lib: build fixups when built with most things disabled

Closes #11687
tiny-curl: patch set
2023-08-24 13:15:31 +02:00 · 2023-08-24 13:15:31 +02:00
4524 changed files with 161952 additions and 199069 deletions
--- a/.azure-pipelines.yml
+++ b/.azure-pipelines.yml
@ -0,0 +1,315 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# https://dev.azure.com/daniel0244/curl/_build?view=runs
+#
+# Azure Pipelines configuration:
+# https://aka.ms/yaml
+
+trigger:
+  branches:
+    include:
+    - 'master'
+    - '*/ci'
+  paths:
+    exclude:
+    - '.circleci/*'
+    - '.cirrus.yml'
+    - '.github/*'
+    - '.github/workflows/*'
+    - 'appveyor.yml'
+    - 'packages/*'
+    - 'plan9/*'
+
+pr:
+  branches:
+    include:
+    - 'master'
+  paths:
+    exclude:
+    - '.circleci/*'
+    - '.cirrus.yml'
+    - '.github/*'
+    - '.github/workflows/*'
+    - 'appveyor.yml'
+    - 'packages/*'
+    - 'plan9/*'
+
+stages:
+
+##########################################
+### Linux jobs first
+##########################################
+
+- stage: linux
+  dependsOn: []
+  jobs:
+  - job: ubuntu
+    # define defaults to make sure variables are always expanded/replaced
+    variables:
+      install: ''
+      configure: ''
+      tests: '!433'
+    timeoutInMinutes: 60
+    pool:
+      vmImage: 'ubuntu-latest'
+    strategy:
+      matrix:
+        default:
+          name: default
+          install:
+          configure: --enable-debug --with-openssl
+        disable_ipv6:
+          name: w/o IPv6
+          configure: --disable-ipv6 --with-openssl
+        disable_http_smtp_imap:
+          name: w/o HTTP/SMTP/IMAP
+          configure: --disable-http --disable-smtp --disable-imap --without-ssl
+        disable_thredres:
+          name: sync resolver
+          configure: --disable-threaded-resolver --with-openssl
+        https_only:
+          name: HTTPS only
+          configure: --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --with-openssl
+        torture:
+          name: torture
+          install: libnghttp2-dev
+          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl
+          tests: -n -t --shallow=25 !FTP
+    steps:
+    - script: sudo apt-get update && sudo apt-get install -y stunnel4 python3-impacket libzstd-dev libbrotli-dev $(install)
+      displayName: 'apt install'
+      retryCountOnTaskFailure: 3
+
+    - script: autoreconf -fi && ./configure --enable-warnings --enable-werror $(configure)
+      displayName: 'configure $(name)'
+
+    - script: make V=1 && make V=1 examples && cd tests && make V=1
+      displayName: 'compile'
+      env:
+        MAKEFLAGS: "-j 2"
+
+    - script: make V=1 test-ci
+      displayName: 'test'
+      env:
+        AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
+        TFLAGS: "-ac /usr/bin/curl -r $(tests)"
+
+- stage: distcheck
+  dependsOn: []
+  jobs:
+  - job: ubuntu
+    timeoutInMinutes: 30
+    pool:
+      vmImage: 'ubuntu-latest'
+    steps:
+    - script: autoreconf -fi && ./configure --without-ssl
+      displayName: 'configure $(name)'
+
+    - script: make && ./maketgz 99.98.97
+      displayName: 'make tarball'
+
+    - script: |
+        tar xf curl-99.98.97.tar.gz
+        cd curl-99.98.97
+        ./configure --prefix=$HOME/temp --without-ssl
+        make
+        make TFLAGS=1 test
+        make install
+        # basic check of the installed files
+        cd ..
+        bash scripts/installcheck.sh $HOME/temp
+        rm -rf curl-99.98.97
+
+      displayName: 'verify in-tree configure build'
+
+    - script: |
+        # verify out-of-tree build
+        tar xf curl-99.98.97.tar.gz
+        touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
+        mkdir build
+        cd build
+        ../curl-99.98.97/configure --without-ssl
+        make
+        make TFLAGS='-p 1 1139' test
+        # verify cmake build
+        cd ..
+        rm -rf curl-99.98.97
+
+      displayName: 'verify out-of-tree configure build'
+
+    - script: |
+        tar xf curl-99.98.97.tar.gz
+        cd curl-99.98.97
+        mkdir build
+        cd build
+        cmake ..
+        make
+
+      displayName: 'verify out-of-tree cmake build'
+
+- stage: scanbuild
+  dependsOn: []
+  jobs:
+  - job: ubuntu
+    timeoutInMinutes: 30
+    pool:
+      vmImage: 'ubuntu-latest'
+    steps:
+    - script: sudo apt-get update && sudo apt-get install -y clang-tools clang libssl-dev libssh2-1-dev libpsl-dev libbrotli-dev libzstd-dev
+      displayName: 'apt install'
+      retryCountOnTaskFailure: 3
+
+    - script: autoreconf -fi
+      displayName: 'autoreconf'
+
+    - script: scan-build ./configure --enable-debug --enable-werror --with-openssl --with-libssh2
+      displayName: 'configure'
+      env:
+        CC: "clang"
+        CCX: "clang++"
+
+    - script: scan-build --status-bugs make
+      displayName: 'make'
+
+    - script: scan-build --status-bugs make examples
+      displayName: 'make examples'
+
+##########################################
+### Windows jobs below
+##########################################
+
+- stage: windows
+  dependsOn: []
+  variables:
+    agent.preferPowerShellOnContainers: true
+  jobs:
+  - job: msys
+    # define defaults to make sure variables are always expanded/replaced
+    variables:
+      container_img: ''
+      container_cmd: ''
+      configure: ''
+      tests: ''
+    timeoutInMinutes: 120
+    pool:
+      vmImage: 'windows-2019'
+    strategy:
+      matrix:
+        v2_mingw32_openssl:
+          name: 32-bit OpenSSL/libssh2
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+          container_cmd: C:\msys64\usr\bin\sh
+          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --with-libssh2 --with-openssl
+          tests: "~571"
+        v2_mingw64_openssl:
+          name: 64-bit OpenSSL/libssh2
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+          container_cmd: C:\msys64\usr\bin\sh
+          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh2 --with-openssl
+          tests: "~571"
+        v2_mingw64_libssh:
+          name: 64-bit OpenSSL/libssh
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+          container_cmd: C:\msys64\usr\bin\sh
+          prepare: pacman -S --needed --noconfirm --noprogressbar libssh-devel mingw-w64-x86_64-libssh
+          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --with-libssh --with-openssl
+          tests: "~571 ~614"
+        v1_mingw:
+          name: 32-bit (legacy)
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw:ltsc2019
+          container_cmd: C:\MinGW\msys\1.0\bin\sh
+          configure: --host=i686-pc-mingw32 --build=i686-pc-mingw32 --prefix=/mingw --enable-debug --without-ssl --with-mingw1-deprecated
+          tests: "!203 !1143"
+        v1_mingw32:
+          name: 32-bit w/o zlib
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw32:ltsc2019
+          container_cmd: C:\MinGW\msys\1.0\bin\sh
+          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --without-zlib --without-ssl
+          tests: "!203 !1143"
+        v1_mingw64:
+          name: 64-bit w/o zlib
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw64:ltsc2019
+          container_cmd: C:\MinGW\msys\1.0\bin\sh
+          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --without-zlib --without-ssl
+          tests: "!203 !1143"
+        v2_mingw32_schannel:
+          name: 32-bit Schannel/SSPI/WinIDN/libssh2
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+          container_cmd: C:\msys64\usr\bin\sh
+          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
+          tests: "~571"
+        v2_mingw64_schannel:
+          name: 64-bit Schannel/SSPI/WinIDN/libssh2
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+          container_cmd: C:\msys64\usr\bin\sh
+          prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
+          tests: "~571"
+        v1_mingw_schannel:
+          name: 32-bit Schannel/SSPI/WinIDN (legacy)
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw:ltsc2019
+          container_cmd: C:\MinGW\msys\1.0\bin\sh
+          configure: --host=i686-pc-mingw32 --build=i686-pc-mingw32 --prefix=/mingw --enable-debug --enable-sspi --with-schannel --with-winidn --with-mingw1-deprecated
+          tests: "!203 !305 !311 !312 !313 !404 !1143 !2033 !2035 !2038 !2041 !2042 !2048 !2070 !2079 !2087 !3023 !3024"
+        v1_mingw32_schannel:
+          name: 32-bit Schannel/SSPI/WinIDN w/o zlib
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw32:ltsc2019
+          container_cmd: C:\MinGW\msys\1.0\bin\sh
+          configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib
+          tests: "!203 !1143"
+        v1_mingw64_schannel:
+          name: 64-bit Schannel/SSPI/WinIDN w/o zlib
+          container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys1-mingw64:ltsc2019
+          container_cmd: C:\MinGW\msys\1.0\bin\sh
+          configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64  --enable-debug --enable-werror --enable-sspi --with-schannel --with-winidn --without-zlib
+          tests: "!203 !1143"
+    container:
+      image: $(container_img)
+      env:
+        MSYS2_PATH_TYPE: inherit
+    steps:
+    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && $(prepare)"
+      displayName: 'prepare'
+      condition: variables.prepare
+      retryCountOnTaskFailure: 3
+
+    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && autoreconf -fi && ./configure $(configure)"
+      displayName: 'configure $(name)'
+
+    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 && make V=1 examples && cd tests && make V=1"
+      displayName: 'compile'
+      env:
+        MAKEFLAGS: "-j 2"
+
+    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 install && PATH=/usr/bin:/bin find . -type f -path '*/.libs/*.exe' -print -execdir mv -t .. {} \;"
+      displayName: 'install'
+
+    - script: $(container_cmd) -l -c "cd $(echo '%cd%') && make V=1 test-ci"
+      displayName: 'test'
+      env:
+        AZURE_ACCESS_TOKEN: "$(System.AccessToken)"
+        TFLAGS: "-ac /usr/bin/curl.exe !IDN !SCP ~612 ~1056 $(tests)"
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -24,10 +24,31 @@

 # View these jobs in the browser: https://app.circleci.com/pipelines/github/curl/curl

-# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/configuration-reference/
+# Use the latest 2.1 version of CircleCI pipeline process engine. See: https://circleci.com/docs/2.0/configuration-reference
 version: 2.1

 commands:
+  configure:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --enable-warnings --enable-werror --with-openssl
+
+  configure-openssl-no-verbose:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --disable-verbose --enable-werror --with-openssl
+
+  configure-no-proxy:
+    steps:
+      - run:
+          command: |
+            autoreconf -fi
+            ./configure --disable-proxy --enable-werror --with-openssl
+
  install-cares:
    steps:
      - run:
@ -44,100 +65,60 @@ commands:
    steps:
      - run:
          command: |
-            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip libpsl-dev
+            sudo apt-get update && sudo apt-get install -y libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev python3-pip
            sudo python3 -m pip install impacket

-  install-wolfssl:
-    steps:
-      - run:
-          command: |
-            # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-            WOLFSSL_VER=5.7.6
-            echo "Installing wolfSSL $WOLFSSL_VER"
-            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
-            tar -xzf v$WOLFSSL_VER-stable.tar.gz
-            cd wolfssl-$WOLFSSL_VER-stable
-            ./autogen.sh
-            ./configure --disable-dependency-tracking --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
-            make install
-
-  install-wolfssh:
-    steps:
-      - run:
-          command: |
-            # renovate: datasource=github-tags depName=wolfSSL/wolfssh versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-            WOLFSSH_VER=1.4.19
-            echo "Installing wolfSSH $WOLFSSH_VER"
-            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssh/archive/v$WOLFSSH_VER-stable.tar.gz
-            tar -xzf v$WOLFSSH_VER-stable.tar.gz
-            cd wolfssh-$WOLFSSH_VER-stable
-            ./autogen.sh
-            ./configure --disable-dependency-tracking --with-wolfssl=$HOME/wssl --prefix=$HOME/wssh --enable-scp --enable-sftp --disable-term --disable-examples
-            make install
-
-  configure:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-openssl \
-              || { tail -1000 config.log; false; }
-
-  configure-openssl-no-verbose:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror \
-              --with-openssl --disable-verbose \
-              || { tail -1000 config.log; false; }
-
-  configure-no-proxy:
-    steps:
-      - run:
-          command: |
-            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror \
-              --with-openssl --disable-proxy \
-              || { tail -1000 config.log; false; }
-
  configure-libssh:
    steps:
      - run:
          command: |
            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-openssl --with-libssh \
-              || { tail -1000 config.log; false; }
+            ./configure --enable-warnings --enable-werror --with-openssl --with-libssh
+
+  install-wolfssl:
+    steps:
+      - run:
+          command: |
+            WOLFSSL_VER=5.6.0
+            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
+            tar -xzf v$WOLFSSL_VER-stable.tar.gz
+            cd wolfssl-$WOLFSSL_VER-stable
+            ./autogen.sh
+            ./configure --enable-tls13 --enable-all --enable-harden --prefix=$HOME/wssl
+            make install
+
+  install-wolfssh:
+    steps:
+      - run:
+          command: |
+            WOLFSSH_VER=1.4.12
+            curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssh/archive/v$WOLFSSH_VER-stable.tar.gz
+            tar -xzf v$WOLFSSH_VER-stable.tar.gz
+            cd wolfssh-$WOLFSSH_VER-stable
+            ./autogen.sh
+            ./configure --with-wolfssl=$HOME/wssl --prefix=$HOME/wssh --enable-scp --enable-sftp --disable-examples
+            make install

  configure-cares:
    steps:
      - run:
          command: |
            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-openssl --enable-ares \
-              || { tail -1000 config.log; false; }
+            ./configure --enable-warnings --enable-werror --with-openssl --enable-ares

  configure-wolfssh:
    steps:
      - run:
          command: |
            autoreconf -fi
-            LDFLAGS="-Wl,-rpath,$HOME/wssh/lib" \
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-warnings \
-              --with-wolfssl=$HOME/wssl --with-wolfssh=$HOME/wssh \
-              || { tail -1000 config.log; false; }
+            LDFLAGS="-Wl,-rpath,$HOME/wssh/lib" ./configure --enable-warnings --enable-werror --with-wolfssl=$HOME/wssl --with-wolfssh=$HOME/wssh

  configure-cares-debug:
    steps:
      - run:
          command: |
            autoreconf -fi
-            ./configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-werror --enable-debug \
-              --with-openssl --enable-ares \
-              || { tail -1000 config.log; false; }
+            ./configure --enable-debug --enable-werror --with-openssl --enable-ares

  build:
    steps:
@ -146,19 +127,18 @@ commands:

  test:
    steps:
-      - run: make -j3 V=1 test-ci TFLAGS='-j14'
+      - run: make -j3 V=1 test-ci

 executors:
  ubuntu:
    machine:
-      image: ubuntu-2004:2024.01.1
+      image: ubuntu-2004:202010-01

 jobs:
  basic:
    executor: ubuntu
    steps:
      - checkout
-      - install-deps
      - configure
      - build
      - test
@ -194,7 +174,6 @@ jobs:
    executor: ubuntu
    steps:
      - checkout
-      - install-deps
      - install-cares
      - configure-cares
      - build
@ -204,7 +183,6 @@ jobs:
    executor: ubuntu
    steps:
      - checkout
-      - install-deps
      - install-libssh
      - configure-libssh
      - build
@ -212,22 +190,20 @@ jobs:

  arm:
    machine:
-      image: ubuntu-2004:2024.01.1
+      image: ubuntu-2004:202101-01
    resource_class: arm.medium
    steps:
      - checkout
-      - install-deps
      - configure
      - build
      - test

  arm-cares:
    machine:
-      image: ubuntu-2004:2024.01.1
+      image: ubuntu-2004:202101-01
    resource_class: arm.medium
    steps:
      - checkout
-      - install-deps
      - install-cares
      - configure-cares-debug
      - build
--- a/.cirrus.yml
+++ b/.cirrus.yml
@ -0,0 +1,294 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# https://cirrus-ci.com/github/curl/curl
+#
+# Cirrus CI configuration:
+# https://cirrus-ci.org/guide/writing-tasks/
+
+freebsd_task:
+  skip: "changesIncludeOnly(
+    '**/CMakeLists.txt',
+    '.azure-pipelines.yml',
+    '.circleci/**',
+    '.github/**',
+    'appveyor.yml',
+    'CMake/**',
+    'packages/**',
+    'plan9/**',
+    'projects/**',
+    'winbuild/**'
+    )"
+
+  name: FreeBSD
+
+  matrix:
+    - name: FreeBSD 13.2
+      freebsd_instance:
+        image_family: freebsd-13-2
+    - name: FreeBSD 12.4
+      freebsd_instance:
+        image_family: freebsd-12-4
+
+  env:
+    CIRRUS_CLONE_DEPTH: 10
+    CRYPTOGRAPHY_DONT_BUILD_RUST: 1
+    MAKE_FLAGS: -j 3
+
+  pkginstall_script:
+    - pkg update -f
+    - pkg install -y autoconf automake libtool pkgconf brotli openldap24-client heimdal libpsl libssh2 openssh-portable libidn2 librtmp libnghttp2 nghttp2 stunnel
+    - pkg delete -y curl
+    - python -m ensurepip --default-pip
+    - python -m pip install --upgrade pip
+    - pip install "cryptography<3.2"
+    - pip install "pyOpenSSL<20.0"
+    - pip install "impacket"
+  configure_script:
+    - autoreconf -fi
+    # Building with the address sanitizer is causing unexplainable test issues due to timeouts
+    #- case `uname -r` in
+    #    12.2*)
+    #    export CC=clang;
+    #    export CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g";
+    #    export CXXFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g";
+    #    export LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer" ;;
+    #  esac
+    - ./configure --prefix="${HOME}"/install --enable-debug --with-openssl --with-libssh2 --with-brotli --with-gssapi --with-libidn2 --enable-manual --enable-ldap --enable-ldaps --with-librtmp --with-libpsl --with-nghttp2 || { tail -300 config.log; false; }
+  compile_script:
+    - make V=1 && make V=1 examples && cd tests && make V=1
+  test_script:
+    # blackhole?
+    - sysctl net.inet.tcp.blackhole
+    # make sure we don't run blackhole != 0
+    - sudo sysctl net.inet.tcp.blackhole=0
+    # Some tests won't run if run as root so run them as another user.
+    # Make directories world writable so the test step can write wherever it needs.
+    - find . -type d -exec chmod 777 {} \;
+    # The OpenSSH server instance for the testsuite cannot be started on FreeBSD,
+    # therefore the SFTP and SCP tests are disabled right away from the beginning.
+    - sudo -u nobody make V=1 TFLAGS="-n !SFTP !SCP" test-ci
+  install_script:
+    - make V=1 install
+
+windows_task:
+  skip: "changesIncludeOnly(
+    '.azure-pipelines.yml',
+    '.circleci/**',
+    '.github/**',
+    'appveyor.yml',
+    'packages/**',
+    'plan9/**'
+    )"
+
+  name: Windows
+  timeout_in: 120m
+  windows_container:
+    image: ${container_img}
+
+  matrix:
+    - name: Windows 32-bit shared/release Schannel/SSPI/WinIDN/libssh2
+      env:
+        container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+        container_cmd: C:\msys64\usr\bin\sh
+        prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+        configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2
+        tests: "~571"
+        make_cmd: make V=1
+    - name: Windows 32-bit static/release Schannel/SSPI/WinIDN/libssh2
+      env:
+        container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw32:ltsc2019
+        container_cmd: C:\msys64\usr\bin\sh
+        prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-i686-libssh2 mingw-w64-i686-python-pip mingw-w64-i686-python-wheel mingw-w64-i686-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+        configure: --host=i686-w64-mingw32 --build=i686-w64-mingw32 --prefix=/mingw32 --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2 --disable-shared --enable-static  --enable-websockets
+        tests: "~571"
+        make_cmd: make LDFLAGS=-all-static V=1
+        PKG_CONFIG: pkg-config --static
+    - name: Windows 64-bit shared/release Schannel/SSPI/WinIDN/libssh2
+      env:
+        container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+        container_cmd: C:\msys64\usr\bin\sh
+        prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+        configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2  --enable-websockets
+        tests: "~571"
+        make_cmd: make V=1
+    - name: Windows 64-bit static/release Schannel/SSPI/WinIDN/libssh2
+      env:
+        container_img: ghcr.io/mback2k/curl-docker-winbuildenv/msys2-mingw64:ltsc2019
+        container_cmd: C:\msys64\usr\bin\sh
+        prepare: pacman -S --needed --noconfirm --noprogressbar libssh2-devel mingw-w64-x86_64-libssh2 mingw-w64-x86_64-python-pip mingw-w64-x86_64-python-wheel mingw-w64-x86_64-python-pyopenssl && python3 -m pip install --prefer-binary impacket
+        configure: --host=x86_64-w64-mingw32 --build=x86_64-w64-mingw32 --prefix=/mingw64 --enable-werror --enable-sspi --with-schannel --with-winidn --with-libssh2 --disable-shared --enable-static --enable-websockets
+        tests: "~571"
+        make_cmd: make LDFLAGS=-all-static V=1
+        PKG_CONFIG: pkg-config --static
+
+  env:
+    CIRRUS_CLONE_DEPTH: 10
+    MSYS2_PATH_TYPE: inherit
+    MAKEFLAGS: -j 3
+
+  prepare_script: |
+    %container_cmd% -l -c "cd $(echo '%cd%') && %prepare%"
+  configure_script: |
+    %container_cmd% -l -c "cd $(echo '%cd%') && autoreconf -fi && ./configure %configure%"
+  compile_script: |
+    %container_cmd% -l -c "cd $(echo '%cd%') && %make_cmd% && %make_cmd% examples && cd tests && %make_cmd%"
+  install_script: |
+    %container_cmd% -l -c "cd $(echo '%cd%') && %make_cmd% install && PATH=/usr/bin:/bin find . -type f -path '*/.libs/*.exe' -print -execdir mv -t .. {} \;"
+  test_script: |
+    %container_cmd% -l -c "cd $(echo '%cd%') && %make_cmd% TFLAGS='!IDN !SCP ~612 ~1056 %tests%' test-ci"
+
+macos_task:
+  skip: "changesIncludeOnly(
+    '.azure-pipelines.yml',
+    '.circleci/**',
+    '.github/**',
+    'appveyor.yml',
+    'packages/**',
+    'plan9/**',
+    'projects/**',
+    'winbuild/**'
+    )"
+
+  name: macOS arm64
+  macos_instance:
+    image: ghcr.io/cirruslabs/macos-ventura-xcode:latest
+
+  matrix:
+    - name: macOS arm64 normal
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2
+        configure: --without-ssl
+    - name: macOS arm64 debug
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2
+        configure: --without-ssl --enable-debug
+    - name: macOS arm64 libssh2
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 libssh2
+        configure: --without-ssl --enable-debug --with-libssh2=/opt/homebrew/opt/libssh2
+        TFLAGS: -n !SFTP !SCP
+    - name: macOS arm64 libssh-c-ares
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 openssl libssh
+        configure: --enable-debug --with-openssl=/opt/homebrew/opt/openssl --with-libssh --enable-ares
+    - name: macOS arm64 libssh
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 openssl libssh
+        configure: --enable-debug --with-openssl=/opt/homebrew/opt/openssl --with-libssh
+    - name: macOS arm64 c-ares
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2
+        configure: --without-ssl --enable-debug --enable-ares
+    - name: macOS arm64 HTTP only
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.15
+        install_packages: nghttp2
+        configure: --enable-debug --enable-maintainer-mode --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets --disable-shared --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib
+    - name: macOS arm64 SecureTransport http2
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.8
+        install_packages: nghttp2
+        configure: --with-secure-transport
+    - name: macOS arm64 OpenSSL http2
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 openssl
+        configure: --enable-debug --with-openssl=/opt/homebrew/opt/openssl
+    - name: macOS arm64 LibreSSL http2
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 libressl
+        configure: --enable-debug --with-openssl=/opt/homebrew/opt/libressl
+    - name: macOS arm64 torture
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 openssl
+        configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/opt/homebrew/opt/openssl
+        TFLAGS: -n -t --shallow=25 !FTP
+    - name: macOS arm64 torture-ftp
+      env:
+        CFLAGS: -Wno-vla -mmacosx-version-min=10.9
+        install_packages: nghttp2 openssl
+        configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/opt/homebrew/opt/openssl
+        TFLAGS: -n -t --shallow=20 FTP
+
+  env:
+    CIRRUS_CLONE_DEPTH: 10
+    MAKE_FLAGS: -j 12
+
+  pkginstall_script:
+    - echo libtool autoconf automake pkg-config ${install_packages} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+    - "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
+    - sudo -H python3 -m pip install --upgrade pip
+    - sudo -H python3 -m pip install impacket
+  configure_script:
+    - autoreconf -fi
+    - ./configure --enable-warnings --enable-werror --enable-websockets ${configure}
+  compile_script:
+    - make V=1 && make V=1 examples && cd tests && make V=1
+  test_script:
+    - make V=1 test-ci
+  install_script:
+    - sudo -H make V=1 install
+
+linux_musl_task:
+  skip: "changesIncludeOnly(
+    '**/CMakeLists.txt',
+    '.azure-pipelines.yml',
+    '.circleci/**',
+    '.github/**',
+    'appveyor.yml',
+    'CMake/**',
+    'packages/**',
+    'plan9/**',
+    'projects/**',
+    'winbuild/**'
+    )"
+  name: Linux MUSL
+  container:
+    image: alpine:3.18
+    memory: 800M
+
+  env:
+    CIRRUS_CLONE_DEPTH: 10
+    MAKEFLAGS: -j 3
+
+  pkginstall_script:
+    - apk add --no-cache build-base autoconf automake libtool perl openssl-dev libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev heimdal-dev libpsl-dev py3-impacket py3-asn1 py3-six py3-pycryptodomex perl-time-hires openssh stunnel sudo
+  configure_script:
+    - autoreconf -fi
+    - ./configure --enable-warnings --enable-debug --enable-websockets --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl
+  compile_script:
+    - make V=1 && make V=1 examples && make -C tests V=1
+  test_script:
+    # TODO: ssh tests don't work, likely because we're running as root
+    - USER=nobody make V=1 test-ci
+  install_script:
+    - make V=1 install
--- a/.dcignore
+++ b/.dcignore
@ -0,0 +1,7 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+tests/**
+docs/**
+docs/examples/**
--- a/.gitattributes
+++ b/.gitattributes
@ -2,6 +2,7 @@
 #
 # SPDX-License-Identifier: curl

+*.dsw -crlf
 buildconf eol=lf
 configure.ac eol=lf
 *.m4 eol=lf
@ -10,6 +11,8 @@ configure.ac eol=lf
 *.sh eol=lf
 *.[ch] whitespace=tab-in-indent

-# Batch files must be run with CRLF line endings.
+# Batch files (bat,btm,cmd) must be run with CRLF line endings.
 # Refer to https://github.com/curl/curl/pull/6442
 *.bat text eol=crlf
+*.btm text eol=crlf
+*.cmd text eol=crlf
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -1,3 +1,3 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@ -26,4 +26,4 @@ Send your suggestions using one of these methods:

 3. as an [issue](https://github.com/curl/curl/issues)

-/ The curl team
+/ The curl team!
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@ -2,8 +2,8 @@
 #
 # SPDX-License-Identifier: curl

-name: Bug Report on code
-description: Tell us about your problem with curl or libcurl
+name: Bug Report
+description: Create a report to help us improve

 body:
  - type: markdown
@ -31,10 +31,10 @@ body:
    id: expected-behaviour
    attributes:
      label: I expected the following
-    validations:
+    validations: 
      required: false
-
-  - type: textarea
+  
+  - type: input
    id: version
    attributes:
      label: curl/libcurl version
@ -42,9 +42,9 @@ body:
        Please paste the output of `curl -V` here.
      placeholder: 'curl 8.2.0'
    validations:
-      required: true
+      required: false

-  - type: textarea
+  - type: input
    id: os
    attributes:
      label: operating system
@ -52,4 +52,4 @@ body:
        On Unix please post the output of `uname -a` here.
      placeholder: 'Fedora Linux 38'
    validations:
-      required: true
+      required: false
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@ -4,15 +4,12 @@

 blank_issues_enabled: false
 contact_links:
-  - name: Ask a question (without email)
-    url: https://github.com/curl/curl/discussions
-    about: Use the Discussion forum here on GitHub
-  - name: Ask a question (using email)
-    url: https://curl.se/mail/
-    about: Send question to the suitable mailing list
-  - name: Commercial support
-    url: https://curl.se/support.html
-    about: Pay for fast quality support for and help with curl/libcurl
  - name: Feature request
    url: https://curl.se/mail/
    about: To propose new features or enhancements, please bring that discussion to a suitable curl mailing list.
+  - name: Question
+    url: https://curl.se/mail/
+    about: Questions should go to the mailing list
+  - name: Commercial support
+    url: https://curl.se/support.html
+    about: Several companies are offering paid support for curl/libcurl
--- a/.github/ISSUE_TEMPLATE/docs.yml
+++ b/.github/ISSUE_TEMPLATE/docs.yml
@ -1,32 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Bug Report on documentation
-description: Problems, errors, mistakes or typos in documentation.
-labels: documentation
-
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this bug report!
-
-        Only file documentation bugs here! Ask questions on the mailing lists https://curl.se/mail/
-
-  - type: textarea
-    id: source
-    attributes:
-      label: Specify which documentation you found a problem with
-      description: |
-        Include function name, URL, tarball version and all other relevant
-        details that identify the documentation source.
-    validations:
-      required: true
-
-  - type: textarea
-    id: problem
-    attributes:
-      label: The problem
-    validations:
-      required: true
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -1,10 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-version: 2
-updates:
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -7,525 +7,296 @@
 # triaging, but is intended to add labels to the easy cases. If the matching
 # language becomes more powerful, more cases should be able to be handled.
 #
-# Labels are added in two ways: the any-glob-to-all-files ones are added if all
-# the files fit into the category, and the any-glob-to-any-file ones are added
-# as long as any file matches. The first ones are for "major" categories (the
-# PR is all about that one topic, like HTTP/3), while the second ones are
-# "addendums" that give useful information about a PR that's really mostly
-# something else (e.g. CI if the PR also touches CI jobs).
-#
-# N.B. any-glob-to-all-files is misnamed; it acts like one-glob-to-all-files.
-# Therefore, to get any-glob-to-all-files semantics with multiple matching
-# patterns, they must be joined with commas to a single string surrounded by
-# braces. For example: '{lib/**,src/**}'.
-#
-# See https://github.com/actions/labeler/ for documentation on this file.
---
-
-appleOS:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              .github/workflows/macos.yml,\
-              lib/config-mac.h,\
-              lib/macos*,\
-              lib/vtls/sectransp*,\
-              m4/curl-sectransp.m4\
-              }"
+# The biggest low-hanging problem is this:
+# It looks like there's no way of specifying that a label be added if *all* the
+# files match *any* one of a number of globs. This feature request is tracked
+# in https://github.com/actions/labeler/issues/423

 authentication:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/mk-ca-bundle.1,\
-              docs/libcurl/opts/CURLINFO_HTTPAUTH*,\
-              docs/libcurl/opts/CURLINFO_PROXYAUTH*,\
-              docs/libcurl/opts/CURLOPT_KRB*,\
-              docs/libcurl/opts/CURLOPT_SASL*,\
-              docs/libcurl/opts/CURLOPT_SERVICE_NAME*,\
-              docs/libcurl/opts/CURLOPT_USERNAME*,\
-              docs/libcurl/opts/CURLOPT_USERPWD*,\
-              docs/libcurl/opts/CURLOPT_XOAUTH*,\
-              lib/*gssapi*,\
-              lib/*krb5*,\
-              lib/*ntlm*,\
-              lib/curl_sasl.*,\
-              lib/http_aws*,\
-              lib/http_digest.*,\
-              lib/http_negotiate.*,\
-              lib/vauth/**\
-              }"
+- all: ['docs/mk-ca-bundle.1']
+- all: ['docs/libcurl/opts/CURLINFO_HTTPAUTH*']
+- all: ['docs/libcurl/opts/CURLINFO_PROXYAUTH*']
+- all: ['docs/libcurl/opts/CURLOPT_KRB*']
+- all: ['docs/libcurl/opts/CURLOPT_SASL*']
+- all: ['docs/libcurl/opts/CURLOPT_SERVICE_NAME*']
+- all: ['docs/libcurl/opts/CURLOPT_USERNAME*']
+- all: ['docs/libcurl/opts/CURLOPT_USERPWD*']
+- all: ['docs/libcurl/opts/CURLOPT_XOAUTH*']
+- all: ['lib/*gssapi*']
+- all: ['lib/*krb5*']
+- all: ['lib/*ntlm*']
+- all: ['lib/curl_sasl.*']
+- all: ['lib/http_aws*']
+- all: ['lib/http_digest.*']
+- all: ['lib/http_negotiate.*']
+- all: ['lib/vauth/**']
+- all: ['tests/server/fake_ntlm.c']

 build:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              **/CMakeLists.txt,\
-              **/Makefile.am,\
-              **/Makefile.inc,\
-              **/*.m4,\
-              **/*.mk,\
-              *.m4,\
-              docs/INSTALL-CMAKE.md,\
-              lib/curl_config.h.cmake,\
-              lib/libcurl*.in,\
-              CMake/**,\
-              CMakeLists.txt,\
-              configure.ac,\
-              m4/**,\
-              Makefile.*,\
-              packages/**,\
-              plan9/**,\
-              projects/**,\
-              winbuild/**,\
-              lib/libcurl.def,\
-              tests/cmake/**\
-              }"
+- all: ['**/CMakeLists.txt']
+- all: ['**/Makefile.am']
+- all: ['**/Makefile.inc']
+- all: ['**/Makefile.mk']
+- all: ['**/*.m4']
+- all: ['**/*.mk']
+- all: ['lib/libcurl*.in']
+- all: ['CMake/**']
+- all: ['configure.ac']
+- all: ['m4/**']
+- all: ['MacOSX-Framework']
+- all: ['packages/**']
+- all: ['plan9/**']
+- all: ['projects/**']
+- all: ['winbuild/**']

 CI:
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - '.circleci/**'
-              - '.github/**'
-              - 'appveyor.*'
-              - 'scripts/ci*'
-              - 'tests/azure.pm'
-              - 'tests/appveyor.pm'
-              - 'tests/CI.md'
+- any: ['.azure-pipelines.yml']
+- any: ['.circleci/**']
+- any: ['.cirrus.yml']
+- any: ['.github/**']
+- any: ['appveyor.yml']
+- any: ['tests/azure.pm']
+- any: ['tests/appveyor.pm']
+- any: ['tests/CI.pm']

 cmake:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              **/CMakeLists.txt,\
-              CMake/**,\
-              docs/INSTALL-CMAKE.md,\
-              lib/curl_config.h.cmake,\
-              tests/cmake/**\
-              }"
+- all: ['**/CMakeLists.txt']
+- all: ['CMake/**']

 cmdline tool:
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - 'docs/cmdline-opts/**'
-              - 'src/**'
+- any: ['docs/cmdline-opts/**']
+- any: ['src/**']

 connecting & proxies:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/internals/CONNECTION-FILTERS.md,\
-              docs/examples/ipv6.c,\
-              docs/libcurl/opts/CURLINFO_CONNECT*,\
-              docs/libcurl/opts/CURLINFO_PROXY*,\
-              docs/libcurl/opts/CURLOPT_ADDRESS*,\
-              docs/libcurl/opts/CURLOPT_CONNECT*,\
-              docs/libcurl/opts/CURLOPT_HAPROXY*,\
-              docs/libcurl/opts/CURLOPT_OPENSOCKET*,\
-              docs/libcurl/opts/CURLOPT_PRE_PROXY*,\
-              docs/libcurl/opts/CURLOPT_PROXY*,\
-              docs/libcurl/opts/CURLOPT_SOCKOPT*,\
-              docs/libcurl/opts/CURLOPT_SOCKS*,\
-              docs/libcurl/opts/CURLOPT_TCP*,\
-              docs/libcurl/opts/CURLOPT_TIMEOUT*,\
-              lib/cf-*proxy.*,\
-              lib/cf-socket.*,\
-              lib/cfilters.*,\
-              lib/conncache.*,\
-              lib/connect.*,\
-              lib/http_proxy.*,\
-              lib/if2ip.*,\
-              lib/noproxy.*,\
-              lib/socks.*,\
-              tests/server/socksd.c\
-              }"
+- all: ['docs/CONNECTION-FILTERS.md']
+- all: ['docs/libcurl/opts/CURLINFO_CONNECT*']
+- all: ['docs/libcurl/opts/CURLINFO_PROXY*']
+- all: ['docs/libcurl/opts/CURLOPT_ADDRESS*']
+- all: ['docs/libcurl/opts/CURLOPT_CONNECT*']
+- all: ['docs/libcurl/opts/CURLOPT_HAPROXY*']
+- all: ['docs/libcurl/opts/CURLOPT_OPENSOCKET*']
+- all: ['docs/libcurl/opts/CURLOPT_PRE_PROXY*']
+- all: ['docs/libcurl/opts/CURLOPT_PROXY*']
+- all: ['docs/libcurl/opts/CURLOPT_SOCKOPT*']
+- all: ['docs/libcurl/opts/CURLOPT_SOCKS*']
+- all: ['docs/libcurl/opts/CURLOPT_TCP*']
+- all: ['docs/libcurl/opts/CURLOPT_TIMEOUT*']
+- all: ['lib/cf-*proxy.*']
+- all: ['lib/cf-socket.*']
+- all: ['lib/cfilters.*']
+- all: ['lib/conncache.*']
+- all: ['lib/connect.*']
+- all: ['lib/http_proxy.*']
+- all: ['lib/if2ip.*']
+- all: ['lib/noproxy.*']
+- all: ['lib/socks.*']
+- all: ['tests/server/socksd.c']

 cookies:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/HTTP-COOKIES.md,\
-              docs/cmdline-opts/cookie*,\
-              docs/cmdline-opts/junk-session-cookies.md,\
-              docs/libcurl/opts/CURLINFO_COOKIE*,\
-              docs/libcurl/opts/CURLOPT_COOKIE*,\
-              docs/examples/cookie_interface.c,\
-              lib/cookie.*,\
-              lib/psl.*\
-              }"
+- all: ['docs/HTTP-COOKIES.md']
+- all: ['docs/libcurl/opts/CURLINFO_COOKIE*']
+- all: ['docs/libcurl/opts/CURLOPT_COOKIE*']
+- all: ['lib/cookie.*']
+- all: ['lib/psl.*']

 cryptography:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/CIPHERS.md,\
-              docs/RUSTLS.md,\
-              docs/libcurl/opts/CURLOPT_EGDSOCKET*,\
-              lib/*sha256*,\
-              lib/*sha512*,\
-              lib/curl_des.*,\
-              lib/curl_hmac.*,\
-              lib/curl_md?.*,\
-              lib/md?.*,\
-              lib/rand.*\
-              }"
+- all: ['docs/CIPHERS.md']
+- all: ['docs/RUSTLS.md']
+- all: ['docs/libcurl/opts/CURLOPT_EGDSOCKET*']
+- all: ['lib/*sha256*']
+- all: ['lib/curl_des.*']
+- all: ['lib/curl_hmac.*']
+- all: ['lib/curl_md?.*']
+- all: ['lib/md?.*']
+- all: ['lib/rand.*']

 DICT:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/dict.*,\
-              tests/dictserver.py\
-              }"
+- all: ['lib/dict.*']
+- all: ['tests/dictserver.py']

 documentation:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              .github/workflows/checkdocs.yml,\
-              .github/scripts/badwords.*,\
-              .github/scripts/cd2cd,\
-              .github/scripts/cd2nroff,\
-              .github/scripts/cdall.pl,\
-              .github/scripts/nroff2cd,\
-              .github/scripts/verify-examples.pl,\
-              .github/scripts/verify-synopsis.pl,\
-              **/*.md,\
-              **/*.txt,\
-              **/*.1,\
-              CHANGES.md,\
-              docs/**,\
-              LICENSES/**,\
-              README,\
-              RELEASE-NOTES,\
-              scripts/cd*\
-              }"
-          - all-globs-to-all-files:
-              # negative matches
-              - '!**/CMakeLists.txt'
-              - '!**/Makefile.am'
+- all: ['**/*.md']
+- all: ['**/*.txt', '!**/CMakeLists.txt']
+- all: ['**/*.1']
+- all: ['**/*.3']
+- all: ['CHANGES']
+- all: ['docs/**', '!docs/examples/**']
+- all: ['GIT-INFO']
+- all: ['LICENSES/**']
+- all: ['README']
+- all: ['RELEASE-NOTES']

 FTP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/opts/CURLINFO_FTP*,\
-              docs/libcurl/opts/CURLOPT_FTP*,\
-              docs/libcurl/opts/CURLOPT_WILDCARDMATCH*,\
-              docs/examples/ftp*,\
-              lib/curl_fnmatch.*,\
-              lib/curl_range.*,\
-              lib/ftp*,\
-              tests/ftp*\
-              }"
+- all: ['docs/libcurl/opts/CURLINFO_FTP*']
+- all: ['docs/libcurl/opts/CURLOPT_FTP*']
+- all: ['docs/libcurl/opts/CURLOPT_WILDCARDMATCH*']
+- all: ['lib/curl_fnmatch.*']
+- all: ['lib/curl_range.*']
+- all: ['lib/ftp*']
+- all: ['tests/ftp*']

 GOPHER:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/gopher*\
-              }"
+- all: ['lib/gopher*']

 HTTP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/hsts*,\
-              docs/examples/http-*,\
-              docs/examples/httpput*,\
-              docs/examples/https*,\
-              docs/examples/*post*,\
-              docs/HTTP-COOKIES.md,\
-              docs/libcurl/opts/CURLINFO_COOKIE*,\
-              docs/libcurl/opts/CURLOPT_COOKIE*,\
-              docs/libcurl/opts/CURLINFO_HTTP_**,\
-              docs/libcurl/opts/CURLINFO_REDIRECT*,\
-              docs/libcurl/opts/CURLINFO_REFER*,\
-              docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*,\
-              docs/libcurl/opts/CURLOPT_HSTS*,\
-              docs/libcurl/opts/CURLOPT_HTTP*,\
-              docs/libcurl/opts/CURLOPT_POST.*,\
-              docs/libcurl/opts/CURLOPT_POSTFIELD*,\
-              docs/libcurl/opts/CURLOPT_POSTREDIR*,\
-              docs/libcurl/opts/CURLOPT_REDIR*,\
-              docs/libcurl/opts/CURLOPT_REFER*,\
-              docs/libcurl/opts/CURLOPT_TRAILER*,\
-              docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*,\
-              lib/cf-https*,\
-              lib/cf-h1*,\
-              lib/cf-h2*,\
-              lib/cookie.*,\
-              lib/hsts.*,\
-              lib/http*,\
-              tests/http*,\
-              tests/http-server.pl,\
-              tests/http/*,\
-              tests/nghttp*\
-              }"
+- all: ['docs/HSTS.md']
+- all: ['docs/HTTP-COOKIES.md']
+- all: ['docs/libcurl/opts/CURLINFO_COOKIE*']
+- all: ['docs/libcurl/opts/CURLOPT_COOKIE*']
+- all: ['docs/libcurl/opts/CURLINFO_HTTP_**']
+- all: ['docs/libcurl/opts/CURLINFO_REDIRECT*']
+- all: ['docs/libcurl/opts/CURLINFO_REFER*']
+- all: ['docs/libcurl/opts/CURLOPT_FOLLOWLOCATION*']
+- all: ['docs/libcurl/opts/CURLOPT_HSTS*']
+- all: ['docs/libcurl/opts/CURLOPT_HTTP*']
+- all: ['docs/libcurl/opts/CURLOPT_POST.*']
+- all: ['docs/libcurl/opts/CURLOPT_POSTFIELD*']
+- all: ['docs/libcurl/opts/CURLOPT_POSTREDIR*']
+- all: ['docs/libcurl/opts/CURLOPT_REDIR*']
+- all: ['docs/libcurl/opts/CURLOPT_REFER*']
+- all: ['docs/libcurl/opts/CURLOPT_TRAILER*']
+- all: ['docs/libcurl/opts/CURLOPT_TRANSFER_ENCODING*']
+- all: ['lib/cf-https*']
+- all: ['lib/cf-h1*']
+- all: ['lib/cf-h2*']
+- all: ['lib/cookie.*']
+- all: ['lib/http*']
+- all: ['tests/http*']
+- all: ['tests/http-server.pl']
+- all: ['tests/http/*']
+- all: ['tests/nghttp*']
+- all: ['tests/tests-httpd/*']

 HTTP/2:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindNGHTTP2.cmake,\
-              CMake/FindQuiche.cmake,\
-              docs/libcurl/opts/CURLOPT_STREAM*,\
-              docs/examples/http2*,\
-              lib/http2*,\
-              tests/http2-server.pl\
-              }"
+- all: ['docs/HTTP2.md']
+- all: ['docs/libcurl/opts/CURLOPT_STREAM*']
+- all: ['lib/http2*']
+- all: ['tests/http2-server.pl']

 HTTP/3:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              .github/workflows/ngtcp2*,\
-              .github/workflows/quiche*,\
-              .github/workflows/osslq*,\
-              CMake/FindMSH3.cmake,\
-              CMake/FindNGHTTP3.cmake,\
-              CMake/FindNGTCP2.cmake,\
-              docs/HTTP3.md,\
-              docs/examples/http3*,\
-              lib/vquic/**,\
-              tests/http3-server.pl,\
-              tests/nghttpx.conf\
-              }"
+- all: ['.github/workflows/ngtcp2*']
+- all: ['.github/workflows/pytest.yml']
+- all: ['docs/HTTP3.md']
+- all: ['lib/vquic/**']
+- all: ['tests/http3-server.pl']
+- all: ['tests/nghttpx.conf']
+
+Hyper:
+- all: ['lib/c-hyper.*']

 IMAP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/imap*,\
-              docs/examples/imap*\
-              }"
+- all: ['lib/imap*']

 LDAP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/*ldap*\
-              }"
+- all: ['lib/*ldap*']

 libcurl API:
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - 'docs/libcurl/ABI.md'
-              - 'docs/libcurl/curl_*.md'
-              - 'include/curl/**'
-
-logging:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/cmdline-opts/trace*,\
-              docs/libcurl/curl_global_trace*,\
-              lib/curl_trc*,\
-              tests/http/test_15_tracing.py\
-              }"
+- all: ['docs/libcurl/ABI.md']
+- any: ['include/curl/**']

 MIME:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/curl_form*,\
-              docs/libcurl/curl_mime_*,\
-              docs/libcurl/opts/CURLOPT_MIME*,\
-              docs/libcurl/opts/CURLOPT_HTTPPOST*,\
-              lib/formdata*,\
-              lib/mime*,\
-              src/tool_formparse.*\
-              }"
+- all: ['docs/libcurl/curl_mime_*']
+- all: ['docs/libcurl/opts/CURLOPT_MIME*']
+- all: ['lib/mime*']

 MQTT:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/mqtt*,\
-              tests/server/mqttd.c\
-              }"
+- all: ['docs/MQTT.md']
+- all: ['lib/mqtt*']
+- all: ['tests/server/mqttd.c']

 name lookup:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/resolve.c,\
-              docs/libcurl/opts/CURLINFO_NAMELOOKUP*,\
-              docs/libcurl/opts/CURLOPT_DNS*,\
-              docs/libcurl/opts/CURLOPT_DOH*,\
-              docs/libcurl/opts/CURLOPT_RESOLVE*,\
-              lib/asyn*,\
-              lib/curl_gethostname.*,\
-              lib/doh*,\
-              lib/host*,\
-              lib/idn*,\
-              lib/inet_pton.*,\
-              lib/socketpair*,\
-              tests/server/resolve.c\
-              }"
+- all: ['docs/libcurl/opts/CURLINFO_NAMELOOKUP*']
+- all: ['docs/libcurl/opts/CURLOPT_DNS*']
+- all: ['docs/libcurl/opts/CURLOPT_DOH*']
+- all: ['docs/libcurl/opts/CURLOPT_RESOLVE*']
+- all: ['lib/asyn*']
+- all: ['lib/curl_gethostname.*']
+- all: ['lib/doh*']
+- all: ['lib/host*']
+- all: ['lib/idn*']
+- all: ['lib/inet_pton.*']
+- all: ['lib/socketpair*']
+- all: ['tests/server/resolve.c']

 POP3:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/pop3*,\
-              lib/pop3.*\
-              }"
+- all: ['lib/pop3.*']

 RTMP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindLibrtmp.cmake,\
-              lib/curl_rtmp.*\
-              }"
+- all: ['lib/curl_rtmp.*']

 RTSP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/opts/CURLINFO_RTSP*,\
-              docs/libcurl/opts/CURLOPT_RTSP*,\
-              lib/rtsp.*,\
-              tests/rtspserver.pl,\
-              tests/server/rtspd.c\
-              }"
+- all: ['docs/libcurl/opts/CURLINFO_RTSP*']
+- all: ['docs/libcurl/opts/CURLOPT_RTSP*']
+- all: ['lib/rtsp.*']
+- all: ['tests/rtspserver.pl']
+- all: ['tests/server/rtspd.c']

 SCP/SFTP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindLibssh2.cmake,\
-              docs/libcurl/opts/CURLOPT_SSH*,\
-              docs/examples/sftp*,\
-              lib/vssh/**,\
-              tests/sshhelp.pm,\
-              tests/sshserver.pl\
-              }"
+- all: ['docs/libcurl/opts/CURLOPT_SSH*']
+- all: ['lib/vssh/**']
+- all: ['tests/sshhelp.pm']
+- all: ['tests/sshserver.pl']

 script:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              **/*.pl,\
-              **/*.sh,\
-              curl-config.in,\
-              docs/curl-config.1,\
-              docs/mk-ca-bundle.1,\
-              docs/THANKS-filter,\
-              scripts/**\
-              }"
+- all: ['**/*.pl']
+- all: ['**/*.sh']
+- all: ['curl-config.in']
+- all: ['docs/curl-config.1']
+- all: ['docs/mk-ca-bundle.1']
+- all: ['docs/THANKS-filter']
+- all: ['scripts/**']

 SMB:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/smb.*,\
-              tests/smbserver.py\
-              }"
+- all: ['lib/smb.*']
+- all: ['tests/smbserver.py']

 SMTP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/examples/smtp-*,\
-              docs/libcurl/opts/CURLOPT_MAIL*,\
-              lib/smtp.*\
-              }"
+- all: ['docs/libcurl/opts/CURLOPT_MAIL*']
+- all: ['lib/smtp.*']

 tests:
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - 'tests/**'
+- any: ['tests/**']

 TFTP:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              lib/tftp.*,\
-              tests/tftpserver.pl,\
-              tests/server/tftp*\
-              }"
+- all: ['lib/tftp.*']
+- all: ['tests/tftpserver.pl']
+- all: ['tests/server/tftp*']

 TLS:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              CMake/FindBearSSL.cmake,\
-              CMake/FindMbedTLS.cmake,\
-              CMake/FindWolfSSL.cmake,\
-              CMake/FindRustls.cmake,\
-              docs/examples/ssl*,\
-              docs/examples/*ssl.*,\
-              docs/examples/*tls.*,\
-              docs/SSL*,\
-              docs/libcurl/curl_global_sslset*,\
-              docs/libcurl/opts/CURLINFO_CA*,\
-              docs/libcurl/opts/CURLINFO_CERT*,\
-              docs/libcurl/opts/CURLINFO_SSL*,\
-              docs/libcurl/opts/CURLINFO_TLS*,\
-              docs/libcurl/opts/CURLOPT_CA*,\
-              docs/libcurl/opts/CURLOPT_CERT*,\
-              docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*,\
-              docs/libcurl/opts/CURLOPT_SSL*,\
-              docs/libcurl/opts/CURLOPT_TLS*,\
-              docs/libcurl/opts/CURLOPT_USE_SSL*,\
-              lib/vtls/**,\
-              m4/curl-bearssl.m4,\
-              m4/curl-gnutls.m4,\
-              m4/curl-mbedtls.m4,\
-              m4/curl-openssl.m4,\
-              m4/curl-rustls.m4,\
-              m4/curl-schannel.m4,\
-              m4/curl-sectransp.m4,\
-              m4/curl-wolfssl.m4\
-              }"
+- all: ['docs/HYPER.md']
+- all: ['docs/SSL*']
+- all: ['docs/libcurl/opts/CURLINFO_CA*']
+- all: ['docs/libcurl/opts/CURLINFO_CERT*']
+- all: ['docs/libcurl/opts/CURLINFO_SSL*']
+- all: ['docs/libcurl/opts/CURLINFO_TLS*']
+- all: ['docs/libcurl/opts/CURLOPT_CA*']
+- all: ['docs/libcurl/opts/CURLOPT_CERT*']
+- all: ['docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY*']
+- all: ['docs/libcurl/opts/CURLOPT_SSL*']
+- all: ['docs/libcurl/opts/CURLOPT_TLS*']
+- all: ['docs/libcurl/opts/CURLOPT_USE_SSL*']
+- all: ['lib/vtls/**']

 URL:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/libcurl/curl_url*,\
-              docs/URL-SYNTAX.md,\
-              docs/examples/parseurl*,\
-              include/curl/urlapi.h,\
-              lib/urlapi*\
-              }"
+- all: ['docs/libcurl/curl_url*']
+- all: ['docs/URL-SYNTAX.md']
+- all: ['include/curl/urlapi.h']
+- all: ['lib/urlapi*']

 WebSocket:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              docs/internals/WEBSOCKET.md*,\
-              docs/examples/websocket*,\
-              docs/libcurl/curl_ws_*,\
-              docs/libcurl/libcurl-ws*,\
-              docs/libcurl/opts/CURLOPT_WS_*,\
-              include/curl/websockets.h,\
-              lib/ws.*,\
-              tests/http/clients/ws*,\
-              tests/http/test_20_websockets.py,\
-              tests/http/testenv/ws*\
-              }"
+- all: ['docs/WEBSOCKET.md*']
+- all: ['docs/libcurl/opts/CURLOPT_WS_*']
+- all: ['docs/libcurl/curl_ws_*']
+- all: ['include/curl/websockets.h']
+- all: ['lib/ws.*']

 Windows:
-  - all:
-      - changed-files:
-          - any-glob-to-all-files: "{\
-              appveyor.*,\
-              .github/workflows/windows.yml,\
-              CMake/win32-cache.cmake,\
-              lib/*win32*,\
-              lib/curl_multibyte.*,\
-              lib/rename.*,\
-              lib/vtls/schannel*,\
-              m4/curl-schannel.m4,\
-              projects/**,\
-              src/tool_doswin.c,\
-              winbuild/**,\
-              lib/libcurl.def\
-              }"
+- all: ['CMake/Platforms/WindowsCache.cmake']
+- all: ['lib/*win32*']
+- all: ['lib/curl_multibyte.*']
+- all: ['lib/rename.*']
+- all: ['lib/vtls/schannel*']
+- all: ['m4/curl-schannel.m4']
+- all: ['projects/**']
+- all: ['src/tool_doswin.c']
+- all: ['winbuild/**']
--- a/.github/scripts/badwords.pl
+++ b/.github/scripts/badwords.pl
@ -1,79 +0,0 @@
-#!/usr/bin/env perl
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# bad[:=]correct
-#
-# If separator is '=', the string will be compared case sensitively.
-# If separator is ':', the check is done case insensitively.
-#
-# To add white listed uses of bad words that are removed before checking for
-# the bad ones:
-#
-# ---(accepted word)
-#
-my $w;
-while(<STDIN>) {
-    chomp;
-    if($_ =~ /^#/) {
-        next;
-    }
-    if($_ =~ /^---(.*)/) {
-        push @whitelist, $1;
-    }
-    elsif($_ =~ /^([^:=]*)([:=])(.*)/) {
-        my ($bad, $sep, $better)=($1, $2, $3);
-        push @w, $bad;
-        $alt{$bad} = $better;
-        if($sep eq "=") {
-            $exactcase{$bad} = 1;
-        }
-    }
-}
-
-my $errors;
-
-sub file {
-    my ($f) = @_;
-    my $l = 0;
-    open(F, "<$f");
-    while(<F>) {
-        my $in = $_;
-        $l++;
-        chomp $in;
-        if($in =~ /^    /) {
-            next;
-        }
-        # remove the link part
-        $in =~ s/(\[.*\])\(.*\)/$1/g;
-        # remove backticked texts
-        $in =~ s/\`.*\`//g;
-        # remove whitelisted patterns
-        for my $p (@whitelist) {
-            $in =~ s/$p//g;
-        }
-        foreach my $w (@w) {
-            my $case = $exactcase{$w};
-            if(($in =~ /^(.*)$w/i && !$case) ||
-               ($in =~ /^(.*)$w/ && $case) ) {
-                my $p = $1;
-                my $c = length($p)+1;
-                print STDERR  "$f:$l:$c: error: found bad word \"$w\"\n";
-                printf STDERR " %4d | $in\n", $l;
-                printf STDERR "      | %*s^%s\n", length($p), " ",
-                    "~" x (length($w)-1);
-                printf STDERR " maybe use \"%s\" instead?\n", $alt{$w};
-                $errors++;
-            }
-        }
-    }
-    close(F);
-}
-
-my @files = @ARGV;
-
-foreach my $each (@files) {
-    file($each);
-}
-exit $errors;
--- a/.github/scripts/badwords.txt
+++ b/.github/scripts/badwords.txt
@ -1,73 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-back-end:backend
-e-mail:email
-run-time:runtime
-set-up:setup
-tool chain:toolchain
-tool-chain:toolchain
-wild-card:wildcard
-wild card:wildcard
-i'm:I am
-you've:You have
-we've:we have
-we're:we are
-we'll:we will
-we'd:we would
-they've:They have
-they're:They are
-they'll:They will
-they'd:They would
-you've:you have
-you'd:you would
-you'll:you will
-you're:you are
-should've:should have
-don't=do not
-could've:could have
-doesn't:does not
-isn't:is not
-aren't:are not
- a html: an html
- a http: an http
- a ftp: an ftp
- url =URL
-internet\b=Internet
-isation:ization
-\bit's:it is
-it'd:it would
-there's:there is
-[^.]\. And: Rewrite it somehow?
-^(And|So|But) = Rewrite it somehow?
-\. But: Rewrite it somehow?
-\. So : Rewrite without "so" ?
- dir :directory
-can't:cannot
-that's:that is
-web page:webpage
-host name\b:hostname
-host names\b:hostnames
-file name\b:filename
-file names\b:filenames
-\buser name\b:username
-\buser names\b:usernames
-\bpass phrase:passphrase
-didn't:did not
-doesn't:does not
-won't:will not
-couldn't:could not
-\bwill\b:rewrite to present tense
-\b32bit=32-bit
-\b64bit=64-bit
-32 bit\b=32-bit
-64 bit\b=64-bit
-64-bits:64 bits or 64-bit
-32-bits:32 bits or 32-bit
-\bvery\b:rephrase using an alternative word
-\bCurl\b=curl
-\bLibcurl\b=libcurl
---WWW::Curl
---NET::Curl
---Curl Corporation
--- a/.github/scripts/binarycheck.pl
+++ b/.github/scripts/binarycheck.pl
@ -1,115 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-# This scripts scans the entire git repository for binary files.
-#
-# All files in the git repo that contain signs of being binary are then
-# collected and a sha256sum is generated for all of them. That summary is then
-# compared to the list of pre-vetted files so that only the exact copies of
-# already scrutinized files are deemed okay to "appear binary".
-#
-
-use strict;
-use warnings;
-
-my $root = ".";
-my $sumsfile = ".github/scripts/binarycheck.sums";
-if($ARGV[0]) {
-    $root = $ARGV[0];
-}
-
-my @bin;
-my %known;
-my $error = 0;
-
-sub knownbins {
-    open(my $mh, "<", "$sumsfile") ||
-        die "can't read known binaries";
-    while(<$mh>) {
-        my $l = $_;
-        chomp $l;
-        if($l =~ /^([a-f0-9]+)  (.*)/) {
-            my ($sum, $file) = ($1, $2);
-            $known{$file} = 1;
-        }
-        elsif($l =~ /^#/) {
-            # skip comments
-        }
-        else {
-            print STDERR "suspicious line in $sumsfile\n";
-            $error++;
-        }
-    }
-    close($mh);
-}
-
-sub checkfile {
-    my ($file) = @_;
-    open(my $mh, "<", "$file") || die "can't read $file";
-    my $line = 0;
-    while(<$mh>) {
-        my $l = $_;
-        $line++;
-        if($l =~ /([\x00-\x08\x0b\x0c\x0e-\x1f\x7f])/) {
-            push @bin, $file;
-
-            if(!$known{$file}) {
-                printf STDERR "$file:$line has unknown binary contents\n";
-                $error++;
-            }
-            last;
-        }
-    }
-    close($mh);
-}
-
-my @files = `git ls-files -- $root`;
-
-if(scalar(@files) < 3000) {
-    # this means this is not the git source code repository or that git does
-    # not work, error out!
-    print STDERR "too few files in the git repository!\n";
-    exit 1;
-}
-
-knownbins();
-
-if(scalar(keys %known) < 10) {
-    print STDERR "too few known binaries in $sumsfile\n";
-    exit 2;
-}
-
-for my $f (@files) {
-    chomp $f;
-    checkfile("$root/$f");
-}
-
-my $check=system("sha256sum -c $sumsfile");
-if($check) {
-    print STDERR "sha256sum detected a problem\n";
-    $error++;
-}
-
-exit $error;
--- a/.github/scripts/binarycheck.sums
+++ b/.github/scripts/binarycheck.sums
@ -1,24 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-# SPDX-License-Identifier: curl
-339d83446859f914867398046270d40b6ca7538c0adfef45eb62c8a16abb6a51  ./tests/certs/EdelCurlRoot-ca.der
-c819fdeb4a6d27dde78895c2f3ed6467a31b332e72781e4ce6e11400bae9df3c  ./tests/certs/Server-localhost-firstSAN-sv.der
-f95d6b18fa02a0e2d98ed851cfa2f0b4b57d67fe8676ce4b1f78fc294ac22307  ./tests/certs/Server-localhost-firstSAN-sv.pub.der
-3520cdc749d32bbe93276be4d8f714e24b5b882284566966f28361f1cb8a4d1c  ./tests/certs/Server-localhost-lastSAN-sv.der
-d623be406f9c02b28b2f2a376b3d8e06ed25335b7cbf96cb2c8de9357a09250d  ./tests/certs/Server-localhost-lastSAN-sv.pub.der
-d89d7ea295af4baa5f57304c69570b4a71f2dd4f9fe06350ab50041287b6910a  ./tests/certs/Server-localhost-sv.der
-0005032e4e1cf7cc5c1540ef03d8bf32703d1ee3b4dc83e2d79afe0b1f4e5e77  ./tests/certs/Server-localhost-sv.pub.der
-5b22627a94c67159a18203ab5cd96b739188188cec61e73a444b2290e14d3d82  ./tests/certs/Server-localhost.nn-sv.der
-611cbce062c9c6924119d7498e19eacdee4326190e516cad9c212a4b4bb49930  ./tests/certs/Server-localhost.nn-sv.pub.der
-6eb66ef346068b4d9bbcc7c79244c48d3a4877f08618ff379b40ae02e067ba09  ./tests/certs/Server-localhost0h-sv.der
-b967734c9bfe3d7a1a7795f348f0bce4d9ba15ca9590697ef2d4d15b92822db0  ./tests/certs/Server-localhost0h-sv.pub.der
-6605cac758b09a954b12c2970c7d7a00f92658fc3ced250b281ae066e3ea6a73  ./tests/certs/stunnel-sv.der
-2e9634d7d8387fbffd1fe43e030746610b2fc088f627333a9b58e5cb224ad6ba  ./tests/certs/stunnel-sv.pub.der
-9e38c1fb0a151c4e23c8abddc44711c12afb3161c6b2a1c68e1bb2b0a4484e3b  ./tests/data/test1425
-26ee981dcb84b6a2adce601084b78e6b787b54a2a997549582a8bd42087ab51b  ./tests/data/test1426
-d640923e45809a3fe277e0af90459d82d32603aacc7b8db88754fcb335bf98df  ./tests/data/test1531
-6f51bc318104fb5fe4b6013fc4e8e1c3c8dec1819202e8ea025bdbc4bbc8c02d  ./tests/data/test1938
-33809cab2442488e5985b4939727bc4ead9fc65150f53008e3e4c93140675a94  ./tests/data/test262
-2d073a52984bab1f196d80464ea8ab6dafd887bd5fee9ed58603f8510df0c6a5  ./tests/data/test35
-4cc9fd6f31d0bb4dcb38e1565796e7ec5e48ea5ac9d3c1101de576be618786ba  ./tests/data/test463
-d655a29dcf2423b420b508c9e381b0fad0b88feb74caa8978725e22c9f7c374d  ./tests/data/test467
-8644ccf85e552755bf65faf2991d84f19523919379ec2cf195841a4cabe1507b  ./tests/data/test545
--- a/.github/scripts/cleancmd.pl
+++ b/.github/scripts/cleancmd.pl
@ -1,119 +0,0 @@
-#!/usr/bin/env perl
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Input: cmdline docs markdown files, they get modified *in place*
-#
-# Strip off the leading meta-data/header part, remove all known curl symbols
-# and long command line options. Also clean up whatever else the spell checker
-# might have a problem with that we still deem is fine.
-#
-
-open(S, "<./docs/libcurl/symbols-in-versions")
-    || die "can't find symbols-in-versions";
-while(<S>) {
-    if(/^([^ ]*) /) {
-        push @asyms, $1;
-    }
-}
-close(S);
-
-# init the opts table with "special" options not easy to figure out
-my @aopts = (
-    '--ftp-ssl-reqd', # old alias
-    );
-
-open(O, "<./docs/options-in-versions")
-    || die "can't find options-in-versions";
-while(<O>) {
-    chomp;
-    if(/^([^ ]+)/) {
-        my $o = $1;
-        push @aopts, $o;
-        if($o =~ /^--no-(.*)/) {
-            # for the --no options, also make one without it
-            push @aopts, "--$1";
-        }
-        elsif($o =~ /^--disable-(.*)/) {
-            # for the --disable options, also make the special ones
-            push @aopts, "--$1";
-            push @aopts, "--no-$1";
-        }
-    }
-}
-close(O);
-
-open(C, "<./.github/scripts/spellcheck.curl")
-    || die "can't find spellcheck.curl";
-while(<C>) {
-    if(/^\#/) {
-        next;
-    }
-    chomp;
-    if(/^([^ ]+)/) {
-        push @asyms, $1;
-    }
-}
-close(C);
-
-# longest symbols first
-my @syms = sort { length($b) <=> length($a) } @asyms;
-
-# longest cmdline options first
-my @opts = sort { length($b) <=> length($a) } @aopts;
-
-sub process {
-    my ($f) = @_;
-
-    my $ignore = 0;
-    my $sepcount = 0;
-    my $out;
-    my $line = 0;
-    open(F, "<$f") or die;
-
-    while(<F>) {
-        $line++;
-        if(/^---/ && ($line == 1)) {
-            $ignore = 1;
-            next;
-        }
-        elsif(/^---/ && $ignore) {
-            $ignore = 0;
-            next;
-        }
-        next if($ignore);
-
-        my $l = $_;
-
-        # strip out backticked words
-        $l =~ s/`[^`]+`//g;
-
-        # **bold**
-        $l =~ s/\*\*(\S.*?)\*\*//g;
-        # *italics*
-        $l =~ s/\*(\S.*?)\*//g;
-
-        # strip out https URLs, we don't want them spellchecked
-        $l =~ s!https://[a-z0-9\#_/.-]+!!gi;
-
-        $out .= $l;
-    }
-    close(F);
-
-    # cut out all known curl cmdline options
-    map { $out =~ s/$_//g; } (@opts);
-
-    # cut out all known curl symbols
-    map { $out =~ s/\b$_\b//g; } (@syms);
-
-    if(!$ignore) {
-        open(O, ">$f") or die;
-        print O $out;
-        close(O);
-    }
-}
-
-for my $f (@ARGV) {
-    process($f);
-}
--- a/.github/scripts/cleanspell.pl
+++ b/.github/scripts/cleanspell.pl
@ -0,0 +1,80 @@
+#!/usr/bin/perl
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+#
+# Input: a libcurl nroff man page
+# Output: the same file, minus the SYNOPSIS and the EXAMPLE sections
+#
+
+my $f = $ARGV[0];
+my $o = $ARGV[1];
+
+open(F, "<$f") or die;
+open(O, ">$o") or die;
+
+my $ignore = 0;
+while(<F>) {
+    if($_ =~ /^.SH (SYNOPSIS|EXAMPLE|\"SEE ALSO\"|SEE ALSO)/) {
+        $ignore = 1;
+    }
+    elsif($ignore && ($_ =~ /^.SH/)) {
+        $ignore = 0;
+    }
+    elsif(!$ignore) {
+        # filter out mentioned CURLE_ names
+        $_ =~ s/CURL(M|SH|U|H)code//g;
+        $_ =~ s/CURL_(READ|WRITE)FUNC_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_CSELECT_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_DISABLE_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_FORMADD_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_HET_DEFAULT//g;
+        $_ =~ s/CURL_IPRESOLVE_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_PROGRESSFUNC_CONTINUE//g;
+        $_ =~ s/CURL_REDIR_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_RTSPREQ_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_TIMECOND_[A-Z0-9_]*//g;
+        $_ =~ s/CURL_VERSION_[A-Z0-9_]*//g;
+        $_ =~ s/CURLALTSVC_[A-Z0-9_]*//g;
+        $_ =~ s/CURLAUTH_[A-Z0-9_]*//g;
+        $_ =~ s/CURLE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFORM_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTP_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTPAUTH_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTPMETHOD_[A-Z0-9_]*//g;
+        $_ =~ s/CURLFTPSSL_[A-Z0-9_]*//g;
+        $_ =~ s/CURLGSSAPI_[A-Z0-9_]*//g;
+        $_ =~ s/CURLHEADER_[A-Z0-9_]*//g;
+        $_ =~ s/CURLINFO_[A-Z0-9_]*//g;
+        $_ =~ s/CURLM_[A-Z0-9_]*//g;
+        $_ =~ s/CURLMIMEOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLMOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPIPE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPROTO_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPROXY_[A-Z0-9_]*//g;
+        $_ =~ s/CURLPX_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSHE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSHOPT_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSSH_[A-Z0-9_]*//g;
+        $_ =~ s/CURLSSLBACKEND_[A-Z0-9_]*//g;
+        $_ =~ s/CURLU_[A-Z0-9_]*//g;
+        $_ =~ s/CURLUE_[A-Z0-9_]*//g;
+        $_ =~ s/CURLUPART_[A-Z0-9_]*//g;
+        $_ =~ s/CURLUSESSL_[A-Z0-9_]*//g;
+        $_ =~ s/curl_global_(init_mem|sslset|cleanup)//g;
+        $_ =~ s/curl_(strequal|strnequal|formadd|waitfd|formget|getdate|formfree)//g;
+        $_ =~ s/curl_easy_(nextheader|duphandle)//g;
+        $_ =~ s/curl_multi_fdset//g;
+        $_ =~ s/curl_mime_(subparts|addpart|filedata|data_cb)//g;
+        $_ =~ s/curl_ws_(send|recv|meta)//g;
+        $_ =~ s/curl_url_(dup)//g;
+        $_ =~ s/curl_pushheader_by(name|num)//g;
+        $_ =~ s/libcurl-(env|ws)//g;
+        $_ =~ s/(^|\W)((tftp|https|http|ftp):\/\/[a-z0-9\-._~%:\/?\#\[\]\@!\$&'()*+,;=]+)//gi;
+        print O $_;
+    }
+}
+close(F);
+close(O);
+
--- a/.github/scripts/cmp-config.pl
+++ b/.github/scripts/cmp-config.pl
@ -1,136 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-my $autotools = $ARGV[0];
-my $cmake = $ARGV[1];
-
-if(!$cmake) {
-    print "Usage: cmp-config <config1> <config2.h>\n";
-    exit;
-}
-
-# this lists complete lines that will be removed from the output if
-# matching
-my %remove = (
-    '#define CURL_EXTERN_SYMBOL' => 1,
-    '#define CURL_OS "Linux"' => 1,
-    '#define CURL_OS "x86_64-pc-linux-gnu"' => 1,
-    '#define GETHOSTNAME_TYPE_ARG2 int' => 1,
-    '#define GETHOSTNAME_TYPE_ARG2 size_t' => 1,
-    '#define HAVE_BROTLI 1' => 1,
-    '#define HAVE_BROTLI_DECODE_H 1' => 1,
-    '#define HAVE_DLFCN_H 1' => 1,
-    '#define HAVE_GSSAPI_GSSAPI_KRB5_H 1' => 1,
-    '#define HAVE_INTTYPES_H 1' => 1,
-    '#define HAVE_LDAP_H 1' => 1,
-    '#define HAVE_LDAP_SSL 1' => 1,
-    '#define HAVE_LIBBROTLIDEC 1' => 1,
-    '#define HAVE_LIBPSL_H 1' => 1,
-    '#define HAVE_LIBRTMP_RTMP_H 1' => 1,
-    '#define HAVE_LIBSOCKET 1' => 1,
-    '#define HAVE_LIBSSH' => 1,
-    '#define HAVE_LIBSSH2 1' => 1,
-    '#define HAVE_LIBSSL 1' => 1,
-    '#define HAVE_LIBWOLFSSH' => 1,
-    '#define HAVE_LIBZSTD 1' => 1,
-    '#define HAVE_MSH3_H 1' => 1,
-    '#define HAVE_NGHTTP2_NGHTTP2_H 1' => 1,
-    '#define HAVE_NGHTTP3_NGHTTP3_H 1' => 1,
-    '#define HAVE_NGTCP2_NGTCP2_CRYPTO_H 1' => 1,
-    '#define HAVE_NGTCP2_NGTCP2_H 1' => 1,
-    '#define HAVE_OPENSSL_CRYPTO_H 1' => 1,
-    '#define HAVE_OPENSSL_ERR_H 1' => 1,
-    '#define HAVE_OPENSSL_PEM_H 1' => 1,
-    '#define HAVE_OPENSSL_RSA_H 1' => 1,
-    '#define HAVE_OPENSSL_SSL_H 1' => 1,
-    '#define HAVE_OPENSSL_X509_H 1' => 1,
-    '#define HAVE_QUICHE_H 1' => 1,
-    '#define HAVE_SSL_SET_QUIC_USE_LEGACY_CODEPOINT 1' => 1,
-    '#define HAVE_STDINT_H 1' => 1,
-    '#define HAVE_STDIO_H 1' => 1,
-    '#define HAVE_STDLIB_H 1' => 1,
-    '#define HAVE_STRING_H 1' => 1,
-    '#define HAVE_SYS_XATTR_H 1' => 1,
-    '#define HAVE_UNICODE_UIDNA_H 1' => 1,
-    '#define HAVE_WOLFSSH_SSH_H 1' => 1,
-    '#define HAVE_ZSTD 1' => 1,
-    '#define HAVE_ZSTD_H 1' => 1,
-    '#define LT_OBJDIR ".libs/"' => 1,
-    '#define NEED_LBER_H 1' => 1,
-    '#define PACKAGE "curl"' => 1,
-    '#define PACKAGE_BUGREPORT "a suitable curl mailing list: https://curl.se/mail/"' => 1,
-    '#define PACKAGE_NAME "curl"' => 1,
-    '#define PACKAGE_STRING "curl -"' => 1,
-    '#define PACKAGE_TARNAME "curl"' => 1,
-    '#define PACKAGE_URL ""' => 1,
-    '#define PACKAGE_VERSION "-"' => 1,
-    '#define SIZEOF_LONG_LONG 8' => 1,
-    '#define VERSION "-"' => 1,
-    '#define _FILE_OFFSET_BITS 64' => 1,
-    );
-
-sub filter {
-    my ($line) = @_;
-    if(!$remove{$line}) {
-        return "$line\n";
-    }
-    $remove{$line}++;
-    return "";
-}
-
-sub grepit {
-    my ($input, $output) = @_;
-    my @defines;
-    # first get all the #define lines
-    open(F, "<$input");
-    while(<F>) {
-        if($_ =~ /^#def/) {
-            chomp;
-            push @defines, $_;
-        }
-    }
-    close(F);
-
-    open(O, ">$output");
-
-    # output the sorted list through the filter
-    foreach my $d(sort @defines) {
-        print O filter($d);
-    }
-    close(O);
-}
-
-grepit($autotools, "/tmp/autotools");
-grepit($cmake, "/tmp/cmake");
-
-foreach my $v (keys %remove) {
-    if($remove{$v} == 1) {
-        print "Ignored, never matched line: $v\n";
-    }
-}
-
-
-# return the exit code from diff
-exit system("diff -u /tmp/autotools /tmp/cmake") >> 8;
--- a/.github/scripts/cmp-pkg-config.sh
+++ b/.github/scripts/cmp-pkg-config.sh
@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-# Sort list of libs, libpaths, cflags found in libcurl.pc and curl-config files,
-# then diff the autotools and cmake generated ones.
-
-sort_lists() {
-  prevline=''
-  section=''
-  while IFS= read -r l; do
-    if [[ "${prevline}" =~ (--cc|--configure) ]]; then  # curl-config
-      echo "<IGNORED>"
-    else
-      # libcurl.pc
-      if [[ "${l}" =~ ^(Requires|Libs|Cflags)(\.private)?:\ (.+)$ ]]; then
-        if [ "${BASH_REMATCH[1]}" = 'Requires' ]; then
-          # Spec does not allow duplicates here:
-          # https://manpages.debian.org/unstable/pkg-config/pkg-config.1.en.html#Requires:
-          # "You may only mention the same package one time on the Requires: line"
-          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ',' '\n' | sort | tr '\n' ' ')"
-        else
-          val="$(printf '%s' "${BASH_REMATCH[3]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
-        fi
-        l="${BASH_REMATCH[1]}${BASH_REMATCH[2]}: ${val}"
-      # curl-config
-      elif [[ "${section}" =~ (--libs|--static-libs) && "${l}" =~ ^( *echo\ \")(.+)(\")$ ]]; then
-        val="$(printf '%s' "${BASH_REMATCH[2]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
-        l="${BASH_REMATCH[1]}${val}${BASH_REMATCH[3]}"
-        section=''
-      fi
-      echo "${l}"
-    fi
-    # curl-config
-    prevline="${l}"
-    if [[ "${l}" =~ --[a-z-]+\) ]]; then
-      section="${BASH_REMATCH[0]}"
-    fi
-  done < "$1"
-}
-
-am=$(mktemp -t autotools.XXX); sort_lists "$1" > "${am}"
-cm=$(mktemp -t cmake.XXX)    ; sort_lists "$2" > "${cm}"
-diff -u "${am}" "${cm}"
-res="$?"
-rm -r -f "${am}" "${cm}"
-
-exit "${res}"
--- a/.github/scripts/codespell-ignore.txt
+++ b/.github/scripts/codespell-ignore.txt
@ -1,16 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-clen
-te
-wont
-statics
-nome
-wast
-numer
-anull
-inout
-msdos
-ba
-fo
-ede
--- a/.github/scripts/distfiles.sh
+++ b/.github/scripts/distfiles.sh
@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-# Compare git repo files with tarball files and report a mismatch
-# after excluding exceptions.
-
-set -eu
-
-gitonly=".git*
-^.*
-^appveyor.*
-^buildconf
-^GIT-INFO.md
-^README.md
-^renovate.json
-^REUSE.toml
-^SECURITY.md
-^LICENSES/*
-^docs/examples/adddocsref.pl
-^docs/THANKS-filter
-^projects/Windows/*
-^scripts/ciconfig.pl
-^scripts/cijobs.pl
-^scripts/contributors.sh
-^scripts/contrithanks.sh
-^scripts/delta
-^scripts/installcheck.sh
-^scripts/release-notes.pl
-^scripts/singleuse.pl
-^tests/CI.md"
-
-tarfiles="$(mktemp)"
-gitfiles="$(mktemp)"
-
-tar -tf "$1" \
-  | sed -E 's|^[^/]+/||g' \
-  | grep -v -E '(/|^)$' \
-  | sort > "${tarfiles}"
-
-git -C "${2:-.}" ls-files \
-  | grep -v -E "($(printf '%s' "${gitonly}" | tr $'\n' '|' | sed -e 's|\.|\\.|g' -e 's|\*|.+|g'))$" \
-  | sort > "${gitfiles}"
-
-dif="$(diff -u "${tarfiles}" "${gitfiles}" | tail -n +3 || true)"
-
-rm -rf "${tarfiles:?}" "${gitfiles:?}"
-
-echo 'Only in tarball:'
-echo "${dif}" | grep '^-' || true
-echo
-
-echo 'Missing from tarball:'
-if echo "${dif}" | grep '^+'; then
-  exit 1
-fi
--- a/.github/scripts/shellcheck.sh
+++ b/.github/scripts/shellcheck.sh
@ -1,10 +0,0 @@
-#!/bin/sh
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-shellcheck --version
-# shellcheck disable=SC2046
-shellcheck --exclude=1091 \
-  --enable=avoid-nullary-conditions,deprecate-which \
-  $(grep -l -E '^#!(/usr/bin/env bash|/bin/sh|/bin/bash)' $(git ls-files))
--- a/.github/scripts/spacecheck.pl
+++ b/.github/scripts/spacecheck.pl
@ -1,153 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Viktor Szakats
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-use strict;
-use warnings;
-
-my @tabs = (
-    "^m4/zz40-xc-ovr.m4",
-    "Makefile\\.[a-z]+\$",
-    "/mkfile",
-    "\\.(bat|sln|vc)\$",
-    "^tests/certs/.+\\.der\$",
-    "^tests/data/test",
-);
-
-my @mixed_eol = (
-    "^tests/certs/.+\\.(crt|der)\$",
-    "^tests/certs/Server-localhost0h-sv.pem",
-    "^tests/data/test",
-);
-
-my @need_crlf = (
-    "\\.(bat|sln)\$",
-    "^winbuild/.+\\.md\$",
-);
-
-my @space_at_eol = (
-    "^tests/.+\\.(cacert|crt|pem)\$",
-    "^tests/data/test",
-);
-
-my @eol_at_eof = (
-    "^tests/certs/.+\\.der\$",
-);
-
-sub fn_match {
-    my ($filename, @masklist) = @_;
-
-    foreach my $mask (@masklist) {
-        if ($filename =~ $mask) {
-            return 1;
-        }
-    }
-    return 0;
-}
-
-sub eol_detect {
-    my ($content) = @_;
-
-    my $cr = () = $content =~ /\r/g;
-    my $lf = () = $content =~ /\n/g;
-
-    if ($cr > 0 && $lf == 0) {
-        return "cr"
-    }
-    elsif ($cr == 0 && $lf > 0) {
-        return "lf"
-    }
-    elsif ($cr == 0 && $lf == 0) {
-        return "bin"
-    }
-    elsif ($cr == $lf) {
-        return "crlf"
-    }
-
-    return ""
-}
-
-my $issues = 0;
-
-open my $git_ls_files, '-|', 'git ls-files' or die "Failed running git ls-files: $!";
-while (my $filename = <$git_ls_files>) {
-    chomp $filename;
-
-    open my $fh, '<', $filename or die "Cannot open '$filename': $!";
-    my $content = do { local $/; <$fh> };
-    close $fh;
-
-    my @err = ();
-
-    if (!fn_match($filename, @tabs) &&
-        $content =~ /\t/) {
-        push @err, "content: has tab";
-    }
-
-    my $eol = eol_detect($content);
-
-    if ($eol eq "" &&
-        !fn_match($filename, @mixed_eol)) {
-        push @err, "content: has mixed EOL types";
-    }
-
-    if ($eol ne "crlf" &&
-        fn_match($filename, @need_crlf)) {
-        push @err, "content: must use CRLF EOL for this file type";
-    }
-
-    if ($eol ne "lf" && $content ne "" &&
-        !fn_match($filename, @need_crlf) &&
-        !fn_match($filename, @mixed_eol)) {
-        push @err, "content: must use LF EOL for this file type";
-    }
-
-    if (!fn_match($filename, @space_at_eol) &&
-        $content =~ /[ \t]\n/) {
-        push @err, "content: has line-ending whitespace";
-    }
-
-    if ($content ne "" &&
-        !fn_match($filename, @eol_at_eof) &&
-        $content !~ /\n\z/) {
-        push @err, "content: has no EOL at EOF";
-    }
-
-    if ($content =~ /\n\n\z/ ||
-        $content =~ /\r\n\r\n\z/) {
-        push @err, "content: has multiple EOL at EOF";
-    }
-
-    if (@err) {
-        $issues++;
-        foreach my $err (@err) {
-            print "$filename: $err\n";
-        }
-    }
-}
-close $git_ls_files;
-
-if ($issues) {
-    exit 1;
-}
--- a/.github/scripts/spellcheck.curl
+++ b/.github/scripts/spellcheck.curl
@ -1,151 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# common variable types + structs
-# callback typedefs
-# public functions names
-# some man page names
-curl_fileinfo
-curl_forms
-curl_hstsentry
-curl_httppost
-curl_index
-curl_khkey
-curl_pushheaders
-curl_waitfd
-CURLcode
-CURLformoption
-CURLHcode
-CURLMcode
-CURLMsg
-CURLSHcode
-CURLUcode
-curl_calloc_callback
-curl_chunk_bgn_callback
-curl_chunk_end_callback
-curl_conv_callback
-curl_debug_callback
-curl_fnmatch_callback
-curl_formget_callback
-curl_free_callback
-curl_hstsread_callback
-curl_hstswrite_callback
-curl_ioctl_callback
-curl_malloc_callback
-curl_multi_timer_callback
-curl_opensocket_callback
-curl_prereq_callback
-curl_progress_callback
-curl_push_callback
-curl_read_callback
-curl_realloc_callback
-curl_resolver_start_callback
-curl_seek_callback
-curl_socket_callback
-curl_sockopt_callback
-curl_ssl_ctx_callback
-curl_strdup_callback
-curl_trailer_callback
-curl_write_callback
-curl_xferinfo_callback
-curl_strequal
-curl_strnequal
-curl_mime_init
-curl_mime_free
-curl_mime_addpart
-curl_mime_name
-curl_mime_filename
-curl_mime_type
-curl_mime_encoder
-curl_mime_data
-curl_mime_filedata
-curl_mime_data_cb
-curl_mime_subparts
-curl_mime_headers
-curl_formadd
-curl_formget
-curl_formfree
-curl_getdate
-curl_getenv
-curl_version
-curl_easy_escape
-curl_escape
-curl_easy_unescape
-curl_unescape
-curl_free
-curl_global_init
-curl_global_init_mem
-curl_global_cleanup
-curl_global_trace
-curl_global_sslset
-curl_slist_append
-curl_slist_free_all
-curl_getdate
-curl_share_init
-curl_share_setopt
-curl_share_cleanup
-curl_version_info
-curl_easy_strerror
-curl_share_strerror
-curl_easy_pause
-curl_easy_ssls_import
-curl_easy_ssls_export
-curl_easy_init
-curl_easy_setopt
-curl_easy_perform
-curl_easy_cleanup
-curl_easy_getinfo
-curl_easy_duphandle
-curl_easy_reset
-curl_easy_recv
-curl_easy_send
-curl_easy_upkeep
-curl_easy_header
-curl_easy_nextheader
-curl_mprintf
-curl_mfprintf
-curl_msprintf
-curl_msnprintf
-curl_mvprintf
-curl_mvfprintf
-curl_mvsprintf
-curl_mvsnprintf
-curl_maprintf
-curl_mvaprintf
-curl_multi_init
-curl_multi_add_handle
-curl_multi_remove_handle
-curl_multi_fdset
-curl_multi_waitfds
-curl_multi_wait
-curl_multi_poll
-curl_multi_wakeup
-curl_multi_perform
-curl_multi_cleanup
-curl_multi_info_read
-curl_multi_strerror
-curl_multi_socket
-curl_multi_socket_action
-curl_multi_socket_all
-curl_multi_timeout
-curl_multi_setopt
-curl_multi_assign
-curl_multi_get_handles
-curl_pushheader_bynum
-curl_pushheader_byname
-curl_multi_waitfds
-curl_easy_option_by_name
-curl_easy_option_by_id
-curl_easy_option_next
-curl_url
-curl_url_cleanup
-curl_url_dup
-curl_url_get
-curl_url_set
-curl_url_strerror
-curl_ws_recv
-curl_ws_send
-curl_ws_meta
-libcurl-env
-libcurl-ws
--- a/.github/scripts/spellcheck.words
+++ b/.github/scripts/spellcheck.words
@ -2,7 +2,6 @@
 #
 # SPDX-License-Identifier: curl
 #
-AAAA
 ABI
 accessor
 ACK
@ -11,12 +10,10 @@ AIA
 AIX
 al
 Alessandro
-aliasMode
 allocator
 alnum
 ALPN
 Altera
-AltSvc
 ALTSVC
 amiga
 AmigaOS
@ -33,6 +30,7 @@ archivers
 Archos
 Arntsen
 Aros
+ascii
 asynch
 AsynchDNS
 atime
@ -40,10 +38,7 @@ auth
 autobuild
 autobuilds
 Autoconf
-autoconf
 Automake
-automake
-autoreconf
 Autotools
 autotools
 AVR
@ -54,7 +49,6 @@ backend
 backends
 backoff
 backticks
-balancers
 Baratov
 basename
 bashrc
@ -69,6 +63,7 @@ Bjørn
 bool
 boolean
 BoringSSL
+boringssl
 Boukris
 Broadcom
 brotli
@ -78,15 +73,14 @@ bugfix
 bugfixes
 buildable
 buildbot
+buildconf
 Caddy
 calloc
 CAPA
-capath
 CCC
 CDN
 CentOS
 CFLAGS
-cflags
 CGI's
 CHACHA
 chacha
@ -109,23 +103,18 @@ CLA
 CLAs
 cleartext
 CLI
-ClientHello
 clientp
 cliget
 closesocket
 CMake
 cmake
-CMake's
 cmake's
 CMakeLists
-CNA
-CNAME
-CNAMEs
+CodeQL
+codeql
 CODESET
 codeset
-CodeSonar
 Comcast
-commit's
 Config
 config
 conncache
@ -136,7 +125,6 @@ CPUs
 CR
 CRL
 CRLF
-crontab
 crt
 crypto
 cryptographic
@ -148,12 +136,9 @@ cshrc
 CTRL
 cURL
 CURLcode
-curldown
 CURLE
-CURLECH
 CURLH
 curlimages
-CURLINFO
 curlrc
 curltest
 customizable
@ -165,19 +150,11 @@ cyassl
 Cygwin
 daniel
 datatracker
-dbg
-Debian
-DEBUGBUILD
 decrypt
-decrypting
 deepcode
 DELE
 DER
-dereference
-dereferences
 deselectable
-deserialization
-Deserialized
 destructor
 detections
 dev
@ -198,7 +175,6 @@ DNS
 dns
 dnsop
 DoH
-DoT
 doxygen
 drftpd
 dsa
@ -210,13 +186,7 @@ EBCDIC
 ECC
 ECDHE
 ECH
-ECHConfig
-ECHConfigList
-ecl
-ECONNREFUSED
 eCOS
-ECT
-EF
 EFnet
 EGD
 EHLO
@ -246,15 +216,12 @@ Falkeborn
 Fandrich
 Fastly
 fcpp
-Fedora
 Feltzing
 ffi
 filesize
 filesystem
-FindCURL
 FLOSS
 fnmatch
-footguns
 formpost
 formposts
 Fortnite
@ -276,7 +243,6 @@ gcc
 GCM
 gdb
 Genode
-Gentoo
 Gergely
 getaddrinfo
 getenv
@ -290,27 +256,23 @@ ggcov
 Ghedini
 Gisle
 Glesys
-globbed
 globbing
 gmail
 GnuTLS
+gnutls
 Golemon
 GOST
 GPG
 GPL
 GPLed
-GREASE
-GREASEing
 Greear
 groff
-gsasl
 GSKit
 gskit
 GSS
 GSSAPI
 GTFO
 Guenter
-GUIs
 Gunderson
 Gustafsson
 gzip
@ -324,7 +286,6 @@ Hards
 Haxx
 haxx
 Heimdal
-HelloRetryRequest
 HELO
 HH
 HMAC
@ -334,21 +295,19 @@ homebrew
 hostname
 hostnames
 Housley
-HRR
 Hruska
 HSTS
 hsts
 HTC
 html
 http
-HTTPAUTH
 httpd
 HTTPD
+HTTPAUTH
 httpget
 HttpGet
 HTTPS
 https
-HTTPSRR
 hyper's
 Högskolan
 IANA
@ -363,10 +322,8 @@ ifdef
 ifdefed
 Ifdefs
 ifdefs
-ifhost
-IIS
 ILE
-illumos
+Illumos
 IMAP
 imap
 IMAPS
@ -375,15 +332,11 @@ impacket
 init
 initializer
 inlined
-interop
 interoperable
 interoperates
 IoT
 ipadOS
 IPCXN
-IPFS
-ipld
-IPNS
 IPv
 IPv4
 IPv4/6
@ -408,7 +361,6 @@ keepalive
 Keil
 kerberos
 Keychain
-keychain
 KiB
 kickstart
 Kirei
@ -442,27 +394,25 @@ libpsl
 Libre
 libre
 LibreSSL
+libressl
 librtmp
 libs
 libssh
+libSSH
 libssh2
 Libtool
-libtool
 libuv
 libWebSocket
 libz
 libzstd
 LineageOS
 linux
-lldb
 ln
 localhost
 LOGDIR
 logfile
 lookups
 loopback
-LOWCOST
-LOWDELAY
 LPRT
 LSB
 lseek
@ -475,14 +425,11 @@ Makefile
 makefiles
 malloc
 mallocs
-manpage
-manpages
 maprintf
 Marek
 Mavrogiannopoulos
 Mbed
 mbedTLS
-md
 Meglio
 memdebug
 MesaLink
@ -493,8 +440,6 @@ Michal
 Micrium
 MicroBlaze
 MicroOS
-middlebox
-MINCOST
 mingw
 MinGW
 MINIX
@ -511,7 +456,6 @@ MorphOS
 MPE
 MPL
 mprintf
-MPTCP
 MQTT
 mqtt
 mqtts
@ -531,7 +475,6 @@ mTLS
 MUA
 multicwd
 multiparts
-multipath
 MultiSSL
 mumbo
 musedev
@ -554,7 +497,6 @@ NEC
 Necko
 NetBSD
 netrc
-netstat
 Netware
 NFS
 nghttp
@ -600,7 +542,6 @@ Orbis
 ORing
 Osipov
 OSS
-PaaS
 pac
 pacman
 parser's
@ -614,11 +555,9 @@ permafailing
 PINGs
 pipelining
 PKCS
-pkcs
 PKGBUILD
 PKI
 pluggable
-pn
 PolarSSL
 Polhem
 pollset
@ -649,12 +588,10 @@ PTR
 ptr
 punycode
 PWD
-pwd
 py
 pycurl
 pytest
 Pytest
-qname
 QNX
 QoS
 Qubes
@ -668,8 +605,6 @@ RBS
 ReactOS
 README
 realloc
-Realtime
-rebalances
 rebase
 RECV
 recv
@ -686,11 +621,10 @@ Relatedly
 repo
 reprioritized
 resending
-resends
 RETR
 retransmit
 retrigger
-RHEL
+RICS
 Rikard
 rmdir
 ROADMAP
@ -698,13 +632,9 @@ Roadmap
 Rockbox
 roffit
 RPG
-RR
-RRs
-RRtype
 RSA
 RTMP
 rtmp
-rtmpdump
 RTMPE
 RTMPS
 RTMPT
@ -719,7 +649,6 @@ runtests
 runtime
 Ruslan
 rustc
-Rustls
 rustls
 Sagula
 SanDisk
@ -772,7 +701,6 @@ SOCKSv
 Solaris
 SONAME
 Soref
-SOVERSION
 SPARC
 SPDX
 SPNEGO
@ -785,7 +713,6 @@ SSL
 ssl
 SSLeay
 SSLKEYLOGFILE
-SSLS
 sslv
 SSLv
 SSLVERSION
@ -800,7 +727,6 @@ stdin
 stdout
 Steinar
 Stenberg
-STLS
 STOR
 strcat
 strcpy
@ -822,7 +748,6 @@ SunSSH
 superset
 svc
 svcb
-SVCB
 Svyatoslav
 Swisscom
 sws
@ -838,10 +763,8 @@ TCP
 tcpdump
 Tekniska
 testability
-testcurl
 TFTP
 tftp
-threadsafe
 Tizen
 TLS
 tlsv
@ -852,13 +775,9 @@ toolchain
 toolchains
 toolset
 toplevel
-TOS
 TPF
 TrackMemory
-transcode
 Tru
-trurl
-trustless
 Tse
 Tsujikawa
 TTL
@ -866,7 +785,6 @@ tvOS
 txt
 typedef
 typedefed
-Ubuntu
 ucLinux
 UDP
 UI
@ -875,14 +793,11 @@ UIDL
 Ultrix
 Unary
 unassign
-UNC
 uncompress
-unencoded
 unencrypted
 unescape
-Unglobbed
-Unicode
 UNICOS
+unix
 UnixSockets
 UnixWare
 unlink
@ -894,7 +809,6 @@ unsanitized
 Unshare
 unsharing
 untrusted
-unwrite
 UPN
 upstreaming
 URI
@ -907,7 +821,6 @@ USD
 userdata
 Userinfo
 userinfo
-USERPROFILE
 UTF
 UX
 valgrind
@ -917,16 +830,10 @@ VC
 vcpkg
 vexxhost
 Viktor
-Virtuozzo
-VLAN
 VM
 VMS
 VMware
-vnd
-VRF
-VRFY
 VSE
-vsftpd
 vsprintf
 vt
 vtls
@ -936,30 +843,30 @@ Warta
 watchOS
 WAV
 WB
-wcurl
 web page
-WebDAV
 WebOS
-webpage
 WebSocket
 WEBSOCKET
 WHATWG
 whitespace
 Whitespaces
 winbind
+WinBind
 winbuild
+winidn
 WinIDN
 WinLDAP
+WinSock
 winsock
+WinSSL
+winssl
 Wireshark
 wolfSSH
 wolfSSL
-ws
 WS
 WSS
 www
 Xbox
-XDG
 xdigit
 Xilinx
 XP
--- a/.github/scripts/spellcheck.yaml
+++ b/.github/scripts/spellcheck.yaml
@ -4,29 +4,29 @@
 #
 # Docs: https://github.com/UnicornGlobal/spellcheck-github-actions
 matrix:
-  - name: Markdown
-    expect_match: false
-    apsell:
-      mode: en
-    dictionary:
-      wordlists:
-        - wordlist.txt
-      output: wordlist.dic
-      encoding: utf-8
-    pipeline:
-      - pyspelling.filters.markdown:
-          markdown_extensions:
-            - markdown.extensions.extra:
-      - pyspelling.filters.html:
-          comments: true
-          attributes:
-            - title
-            - alt
-          ignores:
-            - ':matches(code, pre)'
-            - 'code'
-            - 'pre'
-            - 'strong'
-            - 'em'
-    sources:
-      - '**/*.md|!docs/BINDINGS.md|!docs/DISTROS.md|!docs/CIPHERS-TLS12.md'
+- name: Markdown
+  expect_match: false
+  apsell:
+    mode: en
+  dictionary:
+    wordlists:
+    - wordlist.txt
+    output: wordlist.dic
+    encoding: utf-8
+  pipeline:
+  - pyspelling.filters.markdown:
+      markdown_extensions:
+      - markdown.extensions.extra:
+  - pyspelling.filters.html:
+      comments: true
+      attributes:
+      - title
+      - alt
+      ignores:
+      - ':matches(code, pre)'
+      - 'code'
+      - 'pre'
+      - 'strong'
+      - 'em'
+  sources:
+  - '**/*.md|!docs/BINDINGS.md'
--- a/.github/scripts/trimmarkdownheader.pl
+++ b/.github/scripts/trimmarkdownheader.pl
@ -1,41 +0,0 @@
-#!/usr/bin/env perl
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Given: a libcurl curldown man page
-# Outputs: the same file, minus the header
-#
-
-my $f = $ARGV[0];
-
-open(F, "<$f") or die;
-
-my @out;
-my $line = 0;
-my $hideheader = 0;
-
-while(<F>) {
-    if($hideheader) {
-        if(/^---/) {
-            # end if hiding
-            $hideheader = 0;
-        }
-        push @out, "\n"; # replace with blank
-        next;
-    }
-    elsif(!$line++ && /^---/) {
-        # starts with a header, strip off the header
-        $hideheader = 1;
-        push @out, "\n"; # replace with blank
-        next;
-    }
-    push @out, $_;
-}
-close(F);
-
-open(O, ">$f") or die;
-for my $l (@out) {
-    print O $l;
-}
-close(O);
--- a/.github/scripts/verify-examples.pl
+++ b/.github/scripts/verify-examples.pl
@ -1,110 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-my @files = @ARGV;
-my $cfile = "test.c";
-my $check = "./scripts/checksrc.pl";
-my $error;
-
-if($files[0] eq "-h") {
-    print "Usage: verify-synopsis [man pages]\n";
-    exit;
-}
-
-sub testcompile {
-    my $rc = system("gcc -c test.c -DCURL_DISABLE_TYPECHECK -DCURL_ALLOW_OLD_MULTI_SOCKET -DCURL_DISABLE_DEPRECATION -Wunused -Werror -Wno-unused-but-set-variable -I include") >> 8;
-    return $rc;
-}
-
-sub checksrc {
-    my $rc = system("$check test.c") >> 8;
-    return $rc;
-}
-
-sub extract {
-    my($f) = @_;
-    my $syn = 0;
-    my $l = 0;
-    my $iline = 0;
-    my $fail = 0;
-    open(F, "<$f") or die "failed opening input file $f : $!";
-    open(O, ">$cfile") or die "failed opening output file $cfile : $!";
-    print O "#include <curl/curl.h>\n";
-    while(<F>) {
-        $iline++;
-        if(/^.SH EXAMPLE/) {
-            $syn = 1
-        }
-        elsif($syn == 1) {
-            if(/^.nf/) {
-                $syn++;
-                print O "/* !checksrc! disable UNUSEDIGNORE all */\n";
-                print O "/* !checksrc! disable COPYRIGHT all */\n";
-                print O "/* !checksrc! disable FOPENMODE all */\n";
-                printf O "#line %d \"$f\"\n", $iline+1;
-            }
-        }
-        elsif($syn == 2) {
-            if(/^.fi/) {
-                last;
-            }
-            if(/(?<!\\)(?:\\{2})*\\(?!\\)/) {
-                print STDERR
-                  "Error while processing file $f line $iline:\n$_" .
-                  "Error: Single backslashes \\ are not properly shown in " .
-                  "manpage EXAMPLE output unless they are escaped \\\\.\n";
-                $fail = 1;
-                $error = 1;
-                last;
-            }
-            # two backslashes become one
-            $_ =~ s/\\\\/\\/g;
-            print O $_;
-            $l++;
-        }
-    }
-    close(F);
-    close(O);
-
-    return ($fail ? 0 : $l);
-}
-
-my $count;
-for my $m (@files) {
-    #print "Verify $m\n";
-    my $out = extract($m);
-    if($out) {
-      $error |= testcompile($m);
-      $error |= checksrc($m);
-    }
-    $count++;
-}
-if(!$error) {
-    print "Verified $count man pages ok\n";
-}
-else {
-    print "Detected problems\n";
-}
-exit $error;
--- a/.github/scripts/verify-synopsis.pl
+++ b/.github/scripts/verify-synopsis.pl
@ -1,84 +0,0 @@
-#!/usr/bin/env perl
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-
-my @files = @ARGV;
-my $cfile = "test.c";
-
-if($files[0] eq "-h") {
-    print "Usage: verify-synopsis [man pages]\n";
-    exit;
-}
-
-sub testcompile {
-    my $rc = system("gcc -c test.c -DCURL_DISABLE_TYPECHECK -DCURL_ALLOW_OLD_MULTI_SOCKET -I include") >> 8;
-    return $rc;
-}
-
-
-sub extract {
-    my($f) = @_;
-    my $syn = 0;
-    my $l = 0;
-    my $iline = 0;
-    open(F, "<$f");
-    open(O, ">$cfile");
-    while(<F>) {
-        $iline++;
-        if(/^# SYNOPSIS/) {
-            $syn = 1
-        }
-        elsif($syn == 1) {
-            if(/^\~\~\~/) {
-                $syn++;
-                print O "#line $iline \"$f\"\n";
-            }
-        }
-        elsif($syn == 2) {
-            if(/^\~\~\~/) {
-                last;
-            }
-            # turn the vararg argument into vararg
-            $_ =~ s/, parameter\)\;/, ...);/;
-            print O $_;
-            $l++;
-        }
-    }
-    close(F);
-    close(O);
-
-    if($syn < 2) {
-        print STDERR "Found no synopsis in $f\n";
-        return 1;
-    }
-
-    return 0;
-}
-
-my $error;
-for my $m (@files) {
-    $error |= extract($m);
-    $error |= testcompile($m);
-}
-exit $error;
--- a/.github/scripts/yamlcheck.sh
+++ b/.github/scripts/yamlcheck.sh
@ -1,13 +0,0 @@
-#!/bin/sh
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-set -eu
-
-# shellcheck disable=SC2046
-yamllint \
-  --format standard \
-  --strict \
-  --config-data "$(dirname "$0")/yamlcheck.yaml" \
-  $(git ls-files '*.yaml' '*.yml')
--- a/.github/scripts/yamlcheck.yaml
+++ b/.github/scripts/yamlcheck.yaml
@ -1,17 +0,0 @@
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-#
-# Docs: https://yamllint.readthedocs.io/en/stable/configuration.html
-
-extends: default
-
-rules:
-  line-length:
-    max: 500
-    level: warning
-
-  braces: disable
-  commas: disable
-  comments: disable
-  document-start: disable
--- a/.github/workflows/appveyor-status.yml
+++ b/.github/workflows/appveyor-status.yml
@ -1,41 +1,41 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: AppVeyor Status Report
-
-'on':
-  status
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.sha }}-${{ github.event.target_url }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  split:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.sender.login == 'appveyor[bot]' }}
-    permissions:
-      statuses: write
-    steps:
-      - name: Create individual AppVeyor build statuses
-        if: ${{ github.event.sha && github.event.target_url }}
-        env:
-          APPVEYOR_COMMIT_SHA: ${{ github.event.sha }}
-          APPVEYOR_TARGET_URL: ${{ github.event.target_url }}
-          APPVEYOR_REPOSITORY: ${{ github.event.repository.full_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo ${APPVEYOR_TARGET_URL} | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s | \
-            jq -c '.build.jobs[] | {target_url: ($target_url + "/job/" + .jobId),
-                                    context: (.name | sub("^(Environment: )?"; "AppVeyor / ")),
-                                    state: (.status | sub("queued"; "pending")
-                                                    | sub("starting"; "pending")
-                                                    | sub("running"; "pending")
-                                                    | sub("failed"; "failure")
-                                                    | sub("cancelled"; "error")),
-                                    description: .status}' \
-                --arg target_url ${APPVEYOR_TARGET_URL} | tee /dev/stderr | parallel --pipe -j 1 -N 1 \
-              gh api --silent --input - repos/${APPVEYOR_REPOSITORY}/statuses/${APPVEYOR_COMMIT_SHA}
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: AppVeyor Status Report
+
+on:
+  status
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.sha }}-${{ github.event.target_url }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  split:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.sender.login == 'appveyor[bot]' }}
+    permissions:
+      statuses: write
+    steps:
+      - name: Create individual AppVeyor build statuses
+        if: ${{ github.event.sha && github.event.target_url }}
+        env:
+          APPVEYOR_COMMIT_SHA: ${{ github.event.sha }}
+          APPVEYOR_TARGET_URL: ${{ github.event.target_url }}
+          APPVEYOR_REPOSITORY: ${{ github.event.repository.full_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo ${APPVEYOR_TARGET_URL} | sed 's/\/project\//\/api\/projects\//' | xargs -t -n1 curl -s | \
+            jq -c '.build.jobs[] | {target_url: ($target_url + "/job/" + .jobId),
+                                    context: (.name | sub("^(Environment: )?"; "AppVeyor / ")),
+                                    state: (.status | sub("queued"; "pending")
+                                                    | sub("starting"; "pending")
+                                                    | sub("running"; "pending")
+                                                    | sub("failed"; "failure")
+                                                    | sub("cancelled"; "error")),
+                                    description: .status}' \
+                --arg target_url ${APPVEYOR_TARGET_URL} | tee /dev/stderr | parallel --pipe -j 1 -N 1 \
+              gh api --silent --input - repos/${APPVEYOR_REPOSITORY}/statuses/${APPVEYOR_COMMIT_SHA}
--- a/.github/workflows/awslc.yml
+++ b/.github/workflows/awslc.yml
@ -0,0 +1,129 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Linux AWS-LC
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: awslc-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 3
+
+jobs:
+  autoconf:
+    name: awslc (autoconf)
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 30
+
+    steps:
+    - run: |
+        sudo apt-get update --yes
+        sudo apt-get install --yes libtool autoconf automake pkg-config stunnel4
+        # ensure we don't pick up openssl in this build
+        sudo apt remove --yes libssl-dev
+        sudo python3 -m pip install impacket
+      name: 'install prereqs and impacket'
+
+    - run: |
+        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/awslabs/aws-lc/archive/refs/tags/v1.3.0.tar.gz
+        tar xzf v1.3.0.tar.gz
+        mkdir aws-lc-1.3.0-build
+        cd aws-lc-1.3.0-build
+        cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-1.3.0
+        cmake --build . --parallel
+        cmake --install .
+      name: 'install awslc'
+
+    - uses: actions/checkout@v3
+
+    - run: autoreconf -fi
+      name: 'autoreconf'
+
+    - run: |
+        mkdir build
+        cd build
+        ../configure --enable-warnings --enable-werror --with-openssl=$HOME/awslc
+        cd ..
+      name: 'configure out-of-tree'
+
+    - run: make -C build V=1
+      name: 'make'
+
+    - run: make -C build V=1 examples
+      name: 'make examples'
+
+    - run: make -C build V=1 -C tests
+      name: 'make tests'
+
+    - run: make -C build V=1 test-ci
+      name: 'run tests'
+
+  cmake:
+    name: awslc (cmake)
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 15
+
+    steps:
+    - run: |
+        sudo apt-get update
+        sudo apt-get install cmake stunnel4
+        # ensure we don't pick up openssl in this build
+        sudo apt remove --yes libssl-dev
+        sudo python3 -m pip install impacket
+      name: 'install prereqs and impacket'
+
+    - run: |
+        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/awslabs/aws-lc/archive/refs/tags/v1.3.0.tar.gz
+        tar xzf v1.3.0.tar.gz
+        mkdir aws-lc-1.3.0-build
+        cd aws-lc-1.3.0-build
+        cmake -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-1.3.0
+        cmake --build . --parallel
+        cmake --install .
+      name: 'install awslc'
+
+    - uses: actions/checkout@v3
+
+    # CMAKE_COMPILE_WARNING_AS_ERROR is available in cmake 3.24 or later
+    - run: cmake -Bbuild -DOPENSSL_ROOT_DIR=$HOME/awslc -DBUILD_SHARED_LIBS=ON -DCMAKE_COMPILE_WARNING_AS_ERROR=ON .
+      name: 'cmake generate out-of-tree'
+
+    - run: cmake --build build --parallel
+      name: 'cmake build'
+
+    - run: cmake --install build --prefix $HOME/curl --strip
+      name: 'cmake install'
--- a/.github/workflows/checkdocs.yml
+++ b/.github/workflows/checkdocs.yml
@ -1,159 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-# This workflow contains tests that operate on documentation files only. Some
-# checks modify the source so they cannot be combined into a single job.
-
-name: Docs
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths:
-      - '.github/workflows/checkdocs.yml'
-      - '.github/scripts/mdlinkcheck'
-      - '/scripts/**'
-      - '**.md'
-      - 'docs/*'
-  pull_request:
-    branches:
-      - master
-    paths:
-      - '.github/workflows/checkdocs.yml'
-      - '.github/scripts/**'
-      - '.github/scripts/mdlinkcheck'
-      - '**.md'
-      - 'docs/*'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  #  proselint:
-  #    runs-on: ubuntu-latest
-  #    steps:
-  #      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
-  #        with:
-  #          persist-credentials: false
-  #        name: checkout
-  #
-  #      - name: install prereqs
-  #        run: |
-  #          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-  #          sudo apt-get -o Dpkg::Use-Pty=0 update
-  #          sudo apt-get -o Dpkg::Use-Pty=0 install python3-proselint
-  #
-  #      # config file help: https://github.com/amperser/proselint/
-  #      - name: create proselint config
-  #        run: |
-  #          cat <<JSON > $HOME/.proselintrc.json
-  #          {
-  #            "checks": {
-  #              "typography.diacritical_marks": false,
-  #              "typography.symbols": false,
-  #              "annotations.misc": false,
-  #              "security.password": false,
-  #              "misc.annotations": false
-  #            }
-  #          }
-  #          JSON
-  #
-  #      - name: trim headers off all *.md files
-  #        run: git ls-files -z '*.md' | xargs -0 -n1 .github/scripts/trimmarkdownheader.pl
-  #
-  #      - name: check prose
-  #        run: git ls-files -z '*.md' | grep -Evz 'CHECKSRC.md|DISTROS.md|curl_mprintf.md|CURLOPT_INTERFACE.md|interface.md' | xargs -0 proselint README
-  #
-  #      # This is for CHECKSRC and files with aggressive exclamation mark needs
-  #      - name: create second proselint config
-  #        run: |
-  #          cat <<JSON > $HOME/.proselintrc.json
-  #          {
-  #            "checks": {
-  #              "typography.diacritical_marks": false,
-  #              "typography.symbols": false,
-  #              "typography.exclamation": false,
-  #              "lexical_illusions.misc": false,
-  #              "annotations.misc": false
-  #            }
-  #          }
-  #          JSON
-  #
-  #      - name: check special prose
-  #        run: proselint docs/internals/CHECKSRC.md docs/libcurl/curl_mprintf.md docs/libcurl/opts/CURLOPT_INTERFACE.md docs/cmdline-opts/interface.md
-
-  linkcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: Run mdlinkcheck
-        run: ./scripts/mdlinkcheck
-
-  spellcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: trim all *.md files in docs/
-        run: .github/scripts/cleancmd.pl $(find docs -name "*.md")
-
-      - name: setup the custom wordlist
-        run: grep -v '^#' .github/scripts/spellcheck.words >  wordlist.txt
-
-      - name: Check Spelling
-        uses: rojopolis/spellcheck-github-actions@ed0756273a1658136c36d26e3d0353de35b98c8b # v0
-        with:
-          config_path: .github/scripts/spellcheck.yaml
-
-  badwords-synopsis:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: badwords
-        run: .github/scripts/badwords.pl < .github/scripts/badwords.txt `git ls-files '**.md'` docs/TODO docs/KNOWN_BUGS packages/OS400/README.OS400
-
-      - name: verify-synopsis
-        run: .github/scripts/verify-synopsis.pl docs/libcurl/curl*.md
-
-  man-examples:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: render nroff versions
-        run: autoreconf -fi && ./configure --without-ssl --without-libpsl && make -C docs
-
-      - name: verify examples
-        run: .github/scripts/verify-examples.pl docs/libcurl/curl*.3 docs/libcurl/opts/*.3
-
-  miscchecks:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: spacecheck
-        run: .github/scripts/spacecheck.pl
--- a/.github/workflows/checksrc.yml
+++ b/.github/workflows/checksrc.yml
@ -1,120 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-# This workflow contains checks at the source code level only.
-
-name: Source
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'plan9/**'
-      - 'tests/data/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'plan9/**'
-      - 'tests/data/**'
-      - 'winbuild/**'
-
-permissions: {}
-
-jobs:
-  checksrc:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: check
-        run: git ls-files -z "*.[ch]" | xargs -0 -n1 ./scripts/checksrc.pl
-
-  codespell-cmakelint-pytype-ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: install
-        env:
-          DEBIAN_FRONTEND: noninteractive
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            codespell python3-pip python3-networkx python3-pydot python3-yaml \
-            python3-toml python3-markupsafe python3-jinja2 python3-tabulate \
-            python3-typing-extensions python3-libcst python3-impacket \
-            python3-websockets python3-pytest
-          python3 -m pip install --break-system-packages cmakelint==1.4.3 pytype==2024.9.13 ruff==0.6.8
-
-      - name: spellcheck
-        run: |
-          codespell \
-            --skip scripts/mk-ca-bundle.pl \
-            --skip src/tool_hugehelp.c \
-            -I .github/scripts/codespell-ignore.txt \
-            CMake include m4 scripts src lib
-
-      - name: cmakelint
-        run: scripts/cmakelint.sh
-
-      - name: pytype
-        run: find . -name '*.py' -exec pytype -j auto -k {} +
-
-      - name: ruff
-        run: ruff check --extend-select=B007,B016,C405,C416,COM818,D200,D213,D204,D401,D415,FURB129,N818,PERF401,PERF403,PIE790,PIE808,PLW0127,Q004,RUF010,SIM101,SIM117,SIM118,TRY400,TRY401
-
-  reuse:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5
-
-  miscchecks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-        name: checkout
-
-      - name: shellcheck
-        run: .github/scripts/shellcheck.sh
-
-      - name: spacecheck
-        run: .github/scripts/spacecheck.pl
-
-      - name: yamlcheck
-        run: .github/scripts/yamlcheck.sh
-
-      - name: binarycheck
-        run: .github/scripts/binarycheck.pl
-
-      # we allow some extra in source code
-      - name: badwords
-        run: |
-          grep -Ev '(\\bwill| url | dir )' .github/scripts/badwords.txt | \
-          .github/scripts/badwords.pl $(git ls-files -- src lib include)
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -0,0 +1,80 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: CodeQL
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'docs/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'tests/data/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'docs/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'tests/data/**'
+    - 'winbuild/**'
+  schedule:
+    - cron: '0 0 * * 4'
+
+concurrency:
+  group: ${{ github.workflow }}
+
+permissions: {}
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: cpp
+        queries: security-extended
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
--- a/.github/workflows/configure-vs-cmake.yml
+++ b/.github/workflows/configure-vs-cmake.yml
@ -1,149 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: configure-vs-cmake
-'on':
-  push:
-    branches:
-      - master
-    paths:
-      - '*.ac'
-      - '**/*.m4'
-      - '**/CMakeLists.txt'
-      - 'CMake/**'
-      - 'lib/curl_config.h.cmake'
-      - 'tests/cmake/**'
-      - '.github/scripts/cmp-config.pl'
-      - '.github/workflows/configure-vs-cmake.yml'
-
-  pull_request:
-    branches:
-      - master
-    paths:
-      - '*.ac'
-      - '**/*.m4'
-      - '**/CMakeLists.txt'
-      - 'CMake/**'
-      - 'lib/curl_config.h.cmake'
-      - 'tests/cmake/**'
-      - '.github/scripts/cmp-config.pl'
-      - '.github/workflows/configure-vs-cmake.yml'
-
-permissions: {}
-
-jobs:
-  check-linux:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'run configure --with-openssl'
-        run: |
-          autoreconf -fi
-          export PKG_CONFIG_DEBUG_SPEW=1
-          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl --without-brotli
-
-      - name: 'run cmake'
-        run: |
-          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DCURL_BROTLI=OFF
-
-      - name: 'configure log'
-        run: cat bld-am/config.log 2>/dev/null || true
-
-      - name: 'cmake log'
-        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'compare generated curl_config.h files'
-        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
-
-      - name: 'compare generated libcurl.pc files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
-
-      - name: 'compare generated curl-config files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
-
-  check-macos:
-    runs-on: macos-latest
-    steps:
-      - name: 'install packages'
-        run: |
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew install libtool autoconf automake && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-
-      - name: 'toolchain versions'
-        run: |
-         echo '::group::brew packages installed'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'run configure --with-openssl'
-        run: |
-          autoreconf -fi
-          export PKG_CONFIG_DEBUG_SPEW=1
-          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-openssl --without-libpsl --disable-ldap --with-zstd
-
-      - name: 'run cmake'
-        run: |
-          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF -DCURL_DISABLE_LDAP=ON \
-            -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-            -DCURL_BROTLI=OFF \
-            -DCURL_USE_LIBSSH2=OFF
-
-      - name: 'configure log'
-        run: cat bld-am/config.log 2>/dev/null || true
-
-      - name: 'cmake log'
-        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'compare generated curl_config.h files'
-        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
-
-      - name: 'compare generated libcurl.pc files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
-
-      - name: 'compare generated curl-config files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
-
-  check-windows:
-    runs-on: ubuntu-latest
-    env:
-      TRIPLET: 'x86_64-w64-mingw32'
-    steps:
-      - name: 'install packages'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 install mingw-w64
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'run configure --with-schannel'
-        run: |
-          autoreconf -fi
-          export PKG_CONFIG_DEBUG_SPEW=1
-          mkdir bld-am && cd bld-am && ../configure --enable-static=no --with-schannel --without-libpsl --host="${TRIPLET}"
-
-      - name: 'run cmake'
-        run: |
-          cmake -B bld-cm -DCURL_WERROR=ON -DCURL_USE_SCHANNEL=ON -DCURL_USE_LIBPSL=OFF \
-            -DCMAKE_SYSTEM_NAME=Windows \
-            -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
-            -DCMAKE_C_COMPILER="${TRIPLET}-gcc"
-
-      - name: 'configure log'
-        run: cat bld-am/config.log 2>/dev/null || true
-
-      - name: 'cmake log'
-        run: cat bld-cm/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'compare generated curl_config.h files'
-        run: ./.github/scripts/cmp-config.pl bld-am/lib/curl_config.h bld-cm/lib/curl_config.h
-
-      - name: 'compare generated libcurl.pc files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/libcurl.pc bld-cm/libcurl.pc
-
-      - name: 'compare generated curl-config files'
-        run: ./.github/scripts/cmp-pkg-config.sh bld-am/curl-config bld-cm/curl-config
--- a/.github/workflows/curl-for-win.yml
+++ b/.github/workflows/curl-for-win.yml
@ -1,163 +0,0 @@
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
---
-name: curl-for-win
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  CW_NOGET: 'curl trurl'
-  CW_MAP: '0'
-  CW_JOBS: '5'
-  CW_NOPKG: '1'
-
-jobs:
-  linux-glibc-gcc:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-linux-a64-x64-gcc'
-          export CW_REVISION='${{ github.sha }}'
-          DOCKER_IMAGE='debian:bookworm-slim'
-          export DOCKER_CONTENT_TRUST=1
-          export CW_CCSUFFIX='-15'
-          export CW_GCCSUFFIX='-12'
-          docker trust inspect --pretty "${DOCKER_IMAGE}"
-          time docker pull "${DOCKER_IMAGE}"
-          docker images --digests
-          time docker run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
-            --env-file <(env | grep -a -E \
-              '^(CW_|GITHUB_)') \
-            "${DOCKER_IMAGE}" \
-            sh -c ./_ci-linux-debian.sh
-
-  linux-musl-llvm:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-linux-musl-r64-x64'
-          export CW_REVISION='${{ github.sha }}'
-          . ./_versions.sh
-          docker trust inspect --pretty "${DOCKER_IMAGE}"
-          time docker pull "${DOCKER_IMAGE}"
-          docker images --digests
-          time docker run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
-            --env-file <(env | grep -a -E \
-              '^(CW_|GITHUB_)') \
-            "${DOCKER_IMAGE}" \
-            sh -c ./_ci-linux-debian.sh
-
-  mac-clang:
-    runs-on: macos-latest
-    timeout-minutes: 30
-    env:
-      CW_JOBS: '4'
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-mac-x64'
-          export CW_REVISION='${{ github.sha }}'
-          sh -c ./_ci-mac-homebrew.sh
-
-  win-llvm:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-win-x64'
-          export CW_REVISION='${{ github.sha }}'
-          . ./_versions.sh
-          docker trust inspect --pretty "${DOCKER_IMAGE}"
-          time docker pull "${DOCKER_IMAGE}"
-          docker images --digests
-          time docker run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
-            --env-file <(env | grep -a -E \
-              '^(CW_|GITHUB_)') \
-            "${DOCKER_IMAGE}" \
-            sh -c ./_ci-linux-debian.sh
-
-  win-gcc-libssh-zlibng-x86:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-          path: 'curl'
-          fetch-depth: 8
-      - name: 'build'
-        run: |
-          git clone --depth 1 https://github.com/curl/curl-for-win
-          mv curl-for-win/* .
-          export CW_CONFIG='-main-werror-win-x86-gcc-libssh1-zlibng'
-          export CW_REVISION='${{ github.sha }}'
-          . ./_versions.sh
-          docker trust inspect --pretty "${DOCKER_IMAGE}"
-          time docker pull "${DOCKER_IMAGE}"
-          docker images --digests
-          time docker run --volume "$(pwd):$(pwd)" --workdir "$(pwd)" \
-            --env-file <(env | grep -a -E \
-              '^(CW_|GITHUB_)') \
-            "${DOCKER_IMAGE}" \
-            sh -c ./_ci-linux-debian.sh
--- a/.github/workflows/distcheck.yml
+++ b/.github/workflows/distcheck.yml
@ -1,194 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: dist
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-  pull_request:
-    branches:
-      - master
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 5
-
-jobs:
-  maketgz-and-verify-in-tree:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'remove preinstalled curl libcurl4{-doc}'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
-
-      - name: 'autoreconf'
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: ./configure --without-ssl --without-libpsl
-
-      - name: 'make'
-        run: make V=1
-
-      - name: 'maketgz'
-        run: SOURCE_DATE_EPOCH=1711526400 ./scripts/maketgz 99.98.97
-
-      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
-        with:
-          name: 'release-tgz'
-          path: 'curl-99.98.97.tar.gz'
-          retention-days: 1
-
-      - name: 'verify in-tree configure build including install'
-        run: |
-          echo "::stop-commands::$(uuidgen)"
-          tar xvf curl-99.98.97.tar.gz
-          pushd curl-99.98.97
-          ./configure --prefix=$HOME/temp --without-ssl --without-libpsl
-          make
-          make test-ci
-          make install
-          popd
-          # basic check of the installed files
-          bash scripts/installcheck.sh $HOME/temp
-          rm -rf curl-99.98.97
-
-  verify-out-of-tree-docs:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: maketgz-and-verify-in-tree
-    steps:
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
-        with:
-          name: 'release-tgz'
-
-      - name: 'verify out-of-tree configure build including docs'
-        run: |
-          echo "::stop-commands::$(uuidgen)"
-          tar xvf curl-99.98.97.tar.gz
-          touch curl-99.98.97/docs/{cmdline-opts,libcurl}/Makefile.inc
-          mkdir build
-          pushd build
-          ../curl-99.98.97/configure --without-ssl --without-libpsl
-          make
-          make test-ci
-          popd
-          rm -rf build
-          rm -rf curl-99.98.97
-
-  verify-out-of-tree-autotools-debug:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: maketgz-and-verify-in-tree
-    steps:
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
-        with:
-          name: 'release-tgz'
-
-      - name: 'verify out-of-tree autotools debug build'
-        run: |
-          echo "::stop-commands::$(uuidgen)"
-          tar xvf curl-99.98.97.tar.gz
-          pushd curl-99.98.97
-          mkdir build
-          pushd build
-          ../configure --without-ssl --enable-debug "--prefix=${PWD}/pkg" --without-libpsl
-          make
-          make test-ci
-          make install
-
-  verify-out-of-tree-cmake:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: maketgz-and-verify-in-tree
-    steps:
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
-        with:
-          name: 'release-tgz'
-
-      - name: 'verify out-of-tree cmake build'
-        run: |
-          echo "::stop-commands::$(uuidgen)"
-          tar xvf curl-99.98.97.tar.gz
-          pushd curl-99.98.97
-          cmake -B build -DCURL_WERROR=ON -DCURL_USE_LIBPSL=OFF
-          make -C build
-
-  missing-files:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    needs: maketgz-and-verify-in-tree
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
-        with:
-          name: 'release-tgz'
-
-      - name: 'detect files missing from release tarball'
-        run: .github/scripts/distfiles.sh curl-99.98.97.tar.gz
-
-  reproducible-releases:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'remove preinstalled curl libcurl4{-doc}'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 purge curl libcurl4 libcurl4-doc
-
-      - name: 'generate release tarballs'
-        run: ./scripts/dmaketgz 9.10.11
-
-      - name: 'verify release tarballs'
-        run: |
-          mkdir _verify
-          mv curl-9.10.11.tar.gz _verify
-          cd _verify
-          ../scripts/verify-release curl-9.10.11.tar.gz
-
-  cmake-integration:
-    name: 'cmake-integration-on-${{ matrix.image }}'
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 10
-    env:
-      CC: clang
-      CMAKE_GENERATOR: Ninja
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [ubuntu-latest, macos-latest]
-    steps:
-      - name: 'install prereqs'
-        run: |
-          if [[ '${{ matrix.image }}' = *'ubuntu'* ]]; then
-            sudo apt-get -o Dpkg::Use-Pty=0 install ninja-build libpsl-dev libssl-dev
-          else
-            brew install ninja libpsl openssl
-          fi
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-      - name: 'via FetchContent'
-        run: ./tests/cmake/test.sh FetchContent
-      - name: 'via add_subdirectory'
-        run: ./tests/cmake/test.sh add_subdirectory
-      - name: 'via find_package'
-        run: ./tests/cmake/test.sh find_package
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@ -4,36 +4,40 @@

 name: Fuzzer

-'on':
+on:
  push:
    branches:
-      - master
-      - '*/ci'
+    - master
+    - '*/ci'
    paths-ignore:
-      - '**/*.md'
-      - '**/CMakeLists.txt'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'CMake/**'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'tests/data/**'
-      - 'winbuild/**'
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'tests/data/**'
+    - 'winbuild/**'
  pull_request:
    branches:
-      - master
+    - master
    paths-ignore:
-      - '**/*.md'
-      - '**/CMakeLists.txt'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'CMake/**'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'tests/data/**'
-      - 'winbuild/**'
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'tests/data/**'
+    - 'winbuild/**'

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
--- a/.github/workflows/hacktoberfest-accepted.yml
+++ b/.github/workflows/hacktoberfest-accepted.yml
@ -4,11 +4,11 @@

 name: Hacktoberfest

-'on':
+on:
  # this must not ever run on any other branch than master
  push:
    branches:
-      - master
+    - master

 concurrency:
  # this should not run in parallel, so just run one at a time
@ -26,9 +26,8 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@v3
        with:
-          persist-credentials: false
          fetch-depth: 100

      - name: Check whether repo participates in Hacktoberfest
@ -41,13 +40,13 @@ jobs:

      - name: Search relevant commit message lines starting with Closes/Merges
        run: |
-          git log --format=email '${{ github.event.before }}..${{ github.event.after }}' | \
-            grep -Ei '^Close[sd]? ' | sort | uniq | tee log
+          git log --format=email ${{ github.event.before }}..${{ github.event.after }} | \
+            grep -Ei "^Close[sd]? " | sort | uniq | tee log
        if: steps.check.outputs.label == 'hacktoberfest'

      - name: Search for Number-based PR references
        run: |
-          grep -Eo '#([0-9]+)' log | cut -d# -f2 | sort | uniq | xargs -t -n1 -I{} \
+          grep -Eo "#([0-9]+)" log | cut -d# -f2 | sort | uniq | xargs -t -n1 -I{} \
            gh pr view {} --json number,createdAt \
              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
@ -58,8 +57,8 @@ jobs:

      - name: Search for URL-based PR references
        run: |
-          grep -Eo 'github.com/(.+)/(.+)/pull/([0-9]+)' log | sort | uniq | xargs -t -n1 -I{} \
-            gh pr view 'https://{}' --json number,createdAt \
+          grep -Eo "github.com/(.+)/(.+)/pull/([0-9]+)" log | sort | uniq | xargs -t -n1 -I{} \
+            gh pr view "https://{}" --json number,createdAt \
              --jq '{number, opened: .createdAt} | [.number, .opened] | join(":")' | tee /dev/stderr | \
            grep -Eo '^([0-9]+):[0-9]{4}-(09-30T|10-|11-01T)' | cut -d: -f1 | sort | uniq | xargs -t -n1 -I {} \
              gh pr edit {} --add-label 'hacktoberfest-accepted'
--- a/.github/workflows/http3-linux.yml
+++ b/.github/workflows/http3-linux.yml
@ -1,518 +0,0 @@
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# SPDX-License-Identifier: curl
-
-name: Linux HTTP/3
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-
-concurrency:
-  # Hardcoded workflow filename as workflow name above is just Linux again
-  group: http3-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 5
-  # handled in renovate.json
-  openssl-version: 3.4.1
-  # handled in renovate.json
-  quictls-version: 3.3.0
-  # renovate: datasource=github-tags depName=gnutls/gnutls versioning=semver registryUrl=https://github.com
-  gnutls-version: 3.8.9
-  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-  wolfssl-version: 5.7.6
-  # renovate: datasource=github-tags depName=ngtcp2/nghttp3 versioning=semver registryUrl=https://github.com
-  nghttp3-version: 1.8.0
-  # renovate: datasource=github-tags depName=ngtcp2/ngtcp2 versioning=semver registryUrl=https://github.com
-  ngtcp2-version: 1.11.0
-  # renovate: datasource=github-tags depName=nghttp2/nghttp2 versioning=semver registryUrl=https://github.com
-  nghttp2-version: 1.64.0
-  # renovate: datasource=github-tags depName=cloudflare/quiche versioning=semver registryUrl=https://github.com
-  quiche-version: 0.23.2
-
-jobs:
-  build-cache:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: 'cache quictls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-quictls-no-deprecated
-        env:
-          cache-name: cache-quictls-no-deprecated
-        with:
-          path: ~/quictls/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quictls-version }}-quic1
-
-      - name: 'cache gnutls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-gnutls
-        env:
-          cache-name: cache-gnutls
-        with:
-          path: ~/gnutls/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.gnutls-version }}
-
-      - name: 'cache wolfssl'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssl
-        env:
-          cache-name: cache-wolfssl
-        with:
-          path: ~/wolfssl/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
-
-      - name: 'cache nghttp3'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-nghttp3
-        env:
-          cache-name: cache-nghttp3
-        with:
-          path: ~/nghttp3/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp3-version }}
-
-      - name: 'cache ngtcp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-ngtcp2
-        env:
-          cache-name: cache-ngtcp2
-        with:
-          path: ~/ngtcp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.ngtcp2-version }}-${{ env.quictls-version }}-${{ env.gnutls-version }}-${{ env.wolfssl-version }}
-
-      - name: 'cache nghttp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-nghttp2
-        env:
-          cache-name: cache-nghttp2
-        with:
-          path: ~/nghttp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp2-version }}-${{ env.quictls-version }}-${{ env.ngtcp2-version }}-${{ env.nghttp3-version }}
-
-      - id: settings
-        if: |
-          steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true' ||
-          steps.cache-gnutls.outputs.cache-hit != 'true' ||
-          steps.cache-wolfssl.outputs.cache-hit != 'true' ||
-          steps.cache-nghttp3.outputs.cache-hit != 'true' ||
-          steps.cache-ngtcp2.outputs.cache-hit != 'true' ||
-          steps.cache-nghttp2.outputs.cache-hit != 'true'
-        run: |
-          echo 'needs-build=true' >> $GITHUB_OUTPUT
-
-      - name: 'install build prereqs'
-        if: steps.settings.outputs.needs-build == 'true'
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake pkgconf stunnel4 \
-            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev \
-            nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin \
-            libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools \
-            texinfo texlive texlive-extra-utils autopoint libev-dev \
-            apache2 apache2-dev libnghttp2-dev
-          echo 'CC=gcc-12' >> $GITHUB_ENV
-          echo 'CXX=g++-12' >> $GITHUB_ENV
-
-      - name: 'build quictls'
-        if: steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }}-quic1 https://github.com/quictls/openssl quictls
-          cd quictls
-          ./config no-deprecated --prefix=$PWD/build --libdir=lib no-makedepend no-apps no-docs no-tests
-          make
-          make -j1 install_sw
-
-      - name: 'build gnutls'
-        if: steps.cache-gnutls.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b ${{ env.gnutls-version }} https://github.com/gnutls/gnutls.git
-          cd gnutls
-          ./bootstrap
-          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            LDFLAGS="-Wl,-rpath,$PWD/build/lib -L$PWD/build/lib" \
-            --with-included-libtasn1 --with-included-unistring \
-            --disable-guile --disable-doc --disable-tests --disable-tools
-          make
-          make install
-
-      - name: 'build wolfssl'
-        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b v${{ env.wolfssl-version }}-stable https://github.com/wolfSSL/wolfssl.git
-          cd wolfssl
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-all --enable-quic \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=$PWD/build
-          make
-          make install
-
-      - name: 'build nghttp3'
-        if: steps.cache-nghttp3.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b v${{ env.nghttp3-version }} https://github.com/ngtcp2/nghttp3
-          cd nghttp3
-          git submodule update --init --depth=1
-          autoreconf -fi
-          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            PKG_CONFIG_PATH="$PWD/build/lib/pkgconfig" \
-            --enable-lib-only
-          make
-          make install
-
-      - name: 'build ngtcp2'
-        if: steps.cache-ngtcp2.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b v${{ env.ngtcp2-version }} https://github.com/ngtcp2/ngtcp2
-          cd ngtcp2
-          autoreconf -fi
-          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            PKG_CONFIG_PATH="$HOME/quictls/build/lib/pkgconfig:$HOME/gnutls/build/lib/pkgconfig:$HOME/wolfssl/build/lib/pkgconfig" \
-            --enable-lib-only --with-openssl --with-gnutls --with-wolfssl
-          make install
-
-      - name: 'build nghttp2'
-        if: steps.cache-nghttp2.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b v${{ env.nghttp2-version }} https://github.com/nghttp2/nghttp2
-          cd nghttp2
-          autoreconf -fi
-          ./configure --disable-dependency-tracking --prefix=$PWD/build \
-            PKG_CONFIG_PATH="$HOME/quictls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig" \
-            LDFLAGS="-Wl,-rpath,$HOME/quictls/build/lib" \
-            --enable-http3
-          make install
-
-  linux:
-    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
-    needs:
-      - build-cache
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - name: quictls
-            PKG_CONFIG_PATH: '$HOME/quictls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
-            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/quictls/build/lib"
-              --with-ngtcp2=$HOME/ngtcp2/build --enable-warnings --enable-werror --enable-debug --disable-ntlm
-              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-openssl=$HOME/quictls/build --enable-ssls-export
-              --with-libuv
-
-          - name: gnutls
-            PKG_CONFIG_PATH: '$HOME/gnutls/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
-            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/gnutls/build/lib"
-              --with-ngtcp2=$HOME/ngtcp2/build --enable-warnings --enable-werror --enable-debug
-              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-gnutls=$HOME/gnutls/build --enable-ssls-export
-              --with-libuv
-
-          - name: wolfssl
-            PKG_CONFIG_PATH: '$HOME/wolfssl/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
-            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/wolfssl/build/lib"
-              --with-ngtcp2=$HOME/ngtcp2/build --enable-warnings --enable-werror --enable-debug
-              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-wolfssl=$HOME/wolfssl/build
-              --enable-ech --enable-ssls-export
-              --with-libuv
-
-          - name: wolfssl
-            PKG_CONFIG_PATH: '$HOME/wolfssl/build/lib/pkgconfig:$HOME/nghttp3/build/lib/pkgconfig:$HOME/ngtcp2/build/lib/pkgconfig:$HOME/nghttp2/build/lib/pkgconfig'
-            generate: >-
-              -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON -DENABLE_DEBUG=ON
-              -DTEST_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DHTTPD_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DUSE_ECH=ON
-              -DCURL_USE_LIBUV=ON
-
-          - name: openssl-quic
-            PKG_CONFIG_PATH: '$HOME/openssl/build/lib64/pkgconfig'
-            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/openssl/build/lib64"
-              --enable-warnings --enable-werror --enable-debug --disable-ntlm
-              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-openssl=$HOME/openssl/build --with-openssl-quic
-              --with-nghttp3=$HOME/nghttp3/build
-              --with-libuv
-
-          - name: quiche
-            configure: >-
-              LDFLAGS="-Wl,-rpath,$HOME/quiche/target/release"
-              --with-openssl=$HOME/quiche/quiche/deps/boringssl/src
-              --enable-warnings --enable-werror --enable-debug
-              --with-quiche=$HOME/quiche/target/release
-              --with-test-nghttpx="$HOME/nghttp2/build/bin/nghttpx"
-              --with-ca-fallback
-              --with-libuv
-
-          - name: quiche
-            PKG_CONFIG_PATH: '$HOME/quiche/target/release'
-            generate: >-
-              -DOPENSSL_ROOT_DIR=$HOME/quiche/quiche/deps/boringssl/src -DENABLE_DEBUG=ON
-              -DUSE_QUICHE=ON
-              -DTEST_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DHTTPD_NGHTTPX="$HOME/nghttp2/build/bin/nghttpx"
-              -DCURL_CA_FALLBACK=ON
-              -DCURL_USE_LIBUV=ON
-
-    steps:
-      - name: 'install prereqs'
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake ninja-build pkgconf stunnel4 \
-            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev \
-            nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin \
-            libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools \
-            texinfo texlive texlive-extra-utils autopoint libev-dev libuv1-dev \
-            apache2 apache2-dev libnghttp2-dev vsftpd
-          python3 -m venv $HOME/venv
-          echo 'CC=gcc-12' >> $GITHUB_ENV
-          echo 'CXX=g++-12' >> $GITHUB_ENV
-
-      - name: 'cache quictls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-quictls-no-deprecated
-        env:
-          cache-name: cache-quictls-no-deprecated
-        with:
-          path: ~/quictls/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quictls-version }}-quic1
-          fail-on-cache-miss: true
-
-      - name: 'cache gnutls'
-        if: matrix.build.name == 'gnutls'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-gnutls
-        env:
-          cache-name: cache-gnutls
-        with:
-          path: ~/gnutls/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.gnutls-version }}
-          fail-on-cache-miss: true
-
-      - name: 'cache wolfssl'
-        if: matrix.build.name == 'wolfssl'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssl
-        env:
-          cache-name: cache-wolfssl
-        with:
-          path: ~/wolfssl/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
-          fail-on-cache-miss: true
-
-      - name: 'cache nghttp3'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-nghttp3
-        env:
-          cache-name: cache-nghttp3
-        with:
-          path: ~/nghttp3/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp3-version }}
-          fail-on-cache-miss: true
-
-      - name: 'cache ngtcp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-ngtcp2
-        env:
-          cache-name: cache-ngtcp2
-        with:
-          path: ~/ngtcp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.ngtcp2-version }}-${{ env.quictls-version }}-${{ env.gnutls-version }}-${{ env.wolfssl-version }}
-          fail-on-cache-miss: true
-
-      - name: 'cache nghttp2'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-nghttp2
-        env:
-          cache-name: cache-nghttp2
-        with:
-          path: ~/nghttp2/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.nghttp2-version }}-${{ env.quictls-version }}-${{ env.ngtcp2-version }}-${{ env.nghttp3-version }}
-          fail-on-cache-miss: true
-
-      - name: 'cache openssl'
-        if: matrix.build.name == 'openssl-quic'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-openssl
-        env:
-          cache-name: cache-openssl
-        with:
-          path: ~/openssl/build
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.openssl-version }}
-
-      - name: 'install openssl'
-        if: matrix.build.name == 'openssl-quic' && steps.cache-openssl.outputs.cache-hit != 'true'
-        run: |
-          git clone --quiet --depth=1 -b openssl-${{ env.openssl-version }} https://github.com/openssl/openssl
-          cd openssl
-          ./config --prefix=$HOME/openssl/build no-makedepend no-apps no-docs no-tests
-          make
-          make -j1 install_sw
-          cat exporters/openssl.pc
-
-      - name: 'cache quiche'
-        if: matrix.build.name == 'quiche'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-quiche
-        env:
-          cache-name: cache-quiche
-        with:
-          path: ~/quiche
-          key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.quiche-version }}
-
-      - name: 'build quiche and boringssl'
-        if: matrix.build.name == 'quiche' && steps.cache-quiche.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          git clone --quiet --depth=1 -b ${{ env.quiche-version }} --recursive https://github.com/cloudflare/quiche.git
-          cd quiche
-          #### Work-around https://github.com/curl/curl/issues/7927 #######
-          #### See https://github.com/alexcrichton/cmake-rs/issues/131 ####
-          sed -i -e 's/cmake = "0.1"/cmake = "=0.1.45"/' quiche/Cargo.toml
-
-          cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
-          ln -s libquiche.so target/release/libquiche.so.0
-          mkdir -v quiche/deps/boringssl/src/lib
-          ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/
-
-          # include dir
-          # $HOME/quiche/quiche/deps/boringssl/src/include
-          # lib dir
-          # $HOME/quiche/quiche/deps/boringssl/src/lib
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          if [ -n '${{ matrix.build.PKG_CONFIG_PATH }}' ]; then
-            export PKG_CONFIG_PATH="${{ matrix.build.PKG_CONFIG_PATH }}"
-          fi
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_C_COMPILER_TARGET=$(uname -m)-pc-linux-gnu -DBUILD_STATIC_LIBS=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              ${{ matrix.build.generate }}
-          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              ${{ matrix.build.configure }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'test configs'
-        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
-
-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose
-          else
-            make -C bld V=1
-          fi
-
-      - name: 'check curl -V output'
-        run: bld/src/curl -V
-
-      - name: 'build tests'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'install test prereqs'
-        run: |
-          source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/requirements.txt
-
-      - name: 'run tests'
-        env:
-          TFLAGS: '${{ matrix.build.tflags }}'
-        run: |
-          source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target test-ci
-          else
-            make -C bld V=1 test-ci
-          fi
-
-      - name: 'install pytest prereqs'
-        run: |
-          source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/http/requirements.txt
-
-      - name: 'run pytest event based'
-        env:
-          CURL_TEST_EVENT: 1
-          CURL_CI: github
-          PYTEST_ADDOPTS: '--color=yes'
-        run: |
-          source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-pytest-ci
-          else
-            make -C bld V=1 pytest-ci
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-examples
-          else
-            make -C bld V=1 examples
-          fi
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@ -10,7 +10,7 @@
 # https://github.com/actions/labeler

 name: Labeler
-'on': [pull_request_target]
+on: [pull_request_target]

 jobs:
  label:
@ -21,6 +21,8 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
-        with:
-          repo-token: '${{ secrets.GITHUB_TOKEN }}'
+    - uses: actions/labeler@v4
+      with:
+        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+        # Workaround for actions/labeler#112
+        sync-labels: ''
--- a/.github/workflows/linkcheck.yml
+++ b/.github/workflows/linkcheck.yml
@ -0,0 +1,36 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Markdown links
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths:
+    - '.github/workflows/linkcheck.yml'
+    - '**.md'
+  pull_request:
+    branches:
+    - master
+    paths:
+    - '.github/workflows/linkcheck.yml'
+    - '**.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  # Docs: https://github.com/marketplace/actions/markdown-link-check
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - uses: gaurav-nelson/github-action-markdown-link-check@v1
+      with:
+        use-quiet-mode: 'yes'
--- a/.github/workflows/linux-old.yml
+++ b/.github/workflows/linux-old.yml
@ -1,148 +0,0 @@
-# Copyright (C) Daniel Fandrich, <dan@coneharvesters.com>, et al.
-#
-# SPDX-License-Identifier: curl
-#
-# Compile on an old version of Linux that has barely the minimal build
-# requirements for CMake. This tests that curl is still usable on really
-# outdated systems.
-#
-# Debian stretch is chosen as it closely matches some of the oldest major
-# versions we support (especially cmake); see docs/INTERNALS.md and it
-# is still supported (as of this writing).
-# stretch has ELTS support from Freexian until 2027-06-30
-# For ELTS info see https://www.freexian.com/lts/extended/docs/how-to-use-extended-lts/
-# The Debian key will expire 2025-05-20, after which package signature
-# verification may need to be disabled.
-# httrack is one of the smallest downloaders, needed to bootstrap ELTS,
-# and won't conflict with the curl we're building.
-
-name: Old Linux
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-
-permissions: {}
-
-env:
-  MAKEFLAGS: -j 5
-  DEBIAN_FRONTEND: noninteractive
-
-jobs:
-  cmake:
-    name: linux (cmake & autoconf)
-    runs-on: 'ubuntu-latest'
-    container: 'debian:stretch'
-
-    steps:
-      - name: 'install prereqs'
-        # Remember, this shell is dash, not bash
-        run: |
-          sed -E -i -e s@[a-z]+\.debian\.org/@archive.debian.org/debian-archive/@ -e '/ stretch-updates /d' /etc/apt/sources.list
-          apt-get -o Dpkg::Use-Pty=0 update
-          # See comment above if this fails after 2025-05-20
-          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends httrack
-          httrack --get https://deb.freexian.com/extended-lts/pool/main/f/freexian-archive-keyring/freexian-archive-keyring_2022.06.08_all.deb
-          dpkg -i freexian-archive-keyring_2022.06.08_all.deb
-          echo 'deb http://deb.freexian.com/extended-lts stretch-lts main contrib non-free' | tee /etc/apt/sources.list.d/extended-lts.list
-          apt-get -o Dpkg::Use-Pty=0 update
-          apt-get -o Dpkg::Use-Pty=0 install -y --no-install-suggests --no-install-recommends cmake make automake autoconf libtool gcc pkg-config libpsl-dev libzstd-dev zlib1g-dev libssl1.0-dev libssh-dev libssh2-1-dev libc-ares-dev heimdal-dev libldap2-dev librtmp-dev stunnel4 groff
-          # GitHub's actions/checkout needs a newer glibc. This one is the
-          # latest available for buster, the next stable release after stretch.
-          httrack --get https://security.debian.org/debian-security/pool/updates/main/g/glibc/libc6_2.28-10+deb10u4_amd64.deb
-          dpkg -i libc6_*_amd64.deb
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'cmake build-only (out-of-tree, libssh2)'
-        run: |
-          mkdir bld-1
-          cd bld-1
-          cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
-            -DENABLE_ARES=OFF -DCURL_ZSTD=OFF -DCURL_USE_GSSAPI=OFF -DCURL_USE_LIBSSH2=ON -DCURL_USE_LIBSSH=OFF -DUSE_LIBRTMP=ON
-          make install
-          src/curl --disable --version
-
-      - name: 'cmake build-only curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld-1/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld-1/lib/curl_config.h | sort || true
-
-      # when this job can get a libssh version 0.9.0 or later, this should get
-      # that enabled again
-      - name: 'cmake generate (out-of-tree, c-ares, zstd, gssapi)'
-        run: |
-          mkdir bld-cares
-          cd bld-cares
-          cmake .. -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON -DBUILD_SHARED_LIBS=ON \
-            -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_LIBRTMP=ON \
-            -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON
-
-      - name: 'cmake curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld-cares/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld-cares/lib/curl_config.h | sort || true
-
-      - name: 'cmake build'
-        run: |
-          make -C bld-cares
-          bld-cares/src/curl --disable --version
-
-      - name: 'cmake install'
-        run: make -C bld-cares install
-
-      - name: 'cmake build tests'
-        run: make -C bld-cares testdeps
-
-      - name: 'cmake run tests'
-        run: make -C bld-cares test-ci
-
-      - name: 'autoreconf'
-        run: autoreconf -if
-
-      - name: 'configure (out-of-tree, c-ares, libssh2, zstd, gssapi)'
-        run: |
-          mkdir bld-am
-          cd bld-am
-          ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-            --with-openssl --enable-ares --with-libssh2 --with-zstd --with-gssapi --with-librtmp \
-            --prefix="$PWD"/../install-am
-
-      - name: 'autoconf curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld-am/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld-am/lib/curl_config.h | sort || true
-
-      - name: 'autoconf build'
-        run: |
-          make -C bld-am
-          bld-am/src/curl --disable --version
-
-      - name: 'autoconf install'
-        run: make -C bld-am install
-
-      - name: 'autoconf build tests'
-        run: make -C bld-am/tests all
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@ -4,30 +4,34 @@

 name: Linux

-'on':
+on:
  push:
    branches:
-      - master
-      - '*/ci'
+    - master
+    - '*/ci'
    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
  pull_request:
    branches:
-      - master
+    - master
    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@ -36,673 +40,294 @@ concurrency:
 permissions: {}

 env:
-  MAKEFLAGS: -j 5
-  CURL_CLANG_TIDYFLAGS: '-checks=-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,-clang-analyzer-valist.Uninitialized'
-  # unhandled
-  bearssl-version: 0.6
-  # renovate: datasource=github-tags depName=libressl-portable/portable versioning=semver registryUrl=https://github.com
-  libressl-version: 4.0.0
-  # renovate: datasource=github-tags depName=wolfSSL/wolfssl versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-  wolfssl-version: 5.7.6
-  # renovate: datasource=github-tags depName=wolfSSL/wolfssh versioning=semver extractVersion=^v?(?<version>.+)-stable$ registryUrl=https://github.com
-  wolfssh-version: 1.4.19
-  # renovate: datasource=github-tags depName=Mbed-TLS/mbedtls versioning=semver registryUrl=https://github.com
-  mbedtls-version: 3.6.2
-  # renovate: datasource=github-tags depName=nibanks/msh3 versioning=semver registryUrl=https://github.com
-  msh3-version: 0.6.0
-  # renovate: datasource=github-tags depName=awslabs/aws-lc versioning=semver registryUrl=https://github.com
-  awslc-version: 1.45.0
-  # handled in renovate.json
-  openssl-version: 3.4.1
-  # handled in renovate.json
-  quictls-version: 3.3.0
-  # renovate: datasource=github-tags depName=rustls/rustls-ffi versioning=semver registryUrl=https://github.com
-  rustls-version: 0.14.1
+  MAKEFLAGS: -j 3

 jobs:
-  linux:
-    name: ${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.build.name }}
-    runs-on: ${{ matrix.build.image || 'ubuntu-latest' }}
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
    container: ${{ matrix.build.container }}
-    timeout-minutes: 45
+    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        build:
-          - name: bearssl
-            install_packages: zlib1g-dev
-            install_steps: bearssl pytest
-            configure: LDFLAGS="-Wl,-rpath,$HOME/bearssl/lib" --with-bearssl=$HOME/bearssl --enable-debug
+        - name: quiche
+          install_packages: zlib1g-dev valgrind
+          install_steps: quiche pytest
+          configure: LDFLAGS="-Wl,-rpath,/home/runner/work/curl/curl/quiche/target/release" --with-openssl=/home/runner/work/curl/curl/quiche/quiche/deps/boringssl/src --enable-debug --with-quiche=/home/runner/work/curl/curl/quiche/target/release

-          - name: bearssl clang
-            install_packages: zlib1g-dev clang
-            install_steps: bearssl
-            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/bearssl/lib" --with-bearssl=$HOME/bearssl --enable-debug
+        - name: bearssl
+          install_packages: zlib1g-dev valgrind
+          install_steps: bearssl pytest
+          configure: LDFLAGS="-Wl,-rpath,$HOME/bear/lib" --with-bearssl=$HOME/bear --enable-debug

-          - name: libressl heimdal
-            install_packages: zlib1g-dev heimdal-dev
-            install_steps: libressl pytest
-            configure: LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --with-gssapi --enable-debug
+        - name: bearssl-clang
+          install_packages: zlib1g-dev clang
+          install_steps: bearssl
+          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/bear/lib" --with-bearssl=$HOME/bear --enable-debug

-          - name: libressl heimdal valgrind
-            install_packages: zlib1g-dev heimdal-dev valgrind
-            install_steps: libressl pytest
-            generate: -DOPENSSL_ROOT_DIR=$HOME/libressl -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LIBCURL_VERSIONED_SYMBOLS=ON
+        - name: libressl
+          install_packages: zlib1g-dev valgrind
+          install_steps: libressl pytest
+          configure: LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug

-          - name: libressl clang
-            install_packages: zlib1g-dev clang
-            install_steps: libressl
-            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug
+        - name: libressl-clang
+          install_packages: zlib1g-dev clang
+          install_steps: libressl
+          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/libressl/lib" --with-openssl=$HOME/libressl --enable-debug

-          - name: wolfssl-all
-            install_packages: zlib1g-dev
-            install_steps: wolfssl-all wolfssh
-            configure: LDFLAGS="-Wl,-rpath,$HOME/wolfssl-all/lib" --with-wolfssl=$HOME/wolfssl-all --with-wolfssh=$HOME/wolfssh --enable-ech --enable-debug
+        - name: mbedtls
+          install_packages: libnghttp2-dev valgrind
+          install_steps: mbedtls pytest
+          configure: LDFLAGS="-Wl,-rpath,$HOME/mbed/lib" --with-mbedtls=$HOME/mbed --enable-debug

-          - name: wolfssl-opensslextra valgrind
-            install_packages: zlib1g-dev valgrind
-            install_steps: wolfssl-opensslextra
-            configure: LDFLAGS="-Wl,-rpath,$HOME/wolfssl-opensslextra/lib" --with-wolfssl=$HOME/wolfssl-opensslextra --enable-debug
+        - name: mbedtls-clang
+          install_packages: libnghttp2-dev clang
+          install_steps: mbedtls
+          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/mbed/lib" --with-mbedtls=$HOME/mbed --enable-debug

-          - name: mbedtls valgrind
-            install_packages: libnghttp2-dev valgrind
-            install_steps: mbedtls pytest
-            configure: LDFLAGS="-Wl,-rpath,$HOME/mbedtls/lib" --with-mbedtls=$HOME/mbedtls --enable-debug
+        - name: msh3
+          install_packages: zlib1g-dev valgrind
+          install_steps: quictls msh3
+          configure: LDFLAGS="-Wl,-rpath,$HOME/msh3/lib -Wl,-rpath,$HOME/quictls/lib" --with-msh3=$HOME/msh3 --with-openssl=$HOME/quictls --enable-debug

-          - name: mbedtls clang
-            install_packages: libnghttp2-dev clang
-            install_steps: mbedtls
-            configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/mbedtls/lib" --with-mbedtls=$HOME/mbedtls --enable-debug
+        - name: openssl3
+          install_packages: zlib1g-dev valgrind
+          install_steps: gcc-11 openssl3 pytest
+          configure: LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib64" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets

-          - name: mbedtls
-            install_packages: libnghttp2-dev
-            install_steps: mbedtls
-            PKG_CONFIG_PATH: '$HOME/mbedtls/lib/pkgconfig'  # Requires v3.6.0 or v2.28.8
-            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON
+        - name: openssl3-O3
+          install_packages: zlib1g-dev valgrind
+          install_steps: gcc-11 openssl3
+          configure: CFLAGS=-O3 LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib64" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets

-          - name: mbedtls-pkg
-            install_packages: libnghttp2-dev libmbedtls-dev
-            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
+        - name: openssl3-clang
+          install_packages: zlib1g-dev clang
+          install_steps: openssl3
+          configure: CC=clang LDFLAGS="-Wl,-rpath,$HOME/openssl3/lib64" --with-openssl=$HOME/openssl3 --enable-debug --enable-websockets

-          - name: mbedtls-pkg !pc
-            install_packages: libnghttp2-dev libmbedtls-dev
-            install_steps: skipall
-            generate: -DCURL_USE_MBEDTLS=ON -DENABLE_DEBUG=ON -DCURL_USE_PKGCONFIG=OFF
+        - name: address-sanitizer
+          install_packages: zlib1g-dev libssh2-1-dev clang libssl-dev libubsan1 libasan8 libtsan2
+          install_steps: pytest
+          configure: >
+            CC=clang
+            CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g"
+            LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer"
+            LIBS="-ldl -lubsan"
+            --with-openssl --enable-debug --enable-websockets

-          - name: msh3
-            install_packages: zlib1g-dev
-            install_steps: quictls msh3
-            configure: LDFLAGS="-Wl,-rpath,$HOME/msh3/lib -Wl,-rpath,$HOME/quictls/lib" --with-msh3=$HOME/msh3 --with-openssl=$HOME/quictls --enable-debug
+        - name: memory-sanitizer
+          install_packages: clang
+          install_steps:
+          configure: >
+            CC=clang
+            CFLAGS="-fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds -g"
+            LDFLAGS="-fsanitize=memory"
+            LIBS="-ldl"
+            --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug --enable-websocketsx

-          - name: msh3
-            install_packages: zlib1g-dev
-            install_steps: quictls msh3 skipall
-            PKG_CONFIG_PATH: '$HOME/msh3/lib/pkgconfig'  # Broken as of v0.6.0
-            generate: -DOPENSSL_ROOT_DIR=$HOME/quictls -DUSE_MSH3=ON -DMSH3_INCLUDE_DIR=$HOME/msh3/include -DMSH3_LIBRARY=$HOME/msh3/lib/libmsh3.so -DENABLE_DEBUG=ON
+        - name: event-based
+          install_packages: libssh-dev valgrind
+          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
+          tflags: -n -e '!TLS-SRP'

-          - name: awslc
-            install_packages: zlib1g-dev
-            install_steps: awslc
-            configure: LDFLAGS="-Wl,-rpath,$HOME/awslc/lib" --with-openssl=$HOME/awslc --enable-ech
+        - name: hyper
+          install_steps: rust hyper valgrind
+          configure: LDFLAGS="-Wl,-rpath,$HOME/hyper/target/debug" --with-openssl --with-hyper=$HOME/hyper --enable-debug --enable-websockets

-          - name: awslc
-            install_packages: zlib1g-dev
-            install_steps: awslc
-            generate: -DOPENSSL_ROOT_DIR=$HOME/awslc -DUSE_ECH=ON -DCMAKE_UNITY_BUILD=OFF
+        - name: rustls
+          install_steps: rust rustls pytest valgrind
+          configure: --with-rustls=$HOME/rustls --enable-debug

-          - name: openssl default
-            install_steps: pytest
-            configure: --with-openssl --enable-debug --disable-unity
+        - name: Intel compiler - without SSL
+          install_packages: zlib1g-dev valgrind
+          install_steps: intel
+          configure: CC=icc --enable-debug --without-ssl

-          - name: openssl libssh2 sync-resolver valgrind
-            install_packages: zlib1g-dev libssh2-1-dev valgrind
-            install_steps: pytest
-            configure: --with-openssl --enable-debug --disable-threaded-resolver --with-libssh2
+        - name: Intel compiler - OpenSSL
+          install_packages: zlib1g-dev libssl-dev valgrind
+          install_steps: intel
+          configure: CC=icc --enable-debug --with-openssl

-          - name: openssl
-            install_packages: zlib1g-dev
-            install_steps: pytest
-            configure: CFLAGS=-std=gnu89 --with-openssl --enable-debug
+        - name: NSS
+          install_packages: clang libnss3-dev libnghttp2-dev nss-plugin-pem
+          configure: CC=clang CPPFLAGS="-isystem /usr/include/nss" --with-nss --enable-debug --with-nss-deprecated

-          - name: openssl -O3 valgrind
-            install_packages: zlib1g-dev valgrind
-            configure: CFLAGS=-O3 --with-openssl --enable-debug
-
-          - name: openssl clang krb5
-            install_packages: zlib1g-dev libkrb5-dev clang
-            configure: CC=clang --with-openssl --with-gssapi --enable-debug --disable-docs --disable-manual
-
-          - name: openssl clang krb5 LTO
-            install_packages: zlib1g-dev libkrb5-dev clang
-            install_steps: skipall
-            generate: -DCURL_USE_OPENSSL=ON -DCURL_USE_GSSAPI=ON -DENABLE_DEBUG=ON -DCURL_LTO=ON
-
-          - name: openssl !ipv6
-            configure: --with-openssl --disable-ipv6 --enable-debug --disable-unity
-
-          - name: openssl https-only
-            configure: >-
-              --with-openssl --enable-debug --disable-unity
-              --disable-dict --disable-gopher --disable-ldap --disable-telnet
-              --disable-imap --disable-pop3 --disable-smtp
-              --disable-rtmp --disable-rtsp
-              --disable-scp --disable-sftp --disable-tftp --disable-ftp --disable-file --disable-smb
-
-          - name: openssl torture !FTP
-            install_packages: zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON
-            tflags: -t --shallow=25 !FTP
-            torture: true
-
-          - name: openssl torture FTP
-            install_packages: zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
-            generate: -DCURL_USE_OPENSSL=ON -DENABLE_DEBUG=ON -DENABLE_ARES=ON
-            tflags: -t --shallow=20 FTP
-            torture: true
-
-          - name: openssl i686
-            install_packages: gcc-14-i686-linux-gnu libssl-dev:i386 librtmp-dev:i386 libssh2-1-dev:i386 libidn2-0-dev:i386 libc-ares-dev:i386 zlib1g-dev:i386
-            configure: >-
-              PKG_CONFIG_PATH=/usr/lib/i386-linux-gnu/pkgconfig
-              CC=i686-linux-gnu-gcc-14
-              CPPFLAGS=-I/usr/include/i386-linux-gnu
-              LDFLAGS=-L/usr/lib/i386-linux-gnu
-              --host=i686-linux-gnu
-              --with-openssl --with-librtmp --with-libssh2 --with-libidn2 --enable-ares --enable-debug
-
-          - name: '!ssl !http !smtp !imap'
-            configure: --without-ssl --enable-debug --disable-http --disable-smtp --disable-imap --disable-unity
-
-          - name: clang-tidy
-            install_packages: clang-tidy libssl-dev libssh2-1-dev
-            install_steps: skipall
-            configure: --with-openssl --with-libssh2
-            make-custom-target: tidy
-
-          - name: scanbuild
-            install_packages: clang-tools clang libssl-dev libssh2-1-dev
-            install_steps: skipall
-            configure: --with-openssl --enable-debug --with-libssh2 --disable-unity
-            configure-prefix: CC=clang scan-build
-            make-prefix: scan-build --status-bugs
-
-          - name: address-sanitizer
-            install_packages: zlib1g-dev libssh2-1-dev clang libssl-dev libubsan1 libasan8 libtsan2
-            install_steps: pytest
-            configure: >-
-              CC=clang
-              CFLAGS="-fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g"
-              LDFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined,integer"
-              LIBS="-ldl -lubsan"
-              --with-openssl --enable-debug
-
-          - name: thread-sanitizer
-            install_packages: zlib1g-dev clang libtsan2
-            install_steps: pytest openssl-tsan
-            configure: >-
-              CC=clang
-              CFLAGS="-fsanitize=thread -g"
-              LDFLAGS="-fsanitize=thread -Wl,-rpath,$HOME/openssl/lib"
-              --with-openssl=$HOME/openssl --enable-debug
-
-          - name: memory-sanitizer
-            install_packages: clang
-            configure: >-
-              CC=clang
-              CFLAGS="-fsanitize=memory -Wformat -Werror=format-security -Werror=array-bounds -g"
-              LDFLAGS="-fsanitize=memory"
-              LIBS="-ldl"
-              --without-ssl --without-zlib --without-brotli --without-zstd --without-libpsl --without-nghttp2 --enable-debug
-
-          - name: event-based
-            install_packages: libssh-dev
-            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
-            tflags: -n --test-event '!TLS-SRP'
-
-          - name: duphandle
-            install_packages: libssh-dev
-            configure: --enable-debug --disable-shared --disable-threaded-resolver --with-libssh --with-openssl
-            tflags: -n --test-duphandle '!TLS-SRP'
-
-          - name: rustls valgrind
-            install_packages: valgrind
-            install_steps: rust rustls pytest
-            configure: --with-rustls=$HOME/rustls --enable-debug
-
-          - name: rustls
-            install_steps: rust rustls skipall
-            PKG_CONFIG_PATH: '$HOME/rustls/lib/pkgconfig'  # Not built as of v0.14.0
-            generate: -DCURL_USE_RUSTLS=ON -DRUSTLS_INCLUDE_DIR=$HOME/rustls/include -DRUSTLS_LIBRARY=$HOME/rustls/lib/librustls.a -DENABLE_DEBUG=ON
-
-          - name: IntelC openssl
-            install_packages: zlib1g-dev libssl-dev
-            install_steps: intel
-            configure: CC=icc --enable-debug --with-openssl
-
-          - name: Slackware openssl gssapi gcc
-            # These are essentially the same flags used to build the curl Slackware package
-            # https://ftpmirror.infania.net/slackware/slackware64-current/source/n/curl/curl.SlackBuild
-            configure: --with-openssl --with-libssh2 --with-gssapi --enable-ares --enable-static=no --without-ca-bundle --with-ca-path=/etc/ssl/certs
-            # Docker Hub image that `container-job` executes in
-            container: 'andy5995/slackware-build-essential:15.0'
-
-          - name: Alpine MUSL https-rr
-            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --enable-threaded-resolver --enable-ares --enable-httpsrr
-            container: 'alpine:3.20'
-
-          - name: Alpine MUSL c-ares https-rr
-            configure: --enable-debug --with-ssl --with-libssh2 --with-libidn2 --with-gssapi --enable-ldap --with-libpsl --disable-threaded-resolver --enable-ares --enable-httpsrr --disable-unity
-            container: 'alpine:3.20'
+        - name: Slackware-openssl-with-gssapi-gcc
+          # These are essentially the same flags used to build the curl Slackware package
+          # https://ftpmirror.infania.net/slackware/slackware64-current/source/n/curl/curl.SlackBuild
+          configure: --with-openssl --with-libssh2 --with-gssapi --enable-ares --enable-static=no --without-ca-bundle --with-ca-path=/etc/ssl/certs
+          # Docker Hub image that `container-job` executes in
+          container: 'andy5995/slackware-build-essential:15.0'

    steps:
-      - name: 'install prereqs'
-        if: matrix.build.container == null && !contains(matrix.build.name, 'i686')
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake pkgconf ninja-build \
-            ${{ matrix.build.install_steps != 'skipall' && matrix.build.install_steps != 'skiprun' && 'stunnel4' || '' }} \
-            libpsl-dev libbrotli-dev libzstd-dev \
-            ${{ matrix.build.install_packages }} \
-            ${{ contains(matrix.build.install_steps, 'pytest') && 'apache2 apache2-dev libnghttp2-dev vsftpd' || '' }}
-          python3 -m venv $HOME/venv
+    - if: ${{ matrix.build.container == null }}
+      run: |
+        sudo apt-get update
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 libpsl-dev libbrotli-dev libzstd-dev ${{ matrix.build.install_packages }}
+        sudo python3 -m pip install impacket
+      name: 'install prereqs and impacket'

-      - name: 'install prereqs'
-        if: contains(matrix.build.name, 'i686')
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo dpkg --add-architecture i386
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install \
-            libtool autoconf automake pkgconf stunnel4 \
-            libpsl-dev:i386 libbrotli-dev:i386 libzstd-dev:i386 \
-            ${{ matrix.build.install_packages }}
-          python3 -m venv $HOME/venv
+    - uses: actions/checkout@v3

-      - name: 'install dependencies'
-        if: startsWith(matrix.build.container, 'alpine')
-        run: |
-          apk add --no-cache build-base autoconf automake libtool perl openssl-dev \
-            libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev \
-            heimdal-dev libpsl-dev c-ares-dev \
-            py3-impacket py3-asn1 py3-six py3-pycryptodomex \
-            perl-time-hires openssh stunnel sudo git
+    - if: ${{ contains(matrix.build.install_steps, 'gcc-11') }}
+      run: |
+        sudo add-apt-repository ppa:ubuntu-toolchain-r/ppa
+        sudo apt-get update
+        sudo apt-get install gcc-11
+        sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 100
+        sudo update-alternatives --set gcc /usr/bin/gcc-11
+        gcc --version
+      name: 'install gcc-11'

-      - name: 'cache bearssl'
-        if: contains(matrix.build.install_steps, 'bearssl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-bearssl
-        env:
-          cache-name: cache-bearssl
-        with:
-          path: ~/bearssl
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.bearssl-version }}
+    - if: ${{ contains(matrix.build.install_steps, 'bearssl') }}
+      run: |
+        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://bearssl.org/bearssl-0.6.tar.gz
+        tar -xzf bearssl-0.6.tar.gz
+        cd bearssl-0.6
+        make
+        mkdir -p $HOME/bear/lib $HOME/bear/include
+        cp inc/*.h $HOME/bear/include
+        cp build/libbearssl.* $HOME/bear/lib
+      name: 'install bearssl'

-      - name: 'build bearssl'
-        if: contains(matrix.build.install_steps, 'bearssl') && steps.cache-bearssl.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://bearssl.org/bearssl-${{ env.bearssl-version }}.tar.gz
-          tar -xzf bearssl-${{ env.bearssl-version }}.tar.gz
-          cd bearssl-${{ env.bearssl-version }}
-          make
-          mkdir -p $HOME/bearssl/lib $HOME/bearssl/include
-          cp inc/*.h $HOME/bearssl/include
-          cp build/libbearssl.* $HOME/bearssl/lib
+    - if: ${{ contains(matrix.build.install_steps, 'libressl') }}
+      run: |
+        git clone --quiet --depth=1 -b v3.6.1 https://github.com/libressl-portable/portable.git libressl-git
+        cd libressl-git
+        ./autogen.sh
+        ./configure --prefix=$HOME/libressl
+        make install
+      name: 'install libressl'

-      - name: 'cache libressl'
-        if: contains(matrix.build.install_steps, 'libressl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-libressl
-        env:
-          cache-name: cache-libressl
-        with:
-          path: ~/libressl
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.libressl-version }}
+    - if: ${{ contains(matrix.build.install_steps, 'quiche') }}
+      run: |
+        git clone --quiet --depth=1 --recursive https://github.com/cloudflare/quiche.git
+        cd quiche
+        #### Work-around https://github.com/curl/curl/issues/7927 #######
+        #### See https://github.com/alexcrichton/cmake-rs/issues/131 ####
+        sed -i -e 's/cmake = "0.1"/cmake = "=0.1.45"/' quiche/Cargo.toml

-      - name: 'build libressl'
-        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/libressl/portable/releases/download/v${{ env.libressl-version }}/libressl-${{ env.libressl-version }}.tar.gz
-          tar -xzf libressl-${{ env.libressl-version }}.tar.gz
-          cd libressl-${{ env.libressl-version }}
-          ./configure --disable-dependency-tracking --prefix=$HOME/libressl
-          make install
+        # /home/runner/work/curl/curl/boringssl

-      - name: 'cache wolfssl (all)'
-        if: contains(matrix.build.install_steps, 'wolfssl-all')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssl-all
-        env:
-          cache-name: cache-wolfssl-all
-        with:
-          path: ~/wolfssl-all
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
+        cargo build -v --package quiche --release --features ffi,pkg-config-meta,qlog --verbose
+        mkdir -v quiche/deps/boringssl/src/lib
+        ln -vnf $(find target/release -name libcrypto.a -o -name libssl.a) quiche/deps/boringssl/src/lib/

-      - name: 'build wolfssl (all)'
-        if: contains(matrix.build.install_steps, 'wolfssl-all') && steps.cache-wolfssl-all.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/wolfSSL/wolfssl/archive/v${{ env.wolfssl-version }}-stable.tar.gz
-          tar -xzf v${{ env.wolfssl-version }}-stable.tar.gz
-          cd wolfssl-${{ env.wolfssl-version }}-stable
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-all \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=$HOME/wolfssl-all
-          make install
+        # include dir
+        # /home/runner/work/curl/curl/quiche/quiche/deps/boringssl/src/include
+        # lib dir
+        # /home/runner/work/curl/curl/quiche/quiche/deps/boringssl/src/lib

-      - name: 'cache wolfssl (opensslextra)'
-        if: contains(matrix.build.install_steps, 'wolfssl-opensslextra')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssl-opensslextra
-        env:
-          cache-name: cache-wolfssl-opensslextra
-        with:
-          path: ~/wolfssl-opensslextra
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssl-version }}
+      name: 'build quiche and boringssl'

-      - name: 'build wolfssl (opensslextra)'
-        if: contains(matrix.build.install_steps, 'wolfssl-opensslextra') && steps.cache-wolfssl-opensslextra.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/wolfSSL/wolfssl/archive/v${{ env.wolfssl-version }}-stable.tar.gz
-          tar -xzf v${{ env.wolfssl-version }}-stable.tar.gz
-          cd wolfssl-${{ env.wolfssl-version }}-stable
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --enable-tls13 --enable-harden --enable-opensslextra \
-            --disable-benchmark --disable-crypttests --disable-examples --prefix=$HOME/wolfssl-opensslextra
-          make install
+    - if: ${{ contains(matrix.build.install_steps, 'mbedtls') }}
+      run: |
+        git clone --quiet --depth=1 -b v3.3.0 https://github.com/ARMmbed/mbedtls
+        cd mbedtls
+        make DESTDIR=$HOME/mbed install
+      name: 'install mbedtls'

-      - name: 'cache wolfssh'
-        if: contains(matrix.build.install_steps, 'wolfssl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-wolfssh
-        env:
-          cache-name: cache-wolfssh
-        with:
-          path: ~/wolfssh
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.wolfssh-version }}-${{ env.wolfssl-version }}
+    - if: ${{ contains(matrix.build.install_steps, 'openssl3') }}
+      run: |
+        git clone --quiet --depth=1 https://github.com/openssl/openssl
+        cd openssl
+        ./config enable-tls1_3 --prefix=$HOME/openssl3
+        make -j1 install_sw
+      name: 'install openssl'

-      - name: 'build wolfssh'
-        if: contains(matrix.build.install_steps, 'wolfssh') && steps.cache-wolfssh.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/wolfSSL/wolfssh/archive/v${{ env.wolfssh-version }}-stable.tar.gz
-          tar -xzf v${{ env.wolfssh-version }}-stable.tar.gz
-          cd wolfssh-${{ env.wolfssh-version }}-stable
-          ./autogen.sh
-          ./configure --disable-dependency-tracking --with-wolfssl=$HOME/wolfssl-all --enable-scp --enable-sftp --disable-term \
-            --disable-examples --prefix=$HOME/wolfssh
-          make install
+    - if: ${{ contains(matrix.build.install_steps, 'quictls') }}
+      run: |
+        git clone --quiet --depth=1 -b OpenSSL_1_1_1t+quic https://github.com/quictls/openssl
+        cd openssl
+        ./config enable-tls1_3 --prefix=$HOME/quictls
+        make -j1 install_sw
+      name: 'install quictls'

-      - name: 'cache mbedtls'
-        if: contains(matrix.build.install_steps, 'mbedtls')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-mbedtls
-        env:
-          cache-name: cache-mbedtls-threadsafe
-        with:
-          path: ~/mbedtls
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.mbedtls-version }}
+    - if: ${{ contains(matrix.build.install_steps, 'msh3') }}
+      run: |
+        git clone --quiet -b v0.6.0 --depth=1 --recursive https://github.com/nibanks/msh3
+        cd msh3 && mkdir build && cd build
+        cmake -G 'Unix Makefiles' -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=$HOME/msh3 ..
+        cmake --build .
+        cmake --install .
+      name: 'install msh3'

-      - name: 'build mbedtls'
-        if: contains(matrix.build.install_steps, 'mbedtls') && steps.cache-mbedtls.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${{ env.mbedtls-version }}/mbedtls-${{ env.mbedtls-version }}.tar.bz2
-          tar -xjf mbedtls-${{ env.mbedtls-version }}.tar.bz2
-          cd mbedtls-${{ env.mbedtls-version }}
-          ./scripts/config.py set MBEDTLS_THREADING_C
-          ./scripts/config.py set MBEDTLS_THREADING_PTHREAD
-          cmake -B . -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_INSTALL_PREFIX=$HOME/mbedtls \
-            -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF
-          cmake --build .
-          cmake --install .
+    - if: ${{ contains(matrix.build.install_steps, 'rust') }}
+      run: |
+        cd $HOME
+        curl -sSf --compressed https://sh.rustup.rs/ | sh -s -- -y
+        source $HOME/.cargo/env
+        rustup toolchain install nightly
+      name: 'install rust'

-      - name: 'cache openssl (thread sanitizer)'
-        if: contains(matrix.build.install_steps, 'openssl-tsan')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-openssl-tsan
-        env:
-          cache-name: cache-openssl-tsan
-        with:
-          path: ~/openssl
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.openssl-version }}
+    - if: ${{ contains(matrix.build.install_steps, 'rustls') }}
+      run: |
+        git clone --quiet --depth=1 -b v0.10.0 --recursive https://github.com/rustls/rustls-ffi.git
+        cd rustls-ffi
+        make DESTDIR=$HOME/rustls install
+      name: 'install rustls'

-      - name: 'build openssl (thread sanitizer)'
-        if: contains(matrix.build.install_steps, 'openssl-tsan') && steps.cache-openssl-tsan.outputs.cache-hit != 'true'
-        run: |
-          git clone --quiet --depth=1 -b openssl-${{ env.openssl-version }} https://github.com/openssl/openssl
-          cd openssl
-          CC="clang" CFLAGS="-fsanitize=thread" LDFLAGS="-fsanitize=thread" ./config --prefix=$HOME/openssl --libdir=lib no-makedepend no-apps no-docs no-tests
-          make
-          make -j1 install_sw
+    - if: ${{ contains(matrix.build.install_steps, 'hyper') }}
+      run: |
+        cd $HOME
+        git clone --quiet --depth=1 https://github.com/hyperium/hyper.git
+        cd $HOME/hyper
+        RUSTFLAGS="--cfg hyper_unstable_ffi" cargo +nightly rustc --features client,http1,http2,ffi -Z unstable-options --crate-type cdylib
+        echo "LD_LIBRARY_PATH=$HOME/hyper/target/debug:/usr/local/lib" >> $GITHUB_ENV
+      name: 'install hyper'

-      - name: 'cache quictls'
-        if: contains(matrix.build.install_steps, 'quictls')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-quictls
-        env:
-          cache-name: cache-quictls
-        with:
-          path: ~/quictls
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.quictls-version }}-quic1
+    - if: ${{ contains(matrix.build.install_steps, 'intel') }}
+      run: |
+        cd /tmp
+        curl -sSf --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | sudo apt-key add -
+        sudo add-apt-repository "deb https://apt.repos.intel.com/oneapi all main"
+        sudo apt install --no-install-recommends intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
+        source /opt/intel/oneapi/setvars.sh
+        printenv >> $GITHUB_ENV
+      name: 'install Intel compilers'

-      - name: 'build quictls'
-        if: contains(matrix.build.install_steps, 'quictls') && steps.cache-quictls.outputs.cache-hit != 'true'
-        run: |
-          git clone --quiet --depth=1 -b openssl-${{ env.quictls-version }}-quic1 https://github.com/quictls/openssl
-          cd openssl
-          ./config --prefix=$HOME/quictls --libdir=lib no-makedepend no-apps no-docs no-tests
-          make
-          make -j1 install_sw
+    - if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+      run: |
+        sudo apt-get install apache2 apache2-dev libnghttp2-dev
+        sudo python3 -m pip install -r tests/http/requirements.txt
+        git clone --quiet --depth=1 -b master https://github.com/icing/mod_h2
+        cd mod_h2
+        autoreconf -fi
+        ./configure PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig"
+        make
+        sudo make install
+      name: 'install pytest and apach2-dev mod-h2'

-      - name: 'cache msh3'
-        if: contains(matrix.build.install_steps, 'msh3')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-msh3
-        env:
-          cache-name: cache-msh3
-        with:
-          path: ~/msh3
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.msh3-version }}
+    - run: autoreconf -fi
+      name: 'autoreconf'

-      - name: 'build msh3'
-        if: contains(matrix.build.install_steps, 'msh3') && steps.cache-msh3.outputs.cache-hit != 'true'
-        run: |
-          git clone --quiet --depth=1 -b v${{ env.msh3-version }} --recursive https://github.com/nibanks/msh3
-          cd msh3
-          cmake -B . -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=$HOME/msh3
-          cmake --build .
-          cmake --install .
+    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
+      name: 'configure'

-      - name: 'cache awslc'
-        if: contains(matrix.build.install_steps, 'awslc')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-awslc
-        env:
-          cache-name: cache-awslc
-        with:
-          path: ~/awslc
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.awslc-version }}
+    - run: make V=1
+      name: 'make'

-      - name: 'build awslc'
-        if: contains(matrix.build.install_steps, 'awslc') && steps.cache-awslc.outputs.cache-hit != 'true'
-        run: |
-          curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/awslabs/aws-lc/archive/refs/tags/v${{ env.awslc-version }}.tar.gz
-          tar xzf v${{ env.awslc-version }}.tar.gz
-          mkdir aws-lc-${{ env.awslc-version }}-build
-          cd aws-lc-${{ env.awslc-version }}-build
-          cmake -G Ninja -DCMAKE_INSTALL_PREFIX=$HOME/awslc ../aws-lc-${{ env.awslc-version }} -DBUILD_TOOL=OFF -DBUILD_TESTING=OFF
-          cmake --build .
-          cmake --install .
+    - run: ./src/curl -V
+      name: 'check curl -V output'

-      - name: 'cache rustls'
-        if: contains(matrix.build.install_steps, 'rustls')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-rustls
-        env:
-          cache-name: cache-rustls
-        with:
-          path: ~/rustls
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.rustls-version }}
+    - run: make V=1 examples
+      name: 'make examples'

-      - name: 'install rust'
-        if: contains(matrix.build.install_steps, 'rust') && steps.cache-rustls.outputs.cache-hit != 'true'
-        run: |
-          cd $HOME
-          curl -sSf --compressed https://sh.rustup.rs/ | sh -s -- -y
-          source $HOME/.cargo/env
-          rustup toolchain install stable --profile minimal
+    - run: make V=1 -C tests
+      name: 'make tests'

-      - name: 'build rustls'
-        if: contains(matrix.build.install_steps, 'rustls') && steps.cache-rustls.outputs.cache-hit != 'true'
-        run: |
-          git clone --quiet --depth=1 -b v${{ env.rustls-version }} --recursive https://github.com/rustls/rustls-ffi.git
-          cd rustls-ffi
-          make DESTDIR=$HOME/rustls install
+    - run: make V=1 test-ci
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"

-      - name: 'install Intel compilers'
-        if: contains(matrix.build.install_steps, 'intel')
-        run: |
-          curl -sSf --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | sudo tee /etc/apt/trusted.gpg.d/intel-sw.asc >/dev/null
-          sudo add-apt-repository "deb https://apt.repos.intel.com/oneapi all main"
-          sudo apt-get -o Dpkg::Use-Pty=0 install intel-oneapi-compiler-dpcpp-cpp-and-cpp-classic
-          source /opt/intel/oneapi/setvars.sh
-          printenv >> $GITHUB_ENV
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          [[ '${{ matrix.build.install_steps }}' = *'awslc'* ]] && sudo apt-get -o Dpkg::Use-Pty=0 purge libssl-dev
-          if [ -n '${{ matrix.build.PKG_CONFIG_PATH }}' ]; then
-            export PKG_CONFIG_PATH="${{ matrix.build.PKG_CONFIG_PATH }}"
-          fi
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_INSTALL_PREFIX="$HOME/curl" \
-              -DCMAKE_C_COMPILER_TARGET=$(uname -m)-pc-linux-gnu -DBUILD_STATIC_LIBS=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              ${{ matrix.build.generate }}
-          else
-            mkdir bld && cd bld && \
-            ${{ matrix.build.configure-prefix }} \
-            ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              ${{ matrix.build.configure }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'test configs'
-        run: grep -H -v '^#' bld/tests/config bld/tests/http/config.ini || true
-
-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            ${{ matrix.build.make-prefix }} cmake --build bld --verbose
-          else
-            ${{ matrix.build.make-prefix }} make -C bld V=1 ${{ matrix.build.make-custom-target }}
-          fi
-
-      - name: 'single-use function check'
-        if: ${{ contains(matrix.build.configure, '--disable-unity') || contains(matrix.build.generate, '-DCMAKE_UNITY_BUILD=OFF') }}
-        run: |
-          git config --global --add safe.directory "*"
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            libcurla=bld/lib/libcurl.a
-          else
-            libcurla=bld/lib/.libs/libcurl.a
-          fi
-          ./scripts/singleuse.pl --unit ${libcurla}
-
-      - name: 'check curl -V output'
-        if: ${{ matrix.build.make-custom-target != 'tidy' }}
-        run: bld/src/curl -V
-
-      - name: 'cmake install'
-        if: ${{ matrix.build.generate }}
-        run: cmake --install bld --strip
-
-      - name: 'build tests'
-        if: ${{ matrix.build.install_steps != 'skipall' }}
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'install test prereqs'
-        if: ${{ matrix.build.install_steps != 'skipall' && matrix.build.container == null }}
-        run: |
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/requirements.txt
-
-      - name: 'run tests'
-        if: ${{ matrix.build.install_steps != 'skipall' && matrix.build.install_steps != 'skiprun' }}
-        timeout-minutes: ${{ contains(matrix.build.install_packages, 'valgrind') && 30 || 15 }}
-        run: |
-          export TFLAGS='${{ matrix.build.tflags }}'
-          if [ -z '${{ matrix.build.torture }}' ]; then
-            if [[ '${{ matrix.build.install_steps }}' = *'wolfssh'* ]]; then
-              TFLAGS+=' ~SFTP'
-            fi
-            if [[ '${{ matrix.build.install_packages }}' = *'valgrind'* ]]; then
-              TFLAGS+=' -j6'
-            fi
-            if [[ '${{ matrix.build.install_packages }}' = *'heimdal-dev'* ]]; then
-              TFLAGS+=' ~2077 ~2078'  # valgrind errors
-            fi
-          fi
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          else
-            make -C bld V=1 ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          fi
-
-      - name: 'install pytest prereqs'
-        if: contains(matrix.build.install_steps, 'pytest')
-        run: |
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/http/requirements.txt
-
-      - name: 'run pytest'
-        if: contains(matrix.build.install_steps, 'pytest')
-        env:
-          CURL_CI: github
-          PYTEST_ADDOPTS: '--color=yes'
-        run: |
-          [ -x "$HOME/venv/bin/activate" ] && source $HOME/venv/bin/activate
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-pytest-ci
-          else
-            make -C bld V=1 pytest-ci
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build.make-custom-target != 'tidy' }}
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            ${{ matrix.build.make-prefix }} cmake --build bld --verbose --target curl-examples
-          else
-            ${{ matrix.build.make-prefix }} make -C bld V=1 examples
-          fi
+    - if: ${{ contains(matrix.build.install_steps, 'pytest') }}
+      # run for `tests` directory, so pytest does not pick up any other
+      # packages we might have built here
+      run:
+        pytest -v tests
+      name: 'run pytest'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@ -4,30 +4,34 @@

 name: macOS

-'on':
+on:
  push:
    branches:
-      - master
-      - '*/ci'
+    - master
+    - '*/ci'
    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
  pull_request:
    branches:
-      - master
+    - master
    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
+    - '**/*.md'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@ -35,466 +39,170 @@ concurrency:

 permissions: {}

-# Deprecated Apple APIs and the macos-version-min value required to avoid
-# deprecation warnings with llvm/clang:
-#
-# - 10.7  Lion (2011)          - GSS
-# - 10.8  Mountain Lion (2012) - CFURLCreateDataAndPropertiesFromResource (used by curl Secure Transport code)
-# - 10.9  Maverick (2013)      - LDAP
-# - 10.14 Mojave (2018)        - Secure Transport
-#
-# For Secure Transport, curl implements features that require a target
-# newer than the 10.8 required by `CFURLCreateDataAndPropertiesFromResource`.
-
 env:
-  MAKEFLAGS: -j 4
-  LDFLAGS: -w  # suppress 'object file was built for newer macOS version than being linked' warnings
+  DEVELOPER_DIR: /Applications/Xcode_14.0.1.app/Contents/Developer
+  MAKEFLAGS: -j 5

 jobs:
-  macos:
-    name: "${{ matrix.build.generate && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.build.name }}"
+  autotools:
+    name: ${{ matrix.build.name }}
    runs-on: 'macos-latest'
-    timeout-minutes: 45
-    env:
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.compiler }}
-      CFLAGS: ''
+    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
-        compiler: [clang, llvm@15, gcc-12]
        build:
-          # automake
-          - name: '!ssl !debug brotli zstd'
-            compiler: clang
-            install: brotli zstd
-            configure: --without-ssl --with-brotli --with-zstd
-          - name: '!ssl !debug'
-            compiler: gcc-12
-            configure: --without-ssl
-          - name: '!ssl'
-            compiler: clang
-            configure: --enable-debug --without-ssl
-          - name: '!ssl libssh2 AppleIDN'
-            compiler: clang
-            configure: --enable-debug --with-libssh2=$(brew --prefix libssh2) --without-ssl --with-apple-idn
-          - name: 'OpenSSL libssh c-ares'
-            compiler: clang
-            install: libssh
-            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl) --enable-ares
-          - name: 'OpenSSL libssh'
-            compiler: llvm@15
-            install: libssh
-            configure: --enable-debug --with-libssh --with-openssl=$(brew --prefix openssl)
-          - name: '!ssl c-ares'
-            compiler: clang
-            configure: --enable-debug --enable-ares --without-ssl
-          - name: '!ssl HTTP-only'
-            compiler: clang
-            configure: >-
-              --enable-debug
-              --disable-alt-svc --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap
-              --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp
-              --disable-shared --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets
-              --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2
-              --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib --without-zstd
-
-            macos-version-min: '10.15'  # Catalina (2019)
-          - name: 'SecureTransport libssh2'
-            compiler: clang
-            configure: --enable-debug --with-secure-transport --with-libssh2=$(brew --prefix libssh2)
-            macos-version-min: '10.8'
-          - name: 'SecureTransport libssh2 10.12'
-            compiler: clang
-            configure: --enable-debug --with-secure-transport --with-libssh2=$(brew --prefix libssh2)
-            macos-version-min: '10.12'  # for monotonic timers
-          - name: 'SecureTransport libssh2'
-            compiler: gcc-12
-            configure: --enable-debug --with-secure-transport --with-libssh2=$(brew --prefix libssh2)
-            macos-version-min: '10.8'
-          - name: 'LibreSSL +examples'
-            compiler: clang
-            install: libressl
-            configure: --enable-debug --with-openssl=$(brew --prefix libressl)
-          - name: 'OpenSSL'
-            compiler: clang
-            configure: --enable-debug --with-openssl=$(brew --prefix openssl)
-          - name: 'OpenSSL event-based'
-            compiler: clang
-            configure: --enable-debug --with-openssl=$(brew --prefix openssl)
-            tflags: --test-event
-          - name: 'quictls libssh2 !ldap 10.15'
-            compiler: clang
-            install: quictls
-            configure: --enable-debug --disable-ldap --with-openssl=$(brew --prefix quictls) LDFLAGS="${LDFLAGS} -L$(brew --prefix quictls)/lib"
-            macos-version-min: '10.15'
-          # cmake
-          - name: 'OpenSSL gsasl rtmp AppleIDN'
-            install: gsasl rtmpdump
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DCURL_USE_GSASL=ON -DUSE_LIBRTMP=ON -DUSE_APPLE_IDN=ON
-          - name: 'OpenSSL AppleIDN clang-tidy +examples'
-            install: llvm
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix openssl) -DUSE_APPLE_IDN=ON -DCURL_CLANG_TIDY=ON -DCLANG_TIDY=$(brew --prefix llvm)/bin/clang-tidy
-            clang-tidy: true
-            chkprefill: _chkprefill
-          - name: 'quictls +static libssh +examples'
-            install: quictls libssh
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix quictls) -DBUILD_STATIC_LIBS=ON -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON
-          - name: 'SecureTransport debug'
-            generate: -DCURL_USE_SECTRANSP=ON -DENABLE_DEBUG=ON
-            macos-version-min: '10.8'
-          - name: 'LibreSSL !ldap heimdal c-ares +examples'
-            install: libressl heimdal
-            generate: -DOPENSSL_ROOT_DIR=$(brew --prefix libressl) -DENABLE_ARES=ON -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=$(brew --prefix heimdal) -DCURL_DISABLE_LDAP=ON
-          - name: 'wolfSSL !ldap brotli zstd'
-            install: brotli wolfssl zstd
-            generate: -DCURL_USE_WOLFSSL=ON -DCURL_DISABLE_LDAP=ON -DUSE_ECH=ON
-          - name: 'mbedTLS openldap brotli zstd'
-            install: brotli mbedtls zstd openldap
-            generate: -DCURL_USE_MBEDTLS=ON -DLDAP_INCLUDE_DIR="$(brew --prefix openldap)/include" -DLDAP_LIBRARY="$(brew --prefix openldap)/lib/libldap.dylib" -DLDAP_LBER_LIBRARY="$(brew --prefix openldap)/lib/liblber.dylib"
-          - name: 'GnuTLS !ldap krb5'
-            install: gnutls nettle krb5
-            generate: -DCURL_USE_GNUTLS=ON -DCURL_USE_OPENSSL=OFF -DCURL_USE_GSSAPI=ON -DGSS_ROOT_DIR=$(brew --prefix krb5) -DCURL_DISABLE_LDAP=ON -DUSE_SSLS_EXPORT=ON
-          - name: 'OpenSSL torture !FTP'
-            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=$(brew --prefix openssl)
-            tflags: -t --shallow=25 !FTP
-            torture: true
-          - name: 'OpenSSL torture FTP'
-            generate: -DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DENABLE_THREADED_RESOLVER=OFF -DOPENSSL_ROOT_DIR=$(brew --prefix openssl)
-            tflags: -t --shallow=20 FTP
-            torture: true
-        exclude:
-          - { compiler: llvm@15, build: { macos-version-min: '10.15' } }
-          - { compiler: llvm@15, build: { torture: true } }
-          - { compiler: gcc-12, build: { torture: true } }
-          - { compiler: llvm@15, build: { clang-tidy: true } }
-          - { compiler: gcc-12, build: { clang-tidy: true } }
-          # opt out jobs from combinations that have the compiler set manually
-          - { compiler: llvm@15, build: { compiler: 'clang' } }
-          - { compiler: llvm@15, build: { compiler: 'gcc-12' } }
-          - { compiler: gcc-12, build: { compiler: 'clang' } }
-          - { compiler: gcc-12, build: { compiler: 'llvm@15' } }
-          - { compiler: clang, build: { compiler: 'gcc-12' } }
-          - { compiler: clang, build: { compiler: 'llvm@15' } }
-
+        - name: normal
+          install: nghttp2
+          configure: --without-ssl
+          macosx-version-min: 10.9
+        - name: debug
+          install: nghttp2
+          configure: --enable-debug --without-ssl
+          macosx-version-min: 10.9
+        - name: libssh2
+          install: nghttp2 libssh2
+          configure: --enable-debug --with-libssh2 --without-ssl
+          macosx-version-min: 10.9
+        - name: libssh-c-ares
+          install: openssl nghttp2 libssh
+          configure: --enable-debug --with-libssh --with-openssl=/usr/local/opt/openssl --enable-ares
+          macosx-version-min: 10.9
+        - name: libssh
+          install: openssl nghttp2 libssh
+          configure: --enable-debug --with-libssh --with-openssl=/usr/local/opt/openssl
+          macosx-version-min: 10.9
+        - name: c-ares
+          install: nghttp2
+          configure: --enable-debug --enable-ares --without-ssl
+          macosx-version-min: 10.9
+        - name: HTTP only
+          install: nghttp2
+          configure: --enable-debug --enable-maintainer-mode --disable-dict --disable-file --disable-ftp --disable-gopher --disable-imap --disable-ldap --disable-pop3 --disable-rtmp --disable-rtsp --disable-scp --disable-sftp --disable-smb --disable-smtp --disable-telnet --disable-tftp --disable-unix-sockets --disable-shared --without-brotli --without-gssapi --without-libidn2 --without-libpsl --without-librtmp --without-libssh2 --without-nghttp2 --without-ntlm-auth --without-ssl --without-zlib
+          macosx-version-min: 10.15
+        - name: SecureTransport http2
+          install: nghttp2
+          configure: --enable-debug --with-secure-transport
+          macosx-version-min: 10.8
+        - name: gcc SecureTransport
+          configure: CC=gcc-12 --enable-debug --with-secure-transport
+          macosx-version-min: 10.8
+        - name: OpenSSL http2
+          install: nghttp2 openssl
+          configure: --enable-debug --with-openssl=/usr/local/opt/openssl
+          macosx-version-min: 10.9
+        - name: LibreSSL http2
+          install: nghttp2 libressl
+          configure: --enable-debug --with-openssl=/usr/local/opt/libressl
+          macosx-version-min: 10.9
+        - name: torture
+          install: nghttp2 openssl
+          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/usr/local/opt/openssl
+          tflags: -n -t --shallow=25 !FTP
+          macosx-version-min: 10.9
+        - name: torture-ftp
+          install: nghttp2 openssl
+          configure: --enable-debug --disable-shared --disable-threaded-resolver --with-openssl=/usr/local/opt/openssl
+          tflags: -n -t --shallow=20 FTP
+          macosx-version-min: 10.9
+        - name: macOS 10.15
+          install: nghttp2 libssh2 openssl
+          configure: --enable-debug --disable-ldap --with-openssl=/usr/local/opt/openssl
+          macosx-version-min: 10.15
    steps:
-      - name: 'brew install'
-        # Run this command with retries because of spurious failures seen
-        # while running the tests, for example
-        # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
-        run: |
-          echo ${{ matrix.build.generate && 'ninja' || 'automake libtool' }} \
-            pkgconf libpsl libssh2 \
-            ${{ !matrix.build.clang-tidy && 'libnghttp2 stunnel' || '' }} \
-            ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
+    - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+      name: 'brew bundle'

-      - name: 'brew unlink openssl'
-        if: ${{ contains(matrix.build.install, 'libressl') || contains(matrix.build.install, 'quictls') }}
-        run: |
-          if test -d $(brew --prefix)/include/openssl; then
-            brew unlink openssl
-          fi
+    # Run this command with retries because of spurious failures seen
+    # while running the tests, for example
+    # https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
+    - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
+      name: 'brew install'

-      - name: 'toolchain versions'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && "${CC}" --print-sysroot
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
-          xcrun --sdk macosx --show-sdk-version || true
-          ls -l /Library/Developer/CommandLineTools/SDKs || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages installed'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
+    - run: |
+        case "${{ matrix.build.install }}" in
+          *openssl*)
+            ;;
+          *)
+            if test -d /usr/local/include/openssl; then
+              brew unlink openssl
+            fi;;
+        esac
+      name: 'brew unlink openssl'

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+    - run: python3 -m pip install impacket
+      name: 'pip3 install'

-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
+    - uses: actions/checkout@v3

-      - name: 'configure'
-        run: |
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
-          else
-            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
-          fi
+    - run: autoreconf -fi
+      name: 'autoreconf'

-          if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-            CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-            CC+=" --sysroot=${sysroot}"
-            CC+=" --target=$(uname -m)-apple-darwin"
-          fi
+    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}  --enable-websockets
+      name: 'configure'
+      env:
+        CFLAGS: "-mmacosx-version-min=${{ matrix.build.macosx-version-min }}"

-          if [ -n '${{ matrix.build.generate }}' ]; then
-            for _chkprefill in '' ${{ matrix.build.chkprefill }}; do
-              options=''
-              [ -n '${{ matrix.build.macos-version-min }}' ] && options+=' -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.build.macos-version-min }}'
-              [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
-              cmake -B "bld${_chkprefill}" -G Ninja -D_CURL_PREFILL=ON \
-                -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-                -DCMAKE_OSX_SYSROOT="${sysroot}" \
-                -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-                ${{ matrix.build.generate }} ${options}
-            done
-            if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
-              echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
-              false
-            fi
-          else
-            export CFLAGS
-            if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-              options+=" --target=$(uname -m)-apple-darwin"
-            fi
-            if [ '${{ matrix.compiler }}' != 'clang' ]; then
-              options+=" --with-sysroot=${sysroot}"
-              CFLAGS+=" --sysroot=${sysroot}"
-            fi
-            [ -n '${{ matrix.build.macos-version-min }}' ] && CFLAGS+=' -mmacosx-version-min=${{ matrix.build.macos-version-min }}'
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              --with-libpsl=$(brew --prefix libpsl) \
-              ${{ matrix.build.configure }} ${options}
-          fi
+    - run: make V=1
+      name: 'make'

-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
+    - run: make V=1 examples
+      name: 'make examples'

-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
+    - run: make V=1 -C tests
+      name: 'make tests'

-      - name: 'build-cert'
-        if: contains(matrix.build.generate, '-DCURL_USE_SECTRANSP=ON') || contains(matrix.build.configure, '--with-secure-transport')
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --target clean-certs
-            cmake --build bld --target build-certs --parallel 1
-          else
-            make -C bld/tests/certs clean-certs
-            make -C bld/tests/certs build-certs -j1
-          fi
+    - run: make V=1 test-ci
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }} ~1452"

-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose
-          else
-            make -C bld V=1
-          fi
-
-      - name: 'curl version'
-        run: bld/src/curl --disable --version
-
-      - name: 'build tests'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'install test prereqs'
-        if: ${{ !matrix.build.clang-tidy }}
-        run: |
-          python3 -m venv $HOME/venv
-          source $HOME/venv/bin/activate
-          python3 -m pip install -r tests/requirements.txt
-
-      - name: 'run tests'
-        if: ${{ !matrix.build.clang-tidy }}
-        timeout-minutes: ${{ matrix.build.torture && 20 || 10 }}
-        run: |
-          export TFLAGS='-j20 ${{ matrix.build.tflags }}'
-          if [ -z '${{ matrix.build.torture }}' ]; then
-            TFLAGS+=' ~2037 ~2041'  # flaky
-            if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-              TFLAGS+=' ~1156 ~1539'  # HTTP Content-Range, Content-Length
-              if [[ -n '${{ matrix.build.configure }}' || \
-                    '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-                TFLAGS+=' ~2100'  # 2100:'HTTP GET using DoH' https://github.com/curl/curl/actions/runs/9942146678/job/27462937524#step:15:5059
-              fi
-              if [[ '${{ matrix.build.configure }}' = *'--with-secure-transport'* || \
-                    '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-                TFLAGS+=' ~HTTP/2'  # 2400 2401 2402 2403 2404 2406, Secure Transport + nghttp2
-              else
-                TFLAGS+=' ~2402 ~2404'  # non-Secure Transport + nghttp2
-              fi
-            fi
-            if [[ '${{ matrix.build.configure }}' = *'--with-secure-transport'* || \
-                  '${{ matrix.build.generate }}' = *'-DCURL_USE_SECTRANSP=ON'* ]]; then
-              TFLAGS+=' ~313'  # Secure Transport does not support crl file
-              TFLAGS+=' ~1631 ~1632'  # Secure Transport is not able to shutdown ftp over https gracefully yet
-            fi
-          fi
-          source $HOME/venv/bin/activate
-          rm -f $HOME/.curlrc
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --target ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          else
-            make -C bld V=1 ${{ matrix.build.torture && 'test-torture' || 'test-ci' }}
-          fi
-
-      - name: 'build examples'
-        if: ${{ contains(matrix.build.name, '+examples') }}
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld --verbose --target curl-examples
-          else
-            make -C bld examples V=1
-          fi
-
-  combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, Secure Transport/not, built tool, combinations
-    if: true  # Set to `true` to enable this test matrix. It runs quickly.
-    name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }} ${{ matrix.config }}"
-    runs-on: ${{ matrix.image }}
-    timeout-minutes: 10
-    env:
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.xcode && format('_{0}', matrix.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.compiler }}
+  cmake:
+    name: cmake ${{ matrix.compiler.CC }} ${{ matrix.build.name }}
+    runs-on: 'macos-latest'
+    env: ${{ matrix.compiler }}
    strategy:
      fail-fast: false
      matrix:
-        config: [SecureTransport]  # also: OpenSSL
-        compiler: [gcc-12, gcc-13, gcc-14, llvm@15, llvm@18, clang]
-        # Xcode support matrix as of 2024-07, with default macOS SDK versions and OS names, years:
-        # * = default Xcode on the runner.
-        # macos-13: 14.1, 14.2, 14.3.1, 15.0.1, 15.1,*15.2
-        # macos-14:                     15.0.1, 15.1, 15.2, 15.3,*15.4
-        # macos-15:                                                    *16.0, 16.1
-        # macOSSDK: 13.0, 13.1, 13.3,   14.0,   14.2, 14.2, 14.4, 14.5, 15.0, 15.1
-        #           Ventura (2022)      Sonoma (2023)                   Sequoia (2024)
-        # https://github.com/actions/runner-images/tree/main/images/macos
-        # https://en.wikipedia.org/wiki/MacOS_version_history
-        image: [macos-13, macos-14, macos-15]
-        # Can skip these to reduce jobs:
-        #   15.1 has the same default macOS SDK as 15.2 and identical test result.
-        #   14.1, 15.4 not revealing new fallouts.
-        #xcode: ['14.1', '14.2', '14.3.1', '15.0.1', '15.1', '15.2', '15.3', '15.4', '16.0', '16.1']  # all Xcode
-        #xcode: ['14.1', '14.2', '14.3.1', '15.0.1'        , '15.2', '15.3', '15.4', '16.0', '16.1']  # all SDK
-        #xcode: [        '14.2', '14.3.1', '15.0.1'        , '15.2', '15.3'        , '16.0'        ]  # coverage
-        xcode: ['']  # default Xcodes
-        macos-version-min: ['']
-        build: [autotools, cmake]
-        exclude:
-          # Combinations uncovered by runner images:
-          - { image: macos-13, xcode: '15.3'   }
-          - { image: macos-13, xcode: '15.4'   }
-          - { image: macos-13, xcode: '16.0'   }
-          - { image: macos-13, xcode: '16.1'   }
-          - { image: macos-14, xcode: '14.1'   }
-          - { image: macos-14, xcode: '14.2'   }
-          - { image: macos-14, xcode: '14.3.1' }
-          - { image: macos-14, xcode: '16.0'   }
-          - { image: macos-14, xcode: '16.1'   }
-          - { image: macos-15, xcode: '14.1'   }
-          - { image: macos-15, xcode: '14.2'   }
-          - { image: macos-15, xcode: '14.3.1' }
-          - { image: macos-15, xcode: '15.0.1' }
-          - { image: macos-15, xcode: '15.1'   }
-          - { image: macos-15, xcode: '15.2'   }
-          - { image: macos-15, xcode: '15.3'   }
-          - { image: macos-15, xcode: '15.4'   }
-          - { image: macos-13, compiler: 'llvm@18' }
-          - { image: macos-14, compiler: 'llvm@18' }
-          - { image: macos-15, compiler: 'llvm@15' }
-          # Reduce build combinations, by dropping less interesting ones
-          - { compiler: gcc-12, config: SecureTransport }
-          - { compiler: gcc-13, build: cmake }
-          - { compiler: gcc-14, build: autotools }
+        compiler:
+        - CC: clang
+          CXX: clang++
+          CFLAGS: "-mmacosx-version-min=10.15 -Wno-deprecated-declarations"
+        - CC: gcc-12
+          CXX: g++-12
+          CFLAGS: "-mmacosx-version-min=10.15 -Wno-error=undef -Wno-error=conversion"
+        build:
+        - name: OpenSSL
+          install: nghttp2 openssl
+          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON
+        - name: LibreSSL
+          install: nghttp2 libressl
+          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/libressl -DCURL_DISABLE_LDAP=ON -DCURL_DISABLE_LDAPS=ON -DCMAKE_UNITY_BUILD=ON
+        - name: libssh2
+          install: nghttp2 openssl libssh2
+          generate: -DOPENSSL_ROOT_DIR=/usr/local/opt/openssl -DCURL_USE_LIBSSH2=ON
    steps:
-      - name: 'install autotools'
-        if: ${{ matrix.build == 'autotools' }}
-        run: |
-          echo automake libtool | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
+    - run: echo libtool autoconf automake pkg-config ${{ matrix.build.install }} | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
+      name: 'brew bundle'

-      - name: 'toolchain versions'
-        run: |
-          [[ '${{ matrix.compiler }}' = 'llvm'* ]] && CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-          [[ '${{ matrix.compiler }}' = 'gcc'* ]] && "${CC}" --print-sysroot
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcrun --sdk macosx --show-sdk-path 2>/dev/null || true
-          xcrun --sdk macosx --show-sdk-version || true
-          ls -l /Library/Developer/CommandLineTools/SDKs || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages preinstalled'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
+    - run: "while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done"
+      name: 'brew install'

-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
+    - run: |
+        case "${{ matrix.build.install }}" in
+          *openssl*)
+            ;;
+          *)
+            if test -d /usr/local/include/openssl; then
+              brew unlink openssl
+            fi;;
+        esac
+      name: 'brew unlink openssl'

-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'autotools' }}
-        run: autoreconf -fi
+    - uses: actions/checkout@v3

-      - name: 'configure / ${{ matrix.build }}'
-        run: |
-          if [[ '${{ matrix.compiler }}' = 'gcc'* ]]; then
-            sysroot="$("${CC}" --print-sysroot)"  # Must match the SDK gcc was built for
-          else
-            sysroot="$(xcrun --sdk macosx --show-sdk-path 2>/dev/null)"
-          fi
+    - run: cmake -S. -Bbuild -DCURL_WERROR=ON -DPICKY_COMPILER=ON ${{ matrix.build.generate }}
+      name: 'cmake generate'

-          if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-            CC="$(brew --prefix ${{ matrix.compiler }})/bin/clang"
-            CC+=" --sysroot=${sysroot}"
-            CC+=" --target=$(uname -m)-apple-darwin"
-          fi
-
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=' -DCURL_USE_OPENSSL=ON'
-            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' -DCURL_USE_SECTRANSP=ON'
-            [ -n '${{ matrix.macos-version-min }}' ] && options+=' -DCMAKE_OSX_DEPLOYMENT_TARGET=${{ matrix.macos-version-min }}'
-            # would pick up nghttp2, libidn2, and libssh2
-            cmake -B bld -D_CURL_PREFILL=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              -DCMAKE_OSX_SYSROOT="${sysroot}" \
-              -DCMAKE_C_COMPILER_TARGET="$(uname -m | sed 's/arm64/aarch64/')-apple-darwin$(uname -r)" \
-              -DCMAKE_IGNORE_PREFIX_PATH="$(brew --prefix)" \
-              -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF \
-              -DUSE_NGHTTP2=OFF -DUSE_LIBIDN2=OFF \
-              -DCURL_USE_LIBPSL=OFF -DCURL_USE_LIBSSH2=OFF \
-              ${options}
-          else
-            export CFLAGS
-            if [[ '${{ matrix.compiler }}' = 'llvm'* ]]; then
-              options+=" --target=$(uname -m)-apple-darwin"
-            fi
-            if [ '${{ matrix.compiler }}' != 'clang' ]; then
-              options+=" --with-sysroot=${sysroot}"
-              CFLAGS+=" --sysroot=${sysroot}"
-            fi
-            [ '${{ matrix.config }}' = 'OpenSSL' ]         && options+=" --with-openssl=$(brew --prefix openssl)"
-            [ '${{ matrix.config }}' = 'SecureTransport' ] && options+=' --with-secure-transport'
-            [ -n '${{ matrix.macos-version-min }}' ] && CFLAGS+=' -mmacosx-version-min=${{ matrix.macos-version-min }}'
-            # would pick up nghttp2, libidn2, but libssh2 is disabled by default
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              --disable-docs --disable-manual \
-              --without-nghttp2 --without-libidn2 \
-              --without-libpsl \
-              ${options}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build / ${{ matrix.build }}'
-        run: make -C bld V=1 VERBOSE=1
-
-      - name: 'curl version'
-        run: bld/src/curl --disable --version
+    - run: cmake --build build
+      name: 'cmake build'
--- a/.github/workflows/ngtcp2-gnutls.yml
+++ b/.github/workflows/ngtcp2-gnutls.yml
@ -0,0 +1,168 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: ngtcp2 GnuTLS
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: ngtcp2-gnutls-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 3
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+        - name: gnutls
+          install: >-
+            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev
+            nettle-dev libp11-kit-dev libtspi-dev libunistring-dev guile-2.2-dev libtasn1-bin
+            libtasn1-6-dev libidn2-0-dev gawk gperf libtss2-dev dns-root-data bison gtk-doc-tools
+            texinfo texlive texlive-extra-utils autopoint libev-dev
+          configure: >-
+            PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/all/lib"
+            --with-ngtcp2=$HOME/all --enable-warnings --enable-werror --enable-debug
+            --with-test-nghttpx="$HOME/all/bin/nghttpx"
+          ngtcp2-configure: >-
+            --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-lib-only
+          gnutls-configure: >-
+            PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/all/lib -L$HOME/all/lib"
+            --with-included-libtasn1 --with-included-unistring
+            --disable-guile --disable-doc --disable-tests --disable-tools
+
+    steps:
+    - run: |
+        sudo apt-get update
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
+        sudo apt-get install apache2 apache2-dev
+      name: 'install prereqs and impacket, pytest, crypto'
+
+    - run: |
+        git clone --quiet --depth=1 -b openssl-3.0.9+quic https://github.com/quictls/openssl
+        cd openssl
+        ./config --prefix=$HOME/all --libdir=$HOME/all/lib
+        make -j1 install_sw
+      name: 'install quictls'
+
+    - run: |
+        git clone --quiet --depth=1 https://gitlab.com/gnutls/nettle.git
+        cd nettle
+        ./.bootstrap
+        ./configure LDFLAGS="-Wl,-rpath,$HOME/all/lib" ${{ matrix.build.nettle-configure }} --prefix=$HOME/all --libdir=$HOME/all/lib --disable-documentation
+        make install
+      name: 'install nettle'
+
+    - run: |
+        git clone --quiet --depth=1 -b 3.8.0 https://github.com/gnutls/gnutls.git
+        cd gnutls
+        ./bootstrap
+        ./configure ${{ matrix.build.gnutls-configure }} --prefix=$HOME/all
+        make install
+      name: 'install gnutls'
+
+    - run: |
+        git clone --quiet --depth=1 -b v0.13.0 https://github.com/ngtcp2/nghttp3
+        cd nghttp3
+        autoreconf -fi
+        ./configure --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-lib-only
+        make install
+      name: 'install nghttp3'
+
+    - run: |
+        git clone --quiet --depth=1 -b v0.17.0 https://github.com/ngtcp2/ngtcp2
+        cd ngtcp2
+        autoreconf -fi
+        ./configure ${{ matrix.build.ngtcp2-configure }} --with-openssl --with-gnutls
+        make install
+      name: 'install ngtcp2'
+
+    - run: |
+        git clone --quiet --depth=1 -b v1.55.1 https://github.com/nghttp2/nghttp2
+        cd nghttp2
+        autoreconf -fi
+        ./configure --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-http3
+        make install
+      name: 'install nghttp2'
+
+    - run: |
+        git clone --quiet --depth=1 -b master https://github.com/icing/mod_h2
+        cd mod_h2
+        autoreconf -fi
+        ./configure PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig"
+        make
+        sudo make install
+      name: 'install mod_h2'
+
+    - uses: actions/checkout@v3
+
+    - run: |
+        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
+      name: 'install python test prereqs'
+
+    - run: autoreconf -fi
+      name: 'autoreconf'
+
+    - run: ./configure --with-gnutls=$HOME/all ${{ matrix.build.configure }}
+      name: 'configure'
+
+    - run: make V=1
+      name: 'make'
+
+    - run: make V=1 examples
+      name: 'make examples'
+
+    - run: make V=1 -C tests
+      name: 'make tests'
+
+    - run: make V=1 test-ci
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
+
+    - run: pytest -v
+      name: 'run pytest'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/ngtcp2-quictls.yml
+++ b/.github/workflows/ngtcp2-quictls.yml
@ -0,0 +1,145 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: ngtcp2 quictls
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: ngtcp2-openssl-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 3
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+        - name: quictls
+          install: >-
+            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev
+          configure: >-
+            PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/all/lib"
+            --with-ngtcp2=$HOME/all --enable-warnings --enable-werror --enable-debug
+            --with-test-nghttpx="$HOME/all/bin/nghttpx"
+          ngtcp2-configure: >-
+            --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-lib-only
+
+    steps:
+    - run: |
+        sudo apt-get update
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
+        sudo apt-get install apache2 apache2-dev
+      name: 'install prereqs and impacket, pytest, crypto'
+
+    - run: |
+        git clone --quiet --depth=1 -b openssl-3.0.9+quic https://github.com/quictls/openssl
+        cd openssl
+        ./config --prefix=$HOME/all --libdir=$HOME/all/lib
+        make -j1 install_sw
+      name: 'install quictls'
+
+    - run: |
+        git clone --quiet --depth=1 -b v0.13.0 https://github.com/ngtcp2/nghttp3
+        cd nghttp3
+        autoreconf -fi
+        ./configure --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-lib-only
+        make install
+      name: 'install nghttp3'
+
+    - run: |
+        git clone --quiet --depth=1 -b v0.17.0 https://github.com/ngtcp2/ngtcp2
+        cd ngtcp2
+        autoreconf -fi
+        ./configure ${{ matrix.build.ngtcp2-configure }} --with-openssl
+        make install
+      name: 'install ngtcp2'
+
+    - run: |
+        git clone --quiet --depth=1 -b v1.55.1 https://github.com/nghttp2/nghttp2
+        cd nghttp2
+        autoreconf -fi
+        ./configure --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-http3
+        make install
+      name: 'install nghttp2'
+
+    - run: |
+        git clone --quiet --depth=1 -b master https://github.com/icing/mod_h2
+        cd mod_h2
+        autoreconf -fi
+        ./configure PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig"
+        make
+        sudo make install
+      name: 'install mod_h2'
+
+    - uses: actions/checkout@v3
+
+    - run: |
+        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
+      name: 'install python test prereqs'
+
+    - run: autoreconf -fi
+      name: 'autoreconf'
+
+    - run: ./configure --with-openssl=$HOME/all ${{ matrix.build.configure }}
+      name: 'configure'
+
+    - run: make V=1
+      name: 'make'
+
+    - run: make V=1 examples
+      name: 'make examples'
+
+    - run: make V=1 -C tests
+      name: 'make tests'
+
+    - run: make V=1 test-ci
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
+
+    - run: pytest -v
+      name: 'run pytest'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/ngtcp2-wolfssl.yml
+++ b/.github/workflows/ngtcp2-wolfssl.yml
@ -0,0 +1,158 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: ngtcp2 wolfSSL
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: ngtcp2-wolfssl-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 3
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+        - name: wolfssl
+          install: >-
+            libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libev-dev libc-ares-dev
+          configure: >-
+            PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" LDFLAGS="-Wl,-rpath,$HOME/all/lib"
+            --with-ngtcp2=$HOME/all --enable-warnings --enable-werror --enable-debug
+            --with-test-nghttpx="$HOME/all/bin/nghttpx"
+          ngtcp2-configure: >-
+            --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-lib-only
+          wolfssl-configure: >-
+            --enable-all --enable-quic
+
+    steps:
+    - run: |
+        sudo apt-get update
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
+        sudo apt-get install apache2 apache2-dev
+      name: 'install prereqs'
+
+    - run: |
+        WOLFSSL_VER=v5.6.3-stable
+        git clone --quiet --depth=1 -b $WOLFSSL_VER https://github.com/wolfSSL/wolfssl.git
+        cd wolfssl
+        ./autogen.sh
+        ./configure ${{ matrix.build.wolfssl-configure }} --prefix=$HOME/all
+        make install
+      name: 'install wolfssl'
+
+    - run: |
+        git clone --quiet --depth=1 -b openssl-3.0.9+quic https://github.com/quictls/openssl
+        cd openssl
+        ./config --prefix=$HOME/all --libdir=$HOME/all/lib
+        make -j1 install_sw
+      name: 'install quictls'
+
+    - run: |
+        git clone --quiet --depth=1 -b v0.13.0 https://github.com/ngtcp2/nghttp3
+        cd nghttp3
+        autoreconf -fi
+        ./configure --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-lib-only
+        make install
+      name: 'install nghttp3'
+
+    - run: |
+        git clone --quiet --depth=1 -b v0.17.0 https://github.com/ngtcp2/ngtcp2
+        cd ngtcp2
+        autoreconf -fi
+        ./configure ${{ matrix.build.ngtcp2-configure }} --with-openssl  --with-wolfssl
+        make install
+      name: 'install ngtcp2'
+
+    - run: |
+        git clone --quiet --depth=1 -b v1.55.1 https://github.com/nghttp2/nghttp2
+        cd nghttp2
+        autoreconf -fi
+        ./configure --prefix=$HOME/all PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig" --enable-http3
+        make install
+      name: 'install nghttp2'
+
+    - run: |
+        git clone --quiet --depth=1 -b master https://github.com/icing/mod_h2
+        cd mod_h2
+        autoreconf -fi
+        ./configure PKG_CONFIG_PATH="$HOME/all/lib/pkgconfig"
+        make
+        sudo make install
+      name: 'install mod_h2'
+
+    - uses: actions/checkout@v3
+
+    - run: |
+        sudo python3 -m pip install -r tests/requirements.txt -r tests/http/requirements.txt
+      name: 'install python test prereqs'
+
+    - run: autoreconf -fi
+      name: 'autoreconf'
+
+    - run: ./configure --with-wolfssl=$HOME/all ${{ matrix.build.configure }}
+      name: 'configure'
+
+    - run: make V=1
+      name: 'make'
+
+    - run: make V=1 examples
+      name: 'make examples'
+
+    - run: make V=1 -C tests
+      name: 'make tests'
+
+    - run: make V=1 test-ci
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
+
+    # Disabled for now, we see spurious SSL_connect() errors when talking
+    # http/1.1 to apache and this, so far, is not reproducable in local testing
+    #- run: pytest -v
+    #  name: 'run pytest'
+    #  env:
+    #    TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/non-native.yml
+++ b/.github/workflows/non-native.yml
@ -1,725 +0,0 @@
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-name: non-native
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  netbsd:
-    name: 'NetBSD, CM clang openssl ${{ matrix.arch }}'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        arch: ['x86_64']
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-      - name: 'cmake'
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
-        with:
-          operating_system: 'netbsd'
-          version: '10.1'
-          architecture: ${{ matrix.arch }}
-          run: |
-            # https://pkgsrc.se/
-            time sudo pkgin -y install cmake ninja-build pkg-config perl brotli heimdal openldap-client libssh2 libidn2 libpsl nghttp2 py311-impacket
-            time cmake -B bld -G Ninja \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
-              -DCURL_USE_OPENSSL=ON \
-              -DCURL_USE_GSSAPI=ON \
-              || { cat bld/CMakeFiles/CMake*.yaml; false; }
-            echo '::group::curl_config.h (raw)'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' bld/lib/curl_config.h | sort || true; echo '::endgroup::'
-            time cmake --build bld
-            bld/src/curl --disable --version
-            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time cmake --build bld --target testdeps
-              export TFLAGS='-j4'
-              time cmake --build bld --target test-ci
-            fi
-            echo '::group::build examples'
-            time cmake --build bld --target curl-examples
-            echo '::endgroup::'
-
-  openbsd:
-    name: 'OpenBSD, CM clang libressl ${{ matrix.arch }}'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        arch: ['x86_64']
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-      - name: 'cmake'
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
-        with:
-          operating_system: 'openbsd'
-          version: '7.5'
-          architecture: ${{ matrix.arch }}
-          run: |
-            # https://openbsd.app/
-            # https://www.openbsd.org/faq/faq15.html
-            time sudo pkg_add cmake ninja brotli openldap-client-- libssh2 libidn2 libpsl nghttp2 python3 py3-impacket
-            time cmake -B bld -G Ninja \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
-              -DCURL_USE_OPENSSL=ON \
-              || { cat bld/CMakeFiles/CMake*.yaml; false; }
-            echo '::group::curl_config.h (raw)'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' bld/lib/curl_config.h | sort || true; echo '::endgroup::'
-            time cmake --build bld
-            bld/src/curl --disable --version
-            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time cmake --build bld --target testdeps
-              export TFLAGS='-j8 ~3017 ~TFTP ~FTP'  # FIXME: TFTP requests executed twice? Related: `curl: (69) TFTP: Access Violation`?
-              time cmake --build bld --target test-ci
-            fi
-            echo '::group::build examples'
-            time cmake --build bld --target curl-examples
-            echo '::endgroup::'
-
-  freebsd:
-    name: "FreeBSD, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} openssl${{ matrix.desc }} ${{ matrix.arch }}"
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        include:
-          - { build: 'autotools', arch: 'x86_64', compiler: 'clang' }
-          - { build: 'cmake'    , arch: 'x86_64', compiler: 'clang', options: '-DCMAKE_UNITY_BUILD=OFF -DCURL_TEST_BUNDLES=OFF', desc: ' !unity !bundle !runtests !examples' }
-          - { build: 'autotools', arch: 'arm64', compiler: 'clang' }
-          - { build: 'cmake'    , arch: 'arm64', compiler: 'clang' }
-      fail-fast: false
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-      - name: 'autotools'
-        if: ${{ matrix.build == 'autotools' }}
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
-        with:
-          operating_system: 'freebsd'
-          version: '14.1'
-          architecture: ${{ matrix.arch }}
-          run: |
-            export MAKEFLAGS=-j3
-            # https://ports.freebsd.org/
-            time sudo pkg install -y autoconf automake libtool \
-              pkgconf brotli openldap26-client libidn2 libnghttp2 stunnel py311-impacket
-            time autoreconf -fi
-            export CC='${{ matrix.compiler }}'
-            mkdir bld && cd bld && time ../configure --enable-unity --enable-test-bundles --enable-debug --enable-warnings --enable-werror \
-              --prefix="${HOME}"/install \
-              --with-openssl \
-              --with-brotli --enable-ldap --enable-ldaps --with-libidn2 --with-libssh2 --with-nghttp2 --with-gssapi \
-              --disable-dependency-tracking \
-              ${{ matrix.options }} \
-              || { tail -n 1000 config.log; false; }
-            echo '::group::curl_config.h (raw)'; cat lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' lib/curl_config.h | sort || true; echo '::endgroup::'
-            time make install
-            src/curl --disable --version
-            desc='${{ matrix.desc }}'
-            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time make -C tests
-              if [ "${desc#*!runtests*}" = "${desc}" ]; then
-                time make test-ci V=1 TFLAGS='-j4'
-              fi
-            fi
-            if [ "${desc#*!examples*}" = "${desc}" ]; then
-              echo '::group::build examples'
-              time make examples
-              echo '::endgroup::'
-            fi
-
-      - name: 'cmake'
-        if: ${{ matrix.build == 'cmake' }}
-        uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d # v0.27.0
-        with:
-          operating_system: 'freebsd'
-          version: '14.1'
-          architecture: ${{ matrix.arch }}
-          run: |
-            # https://ports.freebsd.org/
-            time sudo pkg install -y cmake-core ninja perl5 \
-              pkgconf brotli openldap26-client libidn2 libnghttp2 stunnel py311-impacket
-            time cmake -B bld -G Ninja \
-              -DCMAKE_C_COMPILER='${{ matrix.compiler }}' \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DENABLE_DEBUG=ON -DCMAKE_BUILD_TYPE=Debug \
-              -DCURL_USE_OPENSSL=ON \
-              -DCURL_USE_GSSAPI=ON \
-              ${{ matrix.options }} \
-              || { cat bld/CMakeFiles/CMake*.yaml; false; }
-            echo '::group::curl_config.h (raw)'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' bld/lib/curl_config.h | sort || true; echo '::endgroup::'
-            time cmake --build bld
-            bld/src/curl --disable --version
-            desc='${{ matrix.desc }}'
-            if [ '${{ matrix.arch }}' = 'x86_64' ]; then  # Slow on emulated CPU
-              time cmake --build bld --target testdeps
-              if [ "${desc#*!runtests*}" = "${desc}" ]; then
-                time cmake --build bld --target test-ci
-              fi
-            fi
-            if [ "${desc#*!examples*}" = "${desc}" ]; then
-              echo '::group::build examples'
-              time cmake --build bld --target curl-examples
-              echo '::endgroup::'
-            fi
-
-  omnios:
-    name: 'OmniOS, AM gcc openssl amd64'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-      - name: 'autotools'
-        uses: vmactions/omnios-vm@8eba2a9217262f275d4566751a92d6ef2f433d00 # v1
-        with:
-          usesh: true
-          # https://pkg.omnios.org/r151052/core/en/index.shtml
-          prepare: pkg install build-essential libtool nghttp2
-          run: |
-            set -e
-            ln -s /usr/bin/gcpp /usr/bin/cpp  # Some tests expect `cpp`, which is named `gcpp` in this env.
-            export MAKEFLAGS=-j3
-            time autoreconf -fi
-            mkdir bld && cd bld && time ../configure --enable-unity --enable-test-bundles --enable-debug --enable-warnings --enable-werror \
-              --prefix="${HOME}"/install \
-              --with-openssl \
-              --disable-dependency-tracking \
-              || { tail -n 1000 config.log; false; }
-            echo '::group::curl_config.h (raw)'; cat lib/curl_config.h || true; echo '::endgroup::'
-            echo '::group::curl_config.h'; grep -F '#define' lib/curl_config.h | sort || true; echo '::endgroup::'
-            time gmake install
-            src/curl --disable --version
-            time gmake -C tests
-            time gmake test-ci V=1
-            echo '::group::build examples'
-            time gmake examples
-            echo '::endgroup::'
-
-  ios:
-    name: "iOS, ${{ (matrix.build.generator && format('CM-{0}', matrix.build.generator)) || (matrix.build.generate && 'CM' || 'AM' )}} ${{ matrix.build.name }} arm64"
-    runs-on: 'macos-latest'
-    timeout-minutes: 10
-    env:
-      MAKEFLAGS: -j 4
-      DEVELOPER_DIR: "/Applications/Xcode${{ matrix.build.xcode && format('_{0}', matrix.build.xcode) || '' }}.app/Contents/Developer"
-      CC: ${{ matrix.build.compiler || 'clang' }}
-      # renovate: datasource=github-tags depName=libressl-portable/portable versioning=semver registryUrl=https://github.com
-      libressl-version: 4.0.0
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - name: 'libressl'
-            install_steps: libressl
-            configure: --with-openssl="$HOME/libressl" --without-libpsl
-
-          - name: 'libressl'
-            install_steps: libressl
-            # FIXME: Could not make OPENSSL_ROOT_DIR work. CMake seems to prepend sysroot to it.
-            generate: >-
-              -DCMAKE_BUILD_TYPE=Release -DCMAKE_UNITY_BUILD_BATCH_SIZE=50
-              -DOPENSSL_INCLUDE_DIR="$HOME/libressl/include"
-              -DOPENSSL_SSL_LIBRARY="$HOME/libressl/lib/libssl.a"
-              -DOPENSSL_CRYPTO_LIBRARY="$HOME/libressl/lib/libcrypto.a"
-              -DCURL_USE_LIBPSL=OFF
-
-          - name: 'libressl'
-            install_steps: libressl
-            generator: Xcode
-            options: --config Debug
-            generate: >-
-              -DCMAKE_XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED=OFF
-              -DMACOSX_BUNDLE_GUI_IDENTIFIER=se.curl
-              -DOPENSSL_INCLUDE_DIR="$HOME/libressl/include"
-              -DOPENSSL_SSL_LIBRARY="$HOME/libressl/lib/libssl.a"
-              -DOPENSSL_CRYPTO_LIBRARY="$HOME/libressl/lib/libcrypto.a"
-              -DCURL_USE_LIBPSL=OFF
-
-    steps:
-      - name: 'brew install'
-        if: ${{ matrix.build.configure }}
-        run: |
-          echo automake libtool | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-
-      - name: 'toolchain versions'
-        run: |
-          which "${CC}"; "${CC}" --version || true
-          xcodebuild -version || true
-          xcodebuild -sdk -version | grep '^Path:' || true
-          xcrun --sdk iphoneos --show-sdk-path 2>/dev/null || true
-          xcrun --sdk iphoneos --show-sdk-version || true
-          echo '::group::macros predefined'; "${CC}" -dM -E - < /dev/null | sort || true; echo '::endgroup::'
-          echo '::group::brew packages installed'; ls -l "$(brew --prefix)/opt"; echo '::endgroup::'
-
-      - name: 'cache libressl'
-        if: contains(matrix.build.install_steps, 'libressl')
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-libressl
-        env:
-          cache-name: cache-libressl
-        with:
-          path: ~/libressl
-          key: iOS-${{ env.cache-name }}-${{ env.libressl-version }}
-
-      - name: 'build libressl'
-        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
-        run: |
-          curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
-            https://github.com/libressl/portable/releases/download/v${{ env.libressl-version }}/libressl-${{ env.libressl-version }}.tar.gz | tar -x
-          cd libressl-${{ env.libressl-version }}
-          # FIXME: on the 4.0.1 release, delete '-DHAVE_ENDIAN_H=0'
-          cmake -B . \
-            -DHAVE_ENDIAN_H=0 \
-            -DCMAKE_INSTALL_PREFIX="$HOME/libressl" \
-            -DCMAKE_SYSTEM_NAME=iOS \
-            -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
-            -DBUILD_SHARED_LIBS=OFF \
-            -DLIBRESSL_APPS=OFF \
-            -DLIBRESSL_TESTS=OFF
-          cmake --build .
-          cmake --install . --verbose
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build.configure }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            # https://cmake.org/cmake/help/latest/manual/cmake-toolchains.7.html#cross-compiling-for-ios-tvos-visionos-or-watchos
-            [ -n '${{ matrix.build.generator }}' ] && options='-G ${{ matrix.build.generator }}'
-            cmake -B bld -D_CURL_PREFILL=ON \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON -DCURL_WERROR=ON \
-              -DCMAKE_SYSTEM_NAME=iOS \
-              -DUSE_APPLE_IDN=ON \
-              ${{ matrix.build.generate }} ${options}
-          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --disable-dependency-tracking \
-              CFLAGS="-isysroot $(xcrun --sdk iphoneos --show-sdk-path 2>/dev/null)" \
-              --host=aarch64-apple-darwin \
-              --with-apple-idn \
-              ${{ matrix.build.configure }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMakeConfigureLog.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld ${{ matrix.build.options }} --parallel 4 --verbose
-          else
-            make -C bld V=1
-          fi
-
-      - name: 'curl info'
-        run: find . -type f \( -name curl -o -name '*.dylib' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld ${{ matrix.build.options }} --parallel 4 --target testdeps --verbose
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ -n '${{ matrix.build.generate }}' ]; then
-            cmake --build bld ${{ matrix.build.options }} --parallel 4 --target curl-examples --verbose
-          else
-            make -C bld examples V=1
-          fi
-
-  android:
-    name: "Android ${{ matrix.platform }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.name }} arm64"
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 25
-    env:
-      MAKEFLAGS: -j 5
-      VCPKG_BINARY_SOURCES: 'clear;x-gha,readwrite'
-      VCPKG_DISABLE_METRICS: '1'
-    strategy:
-      matrix:
-        include:
-          - { build: 'autotools', platform: '21', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '--with-openssl --with-brotli' }
-
-          - { build: 'cmake'    , platform: '21', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '-DCURL_USE_OPENSSL=ON' }
-
-          - { build: 'autotools', platform: '35', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '--with-openssl --with-brotli' }
-
-          - { build: 'cmake'    , platform: '35', name: "openssl", install: 'brotli zstd libpsl nghttp2 openssl libssh2',
-              options: '-DCURL_USE_OPENSSL=ON' }
-
-          # FIXME: Must disable zstd explicitly, otherwise cmake/pkg-config finds it in /usr/include
-          #        and the build fails. I had found no option to disable this behavior. Other default
-          #        dependencies not offered via vcpkg may also need this.
-          - { build: 'cmake'    , platform: '35', name: "boringssl !zstd", install: 'libpsl boringssl',
-              options: '-DCURL_USE_OPENSSL=ON -DOPENSSL_USE_STATIC_LIBS=ON -DCURL_ZSTD=OFF' }
-
-      fail-fast: false
-    steps:
-      - name: 'vcpkg cache setup'
-        if: ${{ matrix.install }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: 'vcpkg versions'
-        if: ${{ matrix.install }}
-        timeout-minutes: 1
-        run: |
-          git -C "$VCPKG_INSTALLATION_ROOT" show --no-patch --format='%H %ai'
-          vcpkg version
-
-      - name: 'install prereqs for vcpkg'
-        if: contains(matrix.install, 'boringssl')
-        timeout-minutes: 5
-        run: |
-          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
-          sudo apt-get -o Dpkg::Use-Pty=0 update
-          sudo apt-get -o Dpkg::Use-Pty=0 install nasm
-
-      - name: 'vcpkg build'
-        if: ${{ matrix.install }}
-        timeout-minutes: 20
-        run: vcpkg x-set-installed ${{ matrix.install }} '--triplet=arm64-android'
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'autotools' }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          export PKG_CONFIG_PATH="$VCPKG_INSTALLATION_ROOT/installed/arm64-android/lib/pkgconfig"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then  # https://developer.android.com/ndk/guides/cmake
-            cmake -B bld \
-              -DANDROID_ABI=arm64-v8a \
-              -DANDROID_PLATFORM='android-${{ matrix.platform }}' \
-              -DCMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" \
-              -DVCPKG_CHAINLOAD_TOOLCHAIN_FILE=${ANDROID_NDK_HOME}/build/cmake/android.toolchain.cmake -DCMAKE_WARN_DEPRECATED=OFF \
-              -DVCPKG_INSTALLED_DIR="$VCPKG_INSTALLATION_ROOT/installed" \
-              -DVCPKG_TARGET_TRIPLET=arm64-android \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              ${{ matrix.options }}
-          else
-            TOOLCHAIN="${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64"
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              CC="$TOOLCHAIN/bin/aarch64-linux-android${{ matrix.platform }}-clang" \
-              AR="$TOOLCHAIN/bin/llvm-ar" \
-              RANLIB="$TOOLCHAIN/bin/llvm-ranlib" \
-              --host=aarch64-linux-android${{ matrix.platform }} \
-              ${{ matrix.options }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --verbose
-          else
-            make -C bld V=1
-          fi
-
-      - name: 'curl info'
-        run: find . -type f \( -name curl -o -name '*.so' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
-
-  amiga:
-    name: "AmigaOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} gcc AmiSSL m68k"
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 5
-    env:
-      MAKEFLAGS: -j 5
-      amissl-version: 5.18
-    strategy:
-      matrix:
-        build: [autotools, cmake]
-      fail-fast: false
-    steps:
-      - name: 'install compiler'
-        if: ${{ steps.cache-compiler.outputs.cache-hit != 'true' }}
-        run: |
-          cd "${HOME}" || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 \
-            --location https://github.com/bebbo/amiga-gcc/releases/download/Mechen/amiga-gcc.tgz | tar -xz
-          cd opt/appveyor || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 \
-            --location https://github.com/jens-maus/amissl/releases/download/${{ env.amissl-version }}/AmiSSL-${{ env.amissl-version }}-SDK.lha --output bin.lha
-          7z x -bd -y bin.lha
-          rm -f bin.lha
-          mv "$HOME/opt/appveyor" /opt
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'configure'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld \
-              -DAMIGA=1 \
-              -DCMAKE_SYSTEM_NAME=Generic \
-              -DCMAKE_SYSTEM_PROCESSOR=m68k \
-              -DCMAKE_C_COMPILER_TARGET=m68k-unknown-amigaos \
-              -DCMAKE_C_COMPILER=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-gcc \
-              -DCMAKE_C_FLAGS='-O0 -msoft-float -mcrt=clib2' \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_LIBPSL=OFF \
-              -DAMISSL_INCLUDE_DIR=/opt/appveyor/AmiSSL/Developer/include \
-              -DAMISSL_STUBS_LIBRARY=/opt/appveyor/AmiSSL/Developer/lib/AmigaOS3/libamisslstubs.a \
-              -DAMISSL_AUTO_LIBRARY=/opt/appveyor/AmiSSL/Developer/lib/AmigaOS3/libamisslauto.a
-          else
-            autoreconf -fi
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              CC=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-gcc \
-              AR=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-ar \
-              RANLIB=/opt/appveyor/build-agent/opt/amiga/bin/m68k-amigaos-ranlib \
-              --host=m68k-amigaos \
-              --disable-shared \
-              --without-libpsl \
-              --with-amissl \
-              LDFLAGS=-L/opt/appveyor/AmiSSL/Developer/lib/AmigaOS3 \
-              CPPFLAGS=-I/opt/appveyor/AmiSSL/Developer/include \
-              CFLAGS='-O0 -msoft-float -mcrt=clib2' \
-              LIBS='-lnet -lm -latomic'
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld
-          fi
-
-      - name: 'curl info'
-        run: find . -type f \( -name curl -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
-
-  msdos:
-    name: "MS-DOS, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} djgpp openssl i586"
-    runs-on: 'ubuntu-latest'
-    timeout-minutes: 5
-    env:
-      MAKEFLAGS: -j 5
-      toolchain-version: '3.4'
-    strategy:
-      matrix:
-        build: [autotools, cmake]
-      fail-fast: false
-    steps:
-      - name: 'install packages'
-        run: sudo apt-get -o Dpkg::Use-Pty=0 install libfl2 ${{ matrix.build == 'cmake' && 'ninja-build' || '' }}
-
-      - name: 'cache compiler (djgpp)'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-compiler
-        with:
-          path: ~/djgpp
-          key: ${{ runner.os }}-djgpp-${{ env.toolchain-version }}-amd64
-
-      - name: 'install compiler (djgpp)'
-        if: ${{ steps.cache-compiler.outputs.cache-hit != 'true' }}
-        run: |
-          cd "${HOME}" || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 \
-            --location 'https://github.com/andrewwutw/build-djgpp/releases/download/v${{ env.toolchain-version }}/djgpp-linux64-gcc1220.tar.bz2' | tar -xj
-          cd djgpp || exit 1
-          for f in wat3211b.zip zlb13b.zip ssl102ub.zip; do
-            curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 \
-              "https://www.delorie.com/pub/djgpp/current/v2tk/$f" --output bin.zip
-            unzip -q bin.zip
-            rm -f bin.zip
-          done
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'configure'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_SYSTEM_NAME=DOS \
-              -DCMAKE_SYSTEM_PROCESSOR=x86 \
-              -DCMAKE_C_COMPILER_TARGET=i586-pc-msdosdjgpp \
-              -DCMAKE_C_COMPILER="$HOME/djgpp/bin/i586-pc-msdosdjgpp-gcc" \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_LIBPSL=OFF \
-              -DOPENSSL_INCLUDE_DIR="$HOME/djgpp/include" \
-              -DOPENSSL_SSL_LIBRARY="$HOME/djgpp/lib/libssl.a" \
-              -DOPENSSL_CRYPTO_LIBRARY="$HOME/djgpp/lib/libcrypto.a" \
-              -DZLIB_INCLUDE_DIR="$HOME/djgpp/include" \
-              -DZLIB_LIBRARY="$HOME/djgpp/lib/libz.a" \
-              -DWATT_ROOT="$HOME/djgpp/net/watt"
-          else
-            autoreconf -fi
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              CC="$HOME/djgpp/bin/i586-pc-msdosdjgpp-gcc" \
-              AR="$HOME/djgpp/bin/i586-pc-msdosdjgpp-ar" \
-              RANLIB="$HOME/djgpp/bin/i586-pc-msdosdjgpp-ranlib" \
-              WATT_ROOT="$HOME/djgpp/net/watt" \
-              --host=i586-pc-msdosdjgpp \
-              --with-openssl="$HOME/djgpp" \
-              --with-zlib="$HOME/djgpp" \
-              --without-libpsl \
-              --disable-shared
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld
-          fi
-
-      - name: 'curl info'
-        run: find . \( -name '*.exe' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
--- a/.github/workflows/proselint.yml
+++ b/.github/workflows/proselint.yml
@ -0,0 +1,68 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: proselint
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths:
+    - '.github/workflows/proselint.yml'
+    - '**.md'
+  pull_request:
+    branches:
+    - master
+    paths:
+    - '.github/workflows/proselint.yml'
+    - '**.md'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: install prereqs
+      run: sudo apt-get install python3-proselint
+
+    # config file help: https://github.com/amperser/proselint/
+    - name: create proselint config
+      run: |
+        cat <<JSON > $HOME/.proselintrc
+        {
+          "checks": {
+            "typography.diacritical_marks": false,
+            "typography.symbols": false,
+            "annotations.misc": false
+          }
+        }
+        JSON
+
+    - name: check prose
+      run: a=`git ls-files '*.md' | grep -v docs/CHECKSRC.md` && proselint $a README
+
+    # This is for CHECKSRC and files with aggressive exclamation mark needs
+    - name: create second proselint config
+      run: |
+        cat <<JSON > $HOME/.proselintrc
+        {
+          "checks": {
+            "typography.diacritical_marks": false,
+            "typography.symbols": false,
+            "typography.exclamation": false,
+            "annotations.misc": false
+          }
+        }
+        JSON
+
+    - name: check special prose
+      run: a=docs/CHECKSRC.md && proselint $a
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@ -0,0 +1,29 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+# SPDX-FileCopyrightText: 2022 Free Software Foundation Europe e.V. <https://fsfe.org>
+#
+# SPDX-License-Identifier: curl
+
+name: REUSE compliance
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+  pull_request:
+    branches:
+    - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: REUSE Compliance Check
+      uses: fsfe/reuse-action@v1
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@ -0,0 +1,54 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: spell
+on:
+  push:
+    branches:
+    - master
+    paths:
+    - '**.md'
+    - '**.3'
+    - '**.1'
+    - '**/spellcheck.yml'
+    - '**/spellcheck.yaml'
+    - '**/wordlist.txt'
+  pull_request:
+    branches:
+    - master
+    paths:
+    - '**.md'
+    - '**.3'
+    - '**.1'
+    - '**/spellcheck.yml'
+    - '**/spellcheck.yaml'
+    - '**/wordlist.txt'
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: install pandoc
+      run: sudo apt-get install pandoc
+
+    - name: strip "uncheckable" sections from .3 pages
+      run: find docs -name "*.3" -size +40c | sed 's/\.3//' | xargs -t -n1 -I OO  ./.github/scripts/cleanspell.pl OO.3 OO.33
+
+    - name: convert .3 man pages to markdown
+      run: find docs -name "*.33" -size +40c | sed 's/\.33//' | xargs -t -n1 -I OO pandoc -f man -t markdown OO.33 -o OO.md
+
+    - name: convert .1 man pages to markdown
+      run: find docs -name "*.1" -size +40c | sed 's/\.1//' | xargs -t -n1 -I OO pandoc OO.1 -o OO.md
+
+    - name: setup the custom wordlist
+      run: grep -v '^#' .github/scripts/spellcheck.words >  wordlist.txt
+
+    - name: Check Spelling
+      uses: rojopolis/spellcheck-github-actions@v0
+      with:
+        config_path: .github/scripts/spellcheck.yaml
--- a/.github/workflows/torture.yml
+++ b/.github/workflows/torture.yml
@ -0,0 +1,92 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Linux torture
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: torture-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 3
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+        - name: torture
+          install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
+          configure: --with-openssl --enable-debug --enable-ares --enable-websockets
+          tflags: -n -t --shallow=25 !FTP
+        - name: torture-ftp
+          install: libpsl-dev libbrotli-dev libzstd-dev zlib1g-dev libnghttp2-dev libssh2-1-dev libc-ares-dev
+          configure: --with-openssl --enable-debug --enable-ares
+          tflags: -n -t --shallow=20 FTP
+
+    steps:
+    - run: |
+        sudo apt-get update
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
+        sudo python3 -m pip install impacket
+      name: 'install prereqs and impacket'
+
+    - uses: actions/checkout@v3
+
+    - run: autoreconf -fi
+      name: 'autoreconf'
+
+    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
+      name: 'configure'
+
+    - run: make V=1
+      name: 'make'
+
+    - run: make V=1 -C tests
+      name: 'make tests'
+
+    - run: make V=1 test-torture
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@ -1,925 +0,0 @@
-# Copyright (C) Viktor Szakats
-#
-# SPDX-License-Identifier: curl
-
-name: Windows
-
-'on':
-  push:
-    branches:
-      - master
-      - '*/ci'
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-  pull_request:
-    branches:
-      - master
-    paths-ignore:
-      - '**/*.md'
-      - '.circleci/**'
-      - 'appveyor.*'
-      - 'packages/**'
-      - 'plan9/**'
-      - 'projects/**'
-      - 'winbuild/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  cygwin:
-    name: "cygwin, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.platform }} ${{ matrix.name }}"
-    runs-on: windows-latest
-    timeout-minutes: 25
-    defaults:
-      run:
-        shell: C:\cygwin\bin\bash.exe '{0}'
-    env:
-      MAKEFLAGS: -j 5
-      SHELLOPTS: 'igncr'
-    strategy:
-      matrix:
-        include:
-          - { build: 'automake', platform: 'x86_64', tflags: 'skiprun', config: '', name: 'openssl R' }
-          - { build: 'cmake'   , platform: 'x86_64', tflags: ''       , config: '-DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DENABLE_THREADED_RESOLVER=OFF', name: 'openssl' }
-      fail-fast: false
-    steps:
-      - run: git config --global core.autocrlf input
-        shell: pwsh
-
-      - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 # v5
-        with:
-          platform: ${{ matrix.platform }}
-          site: https://mirrors.kernel.org/sourceware/cygwin/
-          # https://cygwin.com/cgi-bin2/package-grep.cgi
-          packages: >-
-            autoconf libtool gcc-core gcc-g++ binutils
-            ${{ matrix.build }} make ninja
-            openssh
-            libssl-devel
-            libssh2-devel
-            libpsl-devel
-            zlib-devel
-            libbrotli-devel
-            libnghttp2-devel
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'automake' }}
-        timeout-minutes: 2
-        run: autoreconf -fi
-
-      - name: 'configure'
-        timeout-minutes: 5
-        run: |
-          PATH=/usr/bin
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld -G Ninja -D_CURL_PREFILL=ON ${options} \
-              -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=30 -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              ${{ matrix.config }}
-          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --prefix="${HOME}"/install \
-              --with-openssl \
-              --with-libssh2 \
-              --disable-dependency-tracking \
-              ${{ matrix.config }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        timeout-minutes: 10
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld V=1 install
-          fi
-
-      - name: 'curl version'
-        timeout-minutes: 1
-        run: |
-          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -exec file '{}' \;
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            PATH="$PWD/bld/lib:$PATH"
-          fi
-          bld/src/curl.exe --disable --version
-
-      - name: 'build tests'
-        if: ${{ matrix.tflags != 'skipall' }}
-        timeout-minutes: 15
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
-
-      - name: 'run tests'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 15
-        run: |
-          export TFLAGS='-j8 ${{ matrix.tflags }} ~615'
-          if [ -x "$(cygpath "${SYSTEMROOT}/System32/curl.exe")" ]; then
-            TFLAGS+=" -ac $(cygpath "${SYSTEMROOT}/System32/curl.exe")"
-          fi
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            PATH="$PWD/bld/lib:$PATH"
-            cmake --build bld --target test-ci
-          else
-            make -C bld V=1 test-ci
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' }}
-        timeout-minutes: 5
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld V=1 examples
-          fi
-
-  msys2:  # both msys and mingw-w64
-    name: "${{ matrix.sys == 'msys' && 'msys2' || 'mingw' }}, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.env }} ${{ matrix.name }} ${{ matrix.test }}"
-    runs-on: windows-latest
-    timeout-minutes: 20
-    defaults:
-      run:
-        shell: msys2 {0}
-    env:
-      MAKEFLAGS: -j 5
-    strategy:
-      matrix:
-        include:
-          - { build: 'autotools', sys: 'msys'   , env: 'x86_64'      , tflags: '!19                !1233', config: '--enable-debug --with-openssl --disable-threaded-resolver --disable-proxy', name: '!proxy' }
-          - { build: 'autotools', sys: 'msys'   , env: 'x86_64'      , tflags: 'skiprun'                 , config: '--enable-debug --with-openssl --disable-threaded-resolver', name: 'default' }
-          - { build: 'cmake'    , sys: 'msys'   , env: 'x86_64'      , tflags: '!19 !504 !704 !705 !1233', config: '-DENABLE_DEBUG=ON -DENABLE_THREADED_RESOLVER=OFF', name: 'default' }
-          - { build: 'autotools', sys: 'msys'   , env: 'x86_64'      , tflags: '!19 !504 !704 !705 !1233', config: '--with-openssl', name: 'default R' }
-          - { build: 'autotools', sys: 'mingw64', env: 'x86_64'      , tflags: 'skiprun'                 , config: '--enable-debug --with-openssl --disable-threaded-resolver --disable-curldebug --enable-static=no --without-zlib', name: 'default' }
-          - { build: 'autotools', sys: 'mingw64', env: 'x86_64'      , tflags: ''                        , config: '--enable-debug --with-openssl --enable-windows-unicode --enable-ares', name: 'c-ares U' }
-          # FIXME: WebSockets test results ignored due to frequent failures on native Windows:
-          - { build: 'cmake'    , sys: 'mingw64', env: 'x86_64'      , tflags: ''                        , config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_ARES=ON', type: 'Debug', name: 'schannel c-ares U' }
-          - { build: 'cmake'    , sys: 'ucrt64' , env: 'ucrt-x86_64' , tflags: 'skiprun'                 , config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DENABLE_CURLDEBUG=ON', type: 'Release', name: 'schannel R TrackMemory' }
-          - { build: 'cmake'    , sys: 'clang64', env: 'clang-x86_64', tflags: 'skiprun'                 , config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=OFF -DCURL_USE_OPENSSL=ON  -DENABLE_UNICODE=OFF', type: 'Release', name: 'openssl', chkprefill: '_chkprefill' }
-          - { build: 'cmake'    , sys: 'ucrt64' , env: 'ucrt-x86_64' , tflags: 'skiprun'                 , config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON', type: 'Release', test: 'uwp', name: 'schannel' }
-          # { build: 'autotools', sys: 'ucrt64' , env: 'ucrt-x86_64' , tflags: 'skiprun'                 , config: '--without-debug --with-schannel --enable-shared', type: 'Release', test: 'uwp', name: 'schannel' }
-          - { build: 'cmake'    , sys: 'mingw64', env: 'x86_64'      , tflags: 'skiprun'                 , config: '-DENABLE_DEBUG=ON  -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON -DCMAKE_VERBOSE_MAKEFILE=ON', type: 'Debug', cflags: '-DCURL_SCHANNEL_DEV_DEBUG', name: 'schannel dev debug' }
-          - { build: 'cmake'    , sys: 'mingw32', env: 'i686'        , tflags: 'skiprun'                 , config: '-DENABLE_DEBUG=OFF -DBUILD_SHARED_LIBS=ON  -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON', type: 'Release', name: 'schannel R' }
-      fail-fast: false
-    steps:
-      - run: git config --global core.autocrlf input
-        shell: pwsh
-
-      - uses: msys2/setup-msys2@d44ca8e88d8b43d56cf5670f91747359d5537f97 # v2
-        if: ${{ matrix.sys == 'msys' }}
-        with:
-          msystem: ${{ matrix.sys }}
-          # https://packages.msys2.org/search
-          install: >-
-            gcc
-            ${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || 'ninja' }}
-            openssh
-            openssl-devel
-            zlib-devel
-            brotli-devel
-            libnghttp2-devel
-            libpsl-devel
-            libssh2-devel
-            ${{ matrix.chkprefill == '_chkprefill' && 'diffutils' || '' }}
-
-      - uses: msys2/setup-msys2@d44ca8e88d8b43d56cf5670f91747359d5537f97 # v2
-        if: ${{ matrix.sys != 'msys' }}
-        with:
-          msystem: ${{ matrix.sys }}
-          install: >-
-            mingw-w64-${{ matrix.env }}-cc
-            mingw-w64-${{ matrix.env }}-${{ matrix.build }} ${{ matrix.build == 'autotools' && 'make' || '' }}
-            openssh
-            mingw-w64-${{ matrix.env }}-openssl
-            mingw-w64-${{ matrix.env }}-libssh2
-            mingw-w64-${{ matrix.env }}-libpsl
-            mingw-w64-${{ matrix.env }}-c-ares
-            ${{ matrix.chkprefill == '_chkprefill' && format('mingw-w64-{0}-diffutils', matrix.env) || '' }}
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'autotools' }}
-        timeout-minutes: 2
-        run: autoreconf -fi
-
-      - name: 'configure'
-        timeout-minutes: 5
-        run: |
-          if [ '${{ matrix.test }}' = 'uwp' ]; then
-            CPPFLAGS='-DWINSTORECOMPAT -DWINAPI_FAMILY=WINAPI_FAMILY_APP'
-            if [[ '${{ matrix.env }}' != 'clang'* ]]; then
-              specs="$(realpath gcc-specs-uwp)"
-              gcc -dumpspecs | sed -e 's/-lmingwex/-lwindowsapp -lmingwex -lwindowsapp/' -e 's/-lmsvcrt/-lucrtapp/' > "${specs}"
-              CFLAGS="-specs=${specs}"
-              CFLAGS_CMAKE="-specs=$(cygpath -w "${specs}")"
-            fi
-          fi
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            for _chkprefill in '' ${{ matrix.chkprefill }}; do
-              if [[ '${{ matrix.env }}' = 'clang'* ]]; then
-                options='-DCMAKE_C_COMPILER=clang'
-              else
-                options='-DCMAKE_C_COMPILER=gcc'
-              fi
-              [ '${{ matrix.sys }}' = 'msys' ] && options+=' -D_CURL_PREFILL=ON'
-              [ '${{ matrix.test }}' = 'uwp' ] && options+=' -DCMAKE_SYSTEM_NAME=WindowsStore -DCMAKE_SYSTEM_VERSION=10.0'
-              [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
-              cmake -B "bld${_chkprefill}" -G Ninja ${options} \
-                -DCMAKE_C_FLAGS="${{ matrix.cflags }} ${CFLAGS_CMAKE} ${CPPFLAGS}" \
-                -DCMAKE_BUILD_TYPE='${{ matrix.type }}' \
-                -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=30 -DCURL_TEST_BUNDLES=ON \
-                -DCURL_WERROR=ON \
-                ${{ matrix.config }}
-            done
-            if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
-              echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
-              false
-            fi
-          else
-            export CFLAGS CPPFLAGS
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --prefix="${HOME}"/install \
-              --with-libssh2 \
-              --disable-dependency-tracking \
-              ${{ matrix.config }}
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        timeout-minutes: 10
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld V=1 install
-          fi
-
-      - name: 'curl version'
-        timeout-minutes: 1
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            PATH="$PWD/bld/lib:$PATH"
-          else
-            PATH="$PWD/bld/lib/.libs:$PATH"
-            # avoid libtool's curl.exe wrapper
-            mv bld/src/.libs/curl.exe bld/src/curl.exe
-          fi
-          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -exec file '{}' \;
-          if [ '${{ matrix.test }}' != 'uwp' ]; then  # curl: error initializing curl library
-            bld/src/curl.exe --disable --version
-          fi
-
-      - name: 'build tests'
-        if: ${{ matrix.tflags != 'skipall' }}  # Save time by skipping this for autotools
-        timeout-minutes: 10
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld V=1 -C tests
-          fi
-          if [ '${{ matrix.build }}' != 'cmake' ]; then
-            # avoid libtool's .exe wrappers
-            mv bld/tests/http/clients/.libs/*.exe bld/tests/http/clients
-            mv bld/tests/libtest/.libs/*.exe bld/tests/libtest
-            mv bld/tests/server/.libs/*.exe bld/tests/server
-            mv bld/tests/unit/.libs/*.exe bld/tests/unit || true
-          fi
-
-      - name: 'install test prereqs'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 5
-        run: |
-          /c/ProgramData/chocolatey/choco.exe install --yes --no-progress --limit-output --timeout 180 --force stunnel || true
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 https://live.sysinternals.com/handle64.exe --output /bin/handle64.exe
-
-      - name: 'run tests'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 10
-        run: |
-          export TFLAGS='-j8 ${{ matrix.tflags }} ~SCP'
-          if [ '${{ matrix.sys }}' != 'msys' ]; then
-            TFLAGS+=' ~2301 ~2302 ~2310'  # WebSockets'
-            TFLAGS+=' ~612 ~613 ~616 ~618'  # SFTP
-          else
-            TFLAGS+=' ~SFTP'
-          fi
-          if [ -x "$(cygpath "${SYSTEMROOT}/System32/curl.exe")" ]; then
-            TFLAGS+=" -ac $(cygpath "${SYSTEMROOT}/System32/curl.exe")"
-          fi
-          PATH="$PATH:/c/Program Files (x86)/stunnel/bin"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            PATH="$PWD/bld/lib:$PATH"
-            cmake --build bld --target test-ci
-          else
-            PATH="$PWD/bld/lib/.libs:$PATH"
-            make -C bld V=1 test-ci
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' || (matrix.tflags == 'skipall' || matrix.tflags == 'skiprun') }}  # Save time by skipping this for autotools running tests
-        timeout-minutes: 5
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld V=1 examples
-          fi
-
-  mingw-w64-standalone-downloads:
-    name: 'dl-mingw, CM ${{ matrix.env }} ${{ matrix.name }}'
-    runs-on: windows-latest
-    timeout-minutes: 20
-    defaults:
-      run:
-        shell: C:\msys64\usr\bin\bash.exe {0}
-    env:
-      MAKEFLAGS: -j 5
-    strategy:
-      matrix:
-        include:
-          - name: 'schannel'
-            env: '9.5.0-x86_64'
-            dir: 'mingw64'
-            url: 'https://github.com/brechtsanders/winlibs_mingw/releases/download/9.5.0-10.0.0-msvcrt-r1/winlibs-x86_64-posix-seh-gcc-9.5.0-mingw-w64msvcrt-10.0.0-r1.7z'
-            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=OFF'
-            type: 'Release'
-            tflags: '~2301 ~2302 ~2310 ~3027'
-          - name: 'schannel U'
-            env: '7.3.0-x86_64'
-            dir: 'mingw64'
-            url: 'https://downloads.sourceforge.net/mingw-w64/Toolchains%20targetting%20Win64/Personal%20Builds/mingw-builds/7.3.0/threads-win32/seh/x86_64-7.3.0-release-win32-seh-rt_v5-rev0.7z'
-            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=ON'
-            type: 'Release'
-            tflags: '~2301 ~2302 ~2310 ~3027 ~3023 ~3024 ~1451'
-          - name: 'schannel !unity'
-            env: '6.4.0-i686'
-            dir: 'mingw32'
-            url: 'https://downloads.sourceforge.net/mingw-w64/Toolchains%20targetting%20Win32/Personal%20Builds/mingw-builds/6.4.0/threads-win32/dwarf/i686-6.4.0-release-win32-dwarf-rt_v5-rev0.7z'
-            config: '-DENABLE_DEBUG=ON -DBUILD_SHARED_LIBS=OFF -DCURL_USE_SCHANNEL=ON -DENABLE_UNICODE=OFF -DCMAKE_UNITY_BUILD=OFF'
-            type: 'Debug'
-            tflags: 'skiprun'
-      fail-fast: false
-    steps:
-      - name: 'cache compiler (gcc ${{ matrix.env }})'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-compiler
-        with:
-          path: ~\my-cache
-          key: ${{ runner.os }}-mingw-w64-${{ matrix.env }}
-
-      - name: 'install compiler (gcc ${{ matrix.env }})'
-        if: ${{ steps.cache-compiler.outputs.cache-hit != 'true' }}
-        timeout-minutes: 5
-        run: |
-          cd "${USERPROFILE}" || exit 1
-          mkdir my-cache
-          cd my-cache || exit 1
-          curl --fail --silent --show-error --retry 3 --retry-connrefused --output pack.bin --location --proto-redir =https '${{ matrix.url }}'
-          pwd
-          7z x -y pack.bin >/dev/null
-          rm -r -f pack.bin
-          ls -l
-
-      - run: git config --global core.autocrlf input
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'configure'
-        timeout-minutes: 5
-        run: |
-          PATH="$(cygpath "${USERPROFILE}")/my-cache/${{ matrix.dir }}/bin:/c/msys64/usr/bin:$PATH"
-          for _chkprefill in '' ${{ matrix.chkprefill }}; do
-            options=''
-            [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
-            cmake -B "bld${_chkprefill}" -G 'MSYS Makefiles' ${options} \
-              -DCMAKE_C_COMPILER=gcc \
-              -DCMAKE_BUILD_TYPE='${{ matrix.type }}' \
-              -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=30 -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_LIBPSL=OFF \
-              ${{ matrix.config }}
-          done
-          if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
-            echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
-            false
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        timeout-minutes: 5
-        run: |
-          PATH="$(cygpath "${USERPROFILE}")/my-cache/${{ matrix.dir }}/bin:/c/msys64/usr/bin:$PATH"
-          cmake --build bld
-
-      - name: 'curl version'
-        timeout-minutes: 1
-        run: |
-          PATH=/usr/bin find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -exec file '{}' \;
-          PATH="$PWD/bld/lib:$PATH"
-          bld/src/curl.exe --disable --version
-
-      - name: 'build tests'
-        if: ${{ matrix.tflags != 'skipall' }}
-        timeout-minutes: 10
-        run: |
-          PATH="$(cygpath "${USERPROFILE}")/my-cache/${{ matrix.dir }}/bin:/c/msys64/usr/bin:$PATH"
-          cmake --build bld --target testdeps
-
-      - name: 'install test prereqs'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 5
-        run: |
-          /c/ProgramData/chocolatey/choco.exe install --yes --no-progress --limit-output --timeout 180 --force stunnel || true
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 https://live.sysinternals.com/handle64.exe --output /bin/handle64.exe
-          python3 -m pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary impacket
-
-      - name: 'downgrade msys2-runtime'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 2
-        # Downgrade to a known good MSYS2 runtime version to avoid the performance regression
-        # causing runtests.pl to run at 2-3x reduced speed.
-        run: |
-          /usr/bin/sed -i 's/^CheckSpace/#CheckSpace/' /etc/pacman.conf
-          exec /usr/bin/pacman --noconfirm --noprogressbar --upgrade https://mirror.msys2.org/msys/x86_64/msys2-runtime-3.5.4-8-x86_64.pkg.tar.zst
-
-      - name: 'run tests'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 10
-        run: |
-          PATH="$(cygpath "${USERPROFILE}")/my-cache/${{ matrix.dir }}/bin:/c/msys64/usr/bin:$PATH"
-          export TFLAGS='-j8 ~WebSockets ${{ matrix.tflags }}'
-          if [ -x "$(cygpath "${SYSTEMROOT}/System32/curl.exe")" ]; then
-            TFLAGS+=" -ac $(cygpath "${SYSTEMROOT}/System32/curl.exe")"
-          fi
-          PATH="$PWD/bld/lib:$PATH:/c/Program Files (x86)/stunnel/bin"
-          cmake --build bld --target test-ci
-
-      - name: 'build examples'
-        timeout-minutes: 5
-        run: |
-          PATH="$(cygpath "${USERPROFILE}")/my-cache/${{ matrix.dir }}/bin:/c/msys64/usr/bin:$PATH"
-          cmake --build bld --target curl-examples
-
-  linux-cross-mingw-w64:
-    name: "linux-mingw, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }}"
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    env:
-      MAKEFLAGS: -j 5
-      TRIPLET: 'x86_64-w64-mingw32'
-    strategy:
-      fail-fast: false
-      matrix:
-        build: [autotools, cmake]
-        compiler: [gcc]
-    steps:
-      - name: 'install packages'
-        timeout-minutes: 5
-        run: sudo apt-get -o Dpkg::Use-Pty=0 install mingw-w64 ${{ matrix.build == 'cmake' && 'ninja-build' || '' }}
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'autoreconf'
-        if: ${{ matrix.build == 'autotools' }}
-        run: autoreconf -fi
-
-      - name: 'configure'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld -G Ninja \
-              -DCMAKE_SYSTEM_NAME=Windows \
-              -DCMAKE_C_COMPILER_TARGET="${TRIPLET}" \
-              -DCMAKE_C_COMPILER="${TRIPLET}-gcc" \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_SCHANNEL=ON -DUSE_WIN32_IDN=ON \
-              -DCURL_USE_LIBPSL=OFF
-          else
-            mkdir bld && cd bld && ../configure --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --host="${TRIPLET}" \
-              --with-schannel --with-winidn \
-              --without-libpsl \
-              --disable-dependency-tracking
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld
-          fi
-
-      - name: 'curl info'
-        run: find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' }}  # Save time by skipping this for autotools
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        run: |
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
-
-  wince:
-    name: "mingw32ce, ${{ matrix.build == 'cmake' && 'CM' || 'AM' }} 4.4.0-arm schannel"
-    runs-on: 'macos-latest'
-    timeout-minutes: 10
-    env:
-      MAKEFLAGS: -j 4
-      toolchain-version: '0.59.1'
-    strategy:
-      matrix:
-        build: [autotools, cmake]
-      fail-fast: false
-    steps:
-      - name: 'install packages'
-        if: ${{ matrix.build == 'autotools' }}
-        timeout-minutes: 5
-        run: |
-          echo automake libtool | xargs -Ix -n1 echo brew '"x"' > /tmp/Brewfile
-          while [[ $? == 0 ]]; do for i in 1 2 3; do brew update && brew bundle install --no-lock --file /tmp/Brewfile && break 2 || { echo Error: wait to try again; sleep 10; } done; false Too many retries; done
-
-      - name: 'cache compiler (mingw32ce)'
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
-        id: cache-compiler
-        with:
-          path: ~/opt/mingw32ce
-          key: ${{ runner.os }}-mingw32ce-${{ env.toolchain-version }}-amd64
-
-      - name: 'install compiler (mingw32ce)'
-        if: ${{ steps.cache-compiler.outputs.cache-hit != 'true' }}
-        timeout-minutes: 5
-        run: |
-          cd "${HOME}" || exit 1
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused --proto-redir =https \
-            --location 'https://downloads.sourceforge.net/cegcc/cegcc/${{ env.toolchain-version }}/cegcc_mingw32ce_snowleopard_r1397.tar.bz2' | tar -x
-          ls -l
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-      - name: 'configure'
-        run: |
-          PATH="$HOME/opt/mingw32ce/bin:$PATH"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake -B bld \
-              -DCMAKE_SYSTEM_NAME=WindowsCE \
-              -DCMAKE_SYSTEM_VERSION=8.0 \
-              -DCMAKE_SYSTEM_PROCESSOR=arm \
-              -DCMAKE_C_FLAGS='-O3 -DNDEBUG' \
-              -DCMAKE_C_COMPILER_TARGET=arm-mingw32ce \
-              -DCMAKE_C_COMPILER=arm-mingw32ce-gcc \
-              -DCMAKE_RC_COMPILER=arm-mingw32ce-windres \
-              -DMINGW32CE_LIBRARY_DIR="$HOME/opt/mingw32ce/arm-mingw32ce/lib" \
-              -DCMAKE_IGNORE_PREFIX_PATH="$(brew --prefix)" \
-              -DCMAKE_UNITY_BUILD=ON -DCMAKE_UNITY_BUILD_BATCH_SIZE=50 -DCURL_TEST_BUNDLES=ON \
-              -DBUILD_SHARED_LIBS=ON -DBUILD_STATIC_LIBS=ON -DBUILD_STATIC_CURL=OFF \
-              -DCURL_WERROR=ON \
-              -DCURL_USE_SCHANNEL=ON \
-              -DCURL_USE_LIBPSL=OFF
-          else
-            autoreconf -fi
-            mkdir bld && cd bld && ../configure --disable-dependency-tracking --enable-unity --enable-test-bundles --enable-warnings --enable-werror \
-              --host=arm-mingw32ce \
-              --with-schannel \
-              --without-libpsl \
-              --disable-shared
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/config.log bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        run: |
-          PATH="$HOME/opt/mingw32ce/bin:$PATH"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld
-          else
-            make -C bld
-          fi
-
-      - name: 'curl info'
-        run: |
-          find . \( -name '*.exe' -o -name '*.dll' -o -name '*.a' \) -exec file '{}' \;
-
-      - name: 'build tests'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          PATH="$HOME/opt/mingw32ce/bin:$PATH"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target testdeps
-          else
-            make -C bld -C tests
-          fi
-
-      - name: 'build examples'
-        if: ${{ matrix.build == 'cmake' }}  # skip for autotools to save time
-        run: |
-          PATH="$HOME/opt/mingw32ce/bin:$PATH"
-          if [ '${{ matrix.build }}' = 'cmake' ]; then
-            cmake --build bld --target curl-examples
-          else
-            make -C bld examples
-          fi
-
-  msvc:
-    name: 'msvc, CM ${{ matrix.arch }}-${{ matrix.plat }} ${{ matrix.name }}'
-    runs-on: windows-latest
-    timeout-minutes: 55
-    defaults:
-      run:
-        shell: C:\msys64\usr\bin\bash.exe {0}
-    env:
-      VCPKG_BINARY_SOURCES: 'clear;x-gha,readwrite'
-      VCPKG_DISABLE_METRICS: '1'
-    strategy:
-      matrix:
-        include:
-          - name: 'openssl'
-            install: 'brotli zlib zstd        nghttp2 nghttp3 openssl libssh2'
-            arch: 'x64'
-            plat: 'uwp'
-            type: 'Debug'
-            tflags: 'skiprun'
-            config: >-
-              -DCURL_USE_LIBSSH2=ON
-              -DCURL_USE_SCHANNEL=OFF -DCURL_USE_OPENSSL=ON -DUSE_OPENSSL_QUIC=ON
-              -DCURL_USE_LIBPSL=OFF
-
-          - name: 'openssl'
-            install: 'brotli zlib zstd libpsl nghttp2 nghttp3 openssl libssh2 pkgconf gsasl c-ares libuv krb5'
-            arch: 'x64'
-            plat: 'windows'
-            type: 'Debug'
-            tflags: '~1516 ~2301 ~2302 ~2303 ~2307 ~2310'
-            config: >-
-              -DCURL_USE_LIBSSH2=ON
-              -DCURL_USE_SCHANNEL=OFF -DCURL_USE_OPENSSL=ON -DUSE_OPENSSL_QUIC=ON
-              -DCURL_USE_GSASL=ON -DENABLE_ARES=ON -DCURL_USE_LIBUV=ON -DCURL_USE_GSSAPI=ON
-
-          - name: 'schannel MultiSSL U'
-            install: 'brotli zlib zstd libpsl nghttp2 libssh2[core,zlib] pkgconf gsasl openssl mbedtls wolfssl'
-            arch: 'x64'
-            plat: 'windows'
-            type: 'Debug'
-            tflags: '~1516 ~2301 ~2302 ~2303 ~2307 ~2310'
-            config: >-
-              -DCURL_USE_LIBSSH2=ON
-              -DCURL_USE_SCHANNEL=ON  -DCURL_USE_OPENSSL=ON -DCURL_USE_MBEDTLS=ON -DCURL_USE_WOLFSSL=ON -DCURL_DEFAULT_SSL_BACKEND=schannel
-              -DCURL_USE_GSASL=ON -DUSE_WIN32_IDN=ON -DENABLE_UNICODE=ON -DUSE_SSLS_EXPORT=ON
-
-          - name: 'libressl'
-            install: 'brotli zlib zstd libpsl nghttp2 libressl libssh2[core,zlib] pkgconf ngtcp2[libressl] nghttp3'
-            arch: 'x64'
-            plat: 'windows'
-            type: 'Debug'
-            tflags: '~1516 ~2301 ~2302 ~2303 ~2307 ~2310'
-            config: >-
-              -DCURL_USE_LIBSSH2=ON
-              -DCURL_USE_SCHANNEL=OFF -DCURL_USE_OPENSSL=ON -DUSE_NGTCP2=ON
-              -DCURL_CA_SEARCH_SAFE=ON -DUSE_SSLS_EXPORT=ON
-
-          - name: 'boringssl'
-            install: 'brotli zlib zstd libpsl nghttp2 boringssl libssh2[core,zlib]'
-            arch: 'x64'
-            plat: 'windows'
-            type: 'Debug'
-            tflags: '~1516 ~2301 ~2302 ~2303 ~2307 ~2310'
-            config: >-
-              -DCURL_USE_LIBSSH2=ON
-              -DCURL_USE_SCHANNEL=OFF -DCURL_USE_OPENSSL=ON
-              -DUSE_ECH=ON
-
-          - name: 'wolfssl'
-            install: 'brotli zlib zstd libpsl nghttp2 wolfssl libssh2 pkgconf gsasl ngtcp2[wolfssl] nghttp3'
-            arch: 'x64'
-            plat: 'windows'
-            type: 'Debug'
-            tflags: '~1516'
-            config: >-
-              -DCURL_USE_LIBSSH2=ON
-              -DCURL_USE_SCHANNEL=OFF -DCURL_USE_WOLFSSL=ON -DUSE_NGTCP2=ON
-              -DCURL_USE_GSASL=ON
-              -DUSE_ECH=ON
-
-          - name: 'mbedtls'
-            install: 'brotli zlib zstd libpsl nghttp2 mbedtls libssh pkgconf gsasl'
-            arch: 'x64'
-            plat: 'windows'
-            type: 'Debug'
-            tflags: '~1516'
-            chkprefill: '_chkprefill'
-            # WARNING: libssh uses hard-coded world-writable paths (/etc/..., ~/.ssh/) to
-            #          read its configuration from, making it vulnerable to attacks on
-            #          Windows. Do not use this component till there is a fix for these.
-            # https://github.com/curl/curl-for-win/blob/3951808deb04df9489ee17430f236ed54436f81a/libssh.sh#L6-L8
-            config: >-
-              -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=ON
-              -DCURL_USE_SCHANNEL=OFF -DCURL_USE_MBEDTLS=ON
-              -DCURL_USE_GSASL=ON
-
-      fail-fast: false
-    steps:
-      - name: 'vcpkg cache setup'
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: 'vcpkg versions'
-        timeout-minutes: 1
-        run: |
-          git -C "$VCPKG_INSTALLATION_ROOT" show --no-patch --format='%H %ai'
-          vcpkg version
-
-      - name: 'vcpkg build'
-        timeout-minutes: 35
-        run: vcpkg x-set-installed ${{ matrix.install }} '--triplet=${{ matrix.arch }}-${{ matrix.plat }}'
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - name: 'configure'
-        timeout-minutes: 5
-        run: |
-          PATH="/c/msys64/usr/bin:$PATH"
-          for _chkprefill in '' ${{ matrix.chkprefill }}; do
-            options=''
-            if [ '${{ matrix.plat }}' = 'uwp' ]; then
-              options+=' -DCMAKE_SYSTEM_NAME=WindowsStore -DCMAKE_SYSTEM_VERSION=10.0'
-              cflags='-DWINAPI_FAMILY=WINAPI_FAMILY_PC_APP'
-              ldflags='-OPT:NOREF -OPT:NOICF -APPCONTAINER:NO'
-              vsglobals=';AppxPackage=false;WindowsAppContainer=false'
-            fi
-            [ '${{ matrix.arch }}' = 'arm64' ] && options+=' -A ARM64'
-            [ '${{ matrix.arch }}' = 'x64' ] && options+=' -A x64'
-            [ '${{ matrix.arch }}' = 'x86' ] && options+=' -A Win32'
-            [ "${_chkprefill}" = '_chkprefill' ] && options+=' -D_CURL_PREFILL=OFF'
-            cmake -B "bld${_chkprefill}" ${options} \
-              -DCMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" \
-              -DVCPKG_INSTALLED_DIR="$VCPKG_INSTALLATION_ROOT/installed" \
-              -DVCPKG_TARGET_TRIPLET='${{ matrix.arch }}-${{ matrix.plat }}' \
-              -DCMAKE_C_FLAGS="${cflags}" \
-              -DCMAKE_EXE_LINKER_FLAGS="-INCREMENTAL:NO ${ldflags}" \
-              -DCMAKE_SHARED_LINKER_FLAGS="-INCREMENTAL:NO ${ldflags}" \
-              -DCMAKE_VS_GLOBALS="TrackFileAccess=false${vsglobals}" \
-              -DCMAKE_UNITY_BUILD=ON -DCURL_TEST_BUNDLES=ON \
-              -DCURL_WERROR=ON \
-              -DBUILD_SHARED_LIBS=OFF \
-              -DENABLE_DEBUG=ON \
-              ${{ matrix.config }}
-          done
-          if [ -d bld_chkprefill ] && ! diff -u bld/lib/curl_config.h bld_chkprefill/lib/curl_config.h; then
-            echo '::group::reference configure log'; cat bld_chkprefill/CMakeFiles/CMake*.yaml 2>/dev/null || true; echo '::endgroup::'
-            false
-          fi
-
-      - name: 'configure log'
-        if: ${{ !cancelled() }}
-        run: cat bld/CMakeFiles/CMake*.yaml 2>/dev/null || true
-
-      - name: 'curl_config.h'
-        run: |
-          echo '::group::raw'; cat bld/lib/curl_config.h || true; echo '::endgroup::'
-          grep -F '#define' bld/lib/curl_config.h | sort || true
-
-      - name: 'build'
-        timeout-minutes: 5
-        run: |
-          PATH="/c/msys64/usr/bin:$PATH"
-          cmake --build bld --config '${{ matrix.type }}' --parallel 5
-
-      - name: 'curl version'
-        timeout-minutes: 1
-        run: |
-          PATH=/usr/bin find . \( -name '*.exe' -o -name '*.dll' -o -name '*.lib' -o -name '*.pdb' \) -exec file '{}' \;
-          if [ '${{ matrix.plat }}' != 'uwp' ]; then  # Missing: ucrtbased.dll, VCRUNTIME140D.dll, VCRUNTIME140D_APP.dll
-            PATH="$PWD/bld/lib/${{ matrix.type }}:$PATH"
-            'bld/src/${{ matrix.type }}/curl.exe' --disable --version
-          fi
-
-      - name: 'build tests'
-        if: ${{ matrix.tflags != 'skipall' }}
-        timeout-minutes: 10
-        run: |
-          PATH="/c/msys64/usr/bin:$PATH"
-          cmake --build bld --config '${{ matrix.type }}' --parallel 5 --target testdeps
-
-      - name: 'install test prereqs'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 5
-        run: |
-          # GnuTLS is not fully functional on Windows, so skip the tests
-          # https://github.com/ShiftMediaProject/gnutls/issues/23
-          if [[ '${{ matrix.name }}' != *'gnutls'* ]]; then
-            /c/ProgramData/chocolatey/choco.exe install --yes --no-progress --limit-output --timeout 180 --force stunnel openssh || true
-          fi
-          curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 https://live.sysinternals.com/handle64.exe --output /bin/handle64.exe
-          python3 -m pip --disable-pip-version-check --no-input --no-cache-dir install --progress-bar off --prefer-binary impacket
-
-      - name: 'downgrade msys2-runtime'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 2
-        # Downgrade to a known good MSYS2 runtime version to avoid the performance regression
-        # causing runtests.pl to run at 2-3x reduced speed.
-        run: |
-          /usr/bin/sed -i 's/^CheckSpace/#CheckSpace/' /etc/pacman.conf
-          exec /usr/bin/pacman --noconfirm --noprogressbar --upgrade https://mirror.msys2.org/msys/x86_64/msys2-runtime-3.5.4-8-x86_64.pkg.tar.zst
-
-      - name: 'run tests'
-        if: ${{ matrix.tflags != 'skipall' && matrix.tflags != 'skiprun' }}
-        timeout-minutes: 10
-        run: |
-          export CURL_DIRSUFFIX='${{ matrix.type }}'
-          export TFLAGS='-j8 ~WebSockets ~SCP ~612 ${{ matrix.tflags }}'
-          if [[ '${{ matrix.install }}' = *'libssh2[core,zlib]'* ]]; then
-            TFLAGS+=' ~SFTP'
-          elif [[ '${{ matrix.install }}' = *'libssh '* ]]; then
-            TFLAGS+=' ~614'  # 'SFTP pre-quote chmod' SFTP, pre-quote, directory
-          fi
-          PATH="$PWD/bld/lib/${{ matrix.type }}:$PATH:/c/Program Files (x86)/stunnel/bin:/c/Program Files/OpenSSH-Win64"
-          PATH="/c/msys64/usr/bin:$PATH"
-          cmake --build bld --config '${{ matrix.type }}' --target test-ci
-
-      - name: 'build examples'
-        timeout-minutes: 5
-        run: |
-          PATH="/c/msys64/usr/bin:$PATH"
-          cmake --build bld --config '${{ matrix.type }}' --parallel 5 --target curl-examples
--- a/.github/workflows/wolfssl.yml
+++ b/.github/workflows/wolfssl.yml
@ -0,0 +1,105 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+name: Linux wolfSSL
+
+on:
+  push:
+    branches:
+    - master
+    - '*/ci'
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+  pull_request:
+    branches:
+    - master
+    paths-ignore:
+    - '**/*.md'
+    - '**/CMakeLists.txt'
+    - '.azure-pipelines.yml'
+    - '.circleci/**'
+    - '.cirrus.yml'
+    - 'appveyor.yml'
+    - 'CMake/**'
+    - 'packages/**'
+    - 'plan9/**'
+    - 'projects/**'
+    - 'winbuild/**'
+
+concurrency:
+  # Hardcoded workflow filename as workflow name above is just Linux again
+  group: wolfssl-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  MAKEFLAGS: -j 3
+
+jobs:
+  autotools:
+    name: ${{ matrix.build.name }}
+    runs-on: 'ubuntu-latest'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+        - name: wolfssl (configured with --enable-all)
+          install:
+          configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
+          wolfssl-configure: --enable-all
+        - name: wolfssl (configured with --enable-opensslextra)
+          install:
+          configure: LDFLAGS="-Wl,-rpath,$HOME/wssl/lib" --with-wolfssl=$HOME/wssl --enable-debug
+          wolfssl-configure: --enable-opensslextra
+
+    steps:
+    - run: |
+        sudo apt-get update
+        sudo apt-get install libtool autoconf automake pkg-config stunnel4 ${{ matrix.build.install }}
+        sudo python3 -m pip install impacket
+      name: 'install prereqs and impacket'
+
+    - run: |
+        WOLFSSL_VER=5.6.3
+        curl -LOsSf --retry 6 --retry-connrefused --max-time 999 https://github.com/wolfSSL/wolfssl/archive/v$WOLFSSL_VER-stable.tar.gz
+        tar -xzf v$WOLFSSL_VER-stable.tar.gz
+        cd wolfssl-$WOLFSSL_VER-stable
+        ./autogen.sh
+        ./configure --enable-tls13 ${{ matrix.build.wolfssl-configure }} --enable-harden --prefix=$HOME/wssl
+        make install
+      name: 'install wolfssl'
+
+    - uses: actions/checkout@v3
+
+    - run: autoreconf -fi
+      name: 'autoreconf'
+
+    - run: ./configure --enable-warnings --enable-werror ${{ matrix.build.configure }}
+      name: 'configure'
+
+    - run: make V=1
+      name: 'make'
+
+    - run: make V=1 examples
+      name: 'make examples'
+
+    - run: make V=1 -C tests
+      name: 'make tests'
+
+    - run: make V=1 test-ci
+      name: 'run tests'
+      env:
+        TFLAGS: "${{ matrix.build.tflags }}"
--- a/.gitignore
+++ b/.gitignore
@ -8,15 +8,11 @@
 *.exp
 *.la
 *.lib
-*.a
-*.res
 *.lo
 *.o
 *.obj
 *.pdb
 *.pyc
-*.orig
-*.rej
 *~
 .*.sw?
 .cproject
@ -31,6 +27,7 @@
 /builds/
 /stats/
 __pycache__
+CHANGES.dist
 Debug
 INSTALL
 Makefile
@ -40,9 +37,6 @@ TAGS
 aclocal.m4
 aclocal.m4.bak
 autom4te.cache
-buildinfo.txt
-ca-bundle.crt
-certdata.txt
 compile
 config.cache
 config.guess
@ -64,7 +58,6 @@ missing
 mkinstalldirs
 tags
 test-driver
-stamp-h*
 scripts/_curl
 scripts/curl.fish
 curl_fuzzer
@ -72,4 +65,4 @@ curl_fuzzer_seed_corpus.zip
 libstandaloneengine.a
 tests/string
 tests/config
-tests/ech-log/
+
--- a/.lift/config.toml
+++ b/.lift/config.toml
@ -0,0 +1,8 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+ignoreRules = [ "DEAD_STORE", "subprocess_without_shell_equals_true" ]
+ignoreFiles = [ "tests/http/**" ]
+build = "make"
+setup = ".lift/setup.sh"
--- a/.lift/setup.sh
+++ b/.lift/setup.sh
@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+autoreconf -fi
+./configure --with-openssl
+echo "Ran the setup script for Lift including autoconf and executing ./configure --with-openssl"
--- a/.mailmap
+++ b/.mailmap
@ -1,6 +1,6 @@
 Guenter Knauf <lists@gknw.net> <gk@gknw.de>
-Gisle Vanem <gvanem@yahoo.no> <gisle.vanem@gmail.com>
-Gisle Vanem <gvanem@yahoo.no> <gvanem@broadpark.no>
+Gisle Vanem <gisle.vanem@gmail.com> <gvanem@yahoo.no>
+Gisle Vanem <gisle.vanem@gmail.com> <gvanem@broadpark.no>
 Alessandro Ghedini <alessandro@ghedini.me> <alessandro@cloudflare.com>
 Alessandro Ghedini <alessandro@ghedini.me> <al3xbio@gmail.com>
 Björn Stenberg <bjorn@haxx.se>
@ -105,12 +105,3 @@ Andy Alt <arch_stanton5995@protonmail.com>
 Thomas1664 on github <46387399+Thomas1664@users.noreply.github.com>
 dengjfzh on github <dengjfzh@gmail.com>
 Brad Harder <brad.harder@gmail.com>
-Derzsi Dániel <daniel@tohka.us>
-Michael Osipov <michael.osipov@siemens.com> <1983-01-06@gmx.net>
-Michael Osipov <michael.osipov@siemens.com> <michael-o@users.sf.net>
-Christian Weisgerber <naddy@mips.inka.de> <curl-library@lists.haxx.se>
-Moritz Buhl <git@moritzbuhl.de>
-Aki Sakurai <75532970+AkiSakurai@users.noreply.github.com>
-Sinkevich Artem <artsin666@gmail.com>
-Andrew Kirillov <akirillo@uk.ibm.com>
-Stephen Farrell <stephen.farrell@cs.tcd.ie>
--- a/.reuse/dep5
+++ b/.reuse/dep5
@ -0,0 +1,102 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: curl
+Upstream-Contact: Daniel Stenberg <daniel@haxx.se>
+Source: https://curl.se
+
+# Tests
+Files: tests/data/test* tests/certs/* tests/stunnel.pem tests/valgrind.supp
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+# Markdown documentation in docs/
+Files: docs/*.md
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+# Docs in docs/
+Files: docs/FAQ docs/INSTALL docs/INSTALL.cmake docs/KNOWN_BUGS docs/MAIL-ETIQUETTE docs/THANKS docs/TODO docs/cmdline-opts/page-footer docs/libcurl/curl_multi_socket_all.3 docs/libcurl/curl_strnequal.3 docs/libcurl/symbols-in-versions docs/options-in-versions
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+# Windows
+Files: projects/Windows/*
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+# Single files we do not want to edit directly
+Files: CHANGES
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: GIT-INFO
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: RELEASE-NOTES
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+# checksrc control files
+Files: lib/.checksrc docs/examples/.checksrc tests/libtest/.checksrc
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: lib/libcurl.plist.in
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: lib/libcurl.vers.in
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: packages/OS400/README.OS400
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: packages/vms/build_vms.com
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: packages/vms/curl_release_note_start.txt
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: packages/vms/curlmsg.sdl
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: packages/vms/macro32_exactcase.patch
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: packages/vms/readme
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: plan9/README
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: projects/wolfssl_override.props
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: README
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: .github/ISSUE_TEMPLATE/bug_report.md
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: .mailmap
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+Files: TINY-RELEASE-NOTES
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: curl
+
+File: lib/config-freertos.h lib/config-micrium.h docs/GPLv3.txt
+Copyright: Daniel Stenberg, <daniel@haxx.se>, et al.
+License: GPL-3.0-or-later
--- a/7
+++ b/7
@ -0,0 +1,7 @@
+See https://curl.se/changes.html for the edited and human readable online
+version of what has changed over the years in different curl releases.
+
+Generate a CHANGES file like the one present in every release like this:
+
+$ git log --pretty=fuller --no-color --date=short --decorate=full | \
+  ./scripts/log2changes.pl
--- a/CHANGES.md
+++ b/CHANGES.md
@ -1,12 +0,0 @@
-<!--
-Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-
-SPDX-License-Identifier: curl
-->
-
-In a release tarball, check the RELEASES-NOTES file for what was done in the
-most recent release. In a git check-out, that file mentions changes that have
-been done since the previous release.
-
-See the online [changelog](https://curl.se/changes.html) for the edited and
-human readable version of what has changed in different curl releases.
--- a/CMake/CurlSymbolHiding.cmake
+++ b/CMake/CurlSymbolHiding.cmake
@ -21,48 +21,58 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-option(CURL_HIDDEN_SYMBOLS "Hide libcurl internal symbols (=hide all symbols that are not officially external)" ON)
+include(CheckCSourceCompiles)
+
+option(CURL_HIDDEN_SYMBOLS "Set to ON to hide libcurl internal symbols (=hide all symbols that aren't officially external)." ON)
 mark_as_advanced(CURL_HIDDEN_SYMBOLS)

-if(WIN32 AND (ENABLE_DEBUG OR ENABLE_CURLDEBUG))
-  # We need to export internal debug functions,
-  # e.g. curl_easy_perform_ev() or curl_dbg_*(),
-  # so disable symbol hiding for debug builds and for memory tracking.
-  set(CURL_HIDDEN_SYMBOLS OFF)
-elseif(DOS OR AMIGA OR MINGW32CE)
-  set(CURL_HIDDEN_SYMBOLS OFF)
-endif()
-
-set(CURL_HIDES_PRIVATE_SYMBOLS FALSE)
-set(CURL_EXTERN_SYMBOL "")
-set(CURL_CFLAG_SYMBOLS_HIDE "")
-
 if(CURL_HIDDEN_SYMBOLS)
+  set(SUPPORTS_SYMBOL_HIDING FALSE)
+
  if(CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
-    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
+    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
  elseif(CMAKE_COMPILER_IS_GNUCC)
    if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.4)
-      # Note: This is considered buggy prior to 4.0 but the autotools do not care, so let us ignore that fact
-      set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-      set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
-      set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+      # note: this is considered buggy prior to 4.0 but the autotools don't care, so let's ignore that fact
+      set(SUPPORTS_SYMBOL_HIDING TRUE)
+      set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
+      set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
    endif()
  elseif(CMAKE_C_COMPILER_ID MATCHES "SunPro" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.0)
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-    set(CURL_EXTERN_SYMBOL "__global")
-    set(CURL_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
-  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 9.0)  # Requires 9.1.045
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
-    set(CURL_EXTERN_SYMBOL "__attribute__((__visibility__(\"default\")))")
-    set(CURL_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+    set(_SYMBOL_EXTERN "__global")
+    set(_CFLAG_SYMBOLS_HIDE "-xldscope=hidden")
+  elseif(CMAKE_C_COMPILER_ID MATCHES "Intel" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 9.0)
+    # note: this should probably just check for version 9.1.045 but I'm not 100% sure
+    #       so let's do it the same way autotools do.
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+    set(_SYMBOL_EXTERN "__attribute__ ((__visibility__ (\"default\")))")
+    set(_CFLAG_SYMBOLS_HIDE "-fvisibility=hidden")
+    check_c_source_compiles("#include <stdio.h>
+        int main (void) { printf(\"icc fvisibility bug test\"); return 0; }" _no_bug)
+    if(NOT _no_bug)
+      set(SUPPORTS_SYMBOL_HIDING FALSE)
+      set(_SYMBOL_EXTERN "")
+      set(_CFLAG_SYMBOLS_HIDE "")
+    endif()
  elseif(MSVC)
-    set(CURL_HIDES_PRIVATE_SYMBOLS TRUE)
+    set(SUPPORTS_SYMBOL_HIDING TRUE)
+  endif()
+
+  set(HIDES_CURL_PRIVATE_SYMBOLS ${SUPPORTS_SYMBOL_HIDING})
+elseif(MSVC)
+  if(NOT CMAKE_VERSION VERSION_LESS 3.7)
+    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE) #present since 3.4.3 but broken
+    set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
+  else()
+    message(WARNING "Hiding private symbols regardless CURL_HIDDEN_SYMBOLS being disabled.")
+    set(HIDES_CURL_PRIVATE_SYMBOLS TRUE)
  endif()
 else()
-  if(MSVC)
-    # Note: This option is prone to export non-curl extra symbols.
-    set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS TRUE)
-  endif()
+  set(HIDES_CURL_PRIVATE_SYMBOLS FALSE)
 endif()
+
+set(CURL_CFLAG_SYMBOLS_HIDE ${_CFLAG_SYMBOLS_HIDE})
+set(CURL_EXTERN_SYMBOL ${_SYMBOL_EXTERN})
--- a/CMake/CurlTests.c
+++ b/CMake/CurlTests.c
@ -21,8 +21,26 @@
 * SPDX-License-Identifier: curl
 *
 ***************************************************************************/
+#ifdef TIME_WITH_SYS_TIME
+/* Time with sys/time test */
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <time.h>
+
+int
+main ()
+{
+if ((struct tm *) 0)
+return 0;
+  ;
+  return 0;
+}
+
+#endif

 #ifdef HAVE_FCNTL_O_NONBLOCK
+
 /* headers for FCNTL_O_NONBLOCK test */
 #include <sys/types.h>
 #include <unistd.h>
@ -30,77 +48,118 @@
 /* */
 #if defined(sun) || defined(__sun__) || \
    defined(__SUNPRO_C) || defined(__SUNPRO_CC)
-#  if defined(__SVR4) || defined(__srv4__)
-#    define PLATFORM_SOLARIS
-#  else
-#    define PLATFORM_SUNOS4
-#  endif
+# if defined(__SVR4) || defined(__srv4__)
+#  define PLATFORM_SOLARIS
+# else
+#  define PLATFORM_SUNOS4
+# endif
 #endif
 #if (defined(_AIX) || defined(__xlC__)) && !defined(_AIX41)
-#  define PLATFORM_AIX_V3
+# define PLATFORM_AIX_V3
 #endif
 /* */
 #if defined(PLATFORM_SUNOS4) || defined(PLATFORM_AIX_V3)
 #error "O_NONBLOCK does not work on this platform"
 #endif

-int main(void)
+int
+main ()
 {
-  /* O_NONBLOCK source test */
-  int flags = 0;
-  if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
-    return 1;
-  return 0;
+      /* O_NONBLOCK source test */
+      int flags = 0;
+      if(0 != fcntl(0, F_SETFL, flags | O_NONBLOCK))
+          return 1;
+      return 0;
 }
 #endif

 /* tests for gethostbyname_r */
-#if defined(HAVE_GETHOSTBYNAME_R_3) || \
-    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_5) || \
+#if defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT) || \
    defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
-    defined(HAVE_GETHOSTBYNAME_R_6) || \
    defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
+#   define _REENTRANT
+    /* no idea whether _REENTRANT is always set, just invent a new flag */
+#   define TEST_GETHOSTBYFOO_REENTRANT
+#endif
+#if defined(HAVE_GETHOSTBYNAME_R_3) || \
+    defined(HAVE_GETHOSTBYNAME_R_5) || \
+    defined(HAVE_GETHOSTBYNAME_R_6) || \
+    defined(TEST_GETHOSTBYFOO_REENTRANT)
 #include <sys/types.h>
 #include <netdb.h>
 int main(void)
 {
-  const char *address = "example.com";
+  char *address = "example.com";
+  int length = 0;
+  int type = 0;
  struct hostent h;
  int rc = 0;
-#if   defined(HAVE_GETHOSTBYNAME_R_3) || \
-      defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
+#if defined(HAVE_GETHOSTBYNAME_R_3) || \
+    defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
  struct hostent_data hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
      defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT) || \
      defined(HAVE_GETHOSTBYNAME_R_6) || \
      defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
  char buffer[8192];
-  struct hostent *hp;
  int h_errnop;
+  struct hostent *hp;
 #endif

 #if   defined(HAVE_GETHOSTBYNAME_R_3) || \
      defined(HAVE_GETHOSTBYNAME_R_3_REENTRANT)
  rc = gethostbyname_r(address, &h, &hdata);
-  (void)hdata;
 #elif defined(HAVE_GETHOSTBYNAME_R_5) || \
      defined(HAVE_GETHOSTBYNAME_R_5_REENTRANT)
  rc = gethostbyname_r(address, &h, buffer, 8192, &h_errnop);
  (void)hp; /* not used for test */
-  (void)h_errnop;
 #elif defined(HAVE_GETHOSTBYNAME_R_6) || \
      defined(HAVE_GETHOSTBYNAME_R_6_REENTRANT)
  rc = gethostbyname_r(address, &h, buffer, 8192, &hp, &h_errnop);
-  (void)hp;
-  (void)h_errnop;
 #endif
-  (void)h;
+
+  (void)length;
+  (void)type;
  (void)rc;
  return 0;
 }
 #endif

+#ifdef HAVE_SOCKLEN_T
+#ifdef _WIN32
+#include <ws2tcpip.h>
+#else
+#include <sys/types.h>
+#include <sys/socket.h>
+#endif
+int
+main ()
+{
+if ((socklen_t *) 0)
+  return 0;
+if (sizeof (socklen_t))
+  return 0;
+  ;
+  return 0;
+}
+#endif
+#ifdef HAVE_IN_ADDR_T
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+int
+main ()
+{
+if ((in_addr_t *) 0)
+  return 0;
+if (sizeof (in_addr_t))
+  return 0;
+  ;
+  return 0;
+}
+#endif
+
 #ifdef HAVE_BOOL_T
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
@ -108,9 +167,13 @@ int main(void)
 #ifdef HAVE_STDBOOL_H
 #include <stdbool.h>
 #endif
-int main(void)
+int
+main ()
 {
-  return (int)sizeof(bool *);
+if (sizeof (bool *) )
+  return 0;
+  ;
+  return 0;
 }
 #endif

@ -119,84 +182,123 @@ int main(void)
 #include <stdarg.h>
 #include <string.h>
 #include <float.h>
-int main(void) { return 0; }
+int main() { return 0; }
 #endif
-
 #ifdef HAVE_FILE_OFFSET_BITS
+#ifdef _FILE_OFFSET_BITS
+#undef _FILE_OFFSET_BITS
+#endif
+#define _FILE_OFFSET_BITS 64
 #include <sys/types.h>
-/* Check that off_t can represent 2**63 - 1 correctly.
-   We cannot simply define LARGE_OFF_T to be 9223372036854775807,
-   since some C++ compilers masquerading as C compilers
-   incorrectly reject 9223372036854775807. */
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
 #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
-static int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 &&
-                           LARGE_OFF_T % 2147483647 == 1)
-                          ? 1 : -1];
-int main(void)
-{
-  (void)off_t_is_large;
-  return 0;
-}
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+                       && LARGE_OFF_T % 2147483647 == 1)
+                      ? 1 : -1];
+int main () { ; return 0; }
 #endif
-
 #ifdef HAVE_IOCTLSOCKET
-#ifdef _WIN32
-#  include <winsock2.h>
+/* includes start */
+#ifdef HAVE_WINDOWS_H
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <windows.h>
+#  ifdef HAVE_WINSOCK2_H
+#    include <winsock2.h>
+#  endif
 #endif
-int main(void)
+
+int
+main ()
 {
-  /* ioctlsocket source code */
-  int socket = -1;
-  unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
-  (void)flags;
+
+/* ioctlsocket source code */
+ int socket;
+ unsigned long flags = ioctlsocket(socket, FIONBIO, &flags);
+
+  ;
  return 0;
 }

 #endif
-
 #ifdef HAVE_IOCTLSOCKET_CAMEL
-#include <proto/bsdsocket.h>
-int main(void)
+/* includes start */
+#ifdef HAVE_WINDOWS_H
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <windows.h>
+#  ifdef HAVE_WINSOCK2_H
+#    include <winsock2.h>
+#  endif
+#endif
+
+int
+main ()
 {
-  /* IoctlSocket source code */
-  if(0 != IoctlSocket(0, 0, 0))
-    return 1;
+
+/* IoctlSocket source code */
+    if(0 != IoctlSocket(0, 0, 0))
+      return 1;
+  ;
  return 0;
 }
 #endif
-
 #ifdef HAVE_IOCTLSOCKET_CAMEL_FIONBIO
-#include <proto/bsdsocket.h>
-#ifdef HAVE_SYS_IOCTL_H
-#  include <sys/ioctl.h>
+/* includes start */
+#ifdef HAVE_WINDOWS_H
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <windows.h>
+#  ifdef HAVE_WINSOCK2_H
+#    include <winsock2.h>
+#  endif
 #endif
-int main(void)
+
+int
+main ()
 {
-  /* IoctlSocket source code */
-  long flags = 0;
-  if(0 != IoctlSocket(0, FIONBIO, &flags))
-    return 1;
-  (void)flags;
+
+/* IoctlSocket source code */
+        long flags = 0;
+        if(0 != IoctlSocket(0, FIONBIO, &flags))
+          return 1;
+  ;
  return 0;
 }
 #endif
-
 #ifdef HAVE_IOCTLSOCKET_FIONBIO
-#ifdef _WIN32
-#  include <winsock2.h>
+/* includes start */
+#ifdef HAVE_WINDOWS_H
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <windows.h>
+#  ifdef HAVE_WINSOCK2_H
+#    include <winsock2.h>
+#  endif
 #endif
-int main(void)
+
+int
+main ()
 {
-  unsigned long flags = 0;
-  if(0 != ioctlsocket(0, FIONBIO, &flags))
-    return 1;
-  (void)flags;
+
+        int flags = 0;
+        if(0 != ioctlsocket(0, FIONBIO, &flags))
+          return 1;
+
+  ;
  return 0;
 }
 #endif
-
 #ifdef HAVE_IOCTL_FIONBIO
 /* headers for FIONBIO test */
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@ -212,18 +314,22 @@ int main(void)
 #ifdef HAVE_STROPTS_H
 #  include <stropts.h>
 #endif
-int main(void)
+
+int
+main ()
 {
-  int flags = 0;
-  if(0 != ioctl(0, FIONBIO, &flags))
-    return 1;
-  (void)flags;
+
+        int flags = 0;
+        if(0 != ioctl(0, FIONBIO, &flags))
+          return 1;
+
+  ;
  return 0;
 }
 #endif
-
 #ifdef HAVE_IOCTL_SIOCGIFADDR
 /* headers for FIONBIO test */
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@ -240,103 +346,156 @@ int main(void)
 #  include <stropts.h>
 #endif
 #include <net/if.h>
-int main(void)
+
+int
+main ()
 {
-  struct ifreq ifr;
-  if(0 != ioctl(0, SIOCGIFADDR, &ifr))
-    return 1;
-  (void)ifr;
+        struct ifreq ifr;
+        if(0 != ioctl(0, SIOCGIFADDR, &ifr))
+          return 1;
+
+  ;
  return 0;
 }
 #endif
-
 #ifdef HAVE_SETSOCKOPT_SO_NONBLOCK
-#ifdef _WIN32
-#  include <winsock2.h>
+/* includes start */
+#ifdef HAVE_WINDOWS_H
+#  ifndef WIN32_LEAN_AND_MEAN
+#    define WIN32_LEAN_AND_MEAN
+#  endif
+#  include <windows.h>
+#  ifdef HAVE_WINSOCK2_H
+#    include <winsock2.h>
+#  endif
 #endif
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
 #ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
-int main(void)
+/* includes end */
+
+int
+main ()
 {
-  if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
-    return 1;
+        if(0 != setsockopt(0, SOL_SOCKET, SO_NONBLOCK, 0, 0))
+          return 1;
+  ;
  return 0;
 }
 #endif
-
 #ifdef HAVE_GLIBC_STRERROR_R
 #include <string.h>
 #include <errno.h>

-static void check(char c) { (void)c; }
+void check(char c) {}

-int main(void)
-{
+int
+main () {
  char buffer[1024];
  /* This will not compile if strerror_r does not return a char* */
  check(strerror_r(EACCES, buffer, sizeof(buffer))[0]);
  return 0;
 }
 #endif
-
 #ifdef HAVE_POSIX_STRERROR_R
 #include <string.h>
 #include <errno.h>

-/* Float, because a pointer cannot be implicitly cast to float */
-static void check(float f) { (void)f; }
+/* float, because a pointer can't be implicitly cast to float */
+void check(float f) {}

-int main(void)
-{
+int
+main () {
  char buffer[1024];
  /* This will not compile if strerror_r does not return an int */
  check(strerror_r(EACCES, buffer, sizeof(buffer)));
  return 0;
 }
 #endif
-
 #ifdef HAVE_FSETXATTR_6
 #include <sys/xattr.h> /* header from libc, not from libattr */
-int main(void)
-{
+int
+main() {
  fsetxattr(0, 0, 0, 0, 0, 0);
  return 0;
 }
 #endif
-
 #ifdef HAVE_FSETXATTR_5
 #include <sys/xattr.h> /* header from libc, not from libattr */
-int main(void)
-{
-  fsetxattr(0, "", 0, 0, 0);
+int
+main() {
+  fsetxattr(0, 0, 0, 0, 0);
  return 0;
 }
 #endif
-
 #ifdef HAVE_CLOCK_GETTIME_MONOTONIC
 #include <time.h>
-int main(void)
-{
-  struct timespec ts;
-  (void)clock_gettime(CLOCK_MONOTONIC, &ts);
-  (void)ts;
+int
+main() {
+  struct timespec ts = {0, 0};
+  clock_gettime(CLOCK_MONOTONIC, &ts);
  return 0;
 }
 #endif
-
 #ifdef HAVE_BUILTIN_AVAILABLE
-int main(void)
-{
-  if(__builtin_available(macOS 10.12, iOS 5.0, *)) {}
+int
+main() {
+  if(__builtin_available(macOS 10.12, *)) {}
  return 0;
 }
 #endif
+#ifdef HAVE_VARIADIC_MACROS_C99
+#define c99_vmacro3(first, ...) fun3(first, __VA_ARGS__)
+#define c99_vmacro2(first, ...) fun2(first, __VA_ARGS__)

+int fun3(int arg1, int arg2, int arg3);
+int fun2(int arg1, int arg2);
+
+int fun3(int arg1, int arg2, int arg3) {
+  return arg1 + arg2 + arg3;
+}
+int fun2(int arg1, int arg2) {
+  return arg1 + arg2;
+}
+
+int
+main() {
+  int res3 = c99_vmacro3(1, 2, 3);
+  int res2 = c99_vmacro2(1, 2);
+  (void)res3;
+  (void)res2;
+  return 0;
+}
+#endif
+#ifdef HAVE_VARIADIC_MACROS_GCC
+#define gcc_vmacro3(first, args...) fun3(first, args)
+#define gcc_vmacro2(first, args...) fun2(first, args)
+
+int fun3(int arg1, int arg2, int arg3);
+int fun2(int arg1, int arg2);
+
+int fun3(int arg1, int arg2, int arg3) {
+  return arg1 + arg2 + arg3;
+}
+int fun2(int arg1, int arg2) {
+  return arg1 + arg2;
+}
+
+int
+main() {
+  int res3 = gcc_vmacro3(1, 2, 3);
+  int res2 = gcc_vmacro2(1, 2);
+  (void)res3;
+  (void)res2;
+  return 0;
+}
+#endif
 #ifdef HAVE_ATOMIC
+/* includes start */
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
@ -346,45 +505,28 @@ int main(void)
 #ifdef HAVE_STDATOMIC_H
 #  include <stdatomic.h>
 #endif
-int main(void)
-{
+/* includes end */
+
+int
+main() {
  _Atomic int i = 1;
-  i = 0;  /* Force an atomic-write operation. */
+  i = 0;  // Force an atomic-write operation.
  return i;
 }
 #endif
-
 #ifdef HAVE_WIN32_WINNT
-#ifdef _WIN32
-#  ifndef NOGDI
-#  define NOGDI
-#  endif
-#  include <windows.h>
+/* includes start */
+#ifdef WIN32
+#  include "../lib/setup-win32.h"
 #endif
+/* includes end */

 #define enquote(x) #x
 #define expand(x) enquote(x)
 #pragma message("_WIN32_WINNT=" expand(_WIN32_WINNT))

-int main(void)
-{
-  return 0;
-}
-#endif
-
-#ifdef MINGW64_VERSION
-#ifdef __MINGW32__
-#  include <_mingw.h>
-#endif
-
-#define enquote(x) #x
-#define expand(x) enquote(x)
-#pragma message("MINGW64_VERSION=" \
-  expand(__MINGW64_VERSION_MAJOR) "." \
-  expand(__MINGW64_VERSION_MINOR))
-
-int main(void)
-{
+int
+main() {
  return 0;
 }
 #endif
--- a/CMake/FindBearSSL.cmake
+++ b/CMake/FindBearSSL.cmake
@ -21,38 +21,12 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the BearSSL library
-#
-# Input variables:
-#
-# - `BEARSSL_INCLUDE_DIR`:   The BearSSL include directory.
-# - `BEARSSL_LIBRARY`:       Path to `bearssl` library.
-#
-# Result variables:
-#
-# - `BEARSSL_FOUND`:         System has BearSSL.
-# - `BEARSSL_INCLUDE_DIRS`:  The BearSSL include directories.
-# - `BEARSSL_LIBRARIES`:     The BearSSL library names.
+find_path(BEARSSL_INCLUDE_DIRS bearssl.h)

-if(DEFINED BEARSSL_INCLUDE_DIRS AND NOT DEFINED BEARSSL_INCLUDE_DIR)
-  message(WARNING "BEARSSL_INCLUDE_DIRS is deprecated, use BEARSSL_INCLUDE_DIR instead.")
-  set(BEARSSL_INCLUDE_DIR "${BEARSSL_INCLUDE_DIRS}")
-  unset(BEARSSL_INCLUDE_DIRS)
-endif()
-
-find_path(BEARSSL_INCLUDE_DIR NAMES "bearssl.h")
-find_library(BEARSSL_LIBRARY NAMES "bearssl")
+find_library(BEARSSL_LIBRARY bearssl)

 include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(BearSSL
-  REQUIRED_VARS
-    BEARSSL_INCLUDE_DIR
-    BEARSSL_LIBRARY
-)
+find_package_handle_standard_args(BEARSSL DEFAULT_MSG
+    BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)

-if(BEARSSL_FOUND)
-  set(BEARSSL_INCLUDE_DIRS ${BEARSSL_INCLUDE_DIR})
-  set(BEARSSL_LIBRARIES    ${BEARSSL_LIBRARY})
-endif()
-
-mark_as_advanced(BEARSSL_INCLUDE_DIR BEARSSL_LIBRARY)
+mark_as_advanced(BEARSSL_INCLUDE_DIRS BEARSSL_LIBRARY)
--- a/CMake/FindBrotli.cmake
+++ b/CMake/FindBrotli.cmake
@ -21,61 +21,23 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the brotli library
-#
-# Input variables:
-#
-# - `BROTLI_INCLUDE_DIR`:    The brotli include directory.
-# - `BROTLICOMMON_LIBRARY`:  Path to `brotlicommon` library.
-# - `BROTLIDEC_LIBRARY`:     Path to `brotlidec` library.
-#
-# Result variables:
-#
-# - `BROTLI_FOUND`:          System has brotli.
-# - `BROTLI_INCLUDE_DIRS`:   The brotli include directories.
-# - `BROTLI_LIBRARIES`:      The brotli library names.
-# - `BROTLI_LIBRARY_DIRS`:   The brotli library directories.
-# - `BROTLI_PC_REQUIRES`:    The brotli pkg-config packages.
-# - `BROTLI_CFLAGS`:         Required compiler flags.
-# - `BROTLI_VERSION`:        Version of brotli.
+include(FindPackageHandleStandardArgs)

-set(BROTLI_PC_REQUIRES "libbrotlidec")
+find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED BROTLI_INCLUDE_DIR AND
-   NOT DEFINED BROTLICOMMON_LIBRARY AND
-   NOT DEFINED BROTLIDEC_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(BROTLI "libbrotlicommon")
-  pkg_check_modules(BROTLIDEC ${BROTLI_PC_REQUIRES})
-endif()
+find_library(BROTLICOMMON_LIBRARY NAMES brotlicommon)
+find_library(BROTLIDEC_LIBRARY NAMES brotlidec)

-if(BROTLI_FOUND AND BROTLIDEC_FOUND)
-  set(Brotli_FOUND TRUE)
-  list(APPEND BROTLIDEC_LIBRARIES ${BROTLI_LIBRARIES})  # order is significant: brotlidec then brotlicommon
-  list(REVERSE BROTLIDEC_LIBRARIES)
-  list(REMOVE_DUPLICATES BROTLIDEC_LIBRARIES)
-  list(REVERSE BROTLIDEC_LIBRARIES)
-  set(BROTLI_LIBRARIES ${BROTLIDEC_LIBRARIES})
-  string(REPLACE ";" " " BROTLI_CFLAGS "${BROTLI_CFLAGS}")
-  message(STATUS "Found Brotli (via pkg-config): ${BROTLI_INCLUDE_DIRS} (found version \"${BROTLI_VERSION}\")")
-else()
-  find_path(BROTLI_INCLUDE_DIR "brotli/decode.h")
-  find_library(BROTLICOMMON_LIBRARY NAMES "brotlicommon")
-  find_library(BROTLIDEC_LIBRARY NAMES "brotlidec")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Brotli
+find_package_handle_standard_args(Brotli
+    FOUND_VAR
+      BROTLI_FOUND
    REQUIRED_VARS
-      BROTLI_INCLUDE_DIR
      BROTLIDEC_LIBRARY
      BROTLICOMMON_LIBRARY
-  )
+      BROTLI_INCLUDE_DIR
+    FAIL_MESSAGE
+      "Could NOT find Brotli"
+)

-  if(BROTLI_FOUND)
-    set(BROTLI_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
-    set(BROTLI_LIBRARIES ${BROTLIDEC_LIBRARY} ${BROTLICOMMON_LIBRARY})
-  endif()
-
-  mark_as_advanced(BROTLI_INCLUDE_DIR BROTLIDEC_LIBRARY BROTLICOMMON_LIBRARY)
-endif()
+set(BROTLI_INCLUDE_DIRS ${BROTLI_INCLUDE_DIR})
+set(BROTLI_LIBRARIES ${BROTLICOMMON_LIBRARY} ${BROTLIDEC_LIBRARY})
--- a/CMake/FindCARES.cmake
+++ b/CMake/FindCARES.cmake
@ -0,0 +1,47 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# - Find c-ares
+# Find the c-ares includes and library
+# This module defines
+#  CARES_INCLUDE_DIR, where to find ares.h, etc.
+#  CARES_LIBRARIES, the libraries needed to use c-ares.
+#  CARES_FOUND, If false, do not try to use c-ares.
+# also defined, but not for general use are
+# CARES_LIBRARY, where to find the c-ares library.
+
+find_path(CARES_INCLUDE_DIR ares.h)
+
+set(CARES_NAMES ${CARES_NAMES} cares)
+find_library(CARES_LIBRARY
+  NAMES ${CARES_NAMES}
+  )
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(CARES
+    REQUIRED_VARS CARES_LIBRARY CARES_INCLUDE_DIR)
+
+mark_as_advanced(
+  CARES_LIBRARY
+  CARES_INCLUDE_DIR
+  )
--- a/CMake/FindCares.cmake
+++ b/CMake/FindCares.cmake
@ -1,97 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the c-ares library
-#
-# Input variables:
-#
-# - `CARES_INCLUDE_DIR`:   The c-ares include directory.
-# - `CARES_LIBRARY`:       Path to `cares` library.
-#
-# Result variables:
-#
-# - `CARES_FOUND`:         System has c-ares.
-# - `CARES_INCLUDE_DIRS`:  The c-ares include directories.
-# - `CARES_LIBRARIES`:     The c-ares library names.
-# - `CARES_LIBRARY_DIRS`:  The c-ares library directories.
-# - `CARES_PC_REQUIRES`:   The c-ares pkg-config packages.
-# - `CARES_CFLAGS`:        Required compiler flags.
-# - `CARES_VERSION`:       Version of c-ares.
-
-set(CARES_PC_REQUIRES "libcares")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED CARES_INCLUDE_DIR AND
-   NOT DEFINED CARES_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(CARES ${CARES_PC_REQUIRES})
-endif()
-
-if(CARES_FOUND)
-  set(Cares_FOUND TRUE)
-  string(REPLACE ";" " " CARES_CFLAGS "${CARES_CFLAGS}")
-  message(STATUS "Found Cares (via pkg-config): ${CARES_INCLUDE_DIRS} (found version \"${CARES_VERSION}\")")
-else()
-  find_path(CARES_INCLUDE_DIR NAMES "ares.h")
-  find_library(CARES_LIBRARY NAMES ${CARES_NAMES} "cares")
-
-  unset(CARES_VERSION CACHE)
-  if(CARES_INCLUDE_DIR AND EXISTS "${CARES_INCLUDE_DIR}/ares_version.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+ARES_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+ARES_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+ARES_VERSION_PATCH[\t ]+([0-9]+).*")
-    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${CARES_INCLUDE_DIR}/ares_version.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(CARES_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Cares
-    REQUIRED_VARS
-      CARES_INCLUDE_DIR
-      CARES_LIBRARY
-    VERSION_VAR
-      CARES_VERSION
-  )
-
-  if(CARES_FOUND)
-    set(CARES_INCLUDE_DIRS ${CARES_INCLUDE_DIR})
-    set(CARES_LIBRARIES    ${CARES_LIBRARY})
-  endif()
-
-  mark_as_advanced(CARES_INCLUDE_DIR CARES_LIBRARY)
-endif()
-
-if(CARES_FOUND AND WIN32)
-  list(APPEND CARES_LIBRARIES "iphlpapi")  # for if_indextoname and others
-endif()
--- a/CMake/FindGSS.cmake
+++ b/CMake/FindGSS.cmake
@ -21,337 +21,292 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the GSS Kerberos library
+# - Try to find the GSS Kerberos library
+# Once done this will define
 #
-# Input variables:
+#  GSS_ROOT_DIR - Set this variable to the root installation of GSS
 #
-# - `GSS_ROOT_DIR`:      Set this variable to the root installation of GSS. (also supported as environment)
-#
-# Result variables:
-#
-# - `GSS_FOUND`:         System has the Heimdal library.
-# - `GSS_FLAVOUR`:       "GNU", "MIT" or "Heimdal" if anything found.
-# - `GSS_INCLUDE_DIRS`:  The GSS include directories.
-# - `GSS_LIBRARIES`:     The GSS library names.
-# - `GSS_LIBRARY_DIRS`:  The GSS library directories.
-# - `GSS_PC_REQUIRES`:   The GSS pkg-config packages.
-# - `GSS_CFLAGS`:        Required compiler flags.
-# - `GSS_VERSION`:       This is set to version advertised by pkg-config or read from manifest.
-#                        In case the library is found but no version info available it is set to "unknown"
+# Read-Only variables:
+#  GSS_FOUND - system has the Heimdal library
+#  GSS_FLAVOUR - "MIT" or "Heimdal" if anything found.
+#  GSS_INCLUDE_DIR - the Heimdal include directory
+#  GSS_LIBRARIES - The libraries needed to use GSS
+#  GSS_LINK_DIRECTORIES - Directories to add to linker search path
+#  GSS_LINKER_FLAGS - Additional linker flags
+#  GSS_COMPILER_FLAGS - Additional compiler flags
+#  GSS_VERSION - This is set to version advertised by pkg-config or read from manifest.
+#                In case the library is found but no version info available it'll be set to "unknown"

-set(_gnu_modname "gss")
-set(_mit_modname "mit-krb5-gssapi")
-set(_heimdal_modname "heimdal-gssapi")
+set(_MIT_MODNAME mit-krb5-gssapi)
+set(_HEIMDAL_MODNAME heimdal-gssapi)

 include(CheckIncludeFile)
 include(CheckIncludeFiles)
 include(CheckTypeSize)

-set(_gss_root_hints
-  "${GSS_ROOT_DIR}"
-  "$ENV{GSS_ROOT_DIR}"
+set(_GSS_ROOT_HINTS
+    "${GSS_ROOT_DIR}"
+    "$ENV{GSS_ROOT_DIR}"
 )

-# Try to find library using system pkg-config if user did not specify root dir
+# try to find library using system pkg-config if user didn't specify root dir
 if(NOT GSS_ROOT_DIR AND NOT "$ENV{GSS_ROOT_DIR}")
-  if(CURL_USE_PKGCONFIG)
+  if(UNIX)
    find_package(PkgConfig QUIET)
-    pkg_search_module(_GSS ${_gnu_modname} ${_mit_modname} ${_heimdal_modname})
-    list(APPEND _gss_root_hints "${_GSS_PREFIX}")
-  endif()
-  if(WIN32)
-    list(APPEND _gss_root_hints "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
+    pkg_search_module(_GSS_PKG ${_MIT_MODNAME} ${_HEIMDAL_MODNAME})
+    list(APPEND _GSS_ROOT_HINTS "${_GSS_PKG_PREFIX}")
+  elseif(WIN32)
+    list(APPEND _GSS_ROOT_HINTS "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos;InstallDir]")
  endif()
 endif()

-if(NOT _GSS_FOUND)  # Not found by pkg-config. Let us take more traditional approach.
-  find_file(_gss_configure_script
-    NAMES
-      "krb5-config"
-    HINTS
-      ${_gss_root_hints}
-    PATH_SUFFIXES
-      "bin"
-    NO_CMAKE_PATH
-    NO_CMAKE_ENVIRONMENT_PATH
+if(NOT _GSS_FOUND) #not found by pkg-config. Let's take more traditional approach.
+  find_file(_GSS_CONFIGURE_SCRIPT
+      NAMES
+          "krb5-config"
+      HINTS
+          ${_GSS_ROOT_HINTS}
+      PATH_SUFFIXES
+          bin
+      NO_CMAKE_PATH
+      NO_CMAKE_ENVIRONMENT_PATH
  )

-  # If not found in user-supplied directories, maybe system knows better
-  find_file(_gss_configure_script
-    NAMES
-      "krb5-config"
-    PATH_SUFFIXES
-      "bin"
+  # if not found in user-supplied directories, maybe system knows better
+  find_file(_GSS_CONFIGURE_SCRIPT
+      NAMES
+          "krb5-config"
+      PATH_SUFFIXES
+          bin
  )

-  if(_gss_configure_script)
+  if(_GSS_CONFIGURE_SCRIPT)
    execute_process(
-      COMMAND ${_gss_configure_script} "--cflags" "gssapi"
-      OUTPUT_VARIABLE _GSS_CFLAGS
-      RESULT_VARIABLE _gss_configure_failed
-      OUTPUT_STRIP_TRAILING_WHITESPACE
-    )
-    message(STATUS "FindGSS krb5-config --cflags: ${_GSS_CFLAGS}")
-    if(NOT _gss_configure_failed)  # 0 means success
-      # Should also work in an odd case when multiple directories are given
+          COMMAND ${_GSS_CONFIGURE_SCRIPT} "--cflags" "gssapi"
+          OUTPUT_VARIABLE _GSS_CFLAGS
+          RESULT_VARIABLE _GSS_CONFIGURE_FAILED
+          OUTPUT_STRIP_TRAILING_WHITESPACE
+      )
+    message(STATUS "CFLAGS: ${_GSS_CFLAGS}")
+    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
+      # should also work in an odd case when multiple directories are given
      string(STRIP "${_GSS_CFLAGS}" _GSS_CFLAGS)
      string(REGEX REPLACE " +-I" ";" _GSS_CFLAGS "${_GSS_CFLAGS}")
      string(REGEX REPLACE " +-([^I][^ \\t;]*)" ";-\\1" _GSS_CFLAGS "${_GSS_CFLAGS}")

-      foreach(_flag IN LISTS _GSS_CFLAGS)
-        if(_flag MATCHES "^-I")
+      foreach(_flag ${_GSS_CFLAGS})
+        if(_flag MATCHES "^-I.*")
          string(REGEX REPLACE "^-I" "" _val "${_flag}")
-          list(APPEND _GSS_INCLUDE_DIRS "${_val}")
+          list(APPEND _GSS_INCLUDE_DIR "${_val}")
        else()
-          list(APPEND _GSS_CFLAGS "${_flag}")
+          list(APPEND _GSS_COMPILER_FLAGS "${_flag}")
        endif()
      endforeach()
    endif()

    execute_process(
-      COMMAND ${_gss_configure_script} "--libs" "gssapi"
-      OUTPUT_VARIABLE _gss_lib_flags
-      RESULT_VARIABLE _gss_configure_failed
-      OUTPUT_STRIP_TRAILING_WHITESPACE
+        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--libs" "gssapi"
+        OUTPUT_VARIABLE _GSS_LIB_FLAGS
+        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
+        OUTPUT_STRIP_TRAILING_WHITESPACE
    )
-    message(STATUS "FindGSS krb5-config --libs: ${_gss_lib_flags}")
+    message(STATUS "LDFLAGS: ${_GSS_LIB_FLAGS}")

-    if(NOT _gss_configure_failed)  # 0 means success
-      # This script gives us libraries and link directories. Blah. We have to deal with it.
-      string(STRIP "${_gss_lib_flags}" _gss_lib_flags)
-      string(REGEX REPLACE " +-(L|l)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
-      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _gss_lib_flags "${_gss_lib_flags}")
+    if(NOT _GSS_CONFIGURE_FAILED) # 0 means success
+      # this script gives us libraries and link directories. Blah. We have to deal with it.
+      string(STRIP "${_GSS_LIB_FLAGS}" _GSS_LIB_FLAGS)
+      string(REGEX REPLACE " +-(L|l)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")
+      string(REGEX REPLACE " +-([^Ll][^ \\t;]*)" ";-\\1" _GSS_LIB_FLAGS "${_GSS_LIB_FLAGS}")

-      foreach(_flag IN LISTS _gss_lib_flags)
-        if(_flag MATCHES "^-l")
+      foreach(_flag ${_GSS_LIB_FLAGS})
+        if(_flag MATCHES "^-l.*")
          string(REGEX REPLACE "^-l" "" _val "${_flag}")
          list(APPEND _GSS_LIBRARIES "${_val}")
-        elseif(_flag MATCHES "^-L")
+        elseif(_flag MATCHES "^-L.*")
          string(REGEX REPLACE "^-L" "" _val "${_flag}")
-          list(APPEND _GSS_LIBRARY_DIRS "${_val}")
+          list(APPEND _GSS_LINK_DIRECTORIES "${_val}")
+        else()
+          list(APPEND _GSS_LINKER_FLAGS "${_flag}")
        endif()
      endforeach()
    endif()

    execute_process(
-      COMMAND ${_gss_configure_script} "--version"
-      OUTPUT_VARIABLE _GSS_VERSION
-      RESULT_VARIABLE _gss_configure_failed
-      OUTPUT_STRIP_TRAILING_WHITESPACE
+        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--version"
+        OUTPUT_VARIABLE _GSS_VERSION
+        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
+        OUTPUT_STRIP_TRAILING_WHITESPACE
    )

-    # Older versions may not have the "--version" parameter. In this case we just do not care.
-    if(_gss_configure_failed)
+    # older versions may not have the "--version" parameter. In this case we just don't care.
+    if(_GSS_CONFIGURE_FAILED)
      set(_GSS_VERSION 0)
    endif()

    execute_process(
-      COMMAND ${_gss_configure_script} "--vendor"
-      OUTPUT_VARIABLE _gss_vendor
-      RESULT_VARIABLE _gss_configure_failed
-      OUTPUT_STRIP_TRAILING_WHITESPACE
+        COMMAND ${_GSS_CONFIGURE_SCRIPT} "--vendor"
+        OUTPUT_VARIABLE _GSS_VENDOR
+        RESULT_VARIABLE _GSS_CONFIGURE_FAILED
+        OUTPUT_STRIP_TRAILING_WHITESPACE
    )

-    # Older versions may not have the "--vendor" parameter. In this case we just do not care.
-    if(_gss_configure_failed)
-      set(GSS_FLAVOUR "Heimdal")  # most probably, should not really matter
+    # older versions may not have the "--vendor" parameter. In this case we just don't care.
+    if(_GSS_CONFIGURE_FAILED)
+      set(GSS_FLAVOUR "Heimdal") # most probably, shouldn't really matter
    else()
-      if(_gss_vendor MATCHES "H|heimdal")
+      if(_GSS_VENDOR MATCHES ".*H|heimdal.*")
        set(GSS_FLAVOUR "Heimdal")
      else()
        set(GSS_FLAVOUR "MIT")
      endif()
    endif()

-  else()  # Either there is no config script or we are on a platform that does not provide one (Windows?)
+  else() # either there is no config script or we are on a platform that doesn't provide one (Windows?)

-    find_path(_GSS_INCLUDE_DIRS NAMES "gssapi/gssapi.h"
-      HINTS
-        ${_gss_root_hints}
-      PATH_SUFFIXES
-        "include"
-        "inc"
+    find_path(_GSS_INCLUDE_DIR
+        NAMES
+            "gssapi/gssapi.h"
+        HINTS
+            ${_GSS_ROOT_HINTS}
+        PATH_SUFFIXES
+            include
+            inc
    )

-    if(_GSS_INCLUDE_DIRS)  # jay, we have found something
-      cmake_push_check_state()
-      list(APPEND CMAKE_REQUIRED_INCLUDES "${_GSS_INCLUDE_DIRS}")
-      check_include_files("gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _gss_have_mit_headers)
+    if(_GSS_INCLUDE_DIR) #jay, we've found something
+      set(CMAKE_REQUIRED_INCLUDES "${_GSS_INCLUDE_DIR}")
+      check_include_files( "gssapi/gssapi_generic.h;gssapi/gssapi_krb5.h" _GSS_HAVE_MIT_HEADERS)

-      if(_gss_have_mit_headers)
+      if(_GSS_HAVE_MIT_HEADERS)
        set(GSS_FLAVOUR "MIT")
      else()
-        # Prevent compiling the header - just check if we can include it
-        list(APPEND CMAKE_REQUIRED_DEFINITIONS "-D__ROKEN_H__")
-        check_include_file("roken.h" _gss_have_roken_h)
+        # prevent compiling the header - just check if we can include it
+        list(APPEND CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
+        check_include_file( "roken.h" _GSS_HAVE_ROKEN_H)

-        check_include_file("heimdal/roken.h" _gss_have_heimdal_roken_h)
-        if(_gss_have_roken_h OR _gss_have_heimdal_roken_h)
+        check_include_file( "heimdal/roken.h" _GSS_HAVE_HEIMDAL_ROKEN_H)
+        if(_GSS_HAVE_ROKEN_H OR _GSS_HAVE_HEIMDAL_ROKEN_H)
          set(GSS_FLAVOUR "Heimdal")
        endif()
+        list(REMOVE_ITEM CMAKE_REQUIRED_DEFINITIONS -D__ROKEN_H__)
      endif()
-      cmake_pop_check_state()
    else()
-      # I am not convinced if this is the right way but this is what autotools do at the moment
-      find_path(_GSS_INCLUDE_DIRS NAMES "gssapi.h"
-        HINTS
-          ${_gss_root_hints}
-        PATH_SUFFIXES
-          "include"
-          "inc"
+      # I'm not convinced if this is the right way but this is what autotools do at the moment
+      find_path(_GSS_INCLUDE_DIR
+          NAMES
+              "gssapi.h"
+          HINTS
+              ${_GSS_ROOT_HINTS}
+          PATH_SUFFIXES
+              include
+              inc
      )

-      if(_GSS_INCLUDE_DIRS)
+      if(_GSS_INCLUDE_DIR)
        set(GSS_FLAVOUR "Heimdal")
-      else()
-        find_path(_GSS_INCLUDE_DIRS NAMES "gss.h"
-          HINTS
-            ${_gss_root_hints}
-          PATH_SUFFIXES
-            "include"
-        )
-
-        if(_GSS_INCLUDE_DIRS)
-          set(GSS_FLAVOUR "GNU")
-          set(GSS_PC_REQUIRES "gss")
-        endif()
      endif()
    endif()

-    # If we have headers, check if we can link libraries
+    # if we have headers, check if we can link libraries
    if(GSS_FLAVOUR)
-      set(_gss_libdir_suffixes "")
-      set(_gss_libdir_hints ${_gss_root_hints})
-      get_filename_component(_gss_calculated_potential_root "${_GSS_INCLUDE_DIRS}" DIRECTORY)
-      list(APPEND _gss_libdir_hints ${_gss_calculated_potential_root})
+      set(_GSS_LIBDIR_SUFFIXES "")
+      set(_GSS_LIBDIR_HINTS ${_GSS_ROOT_HINTS})
+      get_filename_component(_GSS_CALCULATED_POTENTIAL_ROOT "${_GSS_INCLUDE_DIR}" PATH)
+      list(APPEND _GSS_LIBDIR_HINTS ${_GSS_CALCULATED_POTENTIAL_ROOT})

      if(WIN32)
        if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-          list(APPEND _gss_libdir_suffixes "lib/AMD64")
-          if(GSS_FLAVOUR STREQUAL "GNU")
-            set(_gss_libname "gss")
-          elseif(GSS_FLAVOUR STREQUAL "MIT")
-            set(_gss_libname "gssapi64")
+          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/AMD64")
+          if(GSS_FLAVOUR STREQUAL "MIT")
+            set(_GSS_LIBNAME "gssapi64")
          else()
-            set(_gss_libname "libgssapi")
+            set(_GSS_LIBNAME "libgssapi")
          endif()
        else()
-          list(APPEND _gss_libdir_suffixes "lib/i386")
-          if(GSS_FLAVOUR STREQUAL "GNU")
-            set(_gss_libname "gss")
-          elseif(GSS_FLAVOUR STREQUAL "MIT")
-            set(_gss_libname "gssapi32")
+          list(APPEND _GSS_LIBDIR_SUFFIXES "lib/i386")
+          if(GSS_FLAVOUR STREQUAL "MIT")
+            set(_GSS_LIBNAME "gssapi32")
          else()
-            set(_gss_libname "libgssapi")
+            set(_GSS_LIBNAME "libgssapi")
          endif()
        endif()
      else()
-        list(APPEND _gss_libdir_suffixes "lib;lib64")  # those suffixes are not checked for HINTS
-        if(GSS_FLAVOUR STREQUAL "GNU")
-          set(_gss_libname "gss")
-        elseif(GSS_FLAVOUR STREQUAL "MIT")
-          set(_gss_libname "gssapi_krb5")
+        list(APPEND _GSS_LIBDIR_SUFFIXES "lib;lib64") # those suffixes are not checked for HINTS
+        if(GSS_FLAVOUR STREQUAL "MIT")
+          set(_GSS_LIBNAME "gssapi_krb5")
        else()
-          set(_gss_libname "gssapi")
+          set(_GSS_LIBNAME "gssapi")
        endif()
      endif()

-      find_library(_GSS_LIBRARIES NAMES ${_gss_libname}
-        HINTS
-          ${_gss_libdir_hints}
-        PATH_SUFFIXES
-          ${_gss_libdir_suffixes}
+      find_library(_GSS_LIBRARIES
+          NAMES
+              ${_GSS_LIBNAME}
+          HINTS
+              ${_GSS_LIBDIR_HINTS}
+          PATH_SUFFIXES
+              ${_GSS_LIBDIR_SUFFIXES}
      )
+
    endif()
  endif()
 else()
-  # _GSS_MODULE_NAME set since CMake 3.16
-  if(_GSS_MODULE_NAME STREQUAL _gnu_modname OR _GSS_${_gnu_modname}_VERSION)
-    set(GSS_FLAVOUR "GNU")
-    set(GSS_PC_REQUIRES "gss")
-    if(NOT _GSS_VERSION)  # for old CMake versions?
-      set(_GSS_VERSION ${_GSS_${_gnu_modname}_VERSION})
-    endif()
-  elseif(_GSS_MODULE_NAME STREQUAL _mit_modname OR _GSS_${_mit_modname}_VERSION)
+  if(_GSS_PKG_${_MIT_MODNAME}_VERSION)
    set(GSS_FLAVOUR "MIT")
-    set(GSS_PC_REQUIRES "mit-krb5-gssapi")
-    if(NOT _GSS_VERSION)  # for old CMake versions?
-      set(_GSS_VERSION ${_GSS_${_mit_modname}_VERSION})
-    endif()
+    set(_GSS_VERSION _GSS_PKG_${_MIT_MODNAME}_VERSION)
  else()
    set(GSS_FLAVOUR "Heimdal")
-    set(GSS_PC_REQUIRES "heimdal-gssapi")
-    if(NOT _GSS_VERSION)  # for old CMake versions?
-      set(_GSS_VERSION ${_GSS_${_heimdal_modname}_VERSION})
-    endif()
+    set(_GSS_VERSION _GSS_PKG_${_MIT_HEIMDAL}_VERSION)
  endif()
-  message(STATUS "Found GSS/${GSS_FLAVOUR} (via pkg-config): ${_GSS_INCLUDE_DIRS} (found version \"${_GSS_VERSION}\")")
 endif()

-string(REPLACE ";" " " _GSS_CFLAGS "${_GSS_CFLAGS}")
-
-set(GSS_INCLUDE_DIRS ${_GSS_INCLUDE_DIRS})
+set(GSS_INCLUDE_DIR ${_GSS_INCLUDE_DIR})
 set(GSS_LIBRARIES ${_GSS_LIBRARIES})
-set(GSS_LIBRARY_DIRS ${_GSS_LIBRARY_DIRS})
-set(GSS_CFLAGS ${_GSS_CFLAGS})
+set(GSS_LINK_DIRECTORIES ${_GSS_LINK_DIRECTORIES})
+set(GSS_LINKER_FLAGS ${_GSS_LINKER_FLAGS})
+set(GSS_COMPILER_FLAGS ${_GSS_COMPILER_FLAGS})
 set(GSS_VERSION ${_GSS_VERSION})

 if(GSS_FLAVOUR)
  if(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "Heimdal")
    if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-      set(_heimdal_manifest_file "Heimdal.Application.amd64.manifest")
+      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.amd64.manifest")
    else()
-      set(_heimdal_manifest_file "Heimdal.Application.x86.manifest")
+      set(HEIMDAL_MANIFEST_FILE "Heimdal.Application.x86.manifest")
    endif()

-    if(EXISTS "${GSS_INCLUDE_DIRS}/${_heimdal_manifest_file}")
-      file(STRINGS "${GSS_INCLUDE_DIRS}/${_heimdal_manifest_file}" _heimdal_version_str
-        REGEX "^.*version=\"[0-9]\\.[^\"]+\".*$")
+    if(EXISTS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}")
+      file(STRINGS "${GSS_INCLUDE_DIR}/${HEIMDAL_MANIFEST_FILE}" heimdal_version_str
+           REGEX "^.*version=\"[0-9]\\.[^\"]+\".*$")

-      string(REGEX MATCH "[0-9]\\.[^\"]+" GSS_VERSION "${_heimdal_version_str}")
+      string(REGEX MATCH "[0-9]\\.[^\"]+"
+             GSS_VERSION "${heimdal_version_str}")
    endif()

    if(NOT GSS_VERSION)
      set(GSS_VERSION "Heimdal Unknown")
    endif()
  elseif(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "MIT")
-    get_filename_component(_mit_version "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME
-      CACHE)
-    if(WIN32 AND _mit_version)
-      set(GSS_VERSION "${_mit_version}")
+    get_filename_component(_MIT_VERSION "[HKEY_LOCAL_MACHINE\\SOFTWARE\\MIT\\Kerberos\\SDK\\CurrentVersion;VersionString]" NAME CACHE)
+    if(WIN32 AND _MIT_VERSION)
+      set(GSS_VERSION "${_MIT_VERSION}")
    else()
      set(GSS_VERSION "MIT Unknown")
    endif()
-  elseif(NOT GSS_VERSION AND GSS_FLAVOUR STREQUAL "GNU")
-    if(GSS_INCLUDE_DIRS AND EXISTS "${GSS_INCLUDE_DIRS}/gss.h")
-      set(_version_regex "#[\t ]*define[\t ]+GSS_VERSION[\t ]+\"([^\"]*)\"")
-      file(STRINGS "${GSS_INCLUDE_DIRS}/gss.h" _version_str REGEX "${_version_regex}")
-      string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-      set(GSS_VERSION "${_version_str}")
-      unset(_version_regex)
-      unset(_version_str)
-    endif()
  endif()
 endif()

 include(FindPackageHandleStandardArgs)
+
+set(_GSS_REQUIRED_VARS GSS_LIBRARIES GSS_FLAVOUR)
+
 find_package_handle_standard_args(GSS
-  REQUIRED_VARS
-    GSS_FLAVOUR
-    GSS_LIBRARIES
-  VERSION_VAR
-    GSS_VERSION
-  FAIL_MESSAGE
-    "Could NOT find GSS, try to set the path to GSS root folder in the system variable GSS_ROOT_DIR"
+    REQUIRED_VARS
+        ${_GSS_REQUIRED_VARS}
+    VERSION_VAR
+        GSS_VERSION
+    FAIL_MESSAGE
+        "Could NOT find GSS, try to set the path to GSS root folder in the system variable GSS_ROOT_DIR"
 )

-mark_as_advanced(
-  _GSS_CFLAGS
-  _GSS_FOUND
-  _GSS_INCLUDE_DIRS
-  _GSS_LIBRARIES
-  _GSS_LIBRARY_DIRS
-  _GSS_MODULE_NAME
-  _GSS_PREFIX
-  _GSS_VERSION
-)
+mark_as_advanced(GSS_INCLUDE_DIR GSS_LIBRARIES)
--- a/CMake/FindLDAP.cmake
+++ b/CMake/FindLDAP.cmake
@ -1,111 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the ldap library
-#
-# Input variables:
-#
-# - `LDAP_INCLUDE_DIR`:   The ldap include directory.
-# - `LDAP_LIBRARY`:       Path to `ldap` library.
-# - `LDAP_LBER_LIBRARY`:  Path to `lber` library.
-#
-# Result variables:
-#
-# - `LDAP_FOUND`:         System has ldap.
-# - `LDAP_INCLUDE_DIRS`:  The ldap include directories.
-# - `LDAP_LIBRARIES`:     The ldap library names.
-# - `LDAP_LIBRARY_DIRS`:  The ldap library directories.
-# - `LDAP_PC_REQUIRES`:   The ldap pkg-config packages.
-# - `LDAP_CFLAGS`:        Required compiler flags.
-# - `LDAP_VERSION`:       Version of ldap.
-
-set(LDAP_PC_REQUIRES "ldap")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LDAP_INCLUDE_DIR AND
-   NOT DEFINED LDAP_LIBRARY AND
-   NOT DEFINED LDAP_LBER_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LDAP ${LDAP_PC_REQUIRES})
-  pkg_check_modules(LDAP_LBER "lber")
-endif()
-
-if(LDAP_FOUND AND LDAP_LBER_FOUND)
-  list(APPEND LDAP_LIBRARIES ${LDAP_LBER_LIBRARIES})
-  list(REVERSE LDAP_LIBRARIES)
-  list(REMOVE_DUPLICATES LDAP_LIBRARIES)
-  list(REVERSE LDAP_LIBRARIES)
-  string(REPLACE ";" " " LDAP_CFLAGS "${LDAP_CFLAGS}")
-  message(STATUS "Found LDAP (via pkg-config): ${LDAP_INCLUDE_DIRS} (found version \"${LDAP_VERSION}\")")
-else()
-  set(LDAP_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  # On Apple the SDK LDAP gets picked up from
-  # 'MacOSX.sdk/System/Library/Frameworks/LDAP.framework/Headers', which contains
-  # ldap.h and lber.h both being stubs to include <ldap.h> and <lber.h>.
-  # This causes an infinite inclusion loop in compile. Also do this for libraries
-  # to avoid picking up the 'ldap.framework' with a full path.
-  set(_save_cmake_system_framework_path ${CMAKE_SYSTEM_FRAMEWORK_PATH})
-  set(CMAKE_SYSTEM_FRAMEWORK_PATH "")
-  find_path(LDAP_INCLUDE_DIR NAMES "ldap.h")
-  find_library(LDAP_LIBRARY NAMES "ldap")
-  find_library(LDAP_LBER_LIBRARY NAMES "lber")
-  set(CMAKE_SYSTEM_FRAMEWORK_PATH ${_save_cmake_system_framework_path})
-
-  unset(LDAP_VERSION CACHE)
-  if(LDAP_INCLUDE_DIR AND EXISTS "${LDAP_INCLUDE_DIR}/ldap_features.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+LDAP_VENDOR_VERSION_PATCH[\t ]+([0-9]+).*")
-    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${LDAP_INCLUDE_DIR}/ldap_features.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(LDAP_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(LDAP
-    REQUIRED_VARS
-      LDAP_INCLUDE_DIR
-      LDAP_LIBRARY
-      LDAP_LBER_LIBRARY
-    VERSION_VAR
-      LDAP_VERSION
-  )
-
-  if(LDAP_FOUND)
-    set(LDAP_INCLUDE_DIRS ${LDAP_INCLUDE_DIR})
-    set(LDAP_LIBRARIES    ${LDAP_LIBRARY} ${LDAP_LBER_LIBRARY})
-  endif()
-
-  mark_as_advanced(LDAP_INCLUDE_DIR LDAP_LIBRARY LDAP_LBER_LIBRARY)
-endif()
--- a/CMake/FindLibPSL.cmake
+++ b/CMake/FindLibPSL.cmake
@ -0,0 +1,45 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# - Try to find the libpsl library
+# Once done this will define
+#
+# LIBPSL_FOUND - system has the libpsl library
+# LIBPSL_INCLUDE_DIR - the libpsl include directory
+# LIBPSL_LIBRARY - the libpsl library name
+
+find_path(LIBPSL_INCLUDE_DIR libpsl.h)
+
+find_library(LIBPSL_LIBRARY NAMES psl libpsl)
+
+if(LIBPSL_INCLUDE_DIR)
+  file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" libpsl_version_str REGEX "^#define[\t ]+PSL_VERSION[\t ]+\"(.*)\"")
+  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBPSL_VERSION "${libpsl_version_str}")
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(LibPSL
+    REQUIRED_VARS LIBPSL_LIBRARY LIBPSL_INCLUDE_DIR
+    VERSION_VAR LIBPSL_VERSION)
+
+mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
--- a/CMake/FindLibSSH2.cmake
+++ b/CMake/FindLibSSH2.cmake
@ -0,0 +1,45 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+# - Try to find the libssh2 library
+# Once done this will define
+#
+# LIBSSH2_FOUND - system has the libssh2 library
+# LIBSSH2_INCLUDE_DIR - the libssh2 include directory
+# LIBSSH2_LIBRARY - the libssh2 library name
+
+find_path(LIBSSH2_INCLUDE_DIR libssh2.h)
+
+find_library(LIBSSH2_LIBRARY NAMES ssh2 libssh2)
+
+if(LIBSSH2_INCLUDE_DIR)
+  file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" libssh2_version_str REGEX "^#define[\t ]+LIBSSH2_VERSION[\t ]+\"(.*)\"")
+  string(REGEX REPLACE "^.*\"([^\"]+)\"" "\\1"  LIBSSH2_VERSION "${libssh2_version_str}")
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(LibSSH2
+    REQUIRED_VARS LIBSSH2_LIBRARY LIBSSH2_INCLUDE_DIR
+    VERSION_VAR LIBSSH2_VERSION)
+
+mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
--- a/CMake/FindLibgsasl.cmake
+++ b/CMake/FindLibgsasl.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libgsasl library
-#
-# Input variables:
-#
-# - `LIBGSASL_INCLUDE_DIR`:   The libgsasl include directory.
-# - `LIBGSASL_LIBRARY`:       Path to `libgsasl` library.
-#
-# Result variables:
-#
-# - `LIBGSASL_FOUND`:         System has libgsasl.
-# - `LIBGSASL_INCLUDE_DIRS`:  The libgsasl include directories.
-# - `LIBGSASL_LIBRARIES`:     The libgsasl library names.
-# - `LIBGSASL_LIBRARY_DIRS`:  The libgsasl library directories.
-# - `LIBGSASL_PC_REQUIRES`:   The libgsasl pkg-config packages.
-# - `LIBGSASL_CFLAGS`:        Required compiler flags.
-# - `LIBGSASL_VERSION`:       Version of libgsasl.
-
-set(LIBGSASL_PC_REQUIRES "libgsasl")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBGSASL_INCLUDE_DIR AND
-   NOT DEFINED LIBGSASL_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBGSASL ${LIBGSASL_PC_REQUIRES})
-endif()
-
-if(LIBGSASL_FOUND)
-  set(Libgsasl_FOUND TRUE)
-  string(REPLACE ";" " " LIBGSASL_CFLAGS "${LIBGSASL_CFLAGS}")
-  message(STATUS "Found Libgsasl (via pkg-config): ${LIBGSASL_INCLUDE_DIRS} (found version \"${LIBGSASL_VERSION}\")")
-else()
-  find_path(LIBGSASL_INCLUDE_DIR NAMES "gsasl.h")
-  find_library(LIBGSASL_LIBRARY NAMES "gsasl" "libgsasl")
-
-  unset(LIBGSASL_VERSION CACHE)
-  if(LIBGSASL_INCLUDE_DIR AND EXISTS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h")
-    set(_version_regex "#[\t ]*define[\t ]+GSASL_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBGSASL_INCLUDE_DIR}/gsasl-version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBGSASL_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-    find_package_handle_standard_args(Libgsasl
-    REQUIRED_VARS
-      LIBGSASL_INCLUDE_DIR
-      LIBGSASL_LIBRARY
-    VERSION_VAR
-      LIBGSASL_VERSION
-  )
-
-  if(LIBGSASL_FOUND)
-    set(LIBGSASL_INCLUDE_DIRS ${LIBGSASL_INCLUDE_DIR})
-    set(LIBGSASL_LIBRARIES    ${LIBGSASL_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBGSASL_INCLUDE_DIR LIBGSASL_LIBRARY)
-endif()
--- a/CMake/FindLibidn2.cmake
+++ b/CMake/FindLibidn2.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libidn2 library
-#
-# Input variables:
-#
-# - `LIBIDN2_INCLUDE_DIR`:   The libidn2 include directory.
-# - `LIBIDN2_LIBRARY`:       Path to `libidn2` library.
-#
-# Result variables:
-#
-# - `LIBIDN2_FOUND`:         System has libidn2.
-# - `LIBIDN2_INCLUDE_DIRS`:  The libidn2 include directories.
-# - `LIBIDN2_LIBRARIES`:     The libidn2 library names.
-# - `LIBIDN2_LIBRARY_DIRS`:  The libidn2 library directories.
-# - `LIBIDN2_PC_REQUIRES`:   The libidn2 pkg-config packages.
-# - `LIBIDN2_CFLAGS`:        Required compiler flags.
-# - `LIBIDN2_VERSION`:       Version of libidn2.
-
-set(LIBIDN2_PC_REQUIRES "libidn2")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBIDN2_INCLUDE_DIR AND
-   NOT DEFINED LIBIDN2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBIDN2 ${LIBIDN2_PC_REQUIRES})
-endif()
-
-if(LIBIDN2_FOUND)
-  set(Libidn2_FOUND TRUE)
-  string(REPLACE ";" " " LIBIDN2_CFLAGS "${LIBIDN2_CFLAGS}")
-  message(STATUS "Found Libidn2 (via pkg-config): ${LIBIDN2_INCLUDE_DIRS} (found version \"${LIBIDN2_VERSION}\")")
-else()
-  find_path(LIBIDN2_INCLUDE_DIR NAMES "idn2.h")
-  find_library(LIBIDN2_LIBRARY NAMES "idn2" "libidn2")
-
-  unset(LIBIDN2_VERSION CACHE)
-  if(LIBIDN2_INCLUDE_DIR AND EXISTS "${LIBIDN2_INCLUDE_DIR}/idn2.h")
-    set(_version_regex "#[\t ]*define[\t ]+IDN2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBIDN2_INCLUDE_DIR}/idn2.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBIDN2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libidn2
-    REQUIRED_VARS
-      LIBIDN2_INCLUDE_DIR
-      LIBIDN2_LIBRARY
-    VERSION_VAR
-      LIBIDN2_VERSION
-  )
-
-  if(LIBIDN2_FOUND)
-    set(LIBIDN2_INCLUDE_DIRS ${LIBIDN2_INCLUDE_DIR})
-    set(LIBIDN2_LIBRARIES    ${LIBIDN2_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBIDN2_INCLUDE_DIR LIBIDN2_LIBRARY)
-endif()
--- a/CMake/FindLibpsl.cmake
+++ b/CMake/FindLibpsl.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libpsl library
-#
-# Input variables:
-#
-# - `LIBPSL_INCLUDE_DIR`:   The libpsl include directory.
-# - `LIBPSL_LIBRARY`:       Path to `libpsl` library.
-#
-# Result variables:
-#
-# - `LIBPSL_FOUND`:         System has libpsl.
-# - `LIBPSL_INCLUDE_DIRS`:  The libpsl include directories.
-# - `LIBPSL_LIBRARIES`:     The libpsl library names.
-# - `LIBPSL_LIBRARY_DIRS`:  The libpsl library directories.
-# - `LIBPSL_PC_REQUIRES`:   The libpsl pkg-config packages.
-# - `LIBPSL_CFLAGS`:        Required compiler flags.
-# - `LIBPSL_VERSION`:       Version of libpsl.
-
-set(LIBPSL_PC_REQUIRES "libpsl")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBPSL_INCLUDE_DIR AND
-   NOT DEFINED LIBPSL_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBPSL ${LIBPSL_PC_REQUIRES})
-endif()
-
-if(LIBPSL_FOUND AND LIBPSL_INCLUDE_DIRS)
-  set(Libpsl_FOUND TRUE)
-  string(REPLACE ";" " " LIBPSL_CFLAGS "${LIBPSL_CFLAGS}")
-  message(STATUS "Found Libpsl (via pkg-config): ${LIBPSL_INCLUDE_DIRS} (found version \"${LIBPSL_VERSION}\")")
-else()
-  find_path(LIBPSL_INCLUDE_DIR NAMES "libpsl.h")
-  find_library(LIBPSL_LIBRARY NAMES "psl" "libpsl")
-
-  unset(LIBPSL_VERSION CACHE)
-  if(LIBPSL_INCLUDE_DIR AND EXISTS "${LIBPSL_INCLUDE_DIR}/libpsl.h")
-    set(_version_regex "#[\t ]*define[\t ]+PSL_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBPSL_INCLUDE_DIR}/libpsl.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBPSL_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libpsl
-    REQUIRED_VARS
-      LIBPSL_INCLUDE_DIR
-      LIBPSL_LIBRARY
-    VERSION_VAR
-      LIBPSL_VERSION
-  )
-
-  if(LIBPSL_FOUND)
-    set(LIBPSL_INCLUDE_DIRS ${LIBPSL_INCLUDE_DIR})
-    set(LIBPSL_LIBRARIES    ${LIBPSL_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBPSL_INCLUDE_DIR LIBPSL_LIBRARY)
-endif()
--- a/CMake/FindLibrtmp.cmake
+++ b/CMake/FindLibrtmp.cmake
@ -1,103 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the librtmp library
-#
-# Input variables:
-#
-# - `LIBRTMP_INCLUDE_DIR`:   The librtmp include directory.
-# - `LIBRTMP_LIBRARY`:       Path to `librtmp` library.
-#
-# Result variables:
-#
-# - `LIBRTMP_FOUND`:         System has librtmp.
-# - `LIBRTMP_INCLUDE_DIRS`:  The librtmp include directories.
-# - `LIBRTMP_LIBRARIES`:     The librtmp library names.
-# - `LIBRTMP_LIBRARY_DIRS`:  The librtmp library directories.
-# - `LIBRTMP_PC_REQUIRES`:   The librtmp pkg-config packages.
-# - `LIBRTMP_CFLAGS`:        Required compiler flags.
-# - `LIBRTMP_VERSION`:       Version of librtmp.
-
-set(LIBRTMP_PC_REQUIRES "librtmp")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBRTMP_INCLUDE_DIR AND
-   NOT DEFINED LIBRTMP_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBRTMP ${LIBRTMP_PC_REQUIRES})
-endif()
-
-if(LIBRTMP_FOUND AND LIBRTMP_INCLUDE_DIRS)
-  set(Librtmp_FOUND TRUE)
-  string(REPLACE ";" " " LIBRTMP_CFLAGS "${LIBRTMP_CFLAGS}")
-  message(STATUS "Found Librtmp (via pkg-config): ${LIBRTMP_INCLUDE_DIRS} (found version \"${LIBRTMP_VERSION}\")")
-else()
-  find_path(LIBRTMP_INCLUDE_DIR NAMES "librtmp/rtmp.h")
-  find_library(LIBRTMP_LIBRARY NAMES "rtmp")
-
-  unset(LIBRTMP_VERSION CACHE)
-  if(LIBRTMP_INCLUDE_DIR AND EXISTS "${LIBRTMP_INCLUDE_DIR}/librtmp/rtmp.h")
-    set(_version_regex "#[\t ]*define[\t ]+RTMP_LIB_VERSION[\t ]+0x([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F]).*")
-    file(STRINGS "${LIBRTMP_INCLUDE_DIR}/librtmp/rtmp.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str1 "${_version_str}")
-    string(REGEX REPLACE "${_version_regex}" "\\2" _version_str2 "${_version_str}")
-    if(CMAKE_VERSION VERSION_LESS 3.13)
-      # No support for hex version numbers, just strip leading zeroes
-      string(REGEX REPLACE "^0" "" _version_str1 "${_version_str1}")
-      string(REGEX REPLACE "^0" "" _version_str2 "${_version_str2}")
-    else()
-      math(EXPR _version_str1 "0x${_version_str1}" OUTPUT_FORMAT DECIMAL)
-      math(EXPR _version_str2 "0x${_version_str2}" OUTPUT_FORMAT DECIMAL)
-    endif()
-    set(LIBRTMP_VERSION "${_version_str1}.${_version_str2}")
-    unset(_version_regex)
-    unset(_version_str1)
-    unset(_version_str2)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Librtmp
-    REQUIRED_VARS
-      LIBRTMP_INCLUDE_DIR
-      LIBRTMP_LIBRARY
-    VERSION_VAR
-      LIBRTMP_VERSION
-  )
-
-  if(LIBRTMP_FOUND)
-    set(LIBRTMP_INCLUDE_DIRS ${LIBRTMP_INCLUDE_DIR})
-    set(LIBRTMP_LIBRARIES    ${LIBRTMP_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBRTMP_INCLUDE_DIR LIBRTMP_LIBRARY)
-
-  # Necessary when linking a static librtmp
-  find_package(OpenSSL)
-  if(OPENSSL_FOUND)
-    list(APPEND LIBRTMP_LIBRARIES OpenSSL::SSL OpenSSL::Crypto)
-  endif()
-endif()
-
-if(LIBRTMP_FOUND AND WIN32)
-  list(APPEND LIBRTMP_LIBRARIES "winmm")
-endif()
--- a/CMake/FindLibssh.cmake
+++ b/CMake/FindLibssh.cmake
@ -1,97 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libssh library
-#
-# Input variables:
-#
-# - `LIBSSH_INCLUDE_DIR`:   The libssh include directory.
-# - `LIBSSH_LIBRARY`:       Path to libssh library.
-#
-# Result variables:
-#
-# - `LIBSSH_FOUND`:         System has libssh.
-# - `LIBSSH_INCLUDE_DIRS`:  The libssh include directories.
-# - `LIBSSH_LIBRARIES`:     The libssh library names.
-# - `LIBSSH_LIBRARY_DIRS`:  The libssh library directories.
-# - `LIBSSH_PC_REQUIRES`:   The libssh pkg-config packages.
-# - `LIBSSH_CFLAGS`:        Required compiler flags.
-# - `LIBSSH_VERSION`:       Version of libssh.
-
-set(LIBSSH_PC_REQUIRES "libssh")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBSSH_INCLUDE_DIR AND
-   NOT DEFINED LIBSSH_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBSSH ${LIBSSH_PC_REQUIRES})
-endif()
-
-if(LIBSSH_FOUND)
-  set(Libssh_FOUND TRUE)
-  string(REPLACE ";" " " LIBSSH_CFLAGS "${LIBSSH_CFLAGS}")
-  message(STATUS "Found Libssh (via pkg-config): ${LIBSSH_INCLUDE_DIRS} (found version \"${LIBSSH_VERSION}\")")
-else()
-  find_path(LIBSSH_INCLUDE_DIR NAMES "libssh/libssh.h")
-  find_library(LIBSSH_LIBRARY NAMES "ssh" "libssh")
-
-  unset(LIBSSH_VERSION CACHE)
-  if(LIBSSH_INCLUDE_DIR AND EXISTS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+LIBSSH_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+LIBSSH_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+LIBSSH_VERSION_MICRO[\t ]+([0-9]+).*")
-    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${LIBSSH_INCLUDE_DIR}/libssh/libssh_version.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(LIBSSH_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libssh
-    REQUIRED_VARS
-      LIBSSH_INCLUDE_DIR
-      LIBSSH_LIBRARY
-    VERSION_VAR
-      LIBSSH_VERSION
-  )
-
-  if(LIBSSH_FOUND)
-    set(LIBSSH_INCLUDE_DIRS ${LIBSSH_INCLUDE_DIR})
-    set(LIBSSH_LIBRARIES    ${LIBSSH_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBSSH_INCLUDE_DIR LIBSSH_LIBRARY)
-endif()
-
-if(LIBSSH_FOUND AND WIN32)
-  list(APPEND LIBSSH_LIBRARIES "iphlpapi")  # for if_nametoindex
-endif()
--- a/CMake/FindLibssh2.cmake
+++ b/CMake/FindLibssh2.cmake
@ -1,83 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libssh2 library
-#
-# Input variables:
-#
-# - `LIBSSH2_INCLUDE_DIR`:   The libssh2 include directory.
-# - `LIBSSH2_LIBRARY`:       Path to `libssh2` library.
-#
-# Result variables:
-#
-# - `LIBSSH2_FOUND`:         System has libssh2.
-# - `LIBSSH2_INCLUDE_DIRS`:  The libssh2 include directories.
-# - `LIBSSH2_LIBRARIES`:     The libssh2 library names.
-# - `LIBSSH2_LIBRARY_DIRS`:  The libssh2 library directories.
-# - `LIBSSH2_PC_REQUIRES`:   The libssh2 pkg-config packages.
-# - `LIBSSH2_CFLAGS`:        Required compiler flags.
-# - `LIBSSH2_VERSION`:       Version of libssh2.
-
-set(LIBSSH2_PC_REQUIRES "libssh2")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBSSH2_INCLUDE_DIR AND
-   NOT DEFINED LIBSSH2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBSSH2 ${LIBSSH2_PC_REQUIRES})
-endif()
-
-if(LIBSSH2_FOUND AND LIBSSH2_INCLUDE_DIRS)
-  set(Libssh2_FOUND TRUE)
-  string(REPLACE ";" " " LIBSSH2_CFLAGS "${LIBSSH2_CFLAGS}")
-  message(STATUS "Found Libssh2 (via pkg-config): ${LIBSSH2_INCLUDE_DIRS} (found version \"${LIBSSH2_VERSION}\")")
-else()
-  find_path(LIBSSH2_INCLUDE_DIR NAMES "libssh2.h")
-  find_library(LIBSSH2_LIBRARY NAMES "ssh2" "libssh2")
-
-  unset(LIBSSH2_VERSION CACHE)
-  if(LIBSSH2_INCLUDE_DIR AND EXISTS "${LIBSSH2_INCLUDE_DIR}/libssh2.h")
-    set(_version_regex "#[\t ]*define[\t ]+LIBSSH2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${LIBSSH2_INCLUDE_DIR}/libssh2.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(LIBSSH2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libssh2
-    REQUIRED_VARS
-      LIBSSH2_INCLUDE_DIR
-      LIBSSH2_LIBRARY
-    VERSION_VAR
-      LIBSSH2_VERSION
-  )
-
-  if(LIBSSH2_FOUND)
-    set(LIBSSH2_INCLUDE_DIRS ${LIBSSH2_INCLUDE_DIR})
-    set(LIBSSH2_LIBRARIES    ${LIBSSH2_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBSSH2_INCLUDE_DIR LIBSSH2_LIBRARY)
-endif()
--- a/CMake/FindLibuv.cmake
+++ b/CMake/FindLibuv.cmake
@ -1,93 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the libuv library
-#
-# Input variables:
-#
-# - `LIBUV_INCLUDE_DIR`:   The libuv include directory.
-# - `LIBUV_LIBRARY`:       Path to `libuv` library.
-#
-# Result variables:
-#
-# - `LIBUV_FOUND`:         System has libuv.
-# - `LIBUV_INCLUDE_DIRS`:  The libuv include directories.
-# - `LIBUV_LIBRARIES`:     The libuv library names.
-# - `LIBUV_LIBRARY_DIRS`:  The libuv library directories.
-# - `LIBUV_PC_REQUIRES`:   The libuv pkg-config packages.
-# - `LIBUV_CFLAGS`:        Required compiler flags.
-# - `LIBUV_VERSION`:       Version of libuv.
-
-set(LIBUV_PC_REQUIRES "libuv")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED LIBUV_INCLUDE_DIR AND
-   NOT DEFINED LIBUV_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(LIBUV ${LIBUV_PC_REQUIRES})
-endif()
-
-if(LIBUV_FOUND)
-  set(Libuv_FOUND TRUE)
-  string(REPLACE ";" " " LIBUV_CFLAGS "${LIBUV_CFLAGS}")
-  message(STATUS "Found Libuv (via pkg-config): ${LIBUV_INCLUDE_DIRS} (found version \"${LIBUV_VERSION}\")")
-else()
-  find_path(LIBUV_INCLUDE_DIR NAMES "uv.h")
-  find_library(LIBUV_LIBRARY NAMES "uv" "libuv")
-
-  unset(LIBUV_VERSION CACHE)
-  if(LIBUV_INCLUDE_DIR AND EXISTS "${LIBUV_INCLUDE_DIR}/uv/version.h")
-    set(_version_regex1 "#[\t ]*define[\t ]+UV_VERSION_MAJOR[\t ]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[\t ]+UV_VERSION_MINOR[\t ]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[\t ]+UV_VERSION_PATCH[\t ]+([0-9]+).*")
-    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${LIBUV_INCLUDE_DIR}/uv/version.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(LIBUV_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Libuv
-    REQUIRED_VARS
-      LIBUV_INCLUDE_DIR
-      LIBUV_LIBRARY
-    VERSION_VAR
-      LIBUV_VERSION
-  )
-
-  if(LIBUV_FOUND)
-    set(LIBUV_INCLUDE_DIRS ${LIBUV_INCLUDE_DIR})
-    set(LIBUV_LIBRARIES    ${LIBUV_LIBRARY})
-  endif()
-
-  mark_as_advanced(LIBUV_INCLUDE_DIR LIBUV_LIBRARY)
-endif()
--- a/CMake/FindMSH3.cmake
+++ b/CMake/FindMSH3.cmake
@ -21,52 +21,50 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the msh3 library
-#
-# Input variables:
-#
-# - `MSH3_INCLUDE_DIR`:   The msh3 include directory.
-# - `MSH3_LIBRARY`:       Path to `msh3` library.
-#
-# Result variables:
-#
-# - `MSH3_FOUND`:         System has msh3.
-# - `MSH3_INCLUDE_DIRS`:  The msh3 include directories.
-# - `MSH3_LIBRARIES`:     The msh3 library names.
-# - `MSH3_LIBRARY_DIRS`:  The msh3 library directories.
-# - `MSH3_PC_REQUIRES`:   The msh3 pkg-config packages.
-# - `MSH3_CFLAGS`:        Required compiler flags.
-# - `MSH3_VERSION`:       Version of msh3.

-set(MSH3_PC_REQUIRES "libmsh3")
+#[=======================================================================[.rst:
+FindMSH3
+----------

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED MSH3_INCLUDE_DIR AND
-   NOT DEFINED MSH3_LIBRARY)
+Find the msh3 library
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``MSH3_FOUND``
+  System has msh3
+``MSH3_INCLUDE_DIRS``
+  The msh3 include directories.
+``MSH3_LIBRARIES``
+  The libraries needed to use msh3
+#]=======================================================================]
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(MSH3 ${MSH3_PC_REQUIRES})
+  pkg_search_module(PC_MSH3 libmsh3)
 endif()

+find_path(MSH3_INCLUDE_DIR msh3.h
+  HINTS
+    ${PC_MSH3_INCLUDEDIR}
+    ${PC_MSH3_INCLUDE_DIRS}
+)
+
+find_library(MSH3_LIBRARY NAMES msh3
+  HINTS
+    ${PC_MSH3_LIBDIR}
+    ${PC_MSH3_LIBRARY_DIRS}
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(MSH3
+  REQUIRED_VARS
+    MSH3_LIBRARY
+    MSH3_INCLUDE_DIR
+)
+
 if(MSH3_FOUND)
-  string(REPLACE ";" " " MSH3_CFLAGS "${MSH3_CFLAGS}")
-  message(STATUS "Found MSH3 (via pkg-config): ${MSH3_INCLUDE_DIRS} (found version \"${MSH3_VERSION}\")")
-else()
-  set(MSH3_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  find_path(MSH3_INCLUDE_DIR NAMES "msh3.h")
-  find_library(MSH3_LIBRARY NAMES "msh3")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(MSH3
-    REQUIRED_VARS
-      MSH3_INCLUDE_DIR
-      MSH3_LIBRARY
-  )
-
-  if(MSH3_FOUND)
-    set(MSH3_INCLUDE_DIRS ${MSH3_INCLUDE_DIR})
-    set(MSH3_LIBRARIES    ${MSH3_LIBRARY})
-  endif()
-
-  mark_as_advanced(MSH3_INCLUDE_DIR MSH3_LIBRARY)
+  set(MSH3_LIBRARIES    ${MSH3_LIBRARY})
+  set(MSH3_INCLUDE_DIRS ${MSH3_INCLUDE_DIR})
 endif()
+
+mark_as_advanced(MSH3_INCLUDE_DIRS MSH3_LIBRARIES)
--- a/CMake/FindMbedTLS.cmake
+++ b/CMake/FindMbedTLS.cmake
@ -21,95 +21,16 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the mbedTLS library
-#
-# Input variables:
-#
-# - `MBEDTLS_INCLUDE_DIR`:   The mbedTLS include directory.
-# - `MBEDTLS_LIBRARY`:       Path to `mbedtls` library.
-# - `MBEDX509_LIBRARY`:      Path to `mbedx509` library.
-# - `MBEDCRYPTO_LIBRARY`:    Path to `mbedcrypto` library.
-#
-# Result variables:
-#
-# - `MBEDTLS_FOUND`:         System has mbedTLS.
-# - `MBEDTLS_INCLUDE_DIRS`:  The mbedTLS include directories.
-# - `MBEDTLS_LIBRARIES`:     The mbedTLS library names.
-# - `MBEDTLS_LIBRARY_DIRS`:  The mbedTLS library directories.
-# - `MBEDTLS_PC_REQUIRES`:   The mbedTLS pkg-config packages.
-# - `MBEDTLS_CFLAGS`:        Required compiler flags.
-# - `MBEDTLS_VERSION`:       Version of mbedTLS.
+find_path(MBEDTLS_INCLUDE_DIRS mbedtls/ssl.h)

-if(DEFINED MBEDTLS_INCLUDE_DIRS AND NOT DEFINED MBEDTLS_INCLUDE_DIR)
-  message(WARNING "MBEDTLS_INCLUDE_DIRS is deprecated, use MBEDTLS_INCLUDE_DIR instead.")
-  set(MBEDTLS_INCLUDE_DIR "${MBEDTLS_INCLUDE_DIRS}")
-  unset(MBEDTLS_INCLUDE_DIRS)
-endif()
+find_library(MBEDTLS_LIBRARY mbedtls)
+find_library(MBEDX509_LIBRARY mbedx509)
+find_library(MBEDCRYPTO_LIBRARY mbedcrypto)

-set(MBEDTLS_PC_REQUIRES "mbedtls")
+set(MBEDTLS_LIBRARIES "${MBEDTLS_LIBRARY}" "${MBEDX509_LIBRARY}" "${MBEDCRYPTO_LIBRARY}")

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED MBEDTLS_INCLUDE_DIR AND
-   NOT DEFINED MBEDTLS_LIBRARY AND
-   NOT DEFINED MBEDX509_LIBRARY AND
-   NOT DEFINED MBEDCRYPTO_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(MBEDTLS ${MBEDTLS_PC_REQUIRES})
-  pkg_check_modules(MBEDX509 "mbedx509")
-  pkg_check_modules(MBEDCRYPTO "mbedcrypto")
-endif()
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(MbedTLS DEFAULT_MSG
+    MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)

-if(MBEDTLS_FOUND AND MBEDX509_FOUND AND MBEDCRYPTO_FOUND)
-  set(MbedTLS_FOUND TRUE)
-  list(APPEND MBEDTLS_LIBRARIES ${MBEDX509_LIBRARIES} ${MBEDCRYPTO_LIBRARIES})
-  list(REVERSE MBEDTLS_LIBRARIES)
-  list(REMOVE_DUPLICATES MBEDTLS_LIBRARIES)
-  list(REVERSE MBEDTLS_LIBRARIES)
-  string(REPLACE ";" " " MBEDTLS_CFLAGS "${MBEDTLS_CFLAGS}")
-  message(STATUS "Found MbedTLS (via pkg-config): ${MBEDTLS_INCLUDE_DIRS} (found version \"${MBEDTLS_VERSION}\")")
-else()
-  set(MBEDTLS_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  find_path(MBEDTLS_INCLUDE_DIR NAMES "mbedtls/ssl.h")
-  find_library(MBEDTLS_LIBRARY NAMES "mbedtls" "libmbedtls")
-  find_library(MBEDX509_LIBRARY NAMES "mbedx509" "libmbedx509")
-  find_library(MBEDCRYPTO_LIBRARY NAMES "mbedcrypto" "libmbedcrypto")
-
-  unset(MBEDTLS_VERSION CACHE)
-  if(MBEDTLS_INCLUDE_DIR)
-    if(EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")  # 3.x
-      set(_version_header "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
-    elseif(EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")  # 2.x
-      set(_version_header "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")
-    else()
-      unset(_version_header)
-    endif()
-    if(_version_header)
-      set(_version_regex "#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"([0-9.]+)\"")
-      file(STRINGS "${_version_header}" _version_str REGEX "${_version_regex}")
-      string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-      set(MBEDTLS_VERSION "${_version_str}")
-      unset(_version_regex)
-      unset(_version_str)
-      unset(_version_header)
-    endif()
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(MbedTLS
-    REQUIRED_VARS
-      MBEDTLS_INCLUDE_DIR
-      MBEDTLS_LIBRARY
-      MBEDX509_LIBRARY
-      MBEDCRYPTO_LIBRARY
-    VERSION_VAR
-      MBEDTLS_VERSION
-  )
-
-  if(MBEDTLS_FOUND)
-    set(MBEDTLS_INCLUDE_DIRS ${MBEDTLS_INCLUDE_DIR})
-    set(MBEDTLS_LIBRARIES    ${MBEDTLS_LIBRARY} ${MBEDX509_LIBRARY} ${MBEDCRYPTO_LIBRARY})
-  endif()
-
-  mark_as_advanced(MBEDTLS_INCLUDE_DIR MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
-endif()
+mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARY MBEDX509_LIBRARY MBEDCRYPTO_LIBRARY)
--- a/CMake/FindNGHTTP2.cmake
+++ b/CMake/FindNGHTTP2.cmake
@ -21,62 +21,21 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the nghttp2 library
-#
-# Input variables:
-#
-# - `NGHTTP2_INCLUDE_DIR`:   The nghttp2 include directory.
-# - `NGHTTP2_LIBRARY`:       Path to `nghttp2` library.
-#
-# Result variables:
-#
-# - `NGHTTP2_FOUND`:         System has nghttp2.
-# - `NGHTTP2_INCLUDE_DIRS`:  The nghttp2 include directories.
-# - `NGHTTP2_LIBRARIES`:     The nghttp2 library names.
-# - `NGHTTP2_LIBRARY_DIRS`:  The nghttp2 library directories.
-# - `NGHTTP2_PC_REQUIRES`:   The nghttp2 pkg-config packages.
-# - `NGHTTP2_CFLAGS`:        Required compiler flags.
-# - `NGHTTP2_VERSION`:       Version of nghttp2.
+include(FindPackageHandleStandardArgs)

-set(NGHTTP2_PC_REQUIRES "libnghttp2")
+find_path(NGHTTP2_INCLUDE_DIR "nghttp2/nghttp2.h")

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NGHTTP2_INCLUDE_DIR AND
-   NOT DEFINED NGHTTP2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(NGHTTP2 ${NGHTTP2_PC_REQUIRES})
-endif()
+find_library(NGHTTP2_LIBRARY NAMES nghttp2)

-if(NGHTTP2_FOUND)
-  string(REPLACE ";" " " NGHTTP2_CFLAGS "${NGHTTP2_CFLAGS}")
-  message(STATUS "Found NGHTTP2 (via pkg-config): ${NGHTTP2_INCLUDE_DIRS} (found version \"${NGHTTP2_VERSION}\")")
-else()
-  find_path(NGHTTP2_INCLUDE_DIR NAMES "nghttp2/nghttp2.h")
-  find_library(NGHTTP2_LIBRARY NAMES "nghttp2" "nghttp2_static")
-
-  unset(NGHTTP2_VERSION CACHE)
-  if(NGHTTP2_INCLUDE_DIR AND EXISTS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h")
-    set(_version_regex "#[\t ]*define[\t ]+NGHTTP2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${NGHTTP2_INCLUDE_DIR}/nghttp2/nghttp2ver.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(NGHTTP2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(NGHTTP2
+find_package_handle_standard_args(NGHTTP2
+    FOUND_VAR
+      NGHTTP2_FOUND
    REQUIRED_VARS
-      NGHTTP2_INCLUDE_DIR
      NGHTTP2_LIBRARY
-    VERSION_VAR
-      NGHTTP2_VERSION
-  )
+      NGHTTP2_INCLUDE_DIR
+)

-  if(NGHTTP2_FOUND)
-    set(NGHTTP2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
-    set(NGHTTP2_LIBRARIES    ${NGHTTP2_LIBRARY})
-  endif()
+set(NGHTTP2_INCLUDE_DIRS ${NGHTTP2_INCLUDE_DIR})
+set(NGHTTP2_LIBRARIES ${NGHTTP2_LIBRARY})

-  mark_as_advanced(NGHTTP2_INCLUDE_DIR NGHTTP2_LIBRARY)
-endif()
+mark_as_advanced(NGHTTP2_INCLUDE_DIRS NGHTTP2_LIBRARIES)
--- a/CMake/FindNGHTTP3.cmake
+++ b/CMake/FindNGHTTP3.cmake
@ -21,62 +21,58 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the nghttp3 library
-#
-# Input variables:
-#
-# - `NGHTTP3_INCLUDE_DIR`:   The nghttp3 include directory.
-# - `NGHTTP3_LIBRARY`:       Path to `nghttp3` library.
-#
-# Result variables:
-#
-# - `NGHTTP3_FOUND`:         System has nghttp3.
-# - `NGHTTP3_INCLUDE_DIRS`:  The nghttp3 include directories.
-# - `NGHTTP3_LIBRARIES`:     The nghttp3 library names.
-# - `NGHTTP3_LIBRARY_DIRS`:  The nghttp3 library directories.
-# - `NGHTTP3_PC_REQUIRES`:   The nghttp3 pkg-config packages.
-# - `NGHTTP3_CFLAGS`:        Required compiler flags.
-# - `NGHTTP3_VERSION`:       Version of nghttp3.

-set(NGHTTP3_PC_REQUIRES "libnghttp3")
+#[=======================================================================[.rst:
+FindNGHTTP3
+----------

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NGHTTP3_INCLUDE_DIR AND
-   NOT DEFINED NGHTTP3_LIBRARY)
+Find the nghttp3 library
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``NGHTTP3_FOUND``
+  System has nghttp3
+``NGHTTP3_INCLUDE_DIRS``
+  The nghttp3 include directories.
+``NGHTTP3_LIBRARIES``
+  The libraries needed to use nghttp3
+``NGHTTP3_VERSION``
+  version of nghttp3.
+#]=======================================================================]
+
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(NGHTTP3 ${NGHTTP3_PC_REQUIRES})
+  pkg_search_module(PC_NGHTTP3 libnghttp3)
 endif()

+find_path(NGHTTP3_INCLUDE_DIR nghttp3/nghttp3.h
+  HINTS
+    ${PC_NGHTTP3_INCLUDEDIR}
+    ${PC_NGHTTP3_INCLUDE_DIRS}
+)
+
+find_library(NGHTTP3_LIBRARY NAMES nghttp3
+  HINTS
+    ${PC_NGHTTP3_LIBDIR}
+    ${PC_NGHTTP3_LIBRARY_DIRS}
+)
+
+if(PC_NGHTTP3_VERSION)
+  set(NGHTTP3_VERSION ${PC_NGHTTP3_VERSION})
+endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NGHTTP3
+  REQUIRED_VARS
+    NGHTTP3_LIBRARY
+    NGHTTP3_INCLUDE_DIR
+  VERSION_VAR NGHTTP3_VERSION
+)
+
 if(NGHTTP3_FOUND)
-  string(REPLACE ";" " " NGHTTP3_CFLAGS "${NGHTTP3_CFLAGS}")
-  message(STATUS "Found NGHTTP3 (via pkg-config): ${NGHTTP3_INCLUDE_DIRS} (found version \"${NGHTTP3_VERSION}\")")
-else()
-  find_path(NGHTTP3_INCLUDE_DIR NAMES "nghttp3/nghttp3.h")
-  find_library(NGHTTP3_LIBRARY NAMES "nghttp3")
-
-  unset(NGHTTP3_VERSION CACHE)
-  if(NGHTTP3_INCLUDE_DIR AND EXISTS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h")
-    set(_version_regex "#[\t ]*define[\t ]+NGHTTP3_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${NGHTTP3_INCLUDE_DIR}/nghttp3/version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(NGHTTP3_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(NGHTTP3
-    REQUIRED_VARS
-      NGHTTP3_INCLUDE_DIR
-      NGHTTP3_LIBRARY
-    VERSION_VAR
-      NGHTTP3_VERSION
-  )
-
-  if(NGHTTP3_FOUND)
-    set(NGHTTP3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
-    set(NGHTTP3_LIBRARIES    ${NGHTTP3_LIBRARY})
-  endif()
-
-  mark_as_advanced(NGHTTP3_INCLUDE_DIR NGHTTP3_LIBRARY)
+  set(NGHTTP3_LIBRARIES    ${NGHTTP3_LIBRARY})
+  set(NGHTTP3_INCLUDE_DIRS ${NGHTTP3_INCLUDE_DIR})
 endif()
+
+mark_as_advanced(NGHTTP3_INCLUDE_DIRS NGHTTP3_LIBRARIES)
--- a/CMake/FindNGTCP2.cmake
+++ b/CMake/FindNGTCP2.cmake
@ -21,110 +21,95 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the ngtcp2 library
-#
-# This module accepts optional COMPONENTS to control the crypto library (these are
-# mutually exclusive):
-#
-# - quictls:    Use `libngtcp2_crypto_quictls`.   (choose this for LibreSSL)
-# - BoringSSL:  Use `libngtcp2_crypto_boringssl`. (choose this for AWS-LC)
-# - wolfSSL:    Use `libngtcp2_crypto_wolfssl`.
-# - GnuTLS:     Use `libngtcp2_crypto_gnutls`.
-#
-# Input variables:
-#
-# - `NGTCP2_INCLUDE_DIR`:   The ngtcp2 include directory.
-# - `NGTCP2_LIBRARY`:       Path to `ngtcp2` library.
-#
-# Result variables:
-#
-# - `NGTCP2_FOUND`:         System has ngtcp2.
-# - `NGTCP2_INCLUDE_DIRS`:  The ngtcp2 include directories.
-# - `NGTCP2_LIBRARIES`:     The ngtcp2 library names.
-# - `NGTCP2_LIBRARY_DIRS`:  The ngtcp2 library directories.
-# - `NGTCP2_PC_REQUIRES`:   The ngtcp2 pkg-config packages.
-# - `NGTCP2_CFLAGS`:        Required compiler flags.
-# - `NGTCP2_VERSION`:       Version of ngtcp2.
+
+#[=======================================================================[.rst:
+FindNGTCP2
+----------
+
+Find the ngtcp2 library
+
+This module accepts optional COMPONENTS to control the crypto library (these are
+mutually exclusive)::
+
+  OpenSSL:  Use libngtcp2_crypto_quictls
+  GnuTLS:   Use libngtcp2_crypto_gnutls
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``NGTCP2_FOUND``
+  System has ngtcp2
+``NGTCP2_INCLUDE_DIRS``
+  The ngtcp2 include directories.
+``NGTCP2_LIBRARIES``
+  The libraries needed to use ngtcp2
+``NGTCP2_VERSION``
+  version of ngtcp2.
+#]=======================================================================]
+
+if(UNIX)
+  find_package(PkgConfig QUIET)
+  pkg_search_module(PC_NGTCP2 libngtcp2)
+endif()
+
+find_path(NGTCP2_INCLUDE_DIR ngtcp2/ngtcp2.h
+  HINTS
+    ${PC_NGTCP2_INCLUDEDIR}
+    ${PC_NGTCP2_INCLUDE_DIRS}
+)
+
+find_library(NGTCP2_LIBRARY NAMES ngtcp2
+  HINTS
+    ${PC_NGTCP2_LIBDIR}
+    ${PC_NGTCP2_LIBRARY_DIRS}
+)
+
+if(PC_NGTCP2_VERSION)
+  set(NGTCP2_VERSION ${PC_NGTCP2_VERSION})
+endif()

 if(NGTCP2_FIND_COMPONENTS)
-  set(_ngtcp2_crypto_backend "")
-  foreach(_component IN LISTS NGTCP2_FIND_COMPONENTS)
-    if(_component MATCHES "^(BoringSSL|quictls|wolfSSL|GnuTLS)")
-      if(_ngtcp2_crypto_backend)
+  set(NGTCP2_CRYPTO_BACKEND "")
+  foreach(component IN LISTS NGTCP2_FIND_COMPONENTS)
+    if(component MATCHES "^(BoringSSL|quictls|wolfSSL|GnuTLS)")
+      if(NGTCP2_CRYPTO_BACKEND)
        message(FATAL_ERROR "NGTCP2: Only one crypto library can be selected")
      endif()
-      set(_ngtcp2_crypto_backend ${_component})
+      set(NGTCP2_CRYPTO_BACKEND ${component})
    endif()
  endforeach()

-  if(_ngtcp2_crypto_backend)
-    string(TOLOWER "ngtcp2_crypto_${_ngtcp2_crypto_backend}" _crypto_library_lower)
-    string(TOUPPER "ngtcp2_crypto_${_ngtcp2_crypto_backend}" _crypto_library_upper)
-  endif()
-endif()
-
-set(NGTCP2_PC_REQUIRES "libngtcp2")
-if(_ngtcp2_crypto_backend)
-  set(NGTCP2_CRYPTO_PC_REQUIRES "lib${_crypto_library_lower}")
-endif()
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NGTCP2_INCLUDE_DIR AND
-   NOT DEFINED NGTCP2_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(NGTCP2 ${NGTCP2_PC_REQUIRES})
-  if(_ngtcp2_crypto_backend)
-    pkg_check_modules("${_crypto_library_upper}" ${NGTCP2_CRYPTO_PC_REQUIRES})
-  else()
-    set("${_crypto_library_upper}_FOUND" TRUE)
-  endif()
-endif()
-
-list(APPEND NGTCP2_PC_REQUIRES ${NGTCP2_CRYPTO_PC_REQUIRES})
-
-if(NGTCP2_FOUND AND "${${_crypto_library_upper}_FOUND}")
-  list(APPEND NGTCP2_LIBRARIES "${${_crypto_library_upper}_LIBRARIES}")
-  list(REMOVE_DUPLICATES NGTCP2_LIBRARIES)
-  string(REPLACE ";" " " NGTCP2_CFLAGS "${NGTCP2_CFLAGS}")
-  message(STATUS "Found NGTCP2 (via pkg-config): ${NGTCP2_INCLUDE_DIRS} (found version \"${NGTCP2_VERSION}\")")
-else()
-  find_path(NGTCP2_INCLUDE_DIR NAMES "ngtcp2/ngtcp2.h")
-  find_library(NGTCP2_LIBRARY NAMES "ngtcp2")
-
-  unset(NGTCP2_VERSION CACHE)
-  if(NGTCP2_INCLUDE_DIR AND EXISTS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h")
-    set(_version_regex "#[\t ]*define[\t ]+NGTCP2_VERSION[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${NGTCP2_INCLUDE_DIR}/ngtcp2/version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(NGTCP2_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  if(_ngtcp2_crypto_backend)
-    get_filename_component(_ngtcp2_library_dir "${NGTCP2_LIBRARY}" DIRECTORY)
-    find_library(${_crypto_library_upper}_LIBRARY NAMES ${_crypto_library_lower} HINTS ${_ngtcp2_library_dir})
-
-    if(${_crypto_library_upper}_LIBRARY)
-      set(NGTCP2_${_ngtcp2_crypto_backend}_FOUND TRUE)
-      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library_upper}_LIBRARY})
+  if(NGTCP2_CRYPTO_BACKEND)
+    string(TOLOWER "ngtcp2_crypto_${NGTCP2_CRYPTO_BACKEND}" _crypto_library)
+    if(UNIX)
+      pkg_search_module(PC_${_crypto_library} lib${_crypto_library})
+    endif()
+    find_library(${_crypto_library}_LIBRARY
+      NAMES
+        ${_crypto_library}
+      HINTS
+        ${PC_${_crypto_library}_LIBDIR}
+        ${PC_${_crypto_library}_LIBRARY_DIRS}
+    )
+    if(${_crypto_library}_LIBRARY)
+      set(NGTCP2_${NGTCP2_CRYPTO_BACKEND}_FOUND TRUE)
+      set(NGTCP2_CRYPTO_LIBRARY ${${_crypto_library}_LIBRARY})
    endif()
  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(NGTCP2
-    REQUIRED_VARS
-      NGTCP2_INCLUDE_DIR
-      NGTCP2_LIBRARY
-    VERSION_VAR
-      NGTCP2_VERSION
-    HANDLE_COMPONENTS
-  )
-
-  if(NGTCP2_FOUND)
-    set(NGTCP2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
-    set(NGTCP2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
-  endif()
-
-  mark_as_advanced(NGTCP2_INCLUDE_DIR NGTCP2_LIBRARY NGTCP2_CRYPTO_LIBRARY)
 endif()
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NGTCP2
+  REQUIRED_VARS
+    NGTCP2_LIBRARY
+    NGTCP2_INCLUDE_DIR
+  VERSION_VAR NGTCP2_VERSION
+  HANDLE_COMPONENTS
+)
+
+if(NGTCP2_FOUND)
+  set(NGTCP2_LIBRARIES    ${NGTCP2_LIBRARY} ${NGTCP2_CRYPTO_LIBRARY})
+  set(NGTCP2_INCLUDE_DIRS ${NGTCP2_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(NGTCP2_INCLUDE_DIRS NGTCP2_LIBRARIES)
--- a/CMake/FindNSS.cmake
+++ b/CMake/FindNSS.cmake
@ -0,0 +1,40 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+if(UNIX)
+  find_package(PkgConfig QUIET)
+  pkg_search_module(PC_NSS nss)
+endif()
+if(NOT PC_NSS_FOUND)
+  return()
+endif()
+
+set(NSS_LIBRARIES ${PC_NSS_LINK_LIBRARIES})
+set(NSS_INCLUDE_DIRS ${PC_NSS_INCLUDE_DIRS})
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(NSS
+    REQUIRED_VARS NSS_LIBRARIES NSS_INCLUDE_DIRS
+    VERSION_VAR PC_NSS_VERSION)
+
+mark_as_advanced(NSS_INCLUDE_DIRS NSS_LIBRARIES)
--- a/CMake/FindNettle.cmake
+++ b/CMake/FindNettle.cmake
@ -1,88 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the nettle library
-#
-# Input variables:
-#
-# - `NETTLE_INCLUDE_DIR`:   The nettle include directory.
-# - `NETTLE_LIBRARY`:       Path to `nettle` library.
-#
-# Result variables:
-#
-# - `NETTLE_FOUND`:         System has nettle.
-# - `NETTLE_INCLUDE_DIRS`:  The nettle include directories.
-# - `NETTLE_LIBRARIES`:     The nettle library names.
-# - `NETTLE_LIBRARY_DIRS`:  The nettle library directories.
-# - `NETTLE_PC_REQUIRES`:   The nettle pkg-config packages.
-# - `NETTLE_CFLAGS`:        Required compiler flags.
-# - `NETTLE_VERSION`:       Version of nettle.
-
-set(NETTLE_PC_REQUIRES "nettle")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED NETTLE_INCLUDE_DIR AND
-   NOT DEFINED NETTLE_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(NETTLE ${NETTLE_PC_REQUIRES})
-endif()
-
-if(NETTLE_FOUND)
-  set(Nettle_FOUND TRUE)
-  string(REPLACE ";" " " NETTLE_CFLAGS "${NETTLE_CFLAGS}")
-  message(STATUS "Found Nettle (via pkg-config): ${NETTLE_INCLUDE_DIRS} (found version \"${NETTLE_VERSION}\")")
-else()
-  find_path(NETTLE_INCLUDE_DIR NAMES "nettle/sha2.h")
-  find_library(NETTLE_LIBRARY NAMES "nettle")
-
-  unset(NETTLE_VERSION CACHE)
-  if(NETTLE_INCLUDE_DIR AND EXISTS "${NETTLE_INCLUDE_DIR}/nettle/version.h")
-    set(_version_regex1 "#[\t ]*define[ \t]+NETTLE_VERSION_MAJOR[ \t]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[ \t]+NETTLE_VERSION_MINOR[ \t]+([0-9]+).*")
-    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${NETTLE_INCLUDE_DIR}/nettle/version.h" _version_str2 REGEX "${_version_regex2}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    set(NETTLE_VERSION "${_version_str1}.${_version_str2}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_str1)
-    unset(_version_str2)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Nettle
-    REQUIRED_VARS
-      NETTLE_INCLUDE_DIR
-      NETTLE_LIBRARY
-    VERSION_VAR
-      NETTLE_VERSION
-  )
-
-  if(NETTLE_FOUND)
-    set(NETTLE_INCLUDE_DIRS ${NETTLE_INCLUDE_DIR})
-    set(NETTLE_LIBRARIES    ${NETTLE_LIBRARY})
-  endif()
-
-  mark_as_advanced(NETTLE_INCLUDE_DIR NETTLE_LIBRARY)
-endif()
--- a/CMake/FindQUICHE.cmake
+++ b/CMake/FindQUICHE.cmake
@ -0,0 +1,70 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+
+#[=======================================================================[.rst:
+FindQUICHE
+----------
+
+Find the quiche library
+
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``QUICHE_FOUND``
+  System has quiche
+``QUICHE_INCLUDE_DIRS``
+  The quiche include directories.
+``QUICHE_LIBRARIES``
+  The libraries needed to use quiche
+#]=======================================================================]
+if(UNIX)
+  find_package(PkgConfig QUIET)
+  pkg_search_module(PC_QUICHE quiche)
+endif()
+
+find_path(QUICHE_INCLUDE_DIR quiche.h
+  HINTS
+    ${PC_QUICHE_INCLUDEDIR}
+    ${PC_QUICHE_INCLUDE_DIRS}
+)
+
+find_library(QUICHE_LIBRARY NAMES quiche
+  HINTS
+    ${PC_QUICHE_LIBDIR}
+    ${PC_QUICHE_LIBRARY_DIRS}
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(QUICHE
+  REQUIRED_VARS
+    QUICHE_LIBRARY
+    QUICHE_INCLUDE_DIR
+)
+
+if(QUICHE_FOUND)
+  set(QUICHE_LIBRARIES    ${QUICHE_LIBRARY})
+  set(QUICHE_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(QUICHE_INCLUDE_DIRS QUICHE_LIBRARIES)
--- a/CMake/FindQuiche.cmake
+++ b/CMake/FindQuiche.cmake
@ -1,71 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the quiche library
-#
-# Input variables:
-#
-# - `QUICHE_INCLUDE_DIR`:   The quiche include directory.
-# - `QUICHE_LIBRARY`:       Path to `quiche` library.
-#
-# Result variables:
-#
-# - `QUICHE_FOUND`:         System has quiche.
-# - `QUICHE_INCLUDE_DIRS`:  The quiche include directories.
-# - `QUICHE_LIBRARIES`:     The quiche library names.
-# - `QUICHE_LIBRARY_DIRS`:  The quiche library directories.
-# - `QUICHE_PC_REQUIRES`:   The quiche pkg-config packages.
-# - `QUICHE_CFLAGS`:        Required compiler flags.
-# - `QUICHE_VERSION`:       Version of quiche.
-
-set(QUICHE_PC_REQUIRES "quiche")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED QUICHE_INCLUDE_DIR AND
-   NOT DEFINED QUICHE_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(QUICHE ${QUICHE_PC_REQUIRES})
-endif()
-
-if(QUICHE_FOUND)
-  set(Quiche_FOUND TRUE)
-  string(REPLACE ";" " " QUICHE_CFLAGS "${QUICHE_CFLAGS}")
-  message(STATUS "Found Quiche (via pkg-config): ${QUICHE_INCLUDE_DIRS} (found version \"${QUICHE_VERSION}\")")
-else()
-  find_path(QUICHE_INCLUDE_DIR NAMES "quiche.h")
-  find_library(QUICHE_LIBRARY NAMES "quiche")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Quiche
-    REQUIRED_VARS
-      QUICHE_INCLUDE_DIR
-      QUICHE_LIBRARY
-  )
-
-  if(QUICHE_FOUND)
-    set(QUICHE_INCLUDE_DIRS ${QUICHE_INCLUDE_DIR})
-    set(QUICHE_LIBRARIES    ${QUICHE_LIBRARY})
-  endif()
-
-  mark_as_advanced(QUICHE_INCLUDE_DIR QUICHE_LIBRARY)
-endif()
--- a/CMake/FindRustls.cmake
+++ b/CMake/FindRustls.cmake
@ -1,109 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the Rustls library
-#
-# Input variables:
-#
-# - `RUSTLS_INCLUDE_DIR`:   The Rustls include directory.
-# - `RUSTLS_LIBRARY`:       Path to `rustls` library.
-#
-# Result variables:
-#
-# - `RUSTLS_FOUND`:         System has Rustls.
-# - `RUSTLS_INCLUDE_DIRS`:  The Rustls include directories.
-# - `RUSTLS_LIBRARIES`:     The Rustls library names.
-# - `RUSTLS_LIBRARY_DIRS`:  The Rustls library directories.
-# - `RUSTLS_PC_REQUIRES`:   The Rustls pkg-config packages.
-# - `RUSTLS_CFLAGS`:        Required compiler flags.
-# - `RUSTLS_VERSION`:       Version of Rustls.
-
-set(RUSTLS_PC_REQUIRES "rustls")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED RUSTLS_INCLUDE_DIR AND
-   NOT DEFINED RUSTLS_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(RUSTLS ${RUSTLS_PC_REQUIRES})
-endif()
-
-if(RUSTLS_FOUND)
-  set(Rustls_FOUND TRUE)
-  string(REPLACE ";" " " RUSTLS_CFLAGS "${RUSTLS_CFLAGS}")
-  message(STATUS "Found Rustls (via pkg-config): ${RUSTLS_INCLUDE_DIRS} (found version \"${RUSTLS_VERSION}\")")
-else()
-  set(RUSTLS_PC_REQUIRES "")  # Depend on pkg-config only when found via pkg-config
-
-  find_path(RUSTLS_INCLUDE_DIR NAMES "rustls.h")
-  find_library(RUSTLS_LIBRARY NAMES "rustls")
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Rustls
-    REQUIRED_VARS
-      RUSTLS_INCLUDE_DIR
-      RUSTLS_LIBRARY
-  )
-
-  if(RUSTLS_FOUND)
-    set(RUSTLS_INCLUDE_DIRS ${RUSTLS_INCLUDE_DIR})
-    set(RUSTLS_LIBRARIES    ${RUSTLS_LIBRARY})
-  endif()
-
-  mark_as_advanced(RUSTLS_INCLUDE_DIR RUSTLS_LIBRARY)
-endif()
-
-if(RUSTLS_FOUND)
-  if(APPLE)
-    find_library(SECURITY_FRAMEWORK NAMES "Security")
-    mark_as_advanced(SECURITY_FRAMEWORK)
-    if(NOT SECURITY_FRAMEWORK)
-      message(FATAL_ERROR "Security framework not found")
-    endif()
-    list(APPEND RUSTLS_LIBRARIES "-framework Security")
-
-    find_library(FOUNDATION_FRAMEWORK NAMES "Foundation")
-    mark_as_advanced(FOUNDATION_FRAMEWORK)
-    if(NOT FOUNDATION_FRAMEWORK)
-      message(FATAL_ERROR "Foundation framework not found")
-    endif()
-    list(APPEND RUSTLS_LIBRARIES "-framework Foundation")
-  elseif(NOT WIN32)
-    find_library(PTHREAD_LIBRARY NAMES "pthread")
-    if(PTHREAD_LIBRARY)
-      list(APPEND RUSTLS_LIBRARIES ${PTHREAD_LIBRARY})
-    endif()
-    mark_as_advanced(PTHREAD_LIBRARY)
-
-    find_library(DL_LIBRARY NAMES "dl")
-    if(DL_LIBRARY)
-      list(APPEND RUSTLS_LIBRARIES ${DL_LIBRARY})
-    endif()
-    mark_as_advanced(DL_LIBRARY)
-
-    find_library(MATH_LIBRARY NAMES "m")
-    if(MATH_LIBRARY)
-      list(APPEND RUSTLS_LIBRARIES ${MATH_LIBRARY})
-    endif()
-    mark_as_advanced(MATH_LIBRARY)
-  endif()
-endif()
--- a/CMake/FindWolfSSH.cmake
+++ b/CMake/FindWolfSSH.cmake
@ -1,65 +0,0 @@
-#***************************************************************************
-#                                  _   _ ____  _
-#  Project                     ___| | | |  _ \| |
-#                             / __| | | | |_) | |
-#                            | (__| |_| |  _ <| |___
-#                             \___|\___/|_| \_\_____|
-#
-# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
-#
-# This software is licensed as described in the file COPYING, which
-# you should have received as part of this distribution. The terms
-# are also available at https://curl.se/docs/copyright.html.
-#
-# You may opt to use, copy, modify, merge, publish, distribute and/or sell
-# copies of the Software, and permit persons to whom the Software is
-# furnished to do so, under the terms of the COPYING file.
-#
-# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
-# KIND, either express or implied.
-#
-# SPDX-License-Identifier: curl
-#
-###########################################################################
-# Find the wolfSSH library
-#
-# Input variables:
-#
-# - `WOLFSSH_INCLUDE_DIR`:   The wolfSSH include directory.
-# - `WOLFSSH_LIBRARY`:       Path to `wolfssh` library.
-#
-# Result variables:
-#
-# - `WOLFSSH_FOUND`:         System has wolfSSH.
-# - `WOLFSSH_INCLUDE_DIRS`:  The wolfSSH include directories.
-# - `WOLFSSH_LIBRARIES`:     The wolfSSH library names.
-# - `WOLFSSH_VERSION`:       Version of wolfSSH.
-
-find_path(WOLFSSH_INCLUDE_DIR NAMES "wolfssh/ssh.h")
-find_library(WOLFSSH_LIBRARY NAMES "wolfssh" "libwolfssh")
-
-unset(WOLFSSH_VERSION CACHE)
-if(WOLFSSH_INCLUDE_DIR AND EXISTS "${WOLFSSH_INCLUDE_DIR}/wolfssh/version.h")
-  set(_version_regex "#[\t ]*define[\t ]+LIBWOLFSSH_VERSION_STRING[\t ]+\"([^\"]*)\"")
-  file(STRINGS "${WOLFSSH_INCLUDE_DIR}/wolfssh/version.h" _version_str REGEX "${_version_regex}")
-  string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-  set(WOLFSSH_VERSION "${_version_str}")
-  unset(_version_regex)
-  unset(_version_str)
-endif()
-
-include(FindPackageHandleStandardArgs)
-find_package_handle_standard_args(WolfSSH
-  REQUIRED_VARS
-    WOLFSSH_INCLUDE_DIR
-    WOLFSSH_LIBRARY
-  VERSION_VAR
-    WOLFSSH_VERSION
-)
-
-if(WOLFSSH_FOUND)
-  set(WOLFSSH_INCLUDE_DIRS ${WOLFSSH_INCLUDE_DIR})
-  set(WOLFSSH_LIBRARIES    ${WOLFSSH_LIBRARY})
-endif()
-
-mark_as_advanced(WOLFSSH_INCLUDE_DIR WOLFSSH_LIBRARY)
--- a/CMake/FindWolfSSL.cmake
+++ b/CMake/FindWolfSSL.cmake
@ -21,80 +21,16 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the wolfSSL library
-#
-# Input variables:
-#
-# - `WOLFSSL_INCLUDE_DIR`:   The wolfSSL include directory.
-# - `WOLFSSL_LIBRARY`:       Path to `wolfssl` library.
-#
-# Result variables:
-#
-# - `WOLFSSL_FOUND`:         System has wolfSSL.
-# - `WOLFSSL_INCLUDE_DIRS`:  The wolfSSL include directories.
-# - `WOLFSSL_LIBRARIES`:     The wolfSSL library names.
-# - `WOLFSSL_LIBRARY_DIRS`:  The wolfSSL library directories.
-# - `WOLFSSL_PC_REQUIRES`:   The wolfSSL pkg-config packages.
-# - `WOLFSSL_CFLAGS`:        Required compiler flags.
-# - `WOLFSSL_VERSION`:       Version of wolfSSL.
+find_path(WolfSSL_INCLUDE_DIR NAMES wolfssl/ssl.h)
+find_library(WolfSSL_LIBRARY NAMES wolfssl)
+mark_as_advanced(WolfSSL_INCLUDE_DIR WolfSSL_LIBRARY)

-if(DEFINED WolfSSL_INCLUDE_DIR AND NOT DEFINED WOLFSSL_INCLUDE_DIR)
-  message(WARNING "WolfSSL_INCLUDE_DIR is deprecated, use WOLFSSL_INCLUDE_DIR instead.")
-  set(WOLFSSL_INCLUDE_DIR "${WolfSSL_INCLUDE_DIR}")
-endif()
-if(DEFINED WolfSSL_LIBRARY AND NOT DEFINED WOLFSSL_LIBRARY)
-  message(WARNING "WolfSSL_LIBRARY is deprecated, use WOLFSSL_LIBRARY instead.")
-  set(WOLFSSL_LIBRARY "${WolfSSL_LIBRARY}")
-endif()
-
-set(WOLFSSL_PC_REQUIRES "wolfssl")
-
-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED WOLFSSL_INCLUDE_DIR AND
-   NOT DEFINED WOLFSSL_LIBRARY)
-  find_package(PkgConfig QUIET)
-  pkg_check_modules(WOLFSSL ${WOLFSSL_PC_REQUIRES})
-endif()
-
-if(WOLFSSL_FOUND)
-  set(WolfSSL_FOUND TRUE)
-  string(REPLACE ";" " " WOLFSSL_CFLAGS "${WOLFSSL_CFLAGS}")
-  message(STATUS "Found WolfSSL (via pkg-config): ${WOLFSSL_INCLUDE_DIRS} (found version \"${WOLFSSL_VERSION}\")")
-else()
-  find_path(WOLFSSL_INCLUDE_DIR NAMES "wolfssl/ssl.h")
-  find_library(WOLFSSL_LIBRARY NAMES "wolfssl")
-
-  unset(WOLFSSL_VERSION CACHE)
-  if(WOLFSSL_INCLUDE_DIR AND EXISTS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h")
-    set(_version_regex "#[\t ]*define[\t ]+LIBWOLFSSL_VERSION_STRING[\t ]+\"([^\"]*)\"")
-    file(STRINGS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h" _version_str REGEX "${_version_regex}")
-    string(REGEX REPLACE "${_version_regex}" "\\1" _version_str "${_version_str}")
-    set(WOLFSSL_VERSION "${_version_str}")
-    unset(_version_regex)
-    unset(_version_str)
-  endif()
-
-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(WolfSSL
-    REQUIRED_VARS
-      WOLFSSL_INCLUDE_DIR
-      WOLFSSL_LIBRARY
-    VERSION_VAR
-      WOLFSSL_VERSION
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(WolfSSL
+  REQUIRED_VARS WolfSSL_INCLUDE_DIR WolfSSL_LIBRARY
  )

-  if(WOLFSSL_FOUND)
-    set(WOLFSSL_INCLUDE_DIRS ${WOLFSSL_INCLUDE_DIR})
-    set(WOLFSSL_LIBRARIES    ${WOLFSSL_LIBRARY})
-  endif()
-
-  mark_as_advanced(WOLFSSL_INCLUDE_DIR WOLFSSL_LIBRARY)
-endif()
-
-if(WOLFSSL_FOUND AND NOT WIN32)
-  find_library(MATH_LIBRARY NAMES "m")
-  if(MATH_LIBRARY)
-    list(APPEND WOLFSSL_LIBRARIES ${MATH_LIBRARY})  # for log and pow
-  endif()
-  mark_as_advanced(MATH_LIBRARY)
+if(WolfSSL_FOUND)
+  set(WolfSSL_INCLUDE_DIRS ${WolfSSL_INCLUDE_DIR})
+  set(WolfSSL_LIBRARIES ${WolfSSL_LIBRARY})
 endif()
--- a/CMake/FindZstd.cmake
+++ b/CMake/FindZstd.cmake
@ -21,82 +21,51 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# Find the zstd library
-#
-# Input variables:
-#
-# - `ZSTD_INCLUDE_DIR`:   The zstd include directory.
-# - `ZSTD_LIBRARY`:       Path to `zstd` library.
-#
-# Result variables:
-#
-# - `ZSTD_FOUND`:         System has zstd.
-# - `ZSTD_INCLUDE_DIRS`:  The zstd include directories.
-# - `ZSTD_LIBRARIES`:     The zstd library names.
-# - `ZSTD_LIBRARY_DIRS`:  The zstd library directories.
-# - `ZSTD_PC_REQUIRES`:   The zstd pkg-config packages.
-# - `ZSTD_CFLAGS`:        Required compiler flags.
-# - `ZSTD_VERSION`:       Version of zstd.

-if(DEFINED Zstd_INCLUDE_DIR AND NOT DEFINED ZSTD_INCLUDE_DIR)
-  message(WARNING "Zstd_INCLUDE_DIR is deprecated, use ZSTD_INCLUDE_DIR instead.")
-  set(ZSTD_INCLUDE_DIR "${Zstd_INCLUDE_DIR}")
-endif()
-if(DEFINED Zstd_LIBRARY AND NOT DEFINED ZSTD_LIBRARY)
-  message(WARNING "Zstd_LIBRARY is deprecated, use ZSTD_LIBRARY instead.")
-  set(ZSTD_LIBRARY "${Zstd_LIBRARY}")
-endif()
+#[=======================================================================[.rst:
+FindZstd
+----------

-set(ZSTD_PC_REQUIRES "libzstd")
+Find the zstd library

-if(CURL_USE_PKGCONFIG AND
-   NOT DEFINED ZSTD_INCLUDE_DIR AND
-   NOT DEFINED ZSTD_LIBRARY)
+Result Variables
+^^^^^^^^^^^^^^^^
+
+``Zstd_FOUND``
+  System has zstd
+``Zstd_INCLUDE_DIRS``
+  The zstd include directories.
+``Zstd_LIBRARIES``
+  The libraries needed to use zstd
+#]=======================================================================]
+
+if(UNIX)
  find_package(PkgConfig QUIET)
-  pkg_check_modules(ZSTD ${ZSTD_PC_REQUIRES})
+  pkg_search_module(PC_Zstd libzstd)
 endif()

-if(ZSTD_FOUND)
-  set(Zstd_FOUND TRUE)
-  string(REPLACE ";" " " ZSTD_CFLAGS "${ZSTD_CFLAGS}")
-  message(STATUS "Found Zstd (via pkg-config): ${ZSTD_INCLUDE_DIRS} (found version \"${ZSTD_VERSION}\")")
-else()
-  find_path(ZSTD_INCLUDE_DIR NAMES "zstd.h")
-  find_library(ZSTD_LIBRARY NAMES "zstd")
+find_path(Zstd_INCLUDE_DIR zstd.h
+  HINTS
+    ${PC_Zstd_INCLUDEDIR}
+    ${PC_Zstd_INCLUDE_DIRS}
+)

-  unset(ZSTD_VERSION CACHE)
-  if(ZSTD_INCLUDE_DIR AND EXISTS "${ZSTD_INCLUDE_DIR}/zstd.h")
-    set(_version_regex1 "#[\t ]*define[ \t]+ZSTD_VERSION_MAJOR[ \t]+([0-9]+).*")
-    set(_version_regex2 "#[\t ]*define[ \t]+ZSTD_VERSION_MINOR[ \t]+([0-9]+).*")
-    set(_version_regex3 "#[\t ]*define[ \t]+ZSTD_VERSION_RELEASE[ \t]+([0-9]+).*")
-    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str1 REGEX "${_version_regex1}")
-    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str2 REGEX "${_version_regex2}")
-    file(STRINGS "${ZSTD_INCLUDE_DIR}/zstd.h" _version_str3 REGEX "${_version_regex3}")
-    string(REGEX REPLACE "${_version_regex1}" "\\1" _version_str1 "${_version_str1}")
-    string(REGEX REPLACE "${_version_regex2}" "\\1" _version_str2 "${_version_str2}")
-    string(REGEX REPLACE "${_version_regex3}" "\\1" _version_str3 "${_version_str3}")
-    set(ZSTD_VERSION "${_version_str1}.${_version_str2}.${_version_str3}")
-    unset(_version_regex1)
-    unset(_version_regex2)
-    unset(_version_regex3)
-    unset(_version_str1)
-    unset(_version_str2)
-    unset(_version_str3)
-  endif()
+find_library(Zstd_LIBRARY NAMES zstd
+  HINTS
+    ${PC_Zstd_LIBDIR}
+    ${PC_Zstd_LIBRARY_DIRS}
+)

-  include(FindPackageHandleStandardArgs)
-  find_package_handle_standard_args(Zstd
-    REQUIRED_VARS
-      ZSTD_INCLUDE_DIR
-      ZSTD_LIBRARY
-    VERSION_VAR
-      ZSTD_VERSION
-  )
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Zstd
+  REQUIRED_VARS
+    Zstd_LIBRARY
+    Zstd_INCLUDE_DIR
+)

-  if(ZSTD_FOUND)
-    set(ZSTD_INCLUDE_DIRS ${ZSTD_INCLUDE_DIR})
-    set(ZSTD_LIBRARIES    ${ZSTD_LIBRARY})
-  endif()
-
-  mark_as_advanced(ZSTD_INCLUDE_DIR ZSTD_LIBRARY)
+if(Zstd_FOUND)
+  set(Zstd_LIBRARIES    ${Zstd_LIBRARY})
+  set(Zstd_INCLUDE_DIRS ${Zstd_INCLUDE_DIR})
 endif()
+
+mark_as_advanced(Zstd_INCLUDE_DIRS Zstd_LIBRARIES)
--- a/CMake/Macros.cmake
+++ b/CMake/Macros.cmake
@ -21,76 +21,102 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-# File defines convenience macros for available feature testing
+#File defines convenience macros for available feature testing
+
+# This macro checks if the symbol exists in the library and if it
+# does, it prepends library to the list.  It is intended to be called
+# multiple times with a sequence of possibly dependent libraries in
+# order of least-to-most-dependent.  Some libraries depend on others
+# to link correctly.
+macro(check_library_exists_concat LIBRARY SYMBOL VARIABLE)
+  check_library_exists("${LIBRARY};${CURL_LIBS}" ${SYMBOL} "${CMAKE_LIBRARY_PATH}"
+    ${VARIABLE})
+  if(${VARIABLE})
+    set(CURL_LIBS ${LIBRARY} ${CURL_LIBS})
+  endif()
+endmacro()

 # Check if header file exists and add it to the list.
 # This macro is intended to be called multiple times with a sequence of
 # possibly dependent header files.  Some headers depend on others to be
 # compiled correctly.
-macro(check_include_file_concat_curl _file _variable)
-  check_include_files("${CURL_INCLUDES};${_file}" ${_variable})
-  if(${_variable})
-    list(APPEND CURL_INCLUDES ${_file})
+macro(check_include_file_concat FILE VARIABLE)
+  check_include_files("${CURL_INCLUDES};${FILE}" ${VARIABLE})
+  if(${VARIABLE})
+    set(CURL_INCLUDES ${CURL_INCLUDES} ${FILE})
+    set(CURL_TEST_DEFINES "${CURL_TEST_DEFINES} -D${VARIABLE}")
  endif()
 endmacro()

-set(CURL_TEST_DEFINES "")  # Initialize global variable
-
 # For other curl specific tests, use this macro.
-# Return result in variable: CURL_TEST_OUTPUT
-macro(curl_internal_test _curl_test)
-  if(NOT DEFINED "${_curl_test}")
-    string(REPLACE ";" " " _cmake_required_definitions "${CMAKE_REQUIRED_DEFINITIONS}")
-    set(_curl_test_add_libraries "")
+macro(curl_internal_test CURL_TEST)
+  if(NOT DEFINED "${CURL_TEST}")
+    set(MACRO_CHECK_FUNCTION_DEFINITIONS
+      "-D${CURL_TEST} ${CURL_TEST_DEFINES} ${CMAKE_REQUIRED_FLAGS}")
    if(CMAKE_REQUIRED_LIBRARIES)
-      set(_curl_test_add_libraries
+      set(CURL_TEST_ADD_LIBRARIES
        "-DLINK_LIBRARIES:STRING=${CMAKE_REQUIRED_LIBRARIES}")
    endif()

-    message(STATUS "Performing Test ${_curl_test}")
-    try_compile(${_curl_test}
-      ${PROJECT_BINARY_DIR}
-      "${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c"
-      CMAKE_FLAGS
-        "-DCOMPILE_DEFINITIONS:STRING=-D${_curl_test} ${CURL_TEST_DEFINES} ${_cmake_required_definitions}"
-        "${_curl_test_add_libraries}"
-      OUTPUT_VARIABLE CURL_TEST_OUTPUT)
-    if(${_curl_test})
-      set(${_curl_test} 1 CACHE INTERNAL "Curl test")
-      message(STATUS "Performing Test ${_curl_test} - Success")
+    message(STATUS "Performing Curl Test ${CURL_TEST}")
+    try_compile(${CURL_TEST}
+      ${CMAKE_BINARY_DIR}
+      ${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c
+      CMAKE_FLAGS -DCOMPILE_DEFINITIONS:STRING=${MACRO_CHECK_FUNCTION_DEFINITIONS}
+      "${CURL_TEST_ADD_LIBRARIES}"
+      OUTPUT_VARIABLE OUTPUT)
+    if(${CURL_TEST})
+      set(${CURL_TEST} 1 CACHE INTERNAL "Curl test ${FUNCTION}")
+      message(STATUS "Performing Curl Test ${CURL_TEST} - Success")
+      file(APPEND ${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeOutput.log
+        "Performing Curl Test ${CURL_TEST} passed with the following output:\n"
+        "${OUTPUT}\n")
    else()
-      set(${_curl_test} "" CACHE INTERNAL "Curl test")
-      message(STATUS "Performing Test ${_curl_test} - Failed")
+      message(STATUS "Performing Curl Test ${CURL_TEST} - Failed")
+      set(${CURL_TEST} "" CACHE INTERNAL "Curl test ${FUNCTION}")
+      file(APPEND ${CMAKE_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/CMakeError.log
+        "Performing Curl Test ${CURL_TEST} failed with the following output:\n"
+        "${OUTPUT}\n")
    endif()
  endif()
 endmacro()

-macro(curl_dependency_option _option_name _find_name _desc_name)
-  set(${_option_name} "AUTO" CACHE STRING "Build curl with ${_desc_name} support (AUTO, ON or OFF)")
-  set_property(CACHE ${_option_name} PROPERTY STRINGS "AUTO" "ON" "OFF")
-
-  if(${_option_name} STREQUAL "AUTO")
-    find_package(${_find_name})
-  elseif(${_option_name})
-    find_package(${_find_name} REQUIRED)
-  endif()
-endmacro()
-
-# Convert the passed paths to libpath linker options and add them to CMAKE_REQUIRED_*.
-macro(curl_required_libpaths _libpaths_arg)
-  if(CMAKE_VERSION VERSION_LESS 3.31)
-    set(_libpaths "${_libpaths_arg}")
-    foreach(_libpath IN LISTS _libpaths)
-      list(APPEND CMAKE_REQUIRED_LINK_OPTIONS "${CMAKE_LIBRARY_PATH_FLAG}${_libpath}")
+macro(curl_nroff_check)
+  find_program(NROFF NAMES gnroff nroff)
+  if(NROFF)
+    # Need a way to write to stdin, this will do
+    file(WRITE "${CMAKE_CURRENT_BINARY_DIR}/nroff-input.txt" "test")
+    # Tests for a valid nroff option to generate a manpage
+    foreach(_MANOPT "-man" "-mandoc")
+      execute_process(COMMAND "${NROFF}" ${_MANOPT}
+        OUTPUT_VARIABLE NROFF_MANOPT_OUTPUT
+        INPUT_FILE "${CMAKE_CURRENT_BINARY_DIR}/nroff-input.txt"
+        ERROR_QUIET)
+      # Save the option if it was valid
+      if(NROFF_MANOPT_OUTPUT)
+        message("Found *nroff option: -- ${_MANOPT}")
+        set(NROFF_MANOPT ${_MANOPT})
+        set(NROFF_USEFUL ON)
+        break()
+      endif()
    endforeach()
+    # No need for the temporary file
+    file(REMOVE "${CMAKE_CURRENT_BINARY_DIR}/nroff-input.txt")
+    if(NOT NROFF_USEFUL)
+      message(WARNING "Found no *nroff option to get plaintext from man pages")
+    endif()
  else()
-    list(APPEND CMAKE_REQUIRED_LINK_DIRECTORIES "${_libpaths_arg}")
+    message(WARNING "Found no *nroff program")
  endif()
 endmacro()

-# Pre-fill variables set by a check_type_size() call.
-macro(curl_prefill_type_size _type _size)
-  set(HAVE_SIZEOF_${_type} TRUE)
-  set(SIZEOF_${_type} ${_size})
-  set(SIZEOF_${_type}_CODE "#define SIZEOF_${_type} ${_size}")
+macro(optional_dependency DEPENDENCY)
+  set(CURL_${DEPENDENCY} AUTO CACHE STRING "Build curl with ${DEPENDENCY} support (AUTO, ON or OFF)")
+  set_property(CACHE CURL_${DEPENDENCY} PROPERTY STRINGS AUTO ON OFF)
+
+  if(CURL_${DEPENDENCY} STREQUAL AUTO)
+    find_package(${DEPENDENCY})
+  elseif(CURL_${DEPENDENCY})
+    find_package(${DEPENDENCY} REQUIRED)
+  endif()
 endmacro()
--- a/CMake/OtherTests.cmake
+++ b/CMake/OtherTests.cmake
@ -22,136 +22,115 @@
 #
 ###########################################################################
 include(CheckCSourceCompiles)
-include(CheckCSourceRuns)
-include(CheckTypeSize)
+# The begin of the sources (macros and includes)
+set(_source_epilogue "#undef inline")

-macro(curl_add_header_include _check _header)
-  if(${_check})
-    set(_source_epilogue "${_source_epilogue}
-      #include <${_header}>")
+macro(add_header_include check header)
+  if(${check})
+    set(_source_epilogue "${_source_epilogue}\n#include <${header}>")
  endif()
 endmacro()

-set(_cmake_try_compile_target_type_save ${CMAKE_TRY_COMPILE_TARGET_TYPE})
-set(CMAKE_TRY_COMPILE_TARGET_TYPE "STATIC_LIBRARY")
-
-if(NOT DEFINED HAVE_STRUCT_SOCKADDR_STORAGE)
-  cmake_push_check_state()
-  set(CMAKE_EXTRA_INCLUDE_FILES "")
-  if(WIN32)
-    set(CMAKE_EXTRA_INCLUDE_FILES "winsock2.h")
-    list(APPEND CMAKE_REQUIRED_LIBRARIES "ws2_32")
-  elseif(HAVE_SYS_SOCKET_H)
-    set(CMAKE_EXTRA_INCLUDE_FILES "sys/socket.h")
+set(signature_call_conv)
+if(HAVE_WINDOWS_H)
+  add_header_include(HAVE_WINSOCK2_H "winsock2.h")
+  add_header_include(HAVE_WINDOWS_H "windows.h")
+  set(_source_epilogue
+      "${_source_epilogue}\n#ifndef WIN32_LEAN_AND_MEAN\n#define WIN32_LEAN_AND_MEAN\n#endif")
+  set(signature_call_conv "PASCAL")
+  if(HAVE_LIBWS2_32)
+    set(CMAKE_REQUIRED_LIBRARIES ws2_32)
  endif()
-  check_type_size("struct sockaddr_storage" SIZEOF_STRUCT_SOCKADDR_STORAGE)
-  set(HAVE_STRUCT_SOCKADDR_STORAGE ${HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE})
-  cmake_pop_check_state()
+else()
+  add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
+  add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
 endif()

-if(NOT WIN32)
-  set(_source_epilogue "#undef inline")
-  curl_add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
-  curl_add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
-  check_c_source_compiles("${_source_epilogue}
-    int main(void)
-    {
-      int flag = MSG_NOSIGNAL;
-      (void)flag;
-      return 0;
-    }" HAVE_MSG_NOSIGNAL)
-endif()
+set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)

-set(_source_epilogue "#undef inline")
-curl_add_header_include(HAVE_SYS_TIME_H "sys/time.h")
 check_c_source_compiles("${_source_epilogue}
-  #ifdef _MSC_VER
-  #include <winsock2.h>
-  #endif
-  #include <time.h>
-  int main(void)
-  {
-    struct timeval ts;
-    ts.tv_sec  = 0;
-    ts.tv_usec = 0;
-    (void)ts;
+  int main(void) {
+    int flag = MSG_NOSIGNAL;
+    (void)flag;
    return 0;
-  }" HAVE_STRUCT_TIMEVAL)
+  }" HAVE_MSG_NOSIGNAL)

-set(CMAKE_TRY_COMPILE_TARGET_TYPE ${_cmake_try_compile_target_type_save})
-unset(_cmake_try_compile_target_type_save)
+if(NOT HAVE_WINDOWS_H)
+  add_header_include(HAVE_SYS_TIME_H "sys/time.h")
+  add_header_include(TIME_WITH_SYS_TIME "time.h")
+  add_header_include(HAVE_TIME_H "time.h")
+endif()
+check_c_source_compiles("${_source_epilogue}
+int main(void) {
+  struct timeval ts;
+  ts.tv_sec  = 0;
+  ts.tv_usec = 0;
+  (void)ts;
+  return 0;
+}" HAVE_STRUCT_TIMEVAL)

-# Detect HAVE_GETADDRINFO_THREADSAFE
-
-if(WIN32)
-  set(HAVE_GETADDRINFO_THREADSAFE ${HAVE_GETADDRINFO})
-elseif(NOT HAVE_GETADDRINFO)
-  set(HAVE_GETADDRINFO_THREADSAFE FALSE)
-elseif(APPLE OR
-       CMAKE_SYSTEM_NAME STREQUAL "AIX" OR
-       CMAKE_SYSTEM_NAME STREQUAL "FreeBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "HP-UX" OR
-       CMAKE_SYSTEM_NAME STREQUAL "MidnightBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "NetBSD" OR
-       CMAKE_SYSTEM_NAME STREQUAL "SunOS")
-  set(HAVE_GETADDRINFO_THREADSAFE TRUE)
-elseif(BSD OR CMAKE_SYSTEM_NAME MATCHES "BSD")
-  set(HAVE_GETADDRINFO_THREADSAFE FALSE)
+if(HAVE_WINDOWS_H)
+  set(CMAKE_EXTRA_INCLUDE_FILES winsock2.h)
+else()
+  set(CMAKE_EXTRA_INCLUDE_FILES)
+  if(HAVE_SYS_SOCKET_H)
+    set(CMAKE_EXTRA_INCLUDE_FILES sys/socket.h)
+  endif()
 endif()

-if(NOT DEFINED HAVE_GETADDRINFO_THREADSAFE)
-  set(_source_epilogue "#undef inline")
-  curl_add_header_include(HAVE_SYS_SOCKET_H "sys/socket.h")
-  curl_add_header_include(HAVE_SYS_TIME_H "sys/time.h")
-  curl_add_header_include(HAVE_NETDB_H "netdb.h")
-  check_c_source_compiles("${_source_epilogue}
-    int main(void)
-    {
-    #ifndef h_errno
-      #error force compilation error
-    #endif
-      return 0;
-    }" HAVE_H_ERRNO)
+check_type_size("struct sockaddr_storage" SIZEOF_STRUCT_SOCKADDR_STORAGE)
+if(HAVE_SIZEOF_STRUCT_SOCKADDR_STORAGE)
+  set(HAVE_STRUCT_SOCKADDR_STORAGE 1)
+endif()
+
+unset(CMAKE_TRY_COMPILE_TARGET_TYPE)
+
+if(NOT CMAKE_CROSSCOMPILING)
+  if(NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin" AND NOT ${CMAKE_SYSTEM_NAME} MATCHES "iOS")
+    # only try this on non-apple platforms
+
+    # if not cross-compilation...
+    include(CheckCSourceRuns)
+    set(CMAKE_REQUIRED_FLAGS "")
+    if(HAVE_SYS_POLL_H)
+      set(CMAKE_REQUIRED_FLAGS "-DHAVE_SYS_POLL_H")
+    elseif(HAVE_POLL_H)
+      set(CMAKE_REQUIRED_FLAGS "-DHAVE_POLL_H")
+    endif()
+    check_c_source_runs("
+      #include <stdlib.h>
+      #include <sys/time.h>
+
+      #ifdef HAVE_SYS_POLL_H
+      #  include <sys/poll.h>
+      #elif  HAVE_POLL_H
+      #  include <poll.h>
+      #endif

-  if(NOT HAVE_H_ERRNO)
-    check_c_source_compiles("${_source_epilogue}
      int main(void)
      {
-        h_errno = 2;
-        return h_errno != 0 ? 1 : 0;
-      }" HAVE_H_ERRNO_ASSIGNABLE)
+          if(0 != poll(0, 0, 10)) {
+            return 1; /* fail */
+          }
+          else {
+            /* detect the 10.12 poll() breakage */
+            struct timeval before, after;
+            int rc;
+            size_t us;

-    if(NOT HAVE_H_ERRNO_ASSIGNABLE)
-      check_c_source_compiles("${_source_epilogue}
-        int main(void)
-        {
-        #if defined(_POSIX_C_SOURCE) && (_POSIX_C_SOURCE >= 200809L)
-        #elif defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE >= 700)
-        #else
-          #error force compilation error
-        #endif
+            gettimeofday(&before, NULL);
+            rc = poll(NULL, 0, 500);
+            gettimeofday(&after, NULL);
+
+            us = (after.tv_sec - before.tv_sec) * 1000000 +
+              (after.tv_usec - before.tv_usec);
+
+            if(us < 400000) {
+              return 1;
+            }
+          }
          return 0;
-        }" HAVE_H_ERRNO_SBS_ISSUE_7)
-    endif()
-  endif()
-
-  if(HAVE_H_ERRNO OR HAVE_H_ERRNO_ASSIGNABLE OR HAVE_H_ERRNO_SBS_ISSUE_7)
-    set(HAVE_GETADDRINFO_THREADSAFE TRUE)
+    }" HAVE_POLL_FINE)
  endif()
 endif()

-if(NOT WIN32 AND NOT DEFINED HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
-  set(_source_epilogue "#undef inline")
-  curl_add_header_include(HAVE_SYS_TYPES_H "sys/types.h")
-  curl_add_header_include(HAVE_SYS_TIME_H "sys/time.h")
-  check_c_source_compiles("${_source_epilogue}
-    #include <time.h>
-    int main(void)
-    {
-      struct timespec ts;
-      (void)clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
-      return 0;
-    }" HAVE_CLOCK_GETTIME_MONOTONIC_RAW)
-endif()
-
-unset(_source_epilogue)
--- a/CMake/PickyWarnings.cmake
+++ b/CMake/PickyWarnings.cmake
@ -23,67 +23,38 @@
 ###########################################################################
 include(CheckCCompilerFlag)

-set(_picky "")
-
-if(CURL_WERROR AND
-   ((CMAKE_COMPILER_IS_GNUCC AND
-     NOT DOS AND  # Watt-32 headers use the '#include_next' GCC extension
-     NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.0 AND
-     NOT CMAKE_VERSION VERSION_LESS 3.23.0) OR  # to avoid check_symbol_exists() conflicting with GCC -pedantic-errors
-   CMAKE_C_COMPILER_ID MATCHES "Clang"))
-  list(APPEND _picky "-pedantic-errors")
-endif()
-
-if(APPLE AND
-   (CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.6) OR
-   (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.3))
-  list(APPEND _picky "-Werror=partial-availability")  # clang 3.6  appleclang 6.3
-endif()
-
-if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
-  list(APPEND _picky "-Werror-implicit-function-declaration")  # clang 1.0  gcc 2.95
-endif()
-
-if(MSVC)
-  if(CMAKE_C_FLAGS MATCHES "[/-]W[0-4]")
-    string(REGEX REPLACE "[/-]W[0-4]" "" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
-  endif()
-  list(APPEND _picky "-W4")
-elseif(BORLAND)
-  list(APPEND _picky "-w-")  # Disable warnings on Borland to avoid changing 3rd party code.
-endif()
-
 if(PICKY_COMPILER)
  if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")

    # https://clang.llvm.org/docs/DiagnosticsReference.html
    # https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html

-    # _picky_enable = Options we want to enable as-is.
-    # _picky_detect = Options we want to test first and enable if available.
+    # WPICKY_ENABLE = Options we want to enable as-is.
+    # WPICKY_DETECT = Options we want to test first and enable if available.

    # Prefer the -Wextra alias with clang.
    if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-      set(_picky_enable "-Wextra")
+      set(WPICKY_ENABLE "-Wextra")
    else()
-      set(_picky_enable "-W")
+      set(WPICKY_ENABLE "-W")
    endif()

-    list(APPEND _picky_enable
+    list(APPEND WPICKY_ENABLE
      -Wall -pedantic
    )

    # ----------------------------------
    # Add new options here, if in doubt:
    # ----------------------------------
-    set(_picky_detect
+    set(WPICKY_DETECT
    )

    # Assume these options always exist with both clang and gcc.
    # Require clang 3.0 / gcc 2.95 or later.
-    list(APPEND _picky_enable
-      -Wbad-function-cast                  # clang  2.7  gcc  2.95
-      -Wconversion                         # clang  2.7  gcc  2.95
+    list(APPEND WPICKY_ENABLE
+      -Wbad-function-cast                  # clang  3.0  gcc  2.95
+      -Wconversion                         # clang  3.0  gcc  2.95
+      -Winline                             # clang  1.0  gcc  1.0
      -Wmissing-declarations               # clang  1.0  gcc  2.7
      -Wmissing-prototypes                 # clang  1.0  gcc  1.0
      -Wnested-externs                     # clang  1.0  gcc  2.7
@ -98,202 +69,129 @@ if(PICKY_COMPILER)
    )

    # Always enable with clang, version dependent with gcc
-    set(_picky_common_old
-      -Waddress                            # clang  2.7  gcc  4.3
-      -Wattributes                         # clang  2.7  gcc  4.1
+    set(WPICKY_COMMON_OLD
      -Wcast-align                         # clang  1.0  gcc  4.2
      -Wdeclaration-after-statement        # clang  1.0  gcc  3.4
-      -Wdiv-by-zero                        # clang  2.7  gcc  4.1
-      -Wempty-body                         # clang  2.7  gcc  4.3
+      -Wempty-body                         # clang  3.0  gcc  4.3
      -Wendif-labels                       # clang  1.0  gcc  3.3
      -Wfloat-equal                        # clang  1.0  gcc  2.96 (3.0)
-      -Wformat-security                    # clang  2.7  gcc  4.1
-      -Wignored-qualifiers                 # clang  2.8  gcc  4.3
-      -Wmissing-field-initializers         # clang  2.7  gcc  4.1
-      -Wmissing-noreturn                   # clang  2.7  gcc  4.1
+      -Wignored-qualifiers                 # clang  3.0  gcc  4.3
      -Wno-format-nonliteral               # clang  1.0  gcc  2.96 (3.0)
-      -Wno-sign-conversion                 # clang  2.9  gcc  4.3
+      -Wno-sign-conversion                 # clang  3.0  gcc  4.3
      -Wno-system-headers                  # clang  1.0  gcc  3.0
-    # -Wpadded                             # clang  2.9  gcc  4.1               # Not used: We cannot change public structs
-      -Wold-style-definition               # clang  2.7  gcc  3.4
-      -Wredundant-decls                    # clang  2.7  gcc  4.1
      -Wstrict-prototypes                  # clang  1.0  gcc  3.3
-    # -Wswitch-enum                        # clang  2.7  gcc  4.1               # Not used: It basically disallows default case
-      -Wtype-limits                        # clang  2.7  gcc  4.3
-      -Wunreachable-code                   # clang  2.7  gcc  4.1
-    # -Wunused-macros                      # clang  2.7  gcc  4.1               # Not practical
-    #   -Wno-error=unused-macros           # clang  2.7  gcc  4.1
-      -Wunused-parameter                   # clang  2.7  gcc  4.1
+      -Wtype-limits                        # clang  3.0  gcc  4.3
      -Wvla                                # clang  2.8  gcc  4.3
    )

+    set(WPICKY_COMMON
+      -Wdouble-promotion                   # clang  3.6  gcc  4.6  appleclang  6.3
+      -Wenum-conversion                    # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
+      -Wunused-const-variable              # clang  3.4  gcc  6.0  appleclang  5.1
+    )
+
    if(CMAKE_C_COMPILER_ID MATCHES "Clang")
-      list(APPEND _picky_enable
-        ${_picky_common_old}
+      list(APPEND WPICKY_ENABLE
+        ${WPICKY_COMMON_OLD}
        -Wshift-sign-overflow              # clang  2.9
        -Wshorten-64-to-32                 # clang  1.0
-        -Wformat=2                         # clang  3.0  gcc  4.8
      )
-      if(NOT MSVC)
-        list(APPEND _picky_enable
-          -Wlanguage-extension-token       # clang  3.0
-        )
-      endif()
      # Enable based on compiler version
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.6) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.3))
-        list(APPEND _picky_enable
-          -Wdouble-promotion               # clang  3.6  gcc  4.6  appleclang  6.3
-          -Wenum-conversion                # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
-          -Wheader-guard                   # clang  3.4            appleclang  5.1
-          -Wpragmas                        # clang  3.5  gcc  4.1  appleclang  6.0
-          -Wsometimes-uninitialized        # clang  3.2            appleclang  4.6
-        # -Wunreachable-code-break         # clang  3.5            appleclang  6.0  # Not used: Silent in "unity" builds
-          -Wunused-const-variable          # clang  3.4  gcc  6.0  appleclang  5.1
+        list(APPEND WPICKY_ENABLE
+          ${WPICKY_COMMON}
        )
      endif()
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 3.9) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 8.3))
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Wcomma                          # clang  3.9            appleclang  8.3
          -Wmissing-variable-declarations  # clang  3.2            appleclang  4.6
        )
      endif()
      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 7.0) OR
         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.3))
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Wassign-enum                    # clang  7.0            appleclang 10.3
          -Wextra-semi-stmt                # clang  7.0            appleclang 10.3
        )
      endif()
-      if((CMAKE_C_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.0) OR
-         (CMAKE_C_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 12.4))
-        list(APPEND _picky_enable
-          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0  appleclang 12.4  # We do silencing for clang 10.0 and above only
-        )
-      endif()
    else()  # gcc
+      list(APPEND WPICKY_DETECT
+        ${WPICKY_COMMON}
+      )
      # Enable based on compiler version
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.3)
-        list(APPEND _picky_enable
-          ${_picky_common_old}
-          -Wclobbered                      #             gcc  4.3
+        list(APPEND WPICKY_ENABLE
+          ${WPICKY_COMMON_OLD}
          -Wmissing-parameter-type         #             gcc  4.3
          -Wold-style-declaration          #             gcc  4.3
-          -Wpragmas                        # clang  3.5  gcc  4.1  appleclang  6.0
          -Wstrict-aliasing=3              #             gcc  4.0
-          -ftree-vrp                       #             gcc  4.3 (required for -Warray-bounds, included in -Wall)
        )
      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5)
-        list(APPEND _picky_enable
-          -Wjump-misses-init               #             gcc  4.5
+      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5 AND MINGW)
+        list(APPEND WPICKY_ENABLE
+          -Wno-pedantic-ms-format          #             gcc  4.5 (mingw-only)
        )
-
-        if(MINGW)
-          list(APPEND _picky_enable
-            -Wno-pedantic-ms-format        #             gcc  4.5 (MinGW-only)
-          )
-        endif()
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.8)
-        list(APPEND _picky_enable
-          -Wdouble-promotion               # clang  3.6  gcc  4.6  appleclang  6.3
-          -Wformat=2                       # clang  3.0  gcc  4.8
-          -Wtrampolines                    #             gcc  4.6
+        list(APPEND WPICKY_ENABLE
+          -Wformat=2                       # clang  3.0  gcc  4.8 (clang part-default, enabling it fully causes -Wformat-nonliteral warnings)
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.0)
-        list(APPEND _picky_enable
-          -Warray-bounds=2                 # clang  3.0  gcc  5.0 (clang default: -Warray-bounds)
+        list(APPEND WPICKY_ENABLE
+          -Warray-bounds=2 -ftree-vrp      # clang  3.0  gcc  5.0 (clang default: -Warray-bounds)
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 6.0)
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Wduplicated-cond                #             gcc  6.0
          -Wnull-dereference               # clang  3.0  gcc  6.0 (clang default)
            -fdelete-null-pointer-checks
          -Wshift-negative-value           # clang  3.7  gcc  6.0 (clang default)
          -Wshift-overflow=2               # clang  3.0  gcc  6.0 (clang default: -Wshift-overflow)
-          -Wunused-const-variable          # clang  3.4  gcc  6.0  appleclang  5.1
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 7.0)
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Walloc-zero                     #             gcc  7.0
          -Wduplicated-branches            #             gcc  7.0
-          -Wformat-truncation=2            #             gcc  7.0
-          -Wimplicit-fallthrough           # clang  4.0  gcc  7.0
+          -Wformat-overflow=2              #             gcc  7.0
+          -Wformat-truncation=1            #             gcc  7.0
          -Wrestrict                       #             gcc  7.0
        )
      endif()
      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 10.0)
-        list(APPEND _picky_enable
+        list(APPEND WPICKY_ENABLE
          -Warith-conversion               #             gcc 10.0
-          -Wenum-conversion                # clang  3.2  gcc 10.0  appleclang  4.6  g++ 11.0
        )
      endif()
    endif()

    #

-    foreach(_ccopt IN LISTS _picky_enable)
-      list(APPEND _picky "${_ccopt}")
+    unset(WPICKY)
+
+    foreach(_CCOPT ${WPICKY_ENABLE})
+      set(WPICKY "${WPICKY} ${_CCOPT}")
    endforeach()

-    foreach(_ccopt IN LISTS _picky_detect)
-      # Use a unique variable name 1. for meaningful log output 2. to have a fresh, undefined variable for each detection
-      string(MAKE_C_IDENTIFIER "OPT${_ccopt}" _optvarname)
+    foreach(_CCOPT ${WPICKY_DETECT})
+      # surprisingly, CHECK_C_COMPILER_FLAG needs a new variable to store each new
+      # test result in.
+      string(MAKE_C_IDENTIFIER "OPT${_CCOPT}" _optvarname)
      # GCC only warns about unknown -Wno- options if there are also other diagnostic messages,
      # so test for the positive form instead
-      string(REPLACE "-Wno-" "-W" _ccopt_on "${_ccopt}")
-      check_c_compiler_flag(${_ccopt_on} ${_optvarname})
+      string(REPLACE "-Wno-" "-W" _CCOPT_ON "${_CCOPT}")
+      check_c_compiler_flag(${_CCOPT_ON} ${_optvarname})
      if(${_optvarname})
-        list(APPEND _picky "${_ccopt}")
+        set(WPICKY "${WPICKY} ${_CCOPT}")
      endif()
    endforeach()

-    if(CMAKE_COMPILER_IS_GNUCC)
-      if(CMAKE_C_COMPILER_VERSION VERSION_LESS 4.5)
-        # Avoid false positives
-        list(APPEND _picky "-Wno-shadow")
-        list(APPEND _picky "-Wno-unreachable-code")
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.2 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.6)
-        # GCC <4.6 do not support #pragma to suppress warnings locally. Disable them globally instead.
-        list(APPEND _picky "-Wno-overlength-strings")
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.0 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.7)
-        list(APPEND _picky "-Wno-missing-field-initializers")  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36750
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 4.3 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 4.8)
-        list(APPEND _picky "-Wno-type-limits")  # Avoid false positives
-      endif()
-      if(NOT CMAKE_C_COMPILER_VERSION VERSION_LESS 5.1 AND CMAKE_C_COMPILER_VERSION VERSION_LESS 5.5)
-        list(APPEND _picky "-Wno-conversion")  # Avoid false positives
-      endif()
-    endif()
+    message(STATUS "Picky compiler options:${WPICKY}")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${WPICKY}")
  endif()
 endif()
-
-# clang-cl
-if(CMAKE_C_COMPILER_ID STREQUAL "Clang" AND MSVC)
-  list(APPEND _picky "-Wno-language-extension-token")  # Allow __int64
-
-  set(_picky_tmp "")
-  foreach(_ccopt IN LISTS _picky)
-    # Prefix -Wall, otherwise clang-cl interprets it as an MSVC option and translates it to -Weverything
-    if(_ccopt MATCHES "^-W" AND NOT _ccopt STREQUAL "-Wall")
-      list(APPEND _picky_tmp ${_ccopt})
-    else()
-      list(APPEND _picky_tmp "-clang:${_ccopt}")
-    endif()
-  endforeach()
-  set(_picky ${_picky_tmp})
-endif()
-
-if(_picky)
-  string(REPLACE ";" " " _picky "${_picky}")
-  string(APPEND CMAKE_C_FLAGS " ${_picky}")
-  message(STATUS "Picky compiler options: ${_picky}")
-endif()
--- a/CMake/Platforms/WindowsCache.cmake
+++ b/CMake/Platforms/WindowsCache.cmake
@ -0,0 +1,91 @@
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+if(NOT UNIX)
+  if(WIN32)
+    set(HAVE_LIBSOCKET 0)
+    set(HAVE_GETHOSTNAME 1)
+    set(HAVE_LIBZ 0)
+
+    set(HAVE_ARPA_INET_H 0)
+    set(HAVE_FCNTL_H 1)
+    set(HAVE_IO_H 1)
+    set(HAVE_NETDB_H 0)
+    set(HAVE_NETINET_IN_H 0)
+    set(HAVE_NET_IF_H 0)
+    set(HAVE_PWD_H 0)
+    set(HAVE_SETJMP_H 1)
+    set(HAVE_SIGNAL_H 1)
+    set(HAVE_STDLIB_H 1)
+    set(HAVE_STRINGS_H 0)
+    set(HAVE_STRING_H 1)
+    set(HAVE_SYS_PARAM_H 0)
+    set(HAVE_SYS_POLL_H 0)
+    set(HAVE_SYS_SELECT_H 0)
+    set(HAVE_SYS_SOCKET_H 0)
+    set(HAVE_SYS_SOCKIO_H 0)
+    set(HAVE_SYS_STAT_H 1)
+    set(HAVE_SYS_TIME_H 0)
+    set(HAVE_SYS_TYPES_H 1)
+    set(HAVE_SYS_UTIME_H 1)
+    set(HAVE_TERMIOS_H 0)
+    set(HAVE_TERMIO_H 0)
+    set(HAVE_TIME_H 1)
+    set(HAVE_UTIME_H 0)
+
+    set(HAVE_SOCKET 1)
+    set(HAVE_SELECT 1)
+    set(HAVE_STRDUP 1)
+    set(HAVE_STRICMP 1)
+    set(HAVE_STRCMPI 1)
+    set(HAVE_GETTIMEOFDAY 0)
+    set(HAVE_CLOSESOCKET 1)
+    set(HAVE_SIGSETJMP 0)
+    set(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID 1)
+    set(HAVE_GETPASS_R 0)
+    set(HAVE_GETPWUID 0)
+    set(HAVE_GETEUID 0)
+    set(HAVE_UTIME 1)
+    set(HAVE_RAND_EGD 0)
+    set(HAVE_GMTIME_R 0)
+    set(HAVE_GETHOSTBYNAME_R 0)
+    set(HAVE_SIGNAL 1)
+
+    set(HAVE_GETHOSTBYNAME_R_3 0)
+    set(HAVE_GETHOSTBYNAME_R_3_REENTRANT 0)
+    set(HAVE_GETHOSTBYNAME_R_5 0)
+    set(HAVE_GETHOSTBYNAME_R_5_REENTRANT 0)
+    set(HAVE_GETHOSTBYNAME_R_6 0)
+    set(HAVE_GETHOSTBYNAME_R_6_REENTRANT 0)
+
+    set(TIME_WITH_SYS_TIME 0)
+    set(HAVE_O_NONBLOCK 0)
+    set(HAVE_IN_ADDR_T 0)
+    set(STDC_HEADERS 1)
+
+    set(HAVE_SIGACTION 0)
+    set(HAVE_MACRO_SIGSETJMP 0)
+  else()
+    message("This file should be included on Windows platform only")
+  endif()
+endif()
--- a/CMake/Utilities.cmake
+++ b/CMake/Utilities.cmake
@ -23,31 +23,13 @@
 ###########################################################################
 # File containing various utilities

-# Return number of arguments that evaluate to true
-function(curl_count_true _output_count_var)
-  set(_list_len 0)
-  foreach(_option_var IN LISTS ARGN)
-    if(${_option_var})
-      math(EXPR _list_len "${_list_len} + 1")
+# Returns a list of arguments that evaluate to true
+function(count_true output_count_var)
+  set(lst_len 0)
+  foreach(option_var IN LISTS ARGN)
+    if(${option_var})
+      math(EXPR lst_len "${lst_len} + 1")
    endif()
  endforeach()
-  set(${_output_count_var} ${_list_len} PARENT_SCOPE)
-endfunction()
-
-# Dump all defined variables with their values
-function(curl_dumpvars)
-  message("::group::CMake Variable Dump")
-  get_cmake_property(_vars VARIABLES)
-  foreach(_var IN ITEMS ${_vars})
-    get_property(_var_type CACHE ${_var} PROPERTY TYPE)
-    get_property(_var_advanced CACHE ${_var} PROPERTY ADVANCED)
-    if(_var_type)
-      set(_var_type ":${_var_type}")
-    endif()
-    if(_var_advanced)
-      set(_var_advanced " [adv]")
-    endif()
-    message("${_var}${_var_type}${_var_advanced} = '${${_var}}'")
-  endforeach()
-  message("::endgroup::")
+  set(${output_count_var} ${lst_len} PARENT_SCOPE)
 endfunction()
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Daniel Stenberg	f402c181e3	lib: build fixups when built with most things disabled Closes #11687	2023-08-24 13:15:31 +02:00
Daniel Stenberg	1396a6c01f	tiny-curl: patch set	2023-08-24 13:15:31 +02:00