUILD=OFF -DCURL_TEST_BUNDLES=OFF', desc: ' !unity !bundle !runtests !examples' }
          - { build: 'autotools', arch: 'arm64', compiler: 'clang' }
          - { build: 'cmake'    , arch: 'arm64', compiler: 'clang' }
      fail-fast: false
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - name: 'autotools'
        if: ${{ matrix.build == 'autotools' }}
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
+        uses: cross-platform-actions/action@cdc9ee69ef84a5f2e59c9058335d9c57bcb4ac86 # v0.25.0
        with:
          operating_system: 'freebsd'
          version: '14.1'
          architecture: ${{ matrix.arch }}
          run: |
-            export MAKEFLAGS=-j3
            # https://ports.freebsd.org/
-            time sudo pkg install -y autoconf automake libtool \
-              pkgconf brotli openldap26-client libidn2 libnghttp2 stunnel py311-impacket
-            time autoreconf -fi
+            sudo pkg install -y autoconf automake libtool pkgconf brotli openldap26-client libidn2 libnghttp2 nghttp2 stunnel py311-openssl py311-impacket py311-cryptography
+            autoreconf -fi
            export CC='${{ matrix.compiler }}'
-            mkdir bld && cd bld && time ../configure --enable-unity --enable-test-bundles --enable-debug --enable-warnings --enable-werror \
+            mkdir bld && cd bld && ../configure --enable-debug --enable-warnings --enable-werror \
              --prefix="${HOME}"/install \
+              --enable-websockets \
              --with-openssl \
              --with-brotli --enable-ldap --enable-ldaps --with-libidn2 --with-libssh2 --with-nghttp2 --with-gssapi \
-              --disable-dependency-tracking \
-              ${{ matrix.options }} \
-              || { tail -n 1000 config.log; false; }
-            echo '::group::curl_config.h (raw)'; cat lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' lib/curl_config.h | sort || true; echo '::endgroup::'
-            time make install
+              --disable-dependency-tracking || { tail -n 1000 config.log; false; }
+            make -j3 install
            src/curl --disable --version
-            desc='${{ matrix.desc }}'
+            make -j3 examples
            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time make -C tests
-              if [ "${desc#*!runtests*}" = "${desc}" ]; then
-                time make test-ci V=1 TFLAGS='-j4'
-              fi
-            fi
-            if [ "${desc#*!examples*}" = "${desc}" ]; then
-              echo '::group::build examples'
-              time make examples
-              echo '::endgroup::'
+              make -j3 -C tests
+              # The OpenSSH server instance for the testsuite cannot be started on FreeBSD,
+              # therefore the SFTP and SCP tests are disabled right away from the beginning.
+              make test-ci V=1 TFLAGS='-j8 !SFTP !SCP'
            fi

      - name: 'cmake'
        if: ${{ matrix.build == 'cmake' }}
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
+        uses: cross-platform-actions/action@cdc9ee69ef84a5f2e59c9058335d9c57bcb4ac86 # v0.25.0
        with:
          operating_system: 'freebsd'
          version: '14.1'
          architecture: ${{ matrix.arch }}
          run: |
            # https://ports.freebsd.org/
-            time sudo pkg install -y cmake-core ninja perl5 \
-              pkgconf brotli openldap26-client libidn2 libnghttp2 stunnel py311-impacket
-            time cmake -B bld -G Ninja \
-              -DCMAKE_C_COMPILER='${{ matrix.compiler }}' \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
+            sudo pkg install -y cmake pkgconf brotli openldap26-client libidn2 libnghttp2 nghttp2 stunnel py311-openssl py311-impacket py311-cryptography
+            cmake -B bld \
+              '-DCMAKE_C_COMPILER=${{ matrix.compiler }}' \
+              -DCMAKE_UNITY_BUILD=ON \
              -DCURL_WERROR=ON \
-              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
+              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug -DCMAKE_RUNTIME_OUTPUT_DIRECTORY_DEBUG= \
+              -DBUILD_EXAMPLES=ON \
+              -DENABLE_WEBSOCKETS=ON \
              -DCURL_USE_OPENSSL=ON \
-              -DCURL_USE_GSSAPI=ON \
-              ${{ matrix.options }} \
+              -DCURL_BROTLI=ON -DUSE_NGHTTP2=ON -DCURL_USE_GSSAPI=ON \
              || { cat bld/CMakeFiles/CMake*.yaml; false; }
-            echo '::group::curl_config.h (raw)'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' bld/lib/curl_config.h | sort || true; echo '::endgroup::'
-            time cmake --build bld
+            cmake --build bld --config Debug --parallel 3
            bld/src/curl --disable --version
-            desc='${{ matrix.desc }}'
            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time cmake --build bld --target testdeps
-              if [ "${desc#*!runtests*}" = "${desc}" ]; then
-                time cmake --build bld --target test-ci
-              fi
-            fi
-            if [ "${desc#*!examples*}" = "${desc}" ]; then
-              echo '::group::build examples'
-              time cmake --build bld --target curl-examples
-              echo '::endgroup::'
+              cmake --build bld --config Debug --parallel 3 --target testdeps
+              # The OpenSSH server instance for the testsuite cannot be started on FreeBSD,
+              # therefore the SFTP and SCP tests are disabled right away from the beginning.
+              make test-ci V=1 TFLAGS='-j8 !SFTP !SCP'
            fi

  omnios:
-    name: 'OmniOS, AM gcc openssl amd64'
+    name: 'OmniOS (autotools, openssl, gcc, amd64)'
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - name: 'autotools'
-        uses: vmactions/omnios-vm@8eba2a9217262f275d4566751a92d6ef2f433d00 # v1
+        uses: vmactions/omnios-vm@a61ca1ebafdcb14a9d986928d070c9834ee66fd3 # v1
        with:
          usesh: true
-          # https://pkg.omnios.org/r151052/core/en/index.shtml
-          prepare: pkg install build-essential libtool nghttp2
+          # https://pkg.omnios.org/r151050/core/en/index.shtml
+          prepare: pkg install build-essential libtool
          run: |
-            set -e
            ln -s /usr/bin/gcpp /usr/bin/cpp  # Some tests expect `cpp`, which is named `gcpp` in this env.
-            export MAKEFLAGS=-j3
-            time autoreconf -fi
-            mkdir bld && cd bld && time ../configure --enable-unity --enable-test-bundles --enable-debug --enable-warnings --enable-werror \
+            autoreconf -fi
+            mkdir bld && cd bld && ../configure --enable-debug --enable-warnings --enable-werror \
              --prefix="${HOME}"/install \
+              --enable-websockets \
              --with-openssl \
-              --disable-dependency-tracking \
-              || { tail -n 1000 config.log; false; }
-            echo '::group::curl_config.h (raw)'; cat lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' lib/curl_config.h | sort || true; echo '::endgroup::'
-            time gmake install
+              --disable-dependency-tracking || { tail -n 1000 config.log; false; }
+            gmake -j3 install
            src/curl --disable --version
-            time gmake -C tests
-            time gmake test-ci V=1
-            echo '::group::build examples'
-            time gmake examples
-            echo '::endgroup::'
-
-  ios:
-    name: "iOS, ${{ (matrix.build.generator && format('CM-{0}', matrix.build.generator)) || (matrix.build.generate && 'CM' || 'AM' )}} ${{ matrix.build.name }} arm64"
-    runs-on: 'macos-latest'
-    timeout-minutes: 10
-    env:
-      MAKEFLAGS: -j 4
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.build.compiler || 'clang' }}
-      # renovate: datasource=github-tags depName=libressl-portable/portable versioning=semver registryUrl=https://github.com
-      libressl-version: 4.0.0
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - name: 'libressl'
-            install_steps: libressl
-            configure: --with-openssl="$HOME/libressl" --without-libpsl
-
-          - name: 'libressl'
-            install_steps: libressl
-            # FIXME: Could not make OPENSSL_ROOT_DIR work. CMake seems to prepend sysroot to it.
-            generate: >-
-              -DCMAKE_BUILD_TYPE=Release -DCMAKE_UNITY_BUILD_BATCH_SIZE=50
-              -DOPENSSL_INCLUDE_DIR="$HOME/libressl/include"
-              -DOPENSSL_SSL_LIBRARY="$HOME/libressl/lib/libssl.a"
-              -DOPENSSL_CRYPTO_LIBRARY="$HOME/libressl/lib/libcrypto.a"
-              -DCURL_USE_LIBPSL=OFF
-
-          - name: 'libressl'
-            install_steps: libressl
-            generator: Xcode
-            options: --config Debug
-            generate: >-
-              -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED=OFF
-              -DMACOSX_BUNDLE_GUI_IDENTIFIER=se.curl
-              -DOPENSSL_INCLUDE_DIR="$HOME/libressl/include"
-              -DOPENSSL_SSL_LIBRARY="$HOME/libressl/lib/libssl.a"
-              -DOPENSSL_CRYPTO_LIBRARY="$HOME/libressl/lib/libcrypto.a"
-              -DCURL_USE_LIBPSL=OFF
-
-    steps:
-      - name: 'brew install'
-        if: ${{ matrix.build.configure }}
-        run: |
-          echo automake libtool | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-
-      - name: 'toolchain versions'
-        run: |
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcodebuild -sdk -version | grep '^Path:' || true
-          xcrun --sdk iphoneos --show-sdk-path 2>/dev/null || true
-          xcrun --sdk iphoneos --show-sdk-version || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages installed'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - name: 'cache libressl'
-        if: contains(matrix.build.install_steps, 'libressl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-libressl
-        env:
-          cache-name: cache-libressl
-        with:
-          path: ~/libressl
-          key: iOS-${{ env.cache-name }}-${{ env.libressl-version }}
-
-      - name: 'build libressl'
-        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
-        run: |
-          curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/libressl/portable/releases/download/v${{ env.libressl-version }}/libressl-${{ env.libressl-version }}.tar.gz | tar -x
-          cd libressl-${{ env.libressl-version }}
-          # FIXME: on the 4.0.1 release, delete '-DHAVE_ENDIAN_H=0'
-          cmake -B . \
-            -DHAVE_ENDIAN_H=0 \
-            -DCMAKE_INSTALL_PREFIX="$HOME/libressl" \
-            -DCMAKE_SYSTEM_NAME=iOS \
-            -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
-            -DBUILD_SHARED_LIBS=OFF \
-            -DLIBRESSL_APPS=OFF \
-            -DLIBRESSL_TESTS=OFF
-          cmake --build .
-          cmake --install . --verbose
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            # https://cmake.org/cmake/help/latest/manual/cmake-toolchains.7.html#cross-compiling-for-ios-tvos-visionos-or-watchos
-            [ -n '${{ matrix.build.generator }}' ] && options='-G ${{ matrix.build.generator }}'
-            cmake -B bld -D_CURL_PREFILL=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              -DCMAKE_SYSTEM_NAME=iOS \
-              -DUSE_APPLE_IDN=ON \
-              ${{ matrix.build.generate }} ${options}
-          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              CFLAGS="-isysroot $(xcrun --sdk iphoneos --show-sdk-path 2>/dev/null)" \
-              --host=aarch64-apple-darwin \
-              --with-apple-idn \
-              ${{ matrix.build.configure }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld ${{ matrix.build.options }} --parallel 4 --verbose
-          else
-            make -C bld V=1
-          fi
-
-      - name: 'curl info'
-        run: find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld ${{ matrix.build.options }} --parallel 4 --target testdeps --verbose
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld ${{ matrix.build.options }} --parallel 4 --target curl-examples --verbose
-          else
-            make -C bld examples V=1
-          fi
-
-  android:
-    name: "Android ${{ matrix.platform }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.name }} arm64"
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 25
-    env:
-      MAKEFLAGS: -j 5
-      VCPKG_BINARY_SOURCES: 'clear;x-gha,readwrite'
-      VCPKG_DISABLE_METRICS: '1'
-    strategy:
-      matrix:
-        include:
-          - { build: 'autotools', platform: '21', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '--with-openssl --with-brotli' }
-
-          - { build: 'cmake'    , platform: '21', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '-DCURL_USE_OPENSSL=ON' }
-
-          - { build: 'autotools', platform: '35', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '--with-openssl --with-brotli' }
-
-          - { build: 'cmake'    , platform: '35', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '-DCURL_USE_OPENSSL=ON' }
-
-          # FIXME: Must disable zstd explicitly, otherwise cmake/pkg-config finds it in /usr/include
-          #        and the build fails. I had found no option to disable this behavior. Other default
-          #        dependencies not offered via vcpkg may also need this.
-          - { build: 'cmake'    , platform: '35', name: "boringssl !zstd", install: 'libpsl boringssl',
-              options: '-DCURL_USE_OPENSSL=ON -DOPENSSL_USE_STATIC_LIBS=ON -DCURL_ZSTD=OFF' }
-
-      fail-fast: false
-    steps:
-      - name: 'vcpkg cache setup'
-        if: ${{ matrix.install }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: 'vcpkg versions'
-        if: ${{ matrix.install }}
-        timeout-minutes: 1
-        run: |
-          git -C "$VCPKG_INSTALLATION_ROOT" show --no-patch --format='%H %ai'
-          vcpkg version
-
-      - name: 'install prereqs for vcpkg'
-        if: contains(matrix.install, 'boringssl')
-        timeout-minutes: 5
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install nasm
-
-      - name: 'vcpkg build'
-        if: ${{ matrix.install }}
-        timeout-minutes: 20
-        run: vcpkg x-set-installed ${{ matrix.install }} '--triplet=arm64-android'
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'autotools' }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          export PKG_CONFIG_PATH="$VCPKG_INSTALLATION_ROOT/installed/arm64-android/lib/pkgconfig"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then  # https://developer.android.com/ndk/guides/cmake
-            cmake -B bld \
-              -DANDROID_ABI=arm64-v8a \
-              -DANDROID_PLATFORM='android-${{ matrix.platform }}' \
-              -DCMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" \
-              -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=${ANDROID_NDK_HOME}/build/cmake/android.toolchain.cmake -DCMAKE_WARN_DEPRECATED=OFF \
-              -DVCPKG_INSTALLED_DIR="$VCPKG_INSTALLATION_ROOT/installed" \
-              -DVCPKG_TARGET_TRIPLET=arm64-android \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              ${{ matrix.options }}
-          else
-            TOOLCHAIN="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64"
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              CC="$TOOLCHAIN/bin/aarch64-linux-android${{ matrix.platform }}-clang" \
-              AR="$TOOLCHAIN/bin/llvm-ar" \
-              RANLIB="$TOOLCHAIN/bin/llvm-ranlib" \
-              --host=aarch64-linux-android${{ matrix.platform }} \
-              ${{ matrix.options }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --verbose
-          else
-            make -C bld V=1
-          fi
-
-      - name: 'curl info'
-        run: find . -type f \( -name curl -o -name '*.so' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
-
-  amiga:
-    name: "AmigaOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} gcc AmiSSL m68k"
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 5
-    env:
-      MAKEFLAGS: -j 5
-      amissl-version: 5.18
-    strategy:
-      matrix:
-        build: [autotools, cmake]
-      fail-fast: false
-    steps:
-      - name: 'install compiler'
-        if: ${{ steps.cache-compiler.outputs.cache-hit != 'true' }}
-        run: |
-          cd "${HOME}" || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 \
-            --location https://github.com/bebbo/amiga-gcc/releases/download/Mechen/amiga-gcc.tgz | tar -xz
-          cd opt/appveyor || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 \
-            --location https://github.com/jens-maus/amissl/releases/download/${{ env.amissl-version }}/AmiSSL-${{ env.amissl-version }}-SDK.lha --output bin.lha
-          7z x -bd -y bin.lha
-          rm -f bin.lha
-          mv "$HOME/opt/appveyor" /opt
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'configure'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld \
-              -DAMIGA=1 \
-              -DCMAKE_SYSTEM_NAME=Generic \
-              -DCMAKE_SYSTEM_PROCESSOR=m68k \
-              -DCMAKE_C_COMPILER_TARGET=m68k-unknown-amigaos \
-              -DCMAKE_C_COMPILER=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-gcc \
-              -DCMAKE_C_FLAGS='-O0 -msoft-float -mcrt=clib2' \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_LIBPSL=OFF \
-              -DAMISSL_INCLUDE_DIR=/opt/appveyor/AmiSSL/Developer/include \
-              -DAMISSL_STUBS_LIBRARY=/opt/appveyor/AmiSSL/Developer/lib/AmigaOS3/libamisslstubs.a \
-              -DAMISSL_AUTO_LIBRARY=/opt/appveyor/AmiSSL/Developer/lib/AmigaOS3/libamisslauto.a
-          else
-            autoreconf -fi
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              CC=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-gcc \
-              AR=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-ar \
-              RANLIB=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-ranlib \
-              --host=m68k-amigaos \
-              --disable-shared \
-              --without-libpsl \
-              --with-amissl \
-              LDFLAGS=-L/opt/appveyor/AmiSSL/Developer/lib/AmigaOS3 \
-              CPPFLAGS=-I/opt/appveyor/AmiSSL/Developer/include \
-              CFLAGS='-O0 -msoft-float -mcrt=clib2' \
-              LIBS='-lnet -lm -latomic'
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld
-          fi
-
-      - name: 'curl info'
-        run: find . -type f \( -name curl -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
-
-  msdos:
-    name: "MS-DOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} djgpp openssl i586"
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 5
-    env:
-      MAKEFLAGS: -j 5
-      toolchain-version: '3.4'
-    strategy:
-      matrix:
-        build: [autotools, cmake]
-      fail-fast: false
-    steps:
-      - name: 'install packages'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 install libfl2 ${{ matrix.build == 'cmake' && 'ninja-build' || '' }}
-
-      - name: 'cache compiler (djgpp)'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-compiler
-        with:
-          path: ~/djgpp
-          key: ${{ runner.os }}-djgpp-${{ env.toolchain-version }}-amd64
-
-      - name: 'install compiler (djgpp)'
-        if: ${{ steps.cache-compiler.outputs.cache-hit != 'true' }}
-        run: |
-          cd "${HOME}" || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 \
-            --location 'https://github.com/andrewwutw/build-djgpp/releases/download/v${{ env.toolchain-version }}/djgpp-linux64-gcc1220.tar.bz2' | tar -xj
-          cd djgpp || exit 1
-          for f in wat3211b.zip zlb13b.zip ssl102ub.zip; do
-            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 \
-              "https://www.delorie.com/pub/djgpp/current/v2tk/$f" --output bin.zip
-            unzip -q bin.zip
-            rm -f bin.zip
-          done
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'configure'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_SYSTEM_NAME=DOS \
-              -DCMAKE_SYSTEM_PROCESSOR=x86 \
-              -DCMAKE_C_COMPILER_TARGET=i586-pc-msdosdjgpp \
-              -DCMAKE_C_COMPILER="$HOME/djgpp/bin/i586-pc-msdosdjgpp-gcc" \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_LIBPSL=OFF \
-              -DOPENSSL_INCLUDE_DIR="$HOME/djgpp/include" \
-              -DOPENSSL_SSL_LIBRARY="$HOME/djgpp/lib/libssl.a" \
-              -DOPENSSL_CRYPTO_LIBRARY="$HOME/djgpp/lib/libcrypto.a" \
-              -DZLIB_INCLUDE_DIR="$HOME/djgpp/include" \
-              -DZLIB_LIBRARY="$HOME/djgpp/lib/libz.a" \
-              -DWATT_ROOT="$HOME/djgpp/net/watt"
-          else
-            autoreconf -fi
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              CC="$HOME/djgpp/bin/i586-pc-msdosdjgpp-gcc" \
-              AR="$HOME/djgpp/bin/i586-pc-msdosdjgpp-ar" \
-              RANLIB="$HOME/djgpp/bin/i586-pc-msdosdjgpp-ranlib" \
-              WATT_ROOT="$HOME/djgpp/net/watt" \
-              --host=i586-pc-msdosdjgpp \
-              --with-openssl="$HOME/djgpp" \
-              --with-zlib="$HOME/djgpp" \
-              --without-libpsl \
-              --disable-shared
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld
-          fi
-
-      - name: 'curl info'
-        run: find . \( -name '*.exe' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
+            gmake -j3 examples
+            gmake -j3 -C tests
+            gmake test-ci V=1 TFLAGS='-j12 ~MQTT ~FTP'
--- a/.github/workflows/proselint.yml
+++ b/.github/workflows/proselint.yml
@ -0,0 +1,71 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: proselint
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - '.github/workflows/proselint.yml'
+      - '**.md'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '.github/workflows/proselint.yml'
+      - '**.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: install prereqs
+        run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get install python3-proselint
+
+      # config file help: https://github.com/amperser/proselint/
+      - name: create proselint config
+        run: |
+          cat <<JSON > $HOME/.proselintrc
+          {
+            "checks": {
+              "typography.diacritical_marks": false,
+              "typography.symbols": false,
+              "annotations.misc": false,
+              "security.password": false
+            }
+          }
+          JSON
+
+      - name: check prose
+        run: git ls-files '*.md' | grep -Ev 'CHECKSRC.md|DISTROS.md|CURLOPT_INTERFACE.md' | xargs proselint README
+
+      # This is for CHECKSRC and files with aggressive exclamation mark needs
+      - name: create second proselint config
+        run: |
+          cat <<JSON > $HOME/.proselintrc
+          {
+            "checks": {
+              "typography.diacritical_marks": false,
+              "typography.symbols": false,
+              "typography.exclamation": false,
+              "annotations.misc": false
+            }
+          }
+          JSON
+
+      - name: check special prose
+        run: proselint docs/CHECKSRC.md docs/libcurl/opts/CURLOPT_INTERFACE.md
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@ -0,0 +1,29 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
+#
+# SPDX-License-Identifier: curl
+
+name: REUSE compliance
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+  pull_request:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - name: REUSE Compliance Check
+        uses: fsfe/reuse-action@3ae3c6bdf1257ab19397fab11fd3312144692083 # v4
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@ -0,0 +1,28 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+name: shellcheck
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - name: 'shellcheck'
+        run: .github/scripts/shellcheck.sh
--- a/.github/workflows/spacecheck.yml
+++ b/.github/workflows/spacecheck.yml
@ -0,0 +1,28 @@
+# Copyright (C) Viktor Szakats
+#
+# SPDX-License-Identifier: curl
+
+name: spacecheck
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  spacecheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - name: 'spacecheck'
+        run: .github/scripts/spacecheck.pl
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@ -0,0 +1,50 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: spell
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - '**.md'
+      - '**/spellcheck.yml'
+      - '**/spellcheck.yaml'
+      - '.github/scripts/*'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '**.md'
+      - '**/spellcheck.yml'
+      - '**/spellcheck.yaml'
+      - '.github/scripts/*'
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: trim all man page *.md files
+        run: find docs -name "*.md" ! -name "_*" | xargs -n1 ./.github/scripts/cleancmd.pl
+
+      - name: trim libcurl man page *.md files
+        run: find docs/libcurl -name "curl_*.md" -o -name "libcurl*.md" | xargs -n1 ./.github/scripts/cleanspell.pl
+
+      - name: trim libcurl option man page *.md files
+        run: find docs/libcurl/opts -name "CURL*.md" | xargs -n1 ./.github/scripts/cleanspell.pl
+
+      - name: trim cmdline docs markdown _*.md files
+        run: find docs/cmdline-opts -name "_*.md" | xargs -n1 ./.github/scripts/cleancmd.pl --no-header
+
+      - name: setup the custom wordlist
+        run: grep -v '^#' .github/scripts/spellcheck.words >  wordlist.txt
+
+      - name: Check Spelling
+        uses: rojopolis/spellcheck-github-actions@d354a4dc525c8067555c7481b60416cedb0060ff # v0
+        with:
+          config_path: .github/scripts/spellcheck.yaml
--- a/.github/workflows/synopsis.yml
+++ b/.github/workflows/synopsis.yml
@ -0,0 +1,34 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: SYNOPSIS
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths:
+      - 'docs/libcurl/curl_*.md'
+      - 'scripts/*.pl'
+      - '.github/workflows/*.yml'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'docs/libcurl/curl_*.md'
+      - 'scripts/*.pl'
+      - '.github/workflows/*.yml'
+
+permissions: {}
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - name: verify-synopsis
+        run: ./.github/scripts/verify-synopsis.pl docs/libcurl/curl*.md
--- a/.github/workflows/torture.yml
+++ b/.github/workflows/torture.yml
@ -0,0 +1,91 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Linux torture
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: torture-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - name: torture
+            install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
+            configure: --with-openssl --enable-debug --enable-ares --enable-websockets
+            tflags: -n -t --shallow=25 !FTP
+          - name: torture-ftp
+            install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
+            configure: --with-openssl --enable-debug --enable-ares
+            tflags: -n -t --shallow=20 FTP
+
+    steps:
+      - run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get update
+          sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
+          sudo python3 -m pip install impacket
+        name: 'install prereqs and impacket'
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - run: autoreconf -fi
+        name: 'autoreconf'
+
+      - run: ./configure --disable-dependency-tracking --enable-warnings --enable-werror ${{ matrix.build.configure }}
+        name: 'configure'
+
+      - run: make V=1
+        name: 'make'
+
+      - run: make V=1 -C tests
+        name: 'make tests'
+
+      - run: make V=1 test-torture
+        name: 'run tests'
+        env:
+          TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
--- a/.github/workflows/wolfssl.yml
+++ b/.github/workflows/wolfssl.yml
@ -0,0 +1,104 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Linux wolfSSL
+
+on:
+  push:
+    branches:
+      - master
+      - '*/ci'
+    paths-ignore:
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+      - '**/CMakeLists.txt'
+      - '.azure-pipelines.yml'
+      - '.circleci/**'
+      - 'appveyor.*'
+      - 'CMake/**'
+      - 'packages/**'
+      - 'plan9/**'
+      - 'projects/**'
+      - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: wolfssl-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 5
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - name: wolfssl (configured with --enable-all)
+            install:
+            configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
+            wolfssl-configure: --enable-all
+          - name: wolfssl (configured with --enable-opensslextra)
+            install: valgrind
+            configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
+            wolfssl-configure: --enable-opensslextra
+
+    steps:
+      - run: |
+          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
+          sudo apt-get update
+          sudo apt-get install libtool autoconf automake pkg-config stunnel4 libpsl-dev ${{ matrix.build.install }}
+          sudo python3 -m pip install impacket
+        name: 'install prereqs and impacket'
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+      - run: |
+          source .github/scripts/VERSIONS
+          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
+          tar -xzf v$WOLFSSL_VER-stable.tar.gz
+          cd wolfssl-$WOLFSSL_VER-stable
+          ./autogen.sh
+          ./configure --disable-dependency-tracking --enable-tls13 ${{ matrix.build.wolfssl-configure }} --enable-harden --prefix=$HOME/wssl
+          make install
+        name: 'install wolfssl'
+
+      - run: autoreconf -fi
+        name: 'autoreconf'
+
+      - run: ./configure --disable-dependency-tracking --enable-warnings --enable-werror ${{ matrix.build.configure }}
+        name: 'configure'
+
+      - run: make V=1
+        name: 'make'
+
+      - run: make V=1 examples
+        name: 'make examples'
+
+      - run: make V=1 -C tests
+        name: 'make tests'
+
+      - run: make V=1 test-ci
+        name: 'run tests'
+        env:
+          TFLAGS: "${{ matrix.build.tflags }}"
--- a/.gitignore
+++ b/.gitignore
@ -8,15 +8,11 @@
 *.exp
 *.la
 *.lib
-*.a
-*.res
 *.lo
 *.o
 *.obj
 *.pdb
 *.pyc
-*.orig
-*.rej
 *~
 .*.sw?
 .cproject
@ -40,9 +36,6 @@ TAGS
 aclocal.m4
 aclocal.m4.bak
 autom4te.cache
-buildinfo.txt
-ca-bundle.crt
-certdata.txt
 compile
 config.cache
 config.guess
@ -64,7 +57,6 @@ missing
 mkinstalldirs
 tags
 test-driver
-stamp-h*
 scripts/_curl
 scripts/curl.fish
 curl_fuzzer
--- a/.mailmap
+++ b/.mailmap
@ -109,8 +109,3 @@ Derzsi Dániel <daniel@tohka.us>
 Michael Osipov <michael.osipov@siemens.com> <1983-01-06@gmx.net>
 Michael Osipov <michael.osipov@siemens.com> <michael-o@users.sf.net>
 Christian Weisgerber <naddy@mips.inka.de> <curl-library@lists.haxx.se>
-Moritz Buhl <git@moritzbuhl.de>
-Aki Sakurai <75532970+AkiSakurai@users.noreply.github.com>
-Sinkevich Artem <artsin666@gmail.com>
-Andrew Kirillov <akirillo@uk.ibm.com>
-Stephen Farrell <stephen.farrell@cs.tcd.ie>
--- a/CMake/CurlSymbolHiding.cmake
+++ b/CMake/CurlSymbolHiding.cmake
@ -21,7 +21,9 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-option(CURL_HIDDEN_SYMBOLS "Hide libcurl internal symbols (=hide all symbols that are not officially external)" ON)
+include(CheckCSourceCompiles)
+
+option(CURL_HIDDEN_SYMBOLS "Set to ON to hide libcurl internal symbols (=hide all symbols that aren't officially external)." ON)
 mark_as_advanced(CURL_HIDDEN_SYMBOLS)

 if(WIN32 AND (ENABLE_DEBUG OR ENABLE_CURLDEBUG))
@ -29,40 +31,55 @@ if(WIN32 AND (ENABLE_DEBUG OR ENABLE_CURLDEBUG))
  # e.g. curl_easy_perform_ev() or curl_dbg_*(),
  # so disable symbol hiding for debug builds and for memory tracking.
  set(CURL_HIDDEN_SYMBOLS OFF)
-elseif(DOS OR AMIGA OR MINGW32CE)
-  set(CURL_HIDDEN_SYMBOLS OFF)
 endif()

-set(CURL_HIDES_PRIVATE_SYMBOLS FALSE)
-set(CURL_EXTERN_SYMBOL "")
-set(CURL_CFLAG_SYMBOLS_HIDE "")
-
 if(CURL_HIDDEN_SYMBOLS)
+  set(SUPPORTS_SYMBOL_HIDING FALSE)
+
  if(CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
-    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
+    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
  elseif(CMAKE_COMPILER_IS_GNUCC)
    if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.4)
-      # Note: This is considered buggy prior to 4.0 but the autotools do not care, so let us ignore that fact
-      set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-      set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
-      set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+      # note: this is considered buggy prior to 4.0 but the autotools don't care, so let's ignore that fact
+      set(SUPPORTS_SYMBOL_HIDING TRUE)
+      set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
+      set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
    endif()
  elseif(CMAKE_C_COMPILER_ID MATCHES "SunPro" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.0)
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-    set(CURL_EXTERN_SYMBOL "__global")
-    set(CURL_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
-  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 9.0)  # Requires 9.1.045
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
-    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+    set(_SYMBOL_EXTERN "__global")
+    set(_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
+  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 9.0)
+    # note: this should probably just check for version 9.1.045 but I'm not 100% sure
+    #       so let's do it the same way autotools do.
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
+    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    check_c_source_compiles("#include <stdio.h>
+        int main (void) { printf(\"icc fvisibility bug test\"); return 0; }" _no_bug)
+    if(NOT _no_bug)
+      set(SUPPORTS_SYMBOL_HIDING FALSE)
+      set(_SYMBOL_EXTERN "")
+      set(_CFLAG_SYMBOLS_HIDE "")
+    endif()
  elseif(MSVC)
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+  endif()
+
+  set(HIDES_CURL_PRIVATE_SYMBOLS ${SUPPORTS_SYMBOL_HIDING})
+elseif(MSVC)
+  if(NOT CMAKE_VERSION VERSION_LESS 3.7)
+    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE) #present since 3.4.3 but broken
+    set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
+  else()
+    message(WARNING "Hiding private symbols regardless CURL_HIDDEN_SYMBOLS being disabled.")
+    set(HIDES_CURL_PRIVATE_SYMBOLS TRUE)
  endif()
 else()
-  if(MSVC)
-    # Note: This option is prone to export non-curl extra symbols.
-    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE)
-  endif()
+  set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
 endif()
+
+set(CURL_CFLAG_SYMBOLS_HIDE ${_CFLAG_SYMBOLS_HIDE})
+set(CURL_EXTERN_SYMBOL ${_SYMBOL_EXTERN})
--- a/CMake/CurlTests.c
+++ b/CMake/CurlTests.c
@ -30,14 +30,14 @@
 /* */
 #if defined(sun) || defined(__sun__) || \
    defined(__SUNPRO_C) || defined(__SUNPRO_CC)
-#  if defined(__SVR4) || defined(__srv4__)
-#    define PLATFORM_SOLARIS
-#  else
-#    define PLATFORM_SUNOS4
-#  endif
+# if defined(__SVR4) || defined(__srv4__)
+#  define PLATFORM_SOLARIS
+# else
+#  define PLATFORM_SUNOS4
+# endif
 #endif
 #if (defined(_AIX) || defined(__xlC__)) && !defined(_AIX41)
-#  define PLATFORM_AIX_V3
+# define PLATFORM_AIX_V3
 #endif
 /* */
 #if defined(PLATFORM_SUNOS4) || defined(PLATFORM_AIX_V3)
@ -55,52 +55,72 @@ int main(void)
 #endif

 /* tests for gethostbyname_r */
-#if defined(HAVE_GETHOSTBYNAME_R_3) || \
-    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_5) || \
+#if defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
    defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_6) || \
    defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
+#   define _REENTRANT
+    /* no idea whether _REENTRANT is always set, just invent a new flag */
+#   define TEST_GETHOSTBYFOO_REENTRANT
+#endif
+#if defined(HAVE_GETHOSTBYNAME_R_3) || \
+    defined(HAVE_GETHOSTBYNAME_R_5) || \
+    defined(HAVE_GETHOSTBYNAME_R_6) || \
+    defined(TEST_GETHOSTBYFOO_REENTRANT)
 #include <sys/types.h>
 #include <netdb.h>
 int main(void)
 {
-  const char *address = "example.com";
+  char *address = "example.com";
+  int length = 0;
+  int type = 0;
  struct hostent h;
  int rc = 0;
-#if   defined(HAVE_GETHOSTBYNAME_R_3) || \
-      defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
+#if defined(HAVE_GETHOSTBYNAME_R_3) || \
+    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
  struct hostent_data hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
      defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
      defined(HAVE_GETHOSTBYNAME_R_6) || \
      defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
  char buffer[8192];
-  struct hostent *hp;
  int h_errnop;
+  struct hostent *hp;
 #endif

 #if   defined(HAVE_GETHOSTBYNAME_R_3) || \
      defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
  rc = gethostbyname_r(address, &h, &hdata);
-  (void)hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
      defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT)
  rc = gethostbyname_r(address, &h, buffer, 8192, &h_errnop);
  (void)hp; /* not used for test */
-  (void)h_errnop;
 #elif defined(HAVE_GETHOSTBYNAME_R_6) || \
      defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
  rc = gethostbyname_r(address, &h, buffer, 8192, &hp, &h_errnop);
-  (void)hp;
-  (void)h_errnop;
 #endif
-  (void)h;
+
+  (void)length;
+  (void)type;
  (void)rc;
  return 0;
 }
 #endif

+#ifdef HAVE_IN_ADDR_T
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+int main(void)
+{
+  if((in_addr_t *) 0)
+    return 0;
+  if(sizeof(in_addr_t))
+    return 0;
+  ;
+  return 0;
+}
+#endif
+
 #ifdef HAVE_BOOL_T
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
@ -110,7 +130,10 @@ int main(void)
 #endif
 int main(void)
 {
-  return (int)sizeof(bool *);
+  if(sizeof(bool *))
+    return 0;
+  ;
+  return 0;
 }
 #endif

@ -123,52 +146,66 @@ int main(void) { return 0; }
 #endif

 #ifdef HAVE_FILE_OFFSET_BITS
+#ifdef _FILE_OFFSET_BITS
+#undef _FILE_OFFSET_BITS
+#endif
+#define _FILE_OFFSET_BITS 64
 #include <sys/types.h>
-/* Check that off_t can represent 2**63 - 1 correctly.
-   We cannot simply define LARGE_OFF_T to be 9223372036854775807,
-   since some C++ compilers masquerading as C compilers
-   incorrectly reject 9223372036854775807. */
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
 #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
-static int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 &&
-                           LARGE_OFF_T % 2147483647 == 1)
-                          ? 1 : -1];
-int main(void)
-{
-  (void)off_t_is_large;
-  return 0;
-}
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+                       && LARGE_OFF_T % 2147483647 == 1)
+                      ? 1 : -1];
+int main(void) { ; return 0; }
 #endif

 #ifdef HAVE_IOCTLSOCKET
+/* includes start */
 #ifdef _WIN32
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
 #  include <winsock2.h>
 #endif
 int main(void)
 {
  /* ioctlsocket source code */
-  int socket = -1;
+  int socket;
  unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
-  (void)flags;
+  ;
  return 0;
 }

 #endif

 #ifdef HAVE_IOCTLSOCKET_CAMEL
-#include <proto/bsdsocket.h>
+/* includes start */
+#ifdef _WIN32
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <winsock2.h>
+#endif
 int main(void)
 {
  /* IoctlSocket source code */
  if(0 != IoctlSocket(0, 0, 0))
    return 1;
+  ;
  return 0;
 }
 #endif

 #ifdef HAVE_IOCTLSOCKET_CAMEL_FIONBIO
-#include <proto/bsdsocket.h>
-#ifdef HAVE_SYS_IOCTL_H
-#  include <sys/ioctl.h>
+/* includes start */
+#ifdef _WIN32
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <winsock2.h>
 #endif
 int main(void)
 {
@ -176,13 +213,17 @@ int main(void)
  long flags = 0;
  if(0 != IoctlSocket(0, FIONBIO, &flags))
    return 1;
-  (void)flags;
+  ;
  return 0;
 }
 #endif

 #ifdef HAVE_IOCTLSOCKET_FIONBIO
+/* includes start */
 #ifdef _WIN32
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
 #  include <winsock2.h>
 #endif
 int main(void)
@ -190,13 +231,14 @@ int main(void)
  unsigned long flags = 0;
  if(0 != ioctlsocket(0, FIONBIO, &flags))
    return 1;
-  (void)flags;
+  ;
  return 0;
 }
 #endif

 #ifdef HAVE_IOCTL_FIONBIO
 /* headers for FIONBIO test */
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@ -217,13 +259,14 @@ int main(void)
  int flags = 0;
  if(0 != ioctl(0, FIONBIO, &flags))
    return 1;
-  (void)flags;
+  ;
  return 0;
 }
 #endif

 #ifdef HAVE_IOCTL_SIOCGIFADDR
 /* headers for FIONBIO test */
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@ -245,25 +288,32 @@ int main(void)
  struct ifreq ifr;
  if(0 != ioctl(0, SIOCGIFADDR, &ifr))
    return 1;
-  (void)ifr;
+  ;
  return 0;
 }
 #endif

 #ifdef HAVE_SETSOCKOPT_SO_NONBLOCK
+/* includes start */
 #ifdef _WIN32
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
 #  include <winsock2.h>
 #endif
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 #ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
+/* includes end */
 int main(void)
 {
  if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
    return 1;
+  ;
  return 0;
 }
 #endif
@ -272,7 +322,7 @@ int main(void)
 #include <string.h>
 #include <errno.h>

-static void check(char c) { (void)c; }
+void check(char c) {}

 int main(void)
 {
@ -287,8 +337,8 @@ int main(void)
 #include <string.h>
 #include <errno.h>

-/* Float, because a pointer cannot be implicitly cast to float */
-static void check(float f) { (void)f; }
+/* float, because a pointer can't be implicitly cast to float */
+void check(float f) {}

 int main(void)
 {
@ -312,7 +362,7 @@ int main(void)
 #include <sys/xattr.h> /* header from libc, not from libattr */
 int main(void)
 {
-  fsetxattr(0, "", 0, 0, 0);
+  fsetxattr(0, 0, 0, 0, 0);
  return 0;
 }
 #endif
@ -321,9 +371,8 @@ int main(void)
 #include <time.h>
 int main(void)
 {
-  struct timespec ts;
-  (void)clock_gettime(CLOCK_MONOTONIC, &ts);
-  (void)ts;
+  struct timespec ts = {0, 0};
+  clock_gettime(CLOCK_MONOTONIC, &ts);
  return 0;
 }
 #endif
@ -337,6 +386,7 @@ int main(void)
 #endif

 #ifdef HAVE_ATOMIC
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@ -346,6 +396,8 @@ int main(void)
 #ifdef HAVE_STDATOMIC_H
 #  include <stdatomic.h>
 #endif
+/* includes end */
+
 int main(void)
 {
  _Atomic int i = 1;
@ -355,12 +407,17 @@ int main(void)
 #endif

 #ifdef HAVE_WIN32_WINNT
+/* includes start */
 #ifdef _WIN32
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
 #  ifndef NOGDI
-#  define NOGDI
+#    define NOGDI
 #  endif
 #  include <windows.h>
 #endif
+/* includes end */

 #define enquote(x) #x
 #define expand(x) enquote(x)
@ -371,20 +428,3 @@ int main(void)
  return 0;
 }
 #endif
-
-#ifdef MINGW64_VERSION
-#ifdef __MINGW32__
-#  include <_mingw.h>
-#endif
-
-#define enquote(x) #x
-#define expand(x) enquote(x)
-#pragma message("MINGW64_VERSION=" \
-  expand(__MINGW64_VERSION_MAJOR) "." \
-  expand(__MINGW64_VERSION_MINOR))
-
-int main(void)
-{
-  return 0;
-}
-#endif
--- a/CMake/FindBearSSL.cmake
+++ b/CMake/FindBearSSL.cmake
@ -21,38 +21,12 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the BearSSL library
-#
-# Input variables:
-#
-# - `BEARSSL_INCLUDE_DIR`:   The BearSSL include directory.
-# - `BEARSSL_LIBRARY`:       Path to `bearssl` library.
-#
-# Result variables:
-#
-# - `BEARSSL_FOUND`:         System has BearSSL.
-# - `BEARSSL_INCLUDE_DIRS`:  The BearSSL include directories.
-# - `BEARSSL_LIBRARIES`:     The BearSSL library names.
+find_path(BEARSSL_INCLUDE_DIRS bearssl.h)

-if(DEFINED BEARSSL_INCLUDE_DIRS AND NOT DEFINED BEARSSL_INCLUDE_DIR)
-  message(WARNING "BEARSSL_INCLUDE_DIRS is deprecated, use BEARSSL_INCLUDE_DIR instead.")
-  set(BEARSSL_INCLUDE_DIR "${BEARSSL_INCLUDE_DIRS}")
-  unset(BEARSSL_INCLUDE_DIRS)
-endif()
-
-find_path(BEARSSL_INCLUDE_DIR NAMES "bearssl.h")
-find_library(BEARSSL_LIBRARY NAMES "bearssl")
+find_library(BEARSSL_LIBRARY bearssl)

 include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(BearSSL
-  REQUIRED_VARS
-    BEARSSL_INCLUDE_DIR
-    BEARSSL_LIBRARY
-)
+find_package_handle_standard_args(BEARSSL DEFAULT_MSG
+  BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)

-if(BEARSSL_FOUND)
-  set(BEARSSL_INCLUDE_DIRS ${BEARSSL_INCLUDE_DIR})
-  set(BEARSSL_LIBRARIES    ${BEARSSL_LIBRARY})
-endif()
-
-mark_as_advanced(BEARSSL_INCLUDE_DIR BEARSSL_LIBRARY)
+mark_as_advanced(BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)
--- a/CMake/FindBrotli.cmake
+++ b/CMake/FindBrotli.cmake
@ -21,61 +21,23 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the brotli library
-#
-# Input variables:
-#
-# - `BROTLI_INCLUDE_DIR`:    The brotli include directory.
-# - `BROTLICOMMON_LIBRARY`:  Path to `brotlicommon` library.
-# - `BROTLIDEC_LIBRARY`:     Path to `brotlidec` library.
-#
-# Result variables:
-#
-# - `BROTLI_FOUND`:          System has brotli.
-# - `BROTLI_INCLUDE_DIRS`:   The brotli include directories.
-# - `BROTLI_LIBRARIES`:      The brotli library names.
-# - `BROTLI_LIBRARY_DIRS`:   The brotli library directories.
-# - `BROTLI_PC_REQUIRES`:    The brotli pkg-config packages.
-# - `BROTLI_CFLAGS`:         Required compiler flags.
-# - `BROTLI_VERSION`:        Version of brotli.
+include(FindPackageHandleStandardArgs)

-set(BROTLI_PC_REQUIRES "libbrotlidec")
+find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED BROTLI_INCLUDE_DIR AND
-   NOT DEFINED BROTLICOMMON_LIBRARY AND
-   NOT DEFINED BROTLIDEC_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(BROTLI "libbrotlicommon")
-  pkg_check_modules(BROTLIDEC ${BROTLI_PC_REQUIRES})
-endif()
+find_library(BROTLICOMMON_LIBRARY NAMES brotlicommon)
+find_library(BROTLIDEC_LIBRARY NAMES brotlidec)

-if(BROTLI_FOUND AND BROTLIDEC_FOUND)
-  set(Brotli_FOUND TRUE)
-  list(APPEND BROTLIDEC_LIBRARIES ${BROTLI_LIBRARIES})  # order is significant: brotlidec then brotlicommon
-  list(REVERSE BROTLIDEC_LIBRARIES)
-  list(REMOVE_DUPLICATES BROTLIDEC_LIBRARIES)
-  list(REVERSE BROTLIDEC_LIBRARIES)
-  set(BROTLI_LIBRARIES ${BROTLIDEC_LIBRARIES})
-  string(REPLACE ";" " " BROTLI_CFLAGS "${BROTLI_CFLAGS}")
-  message(STATUS "Found Brotli (via pkg-config): ${BROTLI_INCLUDE_DIRS} (found version \"${BROTLI_VERSION}\")")
-else()
-  find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")
-  find_library(BROTLICOMMON_LIBRARY NAMES "brotlicommon")
-  find_library(BROTLIDEC_LIBRARY NAMES "brotlidec")
+find_package_handle_standard_args(Brotli
+  FOUND_VAR
+    BROTLI_FOUND
+  REQUIRED_VARS
+    BROTLIDEC_LIBRARY
+    BROTLICOMMON_LIBRARY
+    BROTLI_INCLUDE_DIR
+  FAIL_MESSAGE
+    "Could NOT find Brotli"
+)

-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Brotli
-    REQUIRED_VARS
-      BROTLI_INCLUDE_DIR
-      BROTLIDEC_LIBRARY
-      BROTLICOMMON_LIBRARY
-  )
-
-  if(BROTLI_FOUND)
-    set(BROTLI_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
-    set(BROTLI_LIBRARIES ${BROTLIDEC_LIBRARY} ${BROTLICOMMON_LIBRARY})
-  endif()
-
-  mark_as_advanced(BROTLI_INCLUDE_DIR BROTLIDEC_LIBRARY BROTLICOMMON_LIBRARY)
-endif()
+set(BROTLI_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
+set(BROTLI_LIBRARIES ${BROTLIDEC_LIBRARY} ${BROTLICOMMON_LIBRARY})
--- a/CMake/FindCARES.cmake
+++ b/CMake/FindCARES.cmake
@ -0,0 +1,47 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# - Find c-ares
+# Find the c-ares includes and library
+# This module defines
+#  CARES_INCLUDE_DIR, where to find ares.h, etc.
+#  CARES_LIBRARIES, the libraries needed to use c-ares.
+#  CARES_FOUND, If false, do not try to use c-ares.
+# also defined, but not for general use are
+# CARES_LIBRARY, where to find the c-ares library.
+
+find_path(CARES_INCLUDE_DIR ares.h)
+
+set(CARES_NAMES ${CARES_NAMES} cares)
+find_library(CARES_LIBRARY
+  NAMES ${CARES_NAMES}
+  )
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(CARES
+  REQUIRED_VARS CARES_LIBRARY CARES_INCLUDE_DIR)
+
+mark_as_advanced(
+  CARES_LIBRARY
+  CARES_INCLUDE_DIR
+  )
--- a/CMake/FindCares.cmake
+++ b/CMake/FindCares.cmake
@ -1,97 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the c-ares library
-#
-# Input variables:
-#
-# - `CARES_INCLUDE_DIR`:   The c-ares include directory.
-# - `CARES_LIBRARY`:       Path to `cares` library.
-#
-# Result variables:
-#
-# - `CARES_FOUND`:         System has c-ares.
-# - `CARES_INCLUDE_DIRS`:  The c-ares include directories.
-# - `CARES_LIBRARIES`:     The c-ares library names.
-# - `CARES_LIBRARY_DIRS`:  The c-ares library directories.
-# - `CARES_PC_REQUIRES`:   The c-ares pkg-config packages.
-# - `CARES_CFLAGS`:        Required compiler flags.
-# - `CARES_VERSION`:       Version of c-ares.
-
-set(CARES_PC_REQUIRES "libcares")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED CARES_INCLUDE_DIR AND
-   NOT DEFINED CARES_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(CARES ${CARES_PC_REQUIRES})
-endif()
-
-if(CARES_FOUND)
-  set(Cares_FOUND TRUE)
-  string(REPLACE ";" " " CARES_CFLAGS "${CARES_CFLAGS}")
-  message(STATUS "Found Cares (via pkg-config): ${CARES_INCLUDE_DIRS} (found version \"${CARES_VERSION}\")")
-else()
-  find_path(CARES_INCLUDE_DIR NAMES "ares.h")
-  find_library(CARES_LIBRARY NAMES ${CARES_NAMES} "cares")
-
-  unset(CARES_VERSION CACHE)
-  if(CARES_INCLUDE_DIR AND EXISTS "${CARES_INCLUDE_DIR}/ares_version.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+ARES_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+ARES_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+ARES_VERSION_PATCH[\t ]+([0-9]+).*")
-    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(CARES_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Cares
-    REQUIRED_VARS
-      CARES_INCLUDE_DIR
-      CARES_LIBRARY
-    VERSION_VAR
-      CARES_VERSION
-  )
-
-  if(CARES_FOUND)
-    set(CARES_INCLUDE_DIRS ${CARES_INCLUDE_DIR})
-    set(CARES_LIBRARIES    ${CARES_LIBRARY})
-  endif()
-
-  mark_as_advanced(CARES_INCLUDE_DIR CARES_LIBRARY)
-endif()
-
-if(CARES_FOUND AND WIN32)
-  list(APPEND CARES_LIBRARIES "iphlpapi")  # for if_indextoname and others
-endif()
--- a/CMake/FindGSS.cmake
+++ b/CMake/FindGSS.cmake
@ -21,337 +21,292 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the GSS Kerberos library
+# - Try to find the GSS Kerberos library
+# Once done this will define
 #
-# Input variables:
+#  GSS_ROOT_DIR - Set this variable to the root installation of GSS
 #
-# - `GSS_ROOT_DIR`:      Set this variable to the root installation of GSS. (also supported as environment)
-#
-# Result variables:
-#
-# - `GSS_FOUND`:         System has the Heimdal library.
-# - `GSS_FLAVOUR`:       "GNU", "MIT" or "Heimdal" if anything found.
-# - `GSS_INCLUDE_DIRS`:  The GSS include directories.
-# - `GSS_LIBRARIES`:     The GSS library names.
-# - `GSS_LIBRARY_DIRS`:  The GSS library directories.
-# - `GSS_PC_REQUIRES`:   The GSS pkg-config packages.
-# - `GSS_CFLAGS`:        Required compiler flags.
-# - `GSS_VERSION`:       This is set to version advertised by pkg-config or read from manifest.
-#                        In case the library is found but no version info available it is set to "unknown"
+# Read-Only variables:
+#  GSS_FOUND - system has the Heimdal library
+#  GSS_FLAVOUR - "MIT" or "Heimdal" if anything found.
+#  GSS_INCLUDE_DIR - the Heimdal include directory
+#  GSS_LIBRARIES - The libraries needed to use GSS
+#  GSS_LINK_DIRECTORIES - Directories to add to linker search path
+#  GSS_LINKER_FLAGS - Additional linker flags
+#  GSS_COMPILER_FLAGS - Additional compiler flags
+#  GSS_VERSION - This is set to version advertised by pkg-config or read from manifest.
+#                In case the library is found but no version info available it'll be set to "unknown"

-set(_gnu_modname "gss")
-set(_mit_modname "mit-krb5-gssapi")
-set(_heimdal_modname "heimdal-gssapi")
+set(_MIT_MODNAME mit-krb5-gssapi)
+set(_HEIMDAL_MODNAME heimdal-gssapi)

 include(CheckIncludeFile)
 include(CheckIncludeFiles)
 include(CheckTypeSize)

-set(_gss_root_hints
+set(_GSS_ROOT_HINTS
  "${GSS_ROOT_DIR}"
  "$ENV{GSS_ROOT_DIR}"
 )

-# Try to find library using system pkg-config if user did not specify root dir
+# try to find library using system pkg-config if user didn't specify root dir
 if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}")
-  if(CURL_USE_PKGCONFIG)
+  if(UNIX)
    find_package(PkgConfig QUIET)
-    pkg_search_module(_GSS ${_gnu_modname} ${_mit_modname} ${_heimdal_modname})
-    list(APPEND _gss_root_hints "${_GSS_PREFIX}")
-  endif()
-  if(WIN32)
-    list(APPEND _gss_root_hints "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
+    pkg_search_module(_GSS_PKG ${_MIT_MODNAME} ${_HEIMDAL_MODNAME})
+    list(APPEND _GSS_ROOT_HINTS "${_GSS_PKG_PREFIX}")
+  elseif(WIN32)
+    list(APPEND _GSS_ROOT_HINTS "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
  endif()
 endif()

-if(NOT _GSS_FOUND)  # Not found by pkg-config. Let us take more traditional approach.
-  find_file(_gss_configure_script
+if(NOT _GSS_FOUND) #not found by pkg-config. Let's take more traditional approach.
+  find_file(_GSS_CONFIGURE_SCRIPT
    NAMES
      "krb5-config"
    HINTS
-      ${_gss_root_hints}
+      ${_GSS_ROOT_HINTS}
    PATH_SUFFIXES
-      "bin"
+      bin
    NO_CMAKE_PATH
    NO_CMAKE_ENVIRONMENT_PATH
  )

-  # If not found in user-supplied directories, maybe system knows better
-  find_file(_gss_configure_script
+  # if not found in user-supplied directories, maybe system knows better
+  find_file(_GSS_CONFIGURE_SCRIPT
    NAMES
      "krb5-config"
    PATH_SUFFIXES
-      "bin"
+      bin
  )

-  if(_gss_configure_script)
+  if(_GSS_CONFIGURE_SCRIPT)
    execute_process(
-      COMMAND ${_gss_configure_script} "--cflags" "gssapi"
+      COMMAND ${_GSS_CONFIGURE_SCRIPT} "--cflags" "gssapi"
      OUTPUT_VARIABLE _GSS_CFLAGS
-      RESULT_VARIABLE _gss_configure_failed
+      RESULT_VARIABLE _GSS_CONFIGURE_FAILED
      OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
-    message(STATUS "FindGSS krb5-config --cflags: ${_GSS_CFLAGS}")
-    if(NOT _gss_configure_failed)  # 0 means success
-      # Should also work in an odd case when multiple directories are given
+      )
+    message(STATUS "CFLAGS: ${_GSS_CFLAGS}")
+    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
+      # should also work in an odd case when multiple directories are given
      string(STRIP "${_GSS_CFLAGS}" _GSS_CFLAGS)
      string(REGEX REPLACE " +-I" ";" _GSS_CFLAGS "${_GSS_CFLAGS}")
      string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _GSS_CFLAGS "${_GSS_CFLAGS}")

-      foreach(_flag IN LISTS _GSS_CFLAGS)
-        if(_flag MATCHES "^-I")
+      foreach(_flag ${_GSS_CFLAGS})
+        if(_flag MATCHES "^-I.*")
          string(REGEX REPLACE "^-I" "" _val "${_flag}")
-          list(APPEND _GSS_INCLUDE_DIRS "${_val}")
+          list(APPEND _GSS_INCLUDE_DIR "${_val}")
        else()
-          list(APPEND _GSS_CFLAGS "${_flag}")
+          list(APPEND _GSS_COMPILER_FLAGS "${_flag}")
        endif()
      endforeach()
    endif()

    execute_process(
-      COMMAND ${_gss_configure_script} "--libs" "gssapi"
-      OUTPUT_VARIABLE _gss_lib_flags
-      RESULT_VARIABLE _gss_configure_failed
+      COMMAND ${_GSS_CONFIGURE_SCRIPT} "--libs" "gssapi"
+      OUTPUT_VARIABLE _GSS_LIB_FLAGS
+      RESULT_VARIABLE _GSS_CONFIGURE_FAILED
      OUTPUT_STRIP_TRAILING_WHITESPACE
    )
-    message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}")
+    message(STATUS "LDFLAGS: ${_GSS_LIB_FLAGS}")

-    if(NOT _gss_configure_failed)  # 0 means success
-      # This script gives us libraries and link directories. Blah. We have to deal with it.
-      string(STRIP "${_gss_lib_flags}" _gss_lib_flags)
-      string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
-      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
+    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
+      # this script gives us libraries and link directories. Blah. We have to deal with it.
+      string(STRIP "${_GSS_LIB_FLAGS}" _GSS_LIB_FLAGS)
+      string(REGEX REPLACE " +-(L|l)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")
+      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")

-      foreach(_flag IN LISTS _gss_lib_flags)
-        if(_flag MATCHES "^-l")
+      foreach(_flag ${_GSS_LIB_FLAGS})
+        if(_flag MATCHES "^-l.*")
          string(REGEX REPLACE "^-l" "" _val "${_flag}")
          list(APPEND _GSS_LIBRARIES "${_val}")
-        elseif(_flag MATCHES "^-L")
+        elseif(_flag MATCHES "^-L.*")
          string(REGEX REPLACE "^-L" "" _val "${_flag}")
-          list(APPEND _GSS_LIBRARY_DIRS "${_val}")
+          list(APPEND _GSS_LINK_DIRECTORIES "${_val}")
+        else()
+          list(APPEND _GSS_LINKER_FLAGS "${_flag}")
        endif()
      endforeach()
    endif()

    execute_process(
-      COMMAND ${_gss_configure_script} "--version"
+      COMMAND ${_GSS_CONFIGURE_SCRIPT} "--version"
      OUTPUT_VARIABLE _GSS_VERSION
-      RESULT_VARIABLE _gss_configure_failed
+      RESULT_VARIABLE _GSS_CONFIGURE_FAILED
      OUTPUT_STRIP_TRAILING_WHITESPACE
    )

-    # Older versions may not have the "--version" parameter. In this case we just do not care.
-    if(_gss_configure_failed)
+    # older versions may not have the "--version" parameter. In this case we just don't care.
+    if(_GSS_CONFIGURE_FAILED)
      set(_GSS_VERSION 0)
    endif()

    execute_process(
-      COMMAND ${_gss_configure_script} "--vendor"
-      OUTPUT_VARIABLE _gss_vendor
-      RESULT_VARIABLE _gss_configure_failed
+      COMMAND ${_GSS_CONFIGURE_SCRIPT} "--vendor"
+      OUTPUT_VARIABLE _GSS_VENDOR
+      RESULT_VARIABLE _GSS_CONFIGURE_FAILED
      OUTPUT_STRIP_TRAILING_WHITESPACE
    )

-    # Older versions may not have the "--vendor" parameter. In this case we just do not care.
-    if(_gss_configure_failed)
-      set(GSS_FLAVOUR "Heimdal")  # most probably, should not really matter
+    # older versions may not have the "--vendor" parameter. In this case we just don't care.
+    if(_GSS_CONFIGURE_FAILED)
+      set(GSS_FLAVOUR "Heimdal") # most probably, shouldn't really matter
    else()
-      if(_gss_vendor MATCHES "H|heimdal")
+      if(_GSS_VENDOR MATCHES ".*H|heimdal.*")
        set(GSS_FLAVOUR "Heimdal")
      else()
        set(GSS_FLAVOUR "MIT")
      endif()
    endif()

-  else()  # Either there is no config script or we are on a platform that does not provide one (Windows?)
+  else() # either there is no config script or we are on a platform that doesn't provide one (Windows?)

-    find_path(_GSS_INCLUDE_DIRS NAMES "gssapi/gssapi.h"
+    find_path(_GSS_INCLUDE_DIR
+      NAMES
+        "gssapi/gssapi.h"
      HINTS
-        ${_gss_root_hints}
+        ${_GSS_ROOT_HINTS}
      PATH_SUFFIXES
-        "include"
-        "inc"
+        include
+        inc
    )

-    if(_GSS_INCLUDE_DIRS)  # jay, we have found something
-      cmake_push_check_state()
-      list(APPEND CMAKE_REQUIRED_INCLUDES "${_GSS_INCLUDE_DIRS}")
-      check_include_files("gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _gss_have_mit_headers)
+    if(_GSS_INCLUDE_DIR) #jay, we've found something
+      set(CMAKE_REQUIRED_INCLUDES "${_GSS_INCLUDE_DIR}")
+      check_include_files( "gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _GSS_HAVE_MIT_HEADERS)

-      if(_gss_have_mit_headers)
+      if(_GSS_HAVE_MIT_HEADERS)
        set(GSS_FLAVOUR "MIT")
      else()
-        # Prevent compiling the header - just check if we can include it
-        list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D__ROKEN_H__")
-        check_include_file("roken.h" _gss_have_roken_h)
+        # prevent compiling the header - just check if we can include it
+        list(APPEND CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
+        check_include_file( "roken.h" _GSS_HAVE_ROKEN_H)

-        check_include_file("heimdal/roken.h" _gss_have_heimdal_roken_h)
-        if(_gss_have_roken_h OR _gss_have_heimdal_roken_h)
+        check_include_file( "heimdal/roken.h" _GSS_HAVE_HEIMDAL_ROKEN_H)
+        if(_GSS_HAVE_ROKEN_H OR _GSS_HAVE_HEIMDAL_ROKEN_H)
          set(GSS_FLAVOUR "Heimdal")
        endif()
+        list(REMOVE_ITEM CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
      endif()
-      cmake_pop_check_state()
    else()
-      # I am not convinced if this is the right way but this is what autotools do at the moment
-      find_path(_GSS_INCLUDE_DIRS NAMES "gssapi.h"
+      # I'm not convinced if this is the right way but this is what autotools do at the moment
+      find_path(_GSS_INCLUDE_DIR
+        NAMES
+          "gssapi.h"
        HINTS
-          ${_gss_root_hints}
+          ${_GSS_ROOT_HINTS}
        PATH_SUFFIXES
-          "include"
-          "inc"
+          include
+          inc
      )

-      if(_GSS_INCLUDE_DIRS)
+      if(_GSS_INCLUDE_DIR)
        set(GSS_FLAVOUR "Heimdal")
-      else()
-        find_path(_GSS_INCLUDE_DIRS NAMES "gss.h"
-          HINTS
-            ${_gss_root_hints}
-          PATH_SUFFIXES
-            "include"
-        )
-
-        if(_GSS_INCLUDE_DIRS)
-          set(GSS_FLAVOUR "GNU")
-          set(GSS_PC_REQUIRES "gss")
-        endif()
      endif()
    endif()

-    # If we have headers, check if we can link libraries
+    # if we have headers, check if we can link libraries
    if(GSS_FLAVOUR)
-      set(_gss_libdir_suffixes "")
-      set(_gss_libdir_hints ${_gss_root_hints})
-      get_filename_component(_gss_calculated_potential_root "${_GSS_INCLUDE_DIRS}" DIRECTORY)
-      list(APPEND _gss_libdir_hints ${_gss_calculated_potential_root})
+      set(_GSS_LIBDIR_SUFFIXES "")
+      set(_GSS_LIBDIR_HINTS ${_GSS_ROOT_HINTS})
+      get_filename_component(_GSS_CALCULATED_POTENTIAL_ROOT "${_GSS_INCLUDE_DIR}" PATH)
+      list(APPEND _GSS_LIBDIR_HINTS ${_GSS_CALCULATED_POTENTIAL_ROOT})

      if(WIN32)
        if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-          list(APPEND _gss_libdir_suffixes "lib/AMD64")
-          if(GSS_FLAVOUR STREQUAL "GNU")
-            set(_gss_libname "gss")
-          elseif(GSS_FLAVOUR STREQUAL "MIT")
-            set(_gss_libname "gssapi64")
+          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/AMD64")
+          if(GSS_FLAVOUR STREQUAL "MIT")
+            set(_GSS_LIBNAME "gssapi64")
          else()
-            set(_gss_libname "libgssapi")
+            set(_GSS_LIBNAME "libgssapi")
          endif()
        else()
-          list(APPEND _gss_libdir_suffixes "lib/i386")
-          if(GSS_FLAVOUR STREQUAL "GNU")
-            set(_gss_libname "gss")
-          elseif(GSS_FLAVOUR STREQUAL "MIT")
-            set(_gss_libname "gssapi32")
+          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/i386")
+          if(GSS_FLAVOUR STREQUAL "MIT")
+            set(_GSS_LIBNAME "gssapi32")
          else()
-            set(_gss_libname "libgssapi")
+            set(_GSS_LIBNAME "libgssapi")
          endif()
        endif()
      else()
-        list(APPEND _gss_libdir_suffixes "lib;lib64")  # those suffixes are not checked for HINTS
-        if(GSS_FLAVOUR STREQUAL "GNU")
-          set(_gss_libname "gss")
-        elseif(GSS_FLAVOUR STREQUAL "MIT")
-          set(_gss_libname "gssapi_krb5")
+        list(APPEND _GSS_LIBDIR_SUFFIXES "lib;lib64") # those suffixes are not checked for HINTS
+        if(GSS_FLAVOUR STREQUAL "MIT")
+          set(_GSS_LIBNAME "gssapi_krb5")
        else()
-          set(_gss_libname "gssapi")
+          set(_GSS_LIBNAME "gssapi")
        endif()
      endif()

-      find_library(_GSS_LIBRARIES NAMES ${_gss_libname}
+      find_library(_GSS_LIBRARIES
+        NAMES
+          ${_GSS_LIBNAME}
        HINTS
-          ${_gss_libdir_hints}
+          ${_GSS_LIBDIR_HINTS}
        PATH_SUFFIXES
-          ${_gss_libdir_suffixes}
+          ${_GSS_LIBDIR_SUFFIXES}
      )
+
    endif()
  endif()
 else()
-  # _GSS_MODULE_NAME set since CMake 3.16
-  if(_GSS_MODULE_NAME STREQUAL _gnu_modname OR _GSS_${_gnu_modname}_VERSION)
-    set(GSS_FLAVOUR "GNU")
-    set(GSS_PC_REQUIRES "gss")
-    if(NOT _GSS_VERSION)  # for old CMake versions?
-      set(_GSS_VERSION ${_GSS_${_gnu_modname}_VERSION})
-    endif()
-  elseif(_GSS_MODULE_NAME STREQUAL _mit_modname OR _GSS_${_mit_modname}_VERSION)
+  if(_GSS_PKG_${_MIT_MODNAME}_VERSION)
    set(GSS_FLAVOUR "MIT")
-    set(GSS_PC_REQUIRES "mit-krb5-gssapi")
-    if(NOT _GSS_VERSION)  # for old CMake versions?
-      set(_GSS_VERSION ${_GSS_${_mit_modname}_VERSION})
-    endif()
+    set(_GSS_VERSION _GSS_PKG_${_MIT_MODNAME}_VERSION)
  else()
    set(GSS_FLAVOUR "Heimdal")
-    set(GSS_PC_REQUIRES "heimdal-gssapi")
-    if(NOT _GSS_VERSION)  # for old CMake versions?
-      set(_GSS_VERSION ${_GSS_${_heimdal_modname}_VERSION})
-    endif()
+    set(_GSS_VERSION _GSS_PKG_${_MIT_HEIMDAL}_VERSION)
  endif()
-  message(STATUS "Found GSS/${GSS_FLAVOUR} (via pkg-config): ${_GSS_INCLUDE_DIRS} (found version \"${_GSS_VERSION}\")")
 endif()

-string(REPLACE ";" " " _GSS_CFLAGS "${_GSS_CFLAGS}")
-
-set(GSS_INCLUDE_DIRS ${_GSS_INCLUDE_DIRS})
+set(GSS_INCLUDE_DIR ${_GSS_INCLUDE_DIR})
 set(GSS_LIBRARIES ${_GSS_LIBRARIES})
-set(GSS_LIBRARY_DIRS ${_GSS_LIBRARY_DIRS})
-set(GSS_CFLAGS ${_GSS_CFLAGS})
+set(GSS_LINK_DIRECTORIES ${_GSS_LINK_DIRECTORIES})
+set(GSS_LINKER_FLAGS ${_GSS_LINKER_FLAGS})
+set(GSS_COMPILER_FLAGS ${_GSS_COMPILER_FLAGS})
 set(GSS_VERSION ${_GSS_VERSION})

 if(GSS_FLAVOUR)
  if(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "Heimdal")
    if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-      set(_heimdal_manifest_file "Heimdal.Application.amd64.manifest")
+      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.amd64.manifest")
    else()
-      set(_heimdal_manifest_file "Heimdal.Application.x86.manifest")
+      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.x86.manifest")
    endif()

-    if(EXISTS "${GSS_INCLUDE_DIRS}/${_heimdal_manifest_file}")
-      file(STRINGS "${GSS_INCLUDE_DIRS}/${_heimdal_manifest_file}" _heimdal_version_str
-        REGEX "^.*version=\"[0-9]\\.[^\"]+\".*$")
+    if(EXISTS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}")
+      file(STRINGS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}" heimdal_version_str
+           REGEX "^.*version=\"[0-9]\\.[^\"]+\".*$")

-      string(REGEX MATCH "[0-9]\\.[^\"]+" GSS_VERSION "${_heimdal_version_str}")
+      string(REGEX MATCH "[0-9]\\.[^\"]+"
+             GSS_VERSION "${heimdal_version_str}")
    endif()

    if(NOT GSS_VERSION)
      set(GSS_VERSION "Heimdal Unknown")
    endif()
  elseif(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "MIT")
-    get_filename_component(_mit_version "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME
-      CACHE)
-    if(WIN32 AND _mit_version)
-      set(GSS_VERSION "${_mit_version}")
+    get_filename_component(_MIT_VERSION "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME CACHE)
+    if(WIN32 AND _MIT_VERSION)
+      set(GSS_VERSION "${_MIT_VERSION}")
    else()
      set(GSS_VERSION "MIT Unknown")
    endif()
-  elseif(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "GNU")
-    if(GSS_INCLUDE_DIRS AND EXISTS "${GSS_INCLUDE_DIRS}/gss.h")
-      set(_version_regex "#[\t ]*define[\t ]+GSS_VERSION[\t ]+\"([^\"]*)\"")
-      file(STRINGS "${GSS_INCLUDE_DIRS}/gss.h" _version_str REGEX "${_version_regex}")
-      string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-      set(GSS_VERSION "${_version_str}")
-      unset(_version_regex)
-      unset(_version_str)
-    endif()
  endif()
 endif()

 include(FindPackageHandleStandardArgs)
+
+set(_GSS_REQUIRED_VARS GSS_LIBRARIES GSS_FLAVOUR)
+
 find_package_handle_standard_args(GSS
  REQUIRED_VARS
-    GSS_FLAVOUR
-    GSS_LIBRARIES
+    ${_GSS_REQUIRED_VARS}
  VERSION_VAR
    GSS_VERSION
  FAIL_MESSAGE
    "Could NOT find GSS, try to set the path to GSS root folder in the system variable GSS_ROOT_DIR"
 )

-mark_as_advanced(
-  _GSS_CFLAGS
-  _GSS_FOUND
-  _GSS_INCLUDE_DIRS
-  _GSS_LIBRARIES
-  _GSS_LIBRARY_DIRS
-  _GSS_MODULE_NAME
-  _GSS_PREFIX
-  _GSS_VERSION
-)
+mark_as_advanced(GSS_INCLUDE_DIR GSS_LIBRARIES)
--- a/CMake/FindLDAP.cmake
+++ b/CMake/FindLDAP.cmake
@ -1,111 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the ldap library
-#
-# Input variables:
-#
-# - `LDAP_INCLUDE_DIR`:   The ldap include directory.
-# - `LDAP_LIBRARY`:       Path to `ldap` library.
-# - `LDAP_LBER_LIBRARY`:  Path to `lber` library.
-#
-# Result variables:
-#
-# - `LDAP_FOUND`:         System has ldap.
-# - `LDAP_INCLUDE_DIRS`:  The ldap include directories.
-# - `LDAP_LIBRARIES`:     The ldap library names.
-# - `LDAP_LIBRARY_DIRS`:  The ldap library directories.
-# - `LDAP_PC_REQUIRES`:   The ldap pkg-config packages.
-# - `LDAP_CFLAGS`:        Required compiler flags.
-# - `LDAP_VERSION`:       Version of ldap.
-
-set(LDAP_PC_REQUIRES "ldap")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LDAP_INCLUDE_DIR AND
-   NOT DEFINED LDAP_LIBRARY AND
-   NOT DEFINED LDAP_LBER_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LDAP ${LDAP_PC_REQUIRES})
-  pkg_check_modules(LDAP_LBER "lber")
-endif()
-
-if(LDAP_FOUND AND LDAP_LBER_FOUND)
-  list(APPEND LDAP_LIBRARIES ${LDAP_LBER_LIBRARIES})
-  list(REVERSE LDAP_LIBRARIES)
-  list(REMOVE_DUPLICATES LDAP_LIBRARIES)
-  list(REVERSE LDAP_LIBRARIES)
-  string(REPLACE ";" " " LDAP_CFLAGS "${LDAP_CFLAGS}")
-  message(STATUS "Found LDAP (via pkg-config): ${LDAP_INCLUDE_DIRS} (found version \"${LDAP_VERSION}\")")
-else()
-  set(LDAP_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  # On Apple the SDK LDAP gets picked up from
-  # 'MacOSX.sdk/System/Library/Frameworks/LDAP.framework/Headers', which contains
-  # ldap.h and lber.h both being stubs to include <ldap.h> and <lber.h>.
-  # This causes an infinite inclusion loop in compile. Also do this for libraries
-  # to avoid picking up the 'ldap.framework' with a full path.
-  set(_save_cmake_system_framework_path ${CMAKE_SYSTEM_FRAMEWORK_PATH})
-  set(CMAKE_SYSTEM_FRAMEWORK_PATH "")
-  find_path(LDAP_INCLUDE_DIR NAMES "ldap.h")
-  find_library(LDAP_LIBRARY NAMES "ldap")
-  find_library(LDAP_LBER_LIBRARY NAMES "lber")
-  set(CMAKE_SYSTEM_FRAMEWORK_PATH ${_save_cmake_system_framework_path})
-
-  unset(LDAP_VERSION CACHE)
-  if(LDAP_INCLUDE_DIR AND EXISTS "${LDAP_INCLUDE_DIR}/ldap_features.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_PATCH[\t ]+([0-9]+).*")
-    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(LDAP_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(LDAP
-    REQUIRED_VARS
-      LDAP_INCLUDE_DIR
-      LDAP_LIBRARY
-      LDAP_LBER_LIBRARY
-    VERSION_VAR
-      LDAP_VERSION
-  )
-
-  if(LDAP_FOUND)
-    set(LDAP_INCLUDE_DIRS ${LDAP_INCLUDE_DIR})
-    set(LDAP_LIBRARIES    ${LDAP_LIBRARY} ${LDAP_LBER_LIBRARY})
-  endif()
-
-  mark_as_advanced(LDAP_INCLUDE_DIR LDAP_LIBRARY LDAP_LBER_LIBRARY)
-endif()
--- a/tests/http/CMakeLists.txt
+++ b/tests/http/CMakeLists.txt
@ -21,36 +21,25 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
+# - Try to find the libpsl library
+# Once done this will define
+#
+# LIBPSL_FOUND - system has the libpsl library
+# LIBPSL_INCLUDE_DIR - the libpsl include directory
+# LIBPSL_LIBRARY - the libpsl library name

-find_program(CADDY "caddy")  # /usr/bin/caddy
-if(NOT CADDY)
-  set(CADDY "")
+find_path(LIBPSL_INCLUDE_DIR libpsl.h)
+
+find_library(LIBPSL_LIBRARY NAMES psl libpsl)
+
+if(LIBPSL_INCLUDE_DIR)
+  file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" libpsl_version_str REGEX "^#define[\t ]+PSL_VERSION[\t ]+\"(.*)\"")
+  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBPSL_VERSION "${libpsl_version_str}")
 endif()
-mark_as_advanced(CADDY)

-find_program(VSFTPD "vsftpd")  # /usr/sbin/vsftpd
-if(NOT VSFTPD)
-  set(VSFTPD "")
-endif()
-mark_as_advanced(VSFTPD)
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(LibPSL
+  REQUIRED_VARS LIBPSL_LIBRARY LIBPSL_INCLUDE_DIR
+  VERSION_VAR LIBPSL_VERSION)

-find_program(HTTPD NAMES "/usr/sbin/apache2" "httpd" "apache2")
-if(NOT HTTPD)
-  set(HTTPD "")
-endif()
-mark_as_advanced(HTTPD)
-
-find_program(APXS "apxs")
-if(NOT APXS)
-  set(APXS "")
-endif()
-mark_as_advanced(APXS)
-
-find_program(HTTPD_NGHTTPX "nghttpx" PATHS "/usr/bin" "/usr/local/bin")
-if(NOT HTTPD_NGHTTPX)
-  set(HTTPD_NGHTTPX "")
-endif()
-mark_as_advanced(HTTPD_NGHTTPX)
-
-# Consumed variables: APXS, CADDY, HTTPD, HTTPD_NGHTTPX, VSFTPD
-configure_file("config.ini.in" "${CMAKE_CURRENT_BINARY_DIR}/config.ini" @ONLY)
+mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
--- a/CMake/FindLibSSH2.cmake
+++ b/CMake/FindLibSSH2.cmake
@ -0,0 +1,45 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# - Try to find the libssh2 library
+# Once done this will define
+#
+# LIBSSH2_FOUND - system has the libssh2 library
+# LIBSSH2_INCLUDE_DIR - the libssh2 include directory
+# LIBSSH2_LIBRARY - the libssh2 library name
+
+find_path(LIBSSH2_INCLUDE_DIR libssh2.h)
+
+find_library(LIBSSH2_LIBRARY NAMES ssh2 libssh2)
+
+if(LIBSSH2_INCLUDE_DIR)
+  file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" libssh2_version_str REGEX "^#define[\t ]+LIBSSH2_VERSION[\t ]+\"(.*)\"")
+  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBSSH2_VERSION "${libssh2_version_str}")
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(LibSSH2
+  REQUIRED_VARS LIBSSH2_LIBRARY LIBSSH2_INCLUDE_DIR
+  VERSION_VAR LIBSSH2_VERSION)
+
+mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
--- a/CMake/FindLibgsasl.cmake
+++ b/CMake/FindLibgsasl.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libgsasl library
-#
-# Input variables:
-#
-# - `LIBGSASL_INCLUDE_DIR`:   The libgsasl include directory.
-# - `LIBGSASL_LIBRARY`:       Path to `libgsasl` library.
-#
-# Result variables:
-#
-# - `LIBGSASL_FOUND`:         System has libgsasl.
-# - `LIBGSASL_INCLUDE_DIRS`:  The libgsasl include directories.
-# - `LIBGSASL_LIBRARIES`:     The libgsasl library names.
-# - `LIBGSASL_LIBRARY_DIRS`:  The libgsasl library directories.
-# - `LIBGSASL_PC_REQUIRES`:   The libgsasl pkg-config packages.
-# - `LIBGSASL_CFLAGS`:        Required compiler flags.
-# - `LIBGSASL_VERSION`:       Version of libgsasl.
-
-set(LIBGSASL_PC_REQUIRES "libgsasl")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBGSASL_INCLUDE_DIR AND
-   NOT DEFINED LIBGSASL_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBGSASL ${LIBGSASL_PC_REQUIRES})
-endif()
-
-if(LIBGSASL_FOUND)
-  set(Libgsasl_FOUND TRUE)
-  string(REPLACE ";" " " LIBGSASL_CFLAGS "${LIBGSASL_CFLAGS}")
-  message(STATUS "Found Libgsasl (via pkg-config): ${LIBGSASL_INCLUDE_DIRS} (found version \"${LIBGSASL_VERSION}\")")
-else()
-  find_path(LIBGSASL_INCLUDE_DIR NAMES "gsasl.h")
-  find_library(LIBGSASL_LIBRARY NAMES "gsasl" "libgsasl")
-
-  unset(LIBGSASL_VERSION CACHE)
-  if(LIBGSASL_INCLUDE_DIR AND EXISTS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h")
-    set(_version_regex "#[\t ]*define[\t ]+GSASL_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBGSASL_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-    find_package_handle_standard_args(Libgsasl
-    REQUIRED_VARS
-      LIBGSASL_INCLUDE_DIR
-      LIBGSASL_LIBRARY
-    VERSION_VAR
-      LIBGSASL_VERSION
-  )
-
-  if(LIBGSASL_FOUND)
-    set(LIBGSASL_INCLUDE_DIRS ${LIBGSASL_INCLUDE_DIR})
-    set(LIBGSASL_LIBRARIES    ${LIBGSASL_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBGSASL_INCLUDE_DIR LIBGSASL_LIBRARY)
-endif()
--- a/CMake/FindLibidn2.cmake
+++ b/CMake/FindLibidn2.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libidn2 library
-#
-# Input variables:
-#
-# - `LIBIDN2_INCLUDE_DIR`:   The libidn2 include directory.
-# - `LIBIDN2_LIBRARY`:       Path to `libidn2` library.
-#
-# Result variables:
-#
-# - `LIBIDN2_FOUND`:         System has libidn2.
-# - `LIBIDN2_INCLUDE_DIRS`:  The libidn2 include directories.
-# - `LIBIDN2_LIBRARIES`:     The libidn2 library names.
-# - `LIBIDN2_LIBRARY_DIRS`:  The libidn2 library directories.
-# - `LIBIDN2_PC_REQUIRES`:   The libidn2 pkg-config packages.
-# - `LIBIDN2_CFLAGS`:        Required compiler flags.
-# - `LIBIDN2_VERSION`:       Version of libidn2.
-
-set(LIBIDN2_PC_REQUIRES "libidn2")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBIDN2_INCLUDE_DIR AND
-   NOT DEFINED LIBIDN2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBIDN2 ${LIBIDN2_PC_REQUIRES})
-endif()
-
-if(LIBIDN2_FOUND)
-  set(Libidn2_FOUND TRUE)
-  string(REPLACE ";" " " LIBIDN2_CFLAGS "${LIBIDN2_CFLAGS}")
-  message(STATUS "Found Libidn2 (via pkg-config): ${LIBIDN2_INCLUDE_DIRS} (found version \"${LIBIDN2_VERSION}\")")
-else()
-  find_path(LIBIDN2_INCLUDE_DIR NAMES "idn2.h")
-  find_library(LIBIDN2_LIBRARY NAMES "idn2" "libidn2")
-
-  unset(LIBIDN2_VERSION CACHE)
-  if(LIBIDN2_INCLUDE_DIR AND EXISTS "${LIBIDN2_INCLUDE_DIR}/idn2.h")
-    set(_version_regex "#[\t ]*define[\t ]+IDN2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBIDN2_INCLUDE_DIR}/idn2.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBIDN2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libidn2
-    REQUIRED_VARS
-      LIBIDN2_INCLUDE_DIR
-      LIBIDN2_LIBRARY
-    VERSION_VAR
-      LIBIDN2_VERSION
-  )
-
-  if(LIBIDN2_FOUND)
-    set(LIBIDN2_INCLUDE_DIRS ${LIBIDN2_INCLUDE_DIR})
-    set(LIBIDN2_LIBRARIES    ${LIBIDN2_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBIDN2_INCLUDE_DIR LIBIDN2_LIBRARY)
-endif()
--- a/CMake/FindLibpsl.cmake
+++ b/CMake/FindLibpsl.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libpsl library
-#
-# Input variables:
-#
-# - `LIBPSL_INCLUDE_DIR`:   The libpsl include directory.
-# - `LIBPSL_LIBRARY`:       Path to `libpsl` library.
-#
-# Result variables:
-#
-# - `LIBPSL_FOUND`:         System has libpsl.
-# - `LIBPSL_INCLUDE_DIRS`:  The libpsl include directories.
-# - `LIBPSL_LIBRARIES`:     The libpsl library names.
-# - `LIBPSL_LIBRARY_DIRS`:  The libpsl library directories.
-# - `LIBPSL_PC_REQUIRES`:   The libpsl pkg-config packages.
-# - `LIBPSL_CFLAGS`:        Required compiler flags.
-# - `LIBPSL_VERSION`:       Version of libpsl.
-
-set(LIBPSL_PC_REQUIRES "libpsl")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBPSL_INCLUDE_DIR AND
-   NOT DEFINED LIBPSL_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBPSL ${LIBPSL_PC_REQUIRES})
-endif()
-
-if(LIBPSL_FOUND AND LIBPSL_INCLUDE_DIRS)
-  set(Libpsl_FOUND TRUE)
-  string(REPLACE ";" " " LIBPSL_CFLAGS "${LIBPSL_CFLAGS}")
-  message(STATUS "Found Libpsl (via pkg-config): ${LIBPSL_INCLUDE_DIRS} (found version \"${LIBPSL_VERSION}\")")
-else()
-  find_path(LIBPSL_INCLUDE_DIR NAMES "libpsl.h")
-  find_library(LIBPSL_LIBRARY NAMES "psl" "libpsl")
-
-  unset(LIBPSL_VERSION CACHE)
-  if(LIBPSL_INCLUDE_DIR AND EXISTS "${LIBPSL_INCLUDE_DIR}/libpsl.h")
-    set(_version_regex "#[\t ]*define[\t ]+PSL_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBPSL_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libpsl
-    REQUIRED_VARS
-      LIBPSL_INCLUDE_DIR
-      LIBPSL_LIBRARY
-    VERSION_VAR
-      LIBPSL_VERSION
-  )
-
-  if(LIBPSL_FOUND)
-    set(LIBPSL_INCLUDE_DIRS ${LIBPSL_INCLUDE_DIR})
-    set(LIBPSL_LIBRARIES    ${LIBPSL_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
-endif()
--- a/CMake/FindLibrtmp.cmake
+++ b/CMake/FindLibrtmp.cmake
@ -1,103 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the librtmp library
-#
-# Input variables:
-#
-# - `LIBRTMP_INCLUDE_DIR`:   The librtmp include directory.
-# - `LIBRTMP_LIBRARY`:       Path to `librtmp` library.
-#
-# Result variables:
-#
-# - `LIBRTMP_FOUND`:         System has librtmp.
-# - `LIBRTMP_INCLUDE_DIRS`:  The librtmp include directories.
-# - `LIBRTMP_LIBRARIES`:     The librtmp library names.
-# - `LIBRTMP_LIBRARY_DIRS`:  The librtmp library directories.
-# - `LIBRTMP_PC_REQUIRES`:   The librtmp pkg-config packages.
-# - `LIBRTMP_CFLAGS`:        Required compiler flags.
-# - `LIBRTMP_VERSION`:       Version of librtmp.
-
-set(LIBRTMP_PC_REQUIRES "librtmp")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBRTMP_INCLUDE_DIR AND
-   NOT DEFINED LIBRTMP_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBRTMP ${LIBRTMP_PC_REQUIRES})
-endif()
-
-if(LIBRTMP_FOUND AND LIBRTMP_INCLUDE_DIRS)
-  set(Librtmp_FOUND TRUE)
-  string(REPLACE ";" " " LIBRTMP_CFLAGS "${LIBRTMP_CFLAGS}")
-  message(STATUS "Found Librtmp (via pkg-config): ${LIBRTMP_INCLUDE_DIRS} (found version \"${LIBRTMP_VERSION}\")")
-else()
-  find_path(LIBRTMP_INCLUDE_DIR NAMES "librtmp/rtmp.h")
-  find_library(LIBRTMP_LIBRARY NAMES "rtmp")
-
-  unset(LIBRTMP_VERSION CACHE)
-  if(LIBRTMP_INCLUDE_DIR AND EXISTS "${LIBRTMP_INCLUDE_DIR}/librtmp/rtmp.h")
-    set(_version_regex "#[\t ]*define[\t ]+RTMP_LIB_VERSION[\t ]+0x([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F]).*")
-    file(STRINGS "${LIBRTMP_INCLUDE_DIR}/librtmp/rtmp.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str1 "${_version_str}")
-    string(REGEX REPLACE "${_version_regex}" "\\2" _version_str2 "${_version_str}")
-    if(CMAKE_VERSION VERSION_LESS 3.13)
-      # No support for hex version numbers, just strip leading zeroes
-      string(REGEX REPLACE "^0" "" _version_str1 "${_version_str1}")
-      string(REGEX REPLACE "^0" "" _version_str2 "${_version_str2}")
-    else()
-      math(EXPR _version_str1 "0x${_version_str1}" OUTPUT_FORMAT DECIMAL)
-      math(EXPR _version_str2 "0x${_version_str2}" OUTPUT_FORMAT DECIMAL)
-    endif()
-    set(LIBRTMP_VERSION "${_version_str1}.${_version_str2}")
-    unset(_version_regex)
-    unset(_version_str1)
-    unset(_version_str2)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Librtmp
-    REQUIRED_VARS
-      LIBRTMP_INCLUDE_DIR
-      LIBRTMP_LIBRARY
-    VERSION_VAR
-      LIBRTMP_VERSION
-  )
-
-  if(LIBRTMP_FOUND)
-    set(LIBRTMP_INCLUDE_DIRS ${LIBRTMP_INCLUDE_DIR})
-    set(LIBRTMP_LIBRARIES    ${LIBRTMP_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBRTMP_INCLUDE_DIR LIBRTMP_LIBRARY)
-
-  # Necessary when linking a static librtmp
-  find_package(OpenSSL)
-  if(OPENSSL_FOUND)
-    list(APPEND LIBRTMP_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
-  endif()
-endif()
-
-if(LIBRTMP_FOUND AND WIN32)
-  list(APPEND LIBRTMP_LIBRARIES "winmm")
-endif()
--- a/CMake/FindLibssh.cmake
+++ b/CMake/FindLibssh.cmake
@ -1,97 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libssh library
-#
-# Input variables:
-#
-# - `LIBSSH_INCLUDE_DIR`:   The libssh include directory.
-# - `LIBSSH_LIBRARY`:       Path to libssh library.
-#
-# Result variables:
-#
-# - `LIBSSH_FOUND`:         System has libssh.
-# - `LIBSSH_INCLUDE_DIRS`:  The libssh include directories.
-# - `LIBSSH_LIBRARIES`:     The libssh library names.
-# - `LIBSSH_LIBRARY_DIRS`:  The libssh library directories.
-# - `LIBSSH_PC_REQUIRES`:   The libssh pkg-config packages.
-# - `LIBSSH_CFLAGS`:        Required compiler flags.
-# - `LIBSSH_VERSION`:       Version of libssh.
-
-set(LIBSSH_PC_REQUIRES "libssh")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBSSH_INCLUDE_DIR AND
-   NOT DEFINED LIBSSH_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBSSH ${LIBSSH_PC_REQUIRES})
-endif()
-
-if(LIBSSH_FOUND)
-  set(Libssh_FOUND TRUE)
-  string(REPLACE ";" " " LIBSSH_CFLAGS "${LIBSSH_CFLAGS}")
-  message(STATUS "Found Libssh (via pkg-config): ${LIBSSH_INCLUDE_DIRS} (found version \"${LIBSSH_VERSION}\")")
-else()
-  find_path(LIBSSH_INCLUDE_DIR NAMES "libssh/libssh.h")
-  find_library(LIBSSH_LIBRARY NAMES "ssh" "libssh")
-
-  unset(LIBSSH_VERSION CACHE)
-  if(LIBSSH_INCLUDE_DIR AND EXISTS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+LIBSSH_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+LIBSSH_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+LIBSSH_VERSION_MICRO[\t ]+([0-9]+).*")
-    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(LIBSSH_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libssh
-    REQUIRED_VARS
-      LIBSSH_INCLUDE_DIR
-      LIBSSH_LIBRARY
-    VERSION_VAR
-      LIBSSH_VERSION
-  )
-
-  if(LIBSSH_FOUND)
-    set(LIBSSH_INCLUDE_DIRS ${LIBSSH_INCLUDE_DIR})
-    set(LIBSSH_LIBRARIES    ${LIBSSH_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBSSH_INCLUDE_DIR LIBSSH_LIBRARY)
-endif()
-
-if(LIBSSH_FOUND AND WIN32)
-  list(APPEND LIBSSH_LIBRARIES "iphlpapi")  # for if_nametoindex
-endif()
--- a/CMake/FindLibssh2.cmake
+++ b/CMake/FindLibssh2.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libssh2 library
-#
-# Input variables:
-#
-# - `LIBSSH2_INCLUDE_DIR`:   The libssh2 include directory.
-# - `LIBSSH2_LIBRARY`:       Path to `libssh2` library.
-#
-# Result variables:
-#
-# - `LIBSSH2_FOUND`:         System has libssh2.
-# - `LIBSSH2_INCLUDE_DIRS`:  The libssh2 include directories.
-# - `LIBSSH2_LIBRARIES`:     The libssh2 library names.
-# - `LIBSSH2_LIBRARY_DIRS`:  The libssh2 library directories.
-# - `LIBSSH2_PC_REQUIRES`:   The libssh2 pkg-config packages.
-# - `LIBSSH2_CFLAGS`:        Required compiler flags.
-# - `LIBSSH2_VERSION`:       Version of libssh2.
-
-set(LIBSSH2_PC_REQUIRES "libssh2")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBSSH2_INCLUDE_DIR AND
-   NOT DEFINED LIBSSH2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBSSH2 ${LIBSSH2_PC_REQUIRES})
-endif()
-
-if(LIBSSH2_FOUND AND LIBSSH2_INCLUDE_DIRS)
-  set(Libssh2_FOUND TRUE)
-  string(REPLACE ";" " " LIBSSH2_CFLAGS "${LIBSSH2_CFLAGS}")
-  message(STATUS "Found Libssh2 (via pkg-config): ${LIBSSH2_INCLUDE_DIRS} (found version \"${LIBSSH2_VERSION}\")")
-else()
-  find_path(LIBSSH2_INCLUDE_DIR NAMES "libssh2.h")
-  find_library(LIBSSH2_LIBRARY NAMES "ssh2" "libssh2")
-
-  unset(LIBSSH2_VERSION CACHE)
-  if(LIBSSH2_INCLUDE_DIR AND EXISTS "${LIBSSH2_INCLUDE_DIR}/libssh2.h")
-    set(_version_regex "#[\t ]*define[\t ]+LIBSSH2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBSSH2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libssh2
-    REQUIRED_VARS
-      LIBSSH2_INCLUDE_DIR
-      LIBSSH2_LIBRARY
-    VERSION_VAR
-      LIBSSH2_VERSION
-  )
-
-  if(LIBSSH2_FOUND)
-    set(LIBSSH2_INCLUDE_DIRS ${LIBSSH2_INCLUDE_DIR})
-    set(LIBSSH2_LIBRARIES    ${LIBSSH2_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
-endif()
--- a/CMake/FindLibuv.cmake
+++ b/CMake/FindLibuv.cmake
@ -1,93 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libuv library
-#
-# Input variables:
-#
-# - `LIBUV_INCLUDE_DIR`:   The libuv include directory.
-# - `LIBUV_LIBRARY`:       Path to `libuv` library.
-#
-# Result variables:
-#
-# - `LIBUV_FOUND`:         System has libuv.
-# - `LIBUV_INCLUDE_DIRS`:  The libuv include directories.
-# - `LIBUV_LIBRARIES`:     The libuv library names.
-# - `LIBUV_LIBRARY_DIRS`:  The libuv library directories.
-# - `LIBUV_PC_REQUIRES`:   The libuv pkg-config packages.
-# - `LIBUV_CFLAGS`:        Required compiler flags.
-# - `LIBUV_VERSION`:       Version of libuv.
-
-set(LIBUV_PC_REQUIRES "libuv")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBUV_INCLUDE_DIR AND
-   NOT DEFINED LIBUV_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBUV ${LIBUV_PC_REQUIRES})
-endif()
-
-if(LIBUV_FOUND)
-  set(Libuv_FOUND TRUE)
-  string(REPLACE ";" " " LIBUV_CFLAGS "${LIBUV_CFLAGS}")
-  message(STATUS "Found Libuv (via pkg-config): ${LIBUV_INCLUDE_DIRS} (found version \"${LIBUV_VERSION}\")")
-else()
-  find_path(LIBUV_INCLUDE_DIR NAMES "uv.h")
-  find_library(LIBUV_LIBRARY NAMES "uv" "libuv")
-
-  unset(LIBUV_VERSION CACHE)
-  if(LIBUV_INCLUDE_DIR AND EXISTS "${LIBUV_INCLUDE_DIR}/uv/version.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+UV_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+UV_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+UV_VERSION_PATCH[\t ]+([0-9]+).*")
-    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(LIBUV_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libuv
-    REQUIRED_VARS
-      LIBUV_INCLUDE_DIR
-      LIBUV_LIBRARY
-    VERSION_VAR
-      LIBUV_VERSION
-  )
-
-  if(LIBUV_FOUND)
-    set(LIBUV_INCLUDE_DIRS ${LIBUV_INCLUDE_DIR})
-    set(LIBUV_LIBRARIES    ${LIBUV_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBUV_INCLUDE_DIR LIBUV_LIBRARY)
-endif()
--- a/CMake/FindMSH3.cmake
+++ b/CMake/FindMSH3.cmake
@ -21,52 +21,50 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the msh3 library
-#
-# Input variables:
-#
-# - `MSH3_INCLUDE_DIR`:   The msh3 include directory.
-# - `MSH3_LIBRARY`:       Path to `msh3` library.
-#
-# Result variables:
-#
-# - `MSH3_FOUND`:         System has msh3.
-# - `MSH3_INCLUDE_DIRS`:  The msh3 include directories.
-# - `MSH3_LIBRARIES`:     The msh3 library names.
-# - `MSH3_LIBRARY_DIRS`:  The msh3 library directories.
-# - `MSH3_PC_REQUIRES`:   The msh3 pkg-config packages.
-# - `MSH3_CFLAGS`:        Required compiler flags.
-# - `MSH3_VERSION`:       Version of msh3.

-set(MSH3_PC_REQUIRES "libmsh3")
+#[=======================================================================[.rst:
+FindMSH3
+----------

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED MSH3_INCLUDE_DIR AND
-   NOT DEFINED MSH3_LIBRARY)
+Find the msh3 library
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``MSH3_FOUND``
+  System has msh3
+``MSH3_INCLUDE_DIRS``
+  The msh3 include directories.
+``MSH3_LIBRARIES``
+  The libraries needed to use msh3
+#]=======================================================================]
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(MSH3 ${MSH3_PC_REQUIRES})
+  pkg_search_module(PC_MSH3 libmsh3)
 endif()

+find_path(MSH3_INCLUDE_DIR msh3.h
+  HINTS
+    ${PC_MSH3_INCLUDEDIR}
+    ${PC_MSH3_INCLUDE_DIRS}
+)
+
+find_library(MSH3_LIBRARY NAMES msh3
+  HINTS
+    ${PC_MSH3_LIBDIR}
+    ${PC_MSH3_LIBRARY_DIRS}
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(MSH3
+  REQUIRED_VARS
+    MSH3_LIBRARY
+    MSH3_INCLUDE_DIR
+)
+
 if(MSH3_FOUND)
-  string(REPLACE ";" " " MSH3_CFLAGS "${MSH3_CFLAGS}")
-  message(STATUS "Found MSH3 (via pkg-config): ${MSH3_INCLUDE_DIRS} (found version \"${MSH3_VERSION}\")")
-else()
-  set(MSH3_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  find_path(MSH3_INCLUDE_DIR NAMES "msh3.h")
-  find_library(MSH3_LIBRARY NAMES "msh3")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(MSH3
-    REQUIRED_VARS
-      MSH3_INCLUDE_DIR
-      MSH3_LIBRARY
-  )
-
-  if(MSH3_FOUND)
-    set(MSH3_INCLUDE_DIRS ${MSH3_INCLUDE_DIR})
-    set(MSH3_LIBRARIES    ${MSH3_LIBRARY})
-  endif()
-
-  mark_as_advanced(MSH3_INCLUDE_DIR MSH3_LIBRARY)
+  set(MSH3_LIBRARIES    ${MSH3_LIBRARY})
+  set(MSH3_INCLUDE_DIRS ${MSH3_INCLUDE_DIR})
 endif()
+
+mark_as_advanced(MSH3_INCLUDE_DIRS MSH3_LIBRARIES)
--- a/CMake/FindMbedTLS.cmake
+++ b/CMake/FindMbedTLS.cmake
@ -21,95 +21,16 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the mbedTLS library
-#
-# Input variables:
-#
-# - `MBEDTLS_INCLUDE_DIR`:   The mbedTLS include directory.
-# - `MBEDTLS_LIBRARY`:       Path to `mbedtls` library.
-# - `MBEDX509_LIBRARY`:      Path to `mbedx509` library.
-# - `MBEDCRYPTO_LIBRARY`:    Path to `mbedcrypto` library.
-#
-# Result variables:
-#
-# - `MBEDTLS_FOUND`:         System has mbedTLS.
-# - `MBEDTLS_INCLUDE_DIRS`:  The mbedTLS include directories.
-# - `MBEDTLS_LIBRARIES`:     The mbedTLS library names.
-# - `MBEDTLS_LIBRARY_DIRS`:  The mbedTLS library directories.
-# - `MBEDTLS_PC_REQUIRES`:   The mbedTLS pkg-config packages.
-# - `MBEDTLS_CFLAGS`:        Required compiler flags.
-# - `MBEDTLS_VERSION`:       Version of mbedTLS.
+find_path(MBEDTLS_INCLUDE_DIRS mbedtls/ssl.h)

-if(DEFINED MBEDTLS_INCLUDE_DIRS AND NOT DEFINED MBEDTLS_INCLUDE_DIR)
-  message(WARNING "MBEDTLS_INCLUDE_DIRS is deprecated, use MBEDTLS_INCLUDE_DIR instead.")
-  set(MBEDTLS_INCLUDE_DIR "${MBEDTLS_INCLUDE_DIRS}")
-  unset(MBEDTLS_INCLUDE_DIRS)
-endif()
+find_library(MBEDTLS_LIBRARY mbedtls)
+find_library(MBEDX509_LIBRARY mbedx509)
+find_library(MBEDCRYPTO_LIBRARY mbedcrypto)

-set(MBEDTLS_PC_REQUIRES "mbedtls")
+set(MBEDTLS_LIBRARIES "${MBEDTLS_LIBRARY}" "${MBEDX509_LIBRARY}" "${MBEDCRYPTO_LIBRARY}")

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED MBEDTLS_INCLUDE_DIR AND
-   NOT DEFINED MBEDTLS_LIBRARY AND
-   NOT DEFINED MBEDX509_LIBRARY AND
-   NOT DEFINED MBEDCRYPTO_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(MBEDTLS ${MBEDTLS_PC_REQUIRES})
-  pkg_check_modules(MBEDX509 "mbedx509")
-  pkg_check_modules(MBEDCRYPTO "mbedcrypto")
-endif()
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(MbedTLS DEFAULT_MSG
+  MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)

-if(MBEDTLS_FOUND AND MBEDX509_FOUND AND MBEDCRYPTO_FOUND)
-  set(MbedTLS_FOUND TRUE)
-  list(APPEND MBEDTLS_LIBRARIES ${MBEDX509_LIBRARIES} ${MBEDCRYPTO_LIBRARIES})
-  list(REVERSE MBEDTLS_LIBRARIES)
-  list(REMOVE_DUPLICATES MBEDTLS_LIBRARIES)
-  list(REVERSE MBEDTLS_LIBRARIES)
-  string(REPLACE ";" " " MBEDTLS_CFLAGS "${MBEDTLS_CFLAGS}")
-  message(STATUS "Found MbedTLS (via pkg-config): ${MBEDTLS_INCLUDE_DIRS} (found version \"${MBEDTLS_VERSION}\")")
-else()
-  set(MBEDTLS_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  find_path(MBEDTLS_INCLUDE_DIR NAMES "mbedtls/ssl.h")
-  find_library(MBEDTLS_LIBRARY NAMES "mbedtls" "libmbedtls")
-  find_library(MBEDX509_LIBRARY NAMES "mbedx509" "libmbedx509")
-  find_library(MBEDCRYPTO_LIBRARY NAMES "mbedcrypto" "libmbedcrypto")
-
-  unset(MBEDTLS_VERSION CACHE)
-  if(MBEDTLS_INCLUDE_DIR)
-    if(EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")  # 3.x
-      set(_version_header "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
-    elseif(EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")  # 2.x
-      set(_version_header "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")
-    else()
-      unset(_version_header)
-    endif()
-    if(_version_header)
-      set(_version_regex "#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"([0-9.]+)\"")
-      file(STRINGS "${_version_header}" _version_str REGEX "${_version_regex}")
-      string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-      set(MBEDTLS_VERSION "${_version_str}")
-      unset(_version_regex)
-      unset(_version_str)
-      unset(_version_header)
-    endif()
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(MbedTLS
-    REQUIRED_VARS
-      MBEDTLS_INCLUDE_DIR
-      MBEDTLS_LIBRARY
-      MBEDX509_LIBRARY
-      MBEDCRYPTO_LIBRARY
-    VERSION_VAR
-      MBEDTLS_VERSION
-  )
-
-  if(MBEDTLS_FOUND)
-    set(MBEDTLS_INCLUDE_DIRS ${MBEDTLS_INCLUDE_DIR})
-    set(MBEDTLS_LIBRARIES    ${MBEDTLS_LIBRARY} ${MBEDX509_LIBRARY} ${MBEDCRYPTO_LIBRARY})
-  endif()
-
-  mark_as_advanced(MBEDTLS_INCLUDE_DIR MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
-endif()
+mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
--- a/CMake/FindNGHTTP2.cmake
+++ b/CMake/FindNGHTTP2.cmake
@ -21,62 +21,41 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the nghttp2 library
-#
-# Input variables:
-#
-# - `NGHTTP2_INCLUDE_DIR`:   The nghttp2 include directory.
-# - `NGHTTP2_LIBRARY`:       Path to `nghttp2` library.
-#
-# Result variables:
-#
-# - `NGHTTP2_FOUND`:         System has nghttp2.
-# - `NGHTTP2_INCLUDE_DIRS`:  The nghttp2 include directories.
-# - `NGHTTP2_LIBRARIES`:     The nghttp2 library names.
-# - `NGHTTP2_LIBRARY_DIRS`:  The nghttp2 library directories.
-# - `NGHTTP2_PC_REQUIRES`:   The nghttp2 pkg-config packages.
-# - `NGHTTP2_CFLAGS`:        Required compiler flags.
-# - `NGHTTP2_VERSION`:       Version of nghttp2.

-set(NGHTTP2_PC_REQUIRES "libnghttp2")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NGHTTP2_INCLUDE_DIR AND
-   NOT DEFINED NGHTTP2_LIBRARY)
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(NGHTTP2 ${NGHTTP2_PC_REQUIRES})
+  pkg_search_module(PC_NGHTTP2 "libnghttp2")
 endif()

+find_path(NGHTTP2_INCLUDE_DIR "nghttp2/nghttp2.h"
+  HINTS
+    ${PC_NGHTTP2_INCLUDEDIR}
+    ${PC_NGHTTP2_INCLUDE_DIRS}
+)
+
+find_library(NGHTTP2_LIBRARY NAMES "nghttp2" "nghttp2_static"
+  HINTS
+    ${PC_NGHTTP2_LIBDIR}
+    ${PC_NGHTTP2_LIBRARY_DIRS}
+)
+
+if(PC_NGHTTP2_VERSION)
+  set(NGHTTP2_VERSION ${PC_NGHTTP2_VERSION})
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NGHTTP2
+  FOUND_VAR
+    NGHTTP2_FOUND
+  REQUIRED_VARS
+    NGHTTP2_LIBRARY
+    NGHTTP2_INCLUDE_DIR
+  VERSION_VAR NGHTTP2_VERSION
+)
+
 if(NGHTTP2_FOUND)
-  string(REPLACE ";" " " NGHTTP2_CFLAGS "${NGHTTP2_CFLAGS}")
-  message(STATUS "Found NGHTTP2 (via pkg-config): ${NGHTTP2_INCLUDE_DIRS} (found version \"${NGHTTP2_VERSION}\")")
-else()
-  find_path(NGHTTP2_INCLUDE_DIR NAMES "nghttp2/nghttp2.h")
-  find_library(NGHTTP2_LIBRARY NAMES "nghttp2" "nghttp2_static")
-
-  unset(NGHTTP2_VERSION CACHE)
-  if(NGHTTP2_INCLUDE_DIR AND EXISTS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h")
-    set(_version_regex "#[\t ]*define[\t ]+NGHTTP2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(NGHTTP2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(NGHTTP2
-    REQUIRED_VARS
-      NGHTTP2_INCLUDE_DIR
-      NGHTTP2_LIBRARY
-    VERSION_VAR
-      NGHTTP2_VERSION
-  )
-
-  if(NGHTTP2_FOUND)
-    set(NGHTTP2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
-    set(NGHTTP2_LIBRARIES    ${NGHTTP2_LIBRARY})
-  endif()
-
-  mark_as_advanced(NGHTTP2_INCLUDE_DIR NGHTTP2_LIBRARY)
+  set(NGHTTP2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
+  set(NGHTTP2_LIBRARIES    ${NGHTTP2_LIBRARY})
 endif()
+
+mark_as_advanced(NGHTTP2_INCLUDE_DIRS NGHTTP2_LIBRARIES)
--- a/CMake/FindNGHTTP3.cmake
+++ b/CMake/FindNGHTTP3.cmake
@ -21,62 +21,58 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the nghttp3 library
-#
-# Input variables:
-#
-# - `NGHTTP3_INCLUDE_DIR`:   The nghttp3 include directory.
-# - `NGHTTP3_LIBRARY`:       Path to `nghttp3` library.
-#
-# Result variables:
-#
-# - `NGHTTP3_FOUND`:         System has nghttp3.
-# - `NGHTTP3_INCLUDE_DIRS`:  The nghttp3 include directories.
-# - `NGHTTP3_LIBRARIES`:     The nghttp3 library names.
-# - `NGHTTP3_LIBRARY_DIRS`:  The nghttp3 library directories.
-# - `NGHTTP3_PC_REQUIRES`:   The nghttp3 pkg-config packages.
-# - `NGHTTP3_CFLAGS`:        Required compiler flags.
-# - `NGHTTP3_VERSION`:       Version of nghttp3.

-set(NGHTTP3_PC_REQUIRES "libnghttp3")
+#[=======================================================================[.rst:
+FindNGHTTP3
+----------

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NGHTTP3_INCLUDE_DIR AND
-   NOT DEFINED NGHTTP3_LIBRARY)
+Find the nghttp3 library
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``NGHTTP3_FOUND``
+  System has nghttp3
+``NGHTTP3_INCLUDE_DIRS``
+  The nghttp3 include directories.
+``NGHTTP3_LIBRARIES``
+  The libraries needed to use nghttp3
+``NGHTTP3_VERSION``
+  version of nghttp3.
+#]=======================================================================]
+
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(NGHTTP3 ${NGHTTP3_PC_REQUIRES})
+  pkg_search_module(PC_NGHTTP3 libnghttp3)
 endif()

+find_path(NGHTTP3_INCLUDE_DIR nghttp3/nghttp3.h
+  HINTS
+    ${PC_NGHTTP3_INCLUDEDIR}
+    ${PC_NGHTTP3_INCLUDE_DIRS}
+)
+
+find_library(NGHTTP3_LIBRARY NAMES nghttp3
+  HINTS
+    ${PC_NGHTTP3_LIBDIR}
+    ${PC_NGHTTP3_LIBRARY_DIRS}
+)
+
+if(PC_NGHTTP3_VERSION)
+  set(NGHTTP3_VERSION ${PC_NGHTTP3_VERSION})
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NGHTTP3
+  REQUIRED_VARS
+    NGHTTP3_LIBRARY
+    NGHTTP3_INCLUDE_DIR
+  VERSION_VAR NGHTTP3_VERSION
+)
+
 if(NGHTTP3_FOUND)
-  string(REPLACE ";" " " NGHTTP3_CFLAGS "${NGHTTP3_CFLAGS}")
-  message(STATUS "Found NGHTTP3 (via pkg-config): ${NGHTTP3_INCLUDE_DIRS} (found version \"${NGHTTP3_VERSION}\")")
-else()
-  find_path(NGHTTP3_INCLUDE_DIR NAMES "nghttp3/nghttp3.h")
-  find_library(NGHTTP3_LIBRARY NAMES "nghttp3")
-
-  unset(NGHTTP3_VERSION CACHE)
-  if(NGHTTP3_INCLUDE_DIR AND EXISTS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h")
-    set(_version_regex "#[\t ]*define[\t ]+NGHTTP3_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(NGHTTP3_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(NGHTTP3
-    REQUIRED_VARS
-      NGHTTP3_INCLUDE_DIR
-      NGHTTP3_LIBRARY
-    VERSION_VAR
-      NGHTTP3_VERSION
-  )
-
-  if(NGHTTP3_FOUND)
-    set(NGHTTP3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
-    set(NGHTTP3_LIBRARIES    ${NGHTTP3_LIBRARY})
-  endif()
-
-  mark_as_advanced(NGHTTP3_INCLUDE_DIR NGHTTP3_LIBRARY)
+  set(NGHTTP3_LIBRARIES    ${NGHTTP3_LIBRARY})
+  set(NGHTTP3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
 endif()
+
+mark_as_advanced(NGHTTP3_INCLUDE_DIRS NGHTTP3_LIBRARIES)
--- a/CMake/FindNGTCP2.cmake
+++ b/CMake/FindNGTCP2.cmake
@ -21,110 +21,97 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the ngtcp2 library
-#
-# This module accepts optional COMPONENTS to control the crypto library (these are
-# mutually exclusive):
-#
-# - quictls:    Use `libngtcp2_crypto_quictls`.   (choose this for LibreSSL)
-# - BoringSSL:  Use `libngtcp2_crypto_boringssl`. (choose this for AWS-LC)
-# - wolfSSL:    Use `libngtcp2_crypto_wolfssl`.
-# - GnuTLS:     Use `libngtcp2_crypto_gnutls`.
-#
-# Input variables:
-#
-# - `NGTCP2_INCLUDE_DIR`:   The ngtcp2 include directory.
-# - `NGTCP2_LIBRARY`:       Path to `ngtcp2` library.
-#
-# Result variables:
-#
-# - `NGTCP2_FOUND`:         System has ngtcp2.
-# - `NGTCP2_INCLUDE_DIRS`:  The ngtcp2 include directories.
-# - `NGTCP2_LIBRARIES`:     The ngtcp2 library names.
-# - `NGTCP2_LIBRARY_DIRS`:  The ngtcp2 library directories.
-# - `NGTCP2_PC_REQUIRES`:   The ngtcp2 pkg-config packages.
-# - `NGTCP2_CFLAGS`:        Required compiler flags.
-# - `NGTCP2_VERSION`:       Version of ngtcp2.
+
+#[=======================================================================[.rst:
+FindNGTCP2
+----------
+
+Find the ngtcp2 library
+
+This module accepts optional COMPONENTS to control the crypto library (these are
+mutually exclusive)::
+
+  quictls, LibreSSL:  Use libngtcp2_crypto_quictls
+  BoringSSL, AWS-LC:  Use libngtcp2_crypto_boringssl
+  wolfSSL:            Use libngtcp2_crypto_wolfssl
+  GnuTLS:             Use libngtcp2_crypto_gnutls
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``NGTCP2_FOUND``
+  System has ngtcp2
+``NGTCP2_INCLUDE_DIRS``
+  The ngtcp2 include directories.
+``NGTCP2_LIBRARIES``
+  The libraries needed to use ngtcp2
+``NGTCP2_VERSION``
+  version of ngtcp2.
+#]=======================================================================]
+
+if(UNIX)
+  find_package(PkgConfig QUIET)
+  pkg_search_module(PC_NGTCP2 libngtcp2)
+endif()
+
+find_path(NGTCP2_INCLUDE_DIR ngtcp2/ngtcp2.h
+  HINTS
+    ${PC_NGTCP2_INCLUDEDIR}
+    ${PC_NGTCP2_INCLUDE_DIRS}
+)
+
+find_library(NGTCP2_LIBRARY NAMES ngtcp2
+  HINTS
+    ${PC_NGTCP2_LIBDIR}
+    ${PC_NGTCP2_LIBRARY_DIRS}
+)
+
+if(PC_NGTCP2_VERSION)
+  set(NGTCP2_VERSION ${PC_NGTCP2_VERSION})
+endif()

 if(NGTCP2_FIND_COMPONENTS)
-  set(_ngtcp2_crypto_backend "")
-  foreach(_component IN LISTS NGTCP2_FIND_COMPONENTS)
-    if(_component MATCHES "^(BoringSSL|quictls|wolfSSL|GnuTLS)")
-      if(_ngtcp2_crypto_backend)
+  set(NGTCP2_CRYPTO_BACKEND "")
+  foreach(component IN LISTS NGTCP2_FIND_COMPONENTS)
+    if(component MATCHES "^(BoringSSL|quictls|wolfSSL|GnuTLS)")
+      if(NGTCP2_CRYPTO_BACKEND)
        message(FATAL_ERROR "NGTCP2: Only one crypto library can be selected")
      endif()
-      set(_ngtcp2_crypto_backend ${_component})
+      set(NGTCP2_CRYPTO_BACKEND ${component})
    endif()
  endforeach()

-  if(_ngtcp2_crypto_backend)
-    string(TOLOWER "ngtcp2_crypto_${_ngtcp2_crypto_backend}" _crypto_library_lower)
-    string(TOUPPER "ngtcp2_crypto_${_ngtcp2_crypto_backend}" _crypto_library_upper)
-  endif()
-endif()
-
-set(NGTCP2_PC_REQUIRES "libngtcp2")
-if(_ngtcp2_crypto_backend)
-  set(NGTCP2_CRYPTO_PC_REQUIRES "lib${_crypto_library_lower}")
-endif()
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NGTCP2_INCLUDE_DIR AND
-   NOT DEFINED NGTCP2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(NGTCP2 ${NGTCP2_PC_REQUIRES})
-  if(_ngtcp2_crypto_backend)
-    pkg_check_modules("${_crypto_library_upper}" ${NGTCP2_CRYPTO_PC_REQUIRES})
-  else()
-    set("${_crypto_library_upper}_FOUND" TRUE)
-  endif()
-endif()
-
-list(APPEND NGTCP2_PC_REQUIRES ${NGTCP2_CRYPTO_PC_REQUIRES})
-
-if(NGTCP2_FOUND AND "${${_crypto_library_upper}_FOUND}")
-  list(APPEND NGTCP2_LIBRARIES "${${_crypto_library_upper}_LIBRARIES}")
-  list(REMOVE_DUPLICATES NGTCP2_LIBRARIES)
-  string(REPLACE ";" " " NGTCP2_CFLAGS "${NGTCP2_CFLAGS}")
-  message(STATUS "Found NGTCP2 (via pkg-config): ${NGTCP2_INCLUDE_DIRS} (found version \"${NGTCP2_VERSION}\")")
-else()
-  find_path(NGTCP2_INCLUDE_DIR NAMES "ngtcp2/ngtcp2.h")
-  find_library(NGTCP2_LIBRARY NAMES "ngtcp2")
-
-  unset(NGTCP2_VERSION CACHE)
-  if(NGTCP2_INCLUDE_DIR AND EXISTS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h")
-    set(_version_regex "#[\t ]*define[\t ]+NGTCP2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(NGTCP2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  if(_ngtcp2_crypto_backend)
-    get_filename_component(_ngtcp2_library_dir "${NGTCP2_LIBRARY}" DIRECTORY)
-    find_library(${_crypto_library_upper}_LIBRARY NAMES ${_crypto_library_lower} HINTS ${_ngtcp2_library_dir})
-
-    if(${_crypto_library_upper}_LIBRARY)
-      set(NGTCP2_${_ngtcp2_crypto_backend}_FOUND TRUE)
-      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library_upper}_LIBRARY})
+  if(NGTCP2_CRYPTO_BACKEND)
+    string(TOLOWER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library)
+    if(UNIX)
+      pkg_search_module(PC_${_crypto_library} lib${_crypto_library})
+    endif()
+    find_library(${_crypto_library}_LIBRARY
+      NAMES
+        ${_crypto_library}
+      HINTS
+        ${PC_${_crypto_library}_LIBDIR}
+        ${PC_${_crypto_library}_LIBRARY_DIRS}
+    )
+    if(${_crypto_library}_LIBRARY)
+      set(NGTCP2_${NGTCP2_CRYPTO_BACKEND}_FOUND TRUE)
+      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library}_LIBRARY})
    endif()
  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(NGTCP2
-    REQUIRED_VARS
-      NGTCP2_INCLUDE_DIR
-      NGTCP2_LIBRARY
-    VERSION_VAR
-      NGTCP2_VERSION
-    HANDLE_COMPONENTS
-  )
-
-  if(NGTCP2_FOUND)
-    set(NGTCP2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
-    set(NGTCP2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
-  endif()
-
-  mark_as_advanced(NGTCP2_INCLUDE_DIR NGTCP2_LIBRARY NGTCP2_CRYPTO_LIBRARY)
 endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NGTCP2
+  REQUIRED_VARS
+    NGTCP2_LIBRARY
+    NGTCP2_INCLUDE_DIR
+  VERSION_VAR NGTCP2_VERSION
+  HANDLE_COMPONENTS
+)
+
+if(NGTCP2_FOUND)
+  set(NGTCP2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
+  set(NGTCP2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(NGTCP2_INCLUDE_DIRS NGTCP2_LIBRARIES)
--- a/CMake/FindNettle.cmake
+++ b/CMake/FindNettle.cmake
@ -21,63 +21,50 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the nettle library
+# - Try to find the nettle library
+# Once done this will define
 #
-# Input variables:
-#
-# - `NETTLE_INCLUDE_DIR`:   The nettle include directory.
-# - `NETTLE_LIBRARY`:       Path to `nettle` library.
-#
-# Result variables:
-#
-# - `NETTLE_FOUND`:         System has nettle.
-# - `NETTLE_INCLUDE_DIRS`:  The nettle include directories.
-# - `NETTLE_LIBRARIES`:     The nettle library names.
-# - `NETTLE_LIBRARY_DIRS`:  The nettle library directories.
-# - `NETTLE_PC_REQUIRES`:   The nettle pkg-config packages.
-# - `NETTLE_CFLAGS`:        Required compiler flags.
-# - `NETTLE_VERSION`:       Version of nettle.
+# NETTLE_FOUND - system has nettle
+# NETTLE_INCLUDE_DIRS - nettle include directories
+# NETTLE_LIBRARIES - nettle library names

-set(NETTLE_PC_REQUIRES "nettle")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NETTLE_INCLUDE_DIR AND
-   NOT DEFINED NETTLE_LIBRARY)
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(NETTLE ${NETTLE_PC_REQUIRES})
+  pkg_check_modules(NETTLE "nettle")
 endif()

 if(NETTLE_FOUND)
-  set(Nettle_FOUND TRUE)
-  string(REPLACE ";" " " NETTLE_CFLAGS "${NETTLE_CFLAGS}")
-  message(STATUS "Found Nettle (via pkg-config): ${NETTLE_INCLUDE_DIRS} (found version \"${NETTLE_VERSION}\")")
+  set(NETTLE_LIBRARIES ${NETTLE_LINK_LIBRARIES})
 else()
  find_path(NETTLE_INCLUDE_DIR NAMES "nettle/sha2.h")
  find_library(NETTLE_LIBRARY NAMES "nettle")

-  unset(NETTLE_VERSION CACHE)
-  if(NETTLE_INCLUDE_DIR AND EXISTS "${NETTLE_INCLUDE_DIR}/nettle/version.h")
-    set(_version_regex1 "#[\t ]*define[ \t]+NETTLE_VERSION_MAJOR[ \t]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[ \t]+NETTLE_VERSION_MINOR[ \t]+([0-9]+).*")
-    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str2 REGEX "${_version_regex2}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    set(NETTLE_VERSION "${_version_str1}.${_version_str2}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_str1)
-    unset(_version_str2)
+  if(NETTLE_INCLUDE_DIR)
+    if(EXISTS "${NETTLE_INCLUDE_DIR}/nettle/version.h")
+      set(_version_regex_major "^#define[ \t]+NETTLE_VERSION_MAJOR[ \t]+([0-9]+).*")
+      set(_version_regex_minor "^#define[ \t]+NETTLE_VERSION_MINOR[ \t]+([0-9]+).*")
+      file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h"
+        _version_major REGEX "${_version_regex_major}")
+      file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h"
+        _version_minor REGEX "${_version_regex_minor}")
+      string(REGEX REPLACE "${_version_regex_major}" "\\1" _version_major "${_version_major}")
+      string(REGEX REPLACE "${_version_regex_minor}" "\\1" _version_minor "${_version_minor}")
+      unset(_version_regex_major)
+      unset(_version_regex_minor)
+      set(NETTLE_VERSION "${_version_major}.${_version_minor}")
+      unset(_version_major)
+      unset(_version_minor)
+    else()
+      set(NETTLE_VERSION "0.0")
+    endif()
  endif()

  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Nettle
+  find_package_handle_standard_args("nettle"
    REQUIRED_VARS
      NETTLE_INCLUDE_DIR
      NETTLE_LIBRARY
-    VERSION_VAR
-      NETTLE_VERSION
-  )
+    VERSION_VAR NETTLE_VERSION)

  if(NETTLE_FOUND)
    set(NETTLE_INCLUDE_DIRS ${NETTLE_INCLUDE_DIR})
--- a/CMake/FindQUICHE.cmake
+++ b/CMake/FindQUICHE.cmake
@ -0,0 +1,70 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+#[=======================================================================[.rst:
+FindQUICHE
+----------
+
+Find the quiche library
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``QUICHE_FOUND``
+  System has quiche
+``QUICHE_INCLUDE_DIRS``
+  The quiche include directories.
+``QUICHE_LIBRARIES``
+  The libraries needed to use quiche
+#]=======================================================================]
+if(UNIX)
+  find_package(PkgConfig QUIET)
+  pkg_search_module(PC_QUICHE quiche)
+endif()
+
+find_path(QUICHE_INCLUDE_DIR quiche.h
+  HINTS
+    ${PC_QUICHE_INCLUDEDIR}
+    ${PC_QUICHE_INCLUDE_DIRS}
+)
+
+find_library(QUICHE_LIBRARY NAMES quiche
+  HINTS
+    ${PC_QUICHE_LIBDIR}
+    ${PC_QUICHE_LIBRARY_DIRS}
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(QUICHE
+  REQUIRED_VARS
+    QUICHE_LIBRARY
+    QUICHE_INCLUDE_DIR
+)
+
+if(QUICHE_FOUND)
+  set(QUICHE_LIBRARIES    ${QUICHE_LIBRARY})
+  set(QUICHE_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(QUICHE_INCLUDE_DIRS QUICHE_LIBRARIES)
--- a/CMake/FindQuiche.cmake
+++ b/CMake/FindQuiche.cmake
@ -1,71 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the quiche library
-#
-# Input variables:
-#
-# - `QUICHE_INCLUDE_DIR`:   The quiche include directory.
-# - `QUICHE_LIBRARY`:       Path to `quiche` library.
-#
-# Result variables:
-#
-# - `QUICHE_FOUND`:         System has quiche.
-# - `QUICHE_INCLUDE_DIRS`:  The quiche include directories.
-# - `QUICHE_LIBRARIES`:     The quiche library names.
-# - `QUICHE_LIBRARY_DIRS`:  The quiche library directories.
-# - `QUICHE_PC_REQUIRES`:   The quiche pkg-config packages.
-# - `QUICHE_CFLAGS`:        Required compiler flags.
-# - `QUICHE_VERSION`:       Version of quiche.
-
-set(QUICHE_PC_REQUIRES "quiche")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED QUICHE_INCLUDE_DIR AND
-   NOT DEFINED QUICHE_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(QUICHE ${QUICHE_PC_REQUIRES})
-endif()
-
-if(QUICHE_FOUND)
-  set(Quiche_FOUND TRUE)
-  string(REPLACE ";" " " QUICHE_CFLAGS "${QUICHE_CFLAGS}")
-  message(STATUS "Found Quiche (via pkg-config): ${QUICHE_INCLUDE_DIRS} (found version \"${QUICHE_VERSION}\")")
-else()
-  find_path(QUICHE_INCLUDE_DIR NAMES "quiche.h")
-  find_library(QUICHE_LIBRARY NAMES "quiche")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Quiche
-    REQUIRED_VARS
-      QUICHE_INCLUDE_DIR
-      QUICHE_LIBRARY
-  )
-
-  if(QUICHE_FOUND)
-    set(QUICHE_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
-    set(QUICHE_LIBRARIES    ${QUICHE_LIBRARY})
-  endif()
-
-  mark_as_advanced(QUICHE_INCLUDE_DIR QUICHE_LIBRARY)
-endif()
--- a/CMake/FindRustls.cmake
+++ b/CMake/FindRustls.cmake
@ -1,109 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the Rustls library
-#
-# Input variables:
-#
-# - `RUSTLS_INCLUDE_DIR`:   The Rustls include directory.
-# - `RUSTLS_LIBRARY`:       Path to `rustls` library.
-#
-# Result variables:
-#
-# - `RUSTLS_FOUND`:         System has Rustls.
-# - `RUSTLS_INCLUDE_DIRS`:  The Rustls include directories.
-# - `RUSTLS_LIBRARIES`:     The Rustls library names.
-# - `RUSTLS_LIBRARY_DIRS`:  The Rustls library directories.
-# - `RUSTLS_PC_REQUIRES`:   The Rustls pkg-config packages.
-# - `RUSTLS_CFLAGS`:        Required compiler flags.
-# - `RUSTLS_VERSION`:       Version of Rustls.
-
-set(RUSTLS_PC_REQUIRES "rustls")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED RUSTLS_INCLUDE_DIR AND
-   NOT DEFINED RUSTLS_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(RUSTLS ${RUSTLS_PC_REQUIRES})
-endif()
-
-if(RUSTLS_FOUND)
-  set(Rustls_FOUND TRUE)
-  string(REPLACE ";" " " RUSTLS_CFLAGS "${RUSTLS_CFLAGS}")
-  message(STATUS "Found Rustls (via pkg-config): ${RUSTLS_INCLUDE_DIRS} (found version \"${RUSTLS_VERSION}\")")
-else()
-  set(RUSTLS_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  find_path(RUSTLS_INCLUDE_DIR NAMES "rustls.h")
-  find_library(RUSTLS_LIBRARY NAMES "rustls")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Rustls
-    REQUIRED_VARS
-      RUSTLS_INCLUDE_DIR
-      RUSTLS_LIBRARY
-  )
-
-  if(RUSTLS_FOUND)
-    set(RUSTLS_INCLUDE_DIRS ${RUSTLS_INCLUDE_DIR})
-    set(RUSTLS_LIBRARIES    ${RUSTLS_LIBRARY})
-  endif()
-
-  mark_as_advanced(RUSTLS_INCLUDE_DIR RUSTLS_LIBRARY)
-endif()
-
-if(RUSTLS_FOUND)
-  if(APPLE)
-    find_library(SECURITY_FRAMEWORK NAMES "Security")
-    mark_as_advanced(SECURITY_FRAMEWORK)
-    if(NOT SECURITY_FRAMEWORK)
-      message(FATAL_ERROR "Security framework not found")
-    endif()
-    list(APPEND RUSTLS_LIBRARIES "-framework Security")
-
-    find_library(FOUNDATION_FRAMEWORK NAMES "Foundation")
-    mark_as_advanced(FOUNDATION_FRAMEWORK)
-    if(NOT FOUNDATION_FRAMEWORK)
-      message(FATAL_ERROR "Foundation framework not found")
-    endif()
-    list(APPEND RUSTLS_LIBRARIES "-framework Foundation")
-  elseif(NOT WIN32)
-    find_library(PTHREAD_LIBRARY NAMES "pthread")
-    if(PTHREAD_LIBRARY)
-      list(APPEND RUSTLS_LIBRARIES ${PTHREAD_LIBRARY})
-    endif()
-    mark_as_advanced(PTHREAD_LIBRARY)
-
-    find_library(DL_LIBRARY NAMES "dl")
-    if(DL_LIBRARY)
-      list(APPEND RUSTLS_LIBRARIES ${DL_LIBRARY})
-    endif()
-    mark_as_advanced(DL_LIBRARY)
-
-    find_library(MATH_LIBRARY NAMES "m")
-    if(MATH_LIBRARY)
-      list(APPEND RUSTLS_LIBRARIES ${MATH_LIBRARY})
-    endif()
-    mark_as_advanced(MATH_LIBRARY)
-  endif()
-endif()
--- a/CMake/FindWolfSSH.cmake
+++ b/CMake/FindWolfSSH.cmake
@ -1,65 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the wolfSSH library
-#
-# Input variables:
-#
-# - `WOLFSSH_INCLUDE_DIR`:   The wolfSSH include directory.
-# - `WOLFSSH_LIBRARY`:       Path to `wolfssh` library.
-#
-# Result variables:
-#
-# - `WOLFSSH_FOUND`:         System has wolfSSH.
-# - `WOLFSSH_INCLUDE_DIRS`:  The wolfSSH include directories.
-# - `WOLFSSH_LIBRARIES`:     The wolfSSH library names.
-# - `WOLFSSH_VERSION`:       Version of wolfSSH.
-
-find_path(WOLFSSH_INCLUDE_DIR NAMES "wolfssh/ssh.h")
-find_library(WOLFSSH_LIBRARY NAMES "wolfssh" "libwolfssh")
-
-unset(WOLFSSH_VERSION CACHE)
-if(WOLFSSH_INCLUDE_DIR AND EXISTS "${WOLFSSH_INCLUDE_DIR}/wolfssh/version.h")
-  set(_version_regex "#[\t ]*define[\t ]+LIBWOLFSSH_VERSION_STRING[\t ]+\"([^\"]*)\"")
-  file(STRINGS "${WOLFSSH_INCLUDE_DIR}/wolfssh/version.h" _version_str REGEX "${_version_regex}")
-  string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-  set(WOLFSSH_VERSION "${_version_str}")
-  unset(_version_regex)
-  unset(_version_str)
-endif()
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(WolfSSH
-  REQUIRED_VARS
-    WOLFSSH_INCLUDE_DIR
-    WOLFSSH_LIBRARY
-  VERSION_VAR
-    WOLFSSH_VERSION
-)
-
-if(WOLFSSH_FOUND)
-  set(WOLFSSH_INCLUDE_DIRS ${WOLFSSH_INCLUDE_DIR})
-  set(WOLFSSH_LIBRARIES    ${WOLFSSH_LIBRARY})
-endif()
-
-mark_as_advanced(WOLFSSH_INCLUDE_DIR WOLFSSH_LIBRARY)
--- a/CMake/FindWolfSSL.cmake
+++ b/CMake/FindWolfSSL.cmake
@ -21,80 +21,40 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the wolfSSL library
-#
-# Input variables:
-#
-# - `WOLFSSL_INCLUDE_DIR`:   The wolfSSL include directory.
-# - `WOLFSSL_LIBRARY`:       Path to `wolfssl` library.
-#
-# Result variables:
-#
-# - `WOLFSSL_FOUND`:         System has wolfSSL.
-# - `WOLFSSL_INCLUDE_DIRS`:  The wolfSSL include directories.
-# - `WOLFSSL_LIBRARIES`:     The wolfSSL library names.
-# - `WOLFSSL_LIBRARY_DIRS`:  The wolfSSL library directories.
-# - `WOLFSSL_PC_REQUIRES`:   The wolfSSL pkg-config packages.
-# - `WOLFSSL_CFLAGS`:        Required compiler flags.
-# - `WOLFSSL_VERSION`:       Version of wolfSSL.

-if(DEFINED WolfSSL_INCLUDE_DIR AND NOT DEFINED WOLFSSL_INCLUDE_DIR)
-  message(WARNING "WolfSSL_INCLUDE_DIR is deprecated, use WOLFSSL_INCLUDE_DIR instead.")
-  set(WOLFSSL_INCLUDE_DIR "${WolfSSL_INCLUDE_DIR}")
-endif()
-if(DEFINED WolfSSL_LIBRARY AND NOT DEFINED WOLFSSL_LIBRARY)
-  message(WARNING "WolfSSL_LIBRARY is deprecated, use WOLFSSL_LIBRARY instead.")
-  set(WOLFSSL_LIBRARY "${WolfSSL_LIBRARY}")
+find_package(PkgConfig QUIET)
+pkg_check_modules(PC_WOLFSSL QUIET "wolfssl")
+
+find_path(WolfSSL_INCLUDE_DIR
+  NAMES "wolfssl/ssl.h"
+  HINTS ${PC_WOLFSSL_INCLUDE_DIRS}
+)
+
+find_library(WolfSSL_LIBRARY
+  NAMES "wolfssl"
+  HINTS ${PC_WOLFSSL_LIBRARY_DIRS}
+)
+
+if(WolfSSL_INCLUDE_DIR)
+  set(_version_regex "^#define[ \t]+LIBWOLFSSL_VERSION_STRING[ \t]+\"([^\"]+)\".*")
+  file(STRINGS "${WolfSSL_INCLUDE_DIR}/wolfssl/version.h"
+    WolfSSL_VERSION REGEX "${_version_regex}")
+  string(REGEX REPLACE "${_version_regex}" "\\1"
+    WolfSSL_VERSION "${WolfSSL_VERSION}")
+  unset(_version_regex)
 endif()

-set(WOLFSSL_PC_REQUIRES "wolfssl")
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(WolfSSL
+  REQUIRED_VARS
+    WolfSSL_INCLUDE_DIR
+    WolfSSL_LIBRARY
+  VERSION_VAR WolfSSL_VERSION
+)

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED WOLFSSL_INCLUDE_DIR AND
-   NOT DEFINED WOLFSSL_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(WOLFSSL ${WOLFSSL_PC_REQUIRES})
+if(WolfSSL_FOUND)
+  set(WolfSSL_INCLUDE_DIRS ${WolfSSL_INCLUDE_DIR})
+  set(WolfSSL_LIBRARIES    ${WolfSSL_LIBRARY})
 endif()

-if(WOLFSSL_FOUND)
-  set(WolfSSL_FOUND TRUE)
-  string(REPLACE ";" " " WOLFSSL_CFLAGS "${WOLFSSL_CFLAGS}")
-  message(STATUS "Found WolfSSL (via pkg-config): ${WOLFSSL_INCLUDE_DIRS} (found version \"${WOLFSSL_VERSION}\")")
-else()
-  find_path(WOLFSSL_INCLUDE_DIR NAMES "wolfssl/ssl.h")
-  find_library(WOLFSSL_LIBRARY NAMES "wolfssl")
-
-  unset(WOLFSSL_VERSION CACHE)
-  if(WOLFSSL_INCLUDE_DIR AND EXISTS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h")
-    set(_version_regex "#[\t ]*define[\t ]+LIBWOLFSSL_VERSION_STRING[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(WOLFSSL_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(WolfSSL
-    REQUIRED_VARS
-      WOLFSSL_INCLUDE_DIR
-      WOLFSSL_LIBRARY
-    VERSION_VAR
-      WOLFSSL_VERSION
-  )
-
-  if(WOLFSSL_FOUND)
-    set(WOLFSSL_INCLUDE_DIRS ${WOLFSSL_INCLUDE_DIR})
-    set(WOLFSSL_LIBRARIES    ${WOLFSSL_LIBRARY})
-  endif()
-
-  mark_as_advanced(WOLFSSL_INCLUDE_DIR WOLFSSL_LIBRARY)
-endif()
-
-if(WOLFSSL_FOUND AND NOT WIN32)
-  find_library(MATH_LIBRARY NAMES "m")
-  if(MATH_LIBRARY)
-    list(APPEND WOLFSSL_LIBRARIES ${MATH_LIBRARY})  # for log and pow
-  endif()
-  mark_as_advanced(MATH_LIBRARY)
-endif()
+mark_as_advanced(WolfSSL_INCLUDE_DIR WolfSSL_LIBRARY)
--- a/CMake/FindZstd.cmake
+++ b/CMake/FindZstd.cmake
@ -21,82 +21,58 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the zstd library
-#
-# Input variables:
-#
-# - `ZSTD_INCLUDE_DIR`:   The zstd include directory.
-# - `ZSTD_LIBRARY`:       Path to `zstd` library.
-#
-# Result variables:
-#
-# - `ZSTD_FOUND`:         System has zstd.
-# - `ZSTD_INCLUDE_DIRS`:  The zstd include directories.
-# - `ZSTD_LIBRARIES`:     The zstd library names.
-# - `ZSTD_LIBRARY_DIRS`:  The zstd library directories.
-# - `ZSTD_PC_REQUIRES`:   The zstd pkg-config packages.
-# - `ZSTD_CFLAGS`:        Required compiler flags.
-# - `ZSTD_VERSION`:       Version of zstd.

-if(DEFINED Zstd_INCLUDE_DIR AND NOT DEFINED ZSTD_INCLUDE_DIR)
-  message(WARNING "Zstd_INCLUDE_DIR is deprecated, use ZSTD_INCLUDE_DIR instead.")
-  set(ZSTD_INCLUDE_DIR "${Zstd_INCLUDE_DIR}")
-endif()
-if(DEFINED Zstd_LIBRARY AND NOT DEFINED ZSTD_LIBRARY)
-  message(WARNING "Zstd_LIBRARY is deprecated, use ZSTD_LIBRARY instead.")
-  set(ZSTD_LIBRARY "${Zstd_LIBRARY}")
-endif()
+#[=======================================================================[.rst:
+FindZstd
+----------

-set(ZSTD_PC_REQUIRES "libzstd")
+Find the zstd library

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED ZSTD_INCLUDE_DIR AND
-   NOT DEFINED ZSTD_LIBRARY)
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``Zstd_FOUND``
+  System has zstd
+``Zstd_INCLUDE_DIRS``
+  The zstd include directories.
+``Zstd_LIBRARIES``
+  The libraries needed to use zstd
+#]=======================================================================]
+
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(ZSTD ${ZSTD_PC_REQUIRES})
+  pkg_search_module(PC_Zstd libzstd)
 endif()

-if(ZSTD_FOUND)
-  set(Zstd_FOUND TRUE)
-  string(REPLACE ";" " " ZSTD_CFLAGS "${ZSTD_CFLAGS}")
-  message(STATUS "Found Zstd (via pkg-config): ${ZSTD_INCLUDE_DIRS} (found version \"${ZSTD_VERSION}\")")
-else()
-  find_path(ZSTD_INCLUDE_DIR NAMES "zstd.h")
-  find_library(ZSTD_LIBRARY NAMES "zstd")
+find_path(Zstd_INCLUDE_DIR zstd.h
+  HINTS
+    ${PC_Zstd_INCLUDEDIR}
+    ${PC_Zstd_INCLUDE_DIRS}
+)

-  unset(ZSTD_VERSION CACHE)
-  if(ZSTD_INCLUDE_DIR AND EXISTS "${ZSTD_INCLUDE_DIR}/zstd.h")
-    set(_version_regex1 "#[\t ]*define[ \t]+ZSTD_VERSION_MAJOR[ \t]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[ \t]+ZSTD_VERSION_MINOR[ \t]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[ \t]+ZSTD_VERSION_RELEASE[ \t]+([0-9]+).*")
-    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(ZSTD_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
+find_library(Zstd_LIBRARY NAMES zstd
+  HINTS
+    ${PC_Zstd_LIBDIR}
+    ${PC_Zstd_LIBRARY_DIRS}
+)

-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Zstd
-    REQUIRED_VARS
-      ZSTD_INCLUDE_DIR
-      ZSTD_LIBRARY
-    VERSION_VAR
-      ZSTD_VERSION
-  )
-
-  if(ZSTD_FOUND)
-    set(ZSTD_INCLUDE_DIRS ${ZSTD_INCLUDE_DIR})
-    set(ZSTD_LIBRARIES    ${ZSTD_LIBRARY})
-  endif()
-
-  mark_as_advanced(ZSTD_INCLUDE_DIR ZSTD_LIBRARY)
+if(Zstd_INCLUDE_DIR)
+  file(READ "${Zstd_INCLUDE_DIR}/zstd.h" _zstd_header)
+  string(REGEX MATCH ".*define ZSTD_VERSION_MAJOR *([0-9]+).*define ZSTD_VERSION_MINOR *([0-9]+).*define ZSTD_VERSION_RELEASE *([0-9]+)" _zstd_ver "${_zstd_header}")
+  set(Zstd_VERSION "${CMAKE_MATCH_1}.${CMAKE_MATCH_2}.${CMAKE_MATCH_3}")
 endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Zstd
+  REQUIRED_VARS
+    Zstd_LIBRARY
+    Zstd_INCLUDE_DIR
+  VERSION_VAR Zstd_VERSION
+)
+
+if(Zstd_FOUND)
+  set(Zstd_LIBRARIES    ${Zstd_LIBRARY})
+  set(Zstd_INCLUDE_DIRS ${Zstd_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(Zstd_INCLUDE_DIRS Zstd_LIBRARIES)
--- a/CMake/Macros.cmake
+++ b/CMake/Macros.cmake
@ -21,76 +21,54 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# File defines convenience macros for available feature testing
+#File defines convenience macros for available feature testing

 # Check if header file exists and add it to the list.
 # This macro is intended to be called multiple times with a sequence of
 # possibly dependent header files.  Some headers depend on others to be
 # compiled correctly.
-macro(check_include_file_concat_curl _file _variable)
-  check_include_files("${CURL_INCLUDES};${_file}" ${_variable})
-  if(${_variable})
-    list(APPEND CURL_INCLUDES ${_file})
+macro(check_include_file_concat FILE VARIABLE)
+  check_include_files("${CURL_INCLUDES};${FILE}" ${VARIABLE})
+  if(${VARIABLE})
+    set(CURL_INCLUDES ${CURL_INCLUDES} ${FILE})
+    set(CURL_TEST_DEFINES "${CURL_TEST_DEFINES} -D${VARIABLE}")
  endif()
 endmacro()

-set(CURL_TEST_DEFINES "")  # Initialize global variable
-
 # For other curl specific tests, use this macro.
-# Return result in variable: CURL_TEST_OUTPUT
-macro(curl_internal_test _curl_test)
-  if(NOT DEFINED "${_curl_test}")
-    string(REPLACE ";" " " _cmake_required_definitions "${CMAKE_REQUIRED_DEFINITIONS}")
-    set(_curl_test_add_libraries "")
+macro(curl_internal_test CURL_TEST)
+  if(NOT DEFINED "${CURL_TEST}")
+    set(MACRO_CHECK_FUNCTION_DEFINITIONS
+      "-D${CURL_TEST} ${CURL_TEST_DEFINES} ${CMAKE_REQUIRED_FLAGS}")
    if(CMAKE_REQUIRED_LIBRARIES)
-      set(_curl_test_add_libraries
+      set(CURL_TEST_ADD_LIBRARIES
        "-DLINK_LIBRARIES:STRING=${CMAKE_REQUIRED_LIBRARIES}")
    endif()

-    message(STATUS "Performing Test ${_curl_test}")
-    try_compile(${_curl_test}
-      ${PROJECT_BINARY_DIR}
-      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c"
-      CMAKE_FLAGS
-        "-DCOMPILE_DEFINITIONS:STRING=-D${_curl_test} ${CURL_TEST_DEFINES} ${_cmake_required_definitions}"
-        "${_curl_test_add_libraries}"
-      OUTPUT_VARIABLE CURL_TEST_OUTPUT)
-    if(${_curl_test})
-      set(${_curl_test} 1 CACHE INTERNAL "Curl test")
-      message(STATUS "Performing Test ${_curl_test} - Success")
+    message(STATUS "Performing Test ${CURL_TEST}")
+    try_compile(${CURL_TEST}
+      ${CMAKE_BINARY_DIR}
+      ${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c
+      CMAKE_FLAGS -DCOMPILE_DEFINITIONS:STRING=${MACRO_CHECK_FUNCTION_DEFINITIONS}
+      "${CURL_TEST_ADD_LIBRARIES}"
+      OUTPUT_VARIABLE OUTPUT)
+    if(${CURL_TEST})
+      set(${CURL_TEST} 1 CACHE INTERNAL "Curl test")
+      message(STATUS "Performing Test ${CURL_TEST} - Success")
    else()
-      set(${_curl_test} "" CACHE INTERNAL "Curl test")
-      message(STATUS "Performing Test ${_curl_test} - Failed")
+      set(${CURL_TEST} "" CACHE INTERNAL "Curl test")
+      message(STATUS "Performing Test ${CURL_TEST} - Failed")
    endif()
  endif()
 endmacro()

-macro(curl_dependency_option _option_name _find_name _desc_name)
-  set(${_option_name} "AUTO" CACHE STRING "Build curl with ${_desc_name} support (AUTO, ON or OFF)")
-  set_property(CACHE ${_option_name} PROPERTY STRINGS "AUTO" "ON" "OFF")
+macro(optional_dependency DEPENDENCY)
+  set(CURL_${DEPENDENCY} AUTO CACHE STRING "Build curl with ${DEPENDENCY} support (AUTO, ON or OFF)")
+  set_property(CACHE CURL_${DEPENDENCY} PROPERTY STRINGS AUTO ON OFF)

-  if(${_option_name} STREQUAL "AUTO")
-    find_package(${_find_name})
-  elseif(${_option_name})
-    find_package(${_find_name} REQUIRED)
+  if(CURL_${DEPENDENCY} STREQUAL AUTO)
+    find_package(${DEPENDENCY})
+  elseif(CURL_${DEPENDENCY})
+    find_package(${DEPENDENCY} REQUIRED)
  endif()
 endmacro()
-
-# Convert the passed paths to libpath linker options and add them to CMAKE_REQUIRED_*.
-macro(curl_required_libpaths _libpaths_arg)
-  if(CMAKE_VERSION VERSION_LESS 3.31)
-    set(_libpaths "${_libpaths_arg}")
-    foreach(_libpath IN LISTS _libpaths)
-      list(APPEND CMAKE_REQUIRED_LINK_OPTIONS "${CMAKE_LIBRARY_PATH_FLAG}${_libpath}")
-    endforeach()
-  else()
-    list(APPEND CMAKE_REQUIRED_LINK_DIRECTORIES "${_libpaths_arg}")
-  endif()
-endmacro()
-
-# Pre-fill variables set by a check_type_size() call.
-macro(curl_prefill_type_size _type _size)
-  set(HAVE_SIZEOF_${_type} TRUE)
-  set(SIZEOF_${_type} ${_size})
-  set(SIZEOF_${_type}_CODE "#define SIZEOF_${_type} ${_size}")
-endmacro()
--- a/CMake/OtherTests.cmake
+++ b/CMake/OtherTests.cmake
@ -25,34 +25,32 @@ include(CheckCSourceCompiles)
 include(CheckCSourceRuns)
 include(CheckTypeSize)

-macro(curl_add_header_include _check _header)
-  if(${_check})
+macro(add_header_include check header)
+  if(${check})
    set(_source_epilogue "${_source_epilogue}
-      #include <${_header}>")
+      #include <${header}>")
  endif()
 endmacro()

-set(_cmake_try_compile_target_type_save ${CMAKE_TRY_COMPILE_TARGET_TYPE})
-set(CMAKE_TRY_COMPILE_TARGET_TYPE "STATIC_LIBRARY")
+set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)

 if(NOT DEFINED HAVE_STRUCT_SOCKADDR_STORAGE)
-  cmake_push_check_state()
-  set(CMAKE_EXTRA_INCLUDE_FILES "")
+  set(CMAKE_EXTRA_INCLUDE_FILES)
  if(WIN32)
    set(CMAKE_EXTRA_INCLUDE_FILES "winsock2.h")
-    list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32")
+    set(CMAKE_REQUIRED_DEFINITIONS "-DWIN32_LEAN_AND_MEAN")
+    set(CMAKE_REQUIRED_LIBRARIES "ws2_32")
  elseif(HAVE_SYS_SOCKET_H)
    set(CMAKE_EXTRA_INCLUDE_FILES "sys/socket.h")
  endif()
  check_type_size("struct sockaddr_storage" SIZEOF_STRUCT_SOCKADDR_STORAGE)
  set(HAVE_STRUCT_SOCKADDR_STORAGE ${HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE})
-  cmake_pop_check_state()
 endif()

 if(NOT WIN32)
  set(_source_epilogue "#undef inline")
-  curl_add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
-  curl_add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
+  add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
+  add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
  check_c_source_compiles("${_source_epilogue}
    int main(void)
    {
@ -63,11 +61,8 @@ if(NOT WIN32)
 endif()

 set(_source_epilogue "#undef inline")
-curl_add_header_include(HAVE_SYS_TIME_H "sys/time.h")
+add_header_include(HAVE_SYS_TIME_H "sys/time.h")
 check_c_source_compiles("${_source_epilogue}
-  #ifdef _MSC_VER
-  #include <winsock2.h>
-  #endif
  #include <time.h>
  int main(void)
  {
@ -78,8 +73,40 @@ check_c_source_compiles("${_source_epilogue}
    return 0;
  }" HAVE_STRUCT_TIMEVAL)

-set(CMAKE_TRY_COMPILE_TARGET_TYPE ${_cmake_try_compile_target_type_save})
-unset(_cmake_try_compile_target_type_save)
+unset(CMAKE_TRY_COMPILE_TARGET_TYPE)
+
+if(NOT CMAKE_CROSSCOMPILING AND NOT APPLE)
+  set(_source_epilogue "#undef inline")
+  add_header_include(HAVE_SYS_POLL_H "sys/poll.h")
+  add_header_include(HAVE_POLL_H "poll.h")
+  check_c_source_runs("${_source_epilogue}
+    #include <stdlib.h>
+    #include <sys/time.h>
+    int main(void)
+    {
+      if(0 != poll(0, 0, 10)) {
+        return 1; /* fail */
+      }
+      else {
+        /* detect the 10.12 poll() breakage */
+        struct timeval before, after;
+        int rc;
+        size_t us;
+
+        gettimeofday(&before, NULL);
+        rc = poll(NULL, 0, 500);
+        gettimeofday(&after, NULL);
+
+        us = (after.tv_sec - before.tv_sec) * 1000000 +
+          (after.tv_usec - before.tv_usec);
+
+        if(us < 400000) {
+          return 1;
+        }
+      }
+      return 0;
+    }" HAVE_POLL_FINE)
+endif()

 # Detect HAVE_GETADDRINFO_THREADSAFE

@ -95,22 +122,23 @@ elseif(APPLE OR
       CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
       CMAKE_SYSTEM_NAME STREQUAL "SunOS")
  set(HAVE_GETADDRINFO_THREADSAFE TRUE)
-elseif(BSD OR CMAKE_SYSTEM_NAME MATCHES "BSD")
+elseif(CMAKE_SYSTEM_NAME MATCHES "BSD")
  set(HAVE_GETADDRINFO_THREADSAFE FALSE)
 endif()

 if(NOT DEFINED HAVE_GETADDRINFO_THREADSAFE)
  set(_source_epilogue "#undef inline")
-  curl_add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
-  curl_add_header_include(HAVE_SYS_TIME_H "sys/time.h")
-  curl_add_header_include(HAVE_NETDB_H "netdb.h")
+  add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
+  add_header_include(HAVE_SYS_TIME_H "sys/time.h")
+  add_header_include(HAVE_NETDB_H "netdb.h")
  check_c_source_compiles("${_source_epilogue}
    int main(void)
    {
-    #ifndef h_errno
+    #ifdef h_errno
+      return 0;
+    #else
      #error force compilation error
    #endif
-      return 0;
    }" HAVE_H_ERRNO)

  if(NOT HAVE_H_ERRNO)
@ -126,11 +154,12 @@ if(NOT DEFINED HAVE_GETADDRINFO_THREADSAFE)
        int main(void)
        {
        #if defined(_POSIX_C_SOURCE) && (_POSIX_C_SOURCE >= 200809L)
+          return 0;
        #elif defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 700)
+          return 0;
        #else
          #error force compilation error
        #endif
-          return 0;
        }" HAVE_H_ERRNO_SBS_ISSUE_7)
    endif()
  endif()
@ -142,8 +171,8 @@ endif()

 if(NOT WIN32 AND NOT DEFINED HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
  set(_source_epilogue "#undef inline")
-  curl_add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
-  curl_add_header_include(HAVE_SYS_TIME_H "sys/time.h")
+  add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
+  add_header_include(HAVE_SYS_TIME_H "sys/time.h")
  check_c_source_compiles("${_source_epilogue}
    #include <time.h>
    int main(void)
@ -153,5 +182,3 @@ if(NOT WIN32 AND NOT DEFINED HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
      return 0;
    }" HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
 endif()
-
-unset(_source_epilogue)
--- a/CMake/PickyWarnings.cmake
+++ b/CMake/PickyWarnings.cmake
@ -23,34 +23,24 @@
 ###########################################################################
 include(CheckCCompilerFlag)

-set(_picky "")
+unset(WPICKY)

 if(CURL_WERROR AND
   ((CMAKE_COMPILER_IS_GNUCC AND
-     NOT DOS AND  # Watt-32 headers use the '#include_next' GCC extension
     NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.0 AND
-     NOT CMAKE_VERSION VERSION_LESS 3.23.0) OR  # to avoid check_symbol_exists() conflicting with GCC -pedantic-errors
+     NOT CMAKE_VERSION VERSION_LESS 3.23.0) OR  # check_symbol_exists() incompatible with GCC -pedantic-errors in earlier CMake versions
   CMAKE_C_COMPILER_ID MATCHES "Clang"))
-  list(APPEND _picky "-pedantic-errors")
+  set(WPICKY "${WPICKY} -pedantic-errors")
 endif()

 if(APPLE AND
   (CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.6) OR
   (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.3))
-  list(APPEND _picky "-Werror=partial-availability")  # clang 3.6  appleclang 6.3
+  set(WPICKY "${WPICKY} -Werror=partial-availability")  # clang 3.6  appleclang 6.3
 endif()

 if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
-  list(APPEND _picky "-Werror-implicit-function-declaration")  # clang 1.0  gcc 2.95
-endif()
-
-if(MSVC)
-  if(CMAKE_C_FLAGS MATCHES "[/-]W[0-4]")
-    string(REGEX REPLACE "[/-]W[0-4]" "" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
-  endif()
-  list(APPEND _picky "-W4")
-elseif(BORLAND)
-  list(APPEND _picky "-w-")  # Disable warnings on Borland to avoid changing 3rd party code.
+  set(WPICKY "${WPICKY} -Werror-implicit-function-declaration")  # clang 1.0  gcc 2.95
 endif()

 if(PICKY_COMPILER)
@ -59,31 +49,32 @@ if(PICKY_COMPILER)
    # https://clang.llvm.org/docs/DiagnosticsReference.html
    # https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html

-    # _picky_enable = Options we want to enable as-is.
-    # _picky_detect = Options we want to test first and enable if available.
+    # WPICKY_ENABLE = Options we want to enable as-is.
+    # WPICKY_DETECT = Options we want to test first and enable if available.

    # Prefer the -Wextra alias with clang.
    if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-      set(_picky_enable "-Wextra")
+      set(WPICKY_ENABLE "-Wextra")
    else()
-      set(_picky_enable "-W")
+      set(WPICKY_ENABLE "-W")
    endif()

-    list(APPEND _picky_enable
+    list(APPEND WPICKY_ENABLE
      -Wall -pedantic
    )

    # ----------------------------------
    # Add new options here, if in doubt:
    # ----------------------------------
-    set(_picky_detect
+    set(WPICKY_DETECT
    )

    # Assume these options always exist with both clang and gcc.
    # Require clang 3.0 / gcc 2.95 or later.
-    list(APPEND _picky_enable
+    list(APPEND WPICKY_ENABLE
      -Wbad-function-cast                  # clang  2.7  gcc  2.95
      -Wconversion                         # clang  2.7  gcc  2.95
+      -Winline                             # clang  1.0  gcc  1.0
      -Wmissing-declarations               # clang  1.0  gcc  2.7
      -Wmissing-prototypes                 # clang  1.0  gcc  1.0
      -Wnested-externs                     # clang  1.0  gcc  2.7
@ -98,7 +89,7 @@ if(PICKY_COMPILER)
    )

    # Always enable with clang, version dependent with gcc
-    set(_picky_common_old
+    set(WPICKY_COMMON_OLD
      -Waddress                            # clang  2.7  gcc  4.3
      -Wattributes                         # clang  2.7  gcc  4.1
      -Wcast-align                         # clang  1.0  gcc  4.2
@ -112,188 +103,144 @@ if(PICKY_COMPILER)
      -Wmissing-field-initializers         # clang  2.7  gcc  4.1
      -Wmissing-noreturn                   # clang  2.7  gcc  4.1
      -Wno-format-nonliteral               # clang  1.0  gcc  2.96 (3.0)
-      -Wno-sign-conversion                 # clang  2.9  gcc  4.3
      -Wno-system-headers                  # clang  1.0  gcc  3.0
-    # -Wpadded                             # clang  2.9  gcc  4.1               # Not used: We cannot change public structs
+    # -Wpadded                             # clang  2.9  gcc  4.1               # Not used because we cannot change public structs
      -Wold-style-definition               # clang  2.7  gcc  3.4
      -Wredundant-decls                    # clang  2.7  gcc  4.1
+      -Wsign-conversion                    # clang  2.9  gcc  4.3
+        -Wno-error=sign-conversion                                              # FIXME
      -Wstrict-prototypes                  # clang  1.0  gcc  3.3
-    # -Wswitch-enum                        # clang  2.7  gcc  4.1               # Not used: It basically disallows default case
+    # -Wswitch-enum                        # clang  2.7  gcc  4.1               # Not used because this basically disallows default case
      -Wtype-limits                        # clang  2.7  gcc  4.3
      -Wunreachable-code                   # clang  2.7  gcc  4.1
    # -Wunused-macros                      # clang  2.7  gcc  4.1               # Not practical
-    #   -Wno-error=unused-macros           # clang  2.7  gcc  4.1
      -Wunused-parameter                   # clang  2.7  gcc  4.1
      -Wvla                                # clang  2.8  gcc  4.3
    )

+    set(WPICKY_COMMON
+      -Wdouble-promotion                   # clang  3.6  gcc  4.6  appleclang  6.3
+      -Wenum-conversion                    # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
+      -Wpragmas                            # clang  3.5  gcc  4.1  appleclang  6.0
+      -Wunused-const-variable              # clang  3.4  gcc  6.0  appleclang  5.1
+    )
+
    if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-      list(APPEND _picky_enable
-        ${_picky_common_old}
+      list(APPEND WPICKY_ENABLE
+        ${WPICKY_COMMON_OLD}
        -Wshift-sign-overflow              # clang  2.9
        -Wshorten-64-to-32                 # clang  1.0
+        -Wlanguage-extension-token         # clang  3.0
        -Wformat=2                         # clang  3.0  gcc  4.8
      )
-      if(NOT MSVC)
-        list(APPEND _picky_enable
-          -Wlanguage-extension-token       # clang  3.0
-        )
-      endif()
      # Enable based on compiler version
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.6) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.3))
-        list(APPEND _picky_enable
-          -Wdouble-promotion               # clang  3.6  gcc  4.6  appleclang  6.3
-          -Wenum-conversion                # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
+        list(APPEND WPICKY_ENABLE
+          ${WPICKY_COMMON}
+          -Wunreachable-code-break         # clang  3.5            appleclang  6.0
          -Wheader-guard                   # clang  3.4            appleclang  5.1
-          -Wpragmas                        # clang  3.5  gcc  4.1  appleclang  6.0
          -Wsometimes-uninitialized        # clang  3.2            appleclang  4.6
-        # -Wunreachable-code-break         # clang  3.5            appleclang  6.0  # Not used: Silent in "unity" builds
-          -Wunused-const-variable          # clang  3.4  gcc  6.0  appleclang  5.1
        )
      endif()
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.9) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.3))
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Wcomma                          # clang  3.9            appleclang  8.3
          -Wmissing-variable-declarations  # clang  3.2            appleclang  4.6
        )
      endif()
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 7.0) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.3))
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Wassign-enum                    # clang  7.0            appleclang 10.3
          -Wextra-semi-stmt                # clang  7.0            appleclang 10.3
        )
      endif()
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.0) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 12.4))
-        list(APPEND _picky_enable
-          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0  appleclang 12.4  # We do silencing for clang 10.0 and above only
+        list(APPEND WPICKY_ENABLE
+          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0  appleclang 12.4  # we have silencing markup for clang 10.0 and above only
        )
      endif()
    else()  # gcc
+      list(APPEND WPICKY_DETECT
+        ${WPICKY_COMMON}
+      )
      # Enable based on compiler version
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.3)
-        list(APPEND _picky_enable
-          ${_picky_common_old}
+        list(APPEND WPICKY_ENABLE
+          ${WPICKY_COMMON_OLD}
          -Wclobbered                      #             gcc  4.3
          -Wmissing-parameter-type         #             gcc  4.3
          -Wold-style-declaration          #             gcc  4.3
-          -Wpragmas                        # clang  3.5  gcc  4.1  appleclang  6.0
          -Wstrict-aliasing=3              #             gcc  4.0
-          -ftree-vrp                       #             gcc  4.3 (required for -Warray-bounds, included in -Wall)
+          -Wtrampolines                    #             gcc  4.3
        )
      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5)
-        list(APPEND _picky_enable
-          -Wjump-misses-init               #             gcc  4.5
+      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5 AND MINGW)
+        list(APPEND WPICKY_ENABLE
+          -Wno-pedantic-ms-format          #             gcc  4.5 (mingw-only)
        )
-
-        if(MINGW)
-          list(APPEND _picky_enable
-            -Wno-pedantic-ms-format        #             gcc  4.5 (MinGW-only)
-          )
-        endif()
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.8)
-        list(APPEND _picky_enable
-          -Wdouble-promotion               # clang  3.6  gcc  4.6  appleclang  6.3
+        list(APPEND WPICKY_ENABLE
          -Wformat=2                       # clang  3.0  gcc  4.8
-          -Wtrampolines                    #             gcc  4.6
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.0)
-        list(APPEND _picky_enable
-          -Warray-bounds=2                 # clang  3.0  gcc  5.0 (clang default: -Warray-bounds)
+        list(APPEND WPICKY_ENABLE
+          -Warray-bounds=2 -ftree-vrp      # clang  3.0  gcc  5.0 (clang default: -Warray-bounds)
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.0)
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Wduplicated-cond                #             gcc  6.0
          -Wnull-dereference               # clang  3.0  gcc  6.0 (clang default)
            -fdelete-null-pointer-checks
          -Wshift-negative-value           # clang  3.7  gcc  6.0 (clang default)
          -Wshift-overflow=2               # clang  3.0  gcc  6.0 (clang default: -Wshift-overflow)
-          -Wunused-const-variable          # clang  3.4  gcc  6.0  appleclang  5.1
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 7.0)
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Walloc-zero                     #             gcc  7.0
          -Wduplicated-branches            #             gcc  7.0
+          -Wformat-overflow=2              #             gcc  7.0
          -Wformat-truncation=2            #             gcc  7.0
          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0
          -Wrestrict                       #             gcc  7.0
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.0)
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Warith-conversion               #             gcc 10.0
-          -Wenum-conversion                # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
        )
      endif()
    endif()

    #

-    foreach(_ccopt IN LISTS _picky_enable)
-      list(APPEND _picky "${_ccopt}")
+    foreach(_CCOPT IN LISTS WPICKY_ENABLE)
+      set(WPICKY "${WPICKY} ${_CCOPT}")
    endforeach()

-    foreach(_ccopt IN LISTS _picky_detect)
-      # Use a unique variable name 1. for meaningful log output 2. to have a fresh, undefined variable for each detection
-      string(MAKE_C_IDENTIFIER "OPT${_ccopt}" _optvarname)
+    foreach(_CCOPT IN LISTS WPICKY_DETECT)
+      # surprisingly, CHECK_C_COMPILER_FLAG needs a new variable to store each new
+      # test result in.
+      string(MAKE_C_IDENTIFIER "OPT${_CCOPT}" _optvarname)
      # GCC only warns about unknown -Wno- options if there are also other diagnostic messages,
      # so test for the positive form instead
-      string(REPLACE "-Wno-" "-W" _ccopt_on "${_ccopt}")
-      check_c_compiler_flag(${_ccopt_on} ${_optvarname})
+      string(REPLACE "-Wno-" "-W" _CCOPT_ON "${_CCOPT}")
+      check_c_compiler_flag(${_CCOPT_ON} ${_optvarname})
      if(${_optvarname})
-        list(APPEND _picky "${_ccopt}")
+        set(WPICKY "${WPICKY} ${_CCOPT}")
      endif()
    endforeach()
-
-    if(CMAKE_COMPILER_IS_GNUCC)
-      if(CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5)
-        # Avoid false positives
-        list(APPEND _picky "-Wno-shadow")
-        list(APPEND _picky "-Wno-unreachable-code")
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.2 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.6)
-        # GCC <4.6 do not support #pragma to suppress warnings locally. Disable them globally instead.
-        list(APPEND _picky "-Wno-overlength-strings")
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.0 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.7)
-        list(APPEND _picky "-Wno-missing-field-initializers")  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36750
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.3 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.8)
-        list(APPEND _picky "-Wno-type-limits")  # Avoid false positives
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.1 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 5.5)
-        list(APPEND _picky "-Wno-conversion")  # Avoid false positives
-      endif()
-    endif()
  endif()
 endif()

-# clang-cl
-if(CMAKE_C_COMPILER_ID STREQUAL "Clang" AND MSVC)
-  list(APPEND _picky "-Wno-language-extension-token")  # Allow __int64
-
-  set(_picky_tmp "")
-  foreach(_ccopt IN LISTS _picky)
-    # Prefix -Wall, otherwise clang-cl interprets it as an MSVC option and translates it to -Weverything
-    if(_ccopt MATCHES "^-W" AND NOT _ccopt STREQUAL "-Wall")
-      list(APPEND _picky_tmp ${_ccopt})
-    else()
-      list(APPEND _picky_tmp "-clang:${_ccopt}")
-    endif()
-  endforeach()
-  set(_picky ${_picky_tmp})
-endif()
-
-if(_picky)
-  string(REPLACE ";" " " _picky "${_picky}")
-  string(APPEND CMAKE_C_FLAGS " ${_picky}")
-  message(STATUS "Picky compiler options: ${_picky}")
+if(WPICKY)
+  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${WPICKY}")
+  message(STATUS "Picky compiler options:${WPICKY}")
 endif()
--- a/CMake/Platforms/WindowsCache.cmake
+++ b/CMake/Platforms/WindowsCache.cmake
@ -32,68 +32,54 @@ if(MINGW)
  set(HAVE_UNISTD_H 1)
  set(HAVE_LIBGEN_H 1)
  set(HAVE_STDDEF_H 1)  # detected by CMake internally in check_type_size()
-  set(HAVE_STDINT_H 1)  # detected by CMake internally in check_type_size()
  set(HAVE_STDBOOL_H 1)
  set(HAVE_BOOL_T "${HAVE_STDBOOL_H}")
+  set(HAVE_STRTOLL 1)
  set(HAVE_BASENAME 1)
+  set(HAVE_STRCASECMP 1)
  set(HAVE_FTRUNCATE 1)
  set(HAVE_SYS_PARAM_H 1)
  set(HAVE_SYS_TIME_H 1)
  set(HAVE_GETTIMEOFDAY 1)
-  set(HAVE_STRINGS_H 1)  # wrapper to string.h
-  set(HAVE_UTIME_H 1)  # wrapper to sys/utime.h
-  set(HAVE_DIRENT_H 1)
-  set(HAVE_OPENDIR 1)
 else()
  set(HAVE_LIBGEN_H 0)
+  set(HAVE_STRCASECMP 0)
  set(HAVE_FTRUNCATE 0)
  set(HAVE_SYS_PARAM_H 0)
  set(HAVE_SYS_TIME_H 0)
  set(HAVE_GETTIMEOFDAY 0)
-  set(HAVE_STRINGS_H 0)
-  set(HAVE_UTIME_H 0)
-  set(HAVE_DIRENT_H 0)
-  set(HAVE_OPENDIR 0)
  if(MSVC)
    set(HAVE_UNISTD_H 0)
+    set(HAVE_LOCALE_H 1)
    set(HAVE_STDDEF_H 1)  # detected by CMake internally in check_type_size()
-    if(MSVC_VERSION GREATER_EQUAL 1600)
-      set(HAVE_STDINT_H 1)  # detected by CMake internally in check_type_size()
-    else()
-      set(HAVE_STDINT_H 0)  # detected by CMake internally in check_type_size()
-    endif()
-    if(MSVC_VERSION GREATER_EQUAL 1800)
+    set(HAVE_STDATOMIC_H 0)
+    if(NOT MSVC_VERSION LESS 1800)
      set(HAVE_STDBOOL_H 1)
+      set(HAVE_STRTOLL 1)
    else()
      set(HAVE_STDBOOL_H 0)
+      set(HAVE_STRTOLL 0)
    endif()
    set(HAVE_BOOL_T "${HAVE_STDBOOL_H}")
-    if(MSVC_VERSION GREATER_EQUAL 1900)
+    if(NOT MSVC_VERSION LESS 1900)
      set(HAVE_SNPRINTF 1)
    else()
      set(HAVE_SNPRINTF 0)
    endif()
    set(HAVE_BASENAME 0)
+    set(HAVE_STRTOK_R 0)
+    set(HAVE_FILE_OFFSET_BITS 0)
+    set(HAVE_ATOMIC 0)
  endif()
 endif()

-if((CMAKE_COMPILER_IS_GNUCC              AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.9) OR
-   (CMAKE_C_COMPILER_ID STREQUAL "Clang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.6))
-  # MinGW or clang-cl
-  set(HAVE_STDATOMIC_H 1)
-  set(HAVE_ATOMIC 1)
-else()
-  set(HAVE_STDATOMIC_H 0)
-  set(HAVE_ATOMIC 0)
-endif()
-
 # Available in Windows XP and newer
 set(HAVE_GETADDRINFO 1)
 set(HAVE_FREEADDRINFO 1)

+set(HAVE_FCHMOD 0)
 set(HAVE_SOCKETPAIR 0)
 set(HAVE_SENDMSG 0)
-set(HAVE_SENDMMSG 0)
 set(HAVE_ALARM 0)
 set(HAVE_FCNTL 0)
 set(HAVE_GETPPID 0)
@ -107,34 +93,38 @@ set(HAVE_IF_NAMETOINDEX 0)
 set(HAVE_GETRLIMIT 0)
 set(HAVE_SETRLIMIT 0)
 set(HAVE_FSETXATTR 0)
+set(HAVE_LIBSOCKET 0)
 set(HAVE_SETLOCALE 1)
 set(HAVE_SETMODE 1)
-set(HAVE__SETMODE 1)
 set(HAVE_GETPEERNAME 1)
 set(HAVE_GETSOCKNAME 1)
 set(HAVE_GETHOSTNAME 1)
+set(HAVE_LIBZ 0)

 set(HAVE_RECV 1)
 set(HAVE_SEND 1)
 set(HAVE_STROPTS_H 0)
+set(HAVE_SYS_XATTR_H 0)
 set(HAVE_ARC4RANDOM 0)
 set(HAVE_FNMATCH 0)
+set(HAVE_SCHED_YIELD 0)
 set(HAVE_ARPA_INET_H 0)
 set(HAVE_FCNTL_H 1)
 set(HAVE_IFADDRS_H 0)
 set(HAVE_IO_H 1)
 set(HAVE_NETDB_H 0)
 set(HAVE_NETINET_IN_H 0)
-set(HAVE_NETINET_IN6_H 0)
 set(HAVE_NETINET_TCP_H 0)
 set(HAVE_NETINET_UDP_H 0)
 set(HAVE_NET_IF_H 0)
 set(HAVE_IOCTL_SIOCGIFADDR 0)
 set(HAVE_POLL_H 0)
-set(HAVE_POLL 0)
+set(HAVE_POLL_FINE 0)
 set(HAVE_PWD_H 0)
+set(HAVE_STRINGS_H 0)  # mingw-w64 has it (wrapper to string.h)
 set(HAVE_SYS_EVENTFD_H 0)
 set(HAVE_SYS_FILIO_H 0)
+set(HAVE_SYS_WAIT_H 0)
 set(HAVE_SYS_IOCTL_H 0)
 set(HAVE_SYS_POLL_H 0)
 set(HAVE_SYS_RESOURCE_H 0)
@ -147,11 +137,18 @@ set(HAVE_SYS_UN_H 0)
 set(HAVE_SYS_UTIME_H 1)
 set(HAVE_TERMIOS_H 0)
 set(HAVE_TERMIO_H 0)
-set(HAVE_LINUX_TCP_H 0)
+set(HAVE_UTIME_H 0)  # mingw-w64 has it (wrapper to sys/utime.h)

+set(HAVE_DIRENT_H 0)
+set(HAVE_OPENDIR 0)
+
+set(HAVE_FSEEKO 0)
+set(HAVE__FSEEKI64 1)
 set(HAVE_SOCKET 1)
 set(HAVE_SELECT 1)
 set(HAVE_STRDUP 1)
+set(HAVE_STRICMP 1)
+set(HAVE_STRCMPI 1)
 set(HAVE_MEMRCHR 0)
 set(HAVE_CLOSESOCKET 1)
 set(HAVE_SIGSETJMP 0)
@ -164,7 +161,9 @@ set(HAVE_GMTIME_R 0)
 set(HAVE_GETHOSTBYNAME_R 0)
 set(HAVE_SIGNAL 1)
 set(HAVE_SIGACTION 0)
+set(HAVE_LINUX_TCP_H 0)
 set(HAVE_GLIBC_STRERROR_R 0)
+set(HAVE_MACH_ABSOLUTE_TIME 0)
 set(HAVE_GETIFADDRS 0)
 set(HAVE_FCNTL_O_NONBLOCK 0)
 set(HAVE_IOCTLSOCKET 1)
@ -177,7 +176,6 @@ set(HAVE_POSIX_STRERROR_R 0)
 set(HAVE_MSG_NOSIGNAL 0)
 set(HAVE_STRUCT_TIMEVAL 1)
 set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
-set(HAVE_TIME_T_UNSIGNED 0)

 set(HAVE_GETHOSTBYNAME_R_3 0)
 set(HAVE_GETHOSTBYNAME_R_3_REENTRANT 0)
@ -186,59 +184,9 @@ set(HAVE_GETHOSTBYNAME_R_5_REENTRANT 0)
 set(HAVE_GETHOSTBYNAME_R_6 0)
 set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 0)

+set(HAVE_O_NONBLOCK 0)
+set(HAVE_IN_ADDR_T 0)
 set(STDC_HEADERS 1)

 set(HAVE_SIZEOF_SUSECONDS_T 0)
 set(HAVE_SIZEOF_SA_FAMILY_T 0)
-
-if(MINGW OR MSVC)
-  curl_prefill_type_size("INT" 4)
-  curl_prefill_type_size("LONG" 4)
-  curl_prefill_type_size("LONG_LONG" 8)
-  curl_prefill_type_size("__INT64" 8)
-  curl_prefill_type_size("CURL_OFF_T" 8)
-  # CURL_SOCKET_T, SIZE_T: 8 for _WIN64, 4 otherwise
-  # TIME_T: 8 for _WIN64 or UCRT or MSVC and not Windows CE, 4 otherwise
-  #   Also 4 for non-UCRT 32-bit when _USE_32BIT_TIME_T is set.
-  #   mingw-w64 sets _USE_32BIT_TIME_T unless __MINGW_USE_VC2005_COMPAT is explicit defined.
-  if(MSVC)
-    set(HAVE_SIZEOF_SSIZE_T 0)
-    set(HAVE_FILE_OFFSET_BITS 0)
-    curl_prefill_type_size("OFF_T" 4)
-    curl_prefill_type_size("ADDRESS_FAMILY" 2)
-  else()
-    # SSIZE_T: 8 for _WIN64, 4 otherwise
-    if(MINGW64_VERSION)
-      if(NOT MINGW64_VERSION VERSION_LESS 3.0)
-        set(HAVE_FILE_OFFSET_BITS 1)
-        curl_prefill_type_size("OFF_T" 8)
-      endif()
-      if(NOT MINGW64_VERSION VERSION_LESS 2.0)
-        curl_prefill_type_size("ADDRESS_FAMILY" 2)
-      else()
-        set(HAVE_SIZEOF_ADDRESS_FAMILY 0)
-      endif()
-    endif()
-  endif()
-endif()
-
-if(WINCE)  # Windows CE exceptions
-  set(HAVE_LOCALE_H 0)
-  set(HAVE_GETADDRINFO 0)
-  set(HAVE_FREEADDRINFO 0)
-  set(HAVE_SETLOCALE 0)
-  set(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 0)
-  set(HAVE_SIGNAL 0)
-  set(HAVE_SETMODE 0)
-  curl_prefill_type_size("CURL_SOCKET_T" 4)
-  curl_prefill_type_size("TIME_T" 4)
-  curl_prefill_type_size("SIZE_T" 4)
-  if(MINGW32CE)
-    set(HAVE_STRTOK_R 0)
-    set(HAVE__SETMODE 0)
-    set(HAVE_FILE_OFFSET_BITS 0)
-    set(HAVE_SIZEOF_ADDRESS_FAMILY 0)
-    curl_prefill_type_size("SSIZE_T" 4)
-    curl_prefill_type_size("OFF_T" 4)
-  endif()
-endif()
--- a/CMake/Utilities.cmake
+++ b/CMake/Utilities.cmake
@ -23,31 +23,13 @@
 ###########################################################################
 # File containing various utilities

-# Return number of arguments that evaluate to true
-function(curl_count_true _output_count_var)
-  set(_list_len 0)
-  foreach(_option_var IN LISTS ARGN)
-    if(${_option_var})
-      math(EXPR _list_len "${_list_len} + 1")
+# Returns number of arguments that evaluate to true
+function(count_true output_count_var)
+  set(lst_len 0)
+  foreach(option_var IN LISTS ARGN)
+    if(${option_var})
+      math(EXPR lst_len "${lst_len} + 1")
    endif()
  endforeach()
-  set(${_output_count_var} ${_list_len} PARENT_SCOPE)
-endfunction()
-
-# Dump all defined variables with their values
-function(curl_dumpvars)
-  message("::group::CMake Variable Dump")
-  get_cmake_property(_vars VARIABLES)
-  foreach(_var IN ITEMS ${_vars})
-    get_property(_var_type CACHE ${_var} PROPERTY TYPE)
-    get_property(_var_advanced CACHE ${_var} PROPERTY ADVANCED)
-    if(_var_type)
-      set(_var_type ":${_var_type}")
-    endif()
-    if(_var_advanced)
-      set(_var_advanced " [adv]")
-    endif()
-    message("${_var}${_var_type}${_var_advanced} = '${${_var}}'")
-  endforeach()
-  message("::endgroup::")
+  set(${output_count_var} ${lst_len} PARENT_SCOPE)
 endfunction()
--- a/CMake/cmake_uninstall.cmake.in
+++ b/CMake/cmake_uninstall.cmake.in
@ -30,20 +30,20 @@ if(NOT DEFINED CMAKE_INSTALL_PREFIX)
 endif()
 message(${CMAKE_INSTALL_PREFIX})

-file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" _files)
-string(REGEX REPLACE "\n" ";" _files "${_files}")
-foreach(_file ${_files})
-  message(STATUS "Uninstalling $ENV{DESTDIR}${_file}")
-  if(IS_SYMLINK "$ENV{DESTDIR}${_file}" OR EXISTS "$ENV{DESTDIR}${_file}")
+file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files)
+string(REGEX REPLACE "\n" ";" files "${files}")
+foreach(file ${files})
+  message(STATUS "Uninstalling $ENV{DESTDIR}${file}")
+  if(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}")
    exec_program(
-      "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${_file}\""
+      "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${file}\""
      OUTPUT_VARIABLE rm_out
      RETURN_VALUE rm_retval
-    )
+      )
    if(NOT "${rm_retval}" STREQUAL 0)
-      message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${_file}")
+      message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${file}")
    endif()
  else()
-    message(STATUS "File $ENV{DESTDIR}${_file} does not exist.")
+    message(STATUS "File $ENV{DESTDIR}${file} does not exist.")
  endif()
 endforeach()
--- a/CMake/curl-config.cmake.in
+++ b/CMake/curl-config.cmake.in
@ -24,14 +24,15 @@
@PACKAGE_INIT@

 include(CMakeFindDependencyMacro)
-if("@USE_OPENSSL@")
-  find_dependency(OpenSSL "@OPENSSL_VERSION_MAJOR@")
+if(@USE_OPENSSL@)
+  find_dependency(OpenSSL @OPENSSL_VERSION_MAJOR@)
 endif()
-if("@HAVE_LIBZ@")
-  find_dependency(ZLIB "@ZLIB_VERSION_MAJOR@")
+if(@USE_ZLIB@)
+  find_dependency(ZLIB @ZLIB_VERSION_MAJOR@)
 endif()

 include("${CMAKE_CURRENT_LIST_DIR}/@TARGETS_EXPORT_NAME@.cmake")
+check_required_components("@PROJECT_NAME@")

 # Alias for either shared or static library
 if(NOT TARGET @PROJECT_NAME@::libcurl)
@ -39,32 +40,5 @@ if(NOT TARGET @PROJECT_NAME@::libcurl)
 endif()

 # For compatibility with CMake's FindCURL.cmake
-set(CURL_VERSION_STRING "@CURLVERSION@")
 set(CURL_LIBRARIES @PROJECT_NAME@::libcurl)
 set_and_check(CURL_INCLUDE_DIRS "@PACKAGE_CMAKE_INSTALL_INCLUDEDIR@")
-
-set(CURL_SUPPORTED_PROTOCOLS "@CURL_SUPPORTED_PROTOCOLS_LIST@")
-set(CURL_SUPPORTED_FEATURES "@CURL_SUPPORTED_FEATURES_LIST@")
-
-foreach(_item IN LISTS CURL_SUPPORTED_PROTOCOLS CURL_SUPPORTED_FEATURES)
-  set(CURL_SUPPORTS_${_item} TRUE)
-endforeach()
-
-set(_missing_req "")
-foreach(_item IN LISTS CURL_FIND_COMPONENTS)
-  if(CURL_SUPPORTS_${_item})
-    set(CURL_${_item}_FOUND TRUE)
-  elseif(CURL_FIND_REQUIRED_${_item})
-    list(APPEND _missing_req ${_item})
-  endif()
-endforeach()
-
-if(_missing_req)
-  string(REPLACE ";" " " _missing_req "${_missing_req}")
-  if(CURL_FIND_REQUIRED)
-    message(FATAL_ERROR "CURL: missing required components: ${_missing_req}")
-  endif()
-  unset(_missing_req)
-endif()
-
-check_required_components("@PROJECT_NAME@")
--- a/CMake/unix-cache.cmake
+++ b/CMake/unix-cache.cmake
@ -1,311 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Based on CI runs for Cygwin/MSYS2, Linux, macOS, FreeBSD, NetBSD, OpenBSD
-if(NOT UNIX)
-  message(FATAL_ERROR "This file should be included on Unix platforms only")
-endif()
-
-set(HAVE_ALARM 1)
-if(ANDROID)
-  set(HAVE_ARC4RANDOM 1)
-else()
-  set(HAVE_ARC4RANDOM 0)
-endif()
-set(HAVE_ARPA_INET_H 1)
-set(HAVE_ATOMIC 1)
-set(HAVE_BASENAME 1)
-set(HAVE_BOOL_T 1)
-if(NOT APPLE)
-  set(HAVE_CLOCK_GETTIME_MONOTONIC 1)
-  if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-    set(HAVE_CLOCK_GETTIME_MONOTONIC_RAW 1)
-  else()
-    set(HAVE_CLOCK_GETTIME_MONOTONIC_RAW 0)
-  endif()
-endif()
-set(HAVE_CLOSESOCKET 0)
-set(HAVE_DECL_FSEEKO 1)
-set(HAVE_DIRENT_H 1)
-if(APPLE OR
-   CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-  set(HAVE_EVENTFD 0)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
-  set(HAVE_EVENTFD 1)
-endif()
-set(HAVE_FCNTL 1)
-set(HAVE_FCNTL_H 1)
-set(HAVE_FCNTL_O_NONBLOCK 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "iOS")
-  set(HAVE_FILE_OFFSET_BITS 0)
-else()
-  set(HAVE_FILE_OFFSET_BITS 1)
-endif()
-set(HAVE_FNMATCH 1)
-set(HAVE_FREEADDRINFO 1)
-set(HAVE_FSEEKO 1)
-if(APPLE)
-  set(HAVE_FSETXATTR 1)
-  set(HAVE_FSETXATTR_5 0)
-  set(HAVE_FSETXATTR_6 1)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-  set(HAVE_FSETXATTR 0)
-  set(HAVE_FSETXATTR_5 0)
-  set(HAVE_FSETXATTR_6 0)
-elseif(CYGWIN OR
-       CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
-  set(HAVE_FSETXATTR 1)
-  set(HAVE_FSETXATTR_5 1)
-  set(HAVE_FSETXATTR_6 0)
-endif()
-set(HAVE_FTRUNCATE 1)
-set(HAVE_GETADDRINFO 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-  set(HAVE_GETADDRINFO_THREADSAFE 0)
-elseif(CYGWIN OR
-       CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
-  set(HAVE_GETADDRINFO_THREADSAFE 1)
-endif()
-set(HAVE_GETEUID 1)
-if(APPLE OR
-   CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
-   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-  set(HAVE_GETHOSTBYNAME_R 0)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
-  set(HAVE_GETHOSTBYNAME_R 1)
-endif()
-set(HAVE_GETHOSTBYNAME_R_3 0)
-set(HAVE_GETHOSTBYNAME_R_3_REENTRANT 0)
-set(HAVE_GETHOSTBYNAME_R_5 0)
-set(HAVE_GETHOSTBYNAME_R_5_REENTRANT 0)
-if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_GETHOSTBYNAME_R_6 1)
-  set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 1)
-else()
-  set(HAVE_GETHOSTBYNAME_R_6 0)
-  set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 0)
-endif()
-set(HAVE_GETHOSTNAME 1)
-if(NOT ANDROID OR ANDROID_PLATFORM_LEVEL GREATER_EQUAL 24)
-  set(HAVE_GETIFADDRS 1)
-else()
-  set(HAVE_GETIFADDRS 0)
-endif()
-if(APPLE OR
-   CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-   CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-  set(HAVE_GETPASS_R 0)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
-  set(HAVE_GETPASS_R 1)
-endif()
-set(HAVE_GETPEERNAME 1)
-set(HAVE_GETPPID 1)
-set(HAVE_GETPWUID 1)
-set(HAVE_GETPWUID_R 1)
-set(HAVE_GETRLIMIT 1)
-set(HAVE_GETSOCKNAME 1)
-set(HAVE_GETTIMEOFDAY 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_GLIBC_STRERROR_R 1)
-else()
-  set(HAVE_GLIBC_STRERROR_R 0)
-endif()
-set(HAVE_GMTIME_R 1)
-set(HAVE_IFADDRS_H 1)
-set(HAVE_IF_NAMETOINDEX 1)
-set(HAVE_INET_NTOP 1)
-set(HAVE_INET_PTON 1)
-set(HAVE_IOCTLSOCKET 0)
-set(HAVE_IOCTLSOCKET_CAMEL 0)
-set(HAVE_IOCTLSOCKET_CAMEL_FIONBIO 0)
-set(HAVE_IOCTLSOCKET_FIONBIO 0)
-set(HAVE_IOCTL_FIONBIO 1)
-set(HAVE_IOCTL_SIOCGIFADDR 1)
-if(CYGWIN)
-  set(HAVE_IO_H 1)
-else()
-  set(HAVE_IO_H 0)
-endif()
-set(HAVE_LIBGEN_H 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_LINUX_TCP_H 1)
-else()
-  set(HAVE_LINUX_TCP_H 0)
-endif()
-set(HAVE_LOCALE_H 1)
-set(HAVE_LONGLONG 1)
-if(APPLE)
-  set(HAVE_MACH_ABSOLUTE_TIME 1)
-endif()
-if(APPLE OR
-   CYGWIN)
-  set(HAVE_MEMRCHR 0)
-else()
-  set(HAVE_MEMRCHR 1)
-endif()
-set(HAVE_MSG_NOSIGNAL 1)
-set(HAVE_NETDB_H 1)
-if(ANDROID)
-  set(HAVE_NETINET_IN6_H 1)
-else()
-  set(HAVE_NETINET_IN6_H 0)
-endif()
-set(HAVE_NETINET_IN_H 1)
-set(HAVE_NETINET_TCP_H 1)
-set(HAVE_NETINET_UDP_H 1)
-set(HAVE_NET_IF_H 1)
-set(HAVE_OPENDIR 1)
-set(HAVE_PIPE 1)
-set(HAVE_POLL 1)
-set(HAVE_POLL_H 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_POSIX_STRERROR_R 0)
-else()
-  set(HAVE_POSIX_STRERROR_R 1)
-endif()
-set(HAVE_PWD_H 1)
-set(HAVE_REALPATH 1)
-set(HAVE_RECV 1)
-set(HAVE_SA_FAMILY_T 1)
-set(HAVE_SCHED_YIELD 1)
-set(HAVE_SELECT 1)
-set(HAVE_SEND 1)
-if(APPLE OR
-   CYGWIN)
-  set(HAVE_SENDMMSG 0)
-else()
-  set(HAVE_SENDMMSG 1)
-endif()
-set(HAVE_SENDMSG 1)
-set(HAVE_SETLOCALE 1)
-if(CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_SETMODE 0)
-else()
-  set(HAVE_SETMODE 1)
-endif()
-set(HAVE_SETRLIMIT 1)
-set(HAVE_SETSOCKOPT_SO_NONBLOCK 0)
-set(HAVE_SIGACTION 1)
-set(HAVE_SIGINTERRUPT 1)
-set(HAVE_SIGNAL 1)
-set(HAVE_SIGSETJMP 1)
-set(HAVE_SNPRINTF 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "iOS")
-  set(HAVE_SOCKADDR_IN6_SIN6_ADDR 0)
-else()
-  set(HAVE_SOCKADDR_IN6_SIN6_ADDR 1)
-endif()
-set(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1)
-set(HAVE_SOCKET 1)
-set(HAVE_SOCKETPAIR 1)
-set(HAVE_STDATOMIC_H 1)
-set(HAVE_STDBOOL_H 1)
-if(CMAKE_SYSTEM_NAME STREQUAL "iOS")
-  set(HAVE_STDDEF_H 0)
-  set(HAVE_STDINT_H 0)
-else()
-  set(HAVE_STDDEF_H 1)
-  set(HAVE_STDINT_H 1)
-endif()
-set(HAVE_STRCASECMP 1)
-set(HAVE_STRCMPI 0)
-set(HAVE_STRDUP 1)
-set(HAVE_STRERROR_R 1)
-set(HAVE_STRICMP 0)
-set(HAVE_STRINGS_H 1)
-if(_CURL_OLD_LINUX)
-  set(HAVE_STROPTS_H 1)
-else()
-  set(HAVE_STROPTS_H 0)  # glibc 2.30 or newer. https://sourceware.org/legacy-ml/libc-alpha/2019-08/msg00029.html
-endif()
-set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
-set(HAVE_STRUCT_TIMEVAL 1)
-if(ANDROID OR CMAKE_SYSTEM_NAME STREQUAL "iOS")
-  set(HAVE_SUSECONDS_T 1)
-endif()
-if(APPLE OR
-   CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-  set(HAVE_SYS_EVENTFD_H 0)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR
-       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
-  set(HAVE_SYS_EVENTFD_H 1)
-endif()
-if(CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_SYS_FILIO_H 0)
-else()
-  set(HAVE_SYS_FILIO_H 1)
-endif()
-set(HAVE_SYS_IOCTL_H 1)
-set(HAVE_SYS_PARAM_H 1)
-set(HAVE_SYS_POLL_H 1)
-set(HAVE_SYS_RESOURCE_H 1)
-set(HAVE_SYS_SELECT_H 1)
-set(HAVE_SYS_SOCKET_H 1)
-if(CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_SYS_SOCKIO_H 0)
-else()
-  set(HAVE_SYS_SOCKIO_H 1)
-endif()
-set(HAVE_SYS_STAT_H 1)
-set(HAVE_SYS_TIME_H 1)
-set(HAVE_SYS_TYPES_H 1)
-set(HAVE_SYS_UN_H 1)
-if(CYGWIN)
-  set(HAVE_SYS_UTIME_H 1)
-else()
-  set(HAVE_SYS_UTIME_H 0)
-endif()
-set(HAVE_TERMIOS_H 1)
-if(CYGWIN OR
-   CMAKE_SYSTEM_NAME STREQUAL "Linux")
-  set(HAVE_TERMIO_H 1)
-else()
-  set(HAVE_TERMIO_H 0)
-endif()
-set(HAVE_TIME_T_UNSIGNED 0)
-set(HAVE_UNISTD_H 1)
-set(HAVE_UTIME 1)
-set(HAVE_UTIMES 1)
-set(HAVE_UTIME_H 1)
-set(HAVE_WRITABLE_ARGV 1)
-if(CYGWIN)
-  set(HAVE__SETMODE 1)
-endif()
-set(STDC_HEADERS 1)
-set(USE_UNIX_SOCKETS 1)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
--- a/2
+++ b/2
@ -1,6 +1,6 @@
 COPYRIGHT AND PERMISSION NOTICE

-Copyright (c) 1996 - 2025, Daniel Stenberg, <daniel@haxx.se>, and many
+Copyright (c) 1996 - 2024, Daniel Stenberg, <daniel@haxx.se>, and many
 contributors, see the THANKS file.

 All rights reserved.
--- a/6
+++ b/6
@ -13,7 +13,7 @@
 #   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl autoreconf -fi
 #   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl ./configure --without-ssl --without-libpsl
 #   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl make
-#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl ./scripts/maketgz 8.7.1
+#   docker run --rm -it -u $(id -u):$(id -g) -v $(pwd):/usr/src -w /usr/src curl/curl ./maketgz 8.7.1
 #
 # or get into a shell in the build environment, for example
 #
@ -21,10 +21,10 @@
 #   $ autoreconf -fi
 #   $ ./configure --without-ssl --without-libpsl
 #   $ make
-#   $ ./scripts/maketgz 8.7.1
+#   $ ./maketgz 8.7.1

 # To update, get the latest digest e.g. from https://hub.docker.com/_/debian/tags
-FROM debian:bookworm-slim@sha256:b73bf02f32434c9be21adf83b9aedf33e731784d8d2dacbbd3ce5f4993f2a2de
+FROM debian:bookworm-slim@sha256:39868a6f452462b70cf720a8daff250c63e7342970e749059c105bf7c1e8eeaf

 RUN apt-get update -qq && apt-get install -qq -y --no-install-recommends \
    build-essential make autoconf automake libtool git perl zip zlib1g-dev gawk && \
--- a/GIT-INFO.md
+++ b/GIT-INFO.md
@ -21,6 +21,10 @@ Daniel uses a configure line similar to this for easier development:

    ./configure --disable-shared --enable-debug --enable-maintainer-mode

+In environments that don't support configure (i.e. Windows), do this:
+
+    buildconf.bat
+
 ## REQUIREMENTS

 See [docs/INTERNALS.md][0] for requirement details.
--- a/Makefile.am
+++ b/Makefile.am
@ -34,45 +34,35 @@ CMAKE_DIST =                                    \
 CMake/CurlTests.c                              \
 CMake/FindBearSSL.cmake                        \
 CMake/FindBrotli.cmake                         \
- CMake/FindCares.cmake                          \
+ CMake/FindCARES.cmake                          \
 CMake/FindGSS.cmake                            \
- CMake/FindLDAP.cmake                           \
- CMake/FindLibgsasl.cmake                       \
- CMake/FindLibidn2.cmake                        \
- CMake/FindLibpsl.cmake                         \
- CMake/FindLibrtmp.cmake                        \
- CMake/FindLibssh.cmake                         \
- CMake/FindLibssh2.cmake                        \
- CMake/FindLibuv.cmake                          \
+ CMake/FindLibPSL.cmake                         \
+ CMake/FindLibSSH2.cmake                        \
 CMake/FindMbedTLS.cmake                        \
 CMake/FindMSH3.cmake                           \
- CMake/FindMbedTLS.cmake                        \
 CMake/FindNGHTTP2.cmake                        \
 CMake/FindNGHTTP3.cmake                        \
 CMake/FindNGTCP2.cmake                         \
 CMake/FindNettle.cmake                         \
- CMake/FindQuiche.cmake                         \
- CMake/FindRustls.cmake                         \
- CMake/FindWolfSSH.cmake                        \
+ CMake/FindQUICHE.cmake                         \
 CMake/FindWolfSSL.cmake                        \
 CMake/FindZstd.cmake                           \
 CMake/Macros.cmake                             \
 CMake/OtherTests.cmake                         \
 CMake/PickyWarnings.cmake                      \
+ CMake/Platforms/WindowsCache.cmake             \
 CMake/Utilities.cmake                          \
- CMake/unix-cache.cmake                         \
- CMake/win32-cache.cmake                        \
- CMakeLists.txt                                 \
- tests/cmake/CMakeLists.txt                     \
- tests/cmake/test.c                             \
- tests/cmake/test.sh
+ CMakeLists.txt

 VC_DIST = projects/README.md                           \
 projects/build-openssl.bat                            \
+ projects/build-wolfssl.bat                            \
 projects/checksrc.bat                                 \
- projects/generate.bat
+ projects/generate.bat                                 \
+ projects/wolfssl_options.h                            \
+ projects/wolfssl_override.props

-WINBUILD_DIST = winbuild/README.md \
+WINBUILD_DIST = winbuild/README.md winbuild/gen_resp_file.bat \
 winbuild/MakefileBuild.vc winbuild/Makefile.vc winbuild/makedebug.bat

 PLAN9_DIST = plan9/include/mkfile \
@ -85,10 +75,15 @@ PLAN9_DIST = plan9/include/mkfile \
 plan9/src/mkfile.inc             \
 plan9/src/mkfile

-EXTRA_DIST = CHANGES.md COPYING RELEASE-NOTES Dockerfile \
- $(CMAKE_DIST) $(VC_DIST) $(WINBUILD_DIST) $(PLAN9_DIST)
+EXTRA_DIST = CHANGES.md COPYING maketgz Makefile.dist curl-config.in       \
+ RELEASE-NOTES buildconf libcurl.pc.in $(CMAKE_DIST) $(VC_DIST)         \
+ $(WINBUILD_DIST) $(PLAN9_DIST) lib/libcurl.vers.in buildconf.bat       \
+ libcurl.def Dockerfile

-DISTCLEANFILES = buildinfo.txt
+CLEANFILES = $(VC14_LIBVCXPROJ) $(VC14_SRCVCXPROJ) \
+ $(VC14_10_LIBVCXPROJ) $(VC14_10_SRCVCXPROJ)       \
+ $(VC14_20_LIBVCXPROJ) $(VC14_20_SRCVCXPROJ)       \
+ $(VC14_30_LIBVCXPROJ) $(VC14_30_SRCVCXPROJ)

 bin_SCRIPTS = curl-config

@ -98,9 +93,15 @@ DIST_SUBDIRS = $(SUBDIRS) tests packages include docs
 pkgconfigdir = $(libdir)/pkgconfig
 pkgconfig_DATA = libcurl.pc

+### USE SIMPLE LIST ASSIGMENTS ABOVE THIS LINE ### DO NOT DELETE
+
+# List of files required to generate VC IDE .dsp, .vcproj and .vcxproj files
+include lib/Makefile.inc
+include src/Makefile.inc
+
 dist-hook:
 	rm -rf $(top_builddir)/tests/log
-	find $(distdir) -name "*.dist" -exec rm {} \;
+	find $(distdir) -name "*.dist" -a \! -name Makefile.dist -exec rm {} \;
 	(distit=`find $(srcdir) -name "*.dist" | grep -v Makefile`; \
 	for file in $$distit; do \
 	  strip=`echo $$file | sed -e s/^$(srcdir)// -e s/\.dist//`; \
@ -111,13 +112,7 @@ check: test examples check-docs

 if CROSSCOMPILING
 test-full: test
-test-nonflaky: test
 test-torture: test
-test-event: test
-test-am: test
-test-ci: test
-pytest: test
-pytest-ci: test

 test:
 	@echo "NOTICE: we can't run the tests when cross-compiling!"
@ -145,12 +140,6 @@ test-am:
 test-ci:
 	@(cd tests; $(MAKE) all ci-test)

-pytest:
-	@(cd tests; $(MAKE) all default-pytest)
-
-pytest-ci:
-	@(cd tests; $(MAKE) all ci-pytest)
-
 endif

 examples:
@ -185,6 +174,27 @@ rpm:
 	mv $$RPM_TOPDIR/RPMS/i386/$(RPMDIST)-*.rpm . ; \
 	mv $$RPM_TOPDIR/SRPMS/$(RPMDIST)-*.src.rpm .

+#
+# Build a Solaris pkgadd format file
+# run 'make pkgadd' once you've done './configure' and 'make' to make a Solaris pkgadd format
+# file (which ends up back in this directory).
+# The pkgadd file is in 'pkgtrans' format, so to install on Solaris, do
+# pkgadd -d ./HAXXcurl-*
+#
+
+# gak - libtool requires an absolute directory, hence the pwd below...
+pkgadd:
+	umask 022 ; \
+	$(MAKE) install DESTDIR=`/bin/pwd`/packages/Solaris/root ; \
+	cat COPYING > $(srcdir)/packages/Solaris/copyright ; \
+	cd $(srcdir)/packages/Solaris && $(MAKE) package
+
+#
+# Build a cygwin binary tarball installation file
+# resulting .tar.bz2 file will end up at packages/Win32/cygwin
+cygwinbin:
+	$(MAKE) -C packages/Win32/cygwin cygwinbin
+
 # We extend the standard install with a custom hook:
 if BUILD_DOCS
 install-data-hook:
--- a/scripts/mk-unity.pl
+++ b/scripts/mk-unity.pl
@ -1,4 +1,3 @@
-#!/usr/bin/env perl
 #***************************************************************************
 #                                  _   _ ____  _
 #  Project                     ___| | | |  _ \| |
@ -6,7 +5,7 @@
 #                            | (__| |_| |  _ <| |___
 #                             \___|\___/|_| \_\_____|
 #
-# Copyright (C) Viktor Szakats
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 #
 # This software is licensed as described in the file COPYING, which
 # you should have received as part of this distribution. The terms
@ -23,41 +22,50 @@
 #
 ###########################################################################

-# Helper script for "unity"-like support in autotools, to generate the umbrella
-# C source that includes the individual source files. Reads Makefile.inc and
-# accepts the variable name containing all the source files to include. Also
-# allow a list of exceptions that are to be excluded from the generated file.
+all:
+	./configure
+	make

-use strict;
-use warnings;
+ssl:
+	./configure --with-openssl
+	make

-if(!@ARGV) {
-    die "Usage: $0 [<c-sources>] [--exclude <exclude-c-sources>]\n";
-}
+vc:
+	cd winbuild
+	nmake /f Makefile.vc MACHINE=x86

-# Specific sources to exclude or add as an extra source file
-my @src;
-my %exclude;
-my $in_exclude = 0;
-foreach my $src (@ARGV) {
-    if($in_exclude) {
-        $exclude{$src} = 1;
-    }
-    elsif($src eq "--exclude") {
-        $in_exclude = 1;
-    }
-    else {
-        push @src, $src;
-    }
-}
+vc-x64:
+	cd winbuild
+	nmake /f Makefile.vc MACHINE=x64

-print <<HEADER
-/* !checksrc! disable COPYRIGHT all */
-HEADER
-    ;
+djgpp%:
+	$(MAKE) -C lib -f Makefile.mk CFG=$@ CROSSPREFIX=i586-pc-msdosdjgpp-
+	$(MAKE) -C src -f Makefile.mk CFG=$@ CROSSPREFIX=i586-pc-msdosdjgpp-

-foreach my $src (@src) {
-    if($src =~ /\.c$/g && !exists $exclude{$src}) {
-        print "#include \"$src\"\n";
-    }
-}
+cygwin:
+	./configure
+	make
+
+cygwin-ssl:
+	./configure --with-openssl
+	make
+
+amiga%:
+	$(MAKE) -C lib -f Makefile.mk CFG=$@ CROSSPREFIX=m68k-amigaos-
+	$(MAKE) -C src -f Makefile.mk CFG=$@ CROSSPREFIX=m68k-amigaos-
+
+unix: all
+
+unix-ssl: ssl
+
+linux: all
+
+linux-ssl: ssl
+
+ca-bundle: scripts/mk-ca-bundle.pl
+	@echo "generate a fresh ca-bundle.crt"
+	@perl $< -b -l -u lib/ca-bundle.crt
+
+ca-firefox: lib/firefox-db2pem.sh
+	@echo "generate a fresh ca-bundle.crt"
+	./lib/firefox-db2pem.sh lib/ca-bundle.crt
--- a/README.md
+++ b/README.md
@ -6,29 +6,26 @@ SPDX-License-Identifier: curl

 # [![curl logo](https://curl.se/logo/curl-logo.svg)](https://curl.se/)

-curl is a command-line tool for transferring data specified with URL syntax.
-Learn how to use curl by reading [the
-manpage](https://curl.se/docs/manpage.html) or [everything
-curl](https://everything.curl.dev/).
-
-Find out how to install curl by reading [the INSTALL
-document](https://curl.se/docs/install.html).
+Curl is a command-line tool for transferring data specified with URL
+syntax. Find out how to use curl by reading [the curl.1 man
+page](https://curl.se/docs/manpage.html) or [the MANUAL
+document](https://curl.se/docs/manual.html). Find out how to install Curl
+by reading [the INSTALL document](https://curl.se/docs/install.html).

 libcurl is the library curl is using to do its job. It is readily available to
-be used by your software. Read [the libcurl
-manpage](https://curl.se/libcurl/c/libcurl.html) to learn how.
+be used by your software. Read [the libcurl.3 man
+page](https://curl.se/libcurl/c/libcurl.html) to learn how.

-## Open Source
+You can find answers to the most frequent questions we get in [the FAQ
+document](https://curl.se/docs/faq.html).

-curl is Open Source and is distributed under an MIT-like
-[license](https://curl.se/docs/copyright.html).
+Study [the COPYING file](https://curl.se/docs/copyright.html) for
+distribution terms.

 ## Contact

-Contact us on a suitable [mailing list](https://curl.se/mail/) or
-use GitHub [issues](https://github.com/curl/curl/issues)/
-[pull requests](https://github.com/curl/curl/pulls)/
-[discussions](https://github.com/curl/curl/discussions).
+If you have problems, questions, ideas or suggestions, please contact us by
+posting to a suitable [mailing list](https://curl.se/mail/).

 All contributors to the project are listed in [the THANKS
 document](https://curl.se/docs/thanks.html).
@ -40,14 +37,17 @@ applications using (lib)curl visit [the support page](https://curl.se/support.ht

 ## Website

-Visit the [curl website](https://curl.se/) for the latest news and downloads.
+Visit the [curl website](https://curl.se/) for the latest news and
+downloads.

-## Source code
+## Git

-Download the latest source from the Git server:
+To download the latest source from the Git server, do this:

    git clone https://github.com/curl/curl.git

+(you will get a directory named curl created, filled with the source code)
+
 ## Security problems

 Report suspected security problems via [our HackerOne
@ -55,13 +55,13 @@ page](https://hackerone.com/curl) and not in public.

 ## Notice

-curl contains pieces of source code that is Copyright (c) 1998, 1999 Kungliga
+Curl contains pieces of source code that is Copyright (c) 1998, 1999 Kungliga
 Tekniska Högskolan. This notice is included here to comply with the
 distribution terms.

 ## Backers

-Thank you to all our backers 🙏 [Become a backer](https://opencollective.com/curl#section-contribute).
+Thank you to all our backers! 🙏 [Become a backer](https://opencollective.com/curl#section-contribute).

 ## Sponsors

--- a/274
+++ b/274
@ -1,136 +1,29 @@
-curl and libcurl 8.13.0
+curl and libcurl 8.10.0

- Public curl releases:         266
- Command line options:         267
+ Public curl releases:         260
+ Command line options:         263
 curl_easy_setopt() options:   306
- Public functions in libcurl:  96
- Contributors:                 3354
+ Public functions in libcurl:  94
+ Contributors:                 3212

 This release includes the following changes:

- o curl: add write-out variable 'tls_earlydata' [79]
- o rustls: add support for CERTINFO [106]
- o tool_getparam: make --url support a file with URLs [104]
- o var: add a '64dec' function that can base64 decode a string [78]
- o wolfssl: tls early data support [50]

 This release includes the following bugfixes:

- o addrinfo: add curl macro to avoid redefining foreign symbols [29]
- o asyn-thread: avoid the separate 'struct resdata' alloc [20]
- o asyn-thread: avoid the separate curl_mutex_t alloc [6]
- o asyn-thread: do not allocate thread_data separately [21]
- o asyn-thread: remove 'status' from struct Curl_async [36]
- o build: add Windows CE / CeGCC support, with CI jobs [87]
- o build: drop unused `getpart` tool [107]
- o build: enable -Wjump-misses-init for GCC 4.5+ [62]
- o build: fix compiler warnings in feature detections [39]
- o build: set `HAVE_WRITABLE_ARGV` for Apple cross-builds [8]
- o build: silence bogus `-Wconversion` warnings with gcc 5.1-5.4 [68]
- o c-ares: error out for unsupported versions, drop unused macros [85]
- o ca-native.md: sync with CURLSSLOPT_NATIVE_CA [72]
- o cf-socket: deduplicate Windows Vista detection [11]
- o client writer: handle pause before deocding [61]
- o cmake: `SHARE_LIB_OBJECT=ON` requires CMake 3.12 or newer [46]
- o cmake: add pre-fill for Unix, enable in GHA/macos, verify pre-fills [42]
- o cmake: allow empty `IMPORT_LIB_SUFFIX`, add suffix collision detection [41]
- o cmake: avoid `-Wnonnull` warning in `HAVE_FSETXATTR_5` detection [81]
- o cmake: disable HTTPS-proxy as a feature if proxy is disabled [77]
- o cmake: drop `CURL_DISABLE_TESTS` option [94]
- o cmake: drop `HAVE_IN_ADDR_T` from pre-fill too
- o cmake: drop two stray TLS feature checks for wolfSSL [9]
- o cmake: fix `HAVE_ATOMIC`/`HAVE_STDATOMIC` pre-fill for clang-cl [28]
- o cmake: fix ECH detection in custom-patched OpenSSL [32]
- o cmake: hide empty `MINGW64_VERSION` output for mingw32ce [114]
- o cmake: mention 'insecure' in the debug build warning [15]
- o cmake: misc tidy-ups [38]
- o cmake: pre-fill known type sizes for Windows OSes [100]
- o cmake: restrict static CRT builds to static curl exe, test in CI [113]
- o cmake: sync cutoff version with autotools for picky option `-ftree-vrp` [99]
- o cmake: sync OpenSSL(-fork) feature checks with `./configure` [49]
- o CODE_STYLE: readability and banned functions [35]
- o configure: silence compiler warnings in feature checks, drop duplicates [86]
- o configure: use `curl_cv_apple` variable [40]
- o conn: fix connection reuse when SSL is optional [54]
- o contributors.sh: lowercase 'github' for consistency [52]
- o contrithanks.sh: update docs/THANKS in place [119]
- o cookie: do prefix matching case-sensitively [82]
- o cookie: minor parser simplification [58]
- o cookie: simplify invalid_octets() [24]
- o curl.h: change some enums to defines with L suffix [84]
- o curl_msh3: remove verify bypass from DEBUGBUILDs [43]
- o curl_trc: fix build with CURL_DISABLE_VERBOSE_STRINGS [109]
- o CURLMOPT_SOCKETFUNCTION.md: add advice for socket callback invocation[69]
- o CURLOPT_HTTPHEADER.md: add comments to the example [90]
- o CURLOPT_HTTPHEADER.md: rephrases [108]
- o docs: add FD_ZERO to curl_multi_fdset example [19]
- o docs: bump `rustls` to 0.14.1 [111]
- o docs: correct argument names & URL redirection [4]
- o eventfd: allow use on all CPUs [93]
- o gnutls: fix connection state check on handshake [80]
- o hash: use single linked list for entries [57]
- o hostip: make CURLOPT_RESOLVE support replacing IPv6 addresses [47]
- o HTTP3.md: only speak about minimal versions [18]
- o http: convert parsers to strparse [48]
- o http: fix NTLM info message typo [22]
- o http: fix the auth check [88]
- o http: make the RTSP version check stricter [73]
- o http: negotiation and room for alt-svc/https rr to navigate [64]
- o http: version negotiation [45]
- o http_aws_sigv4: use strparse more for parsing [55]
- o https-rr: implementation improvements [44]
- o httpsrr: fix port detection [51]
- o httpsrr: fix the HTTPS-RR threaded-resolver build combo [67]
- o INSTALL-CMAKE.md: CMake usage updates [101]
- o INSTALL-CMAKE.md: mention `ZLIB_USE_STATIC_LIBS` [112]
- o lib: better optimized casecompare() and ncasecompare() [3]
- o lib: simplify more white space loops [60]
- o lib: strtoofft.h header cleanup [17]
- o lib: use Curl_str_* instead of strtok_r() [59]
- o lib: use Curl_str_number() for parsing decimal numbers [13]
- o libtest/libprereq.c: set CURLOPT_FOLLOWLOCATION with a long [89]
- o managen: correct the warning for un-escaped '<' and '>' [1]
- o msvc: drop support for VS2005 and older [96]
- o multi: event based rework [74]
- o openssl: check return value of X509_get0_pubkey [105]
- o openssl: drop support for old OpenSSL/LibreSSL versions [95]
- o openssl: remove bad `goto`s into other scope [63]
- o runtests: drop recognizing 'winssl' as Schannel [102]
- o runtests: drop ref to unused external function
- o runtests: recognize AWS-LC as OpenSSL [103]
- o runtests: support multi-target cmake, drop workarounds from CI [116]
- o schannel: deduplicate Windows Vista detection [98]
- o schannel: enable ALPN support under WINE 6.0+ [92]
- o schannel: enable ALPN with MinGW, fix ALPN for UWP builds [71]
- o schannel: guard ALPN init code to ALPN builds [91]
- o scripts/managen: fix option 'single' [31]
- o scripts/managen: fix parsing of markdown code sections [30]
- o setopt: remove unnecesary void pointer typecasts [76]
- o ssh: consider sftp quote commands case sensitive [33]
- o ssl session cache: add exportable flag [56]
- o strparse: make Curl_str_number() return error for no digits [14]
- o strparse: switch the API to work on 'const char *' [2]
- o strparse: switch to curl_off_t as base data type [7]
- o tests: fix enum/int confusion, fix autotools `CFLAGS` for `servers` [27]
- o tidy-up: align MSYS2/Cygwin codepaths, follow Cygwin `MAX_PID` bump [97]
- o tidy-up: delete, comment or scope C macros reported unused [16]
- o tidy-up: drop unused `CURL_INADDR_NONE` macro and `in_addr_t` type [26]
- o tidy-up: use `CURL_ARRAYSIZE()` [37]
- o timediff: fix comment for curlx_mstotv() [25]
- o timediff: remove unnecessary double typecast [53]
- o tool_getparam: clear sensitive arguments better [66]
- o tool_operate: fail SSH transfers without server auth [70]
- o urlapi: simplify junkscan [23]
- o variable.md: clarify 'trim' example [12]
- o windows: drop code and curl manifest targeting W2K and older [115]
- o wolfssh: retrieve the error using wolfSSH_get_error [5]
- o wolfssl: fix CA certificate multiple location import [34]
- o wolfssl: warn if CA native import option is ignored [65]
- o wolfssl: when using PQ KEM, use ML-KEM, not Kyber [10]
+ o cmake: distcheck for files in CMake subdir [9]
+ o dist: add missing `FindNettle.cmake` [11]
+ o GHA/windows: enable MulitSSL in an MSVC job [2]
+ o GHA: scan git repository and detect unvetted binary files [3]
+ o INSTALL.md: MultiSSL and QUIC are mutually exclusive [7]
+ o lib: convert some debugf()s into traces [8]
+ o libcurl.pc: add `Cflags.private` [10]
+ o rustls: make all tests pass [1]
+ o tests: provide docs as curldown, not nroff [12]

 This release includes the following known bugs:

- See https://curl.se/docs/knownbugs.html
+ See docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)

 For all changes ever done in curl:

@ -138,136 +31,25 @@ For all changes ever done in curl:

 Planned upcoming removals include:

- o Support for the msh3 HTTP/3 backend
- o The winbuild build system
 o TLS libraries not supporting TLS 1.3

- See https://curl.se/dev/deprecate.html
+ See https://curl.se/dev/deprecate.html for details

 This release would not have looked like this without help, code, reports and
 advice from friends like these:

-  Anthony Hu, Dan Fandrich, Daniel Stenberg, dependabot[bot], Derek Huang,
-  Dexter Gerig, Harry Sintonen, Jeremy Drake, John Bampton, Joseph Chen,
-  kayrus on github, kriztalz, Laurențiu Nicola, lf- on github, Marcel Raad,
-  Mark Phillips, qhill on github, Ray Satiro, renovate[bot], rmg-x on github,
-  RubisetCie on github, Sergey, Stefan Eissing, Tianyi Song, Timo Tijhof,
-  Viktor Szakats, Yedaya Katsman, Zenju on github
-  (28 contributors)
+  Christoph Reiter, Daniel Stenberg, Joe Birr-Pixton, Matt Jolly,
+  Stefan Eissing, Tal Regev, Viktor Szakats
+  (7 contributors)

 References to bug reports and discussions on issues:

- [1] = https://curl.se/bug/?i=16315
- [2] = https://curl.se/bug/?i=16316
- [3] = https://curl.se/bug/?i=16311
- [4] = https://curl.se/bug/?i=16334
- [5] = https://curl.se/bug/?i=16335
- [6] = https://curl.se/bug/?i=16323
- [7] = https://curl.se/bug/?i=16336
- [8] = https://curl.se/bug/?i=16338
- [9] = https://curl.se/bug/?i=16339
- [10] = https://curl.se/bug/?i=16337
- [11] = https://curl.se/bug/?i=16400
- [12] = https://curl.se/bug/?i=16346
- [13] = https://curl.se/bug/?i=16319
- [14] = https://curl.se/bug/?i=16319
- [15] = https://curl.se/bug/?i=16327
- [16] = https://curl.se/bug/?i=16279
- [17] = https://curl.se/bug/?i=16331
- [18] = https://curl.se/bug/?i=16320
- [19] = https://curl.se/bug/?i=16325
- [20] = https://curl.se/bug/?i=16321
- [21] = https://curl.se/bug/?i=16241
- [22] = https://curl.se/bug/?i=16305
- [23] = https://curl.se/bug/?i=16307
- [24] = https://curl.se/bug/?i=16306
- [25] = https://curl.se/bug/?i=16310
- [26] = https://curl.se/bug/?i=16318
- [27] = https://curl.se/bug/?i=16314
- [28] = https://curl.se/bug/?i=16313
- [29] = https://curl.se/bug/?i=16274
- [30] = https://curl.se/bug/?i=16345
- [31] = https://curl.se/bug/?i=16344
- [32] = https://curl.se/bug/?i=16354
- [33] = https://curl.se/bug/?i=16382
- [34] = https://curl.se/bug/?i=16391
- [35] = https://curl.se/bug/?i=16349
- [36] = https://curl.se/bug/?i=16347
- [37] = https://curl.se/bug/?i=16381
- [38] = https://curl.se/bug/?i=16238
- [39] = https://curl.se/bug/?i=16287
- [40] = https://curl.se/bug/?i=16340
- [41] = https://curl.se/bug/?i=16324
- [42] = https://curl.se/bug/?i=15841
- [43] = https://curl.se/bug/?i=16342
- [44] = https://curl.se/bug/?i=16132
- [45] = https://curl.se/bug/?i=16100
- [46] = https://curl.se/bug/?i=16375
- [47] = https://curl.se/bug/?i=16357
- [48] = https://curl.se/bug/?i=16436
- [49] = https://curl.se/bug/?i=16352
- [50] = https://curl.se/bug/?i=16167
- [51] = https://curl.se/bug/?i=16409
- [52] = https://curl.se/bug/?i=16443
- [53] = https://curl.se/bug/?i=16367
- [54] = https://curl.se/bug/?i=16384
- [55] = https://curl.se/bug/?i=16366
- [56] = https://curl.se/bug/?i=16322
- [57] = https://curl.se/bug/?i=16351
- [58] = https://curl.se/bug/?i=16362
- [59] = https://curl.se/bug/?i=16360
- [60] = https://curl.se/bug/?i=16363
- [61] = https://curl.se/bug/?i=16280
- [62] = https://curl.se/bug/?i=16252
- [63] = https://curl.se/bug/?i=16356
- [64] = https://curl.se/bug/?i=16117
- [65] = https://curl.se/bug/?i=16417
- [66] = https://curl.se/bug/?i=16396
- [67] = https://curl.se/bug/?i=16399
- [68] = https://curl.se/bug/?i=16398
- [69] = https://curl.se/bug/?i=16441
- [70] = https://curl.se/bug/?i=16205
- [71] = https://curl.se/bug/?i=16385
- [72] = https://curl.se/bug/?i=16373
- [73] = https://curl.se/bug/?i=16435
- [74] = https://curl.se/bug/?i=16308
- [76] = https://curl.se/bug/?i=16426
- [77] = https://curl.se/bug/?i=16434
- [78] = https://curl.se/bug/?i=16330
- [79] = https://curl.se/bug/?i=15956
- [80] = https://curl.se/bug/?i=16423
- [81] = https://curl.se/bug/?i=16427
- [82] = https://curl.se/bug/?i=16494
- [84] = https://curl.se/bug/?i=16482
- [85] = https://curl.se/bug/?i=16407
- [86] = https://curl.se/bug/?i=16377
- [87] = https://curl.se/bug/?i=15975
- [88] = https://curl.se/bug/?i=16419
- [89] = https://curl.se/bug/?i=16487
- [90] = https://curl.se/bug/?i=16488
- [91] = https://curl.se/bug/?i=16420
- [92] = https://curl.se/bug/?i=16393
- [93] = https://curl.se/bug/?i=16277
- [94] = https://curl.se/bug/?i=16134
- [95] = https://curl.se/bug/?i=16104
- [96] = https://curl.se/bug/?i=16004
- [97] = https://curl.se/bug/?i=16217
- [98] = https://curl.se/bug/?i=16408
- [99] = https://curl.se/bug/?i=16478
- [100] = https://curl.se/bug/?i=16464
- [101] = https://curl.se/bug/?i=16329
- [102] = https://curl.se/bug/?i=16467
- [103] = https://curl.se/bug/?i=16466
- [104] = https://curl.se/bug/?i=16099
- [105] = https://curl.se/bug/?i=16468
- [106] = https://curl.se/bug/?i=16459
- [107] = https://curl.se/bug/?i=16460
- [108] = https://curl.se/bug/?i=16461
- [109] = https://curl.se/bug/?i=16462
- [111] = https://curl.se/bug/?i=16446
- [112] = https://curl.se/bug/?i=16457
- [113] = https://curl.se/bug/?i=16456
- [114] = https://curl.se/bug/?i=16455
- [115] = https://curl.se/bug/?i=16453
- [116] = https://curl.se/bug/?i=16452
- [119] = https://curl.se/bug/?i=16448
+ [1] = https://curl.se/bug/?i=14317
+ [2] = https://curl.se/bug/?i=14276
+ [3] = https://curl.se/bug/?i=14333
+ [7] = https://curl.se/bug/?i=14308
+ [8] = https://curl.se/bug/?i=14322
+ [9] = https://curl.se/bug/?i=14323
+ [10] = https://curl.se/bug/?i=14321
+ [11] = https://curl.se/bug/?i=14285
+ [12] = https://curl.se/bug/?i=14324
--- a/REUSE.toml
+++ b/REUSE.toml
@ -24,7 +24,7 @@ path = [
  "docs/TODO",
  "GIT-INFO.md",
  "lib/libcurl.vers.in",
-  "lib/libcurl.def",
+  "libcurl.def",
  "packages/OS400/README.OS400",
  "packages/vms/build_vms.com",
  "packages/vms/curl_release_note_start.txt",
@ -32,7 +32,7 @@ path = [
  "packages/vms/macro32_exactcase.patch",
  "packages/vms/readme",
  "plan9/README",
-  "projects/Windows/**",
+  "projects/Windows/**", "projects/wolfssl_override.props",
  "README",
  "RELEASE-NOTES",
  "renovate.json",
@ -43,13 +43,8 @@ path = [
  # checksrc control files
  "docs/examples/.checksrc",
  "lib/.checksrc",
-  "lib/vauth/.checksrc",
-  "lib/vquic/.checksrc",
-  "lib/vssh/.checksrc",
-  "lib/vtls/.checksrc",
  "src/.checksrc",
  "tests/libtest/.checksrc",
-  "tests/server/.checksrc",
 ]
 SPDX-FileCopyrightText = "Daniel Stenberg, <daniel@haxx.se>, et al."
 SPDX-License-Identifier = "curl"
--- a/SECURITY.md
+++ b/SECURITY.md
@ -14,16 +14,3 @@ If you have found or just suspect a security problem somewhere in curl or
 libcurl, report it on [HackerOne](https://hackerone.com/curl).

 We treat security issues with confidentiality until controlled and disclosed responsibly.
-
-## OpenSSF Best Practices
-
-curl has achieved Gold status on the Open Source Security Foundation (OpenSSF)
-[Best Practices](https://bestpractices.dev/) (formerly Core Infrastructure
-Initiative Best Practices), reflecting its adherence to rigorous
-security and best practice standards. This achievement highlights curl's
-comprehensive documentation, secure development processes, effective change
-control mechanisms, and strong maintenance routines. Meeting these criteria
-demonstrates curl's commitment to security and reliability, ensuring the
-project's sustainability and trustworthiness. This underscores curl's role as
-a leader in open-source software practices. More information can be found on
-[curl's OpenSSF Best Practices project page](https://www.bestpractices.dev/projects/63).
--- a/Show More
+++ b/Show More