diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..ade34bc
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/curl-8.0.1_9-win64-mingw
\ No newline at end of file
diff --git a/curl-8.0.1_9-win64-mingw/.vs/ProjectSettings.json b/curl-8.0.1_9-win64-mingw/.vs/ProjectSettings.json
new file mode 100644
index 0000000..4e72f3b
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/.vs/ProjectSettings.json
@@ -0,0 +1,3 @@
+{
+ "CurrentProjectSetting": "Нет конфигураций"
+}
\ No newline at end of file
diff --git a/curl-8.0.1_9-win64-mingw/.vs/VSWorkspaceState.json b/curl-8.0.1_9-win64-mingw/.vs/VSWorkspaceState.json
new file mode 100644
index 0000000..c3593d8
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/.vs/VSWorkspaceState.json
@@ -0,0 +1,7 @@
+{
+ "ExpandedNodes": [
+ "",
+ "\\bin"
+ ],
+ "PreviewInSolutionExplorer": false
+}
\ No newline at end of file
diff --git a/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/14a1a588-d186-47b9-aa12-733c51b93b83.vsidx b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/14a1a588-d186-47b9-aa12-733c51b93b83.vsidx
new file mode 100644
index 0000000..3f04988
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/14a1a588-d186-47b9-aa12-733c51b93b83.vsidx differ
diff --git a/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/a1549df6-eb01-435e-a916-506b3e062a10.vsidx b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/a1549df6-eb01-435e-a916-506b3e062a10.vsidx
new file mode 100644
index 0000000..2285935
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/a1549df6-eb01-435e-a916-506b3e062a10.vsidx differ
diff --git a/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/read.lock b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/FileContentIndex/read.lock
new file mode 100644
index 0000000..e69de29
diff --git a/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/config/applicationhost.config b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/config/applicationhost.config
new file mode 100644
index 0000000..0d88f0d
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/config/applicationhost.config
@@ -0,0 +1,1016 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/v17/.suo b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/v17/.suo
new file mode 100644
index 0000000..9615a1b
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/v17/.suo differ
diff --git a/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/v17/Browse.VC.db b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/v17/Browse.VC.db
new file mode 100644
index 0000000..e3ab651
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/.vs/curl-8.0.1_9-win64-mingw/v17/Browse.VC.db differ
diff --git a/curl-8.0.1_9-win64-mingw/.vs/slnx.sqlite b/curl-8.0.1_9-win64-mingw/.vs/slnx.sqlite
new file mode 100644
index 0000000..2fc6925
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/.vs/slnx.sqlite differ
diff --git a/curl-8.0.1_9-win64-mingw/.vs/tasks.vs.json b/curl-8.0.1_9-win64-mingw/.vs/tasks.vs.json
new file mode 100644
index 0000000..a6b1a11
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/.vs/tasks.vs.json
@@ -0,0 +1,10 @@
+{
+ "version": "0.2.1",
+ "tasks": [
+ {
+ "taskLabel": "задача-curl-8.0",
+ "appliesTo": "/",
+ "type": "launch"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/curl-8.0.1_9-win64-mingw/BUILD-HASHES.txt b/curl-8.0.1_9-win64-mingw/BUILD-HASHES.txt
new file mode 100644
index 0000000..46165a1
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/BUILD-HASHES.txt
@@ -0,0 +1,189 @@
+SHA2-256(./bin/curl-ca-bundle.crt)= fb1ecd641d0a02c01bc9036d513cb658bbda62a75e246bedbc01764560a639f0
+SHA2-256(./bin/curl.exe)= 5174c385297927f044f975c423926d07add799ffc6bb546c66f28745cf8ece47
+SHA2-256(./bin/libcurl-x64.def)= 1a0493c4587747d399ab1b5bd445702d776adc3aefb9cbcc6e5f4770f0330a98
+SHA2-256(./bin/libcurl-x64.dll)= bde9bee3cfb25bd0c348ad59a0ebdc1f06734f8f5e3c3580a770ccf3b4fb3485
+SHA2-256(./include/brotli/decode.h)= a9665d09f77df18f8a1f4c948610474ebd8758ff3f3a0714842af0a12d263ee6
+SHA2-256(./include/brotli/encode.h)= dfc6f8e43b30e2e88c5cc9d1a4842aa967aa399e2ccd4eea3fb134a990216812
+SHA2-256(./include/brotli/port.h)= 2cffc986439dfac586589f538db721155229ac615dfad16300dd70aff7b718f6
+SHA2-256(./include/brotli/types.h)= 96c9330e790aa6fe53f4cdd328d0a4b98e361b82913baa3219db73aadb11272c
+SHA2-256(./include/curl/curl.h)= 3c35502a677855429e5158fb445c6db11aa8eab1baabda07be5e3bf8a68a9fda
+SHA2-256(./include/curl/curlver.h)= 0643bb8ed1f79eaaf8758304262eb2ed1e8a418344ae277e33850495aba9444b
+SHA2-256(./include/curl/easy.h)= b9c5aed96b32f76fd09338cb3b4066c8082b702165960e4026a0a4e0d3612634
+SHA2-256(./include/curl/header.h)= 614be48a86f4e5d304c5aa40ef1c85245e25b97732921c3631840146669d992f
+SHA2-256(./include/curl/mprintf.h)= 637de71d034d478ad47237c376c02eefa50514ada9f2a037ca42c6ffdf66c3dc
+SHA2-256(./include/curl/multi.h)= 3dd2ff1eeea4298f08d0aa5c6a46140644b6ee2e710ee8bc64513e732f32975c
+SHA2-256(./include/curl/options.h)= 5716018d27e783283825bed2a8a051190487722fdeb64b7aa2d03a997e99b8d1
+SHA2-256(./include/curl/stdcheaders.h)= d7588b86814a35ffc3766ff6242e6f6705e04401fc9c208a195caff3503af81c
+SHA2-256(./include/curl/system.h)= afdcf4eff603a098a00a039b50a2c7576f0b1df24b02b25dd2bcf770f2472c9c
+SHA2-256(./include/curl/typecheck-gcc.h)= d185380689acef7cee201b07cfbf20aa29f3ab7f19ba08895f927cffe028edb5
+SHA2-256(./include/curl/urlapi.h)= dd631108b8503994fcf6c416eeaea2973822fc778ea2cff440c6b6e21c8712d2
+SHA2-256(./include/curl/websockets.h)= df5effcf55908ce67501008f99ce1ac4d01cfc48d2788d6a106dc6bfda009078
+SHA2-256(./include/gsasl-mech.h)= 3d264823c4a12181b05240c3751a8f91a09bf33a692d9bd4f5e92088f18c5ce8
+SHA2-256(./include/gsasl-version.h)= 1648f62390bf3570313cc1230f016233e01619cc64a077feba7a962f9be52fc9
+SHA2-256(./include/gsasl.h)= 4b2a4ccdc45e8c3e03089e05a250d58b7a740871a2f734e8ad6d6b350c220c85
+SHA2-256(./include/libssh2.h)= 2ad4b44156ccee35b2dc0611485d60b5a12569e4b1317cb06753d9585b657bf8
+SHA2-256(./include/libssh2_publickey.h)= 2d419bdfbc155cec62cc23d7cb87f3d9361c4f26ce3b3910c74cef715bd2e70b
+SHA2-256(./include/libssh2_sftp.h)= 8a0c63c323edc42286cc608f9a53cebe46ac91432e1080a8520ab69d3caeadbf
+SHA2-256(./include/nghttp2/nghttp2.h)= 0d1d48c9ea099a6f4dbe39491b9c0f68f2c2a4b99898e568da34f59a9017029e
+SHA2-256(./include/nghttp2/nghttp2ver.h)= 565dc92c07698bab1a3eea480012605d5e8fb565c1649419cad46283d5e0bccc
+SHA2-256(./include/nghttp3/nghttp3.h)= 16dbc7a459c3490fd67be00bd7193a39ce3b412ce8fa008472cc907166acebe0
+SHA2-256(./include/nghttp3/version.h)= 8609194d4646d3f5132c94c9ecf24b9b4e2b8f5757b1a0b04ff0ce3e481217c8
+SHA2-256(./include/ngtcp2/ngtcp2.h)= b4d51bd8eeb6443fc0c435395a58396177ce0670c2d6c9e95297c6ff8a616227
+SHA2-256(./include/ngtcp2/ngtcp2_crypto.h)= b0406acffec30d47df3582613f378a9681d3040aee0a92f251048ec5edebe034
+SHA2-256(./include/ngtcp2/ngtcp2_crypto_openssl.h)= 342791e1cd6181ff575d9a220db1cb1dab79f328774b0e69b3618df010b5a389
+SHA2-256(./include/ngtcp2/version.h)= a82a7ed097010cda262e1850615bb237cdcb160c3dac1bc95a8f0544869812c3
+SHA2-256(./include/openssl/aes.h)= 27aaa89367b022b12b66cf52c3c2d68f6761965ac36f3f1153202fa44692ad0e
+SHA2-256(./include/openssl/asn1.h)= 6e9e4042d0cf76eb3b9f5a4d299154dd1d95b8b3c5b645fde7dbe83e7f05b3c9
+SHA2-256(./include/openssl/asn1_mac.h)= 5a0d1d59316bc398bc63af0f1dcf377fb66c3e3132d4c45400c9dbc2003e24b5
+SHA2-256(./include/openssl/asn1err.h)= 75c4b045fef75587c0df5c658b7466b74ad42755368a56cf6ff43581aa5768c6
+SHA2-256(./include/openssl/asn1t.h)= 6c6189504732c30bbf7363676b07fa6fc34330e960b2921b186f9d56deeec000
+SHA2-256(./include/openssl/async.h)= 49369e1569d424f56f016865a34d59b676984e7f67f459e6514241afcd818252
+SHA2-256(./include/openssl/asyncerr.h)= 154f003cfbf49040a04d9aac459cf5009a5a1d76298b222d66ba5b5a4e3721af
+SHA2-256(./include/openssl/bio.h)= 76aed534c208e7e78f141b837f5c1f15f20c01fd18a7599ee8b704078529cd89
+SHA2-256(./include/openssl/bioerr.h)= 348571893bca9600b9f790af5c6a02b40bffd83a718450a54a8022c70fef1a14
+SHA2-256(./include/openssl/blowfish.h)= fb4b19b7730d1cc7ff2b9da1435a506ad0ef50263bd168c5ff24214a06580282
+SHA2-256(./include/openssl/bn.h)= 7a439d7b7fcb7b2bee94012f7eab7f130e8abf6691a738ec2bd2c6ee1d6de2de
+SHA2-256(./include/openssl/bnerr.h)= f0dfac26985a7ae40174e90173df9f95b15bba4d3768290746d7258ff1b0ae64
+SHA2-256(./include/openssl/buffer.h)= c87b52702746e224e6242f4a2a2070b007502ea92063b41df2c4f6bec11c37ca
+SHA2-256(./include/openssl/buffererr.h)= 73f33a7b4406477a0eaf9d0ec42f43b2594167b1d6b84175f378cf5b0de07c12
+SHA2-256(./include/openssl/camellia.h)= d1cee6e44668fba0e46c38db7394aa094c6cd2a25b97dbcfcc6f0ff4414f8ebf
+SHA2-256(./include/openssl/cast.h)= 654ac650ae74ca5e9a87ab46c1205157a7489097d005fdccc4c52912cfcefa55
+SHA2-256(./include/openssl/cmac.h)= b26f8ddb9f60eef2601a84a5455c11060e028d8ce700cae682c4a02ffe2f2ca2
+SHA2-256(./include/openssl/cmp.h)= 22b8e1127029459711ec45a08630228b688ed47deb4f4d62111f39f4fe3c2e1b
+SHA2-256(./include/openssl/cmp_util.h)= 7a982bac5840812b486176102b1fe8b48dda8cce0fe94f2d35aff5057a99004e
+SHA2-256(./include/openssl/cmperr.h)= d22b5995d615e5374041784cd1af99b4ef349b0cd6e2ac852c6d1dbf9aed8e90
+SHA2-256(./include/openssl/cms.h)= 9564be579e014db5a53f5f38c4c16e1b3c76010965f6172a79fb96c89768636e
+SHA2-256(./include/openssl/cmserr.h)= 9db6b3e5e7d1a82c7bffbde27a91f5ace1ddf8c11f5f5a55b90b3df9a67f4ab6
+SHA2-256(./include/openssl/comp.h)= 44ad0613758e8cf84d9ec4f40cf50cbb735b16e659f7e9fd30c2155585d94199
+SHA2-256(./include/openssl/comperr.h)= 656851389d8f21bc80b566248d7849c6b4ecbd5b178592b8e099c6457b37d87c
+SHA2-256(./include/openssl/conf.h)= d6fc24e176f2ad3a7020ce3d982c282c8e048fc6e2198f5e98eac5d10e308874
+SHA2-256(./include/openssl/conf_api.h)= a66bcc69464235679980efc4a687a4fe036388da91173809ca45c0a3cfe47a5b
+SHA2-256(./include/openssl/conferr.h)= 4b724e0a69104b630c334787994273c619f4dc0b509a0b03271de5a7e2539fcb
+SHA2-256(./include/openssl/configuration.h)= 273fb44e320dcc0dcf53f0c0c8946e9da72e18a4803512c5e62eab26744b8a89
+SHA2-256(./include/openssl/conftypes.h)= e8f6697076d2464eaecfe2cdae8d2045388c53da2372fd52df5f6cfdc4d63375
+SHA2-256(./include/openssl/core.h)= 2981b182ac8930f17b136665b61f1c34c0cfdb4e122f19bd75d7ff552ff5e736
+SHA2-256(./include/openssl/core_dispatch.h)= ab6ac7673333b11035a437640ac729e537a7c66949e4e1eb953d24f55eb40fee
+SHA2-256(./include/openssl/core_names.h)= 86a2c73a71940bf61b8523b46bf81383c86e18e30c0608eae7667cbeae4019a4
+SHA2-256(./include/openssl/core_object.h)= 7a7172d30597e3a3e06c4e67a049d1335aa6f7d5b49641abba8fd4d5a1c07563
+SHA2-256(./include/openssl/crmf.h)= 35f535d165e6d33782205d433a00dcc16b402f669f67b203d8400e03e239a471
+SHA2-256(./include/openssl/crmferr.h)= c08a40103c0c6d0d7d9ad0e2781db1f19829d29193d115d38b4d0271d13fecf9
+SHA2-256(./include/openssl/crypto.h)= e38be34cd9c27f3f7af7acf4039357e79b4af2465d61f21ffb9687901fa8e325
+SHA2-256(./include/openssl/cryptoerr.h)= 2035467a49cd64e952be41ce9a8754652acf31e481f2d710e14a0a4fc870cd4f
+SHA2-256(./include/openssl/cryptoerr_legacy.h)= 870042252331e89723d31079469104cafd676f0fedcbe0d99f56f3e8862fff8d
+SHA2-256(./include/openssl/ct.h)= 8934546579df1f30bf22e1e8cd4872a0c2dbc54f5157f92534491c0f9571d956
+SHA2-256(./include/openssl/cterr.h)= 562bfe4ac984ebfef4fb91bdbe0a649d157f5057ab61ffee3a844d23f7c72c0a
+SHA2-256(./include/openssl/decoder.h)= 8419fd9e4e333fd477238bbad4ff875d5657b02cc39635c3a5c15f3a5bc7f0f2
+SHA2-256(./include/openssl/decodererr.h)= a785fb95930e8b4a18054f77b7d5143d44673f4ca57682899bc2bf3464cafccf
+SHA2-256(./include/openssl/des.h)= bb13c7c5e13f3402d674fa88994b92ed72d6cdc1116707765d28bd7e0de31285
+SHA2-256(./include/openssl/dh.h)= 0ffdb3e46f8930e13e4dfbe7d6bc76c703c20aa763d9613a69aca1981fa41bbf
+SHA2-256(./include/openssl/dherr.h)= 930731f5b68298def56df6fb0a3cdeb5534cd22543bef9a446fc73d680e4ce5a
+SHA2-256(./include/openssl/dsa.h)= 702b50b9877cc54e7b19b87c5b9584a208aa5b25a93f840f4d109f6bd18a6238
+SHA2-256(./include/openssl/dsaerr.h)= 69c2ecff5f62898461bc521ea918abd2a673206dd5e8d43288ad25d2c012f163
+SHA2-256(./include/openssl/dtls1.h)= 1d1f404032a9eb31408c1f10bdff554d5740fb345b64b86fb74da8df95fbd901
+SHA2-256(./include/openssl/e_os2.h)= edc97525ece6d817c910da30f229bba4ad419bb0da4c49c9addb4f0ae751753f
+SHA2-256(./include/openssl/ebcdic.h)= 75a668c25c97853d5ba37ebce060a15152573242e3729d42830eba1daa642404
+SHA2-256(./include/openssl/ec.h)= e61ffa1cbfd7bac0114bbd73537b8b39843cbcbd3423c068bf07dbdc1c21e3dc
+SHA2-256(./include/openssl/ecdh.h)= 5b99fdd1dfea38640ed8a506fb9b66db381cc26a1254448a81cc6b161e41850f
+SHA2-256(./include/openssl/ecdsa.h)= 5b99fdd1dfea38640ed8a506fb9b66db381cc26a1254448a81cc6b161e41850f
+SHA2-256(./include/openssl/ecerr.h)= ce4fec7ee41de25a20abb7a9f00fe93305793a7bd2023d434b9aa6f64f91058a
+SHA2-256(./include/openssl/encoder.h)= 907d2f061c2972447d3f0c1cfc149c78791b1e4bdc131ad5a3eed1d084c76b41
+SHA2-256(./include/openssl/encodererr.h)= 63504766e9fcf36fe1527d95fe21460574896da187c60707bfa68254a35693b7
+SHA2-256(./include/openssl/engine.h)= b48e5406717b26f41085dad8cc553e78c6cc54ea936df8ff1aa1312f32a6c053
+SHA2-256(./include/openssl/engineerr.h)= 8616a93b1b1bd8d1221844834817c28b7da78be1649a5b1780d9ea65fba8807c
+SHA2-256(./include/openssl/err.h)= 3cc1e1dbda3781fec4f515b1d61e31c39c6e76b802b3150e7c977b0b0a213608
+SHA2-256(./include/openssl/ess.h)= 073ef3e4de09dc3e35117c37ba074e5c78a5041e1263768d475ee0df650c003a
+SHA2-256(./include/openssl/esserr.h)= e791193e891b0784670d5410539aeea9d2a8591de71495b4add6e7dbf9dc22cd
+SHA2-256(./include/openssl/evp.h)= afa819625e3ec99c970229a92915fe6e397c46e620c8b904f163a551bed042d8
+SHA2-256(./include/openssl/evperr.h)= 7fab5bade4441300fa7ffe721ca2eb361835998db7d386f8f1be7db5b7596c3f
+SHA2-256(./include/openssl/fips_names.h)= 6332c39728d4406299deaf5e161de6583294e4f5ec172bdbce080a354761566f
+SHA2-256(./include/openssl/fipskey.h)= 7bca4b30e836685232c7cc0323059680cc367df6390e88c71843208f1b6df204
+SHA2-256(./include/openssl/hmac.h)= e49fbe0086f8fbefa5648eef70bc84e8090a9226a1e3c6e856499373004aed0a
+SHA2-256(./include/openssl/http.h)= 70777f3993fce1e96dd54a1c8f839da604753f9c92cdafcaa5f268ce608bb0cd
+SHA2-256(./include/openssl/httperr.h)= b50562e98d92c08e47e2b1b0bcf5652820b2a774652968a1188f9f2d87f2fe87
+SHA2-256(./include/openssl/idea.h)= 239122df15e738d7552dd76850c55a9ffe0136f33506c23d9058215a1255af66
+SHA2-256(./include/openssl/kdf.h)= 41756fe038443d1d270458d53d6e42ea78d12d980728b6a9284fa259958ea00a
+SHA2-256(./include/openssl/kdferr.h)= 3d9f27fffdb49e0ece9d5a62adbb9cc42c56262b00cc8ce7f956b2cb05a2a22d
+SHA2-256(./include/openssl/lhash.h)= 0c457611f11e6c4fd574738f133618b538f5e0011e9bb9d944f223cf91ce8e92
+SHA2-256(./include/openssl/macros.h)= 30823bbca2920f6897f92a3372eec678240b94e1a9d3da6090f70207b8e1bd56
+SHA2-256(./include/openssl/md2.h)= 4add77ed047736979dc442a49d42921cce21e654a2dceef058d0191aa2d3c941
+SHA2-256(./include/openssl/md4.h)= 0472e597d139b44dd7d78d9093a5d8109417d18e9955fc940f1ea3e2e892ab44
+SHA2-256(./include/openssl/md5.h)= 308c901ec1a28f9b0098717f689ca63e104ce805050802d38b8f122d85ab2c78
+SHA2-256(./include/openssl/mdc2.h)= 42b844c9ae9e00e7c0b0e28858b8b3db7b8abf7e514e5e63f43456371ed3384b
+SHA2-256(./include/openssl/modes.h)= 4a8b3b1dafc15798a3b2bef0e3885275746e7fae73a0d96e55da55261554ba52
+SHA2-256(./include/openssl/obj_mac.h)= c1d31f32a3dbc9dea1db10f322b4b46a24c3d4411fe54630df59fa46fc2b583a
+SHA2-256(./include/openssl/objects.h)= 5fc6f3f0dd5e46fd409cb51ae1b331fec799fb6ef4b5efdc8ffbe264e5e83997
+SHA2-256(./include/openssl/objectserr.h)= e17a8d7f62a1ef257fd90e604d4293bf02d5f81ae8198efe1e197c5b27baeb8c
+SHA2-256(./include/openssl/ocsp.h)= 99d8de16ff3d39cea37359f0dc52dad8632702db19bfdb2a9ea8f8a79997a519
+SHA2-256(./include/openssl/ocsperr.h)= 178329cfc042d3f1eb6e179206d844de41ba05ee4ac0ed9e3e6c861fb49d68ea
+SHA2-256(./include/openssl/opensslconf.h)= 890184233890bacd52fd420fef07befad411b9a318b97efbf36f46673d3e7841
+SHA2-256(./include/openssl/opensslv.h)= 973e9d2652e7f22fcfd8b154dc3f002d51e0e5bdca3a66027c69f5dfc36de92a
+SHA2-256(./include/openssl/ossl_typ.h)= 76cb203ef3bcd305f4171e1d33f3f3319dee6354c2433493e5e9068aa79672fd
+SHA2-256(./include/openssl/param_build.h)= 3bf39b1037256466f1a89868621b2b62f1d05e63064159e60727041b170d55e3
+SHA2-256(./include/openssl/params.h)= 10d8e0157e339ee01f3b9c60c4b5bc60e6d4edce1084f0c9589ff75bf3a9f693
+SHA2-256(./include/openssl/pem.h)= 26e59ed8238091baafa52e477910a0fb1c8d2447a23bf330d017650bee5ca105
+SHA2-256(./include/openssl/pem2.h)= a34a1607983b5f32be8ca49e75c3b41f1c9413b4eb777af144958283ecbd3922
+SHA2-256(./include/openssl/pemerr.h)= 843df90b1b434eed626bb6b8bccd5f6ed530e592d706584f56a725d254d8a5d2
+SHA2-256(./include/openssl/pkcs12.h)= 2c6b6c18968d8c78935c585a96e641102294964939f93a60c87fd6fa55425278
+SHA2-256(./include/openssl/pkcs12err.h)= b692b1a2c7fc06002dee07a868f0ec394e9b7f20b5e151f78e0941e143c2d2d4
+SHA2-256(./include/openssl/pkcs7.h)= 4cf978d2986cfea67438b48b9577f7017ca5dcff1dc81eadb7d702d7583dee40
+SHA2-256(./include/openssl/pkcs7err.h)= 9fe7a51f3de13b1fd03b319c64b8bd287164eb6ce7d3481994141c0be51396d5
+SHA2-256(./include/openssl/prov_ssl.h)= 1f5c121c02d31f695bff708396e0512286fa04dee67f12ab895c0c558ba33f20
+SHA2-256(./include/openssl/proverr.h)= c6524a35fda47769544a58905a44467a0fe84db2bf644168c46c25e51f6e5686
+SHA2-256(./include/openssl/provider.h)= b9e5b46a26f7e7ec383fe540404092e4d76ae54b5822744e4ba0750ef8d2cac0
+SHA2-256(./include/openssl/quic.h)= 8137476df19d360dc5da219cfe824dafa5b2521021f4337e7655d6368003fcb6
+SHA2-256(./include/openssl/rand.h)= bb9a0269d976465e31ae7c22a022b39b55e7f5b003ddf82f5b9d0e009da482d9
+SHA2-256(./include/openssl/randerr.h)= 80260d41625b9ed9f727e8553a65a111645b3c013df8cc8fa6a718d32b643c88
+SHA2-256(./include/openssl/rc2.h)= 08c6865d169a300e8bc818bd810f80ffb8a21d69e97dad88e400b586d0f3e965
+SHA2-256(./include/openssl/rc4.h)= ea45836c253246c1d6f1b16b360dbb59322e26e28bfc54881d698e7cd5057666
+SHA2-256(./include/openssl/rc5.h)= 968c96ead08204edb8148981094700cbc3338ed0613c4469da5ab4675fa1ce29
+SHA2-256(./include/openssl/ripemd.h)= 2e28edeb6613516db89e28c9d962301f4fe7b38366ebdd1d35933f3491d57b9d
+SHA2-256(./include/openssl/rsa.h)= 087c43978b2728f8797cf60752931b55157ab8812fc92fc5dd172fc99efe2a35
+SHA2-256(./include/openssl/rsaerr.h)= a745e6b2835af7bb933e78870a270d51ab33778fe10a5cd377422d4b9587dcf0
+SHA2-256(./include/openssl/safestack.h)= bcd1a766d9043cf69f93414f8f5f7460a7f8b380c983ba986284ed5ad7947a0e
+SHA2-256(./include/openssl/seed.h)= 0d6d206f240f7bd6fa28cd4ec66b2b878f199af3ce6eda172af9fe31ebb71586
+SHA2-256(./include/openssl/self_test.h)= 780a17cecfd4f821d1293ababb5f560a111c67d32eace330d22ce40f03fee84d
+SHA2-256(./include/openssl/sha.h)= 06500535b9b3d9742e745558dc02e52d0df6d75b038457d4f6c374ed68d39eaf
+SHA2-256(./include/openssl/srp.h)= 9931b618255b70a35ef5b554ceee202163a3ae693e926fc1ed2a74a91d3fe595
+SHA2-256(./include/openssl/srtp.h)= d2b97e90531bf9cdb086d9943a518bc474aebaa0aef02f1d41e8113fe944c9d9
+SHA2-256(./include/openssl/ssl.h)= 6be04d31a681de98c80de4c33ea46e222575557dc151086f1bb3bb3e6e4633f5
+SHA2-256(./include/openssl/ssl2.h)= 92e3330e2867bf17d3b305ba0f6fe6b073ad4bdb9db519e4224bbd993f1e9cb7
+SHA2-256(./include/openssl/ssl3.h)= 5ce26c99d8a0fffe062a4293f01f6d55619b4e1b8f75bf0065fb3faa2ac512e9
+SHA2-256(./include/openssl/sslerr.h)= f26757bbc37c71c4897cf81a6a6fa653d2f78de2b342c96503393d3abcb08a4b
+SHA2-256(./include/openssl/sslerr_legacy.h)= 98401ca29f46694fff11304801d995015a7e4a81afe0db0a9a79a0bdde9e03d8
+SHA2-256(./include/openssl/stack.h)= 69f94382a15a3c4cfd1dda32108db5234727b36ed0e25f1fb12e0993c7b5ac95
+SHA2-256(./include/openssl/store.h)= cfd4ee1777782d642da53a045d253ede58f0f0463647e6d4f352953b26e2e058
+SHA2-256(./include/openssl/storeerr.h)= 370277e107a1b979ff5e0bd28f5adb92e066d41831ac37ce7108d2a1b84376f6
+SHA2-256(./include/openssl/symhacks.h)= 68b54776fa15943f3f018be6c7dc7a8847c9f512fb5eeec4f093804197dc2dfa
+SHA2-256(./include/openssl/tls1.h)= 99fa5ab66437bd5bfe73359d5a0f1b8b86b0ea14fa2a8378ef3137ee34356e24
+SHA2-256(./include/openssl/trace.h)= b875c655debc29d9c910db5522feb97edf147798dea6f2fcad8f9a85abb18a1a
+SHA2-256(./include/openssl/ts.h)= 886fcc2d0687b1f3d430d8091067c4bf9a73df2102e1581ac2a1bcfc5f6cf515
+SHA2-256(./include/openssl/tserr.h)= 0d851cb9db84c48bb8a9871a988950fd0b62ecc854b11641e3e9a07fa191a6f6
+SHA2-256(./include/openssl/txt_db.h)= 1a6a6b331ef3cc6c632f782e8da2fa81aaeeac56e4d0b2fb3016f936805be257
+SHA2-256(./include/openssl/types.h)= 0a99b2c6f9a99ce25038eb98790eaf0f6c3dafaccfe37d6ff126d54f2387375d
+SHA2-256(./include/openssl/ui.h)= 0dca137a0686620b4f159b9ce78a45a772f04d670e2b24a42feb53273cb2fd81
+SHA2-256(./include/openssl/uierr.h)= 6f46dc9509b4d10802aaa1ad3c84763a2843312fdc8dd8add5c7b24e7f0c877f
+SHA2-256(./include/openssl/whrlpool.h)= bb8f9f6ad1960e87f78363793130a0c1bee89b64a12eb32e939791fb0ca61016
+SHA2-256(./include/openssl/x509.h)= 67508e0a77ef6bb1caf53f8cc018eb1883ded35e65ac9c87c23658a62629c0bb
+SHA2-256(./include/openssl/x509_vfy.h)= 8f4b78478d697614edad17c08ca34317ccfefd594ec053d444e842aaecebb14d
+SHA2-256(./include/openssl/x509err.h)= 2c4d4a6f0c94bfc1fc3208f45c50463240719a25de72716d7d033845a84d991e
+SHA2-256(./include/openssl/x509v3.h)= bf492e29364b57f4f130619b18d2932763e9c3f54024cd4979a84a26e064624d
+SHA2-256(./include/openssl/x509v3err.h)= 25ce00779ee00002830ede3e302a8b4bf03dbc505243d2b87a86a62c31a52d6f
+SHA2-256(./include/zconf.h)= e5a9079e37fa799583634fcd6905b53f1c20fd1d98e6bae942674c3c419b9fab
+SHA2-256(./include/zdict.h)= 02a34169467501fcc665cccb33f5bd455fdb665e9806851777dc8a6c4d5a75e3
+SHA2-256(./include/zlib.h)= a980a0d104198a53cc220c51ab5856e5be901bec8a2d02e0ee79a8754219dfed
+SHA2-256(./include/zstd.h)= 41d0f43747d0dee56f60bd10aed262f193d725b7e11eb9e94aa4ad80183c7da8
+SHA2-256(./include/zstd_errors.h)= 36dbd0a595852e10ff5b52992294f610055b8781101f4634036e05cf7d4bb506
+SHA2-256(./lib/libbrotlicommon.a)= 63c4c939411bf4d409ce5d3897dda4c2f4c7d380bdc53834680e028634f1e470
+SHA2-256(./lib/libbrotlidec.a)= 5d22a3d49e3768a66b0ad55c3448092277f64cd85dd37c9e127699b3ccfe5b79
+SHA2-256(./lib/libcrypto.a)= ce5f64219af5097cc967254e8eb2a828187dc9ecf5e55078301496a5fd090a8c
+SHA2-256(./lib/libcurl.a)= 9c5226c75751a067715c42dcab690e472132ab44d8c0ab45249c8696c175ec77
+SHA2-256(./lib/libcurl.dll.a)= 8fe78c9f947e41ad0f5460ea1857a836e4ebee171d0b17d928fde930f652aec6
+SHA2-256(./lib/libgsasl.a)= 1833de5f30a1e188bf19a67f6cba999d91be956a9e1651643cdb75c80f481a15
+SHA2-256(./lib/libnghttp2.a)= 3b99de99b5fb74c30650eba5c880746e099f0d6e5e6b25b0f53329c378c12b7b
+SHA2-256(./lib/libnghttp3.a)= 886167f9e27135a494cd32d3c42e6839f4163cbdf2ce7697a39d5f4757223fab
+SHA2-256(./lib/libngtcp2.a)= d00bd6f4e65d9374dc8bac4d40b59c97fa193556210fbd8bf13a1f6b253cf6b1
+SHA2-256(./lib/libngtcp2_crypto_openssl.a)= 65e9eb51c8c867bc9ad6c1dbe836ef854a62b7e6452f522aadd5b8ac35aff4a4
+SHA2-256(./lib/libssh2.a)= 53a8079360577e007e0f44fe99725eadcdcd15b3a632244f296cfca61719c56e
+SHA2-256(./lib/libssl.a)= 37879cd8487f34926365397e8bfd794e34c600dd144bb94becd8adfafce1cb6f
+SHA2-256(./lib/libz.a)= 108bf761dc063ab23e58d248f4b98e53f43bf42a31d63fc324a301d1fd7bc642
+SHA2-256(./lib/libzstd.a)= 8cf9bc46b060c3374b7c008205fbe572276e77e2c67599139edb461b77255cfa
diff --git a/curl-8.0.1_9-win64-mingw/BUILD-MANIFEST.txt b/curl-8.0.1_9-win64-mingw/BUILD-MANIFEST.txt
new file mode 100644
index 0000000..f7b72bc
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/BUILD-MANIFEST.txt
@@ -0,0 +1,13 @@
+.clang 15.0.6
+.mingw-w64 10.0.0-3
+zlib 1.2.13 https://zlib.net/zlib-1.2.13.tar.xz
+zstd 1.5.5 https://github.com/facebook/zstd/releases/download/v1.5.5/zstd-1.5.5.tar.gz
+brotli 1.0.9 https://github.com/google/brotli/archive/v1.0.9.tar.gz
+nghttp3 0.10.0 https://github.com/ngtcp2/nghttp3/releases/download/v0.10.0/nghttp3-0.10.0.tar.xz
+quictls 3.1.0 https://github.com/quictls/openssl/archive/refs/heads/openssl-3.1.0+quic.tar.gz
+gsasl 2.2.0 https://ftp.gnu.org/gnu/gsasl/gsasl-2.2.0.tar.gz
+ngtcp2 0.14.1 https://github.com/ngtcp2/ngtcp2/releases/download/v0.14.1/ngtcp2-0.14.1.tar.xz
+nghttp2 1.53.0 https://github.com/nghttp2/nghttp2/releases/download/v1.53.0/nghttp2-1.53.0.tar.xz
+libssh2 1.10.0 https://www.libssh2.org/download/libssh2-1.10.0.tar.gz
+cacert 2023-01-10 https://curl.se/ca/cacert-2023-01-10.pem
+curl 8.0.1 https://curl.se/download/curl-8.0.1.tar.xz
diff --git a/curl-8.0.1_9-win64-mingw/BUILD-README.url b/curl-8.0.1_9-win64-mingw/BUILD-README.url
new file mode 100644
index 0000000..36278f8
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/BUILD-README.url
@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/curl/curl-for-win
diff --git a/curl-8.0.1_9-win64-mingw/CHANGES.txt b/curl-8.0.1_9-win64-mingw/CHANGES.txt
new file mode 100644
index 0000000..43bb0a5
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/CHANGES.txt
@@ -0,0 +1,9887 @@
+ _ _ ____ _
+ ___| | | | _ \| |
+ / __| | | | |_) | |
+ | (__| |_| | _ <| |___
+ \___|\___/|_| \_\_____|
+
+ Changelog
+
+Version 8.0.1 (20 Mar 2023)
+
+Daniel Stenberg (20 Mar 2023)
+
+- RELEASE-NOTES: synced
+
+ curl 8.0.1
+
+- Revert "multi: remove PENDING + MSGSENT handles from the main linked list"
+
+ This reverts commit f6d6f3ce01e377932f1ce7c24ee34d45a36950b8.
+
+ The commits caused issues in the 8.0.0 release. Needs a retake.
+
+ Reported-by: Kamil Dudka
+ Closes #10795
+
+- include/curl/curlver.h: bump to 8.0.1
+
+Version 8.0.0 (20 Mar 2023)
+
+Daniel Stenberg (20 Mar 2023)
+
+- RELEASE-NOTES: synced
+
+ The curl 8.0.0 release
+
+- THANKS: from the 8.0.0 release
+
+- scripts/delta: fix "ambiguous argument" when used in branches
+
+- SECURITY-PROCESS.md: Busy-loops are not security problems
+
+ Closes #10790
+
+Stefan Eissing (17 Mar 2023)
+
+- tests/http: do not save files for downloads in scorecard testing
+
+ Closes #10788
+
+Daniel Stenberg (17 Mar 2023)
+
+- cf-socket: use port 80 when resolving name for local bind
+
+ It turns out c-ares returns an error when asked to resolve a host name with
+ ares_getaddrinfo using port number 0.
+
+ Reported as a c-ares bug here: https://github.com/c-ares/c-ares/issues/517
+
+ The work-around is to simply use port 80 instead, as the number typically doe
+ s
+ not make a difference and a non-zero number works for c-ares.
+
+ Fixes #10759
+ Reported-by: Matt Jolly
+ Closes #10789
+
+- curl.h: require gcc 12.1 for the deprecation magic
+
+ Reported-by: kchow-FTNT on github
+ Fixes #10726
+ Closes #10784
+
+- Revert "rtsp: use dynbuf instead of custom reallocs"
+
+ This reverts commit 1b9ea3239d22147e00d8 because of OSS-fuzz reports.
+ I'll do another take after the pending release.
+
+ Closes #10785
+
+- test422: verify --next used without a prior URL
+
+ Closes #10782
+
+- tool_getparam: error if --next is used without a prior URL
+
+ Reported-by: 積丹尼 Dan Jacobson
+ Ref: https://github.com/curl/curl/pull/10769#discussion_r1137895629
+
+ Closes #10782
+
+- libssh: use dynbuf instead of realloc
+
+ When building lines to show for SFTP directory listings.
+
+ Closes #10778
+
+- lib2305: deal with CURLE_AGAIN
+
+ The test does a slightly ugly busy-loop for this case but should be
+ managable due to it likely being a very short moment.
+
+ Mention CURLE_AGAIN in curl_ws_recv.3
+
+ Fixes #10760
+ Reported-by: Jay Satiro
+ Closes #10781
+
+- rtsp: use dynbuf instead of custom reallocs
+
+ For the RTP buffering.
+
+ Closes #10776
+
+- libssh2: remove unused variable from libssh2's struct
+
+ Closes #10777
+
+- RELEASE-NOTES: synced
+
+- multi: remove PENDING + MSGSENT handles from the main linked list
+
+ As they are not driving transfers or any socket activity, the main loop
+ does not need to iterate over these handles. A performance improvement.
+
+ They are instead only held in their own separate lists.
+
+ Assisted-by: Stefan Eissing
+ Ref: #10743
+ Closes #10762
+
+- multi: turn link/unlinking easy handles into dedicated functions
+
+- http_aws_sigv4: fix scan-build "value stored to 'ret' is never read"
+
+ Follow-up to 495d09810aa9a
+
+ Closes #10766
+
+- lib: skip Curl_llist_destroy calls
+
+ Linked lists themselves do not carry any allocations, so for the lists
+ that do not have have a set destructor we can just skip the
+ Curl_llist_destroy() call and save CPU time.
+
+ Closes #10764
+
+- lib643: LIB644 is never defined, this is dead code
+
+ Closes #10765
+
+- libtest/Makefile.inc: remove superfluous variables
+
+ Rely on the defaults when possible.
+
+ Closes #10765
+
+- tests/http: remove year ranges from copyrights
+
+ Closes #10763
+
+Casey Bodley (14 Mar 2023)
+
+- aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
+
+ all s3 requests default to UNSIGNED-PAYLOAD and add the required
+ x-amz-content-sha256 header. this allows CURLAUTH_AWS_SIGV4 to correctly
+ sign s3 requests to amazon with no additional configuration
+
+ Signed-off-by: Casey Bodley
+
+ Closes #9995
+
+Viktor Szakats (14 Mar 2023)
+
+- wolfssl: add quic/ngtcp2 detection in cmake, and fix builds
+
+ - add QUIC/ngtcp2 detection in CMake with wolfSSL.
+
+ Because wolfSSL uses zlib if available, move compression detection
+ before TLS detection. (OpenSSL might also need this in the future.)
+
+ - wolfSSL 5.5.0 started using C99 types in its `quic.h` header, but it
+ doesn't #include the necessary C99 header itself, breaking builds
+ (unless another dependency pulled it by chance.) Add local workaround
+ for it. For this to work with all build tools, we had to fix our
+ header detection first. Ref: #10745
+
+ Ref: https://github.com/curl/curl-for-win/commit/6ad5f6ecc15620c15625fc4434
+ 76b3a1ecef4f3f
+
+ Closes #10739
+
+Stefan Eissing (14 Mar 2023)
+
+- secure-transport: fix recv return code handling
+
+ Return code handling of recv calls were not always correct when an error
+ occured or the connection was closed.
+
+ Closes #10717
+
+- http2: Use KEEP_SEND_HOLD for flow control in HTTP/2
+
+ - use the defined, but so far not used, KEEP_SEND_HOLD bit for flow
+ control based suspend of sending in transfers.
+
+ Prior to this change KEEP_SEND_PAUSE bit was used instead, but that can
+ interfere with pausing streams from the user side via curl_easy_pause.
+
+ Fixes https://github.com/curl/curl/issues/10751
+ Closes https://github.com/curl/curl/pull/10753
+
+Dan Fandrich (13 Mar 2023)
+
+- tests: fix control code that hid some text in runtests.1
+
+- tests: sync option lists in runtests.pl & its man page
+
+Daniel Stenberg (13 Mar 2023)
+
+- multi: make multi_perform ignore/unignore signals less often
+
+ For improved performance
+
+ Reported-by: Jerome St-Louis
+ Ref: #10743
+ Closes #10750
+
+Viktor Szakats (13 Mar 2023)
+
+- cmake: delete unused HAVE__STRTOI64
+
+ Also delete obsolete surrounding comments.
+
+ Reviewed-by: Daniel Stenberg
+ Closes #10756
+
+- CI: fix copyright header
+
+ Follow-up to 395b9175b7422d699fa93643973295c106cdf147
+
+Daniel Stenberg (13 Mar 2023)
+
+- RELEASE-PROCEDURE.md: update coming release dates
+
+Stefan Eissing (13 Mar 2023)
+
+- tests/http: add pytest to GHA and improve tests
+
+ - added to: ngtcp2-quictls, ngtcp2-gnutls and the linux varians
+ quiche, bearssl, libressl, mbedtls, openssl3, rustls
+ - added disabled in ngtcp2-wolfssl due to weird SSL_connect() errors
+ not reproducable locally
+
+ Improvements on pytest:
+
+ - handling of systems with nghttpx in $PATH
+ - configure will seach $PATH got nghttpx used in pytest
+ - pytest fixes for managing nghttpx without h3 support
+ - ngtcp2-wolfssl: use a fully enabled wolfssl build
+
+ - lower parallel count for http/1.1 tests, since we do not
+ want to test excessive connections.
+ - check built curl for HTTPS-proxy support in proxy tests
+ - bearssl does not like one of our critical cert extensions, making
+ it non-critical now
+ - bearssl is too slow for test_12, skipping
+ - making sure we do h3 tests only when curl and server support is there
+
+ Closes #10699
+
+Marcel Raad (13 Mar 2023)
+
+- tool_operate: silence unused parameter warning
+
+ `global` is only used in the `my_setopt` macro version without
+ `CURL_DISABLE_LIBCURL_OPTION` since commit 4774decf10a.
+
+ Closes https://github.com/curl/curl/pull/10752
+
+Viktor Szakats (13 Mar 2023)
+
+- build: fix stdint/inttypes detection with non-autotools
+
+ Fix `stdint.h` and `inttypes.h` detection with non-autotools builds on
+ Windows. (autotools already auto-detected them accurately.)
+
+ `lib/config-win32.h` builds (e.g. `Makefile.mk`):
+ - set `HAVE_STDINT_H` where supported.
+ - set `HAVE_INTTYPES_H` for MinGW.
+
+ CMake:
+ - auto-detect them on Windows. (They were both force-disabled.)
+ - delete unused `CURL_PULL_STDINT_H`.
+ - delete unused `CURL_PULL_INTTYPES_H`.
+ - stop detecting `HAVE_STDINT_H` twice.
+ Present since the initial CMake commit: 4c5307b45655ba75ab066564afdc0c111a8
+ b9291
+
+ curl doesn't use these C99 headers, we need them now to workaround
+ broken wolfSSL builds. Ref: #10739
+
+ Once that clears up, we can delete these detections and macros (unless
+ we want to keep them for future us.)
+
+ Reviewed-by: Daniel Stenberg
+ Closes #10745
+
+Daniel Stenberg (13 Mar 2023)
+
+- RELEASE-NOTES: synced
+
+- ftp: add more conditions for connection reuse
+
+ Reported-by: Harry Sintonen
+ Closes #10730
+
+Dan Fandrich (12 Mar 2023)
+
+- tests: make first.c the same for both lib tests and unit tests
+
+ The only difference used to be global variable used in unittest tests.
+ After cb7ed5a removed individual flag overrides for the unittests, first.c
+ was no longer recompiled for unit tests to include the flag, so whether it
+ worked or gave a link error depended on whether it was compiled in
+ libtest or unittest first. This way also speeds up the build by
+ eliminating 40 identical compile invocations.
+
+ Fixes #10749
+
+- tests: use AM_CPPFILES to modify flags in unit tests
+
+ Using CPPFLAGS sometimes caused odd compile issues when building tests
+ with parallel make and AM_CPPFILES is the right flag, anyway.
+
+ Follow-up to cb7ed5a
+
+ Ref #10749
+
+Viktor Szakats (13 Mar 2023)
+
+- Makefile.mk: fix -g option in debug mode [ci skip]
+
+ Add it to `CFLAGS` (was: `LDFLAGS`).
+
+ Closes #10747
+
+Jay Satiro (12 Mar 2023)
+
+- tool: improve --stderr handling
+
+ - freopen stderr with the user-specified file (--stderr file) instead of
+ using a separate 'errors' stream.
+
+ - In tool_setup.h override stdio.h's stderr macro as global variable
+ tool_stderr.
+
+ Both freopen and overriding the stderr macro are necessary because if
+ the user-specified filename is "-" then stdout is assigned to
+ tool_stderr and no freopen takes place. See the PR for more information.
+
+ Ref: https://github.com/curl/curl/issues/10491
+
+ Closes https://github.com/curl/curl/pull/10673
+
+Dan Fandrich (11 Mar 2023)
+
+- CI: don't run CI jobs if only another CI was changed
+
+ Also skip builds on non-Windows platforms when only Windows build files
+ have changed.
+
+ This should reduce the number of useless builds and the associated
+ waiting time and chance of spurious failures, freeing resources for
+ new PRs.
+
+ Closes #10742
+
+- http: don't send 100-continue for short PUT requests
+
+ This is already how curl is documented to behave in Everything curl, but
+ in actuality only short POSTs skip this. This should knock 30 seconds
+ off a full run of the test suite since the 100-continue timeout will no
+ longer be hit.
+
+ Closes #10740
+
+- tests: add DELAY keyword to more tests using waits
+
+- tests: hack to build most unit tests under cmake
+
+ These are only built when a libcurl static library is available, since
+ we're not building a special libcurlu library yet and these tests rely
+ on private symbols that aren't available in the shared library. A few
+ unit tests do require libcurlu, so those are not built.
+
+ Closes #10722
+
+- tests: fix MSVC unreachable code warnings in unit tests
+
+ Switch unit1654 to use the proper test macros as well.
+
+- tests: make CPPFLAGS common to all unit tests
+
+ There's no need to specify them individually.
+
+- tests: keep cmake unit tests names in sync
+
+ Put only the test names into Makefile.inc so they can be used by both
+ cmake and automake. This will prevent the list of tests from becoming
+ out of date when they are also built under cmake.
+
+Viktor Szakats (11 Mar 2023)
+
+- src: silence wmain() warning for all build methods
+
+ llvm/clang and gcc doesn't recognize the wmain() function in Unicode
+ Windows builds:
+
+ llvm/clang:
+ ```
+ ../../src/tool_main.c:239:5: warning: no previous prototype for function 'wma
+ in' [-Wmissing-prototypes]
+ int wmain(int argc, wchar_t *argv[])
+ ^
+ 1 warning generated.
+ ```
+
+ gcc:
+ ```
+ ../../src/tool_main.c:239:5: warning: no previous prototype for 'wmain' [-Wmi
+ ssing-prototypes]
+ 239 | int wmain(int argc, wchar_t *argv[])
+ | ^~~~~
+ ```
+
+ Before this patch, we already silenced it with CMake. This patch moves
+ the silencing to the source, so that it applies to all build tools.
+
+ Bug: https://github.com/curl/curl/issues/7229#issuecomment-1464806651
+
+ Reviewed-by: Marcel Raad
+ Closes #10744
+
+Dan Fandrich (10 Mar 2023)
+
+- CI: fix retrying on brew failures
+
+ The previous attempt didn't consider that the shell would exit
+ immediately after the false statement in the retry case.
+
+ Follow-up to dc141a37
+
+Stefan Eissing (10 Mar 2023)
+
+- http2: fix error handling during parallel operations
+
+ RST and connection close were not handled correctly during parallel
+ transfers, leading to aborted response bodies being reported complete.
+
+ Closes #10715
+
+Daniel Stenberg (10 Mar 2023)
+
+- url: only reuse connections with same GSS delegation
+
+ Reported-by: Harry Sintonen
+ Closes #10731
+
+Viktor Szakats (10 Mar 2023)
+
+- lib: silence clang/gcc -Wvla warnings in brotli headers
+
+ brotli v1.0.0 throughout current latest v1.0.9 and latest master [1]
+ trigger this warning.
+
+ It happened with CMake and GNU Make. autotools builds avoid it with
+ the `convert -I options to -isystem` macro.
+
+ llvm/clang:
+ ```
+ In file included from ./curl/lib/content_encoding.c:36:
+ ./brotli/x64-ucrt/usr/include/brotli/decode.h:204:34: warning: variable lengt
+ h array used [-Wvla]
+ const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)],
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ./brotli/x64-ucrt/usr/include/brotli/port.h:253:34: note: expanded from macro
+ 'BROTLI_ARRAY_PARAM'
+ ^~~~~~
+ In file included from ./curl/lib/content_encoding.c:36:
+ ./brotli/x64-ucrt/usr/include/brotli/decode.h:206:48: warning: variable lengt
+ h array used [-Wvla]
+ uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]);
+ ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~
+ ./brotli/x64-ucrt/usr/include/brotli/port.h:253:35: note: expanded from macro
+ 'BROTLI_ARRAY_PARAM'
+ ~^~~~~
+ ```
+
+ gcc:
+ ```
+ In file included from ./curl/lib/content_encoding.c:36:
+ ./brotli/x64-ucrt/usr/include/brotli/decode.h:204:5: warning: ISO C90 forbids
+ variable length array 'encoded_buffer' [-Wvla]
+ 204 | const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)],
+ | ^~~~~
+ ./brotli/x64-ucrt/usr/include/brotli/decode.h:206:5: warning: ISO C90 forbids
+ variable length array 'decoded_buffer' [-Wvla]
+ 206 | uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]);
+ | ^~~~~~~
+ ```
+
+ [1] https://github.com/google/brotli/commit/ed1995b6bda19244070ab5d331111f16f
+ 67c8054
+
+ Reviewed-by: Daniel Stenberg
+ Reviewed-by: Marcel Raad
+ Closes #10738
+
+Daniel Stenberg (10 Mar 2023)
+
+- curl_path: create the new path with dynbuf
+
+ Closes #10729
+
+- url: remove dummy protocol handler
+
+ Just two added checks were needed saves a whole handler struct.
+
+ Closes #10727
+
+Dan Fandrich (10 Mar 2023)
+
+- CI: retry a failed brew update too, not just brew install
+
+ Also, make sure an eventual failure ends up returning a failure code so
+ the job stops.
+
+Daniel Stenberg (10 Mar 2023)
+
+- url: fix the SSH connection reuse check
+
+ Reported-by: Harry Sintonen
+ Closes #10735
+
+- CURLOPT_PROXY.3: curl+NSS does not handle HTTPS over unix domain socket
+
+ It results in error "NSS error -5985 (PR_ADDRESS_NOT_SUPPORTED_ERROR)"
+
+ Disabled test 1470 for NSS builds and documented the restriction.
+
+ Reported-by: Dan Fandrich
+ Fixes #10723
+ Closes #10734
+
+- CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
+
+ Reported-by: Hiroki Kurosawa
+ Closes #10732
+
+- telnet: only accept option arguments in ascii
+
+ To avoid embedded telnet negotiation commands etc.
+
+ Reported-by: Harry Sintonen
+ Closes #10728
+
+- test1903: test use of COOKIEFILE - reset - COOKIEFILE
+
+ This also tests for the memory leak bug fixed by parent commit b559ef6f.
+
+ Ref: #10694
+
+ Closes https://github.com/curl/curl/pull/10712
+
+Jay Satiro (10 Mar 2023)
+
+- url: fix cookielist memleak when curl_easy_reset
+
+ - Free set.cookelist in Curl_freeset instead of Curl_close.
+
+ Prior to this change the cookielist linked list wasn't freed by
+ curl_easy_reset which calls Curl_freeset to free all set.
+
+ Bug: https://github.com/curl/curl/issues/10694#issuecomment-1458619157
+ Reported-by: Sergey Ryabinin
+
+ Closes https://github.com/curl/curl/pull/10709
+
+Dan Fandrich (10 Mar 2023)
+
+- tests: fix some keywords and unused sections
+
+- tests: fix test1301 to call the right binary
+
+ It was refactored in commit 480ac6e5 but this step was missed.
+
+- tests: add timeout, SLOWDOWN and DELAY keywords to tests
+
+ These are tests that are testing timing and end up being quite slow.
+
+Daniel Stenberg (10 Mar 2023)
+
+- RELEASE-NOTES: synced
+
+Stefan Eissing (10 Mar 2023)
+
+- wolfSSL: ressurect the BIO `io_result`
+
+ In pytest'ing the situation occored that wolfSSL reported an
+ IO error when the underlying BIO operation was returning an
+ CURLE_AGAIN condition.
+
+ Readding the `io_result` filter context member to detect such
+ situations.
+
+ Also, making sure that the returned CURLcode is initialized
+ on all recv operations outcome.
+
+ Closes #10716
+
+- gssapi: align global `gss_OID_desc` vars to silence ld warnings on macOS vent
+ ura
+
+ Refs #9975 which first reported this.
+
+ Closes #10718
+
+Daniel Stenberg (10 Mar 2023)
+
+- libssh2: only set the memory callbacks when debugging
+
+ This makes us debug libssh2 less and libcurl more when for example
+ running torture tests that otherwise will spend a lot of time in libssh2
+ functions.
+
+ We leave libssh2 to test libssh2.
+
+ Closes #10721
+
+- docs/SECURITY-PROCESS.md: updates
+
+ - allow Low+Medium issues to be managed through plain PRs
+ - update the bug-bounty part to reflect current reality
+
+ Closes #10719
+
+Dan Fandrich (9 Mar 2023)
+
+- tests: fix tag markup issues in some tests
+
+Marcel Raad (9 Mar 2023)
+
+- tests: add `cookies` features
+
+ These tests don't work with `--disable-cookies`.
+
+ Closes https://github.com/curl/curl/pull/10713
+
+- test420: add cookies keyword
+
+ It fails with `--disable-cookies`.
+
+ Closes https://github.com/curl/curl/pull/10713
+
+Dan Fandrich (8 Mar 2023)
+
+- CI: Add more labeler match patterns
+
+ Also, add the CI, tests or libcurl API tags in conjunction with any
+ others that might also apply.
+
+Andy Alt (9 Mar 2023)
+
+- GHA: minor improvements to spellcheck
+
+ Closes #10640
+
+Daniel Stenberg (9 Mar 2023)
+
+- test1671: fix after fix
+
+- test421: -w %{header_json} test with multiple same header names
+
+ To reproduce the issue in #10704
+
+- tool_writeout_json. fix the output for duplicate header names
+
+ Header entries with index != 0 are handled at the index 0 level so they
+ should then be skipped when iterated over.
+
+ Reported-by: Boris Okunskiy
+ Fixes #10704
+ Closes #10707
+
+- headers: make curl_easy_header and nextheader return different buffers
+
+ By letting curl_easy_header() and curl_easy_nextheader() store the
+ header data in their own struct storage when they return a pointer to
+ it, it makes it possible for applications to use them both in a loop.
+ Like the curl tool does.
+
+ Reported-by: Boris Okunskiy
+ Fixes #10704
+ Closes #10707
+
+rcombs (8 Mar 2023)
+
+- urlapi: take const args in _dup and _get functions
+
+ Closes #10708
+
+- urlapi: avoid mutating internals in getter routine
+
+ This was not intended.
+
+ Closes #10708
+
+Daniel Stenberg (8 Mar 2023)
+
+- urlapi: '%' is illegal in host names
+
+ Update test 1560 to verify
+
+ Ref: #10708
+ Closes #10711
+
+- ftp: make the 'ftpauth' a more normal 'char *'-array
+
+ Closes #10703
+
+Evgeny Grin (Karlson2k) (8 Mar 2023)
+
+- doc: fix compiler warning in libcurl.m4
+
+ Current test for curl_free() may produce warnings with strict compiler
+ flags or even with default compiler flags with upcoming versions.
+ These warning could turned into errors by -Werror or similar flags.
+ Such warnings/errors are avoided by this patch.
+
+ Closes #10710
+
+Viktor Szakats (8 Mar 2023)
+
+- misc: fix typos
+
+ Closes #10706
+
+Stefan Eissing (7 Mar 2023)
+
+- ftp: active mode with SSL, add the damn filter
+
+ - since 7.87.0 we lost adding the SSL filter for an active
+ FTP connection that uses SSL. This leads to hangers and timeouts
+ as reported in #10666.
+
+ Reported-by: SandakovMM on github
+ Fixes #10666
+ Closes #10669
+
+Daniel Stenberg (7 Mar 2023)
+
+- docs: extend the URL API descriptions
+
+ Closes #10701
+
+Stefan Eissing (7 Mar 2023)
+
+- url: fix logic in connection reuse to deny reuse on "unclean" connections
+
+ - add parameter to `conn_is_alive()` cfilter method that returns
+ if there is input data waiting on the connection
+ - refrain from re-using connnection from the cache that have
+ input pending
+ - adapt http/2 and http/3 alive checks to digest pending input
+ to check the connection state
+ - remove check_cxn method from openssl as that was just doing
+ what the socket filter now does.
+ - add tests for connection reuse with special server configs
+
+ Closes #10690
+
+Daniel Stenberg (6 Mar 2023)
+
+- x509asn1: use plain %x, not %lx, when the arg is an int
+
+ Pointed out by Coverity.
+
+ Closes #10689
+
+Stefan Eissing (6 Mar 2023)
+
+- http2: fix handling of RST and GOAWAY to recognize partial transfers
+
+ - a reset transfer (HTTP/2 RST) did not always lead to the proper
+ error message on receiving its response, leading to wrong reports
+ of a successful transfer
+ - test_05_02 was able to trigger this condition with increased transfer
+ count. The simulated response errors did not carry a 'Content-Length'
+ so only proper RST handling could detect the abort
+ - When doing such transfers in parallel, a connection could enter the
+ state where
+ a) it had been closed (GOAWAY received)
+ b) the RST had not been "seen" for the transfer yet
+ or c) the GOAWAY announced an error and the last successful
+ stream id was not checked against ongoing transfers
+
+ Closes #10693
+
+- tests: use dynamic ports numbers in pytest suite
+
+ - necessary ports are bound at start of test suite and then
+ given to server fixtures for use.
+ - this make parallel use of pytest (in separate directories),
+ practically safe for use as OS tend to not reuse such port numbers
+ for a while
+
+ Closes #10692
+
+- connect: fix time_connect and time_appconnect timer statistics
+
+ - time_connect was not updated when the overall connection failed,
+ e.g. when SSL verification was unsuccessful, refs #10670
+ - rework gather those values to interrogate involved filters,
+ also from all eyeballing attempts, to report the maximum of
+ those values.
+ - added 3 test cases in test_06 to check reported values on
+ successful, partially failed and totally failed connections.
+
+ Reported-by: Master Inspire
+ Fixes #10670
+ Closes #10671
+
+Daniel Stenberg (6 Mar 2023)
+
+- test1905: update output cookie order
+
+ After the #10685 update
+
+- test420: verify expiring cookies
+
+ Cookies that are loaded fine from a jar but then are expired in headers.
+
+- cookie: don't load cookies again when flushing
+
+ Reported-by: Sergio Mijatovic
+ Fixes #10677
+ Closes #10685
+
+- RELEASE-NOTES: synced
+
+Andy Alt (6 Mar 2023)
+
+- docs: note '--data-urlencode' option
+
+ Closes #10687
+
+Daniel Stenberg (6 Mar 2023)
+
+- DEPRECATE: the original legacy mingw version 1
+
+ Remove completely in September 2023
+
+ Closes #10667
+
+Harry Sintonen (6 Mar 2023)
+
+- rand: use arc4random as fallback when available
+
+ Normally curl uses cryptographically strong random provided by the
+ selected SSL backend. If compiled without SSL support, a naive built-in
+ function was used instead.
+
+ Generally this was okay, but it will result in some downsides for non-
+ SSL builds, such as predictable temporary file names.
+
+ This change ensures that arc4random will be used instead, if available.
+
+ Closes #10672
+
+Grisha Levit (6 Mar 2023)
+
+- tool: dump headers even if file is write-only
+
+ The fixes in #10079 brought a (seemingly unrelated) change of open mode
+ from `wb`/`ab` to `wb+`/`ab+` for the headerfile. This makes it no
+ longer possible to write the header file to e.g. a pipe, like:
+
+ curl -D >(grep ...) file:///dev/null
+
+ Which presently results in `Warning: Failed to open /dev/fd/63`
+
+ See #10079
+ Closes #10675
+
+Jay Satiro (6 Mar 2023)
+
+- tests: fix gnutls-serv check
+
+ - If gnutls-serv doesn't exist then don't try to execute it.
+
+ Follow-up to 2fdc1d81.
+
+ Closes https://github.com/curl/curl/pull/10688
+
+Daniel Stenberg (6 Mar 2023)
+
+- lib1560: fix enumerated type mixed with another type
+
+ Follow-up to c84c0f9aa3bb006
+
+ Closes #10684
+
+Viktor Szakats (5 Mar 2023)
+
+- cmake: fix enabling LDAPS on Windows
+
+ Before this patch, enabling LDAPS required a manual C flag:
+ https://github.com/curl/curl-for-win/blob/c1cfc31cfc04f24f7a4f946564d6f0e1b4d
+ 7dd36/curl-cmake.sh#L105
+
+ Fix this and enable LDAPS automatically when using `wldap32` (and
+ when not explicitly disabled). This matches autotools and `Makefile.mk`
+ behavior. Also remove issue from KNOWN_BUGS.
+
+ Add workaround for MSVS 2010 warning triggered by LDAPS now enabled
+ in more CI tests:
+ `ldap.c(360): warning C4306: 'type cast' : conversion from 'int' to 'void *'
+ of greater size`
+ Ref: https://ci.appveyor.com/project/curlorg/curl/builds/46408284/job/v8mwl9y
+ fbmoeqwlr#L312
+
+ Reported-by: JackBoosY on github
+ Reviewed-by: Jay Satiro
+ Reviewed-by: Marcel Raad
+ Fixes #6284
+ Closes #10674
+
+- Makefile.mk: delete redundant `HAVE_LDAP_SSL` macro [ci skip]
+
+ Since abebb2b8939c6b3e0f951eb2d9ec3729b569aa2c, we set this macro for
+ all Windows `wldap32` builds using `Makefile.mk`.
+
+ For OpenLDAP builds this macro is not enough to enable LDAPS, and
+ OpenLDAP is not an option in `Makefile.mk`. For Novell LDAP it might
+ have helped, but it's also not an option anymore in `Makefile.mk`.
+
+ The future for LDAPS is that we should enable it by default without
+ extra build knobs.
+
+ Reviewed-by: Marcel Raad
+ Closes #10681
+
+- cmake: skip CA-path/bundle auto-detection in cross-builds
+
+ Also remove issue from KNOWN_BUGS.
+
+ Reported-by: Cristian Morales Vega
+ Reviewed-by: Marcel Raad
+ Fixes #6178
+ Closes #10676
+
+Daniel Stenberg (3 Mar 2023)
+
+- schannel: loop over the algos to pick the selected one
+
+ Avoid using the funny macro and the extra buffer copy.
+
+ Closes #10647
+
+- wildcard: remove files and move functions into ftplistparser.c
+
+- ftp: allocate the wildcard struct on demand
+
+ The feature is rarely used so this frees up data for the vast majority
+ of easy handles that don't use it.
+
+ Rename "protdata" to "ftpwc" since it is always an FTP wildcard struct
+ pointer. Made the state struct field an unsigned char to save space.
+
+ Closes #10639
+
+- lib1560: test parsing URLs with ridiculously large fields
+
+ In the order of 120K.
+
+ Closes #10665
+
+Brad Spencer (3 Mar 2023)
+
+- urlapi: parse IPv6 literals without ENABLE_IPV6
+
+ This makes the URL parser API stable and working the same way
+ independently of libcurl supporting IPv6 transfers or not.
+
+ Closes #10660
+
+Jan Engelhardt (3 Mar 2023)
+
+- build: drop the use of XC_AMEND_DISTCLEAN
+
+ Because automake used to delete depdirs at once (.deps) and there was an issu
+ e
+ with portability, curl's XC_AMEND_DISTCLEAN greps the Makefiles in an attempt
+ to build a list of all depfiles and delete them individually instead.
+
+ Since commit 08849db866b44510f6b8fd49e313c91a43a3dfd3, automake switched from
+ deleting directories to individual files. curl's custom logic now finds a lot
+ more results with the grep (the filtering of these results isn't great), whic
+ h
+ causes a massive bloating of the Makefile in the order of O(n^2).
+
+ Also remove now-unused XC_AMEND_DISTCLEAN macro group
+
+ References: https://github.com/curl/curl/issues/9843
+ References: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59288
+
+ Reported-by: Ilmari Lauhakangas
+ Fixes #9843
+ Closes #10661
+
+Balakrishnan Balasubramanian (3 Mar 2023)
+
+- test1470: test socks proxy using unix sockets and connect to https
+
+ Similar to test1468 except using https instead of http
+
+ Closes #10662
+
+Daniel Stenberg (3 Mar 2023)
+
+- test1960: verify CURL_SOCKOPT_ALREADY_CONNECTED
+
+ When returned from the CURLOPT_SOCKOPTFUNCTION, like when we have a
+ custom socket connected in the app, passed in to libcurl.
+
+ Verifies the fix in #10648
+
+ Closes #10651
+
+Stefan Eissing (2 Mar 2023)
+
+- tests: rename tests/tests-httpd to tests/http
+
+ - httpd is only one server we test with
+ - the suite coveres the HTTP protocol in general where
+ the default test cases need a more beefy environment
+
+ Closes #10654
+
+- socket: detect "dead" connections better, e.g. not fit for reuse
+
+ - refs #10646 where reuse was attempted on closed connections in the
+ cache, leading to an exhaustion of retries on a transfer
+ - the mistake was that poll events like POLLHUP, POLLERR, etc
+ were regarded as "not dead".
+ - change cf-socket filter check to regard such events as inidication
+ of corpsiness.
+ - vtls filter checks: fixed interpretation of backend check result
+ when inconclusive to interrogate status further down the filter
+ chain.
+
+ Reported-by: SendSonS on github
+ Fixes #10646
+ Closes #10652
+
+- lib: give source files cf-http.* better fitting names
+
+ Closes #10656
+
+- http2: fix code indent
+
+ Closes https://github.com/curl/curl/pull/10655
+
+Shankar Jadhavar (1 Mar 2023)
+
+- cf-socket: if socket is already connected, return CURLE_OK
+
+ In 7.87.0, if callback method for CURLOPT_SOCKOPTFUNCTION returns
+ CURL_SOCKOPT_ALREADY_CONNECTED then curl library used to return
+ CURLE_OK. n 7.88.0, now even if callback returns
+ CURL_SOCKOPT_ALREADY_CONNECTED, curl library still tries to connect to
+ socket by invoking method do_connect().
+
+ This is regression caused by commit
+ https://github.com/curl/curl/commit/71b7e0161032927cdfb
+
+ Fix: Check if we are already connected and return CURLE_OK.
+
+ Fixes #10626
+ Closes #10648
+
+Jay Satiro (1 Mar 2023)
+
+- DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
+
+ This is the existing behavior and it has been widely assumed in the
+ codebase.
+
+ Closes https://github.com/curl/curl/pull/10645
+
+Stefan Eissing (1 Mar 2023)
+
+- http2: fix upload busy loop
+
+ - Set KEEP_SEND_PAUSE when exhausting remote HTTP/2 window size of a
+ stream.
+
+ - Clear KEEP_SEND_PAUSE when receiving HTTP/2 window updates on a paused
+ stream.
+
+ - Also fix http2 send compiler warnings reported in #10449.
+
+ Prior to this change, starting in 71b7e016 which precedes 7.88.0,
+ libcurl may eat CPU during HTTP/2 upload.
+
+ Reported-by: Jay Satiro
+
+ Fixes https://github.com/curl/curl/issues/10449
+ Fixes https://github.com/curl/curl/issues/10618
+ Closes https://github.com/curl/curl/pull/10627
+
+Daniel Stenberg (1 Mar 2023)
+
+- sectransp: make read_cert() use a dynbuf when loading
+
+ Closes #10632
+
+Jay Satiro (1 Mar 2023)
+
+- transfer: limit Windows SO_SNDBUF updates to once a second
+
+ - Change readwrite_upload() to call win_update_buffer_size() no more
+ than once a second to update SO_SNDBUF (send buffer limit).
+
+ Prior to this change during an upload readwrite_upload() could call
+ win_update_buffer_size() anywhere from hundreds of times per second to
+ an extreme test case of 100k per second (which is likely due to a bug,
+ see #10618). In the latter case WPA profiler showed
+ win_update_buffer_size was the highest capture count in
+ readwrite_upload. In any case the calls were excessive and unnecessary.
+
+ Ref: https://github.com/curl/curl/pull/2762
+
+ Closes https://github.com/curl/curl/pull/10611
+
+Daniel Stenberg (28 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+Stefan Eissing (28 Feb 2023)
+
+- http2: fix for http2-prior-knowledge when reusing connections
+
+ - refs #10634 where errors in the HTTP/2 framing layer are observed.
+ - the bug was that on connection reuse, the code attempted to switch
+ in yet another layer of HTTP/2 handling instead of detecting that
+ this was already in place.
+ - added pytest testcase reproducing the issue.
+
+ Reported-by: rwmjones on github
+ Fixes #10634
+ Closes #10643
+
+- cf-socket: fix handling of remote addr for accepted tcp sockets
+
+ - do not try to determine the remote address of a listen socket. There
+ is none.
+ - Update remote address of an accepted socket by getpeername() if
+ available.
+
+ Reported-by: Harry Sintonen
+ Fixes #10622
+ Closes #10642
+
+- http: fix unix domain socket use in https connects
+
+ - when h2/h3 eyeballing was involved, unix domain socket
+ configurations were not honoured
+ - configuring --unix-socket will disable HTTP/3 as candidate for eyeballing
+ - combinatino of --unix-socket and --http3-only will fail during initialisati
+ on
+ - adding pytest test_11 to reproduce
+
+ Reported-by: Jelle van der Waa
+ Fixes #10633
+ Closes #10641
+
+Daniel Stenberg (28 Feb 2023)
+
+- setopt: move the CURLOPT_CHUNK_DATA pointer to the set struct
+
+ To make duphandle work etc
+
+ Closes #10635
+
+Viktor Szakats (28 Feb 2023)
+
+- quic/schannel: fix compiler warnings
+
+ Fixes #10603
+ Closes #10616
+
+Daniel Stenberg (28 Feb 2023)
+
+- page-footer: add explanation for three missing exit codes
+
+ Added in 7.73.0, 7.77.0 and 7.84.0
+
+ Closes #10630
+
+積丹尼 Dan Jacobson (28 Feb 2023)
+
+- rate.c: single URLs make no sense in --rate example
+
+ Here somehow you need to put more than one URL in these examples, else
+ they will make no sense, as --rate only affects the second and beyond
+ URLs. The first URL will always finish the same time no matter what
+ --rate is given.
+
+ Closes #10638
+
+Daniel Stenberg (28 Feb 2023)
+
+- libcurl-errors.3: add the CURLHcode errors from curl_easy_header.3
+
+ Closes #10629
+
+- mqtt: on send error, return error
+
+ Reported-by: Maciej Domanski
+
+ Closes #10623
+
+- ws: keep the socket non-blocking
+
+ Reported-by: marski on github
+ Fixes #10615
+ Closes #10625
+
+- hostip: avoid sscanf and extra buffer copies
+
+ Also made create_hostcache_id() return the id length.
+
+ Closes #10601
+
+- PARALLEL-TRANSFERS.md: not "early days" for this anymore
+
+ Refresh the language as the support is now over three years old
+
+ Closes #10624
+
+- easy: remove infof() debug leftover from curl_easy_recv
+
+ It said "reached [path]/easy.c:1231"
+
+ Closes #10628
+
+- idn: return error if the conversion ends up with a blank host
+
+ Some IDN sequences are converted into "" (nothing), which can make this
+ function end up with a zero length host name and we cannot consider that
+ a valid host to continue with.
+
+ Reported-by: Maciej Domanski
+ Closes #10617
+
+- examples/http3.c: use CURL_HTTP_VERSION_3
+
+ and update the comment
+
+ Closes #10619
+
+- x509asn1.c: use correct format specifier for infof() call
+
+ Detected by Coverity
+
+ Closes #10614
+
+- Revert "GHA: add Microsoft C++ Code Analysis"
+
+ This reverts commit e0db842b2a082dffad4a9fbe31321e9a75c74041.
+
+ This tool seems very restricted in how often it might be used by a
+ project and thus very quickly start to report fails simply because it
+ refuses to run when "there are more runs than allowed".
+
+ Closes #10613
+
+Patrick Monnerat (25 Feb 2023)
+
+- tests: test secure mail protocols with explicit SSL requests
+
+ New tests 987, 988 and 989, disabled for rustls (hanging).
+
+ Closes #10077
+
+- tests: support for imaps/pop3s/smtps protocols
+
+ Closes #10077
+
+- runtests: use a hash table for server port numbers
+
+ Closes #10077
+
+Andy Alt (25 Feb 2023)
+
+- INTERNALS.md: grammar
+
+ Closes #10607
+
+Daniel Stenberg (25 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+Philip Heiduck (25 Feb 2023)
+
+- .cirrus.yml: Bump to FreeBSD 13.2
+
+ Closes #10270
+
+- ngtcp2-gnutls.yml: bump to gnutls 3.8.0
+
+ Closes #10507
+
+- CI: update ngtcp2 and nghttp2 for pytest
+
+ Follow-up: https://github.com/curl/curl/commit/5c9ee8cef4b351a085b440f8178500
+ 124647f8e6
+
+ Closes #10508
+
+Andy Alt (25 Feb 2023)
+
+- GHA: use same flags for Slackbuild as Slack package
+
+ Closes #10526
+
+Daniel Stenberg (24 Feb 2023)
+
+- rtsp: avoid sscanf for parsing
+
+ Closes #10605
+
+- http_proxy: parse the status line without sscanf
+
+ Closes #10602
+
+- telnet: error correctly for WS set to "x[num]"
+
+ Follow-up to e4f93be9d587
+ Reported-by: Harry Sintonen
+ Closes #10606
+
+- krb5: avoid sscanf for parsing
+
+ Closes #10599
+
+- misc: remove support for curl_off_t < 8 bytes
+
+ Closes #10597
+
+- telnet: parse NEW_ENVIRON without sscanf
+
+ Closes #10596
+
+- telnet: parse the WS= argument without sscanf
+
+ Closes #10596
+
+- telnet: parse telnet options without sscanf
+
+ Closes #10596
+
+- ftp: replace sscanf for MDTM 213 response parsing
+
+ Closes #10590
+
+- ftp: replace sscanf for PASV parsing
+
+ Closes #10590
+
+- ftp: make the EPSV response parser not use sscanf
+
+ Closes #10590
+
+Stefan Eissing (24 Feb 2023)
+
+- ngtcp2: fix unwanted close of file descriptor 0
+
+ ... causing macOS to hand out 0 as next socket handle and failing on
+ further operations.
+
+ Reported-by: Sergey Fionov
+ Fixes #10593
+ Closes #10595
+
+Daniel Stenberg (23 Feb 2023)
+
+- select: stop treating POLLRDBAND as an error
+
+ POLLRDBAND does not seem to be an general error and on Windows the value
+ for POLLIN is 768 and the value for POLLRDBAND is 512.
+
+ Fixes #10501
+ Reported-by: opensslonzos-github on github
+ Closes #10592
+
+- test978: mark file as text mode
+
+ Follow-up to 4ea5702980cb
+
+ To fix test failures on Windows
+
+ Closes #10594
+
+- http: rewrite the status line parser without sscanf
+
+ Closes #10585
+
+- test978: verify that --stderr works for -w's stderr as well
+
+Jay Satiro (23 Feb 2023)
+
+- curl: make -w's %{stderr} use the file set with --stderr
+
+ Reported-by: u20221022 on github
+ Fixes #10491
+ Closes #10569
+
+- winbuild: fix makefile clean
+
+ - Fix and move 'clean' code that removes the output and obj directories
+ trees from MakefileBuild.vc to Makefile.vc.
+
+ Prior to this change the 'clean' code did not work right because the
+ variables containing the directory names were not fully initialized and
+ the rmdir syntax was sometimes incorrect (typos). DIRDIST for example
+ was set to ..\builds\ and not ..\builds\$(CONFIG_NAME_LIB)\ so it would
+ remove the former and not the latter. If WITH_PREFIX was set then that
+ directory was removed instead.
+
+ Also, DIRDIST (the output directory) even if initialized should not be
+ removed by MakefileBuild.vc because by that time it could be set to a
+ user directory that may contain other files if WITH_PREFIX is set (eg we
+ don't want rmdir /s /q C:\usr\local). Therefore we remove from
+ Makefile.vc before any of that happens. I added a comment in both
+ makefiles explaining this.
+
+ Closes https://github.com/curl/curl/pull/10576
+
+- sectransp: fix compiler warning c89 mixed code/declaration
+
+ Since cbf57176 the Cirrus CI 'macOS arm64 SecureTransport http2' has
+ been failing due to c89 warnings mixed code/declaration. That commit is
+ not the cause so I assume something has changed in the CI outside of our
+ configuration. Anyway, we don't mix code/declaration so this is the fix
+ for that.
+
+ Closes https://github.com/curl/curl/pull/10574
+
+Philipp Engel (22 Feb 2023)
+
+- BINDINGS: add Fortran binding
+
+ Closes #10589
+
+Stefan Eissing (22 Feb 2023)
+
+- test2600: detect when ALARM_TIMEOUT is in use and adjust
+
+ - use higher timeout values > 1s
+ - skip duration checks
+
+ Assisted-by: Marcel Raad
+ Closes #10513
+
+Daniel Stenberg (22 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+- test686: verify return code for no URL after --next
+
+- tool_operate: propagate error codes for missing URL after --next
+
+ Fixes #10558
+ Reported-by: u20221022 on github
+ Closes #10580
+
+- test1278: verify that an extra --no-remote-name cause no warning
+
+- tool_getparam: don't add a new node for just --no-remote-name
+
+ Unless --remote-name-all is used.
+
+ Fixes #10564
+ Reported-by: u20221022 on github
+ Closes #10582
+
+- gen.pl: add '%GLOBALS' as a variable for mainpage
+
+ And use it in page-header to list all global command line options.
+
+- docs/cmdline-opts: mark all global options
+
+ gen.pl now outputs a generic explanations for them for each option
+
+ Fixes #10566
+ Reported-by: u20221022 on github
+ Closes #10584
+
+- GHA: add Microsoft C++ Code Analysis
+
+ Closes #10583
+
+- tool_progress: shut off progress meter for --silent in parallel
+
+ Reported-by: finkjsc on github
+ Fixes #10573
+ Closes #10579
+
+- lib1560: add a test using %25 in the userinfo in a URL
+
+ Closes #10578
+
+Stefan Eissing (21 Feb 2023)
+
+- CURLOPT_PIPEWAIT: allow waited reuse also for subsequent connections
+
+ As tested in test_02_07, when firing off 200 urls with --parallel, 199
+ wait for the first connection to be established. if that is multiuse,
+ urls are added up to its capacity.
+
+ The first url over capacity opens another connection. But subsequent
+ urls found the same situation and open a connection too. They should
+ have waited for the second connection to actually connect and make its
+ capacity known.
+
+ This change fixes that by
+
+ - setting `connkeep()` early in the HTTP setup handler. as otherwise
+ a new connection is marked as closeit by default and not considered
+ for multiuse at all
+ - checking the "connected" status for a candidate always and continuing
+ to PIPEWAIT if no alternative is found.
+
+ pytest:
+ - removed "skip" from test_02_07
+ - added test_02_07b to check that http/1.1 continues to work as before
+
+ Closes #10456
+
+Daniel Stenberg (21 Feb 2023)
+
+- test419: verify --dump-header to file that cannot be created
+
+ Closes #10571
+
+- tool_operate: avoid fclose(NULL) on bad header dump file
+
+ Fixes #10570
+ Reported-by: Jérémy Rabasco
+ Closes #10571
+
+- RELEASE-NOTES: synced
+
+ Starting the journey towards 8.0.0
+
+- cookie: parse without sscanf()
+
+ Saves us from using 2*4096 bytes buffers on stack, the extra copies and
+ more.
+
+ Closes #10550
+
+- lib517: verify time stamps without leading zeroes plus some more
+
+- parsedate: replace sscanf( for time stamp parsing
+
+ Closes #10547
+
+- parsedate: parse strings without using sscanf()
+
+ - sscanf is slow and complex, avoid it
+ - give up already if the string is 12 bytes or longer as no valid string
+ can be that long
+ - this can now be done without copy
+
+ Closes #10547
+
+Matt Jolly (20 Feb 2023)
+
+- tests: HTTP server fixups
+
+ - httpserver.pl -> http-server.pl for consistency
+ - add http3-server.pl to EXTRA_DIST; alphabetise for maintainability
+ - nghttpx proxy invocation scripts should not use getcwd
+
+ Closes #10568
+
+Version 7.88.1 (20 Feb 2023)
+
+Daniel Stenberg (20 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+ 7.88.1 release
+
+- THANKS: add contributors from 7.88.1
+
+- socketpair: allow EWOULDBLOCK when reading the pair check bytes
+
+ Reported-by: Gunamoi Software
+ Co-authored-by: Jay Satiro
+ Fixes #10561
+ Closes #10562
+
+Jay Satiro (18 Feb 2023)
+
+- tool_operate: fix scanbuild compiler warning
+
+ Prior to this change Azure CI scanbuild warned of a potential NULL
+ pointer string passed to strtol when CURLDEBUG enabled, even though the
+ way the code was written it wouldn't have happened.
+
+ Bug: https://github.com/curl/curl/commit/5479d991#r101159711
+ Reported-by: Marcel Raad
+
+ Closes https://github.com/curl/curl/pull/10559
+
+- curl_setup: Suppress OpenSSL 3 deprecation warnings
+
+ - Define OPENSSL_SUPPRESS_DEPRECATED.
+
+ OpenSSL 3 has deprecated some of the functions libcurl uses such as
+ those with DES, MD5 and ENGINE prefix. We don't have replacements for
+ those functions so the warnings were disabled in autotools and cmake
+ builds, but still showed in other builds.
+
+ Closes https://github.com/curl/curl/pull/10543
+
+- build-openssl.bat: keep OpenSSL 3 engine binaries
+
+ Prior to this change copying the OpenSSL 3 engine binaries failed
+ because 'engines-1_1' (OpenSSL 1.1.x folder name) was erroneously used
+ instead of 'engines-3'. The OpenSSL 3 builds would complete successfully
+ but without the engine binaries.
+
+ Closes https://github.com/curl/curl/pull/10542
+
+ALittleDruid (18 Feb 2023)
+
+- cmake: fix Windows check for CryptAcquireContext
+
+ Check for CryptAcquireContext in windows.h and wincrypt.h only, since
+ otherwise this check may fail due to third party headers not found.
+
+ Closes https://github.com/curl/curl/pull/10353
+
+Daniel Stenberg (19 Feb 2023)
+
+- remote-header-name.d: mention that filename* is not supported
+
+ and that you can use --clobber to allow overwriting.
+
+ Ref: #10533
+ Closes #10555
+
+ Co-authored-by: Jay Satiro
+
+Pierrick Charron (18 Feb 2023)
+
+- CURLOPT_WS_OPTIONS.3: fix the availability version
+
+ Closes #10557
+
+Jacob Hoffman-Andrews (18 Feb 2023)
+
+- GHA: update rustls dependency to 0.9.2
+
+ This allows re-enabling test 312 for the rustls backend.
+
+ Closes #10553
+
+Philip Heiduck (18 Feb 2023)
+
+- HTTP3.md: update git branches
+
+ Closes #10554
+
+Stefan Eissing (17 Feb 2023)
+
+- urldata: remove `now` from struct SingleRequest - not needed
+
+ Closes #10549
+
+Daniel Stenberg (17 Feb 2023)
+
+- lib1560: add IPv6 canonicalization tests
+
+ Closes #10552
+
+- RELEASE-NOTES: synced
+
+- urlapi: do the port number extraction without using sscanf()
+
+ - sscanf() is rather complex and slow, strchr() much simpler
+
+ - the port number function does not need to fully verify the IPv6 address
+ anyway as it is done later in the hostname_check() function and doing
+ it twice is unnecessary.
+
+ Closes #10541
+
+Stefan Eissing (17 Feb 2023)
+
+- setopt: allow HTTP3 when HTTP2 is not defined
+
+ Reported-by: Karthikdasari0423 on github
+ Fixes #10538
+ Closes #10544
+
+Jon Rumsey (17 Feb 2023)
+
+- os400: correct Curl_os400_sendto()
+
+ Add const qualifier to 5th argument of Curl_os400_sendto()
+
+ Make OS400 wrapper for sendto match the normal prototype of sendto()
+ with a const qualifier.
+
+ Fixes #10539
+ Closes #10548
+
+Stefan Eissing (17 Feb 2023)
+
+- tests-httpd: add proxy tests
+
+ for direct and tunneling checks on http: and https:
+
+ Closes #10519
+
+Daniel Stenberg (17 Feb 2023)
+
+- curl: make --silent work stand-alone
+
+ - renamed the struct field to 'silent' to match the cmdline option
+ - make --show-error toggle independently of --silent
+ - make --silent independent of ->noprogress as well
+
+ By doing this, the three options --silent, --no-progress-meter and
+ --show-error should work independently of each other and also work with
+ and without '--no-' prefix as documented.
+
+ Reported-by: u20221022 on github
+ Fixes #10535
+ Closes #10536
+
+- socks: allow using DoH to resolve host names
+
+ For SOCKS modes where a local host resolve is done.
+
+ It was previously disabled in 12d655d4561, but a few local tests seem to
+ indicate that it works fine. Works now because of the SOCKS refactor of
+ 4a4b63daaa01ef59 that made it non-blocking.
+
+ Reported-by: roughtex on github
+ Fixes #10537
+ Closes #10540
+
+Stefan Eissing (17 Feb 2023)
+
+- test: add test for HTTP/2 corruption as reported in #10525
+
+ - adding test_02_20 for reproducing the situation
+ - using recently released mod_h2 Apache module
+ - skipping test if an older version is installed
+ - adding installation of current mod_h2 to github pytest workflow
+
+ This reproduces the error reliable (for me) on the lib/http2.c version
+ of curl 7.88.0. And passes with the recent curl master.
+
+ Closes #10534
+
+Daniel Stenberg (16 Feb 2023)
+
+- tool_operate: allow debug builds to set buffersize
+
+ Using the CURL_BUFFERSIZE environment variable.
+
+ Closes #10532
+
+Stefan Eissing (16 Feb 2023)
+
+- connnect: fix timeout handling to use full duration
+
+ - connect timeout was used at half the configured value, if the
+ destination had 1 ip version 4 and other version 6 addresses
+ (or the other way around)
+ - extended test2600 to reproduce these cases
+
+ Reported-by: Michael Kaufmann
+ Fixes #10514
+ Closes #10517
+
+Daniel Stenberg (16 Feb 2023)
+
+- tool_getparam: make --get a true boolean
+
+ To match how it is documented in the man page.
+
+ Fixes #10527
+ Reported-by: u20221022 on github
+ Closes #10531
+
+Harry Sintonen (16 Feb 2023)
+
+- http:: include stdint.h more readily
+
+ Closes #10516
+
+Stefan Eissing (16 Feb 2023)
+
+- tests: make the telnet server shut down a socket gracefully
+
+ - test 1452 failed occasionally with ECONNRESET errnos in curl when the
+ server closed the connection in an unclean state.
+
+ Closes #10509
+
+Harry Sintonen (16 Feb 2023)
+
+- http2: set drain on stream end
+
+ Ensure that on_frame_recv() stream end will trigger a read if there is
+ pending data. Without this it could happen that the pending data is
+ never consumed.
+
+ This combined with https://github.com/curl/curl/pull/10529 should fix
+ https://github.com/curl/curl/issues/10525
+
+ Ref: https://github.com/curl/curl/issues/10525
+ Closes #10530
+
+Stefan Eissing (16 Feb 2023)
+
+- http2: buffer/pausedata and output flush fix.
+
+ * do not process pending input data when copying pausedata to the
+ caller
+ * return CURLE_AGAIN if the output buffer could not be completely
+ written out.
+
+ Ref: #10525
+ Closes #10529
+
+Marcel Raad (16 Feb 2023)
+
+- krb5: silence cast-align warning
+
+ Add an intermediate cast to `void *`, as done everywhere else when
+ casting from `sockaddr *` to `sockaddr_in *`.
+
+ Closes https://github.com/curl/curl/pull/10528
+
+Daniel Stenberg (15 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+ bumped to 7.88.1
+
+- tests: make sure gnuserv-tls has SRP support before using it
+
+ Reported-by: fundawang on github
+ Fixes #10522
+ Closes #10524
+
+- runtests: fix "uninitialized value $port"
+
+ by using a more appropriate variable
+
+ Reported-by: fundawang on github
+ Fixes #10518
+ Closes #10520
+
+Version 7.88.0 (15 Feb 2023)
+
+Daniel Stenberg (15 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+ 7.88.0 release
+
+- THANKS: added contributors from 7.88.0
+
+- openssl: rename 'errcode_t' to 'sslerr_t'
+
+ Turns out "/usr/include/et/com_err.h" typedefs this type (without proper
+ variable scoping).
+
+ comerr is the "common error description library" that apparently might be use
+ d
+ by krb5 code, which then makes this header get used in a curl build.
+
+ Reported-by: Bruno Henrique Batista Cruz da Silva
+ Fixed #10502
+ Closes #10500
+
+Dan Fandrich (13 Feb 2023)
+
+- CONTRIBUTE: More formally specify the commit description
+
+ This codifies what people have actually used in git commits over the
+ past 6 years. I've left off some lesser-used headers that appear to
+ duplicate others and tried to describe a consistent use for several
+ others that were used more arbitrarily.
+
+ This makes it easier for new committers to find out the kinds of things
+ we want to acknowledge, makes it easier to perform statistical analysis
+ on commits, and opens the possibility of performing lint checks on
+ descriptions before submission.
+
+ Reviewed-by: Daniel Stenberg
+ Reviewed-by: Jay Satiro
+
+ Closes #10478
+
+Stefan Eissing (13 Feb 2023)
+
+- openssl: test and fix for forward proxy handling (non-tunneling).
+
+ - adding pytest test_10 cases for proxy httpd setup tests
+ - fixing openssl bug in https: proxy hostname verification that
+ used the hostname of the request and not the proxy name.
+
+ Closes #10498
+
+Daniel Stenberg (13 Feb 2023)
+
+- cmdline-opts/Makefile: on error, do not leave a partial
+
+ And support 'make V=1' to show the full command line
+
+ Closes #10497
+
+- curl.1: make help, version and manual sections "custom"
+
+ Instead of using "multi: boolean", as these are slightly special as in
+ they do are not enable/disable ones.
+
+ Fixes #10490
+ Reported-by: u20221022 on github
+ Closes #10497
+
+Stefan Eissing (13 Feb 2023)
+
+- tests: add tests for HTTP/2 and HTTP/3 to verify the header API
+
+ Test 2403 and 2503 check "header_json" output and therefore use of
+ header-api
+
+ Closes #10495
+
+Philip Heiduck (13 Feb 2023)
+
+- CI: update wolfssl / wolfssh to 5.5.4 / 1.4.12
+
+ Closes #10493
+
+Daniel Stenberg (13 Feb 2023)
+
+- KNOW_BUGS: cleanups with some changed to TODOs
+
+ - remove "Excessive HTTP/2 packets with TCP_NODELAY"
+
+ This is not a bug. Rather room for improvement.
+
+ I believe these have been fixed:
+
+ - 17.4 Connection failures with parallel HTTP/2
+ - 17.5 HTTP/2 connections through HTTPS proxy frequently stall
+
+ - remove "FTPS needs session reuse"
+
+ That is still true, but curl should also do session reuse now.
+
+ - remove "ASCII FTP"
+
+ It is documented behavior, and not single user has asked for extended
+ functionality here the last decade or so.
+
+ - remove "Passive transfer tries only one IP address"
+
+ add as a TODO
+
+ - remove "DoH leaks memory after followlocation"
+
+ With a recipe on how to reproduce, this is pointless to keep around
+
+ - remove "DoH does not inherit all transfer options"
+
+ add it as a TODO
+
+ Closes #10487
+
+Tatsuhiro Tsujikawa (13 Feb 2023)
+
+- GHA: bump ngtcp2 workflow dependencies
+
+ Closes #10494
+
+Patrick Monnerat (13 Feb 2023)
+
+- content_encoding: do not reset stage counter for each header
+
+ Test 418 verifies
+
+ Closes #10492
+
+Daniel Stenberg (13 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+Jay Satiro (13 Feb 2023)
+
+- multi: stop sending empty HTTP/3 UDP datagrams on Windows
+
+ - Limit the 0-sized send procedure that is used to reset a SOCKET's
+ FD_WRITE to TCP sockets only.
+
+ Prior to this change the reset was used on UDP sockets as well, but
+ unlike TCP sockets a 0-sized send actually sends out a datagram.
+
+ Assisted-by: Marc Hörsken
+
+ Ref: https://github.com/curl/curl/pull/9203
+
+ Fixes https://github.com/curl/curl/issues/9086
+ Closes https://github.com/curl/curl/pull/10430
+
+Viktor Szakats (12 Feb 2023)
+
+- h3: silence compiler warnings
+
+ Reviewed-by: Daniel Stenberg
+ Fixes #10485
+ Closes #10486
+
+Daniel Stenberg (12 Feb 2023)
+
+- smb: return error on upload without size
+
+ The protocol needs to know the size ahead of time, this is now a known
+ restriction and not a bug.
+
+ Also output a clearer error if the URL path does not contain proper
+ share.
+
+ Ref: #7896
+ Closes #10484
+
+Viktor Szakats (12 Feb 2023)
+
+- windows: always use curl's basename() implementation
+
+ The `basename()` [1][2] implementation provided by mingw-w64 [3] makes
+ assumptions about input encoding and may break with non-ASCII strings.
+
+ `basename()` was auto-detected with CMake, autotools and since
+ 68fa9bf3f5d7b4fcbb57619f70cb4aabb79a51f6 (2022-10-13), also in
+ `Makefile.mk` after syncing its behaviour with the mainline build
+ methods. A similar patch for curl-for-win broke official Windows
+ builds earlier, in release 7.83.1_4 (2022-06-15).
+
+ This patch forces all Windows builds to use curl's internal
+ `basename()` implementation to avoid such problems.
+
+ [1]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/basename.html
+ [2]: https://www.man7.org/linux/man-pages/man3/basename.3.html
+ [3]: https://sourceforge.net/p/mingw-w64/mingw-w64/ci/master/tree/mingw-w64-c
+ rt/misc/basename.c
+
+ Reported-by: UnicornZhang on Github
+ Assisted-by: Cherish98 on Github
+ Reviewed-by: Daniel Stenberg
+
+ Fixes #10261
+ Closes #10475
+
+Philip Heiduck (12 Feb 2023)
+
+- Linux CI: Bump rustls-ffi to v0.9.1
+
+ Closes #10476
+
+Daniel Stenberg (12 Feb 2023)
+
+- libtest: build lib2305 with multibyte as well
+
+ Fixes a build regression.
+
+ Follow-up to 5a9a04d5567
+ Reported-by: Viktor Szakats
+ Ref: https://github.com/curl/curl/pull/10475#issuecomment-1426831800
+
+ Closes #10477
+
+Dmitry Atamanov (12 Feb 2023)
+
+- cmake: fix dev warning due to mismatched arg
+
+ The package name passed to find_package_handle_standard_args (BROTLI)
+ does not match the name of the calling package (Brotli). This can lead
+ to problems in calling code that expects find_package result variables
+ (e.g., _FOUND) to follow a certain pattern.
+
+ Closes https://github.com/curl/curl/pull/10471
+
+James Keast (11 Feb 2023)
+
+- setopt: Address undefined behaviour by checking for null
+
+ This addresses undefined behaviour found using clang's UBsan:
+
+ curl/lib/setopt.c:177:14: runtime error: applying non-zero offset 1 to null p
+ ointer
+ SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior curl/lib/setopt.c:177
+ :14 in
+
+ Closes #10472
+
+Jacob Hoffman-Andrews (11 Feb 2023)
+
+- rustls: improve error messages
+
+ Changes numeric error codes into verbose error codes in two places.
+ Adds a prefix indicating that the error came from rustls, and in some
+ places which function it came from.
+
+ Adds special handling for RUSTLS_RESULT_UNEXPECTED_EOF, since the
+ default message of "Unexpected EOF" is insufficiently explanatory.
+
+ Closes #10463
+
+Daniel Stenberg (11 Feb 2023)
+
+- openssl: remove dead code
+
+ Follow-up to e8b00fcd6a
+
+ Due to the new 'if(!nonblocking)' check on the block a level above,
+ there is no need to check for it again within the same conditional.
+
+ Detected by Coverity
+
+ Closes #10473
+
+- ngtcp2: replace removed define and stop using removed function
+
+ They were removed upstream.
+
+ Reported-by: Karthikdasari0423 on github
+ Fixes #10469
+ Closes #10474
+
+- scripts/delta: show percent of number of files changed since last tag
+
+- RELEASE-NOTES: synced
+
+Stefan Eissing (10 Feb 2023)
+
+- pytest: add a test case for PUSH related things.
+
+ - checking that "103 Early Hints" are visible in curl's header dump file
+
+ Closes #10452
+
+Gregory Panakkal (10 Feb 2023)
+
+- WEBSOCKET.md: typo
+
+ Fixing missing slash for ws protocol scheme
+
+ Closes #10464
+
+Stefan Eissing (10 Feb 2023)
+
+- vquic: stabilization and improvements
+
+ vquic stabilization
+ - udp send code shared between ngtcp2 and quiche
+ - quiche handling of data and events improved
+
+ ngtcp2 and pytest improvements
+ - fixes handling of "drain" situations, discovered in scorecard
+ tests with the Caddy server.
+ - improvements in handling transfers that have already data or
+ are already closed to make an early return on recv
+
+ pytest
+ - adding caddy tests when available
+
+ scorecard improvemnts.
+ - using correct caddy port
+ - allowing tests for only httpd or caddy
+
+ Closes #10451
+
+Philip Heiduck (10 Feb 2023)
+
+- Linux CI: update some dependecies to latest tag
+
+ Closes #10458
+
+Daniel Stenberg (10 Feb 2023)
+
+- test2305: send 3 frames, 4097 bytes each, as one message
+
+ Receive them using a 256 bytes buffer in a loop.
+
+- ws: fix recv of larger frames
+
+ + remove 'oleft' from the struct
+ + deal with "overflow data" in a separate dynbuf
+
+ Reported-by: Mike Duglas
+ Fixes #10438
+ Closes #10447
+
+- curl/websockets.h: extend the websocket frame struct
+
+- sws: fix typo, indentation add more ws logging
+
+- test2304: remove stdout verification
+
+ This cripples the test somewhat but the check was bad since depending on
+ timing it could exit before the output was done, making the test flaky.
+
+Dan Fandrich (9 Feb 2023)
+
+- CI: Add more labeler match patterns
+
+- CI: Retry failed downloads to reduce spurious failures
+
+ A temporary error with a remote server shouldn't cause a CI run to fail.
+ Also, put a cap on the time to download to fail faster on a misbehaving
+ server or connection and use HTTP compression where possible to reduce
+ download times.
+
+Daniel Stenberg (9 Feb 2023)
+
+- no-clobber.d: only use long form options in man page text
+
+ ... since they are expanded and the short-form gets mentioned
+ automatically so if the short form is mentioned as well, it gets
+ repeated.
+
+ Fixes #10461
+ Closes #10462
+ Reported-by: Dan Fandrich
+
+- GHA: enable websockets in the torture job
+
+ Closes #10448
+
+- header.d: add a header file example
+
+ Closes #10455
+
+Stefan Eissing (9 Feb 2023)
+
+- HTTP/[23]: continue upload when state.drain is set
+
+ - as reported in #10433, HTTP/2 uploads may stall when a response is
+ received before the upload is done. This happens when the
+ data->state.drain is set for such a transfer, as the special handling
+ in transfer.c from then on only cared about downloads.
+ - add continuation of uploads, if applicable, in this case.
+ - add pytest case test_07_12_upload_seq_large to reproduce this scenario
+ (although, current nghttp2 implementation is using drain less often)
+
+ Reported-by: Lucas Pardue
+
+ Fixes #10433
+ Closes #10443
+
+- http2: minor buffer and error path fixes
+
+ - use memory buffer in full available size
+ - fail receive of reset/errored streams early
+
+ pytest:
+ - make test_05 error cases more reliable
+
+ Closes #10444
+
+Federico Pellegrin (9 Feb 2023)
+
+- openldap: fix missing sasl symbols at build in specific configs
+
+ If curl is built with openldap support (USE_OPENLDAP=1) but does not
+ have also some other protocol (IMAP/SMTP/POP3) enabled that brings
+ in Curl_sasl_* functions, then the build will fail with undefined
+ references to various symbols:
+
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_decode_mech'
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_parse_url_auth
+ _option'
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_cleanup'
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_can_authentica
+ te'
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_continue'
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_start'
+ ld: ../lib/.libs/libcurl.so: undefined reference to `Curl_sasl_init'
+
+ This was tracked down to these functions bein used in openldap.c but
+ defined in curl_sasl.c and then forward in two vauth/ files to have
+ a guard against a set of #define configurations that was now extended
+ to cover also this case.
+
+ Example configuration targeted that could reproduce the problem:
+
+ curl 7.87.1-DEV () libcurl/7.87.1-DEV .... OpenLDAP/2.6.3
+ Protocols: file ftp ftps http https ldap ldaps
+
+ Closes #10445
+
+Daniel Stenberg (9 Feb 2023)
+
+- ws: use %Ou for outputting curl_off_t with info()
+
+ Reported-by: Mike Duglas
+ Fixes #10439
+ Closes #10441
+
+Jay Satiro (9 Feb 2023)
+
+- curl_setup: Disable by default recv-before-send in Windows
+
+ Prior to this change a workaround for Windows to recv before every send
+ was enabled by default. The way it works is a recv is called before
+ every send and saves the received data, in case send fails because in
+ Windows apparently that can wipe out the socket's internal received
+ data buffer.
+
+ This feature has led to several bugs because the way libcurl operates
+ it waits on a socket to read or to write, and may not at all times
+ check for buffered receive data.
+
+ Two recent significant bugs this workaround caused:
+ - Broken Schannel TLS 1.3 connections (#9431)
+ - HTTP/2 arbitrary hangs (#10253)
+
+ The actual code remains though it is disabled by default. Though future
+ changes to connection filter buffering could improve the situation IMO
+ it's just not tenable to manage this workaround.
+
+ Ref: https://github.com/curl/curl/issues/657
+ Ref: https://github.com/curl/curl/pull/668
+ Ref: https://github.com/curl/curl/pull/720
+
+ Ref: https://github.com/curl/curl/issues/9431
+ Ref: https://github.com/curl/curl/issues/10253
+
+ Closes https://github.com/curl/curl/pull/10409
+
+Stefan Eissing (8 Feb 2023)
+
+- http2: aggregate small SETTINGS/PRIO/WIN_UPDATE frames
+
+ add a small buffer to nghttp2 session sending in order to aggregate
+ small SETTINGS/PRIO/WIN_UPDATE frames that nghttp2 "writes" to the
+ callback individually.
+
+ Ref: #10389
+ Closes #10432
+
+- openssl: store the CA after first send (ClientHello)
+
+ move Curl_ssl_setup_x509_store() call after the first send (ClientHello)
+ this gives time to parse CA anchors while waiting on the server reply
+
+ Ref: #10389
+ Closes #10432
+
+Daniel Stenberg (8 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+Anthony Hu (8 Feb 2023)
+
+- wolfssl: remove deprecated post-quantum algorithms
+
+ Closes #10440
+
+John Bampton (8 Feb 2023)
+
+- misc: fix spelling
+
+ Closes #10437
+
+Daniel Stenberg (7 Feb 2023)
+
+- man pages: call the custom user pointer 'clientp' consistently
+
+ The variable had a few different names. Now try to use 'clientp'
+ consistently for all man pages using a custom pointer set by the
+ application.
+
+ Reported-by: Gerrit Renker
+
+ Fixes #10434
+ Closes #10435
+
+- vtls: infof using %.*s needs to provide the length as int
+
+ Fixes a Coverity warning.
+
+ Closes #10436
+
+Stefan Eissing (7 Feb 2023)
+
+- vrls: addressing issues reported by coverity
+
+ I believe the code was secure before this, but limiting the accepted
+ name length to what is used in the structures should help Coverity's
+ analysis.
+
+ Closes #10431
+
+Daniel Stenberg (7 Feb 2023)
+
+- tool_operate: move the 'updated' variable
+
+ This was already done by Dan Fandrich in the previous PR but somehow I
+ lost that fixup.
+
+ Follow-up to 349c5391f2121e
+
+Dan Fandrich (7 Feb 2023)
+
+- tool_operate: Fix error codes during DOS filename sanitize
+
+ It would return CURLE_URL_MALFORMAT in an OOM condition.
+
+ Closes #10414
+
+- tool_operate: Fix error codes on bad URL & OOM
+
+ curl would erroneously report CURLE_OUT_OF_MEMORY in some cases instead
+ of CURLE_URL_MALFORMAT. In other cases, it would erroneously return
+ CURLE_URL_MALFORMAT instead of CURLE_OUT_OF_MEMORY. Add a test case to
+ test the former condition.
+
+ Fixes #10130
+ Closes #10414
+
+Daniel Stenberg (6 Feb 2023)
+
+- setopt: use >, not >=, when checking if uarg is larger than uint-max
+
+ Closes #10421
+
+- vtls: fix failf() format argument type for %.*s handling
+
+ Reported by Coverity
+
+ Closes #10422
+
+- openssl: fix "Improper use of negative value"
+
+ By getting the socket first and returning error in case of bad socket.
+
+ Detected by Coverity.
+
+ Closes #10423
+
+Dan Fandrich (6 Feb 2023)
+
+- packages: Remove Android.mk from makefile
+
+ This was missed in commit #44141512
+
+ Ref: #10418
+
+Daniel Stenberg (6 Feb 2023)
+
+- curl_ws_send.3: clarify how to send multi-frame messages
+
+Mike Duglas (6 Feb 2023)
+
+- ws: fix multiframe send handling
+
+ Fixes #10413
+ Closes #10420
+
+Daniel Stenberg (6 Feb 2023)
+
+- unit2600: make sure numerical curl_easy_setopt sets long
+
+ Follow-up to 671158242db3203
+
+ Reported-by: Marcel Raad
+ Fixes #10410
+ Closes #10419
+
+Andy Alt (6 Feb 2023)
+
+- GHA: move Slackware test into matrix
+
+ Closes #10412
+
+Pronyushkin Petr (6 Feb 2023)
+
+- urlapi: fix part of conditional expression is always true: qlen
+
+ Closes #10408
+
+- url: fix part of conditional expression is always true
+
+ Closes #10407
+
+Daniel Stenberg (6 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+Philip Heiduck (6 Feb 2023)
+
+- GHA/macos.yml: bump to gcc-12
+
+ Closes #10415
+
+Daniel Stenberg (6 Feb 2023)
+
+- packages: remove Android, update README
+
+ - Nobody builds curl for Android using this anymore
+ - Refreshed the README and converted to markdown
+
+ Reported-by: John Porter
+ Fixes #10416
+ Closes #10418
+
+Kvarec Lezki (5 Feb 2023)
+
+- fopen: remove unnecessary assignment
+
+ [CWE-1164] V1048: The '* tempname' variable was assigned the same value.
+
+ Ref: https://pvs-studio.com/en/docs/warnings/v1048/
+
+ Closes https://github.com/curl/curl/pull/10398
+
+Gisle Vanem (5 Feb 2023)
+
+- libtest: add a sleep macro for Windows
+
+ .. because sleep() is used in some libtests.
+
+ Closes https://github.com/curl/curl/pull/10295
+
+Kvarec Lezki (3 Feb 2023)
+
+- http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
+
+ V220: Suspicious sequence of types castings: memsize -> 32-bit integer -> mem
+ size.
+
+ https://pvs-studio.com/en/docs/warnings/v220/
+
+ Closes #10400
+
+Daniel Stenberg (3 Feb 2023)
+
+- mailmap: Thomas1664 on github
+
+Thomas1664 on github (3 Feb 2023)
+
+- CURLOPT_WRITEFUNCTION.3: fix memory leak in example
+
+ Closes #10390
+
+Kvarec Lezki (3 Feb 2023)
+
+- doh: ifdef IPv6 code
+
+ For disabled IPv6 a condition (conn->ip_version != CURL_IPRESOLVE_V4) is
+ always false. https://pvs-studio.com/en/docs/warnings/v560/
+
+ Closes #10397
+
+Daniel Stenberg (3 Feb 2023)
+
+- urlapi: remove pathlen assignment
+
+ "Value stored to 'pathlen' is never read"
+
+ Follow-up to 804d5293f89
+
+ Reported-by: Kvarec Lezki
+
+ Closes #10405
+
+Kvarec Lezki (3 Feb 2023)
+
+- http: fix "part of conditional expression is always false"
+
+ [CWE-570] V560: A part of conditional expression is always false: conn->bits.
+ authneg.
+ [CWE-570] V560: A part of conditional expression is always false: conn->handl
+ er->protocol & (0 | 0).
+
+ https://pvs-studio.com/en/docs/warnings/v560/
+
+ Closes #10399
+
+Daniel Stenberg (2 Feb 2023)
+
+- urlapi: skip the extra dedotdot alloc if no dot in path
+
+ Saves an allocation for many/most URLs.
+
+ Updates test 1395 accordingly
+
+ Closes #10403
+
+Stefan Eissing (2 Feb 2023)
+
+- connections: introduce http/3 happy eyeballs
+
+ New cfilter HTTP-CONNECT for h3/h2/http1.1 eyeballing.
+ - filter is installed when `--http3` in the tool is used (or
+ the equivalent CURLOPT_ done in the library)
+ - starts a QUIC/HTTP/3 connect right away. Should that not
+ succeed after 100ms (subject to change), a parallel attempt
+ is started for HTTP/2 and HTTP/1.1 via TCP
+ - both attempts are subject to IPv6/IPv4 eyeballing, same
+ as happens for other connections
+ - tie timeout to the ip-version HAPPY_EYEBALLS_TIMEOUT
+ - use a `soft` timeout at half the value. When the soft timeout
+ expires, the HTTPS-CONNECT filter checks if the QUIC filter
+ has received any data from the server. If not, it will start
+ the HTTP/2 attempt.
+
+ HTTP/3(ngtcp2) improvements.
+ - setting call_data in all cfilter calls similar to http/2 and vtls filters
+ for use in callback where no stream data is available.
+ - returning CURLE_PARTIAL_FILE for prematurely terminated transfers
+ - enabling pytest test_05 for h3
+ - shifting functionality to "connect" UDP sockets from ngtcp2
+ implementation into the udp socket cfilter. Because unconnected
+ UDP sockets are weird. For example they error when adding to a
+ pollset.
+
+ HTTP/3(quiche) improvements.
+ - fixed upload bug in quiche implementation, now passes 251 and pytest
+ - error codes on stream RESET
+ - improved debug logs
+ - handling of DRAIN during connect
+ - limiting pending event queue
+
+ HTTP/2 cfilter improvements.
+ - use LOG_CF macros for dynamic logging in debug build
+ - fix CURLcode on RST streams to be CURLE_PARTIAL_FILE
+ - enable pytest test_05 for h2
+ - fix upload pytests and improve parallel transfer performance.
+
+ GOAWAY handling for ngtcp2/quiche
+ - during connect, when the remote server refuses to accept new connections
+ and closes immediately (so the local conn goes into DRAIN phase), the
+ connection is torn down and a another attempt is made after a short grace
+ period.
+ This is the behaviour observed with nghttpx when we tell it to shut
+ down gracefully. Tested in pytest test_03_02.
+
+ TLS improvements
+ - ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, repl
+ aces
+ copy of logic in all tls backends.
+ - standardized the infof logging of offered ALPNs
+ - ALPN negotiated: have common function for all backends that sets alpn propr
+ ty
+ and connection related things based on the negotiated protocol (or lack the
+ reof).
+
+ - new tests/tests-httpd/scorecard.py for testing h3/h2 protocol implementatio
+ n.
+ Invoke:
+ python3 tests/tests-httpd/scorecard.py --help
+ for usage.
+
+ Improvements on gathering connect statistics and socket access.
+ - new CF_CTRL_CONN_REPORT_STATS cfilter control for having cfilters
+ report connection statistics. This is triggered when the connection
+ has completely connected.
+ - new void Curl_pgrsTimeWas(..) method to report a timer update with
+ a timestamp of when it happend. This allows for updating timers
+ "later", e.g. a connect statistic after full connectivity has been
+ reached.
+ - in case of HTTP eyeballing, the previous changes will update
+ statistics only from the filter chain that "won" the eyeballing.
+ - new cfilter query CF_QUERY_SOCKET for retrieving the socket used
+ by a filter chain.
+ Added methods Curl_conn_cf_get_socket() and Curl_conn_get_socket()
+ for convenient use of this query.
+ - Change VTLS backend to query their sub-filters for the socket when
+ checks during the handshake are made.
+
+ HTTP/3 documentation on how https eyeballing works.
+
+ TLS improvements
+ - ALPN selection for SSL/SSL-PROXY filters in one vtls set of functions, repl
+ aces
+ copy of logic in all tls backends.
+ - standardized the infof logging of offered ALPNs
+ - ALPN negotiated: have common function for all backends that sets alpn propr
+ ty
+ and connection related things based on the negotiated protocol (or lack the
+ reof).
+
+ Scorecard with Caddy.
+ - configure can be run with `--with-test-caddy=path` to specify which caddy t
+ o use for testing
+ - tests/tests-httpd/scorecard.py now measures download speeds with caddy
+
+ pytest improvements
+ - adding Makfile to clean gen dir
+ - adding nghttpx rundir creation on start
+ - checking httpd version 2.4.55 for test_05 cases where it is needed. Skippin
+ g with message if too old.
+ - catch exception when checking for caddy existance on system.
+
+ Closes #10349
+
+Daniel Stenberg (2 Feb 2023)
+
+- CODEOWNERS: remove the peeps mentioned as CI owners
+
+ These owners do not have the bandwidth/energy to do the reviews which
+ makes PRs stall and this ownership claim flawed. We can bring people
+ back when the situation is different.
+
+ Follow-up to c04c78ac87c4d46737934345a
+
+ Closes #10386
+
+Martin D'Aloia (2 Feb 2023)
+
+- write-out.d: add 'since version' to %{header_json} documentation
+
+ The documentation of `%{header_json}` missed to mention since which
+ version this variable for `--write-out` is present.
+
+ Based on commit https://github.com/curl/curl/commit/4133a69f2daa476bb
+ we can determine from the tags were this commit is present that the
+ first version to include it was `7.83.0`.
+ This could be also checked with:
+ `git tag --contains 4133a69f2daa476bb6d902687f1dd6660ea9c3c5`
+
+ Closes #10395
+
+Daniel Stenberg (1 Feb 2023)
+
+- urlapi: avoid Curl_dyn_addf() for hex outputs
+
+ Inspired by the recent fixes to escape.c, we should avoid calling
+ Curl_dyn_addf() in loops, perhaps in particular when adding something so
+ simple as %HH codes - for performance reasons. This change makes the
+ same thing for the URL parser's two URL-encoding loops.
+
+ Closes #10384
+
+- urlapi: skip path checks if path is just "/"
+
+ As a miniscule optimization, treat a path of the length 1 as the same as
+ non-existing, as it can only be a single leading slash, and that's what
+ we do for no paths as well.
+
+ Closes #10385
+
+Philip Heiduck (1 Feb 2023)
+
+- GHA/macos: use Xcode_14.0.1 for cmake builds
+
+ Fixes #10356
+ Closes #10381
+
+Viktor Szakats (1 Feb 2023)
+
+- tls: fixes for wolfssl + openssl combo builds
+
+ 1. Add `USE_WOLFSSL` to the TLS backend priority list in
+ `lib/curl_ntlm_core.c`.
+
+ 2. Fix `lib/curl_ntlm_core.h` to respect TLS backend priority, bringing
+ it in sync with the above list and `lib/curl_ntlm_core.c` itself.
+
+ Reported-by: Mark Roszko
+ Ref: https://github.com/curl/curl/issues/10321
+
+ 3. Allow enabling both wolfSSL and OpenSSL at the same time in
+ `lib/Makefile.mk` bringing this in line with cmake/autotools builds.
+ Update logic to select the crypto-specific lib for `ngtcp2`, which
+ supports a single TLS backend at the same time.
+
+ Closes #10322
+
+Daniel Stenberg (1 Feb 2023)
+
+- RELEASE-NOTES: synced
+
+- docs/INSTALL: document how to use multiple TLS backends
+
+ And document how OpenSSL forks and wolfSSL cannot be used at the same
+ time.
+
+ Reported-by: Mark Roszko
+ Fixes #10321
+ Closes #10382
+
+Kvarec Lezki (1 Feb 2023)
+
+- cookies: fp is always not NULL
+
+ Closes #10383
+
+Daniel Stenberg (31 Jan 2023)
+
+- escape: use table lookup when adding %-codes to output
+
+ On my dev host, this code runs 7.8 times faster.
+
+ Closes #10377
+
+- unit2600: avoid error: ‘TEST_CASES’ defined but not used
+
+ Follow-up to d55de24dce9d51
+
+ Closes #10379
+
+- escape: hex decode with a lookup-table
+
+ Makes the decoding 2.8 times faster in my tests.
+
+ Closes #10376
+
+- cf-socket: fix build error wo TCP_FASTOPEN_CONNECT
+
+ Follow-up to 5651a36d1a
+
+ Closes #10378
+
+ Reviewed-by: Stefan Eissing
+
+Stefan Eissing (31 Jan 2023)
+
+- CI: add pytest github workflow to CI test/tests-httpd on a HTTP/3 setup
+
+ Closes #10317
+
+- connect: fix strategy testing for attempts, timeouts and happy-eyeball
+
+ - add test2600 as a unit test that triggers various connect conditions
+ and monitors behaviour, available in a debug build only.
+
+ - this exposed edge cases in connect.c that have been fixed
+
+ Closes #10312
+
+- cf-socket: improvements in socket I/O handling
+
+ - Curl_write_plain/Curl_read_plain have been eliminated. Last code use
+ now uses Curl_conn_send/recv so that requests use conn->send/revc
+ callbacks which defaults to cfilters use.
+ - Curl_recv_plain/Curl_send_plain have been internalized in cf-socket.c.
+ - USE_RECV_BEFORE_SEND_WORKAROUND (active on Windows) has been moved
+ into cf-socket.c. The pre_recv buffer is held at the socket filter
+ context. `postponed_data` structures have been removed from
+ `connectdata`.
+ - the hanger in HTTP/2 request handling was a result of read buffering
+ on all sends and the multi handling is not prepared for this. The
+ following happens:
+
+ - multi preforms on a HTTP/2 easy handle
+ - h2 reads and processes data
+ - this leads to a send of h2 data
+ - which receives and buffers before the send
+ - h2 returns
+ - multi selects on the socket, but no data arrives (its in the buffer alre
+ ady)
+ the workaround now receives data in a loop as long as there is something i
+ n
+ the buffer. The real fix would be for multi to change, so that `data_pendi
+ ng`
+ is evaluated before deciding to wait on the socket.
+
+ io_buffer, optional, in cf-socket.c, http/2 sets state.drain if lower
+ filter have pending data.
+
+ This io_buffer is only available/used when the
+ -DUSE_RECV_BEFORE_SEND_WORKAROUND is active, e.g. on Windows
+ configurations. It also maintains the original checks on protocol
+ handler being HTTP and conn->send/recv not being replaced.
+
+ The HTTP/2 (nghttp2) cfilter now sets data->state.drain when it finds
+ out that the "lower" filter chain has still pending data at the end of
+ its IO operation. This prevents the processing from becoming stalled.
+
+ Closes #10280
+
+Daniel Stenberg (31 Jan 2023)
+
+- openssl: only use CA_BLOB if verifying peer
+
+ Reported-by: Paul Groke
+ Bug: https://curl.se/mail/lib-2023-01/0070.html
+ Fixes #10351
+ Closes #10359
+
+Thomas1664 on github (31 Jan 2023)
+
+- curl_free.3: fix return type of `curl_free`
+
+ Fixes #10373
+ Closes #10374
+
+Daniel Stenberg (30 Jan 2023)
+
+- zuul: stop using this CI service
+
+ The important jobs have already transitioned. The remaining ones we can
+ skip for now.
+
+ Closes #10368
+
+- copyright: remove "m4/ax_compile_check_sizeof.m4" from skips
+
+ and report if skipped files do not exist.
+
+ Follow-up to 9e11c2791fb960758 which removed the file.
+
+ Closes #10369
+
+- ws: unstick connect-only shutdown
+
+ As this mode uses blocking sockets, it must set them back to
+ non-blocking in disconnect to avoid the risk of getting stuck.
+
+ Closes #10366
+
+- ws: remove bad assert
+
+ Reported-by: Stanley Wucw
+ Fixes #10347
+ Closes #10366
+
+- openssl: adapt to boringssl's error code type
+
+ BoringSSL uses uint32_t, OpenSSL uses 'unsigned 'long'
+
+ Closes #10360
+
+- tool_operate: repair --rate
+
+ Regression from a55256cfb242 (7.87.0)
+ Reported-by: highmtworks on github
+ Fixes #10357
+ Closes #10358
+
+- dict: URL decode the entire path always
+
+ Reported-by: dekerser on github
+ Fixes #10298
+ Closes #10354
+
+Stefan Eissing (29 Jan 2023)
+
+- vtls: do not null-check when we already assume cf-ctx exists
+
+ Fixes #10361
+ Closes #10362
+
+Daniel Stenberg (29 Jan 2023)
+
+- RELEASE-NOTES: synced
+
+- CURLOPT_READFUNCTION.3: the callback 'size' arg is always 1
+
+ Reported-by: Brian Green
+ Fixes #10328
+ Closes #10355
+
+- copyright.pl: cease doing year verifications
+
+ As we have (mostly) removed the copyright year ranges.
+
+ Reported-by: Ryan Schmidt
+ Fixes #10345
+ Closes #10352
+
+Dan Fandrich (28 Jan 2023)
+
+- CI: Work around a labeler bug that removes labels
+
+Jay Satiro (26 Jan 2023)
+
+- write-out.d: clarify Windows % symbol escaping
+
+ - Clarify that in Windows batch files the % must be escaped as %%, and
+ at the command prompt it cannot be escaped which could lead to
+ incorrect expansion.
+
+ Prior to this change the doc implied % must be escaped as %% in win32
+ always.
+
+ ---
+
+ Examples showing how a write-out argument is received by curl:
+
+ If curl --write-out "%{http_code}" is executed in a batch file:
+ {http_code}
+
+ If curl --write-out "%%{http_code}" is executed in a batch file:
+ %{http_code}
+
+ If curl --write-out "%{http_code}" is executed from the command prompt:
+ %{http_code}
+
+ If curl --write-out "%%{http_code}" is executed from the command prompt:
+ %%{http_code}
+
+ At the command prompt something like "%{speed_download}%{http_code}"
+ would first be parsed by the command interpreter as %{speed_download}%
+ and would be expanded as environment variable {speed_download} if it
+ existed, though that's highly unlikely since Windows environment names
+ don't use braces.
+
+ ---
+
+ Reported-by: Muhammad Hussein Ammari
+
+ Ref: https://github.com/bagder/everything-curl/pull/279
+
+ Fixes https://github.com/curl/curl/issues/10323
+ Closes https://github.com/curl/curl/pull/10337
+
+Ryan Schmidt (26 Jan 2023)
+
+- connect: Fix build when not ENABLE_IPV6
+
+ Check for ENABLE_IPV6 before accessing AF_INET6. Fixes build failure
+ introduced in 1c5d8ac.
+
+ Closes https://github.com/curl/curl/pull/10344
+
+- cf-socket: Fix build when not HAVE_GETPEERNAME
+
+ Remove remaining references to conn and sockfd, which were removed from
+ the function signature when conninfo_remote was renamed to
+ conn_set_primary_ip in 6a8d7ef.
+
+ Closes https://github.com/curl/curl/pull/10343
+
+Stefan Eissing (26 Jan 2023)
+
+- vtls: Manage current easy handle in nested cfilter calls
+
+ The previous implementation cleared `data` so the outer invocation lost
+ its data, which could lead to a crash.
+
+ Bug: https://github.com/curl/curl/issues/10336
+ Reported-by: Fujii Hironori
+
+ Closes https://github.com/curl/curl/pull/10340
+
+Dan Fandrich (25 Jan 2023)
+
+- CI: Add even more paths to the labeler config (#10326)
+
+- scripts: Fix Appveyor job detection in cijobs.pl
+
+ The reorganization in #9769 broke the script. This should probably be
+ rewritten to use a YAML parser for better upward compatibility.
+
+- CI: Add a few more paths to the labeler config (#10326)
+
+- CI: Switch the labeler event to pull_request_target
+
+ Otherwise, the action won't work on PRs from forked repositories
+ (#10326).
+
+Viktor Szakats (25 Jan 2023)
+
+- cmake: delete redundant macro definition `SECURITY_WIN32`
+
+ Stop explicitly defining `SECURITY_WIN32` in CMake builds.
+
+ No other build systems define this macro, because it's unconditionally
+ defined in `lib/curl_sspi.h` already. This is the only curl source using
+ the `sspi.h` and `security.h` Win32 headers, and no other Win32 headers
+ need this macro.
+
+ Reviewed-by: Jay Satiro
+ Closes #10341
+
+Fredrik (24 Jan 2023)
+
+- winbuild: document that arm64 is supported
+
+ Building an arm64 version works flawlessly with the VS arm64 toolset.
+
+ Closes https://github.com/curl/curl/pull/10332
+
+Cherish98 (24 Jan 2023)
+
+- openssl: don't log raw record headers
+
+ - Skip content type SSL3_RT_HEADER in verbose TLS output.
+
+ This commit prevents bogus and misleading verbose TLS header messages as
+ discussed in #10299.
+
+ Assisted-by: Peter Wu
+
+ Closes https://github.com/curl/curl/pull/10299
+
+Marc Aldorasi (24 Jan 2023)
+
+- cmake: use list APPEND syntax for CMAKE_REQUIRED_DEFINITIONS
+
+ - Use list() instead of set() for CMAKE_REQUIRED_DEFINITIONS list since
+ the former is clearer.
+
+ Closes https://github.com/curl/curl/pull/10272
+
+Dan Fandrich (23 Jan 2023)
+
+- CI: Add a workflow to automatically label pull requests
+
+ The labeler language is quite restrictive right now so labels are added
+ quite conservatively, meaning that many PRs won't get labels when it's
+ "obvious" they should. It will still save some manual work on those
+ that it can label.
+
+Jay Satiro (21 Jan 2023)
+
+- system.h: assume OS400 is always built with ILEC compiler
+
+ Prior to this change the OS400 types were only defined when __ILEC400__.
+ That symbol is only defined by IBM's C compiler and not their C++
+ compiler, which led to missing types when users on OS400 would compile a
+ C++ application that included curl.
+
+ The IBM C and C++ compilers are the only native compilers on the
+ platform.
+
+ Assisted-by: Jon Rumsey
+ Reported-by: John Sherrill
+
+ Fixes https://github.com/curl/curl/issues/10305
+ Closes https://github.com/curl/curl/pull/10329
+
+xgladius (20 Jan 2023)
+
+- cmake: Remove deprecated symbols check
+
+ curl stopped use of CMAKE_USE_ as a prefix for its own build symbols in
+ 2021 and added a check, meant to last 1 year, to fatally error on those
+ symbols. This commit removes that check.
+
+ Closes https://github.com/curl/curl/pull/10314
+
+Dan Fandrich (20 Jan 2023)
+
+- docs: POSTFIELDSIZE must be set to -1 with read function
+
+ Reported-by: RanBarLavie on github
+
+ Closes #10313
+
+Stefan Eissing (20 Jan 2023)
+
+- vtls: fix hostname handling in filters
+
+ - Copy the hostname and dispname to ssl_connect_data.
+
+ Use a copy instead of referencing the `connectdata` instance since this
+ may get free'ed on connection reuse.
+
+ Reported-by: Stefan Talpalaru
+ Reported-by: sergio-nsk@users.noreply.github.com
+
+ Fixes https://github.com/curl/curl/issues/10273
+ Fixes https://github.com/curl/curl/issues/10309
+
+ Closes https://github.com/curl/curl/pull/10310
+
+Sergey Bronnikov (17 Jan 2023)
+
+- lib: fix typos
+
+ Closes https://github.com/curl/curl/pull/10307
+
+- curl_version_info.3: fix typo
+
+ Closes https://github.com/curl/curl/pull/10306
+
+Jay Satiro (17 Jan 2023)
+
+- openssl: Don't ignore CA paths when using Windows CA store (redux)
+
+ .. and remove 'experimental' designation from CURLSSLOPT_NATIVE_CA.
+
+ This commit restores the behavior of CURLSSLOPT_NATIVE_CA so that it
+ does not override CURLOPT_CAINFO / CURLOPT_CAPATH, or the hardcoded
+ default locations. Instead the native Windows CA store can be used at
+ the same time.
+
+ ---
+
+ This behavior was originally added over two years ago in abbc5d60
+ (#5585) but then 83393b1a (#7892) broke it over a year ago, I assume
+ inadvertently.
+
+ The CURLSSLOPT_NATIVE_CA feature was marked experimental and likely
+ rarely used.
+
+ Ref: https://github.com/curl/curl/pull/5585
+ Ref: https://github.com/curl/curl/pull/7892
+ Ref: https://curl.se/mail/lib-2023-01/0019.html
+
+ Closes https://github.com/curl/curl/pull/10244
+
+Daniel Stenberg (13 Jan 2023)
+
+- RELEASE-NOTES: synced
+
+- ws: fix autoping handling
+
+ Reported-by: Alexey Savchuk
+ Fixes #10289
+ Closes #10294
+
+- curl_log: avoid printf() format checking with mingw
+
+ Since it does not seem to like %zu and more
+
+ Follow-up to db91dbbf2
+
+ Fixes #10291
+ Closes #10292
+
+- tool_getparam: fix compiler warning when !HAVE_WRITABLE_ARGV
+
+ Follow-up to 2ed0e1f70ee176edf3d2
+
+ Closes #10286
+
+Stefan Eissing (12 Jan 2023)
+
+- openssl: make the BIO_METHOD a local variable in the connection filter
+
+ This avoids UAF issues when `curl_global_cleanup()` is called before all
+ transfers have been completely handled. Unfortunately this seems to be a
+ more common pattern than we like.
+
+ Closes #10285
+
+Daniel Stenberg (12 Jan 2023)
+
+- curl: output warning at --verbose output for debug-enabled version
+
+ + a libcurl warning in the debug output
+
+ Assisted-by: Jay Satiro
+
+ Ref: https://curl.se/mail/lib-2023-01/0039.html
+ Closes #10278
+
+- src: add --http3-only
+
+ Warning: --http3 and --http3-only are subject to change again (or be
+ removed) before HTTP/3 support goes non-experimental.
+
+ Closes #10264
+
+- curl.h: add CURL_HTTP_VERSION_3ONLY
+
+ As the previous CURL_HTTP_VERSION_3 option gets a slightly altered meaning.
+
+ Closes #10264
+
+- connect: fix access of pointer before NULL check
+
+ Detected by Coverity CID 1518992
+
+ Closes #10284
+
+Daniel Gustafsson (12 Jan 2023)
+
+- easyoptions: Fix header printing in generation script
+
+ The optiontable.pl script prints the header comment when generating
+ easyoptions.c, but it wasn't escaping all characters which jumbled the
+ curl ascii logo. Fix by escaping.
+
+ Cloes #10275
+
+Harry Sintonen (12 Jan 2023)
+
+- tool_getparam: fix hiding of command line secrets
+
+ Closes #10276
+
+Stefan Eissing (12 Jan 2023)
+
+- tests: document the cfilter debug logging options
+
+ Closes #10283
+
+- curl_log: for failf/infof and debug logging implementations
+
+ - new functions and macros for cfilter debugging
+ - set CURL_DEBUG with names of cfilters where debug logging should be
+ enabled
+ - use GNUC __attribute__ to enable printf format checks during compile
+
+ Closes #10271
+
+Daniel Stenberg (10 Jan 2023)
+
+- RELEASE-NOTES: synced
+
+Nick Banks (10 Jan 2023)
+
+- msh3: update to v0.6
+
+ Closes #10192
+
+Stefan Eissing (10 Jan 2023)
+
+- ngtcp2: add CURLOPT_SSL_CTX_FUNCTION support for openssl+wolfssl
+
+ Using common method for SSL_CTX initialization of verfiy peer and CA
+ settings. This also provides X509_STORE sharing to become available for
+ ngtcp2+openssl HTTP/3.
+
+ Reported-by: violetlige on github
+
+ Fixes #10222
+ Closes #10239
+
+Daniel Stenberg (10 Jan 2023)
+
+- cf-socket: make infof() call use %zu for size_t output
+
+ Detected by Coverity CID 1518986 and CID 1518984
+
+ Closes #10268
+
+Jon Rumsey (10 Jan 2023)
+
+- os400: fixes to make-lib.sh and initscript.sh
+
+ Adjust how exports list is generated from header files to account for
+ declarations across multiple lines and CURL_DEPRECATED(...) tags.
+
+ Update initscript.sh
+
+ Specify qadrt_use_inline to prevent unistd.h in ASCII runtime defining
+ close(a) -> close_a(a)
+
+ Fixes #10266
+ Closes #10267
+
+Stefan Eissing (9 Jan 2023)
+
+- tests-httpd: basic infra to run curl against an apache httpd plus nghttpx for
+ h3
+
+ - adding '--with-test-httpd=' to configure non-standard apache2
+ install
+ - python env and base classes for running httpd
+ - basic tests for connectivity with h1/h2/h3
+ - adding test cases for truncated responses in http versions.
+ - adding goaway test for HTTP/3.
+ - adding "stuttering" tests with parallel downloads in chunks with
+ varying delays between chunks.
+
+ - adding a curltest module to the httpd server, adding GOAWAY test.
+ - mod_curltest now installs 2 handlers
+ - 'echo': writing as response body what came as request body
+ - 'tweak': with query parameters to tweak response behaviour
+ - marked known fails as skip for now
+
+ Closes #10175
+
+- quic: improve connect error message, debugging info, fix false connect report
+
+ - ECONNECTREFUSED has not its own fail message in quic filters
+ - Debug logging in connect eyballing improved
+ - Fix bug in ngtcp2/quiche that could lead to false success reporting.
+
+ Reported-by: Divy Le Ray
+
+ Fixes #10245
+ Closes #10248
+
+- quiche: fix build without any HTTP/2 implementation
+
+ Fixes #10260
+ Closes #10263
+
+Daniel Stenberg (9 Jan 2023)
+
+- .github/workflows/linux.yml: add a quiche CI job
+
+ Move over from zuul
+
+ Closes #10241
+
+- curl.h: allow up to 10M buffer size
+
+ Bump the limit from 512K. There might be reasons for applications using
+ h3 to set larger buffers and there is no strong reason for curl to have
+ a very small maximum.
+
+ Ref: https://curl.se/mail/lib-2023-01/0026.html
+
+ Closes #10256
+
+Tatsuhiro Tsujikawa (8 Jan 2023)
+
+- GHA: use designated ngtcp2 and its dependencies versions
+
+ Designate ngtcp2 and its dependency versions so that the CI build does
+ not fail without our control.
+
+ Closes #10257
+
+Daniel Stenberg (8 Jan 2023)
+
+- docs/cmdline-opts/hsts.d: explain hsts more
+
+ Closes #10258
+
+Stefan Eissing (8 Jan 2023)
+
+- msh3: run again in its cfilter
+
+ - test 2500, single GET works
+ - test 2501, single POST stalls
+ - test 2502, multiple, sequential GETs each use a new connection since
+ MsH3ConnectionGetState(qconn) no longer reports CONNECTED after one
+ GET.
+
+ Closes #10204
+
+Jay Satiro (8 Jan 2023)
+
+- sendf: fix build for Linux TCP fastopen
+
+ - Fix the remote addr struct dereference.
+
+ - Include cf-socket.h in urldata.h.
+
+ Follow-up to 6a8d7ef9 which changed conn->ipaddr (Curl_addrinfo* )
+ member to conn->remote_addr (Curl_sockaddr_ex *) several days ago.
+
+ Reported-by: Stephan Guilloux
+
+ Fixes https://github.com/curl/curl/issues/10249
+ Closes https://github.com/curl/curl/pull/10250
+
+Daniel Stenberg (7 Jan 2023)
+
+- RELEASE-NOTES: synced
+
+- setopt: move the SHA256 opt within #ifdef libssh2
+
+ Because only the libssh2 backend not supports it and thus this should
+ return error if this option is used other backends.
+
+ Reported-by: Harry Sintonen
+
+ Closes #10255
+
+Patrick Monnerat (7 Jan 2023)
+
+- nss: implement data_pending method
+
+ NSS currently uses the default Curl_none_data_pending() method which
+ always returns false, causing TLS buffered input data to be missed.
+
+ The current commit implements the nss_data_pending() method that properly
+ monitors the presence of available TLS data.
+
+ Ref:#10077
+
+ Closes #10225
+
+Jay Satiro (6 Jan 2023)
+
+- CURLOPT_HEADERDATA.3: warn DLL users must set write function
+
+ - Warn that in Windows if libcurl is running from a DLL and if
+ CURLOPT_HEADERDATA is set then CURLOPT_WRITEFUNCTION or
+ CURLOPT_HEADERFUNCTION must be set as well, otherwise the user may
+ experience crashes.
+
+ We already have a similar warning in CURLOPT_WRITEDATA. Basically, in
+ Windows libcurl could crash writing a FILE pointer that was created by
+ a different C runtime. In Windows each DLL that is part of a program may
+ or may not have its own C runtime.
+
+ Ref: https://github.com/curl/curl/issues/10231
+
+ Closes https://github.com/curl/curl/pull/10233
+
+Jon Rumsey (5 Jan 2023)
+
+- x509asn1: fix compile errors and warnings
+
+ Various small issues when built for GSKit
+
+ Closes #10238
+
+Patrick Monnerat (5 Jan 2023)
+
+- runtests: fix detection of TLS backends
+
+ Built-in TLS backends are detected at test time by scanning for their
+ names in the version string line returned by the cli tool: as this line
+ may also list the libssh configuration that mentions its own backend,
+ the curl backend may be wrongly determined.
+
+ In example, if the version line contains "libssh/0.10.4/openssl/zlib",
+ OpenSSL is detected as a curl-configured backend even if not.
+
+ This fix requires the backend names to appear as full words preceded by
+ spacing in the version line to be recognized as curl TLS backends.
+
+ Closes #10236
+
+Andy Alt (5 Jan 2023)
+
+- GHA: add job on Slackware 15.0
+
+ Closes #10230
+
+Daniel Stenberg (5 Jan 2023)
+
+- test363: make even smaller writes to loop more
+
+- http_proxy: do not assign data->req.p.http use local copy
+
+ Avoid the tricky reusing of the data->req.p.http pointer for http proxy
+ tunneling.
+
+ Fixes #10194
+ Closes #10234
+
+Stefan Eissing (5 Jan 2023)
+
+- quic: rename vquic implementations, fix for quiche build.
+
+ - quiche in debug mode did not build, fixed.
+ - moved all vquic implementation files to prefix curl_* to avoid
+ the potential mixups between provided .h files and our own.
+ - quich passes test 2500 and 2502. 2501, the POST, fail with
+ the body being rejected. Quich bug?
+
+ Closes #10242
+
+- sectransp: fix for incomplete read/writes
+
+ SecureTransport expects result code errSSLWouldBlock when the requested
+ length could not be sent/recieved in full. The previous code returned
+ noErr, which let SecureTransport to believe that the IO had terminated
+ prematurely.
+
+ Fixes #10227
+ Closes #10235
+
+Andy Alt (5 Jan 2023)
+
+- GHA: Hacktoberfest CI: Update deprecated 'set-output' command
+
+ Closes #10221
+
+Jay Satiro (5 Jan 2023)
+
+- scripts: set file mode +x on all perl and shell scripts
+
+ - Set all scripts +x, ie 644 => 755.
+
+ Prior to this change some scripts were not executable and therefore
+ could not be called directly.
+
+ ~~~
+ git ls-files -s \*.{sh,pl,py} | grep -v 100755
+ ~~~
+
+ Closes https://github.com/curl/curl/pull/10219
+
+Stefan Eissing (4 Jan 2023)
+
+- tool_operate: fix headerfile writing
+
+ Do not rely on the first transfer started to be the first to get a
+ response (remember -Z). All transfers now write the headefile (-D) in
+ append mode, making sure that the order of transfer responses does not
+ lead to overwrites of previous data.
+
+ Closes #10224
+
+Daniel Stenberg (4 Jan 2023)
+
+- misc: reduce struct and struct field sizes
+
+ - by using BIT() instead of bool
+ - imap: shrink struct
+ - ftp: make state 'unsigned char'
+ - ftp: sort ftp_conn struct entries on size
+ - urldata: use smaller fields for SSL version info storage
+ - pop3: reduce the pop3_conn struct size
+ - smtp: reduce the size of the smtp structs
+
+ Closes #10186
+
+- noproxy: support for space-separated names is deprecated
+
+ To be removed in July 2024.
+
+ Assisted-by: Michael Osipov
+ Fixes #10209
+ Closes #10215
+
+Andrei Rybak (4 Jan 2023)
+
+- lib: fix typos in comments which repeat a word
+
+ Remove erroneously duplicated words in code comments of files
+ `lib.connect.c` and `lib/url.c`.
+
+ Closes #10220
+
+Radek Brich (3 Jan 2023)
+
+- cmake: set SOVERSION also for macOS
+
+ Closes #10214
+
+Jay Satiro (3 Jan 2023)
+
+- http2: fix compiler warning due to uninitialized variable
+
+ Prior to this change http2_cfilter_add could return an uninitialized
+ cfilter pointer in an OOM condition. In this case though, the pointer
+ is discarded and not dereferenced so there was no risk of a crash.
+
+Stefan Eissing (3 Jan 2023)
+
+- cf-socket: keep sockaddr local in the socket filters
+
+ - copy `struct Curl_addrinfo` on filter setup into context
+ - remove `struct Curl_addrinfoi *` with `struct Curl_sockaddr_ex *` in
+ connectdata that is set and NULLed by the socket filter
+ - this means we have no reference to the resolver info in connectdata or
+ its filters
+ - trigger the CF_CTRL_CONN_INFO_UPDATE event when the complete filter
+ chain reaches connected status
+ - update easy handle connection information on CF_CTRL_DATA_SETUP event.
+
+ Closes #10213
+
+Daniel Stenberg (3 Jan 2023)
+
+- RELEASE-NOTES: synced
+
+- runtests: consider warnings fatal and error on them
+
+ To help us detect and fix warnings in this script easier and faster.
+
+ Assisted-by: Jakob Hirsch
+
+ Ref: #10206
+ Closes #10208
+
+- copyright: update all copyright lines and remove year ranges
+
+ - they are mostly pointless in all major jurisdictions
+ - many big corporations and projects already don't use them
+ - saves us from pointless churn
+ - git keeps history for us
+ - the year range is kept in COPYING
+
+ checksrc is updated to allow non-year using copyright statements
+
+ Closes #10205
+
+- docs/DEPRECATE.md: deprecate gskit
+
+ Ref: #10163
+
+ - This is a niche TLS library, only running on some IBM systems
+ - no regular curl contributors use this backend
+ - no CI builds use or verify this backend
+ - gskit, or the curl adaption for it, lacks many modern TLS features
+ making it an inferior solution
+ - build breakages in this code take weeks or more to get detected
+ - fixing gskit code is mostly done "flying blind"
+
+ Closes #10201
+
+- Revert "x509asn1: avoid freeing unallocated pointers"
+
+ This reverts commit 6b19247e794cfdf4ec63c5880d8f4f5485f653ab.
+
+ Fixes #10163
+ Closes #10207
+
+- ngtcp2: fix the build without 'sendmsg'
+
+ Follow-up from 71b7e0161032
+
+ Closes #10210
+
+- cmake: check for sendmsg
+
+ Used by ngtcp2
+
+ Closes #10211
+
+Timmy Schierling (2 Jan 2023)
+
+- runtest.pl: add expected fourth return value
+
+ Fixes warning in autobild log: "Use of uninitialized value $HTTP2TLSPORT
+ in substitution iterator at /tests/runtests.pl line 3516"
+
+ Closes #10206
+
+Daniel Stenberg (2 Jan 2023)
+
+- http2: when using printf %.*s, the length arg must be 'int'
+
+ Detected by Coverity CID 1518341
+
+ Closes #10203
+
+- cfilters: check for NULL before using pointer
+
+ Detected by Coverity CID 1518343
+
+ Closes #10202
+
+- http2: in connisdead check, attach the connection before reading
+
+ Otherwise data->conn is NULL and things go wrong.
+
+ This problem caused occastional failures in test 359, 1700 and more
+ depending on timing and the alignment of various planets.
+
+ Assisted-by: Stefan Eissing
+
+ Closes #10199
+
+Philip Heiduck (2 Jan 2023)
+
+- Linux CI: update some dependecies to latest tag
+
+ Closes #10195
+
+Daniel Stenberg (2 Jan 2023)
+
+- c-hyper: move down the Accept-Encoding header generation
+
+ To match the internal HTTP request header order so that test 1277 works
+ again.
+
+ Closes #10200
+
+- release-notes.pl: check fixes/closes lines better
+
+ To better skip lines that just happen to mention those words at the
+ start of a line without being instructions.
+
+- test1560: use a UTF8-using locale when run
+
+ There are odd cases that don't use UTF8 and then the IDN handling goes
+ wrong.
+
+ Reported-by: Marcel Raad
+ Fixes #10193
+ Closes #10196
+
+- cf-socket: fix build regression
+
+ Reported-by: Stephan Guilloux
+ Fixes #10190
+ Closes #10191
+
+- examples: remove the curlgtk.c example
+
+ - it does not add a lot of value
+ - we do not test-build it to verify because of its dependencies
+ - unclear for what GTK versions it works or not
+
+ Reported-by: odek86 on github
+
+ Fixes #10197
+ Closes #10198
+
+Andy Alt (2 Jan 2023)
+
+- docs: add link to GitHub Discussions
+
+ Closes #10171
+
+- GHA: ignore changes to md files for most workflows
+
+ Closes #10176
+
+Josh Brobst (2 Jan 2023)
+
+- http: decode transfer encoding first
+
+ The unencoding stack is added to as Transfer-Encoding and
+ Content-Encoding fields are encountered with no distinction between the
+ two, meaning the stack will be incorrect if, e.g., the message has both
+ fields and a non-chunked Transfer-Encoding comes first. This commit
+ fixes this by ordering the stack with transfer encodings first.
+
+ Reviewed-by: Patrick Monnerat
+ Closes #10187
+
+Daniel Stenberg (1 Jan 2023)
+
+- curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
+
+ Follow-up since 223f26c28a340b36
+
+ Deprecated since 7.82.0
+
+ Closes #10189
+
+- curl_global_sslset.3: clarify the openssl situation
+
+ and add rustls
+
+ Closes #10188
+
+Cameron Blomquist (1 Jan 2023)
+
+- http: add additional condition for including stdint.h
+
+ stdint.h was only included in http.h when ENABLE_QUIC was defined, but
+ symbols from stdint.h are also used when USE_NGHTTP2 is defined. This
+ causes build errors when USE_NGHTTP2 is defined but ENABLE_QUIC is not.
+
+ Closes #10185
+
+Daniel Stenberg (31 Dec 2022)
+
+- urldata: cease storing TLS auth type
+
+ The only TLS auth type libcurl ever supported is SRP and that is the
+ default type. Since nobody ever sets any other type, there is no point
+ in wasting space to store the set type and code to check the type.
+
+ If TLS auth is used, SRP is now implied.
+
+ Closes #10181
+
+- vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
+
+ Previously libcurl would use the HTTP/1.1 ALPN id even when the
+ application specified HTTP/1.0.
+
+ Reported-by: William Tang
+ Ref: #10183
+
+Marcel Raad (30 Dec 2022)
+
+- lib670: make test.h the first include
+
+ As in all other lib tests. This avoids a macro redefinition warning for
+ `_FILE_OFFSET_BITS` visible in the autobuilds.
+
+ Closes https://github.com/curl/curl/pull/10182
+
+Stefan Eissing (30 Dec 2022)
+
+- lib: connect/h2/h3 refactor
+
+ Refactoring of connection setup and happy eyeballing. Move
+ nghttp2. ngtcp2, quiche and msh3 into connection filters.
+
+ - eyeballing cfilter that uses sub-filters for performing parallel connects
+ - socket cfilter for all transport types, including QUIC
+ - QUIC implementations in cfilter, can now participate in eyeballing
+ - connection setup is more dynamic in order to adapt to what filter did
+ really connect. Relevant to see if a SSL filter needs to be added or
+ if SSL has already been provided
+ - HTTP/3 test cases similar to HTTP/2
+ - multiuse of parallel transfers for HTTP/3, tested for ngtcp2 and quiche
+
+ - Fix for data attach/detach in VTLS filters that could lead to crashes
+ during parallel transfers.
+ - Eliminating setup() methods in cfilters, no longer needed.
+ - Improving Curl_conn_is_alive() to replace Curl_connalive() and
+ integrated ssl alive checks into cfilter.
+ - Adding CF_CNTRL_CONN_INFO_UPDATE to tell filters to update
+ connection into and persist it at the easy handle.
+
+ - Several more cfilter related cleanups and moves:
+ - stream_weigth and dependency info is now wrapped in struct
+ Curl_data_priority
+ - Curl_data_priority members depend is available in HTTP2|HTTP3
+ - Curl_data_priority members depend on NGHTTP2 support
+ - handling init/reset/cleanup of priority part of url.c
+ - data->state.priority same struct, but shallow copy for compares only
+
+ - PROTOPT_STREAM has been removed
+ - Curl_conn_is_mulitplex() now available to check on capability
+
+ - Adding query method to connection filters.
+ - ngtcp2+quiche: implementing query for max concurrent transfers.
+
+ - Adding is_alive and keep_alive cfilter methods. Adding DATA_SETUP event.
+ - setting keepalive timestamp on connect
+ - DATA_SETUP is called after the connection has been completely
+ setup (but may not connected yet) to allow filters to initialize
+ data members they use.
+
+ - there is no socket to be had with msh3, it is unclear how select
+ shall work
+
+ - manual test via "curl --http3 https://curl.se" fail with "empty
+ reply from server".
+
+ - Various socket/conn related cleanups:
+ - Curl_socket is now Curl_socket_open and in cf-socket.c
+ - Curl_closesocket is now Curl_socket_close and in cf-socket.c
+ - Curl_ssl_use has been replaced with Cur_conn_is_ssl
+ - Curl_conn_tcp_accepted_set has been split into
+ Curl_conn_tcp_listen_set and Curl_conn_tcp_accepted_set
+ with a clearer purpose
+
+ Closes #10141
+
+Daniel Stenberg (30 Dec 2022)
+
+- RELEASE-NOTES: synced
+
+- docs/libcurl/curl_getdate.3: minor whitespace edit
+
+ To avoid a fccp quirk that made it render wrongly on the website
+
+- transfer: break the read loop when RECV is cleared
+
+ When the RECV bit is cleared because the response reading for this
+ transfer is complete, the read loop should be stopped. data_pending()
+ can otherwise still return TRUE and another read would be attempted.
+
+ Reported-by: Hide Ishikawa
+ Fixes #10172
+ Closes #10174
+
+- multihandle: turn bool struct fields into bits
+
+ Closes #10179
+
+Stefan Eissing (30 Dec 2022)
+
+- ftpserver: lower the normal DATA connect timeout to speed up torture tests
+
+ - tests/ftpserver.pl blocks when expecting a DATA connection from the
+ client.
+
+ - the previous 10 seconds were encountered repeatedly in torture tests
+ and let to long waits.
+
+ - 2 seconds should still be sufficient for current hw, but CI will show.
+
+ Closes #10178
+
+Nick Banks (28 Dec 2022)
+
+- msh3: add support for request payload
+
+ Closes #10136
+
+Stefan Eissing (28 Dec 2022)
+
+- openssl: remove attached easy handles from SSL instances
+
+ - keeping the "current" easy handle registered at SSL* is no longer
+ necessary, since the "calling" data object is already stored in the
+ cfilter's context (and used by other SSL backends from there).
+ - The "detach" of an easy handle that goes out of scope is then avoided.
+ - using SSL_set0_wbio for clear reference counting where available.
+
+ Closes #10151
+
+Daniel Stenberg (28 Dec 2022)
+
+- socketpair: allow localhost MITM sniffers
+
+ Windows allow programs to MITM connections to localhost. The previous
+ check here would detect that and error out. This new method writes data
+ to verify the pipe thus allowing MITM.
+
+ Reported-by: SerusDev on github
+ Fixes #10144
+ Closes #10169
+
+- HTTP3: mention what needs to be in place to remove EXPERIMENTAL label
+
+ Closes #10168
+
+Andy Alt (28 Dec 2022)
+
+- MANUAL.md: add pipe to apt-key example
+
+ Closes #10170
+
+Daniel Stenberg (27 Dec 2022)
+
+- test417: verify %{certs} output
+
+- runtests: make 'mbedtls' a testable feature
+
+ Also add to FILEFORMAT.md
+
+- writeout: add %{certs} and %{num_certs}
+
+ Let users get the server certificate chain using the command line
+
+ Closes #10019
+
+Stefan Eissing (27 Dec 2022)
+
+- haxproxy: send before TLS handhshake
+
+ - reverse order of haproxy and final ssl cfilter
+
+ - make haproxy avaiable on PROXY builds, independent of HTTP support as
+ it can be used with any protocol.
+
+ Reported-by: Sergio-IME on github
+ Fixes #10165
+ Closes #10167
+
+Daniel Stenberg (27 Dec 2022)
+
+- RELEASE-NOTES: synced
+
+- test446: verify hsts with two URLs
+
+- runtests: support crlf="yes" for verify/proxy
+
+- hsts: handle adding the same host name again
+
+ It will then use the largest expire time of the two entries.
+
+- tool_operate: share HSTS between handles
+
+- share: add sharing of HSTS cache among handles
+
+ Closes #10138
+
+Viktor Szakats (27 Dec 2022)
+
+- Makefile.mk: fix wolfssl and mbedtls default paths
+
+ Fix the defaults for `WOLFSSL_PATH` and `MBEDTLS_PATH` to have
+ meaningful values instead of the copy-pasted wrong ones.
+
+ Ref: https://github.com/curl/curl/commit/66e68ca47f7fd00dff2cb7c45ba6725d4009
+ 9585#r94275172
+
+ Reported-by: Ryan Schmidt
+ Closes #10164
+
+Daniel Stenberg (27 Dec 2022)
+
+- INTERNALS: cleanup
+
+ - remove "operating systems" (mostly outdated)
+
+ - upodate the "build tools"
+
+ Closes #10162
+
+- cmake: bump requirement to 3.7
+
+ Because this is the cmake version (released in November 2016) that
+ introduced GREATER_EQUAL, which is used already.
+
+ Reported-by: nick-telia on github
+ Fixes #10128
+ Closes #10161
+
+- cfilters:Curl_conn_get_select_socks: use the first non-connected filter
+
+ When there are filters addded for both socket and SSL, the code
+ previously checked the SSL sockets during connect when it *should* first
+ check the socket layer until that has connected.
+
+ Fixes #10157
+ Fixes #10146
+ Closes #10160
+
+ Reviewed-by: Stefan Eissing
+
+- urlapi: add CURLU_PUNYCODE
+
+ Allows curl_url_get() get the punycode version of host names for the
+ host name and URL parts.
+
+ Extend test 1560 to verify.
+
+ Closes #10109
+
+- RELEASE-NOTES: synced
+
+- libssh2: try sha2 algos for hostkey methods
+
+ As is supported by recent libssh2, but should just be ignored by older
+ versions.
+
+ Reported-by: norbertmm on github
+ Assisted-by: norbertmm on github
+ Fixes #10143
+ Closes #10145
+
+Patrick Monnerat (26 Dec 2022)
+
+- typecheck: accept expressions for option/info parameters
+
+ As expressions can have side effects, evaluate only once.
+
+ To enable deprecation reporting only once, get rid of the __typeof__
+ use to define the local temporary variable and use the target type
+ (CURLoption/CURLINFO). This also avoids multiple reports on type
+ conflicts (if some) by the curlcheck_* macros.
+
+ Note that CURLOPT_* and CURLINFO_* symbols may be deprecated, but not
+ their values: a curl_easy_setopt call with an integer constant as option
+ will never report a deprecation.
+
+ Reported-by: Thomas Klausner
+ Fixes #10148
+ Closes #10149
+
+Paul Howarth (26 Dec 2022)
+
+- tests: avoid use of sha1 in certificates
+
+ The SHA-1 algorithm is deprecated (particularly for security-sensitive
+ applications) in a variety of OS environments. This already affects
+ RHEL-9 and derivatives, which are not willing to use certificates using
+ that algorithm. The fix is to use sha256 instead, which is already used
+ for most of the other certificates in the test suite.
+
+ Fixes #10135
+
+ This gets rid of issues related to sha1 signatures.
+
+ Manual steps after "make clean-certs" and "make build-certs":
+
+ - Copy tests/certs/stunnel-sv.pem to tests/stunnel.pem
+ (make clean-certs does not remove the original tests/stunnel.pem)
+
+ - Copy tests/certs/Server-localhost-sv.pubkey-pinned into --pinnedpubkey
+ options of tests/data/test2041 and tests/data/test2087
+
+ Closes #10153
+
+Yurii Rashkovskii (26 Dec 2022)
+
+- cmake: fix the snprintf detection
+
+ I haven't had the time to check other configurations, but on my macOS
+ Ventura 13.1 with XCode 14.2 cmake does not find `snprintf`.
+
+ Solution: ensure stdio.h is checked for definitions
+
+ Closes #10155
+
+Radu Hociung (26 Dec 2022)
+
+- http: remove the trace message "Mark bundle... multiuse"
+
+ The message "Mark bundle as not supporting multiuse" was added at commit
+ 29364d93 when an http/2-related bug was fixed, and it appears to be a
+ leftover trace message.
+
+ This message should be removed because:
+ * it conveys no information to the user
+ * it is enabled in the default build (--enable-verbose)
+ * it reads like a warning/unexpected condition
+ * it is equivalent to "Detected http proto < 2", which is
+ not a useful message.
+ * it is a time-wasting red-herring for anyone who encounters
+ it for the first time while investigating some other, real
+ problem.
+
+ This commit removes the trace message "Mark bundle as not
+ supporting multiuse"
+
+ Closes #10159
+
+Hannah Schierling (26 Dec 2022)
+
+- url: fix build with `--disable-cookies`
+
+ Struct `UserDefined` has no member `cookielist` if
+ `CURL_DISABLE_COOKIES` is defined.
+
+ Follow-up to af5999a
+
+ Closes #10158
+
+Stefan Eissing (23 Dec 2022)
+
+- runtests: also tear down http2/http3 servers when https server is stopped
+
+ Closes #10114
+
+- tests: add 3 new HTTP/2 test cases, plus https: support for nghttpx
+
+ - a simple https get
+ - a simple https post
+ - a multi get of 4 requests and check that same connection was used
+
+ Closes #10114
+
+Daniel Stenberg (23 Dec 2022)
+
+- urldata: remove unused struct fields, made more conditional
+
+ - source_quote, source_prequote and source_postquote have not been used since
+ 5e0d9aea3; September 2006
+
+ - make several fields conditional on proxy support
+
+ - make three quote struct fields conditional on FTP || SSH
+
+ - make 'mime_options' depend on MIME
+
+ - make trailer_* fields depend on HTTP
+
+ - change 'gssapi_delegation' from long to unsigned char
+
+ - make 'localportrange' unsigned short instead of int
+
+ - conn->trailer now depends on HTTP
+
+ Closes #10147
+
+- urldata: make set.http200aliases conditional on HTTP being present
+
+ And make a few SSH-only fields depend on SSH
+
+ Closes #10140
+
+- md4: fix build with GnuTLS + OpenSSL v1
+
+ Reported-by: Esdras de Morais da Silva
+
+ Fixes #10110
+ Closes #10142
+
+- urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
+
+ Closes #10139
+
+John Bampton (22 Dec 2022)
+
+- misc: fix grammar and spelling
+
+ Closes #10137
+
+Daniel Stenberg (22 Dec 2022)
+
+- urldata: move the cookefilelist to the 'set' struct
+
+ The cookiefile entries are set into the handle and should remain set for
+ the lifetime of the handle so that duplicating it also duplicates the
+ list. Therefore, the struct field is moved from 'state' to 'set'.
+
+ Fixes #10133
+ Closes #10134
+
+- strdup: name it Curl_strdup
+
+ It does not belong in the curlx_ name space as it is never used
+ externally.
+
+ Closes #10132
+
+Nick Banks (22 Dec 2022)
+
+- msh3: update to v0.5 Release
+
+ Closes #10125
+
+Andy Alt (22 Dec 2022)
+
+- workflows/linux.yml: merge 3 common packages
+
+ Closes #10071
+
+Daniel Stenberg (21 Dec 2022)
+
+- docs: mention indirect effects of --insecure
+
+ Warn users that disabling certficate verification allows servers to
+ "pollute" curl with data it trusts.
+
+ Reported-by: Harry Sintonen
+ Closes #10126
+
+- SECURITY-PROCESS.md: document severity levels
+
+ Closes #10118
+
+- RELEASE_NOTES: synced
+
+ bumped version for new cycle
+
+Marcel Raad (21 Dec 2022)
+
+- tool_operate: fix `CURLOPT_SOCKS5_GSSAPI_NEC` type
+
+ `CURLOPT_SOCKS5_GSSAPI_NEC` is a long, while `socks5_gssapi_nec` was
+ made a bool in commit 4ac64eadf60.
+
+ Closes https://github.com/curl/curl/pull/10124
+
+Version 7.87.0 (21 Dec 2022)
+
+Daniel Stenberg (21 Dec 2022)
+
+- RELEASE-NOTES: synced
+
+ The curl 7.87.0 release
+
+- THANKS: 40 new contributors from 7.87.0
+
+- http: fix the ::1 comparison for IPv6 localhost for cookies
+
+ When checking if there is a "secure context", which it is if the
+ connection is to localhost even if the protocol is HTTP, the comparison
+ for ::1 was done incorrectly and included brackets.
+
+ Reported-by: BratSinot on github
+
+ Fixes #10120
+ Closes #10121
+
+Philip Heiduck (19 Dec 2022)
+
+- CI/spell: actions/checkout@v2 > actions/checkout@v3
+
+Daniel Stenberg (19 Dec 2022)
+
+- smb/telnet: do not free the protocol struct in *_done()
+
+ It is managed by the generic layer.
+
+ Reported-by: Trail of Bits
+
+ Closes #10112
+
+- http: use the IDN decoded name in HSTS checks
+
+ Otherwise it stores the info HSTS into the persistent cache for the IDN
+ name which will not match when the HSTS status is later checked for
+ using the decoded name.
+
+ Reported-by: Hiroki Kurosawa
+
+ Closes #10111
+
+- CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
+
+ Closes #10106
+
+Xì Gà (16 Dec 2022)
+
+- socks: fix username max size is 255 (0xFF)
+
+ Closes #10105
+
+ Reviewed-by: Daniel Gustafsson
+
+Daniel Stenberg (16 Dec 2022)
+
+- limit-rate.d: see also --rate
+
+- lib1560: add some basic IDN host name tests
+
+ Closes #10094
+
+- idn: rename the files to idn.[ch] and hold all IDN functions
+
+ Closes #10094
+
+- idn: remove Curl_win32_ascii_to_idn
+
+ It was not used. Introduce a new IDN header for the prototype(s).
+
+ Closes #10094
+
+- RELEASE-NOTES: synced
+
+- curl_url_get.3: remove spurious backtick
+
+ Put there by mistake.
+
+ Follow-up from 9a8564a92
+
+ Closes #10101
+
+- socks: fix infof() flag for outputing a char
+
+ It used to be a 'long', %lu is no longer correct.
+
+ Follow-up to 57d2d9b6bed33d
+ Detected by Coverity CID 1517663
+
+ Closes #10100
+
+- ssl-reqd.d: clarify that this is for upgrading connections only
+
+ Closes #10093
+
+- curl_url_set.3: document CURLU_DISALLOW_USER
+
+ Closes #10099
+
+- cmake: set the soname on the shared library
+
+ Set SONAME and VERSION for platforms we think this works on. Remove
+ issue from KNOWN_BUGS.
+
+ Assisted-by: Jakub Zakrzewski
+
+ Closes #10023
+
+- tool_paramhlp: free the proto strings on exit
+
+ And also make sure that repeated use of the options free the previous
+ string before it stores a new.
+
+ Follow-up from e6f8445edef8e7996d
+
+ Closes #10098
+
+- tool_cfgable: free the ssl_ec_curves on exit
+
+ Follow-up to ede125b7b
+
+ Closes #10097
+
+- urlapi: reject more bad letters from the host name: &+()
+
+ Follow-up from eb0167ff7d31d3a5
+
+ Extend test 1560 to verify
+
+ Closes #10096
+
+- altsvc: fix rejection of negative port numbers
+
+ Follow-up to ac612dfeee95
+
+ strtoul() accepts a leading minus so better make sure there is none
+
+ Extended test 356 somewhat to use a huge negative 64 bit number that
+ otherwise becomes a low positive number.
+
+ Closes #10095
+
+- lib: use size_t or int etc instead of longs
+
+ Since long is not using a consistent data size in curl builds, making it
+ often "waste" 32 bits.
+
+ Closes #10088
+
+- azure: use "unversioned" clang and clang-tools for scanbuild job
+
+ To make it less fragile
+
+ Closes #10092
+
+Daniel Gustafsson (14 Dec 2022)
+
+- x509asn1: avoid freeing unallocated pointers
+
+ When utf8asn1str fails there is no allocation returned, so freeing
+ the return pointer in **to is at best a no-op and at worst a double-
+ free bug waiting to happen. The current coding isn't hiding any such
+ bugs but to future proof, avoid freeing the return value pointer iff
+ the function failed.
+
+ Closes: #10087
+ Reviewed-by: Daniel Stenberg
+
+Emil Engler (13 Dec 2022)
+
+- curl_url_set.3: fix typo
+
+ Closes: #10089
+ Reviewed-by: Daniel Gustafsson
+
+Daniel Stenberg (13 Dec 2022)
+
+- test2304: verify websocket handling when connection is closed
+
+- server/sws: if asked to close connection, skip the websocket handling
+
+- ws: if no connection is around, return error
+
+ - curl_ws_send returns CURLE_SEND_ERROR if data->conn is gone
+
+ - curl_ws_recv returns CURLE_GOT_NOTHING on connection close
+
+ - curl_ws_recv.3: mention new return code for connection close + example
+ embryo
+
+ Closes #10084
+
+Emil Engler (13 Dec 2022)
+
+- docs: extend the dump-header documentation
+
+ This commit extends the documentation of the --dump-header command-line
+ option to reflect the behavior introduced in 8b1e5df7.
+
+ See #10079
+ Closes #10085
+
+Daniel Stenberg (12 Dec 2022)
+
+- RELEASE-NOTES: synced
+
+- styled-output.d: this option does not work on Windows
+
+ Reported-by: u20221022 on github
+
+ Fixes #10082
+ Closes #10083
+
+Emil Engler (12 Dec 2022)
+
+- tool: determine the correct fopen option for -D
+
+ This commit fixes a bug in the dump-header feature regarding the
+ determination of the second fopen(3) option.
+
+ Reported-by: u20221022 on github
+
+ See #4753
+ See #4762
+ Fixes #10074
+ Closes #10079
+
+Christian Schmitz (11 Dec 2022)
+
+- docs/curl_ws_send: Fixed typo in websocket docs
+
+ Replace as with is in relevant sentences.
+
+ Closes: #10081
+ Reviewed-by: Daniel Gustafsson
+
+Prithvi MK (11 Dec 2022)
+
+- c-hyper: fix multi-request mechanism
+
+ It makes test 565 run fine.
+
+ Fixes #8896
+ Closes #10080
+ Assisted-by: Daniel Stenberg
+
+Andy Alt (11 Dec 2022)
+
+- page-header: grammar improvement (display transfer rate)
+
+ Closes #10068
+
+- docs/DEPRECATE.md: grammar improvement and sp correction
+
+ The main thing I wanted to do was fix the spelling of "spent", but I
+ think this rewording improves the flow of the paragraph.
+
+ Closes #10067
+
+Boris Verkhovskiy (11 Dec 2022)
+
+- tool_cfgable: make socks5_gssapi_nec a boolean
+
+ Closes #10078
+
+Frank Gevaerts (9 Dec 2022)
+
+- contributors.sh: actually use $CURLWWW instead of just setting it.
+
+ The script was all set up for flexibility where curl-www is elsewhere in
+ the filesystem, but then hard-coded ../curl-www anyway...
+
+ Closes #10064
+
+Daniel Stenberg (9 Dec 2022)
+
+- KNOWN_BUGS: remove items not considered bugs any more
+
+ - CURL_GLOBAL_SSL
+
+ This option was changed in libcurl 7.57.0 and clearly it has not caused
+ too many issues and a lot of time has passed.
+
+ - Store TLS context per transfer instead of per connection
+
+ This is a possible future optimization. One that is much less important
+ and interesting since the added support for CA caching.
+
+ - Microsoft telnet server
+
+ This bug was filed in May 2007 against curl 7.16.1 and we have not
+ received further reports.
+
+ - active FTP over a SOCKS
+
+ Actually, proxies in general is not working with active FTP mode. This
+ is now added in proxy documentation.
+
+ - DICT responses show the underlying protocol
+
+ curl still does this, but since this is now an established behavior
+ since forever we cannot change it easily and adding an option for it
+ seems crazy as this protocol is not so little its not worth it. Let's
+ just live with it.
+
+ - Secure Transport disabling hostname validation also disables SNI
+
+ This is an already documented restriction in Secure Transport.
+
+ - CURLOPT_SEEKFUNCTION not called with CURLFORM_STREAM
+
+ The curl_formadd() function is marked and documented as deprecated. No
+ point in collecting bugs for it. It should not be used further.
+
+ - STARTTRANSFER time is wrong for HTTP POSTs
+
+ After close source code inspection I cannot see how this is true or that
+ there is any special treatment for different HTTP methods. We also have
+ not received many further reports on this, making me strongly suspect
+ that this is no (longer an) issue.
+
+ - multipart formposts file name encoding
+
+ The once proposed RFC 5987-encoding is since RFC 7578 documented as MUST
+ NOT be used. The since then implemented MIME API allows the user to set
+ the name on their own and can thus provide it encoded as it wants.
+
+ - DoH is not used for all name resolves when enabled
+
+ It is questionable if users actually want to use DoH for interface and
+ FTP port name resolving. This restriction is now documented and we
+ advice users against using name resolving at all for these functions.
+
+ Closes #10043
+
+- CURLOPT_COOKIEFILE.3: advice => advise
+
+ Closes #10063
+
+ Reviewed-by: Daniel Gustafsson
+
+Daniel Gustafsson (9 Dec 2022)
+
+- curl.h: reword comment to not use deprecated option
+
+ CURLOPT_INFILE was replaced by CURLOPT_READDATA in 7.9.7, reword the
+ comment mentioning it to make code grepping easier as well as improve
+ the documentation.
+
+ Closes: #10062
+ Reviewed-by: Daniel Stenberg
+
+Ryan Schmidt (9 Dec 2022)
+
+- system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
+
+ Change "__MWERKS__" to "macintosh". When this block was originally added
+ in 3ac6929 it was probably intended to handle classic Mac OS since the
+ previous classic Mac OS build procedure for curl (which was removed in
+ bf327a9) used Metrowerks CodeWarrior.
+
+ But there are other classic Mac OS compilers, such as the MPW compilers,
+ that were not handled by this case. For classic Mac OS,
+ CURL_TYPEOF_CURL_SOCKLEN_T needs to match what's provided by the
+ third-party GUSI library, which does not vary by compiler.
+
+ Meanwhile CodeWarrior works on platforms other than classic Mac OS, and
+ they may need different definitions. Separate blocks could be added
+ later for any of those platforms that curl doesn't already support.
+
+ Closes #10049
+
+- vms: remove SIZEOF_SHORT
+
+ The rest of SIZEOF_SHORT was removed in d48dd15.
+
+ See #9291
+ Closes #10061
+
+Daniel Gustafsson (8 Dec 2022)
+
+- tool_formparse: avoid clobbering on function params
+
+ While perfectly legal to do, clobbering function parameters and using
+ them as local variables is confusing at best and rarely improves code
+ readability. Fix by using a local variable instead, no functionality
+ is changed.
+
+ This also renames the parameter from data to mime_data since the term
+ data is (soft) reserved for the easy handle struct.
+
+ Closes: #10046
+ Reviewed-by: Daniel Stenberg
+
+- noproxy: guard against empty hostnames in noproxy check
+
+ When checking for a noproxy setting we need to ensure that we get
+ a hostname passed in. If there is no hostname then there cannot be
+ a matching noproxy rule for it by definition.
+
+ Closes: #10057
+ Reported-by: Geeknik Labs
+ Reviewed-by: Daniel Stenberg
+
+Daniel Stenberg (8 Dec 2022)
+
+- c-hyper: CONNECT respones are not server responses
+
+ Together with d31915a8dbbd it makes test 265 run fine.
+
+ Fixes #8853
+ Assisted-by: Prithvi MK
+ Assisted-by: Sean McArthur
+ Closes #10060
+
+- test265: Use "connection: keep-alive" response header
+
+ When it answers as HTTP/1.0, so that clients (hyper) knows properly that
+ the connection remains intact.
+
+- RELEASE-NOTES: synced
+
+Stefan Eissing (8 Dec 2022)
+
+- cfilter: improve SSL connection checks
+
+ - fixes `Curl_ssl_cf_get_ssl()` to detect also the first filter instance
+ as ssl (refs #10053)
+
+ - replaces `Curl_ssl_use()` with the correct `Curl_conn_is_ssl()`
+
+ Closes #10054
+ Fixes #10053
+
+ Reported-by: Patrick Monnerat
+
+Daniel Stenberg (8 Dec 2022)
+
+- runtests: silence nghttpx errors
+
+ Also, move the output of the nghttpx_h3 info to the general "Env:" line
+ in the test output header.
+
+ Reported-by: Marcel Raad
+ Ref: https://github.com/curl/curl/commit/ca15b7512e8d1199e55fbaa206ef01e64b8f
+ 147d#commitcomment-92015094
+ Closes #10044
+
+Ryan Schmidt (7 Dec 2022)
+
+- config-mac: define HAVE_SYS_IOCTL_H
+
+ This is needed to compile nonblock.c on classic Mac OS with Grand
+ Unified Socket Interface (GUSI) because nonblock.c uses FIONBIO which is
+ defined in which is included by .
+
+ Ref: https://sourceforge.net/projects/gusi/
+
+ Closes https://github.com/curl/curl/pull/10042
+
+Philip Heiduck (7 Dec 2022)
+
+- CI: Change FreeBSD image from 12.3 to 12.4
+
+ Ref: https://www.phoronix.com/news/FreeBSD-12.4-Released
+
+ Closes https://github.com/curl/curl/pull/10051
+
+Ryan Schmidt (7 Dec 2022)
+
+- test1421: fix typo
+
+ Closes https://github.com/curl/curl/pull/10055
+
+Jay Satiro (7 Dec 2022)
+
+- build: assume errno.h is always available
+
+ - Remove errno.h detection from all build configurations.
+
+ errno.h is a standard header according to C89.
+
+ Closes https://github.com/curl/curl/pull/9986
+
+- build: assume assert.h is always available
+
+ - Remove assert.h detection from all build configurations.
+
+ assert.h is a standard header according to C89.
+
+ I had proposed this several years ago as part of a larger change that
+ was abandoned.
+
+ Ref: https://github.com/curl/curl/issues/1237#issuecomment-277500720
+
+ Closes https://github.com/curl/curl/pull/9985
+
+Philip Heiduck (7 Dec 2022)
+
+- CI: LGTM.com will be shut down in December 2022
+
+ Closes #10052
+
+Daniel Stenberg (6 Dec 2022)
+
+- mailmap: Andy Alt
+
+Andy Alt (6 Dec 2022)
+
+- misc: Fix incorrect spelling
+
+ Fix various uses of connnect by replacing them with connect.
+
+ Closes: #10045
+ Reviewed-by: Daniel Stenberg
+ Reviewed-by: Daniel Gustafsson
+
+Stefan Eissing (6 Dec 2022)
+
+- wolfssl: remove special BIO return code handling
+
+ - rely solely on the retry flag in BIO, similar to OpenSSL vtls
+ implementation.
+
+ Ref: https://github.com/curl/curl/pull/10021#issuecomment-1336147053
+
+ Closes #10033
+
+Daniel Stenberg (6 Dec 2022)
+
+- openssl: return -1 on error in the BIO callbacks
+
+ BIO_read and BIO_write return negative numbers on error, including
+ retryable ones. A regression from 55807e6. Both branches should be
+ returning -1.
+
+ The APIs are patterned after POSIX read and write which, similarly,
+ return -1 on errors, not zero, with EAGAIN treated as an error.
+
+ Bug: https://github.com/curl/curl/issues/10013#issuecomment-1335308146
+ Reported-by: David Benjamin
+ Closes #10021
+
+Ryan Schmidt (6 Dec 2022)
+
+- config-mac: remove HAVE_SYS_SELECT_H
+
+ When compiling for classic Mac OS with GUSI, there is no sys/select.h.
+ GUSI provides the "select" function prototype in sys/time.h.
+
+ Closes #10039
+
+- setup: do not require __MRC__ defined for Mac OS 9 builds
+
+ Partially reverts "somewhat protect Mac OS X users from using Mac OS 9
+ config file", commit 62519bfe059251af2914199f284c736553ff0489.
+
+ Do things that are specific to classic Mac OS (i.e. include config-mac.h
+ in curl_setup.h and rename "main" to "curl_main" in tool_setup.h) when
+ only "macintosh" is defined. Remove the additional condition that
+ "__MRC__" should be defined since that would only be true with the MPW
+ MrC compiler which prevents the use of other reasonable compilers like
+ the MPW SC compiler and especially the Metrowerks CodeWarrior compilers.
+ "macintosh" is only defined by classic Mac OS compilers so this change
+ should not affect users of Mac OS X / OS X / macOS / any other OS.
+
+ Closes #10037
+
+- curl.h: name all public function parameters
+
+ Most public function parameters already have names; this adds those
+ that were missing.
+
+ Closes #10036
+
+Andy Alt (6 Dec 2022)
+
+- docs/examples: spell correction ('Retrieve')
+
+ Closes #10040
+
+Daniel Stenberg (6 Dec 2022)
+
+- unit1302: slightly extended
+
+ To test more base64 decoding
+
+- base64: faster base64 decoding
+
+ - by using a lookup table instead of strchr()
+ - by doing full quantums first, then padding
+
+ Closes #10032
+
+Michael Musset (6 Dec 2022)
+
+- libssh2: return error when ssh_hostkeyfunc returns error
+
+ return CURLE_PEER_FAILED_VERIFICATION if verification with the callback
+ return a result different than CURLKHMATCH_OK
+
+ Closes #10034
+
+Viktor Szakats (5 Dec 2022)
+
+- Makefile.mk: improve a GNU Make hack [ci skip]
+
+ Replace the hack of using `$() ` to represent a single space. The new
+ method silences the `--warn-undefined-variables` debug warning and it's
+ also a better-known form of solving this problem.
+
+ Reviewed-by: Jay Satiro
+ Closes #10031
+
+Daniel Stenberg (5 Dec 2022)
+
+- tests/unit/.gitignore: ignore all unit + 4 digits files
+
+- base64: encode without using snprintf
+
+ For speed. In some tests, this approch is 29 times faster!
+
+ Closes #10026
+
+- base64: better alloc size
+
+ The previous algorithm allocated more bytes than necessary.
+
+ Suggested-by: xtonik on github
+ Fixes #10024
+ Closes #10025
+
+Ryan Schmidt (5 Dec 2022)
+
+- config-mac: fix typo: size_T -> size_t
+
+ Both MPW and CodeWarrior compilers complained about this.
+
+ Closes #10029
+
+Daniel Stenberg (3 Dec 2022)
+
+- RELEASE-NOTES: synced
+
+Jakub Zakrzewski (2 Dec 2022)
+
+- CMake: fix build with `CURL_USE_GSSAPI`
+
+ CMAKE_*_LINKER_FLAGS must be a string but GSS_LINKER_FLAGS is a list, so
+ we need to replace semicolons with spaces when setting those.
+
+ Fixes #9017
+ Closes #1022
+
+Max Dymond (2 Dec 2022)
+
+- ci: Reuse fuzzing snippet from curl-fuzzer project
+
+Diogo Teles Sant'Anna (2 Dec 2022)
+
+- GHA: clarify workflows permissions, set least possible privilege
+
+ Set top-level permissions to None on all workflows, setting per-job
+ permissions. This avoids that new jobs inherit unwanted permissions.
+
+ Discussion: https://curl.se/mail/lib-2022-11/0028.html
+
+ Signed-off-by: Diogo Teles Sant'Anna
+
+ Closes #9928
+
+Viktor Szakats (2 Dec 2022)
+
+- Makefile.mk: address minor issues
+
+ - Fix `NROFF` auto-detection with certain shell/make-build combinations:
+
+ When a non-MSYS2 GNU Make runs inside an MSYS2 shell, Make executes
+ the detection command as-is via `CreateProcess()`. It fails because
+ `command` is an `sh` built-in. Ensure to explicitly invoke the shell.
+
+ - Initialize user-customizable variables:
+
+ Silences a list of warnings when running GNU Make with the option
+ `--warn-undefined-variables`. Another benefit is that it's now easy
+ to look up all user-customizable `Makefile.mk` variables by grepping
+ for ` ?=` in the curl source tree.
+
+ Suggested-by: Gisle Vanem
+ Ref: https://github.com/curl/curl/pull/9764#issuecomment-1330674433
+
+ - Fix `MKDIR` invocation:
+
+ Avoid a warning and potential issue in envs without forward-slash
+ support.
+
+ Closes #10000
+
+Rob de Wit (2 Dec 2022)
+
+- curl_get_line: allow last line without newline char
+
+ improve backwards compatibility
+
+ Test 3200 verifies
+
+ Closes #9973
+
+Daniel Stenberg (2 Dec 2022)
+
+- cookie: open cookie jar as a binary file
+
+ On Windows there is a difference and for text files, ^Z means end of
+ file which is not desirable.
+
+ Ref: #9973
+ Closes #10017
+
+- runtests: only do CRLF replacements for hyper if it is HTTP
+
+ Closes #10016
+
+Stefan Eissing (1 Dec 2022)
+
+- openssl: fix for BoringSSL BIO result interpretation mixups
+
+ Reported-by: Robin Marx
+ Fixes #10013
+ Closes #10015
+
+Max Dymond (1 Dec 2022)
+
+- ci: Remove zuul fuzzing job as it's superseded by CIFuzz
+
+Daniel Stenberg (1 Dec 2022)
+
+- runtests: do CRLF replacements per section only
+
+ The `crlf="yes"` attribute and "hyper mode" are now only applied on a
+ subset of dedicated sections: data, datacheck, stdout and protocol.
+
+ Updated test 2500 accordingly.
+
+ Also made test1 use crlf="yes" for , mostly because it is
+ often used as a template test case. Going forward, using this attribute
+ we should be able to write test cases using linefeeds only and avoid
+ mixed line ending encodings.
+
+ Follow-up to ca15b7512e8d11
+
+ Fixes #10009
+ Closes #10010
+
+Stefan Eissing (1 Dec 2022)
+
+- gnutls: use common gnutls init and verify code for ngtcp2
+
+ Closes #10007
+
+Baitinq on github (1 Dec 2022)
+
+- aws_sigv4: fix typos in aws_sigv4.c
+
+ Closes #10008
+
+Kenneth Myhra (30 Nov 2022)
+
+- curl.h: include on SerenityOS
+
+ Closes #10006
+
+Daniel Stenberg (30 Nov 2022)
+
+- openssl: prefix errors with '[lib]/[version]: '
+
+ To help users understand where this (cryptic) error message comes from.
+
+ Suggested-by: Philip Sanetra
+ Ref: #10002
+ Closes #10004
+
+Stefan Eissing (30 Nov 2022)
+
+- tests: add HTTP/3 test case, custom location for proper nghttpx
+
+ - adding support for HTTP/3 test cases via a nghttpx server that is
+ build with ngtcp2 and nghttp3.
+ - test2500 is the first test case, performing a simple GET.
+ - nghttpx is checked for support and the 'feature' nghttpx-h3
+ is set accordingly. test2500 will only run, when supported.
+ - a specific nghttpx location can be given in the environment
+ variable NGHTTPX or via the configure option
+ --with-test-nghttpx=
+
+ Extend NGHTTPX config to H2 tests as well
+
+ * use $ENV{NGHTTPX} and the configured default also in http2 server starts
+ * always provide the empty test/nghttpx.conf to nghttpx. as it defaults to
+ reading /etc/nghttpx/nghttpx.conf otherwise.
+
+ Added nghttpx to CI ngtcp2 jobs to run h3 tests.
+
+ Closes #9031
+
+Daniel Stenberg (30 Nov 2022)
+
+- RELEASE-NOTES: synced
+
+ Removed duplicate after contributors.sh fix: 9967c10b6daa1
+
+- scripts/contributors.sh: strip one OR MORE leading spaces
+
+ From names found credited in commit logs
+
+- RELEASE-NOTES: synced
+
+- openssl/mbedtls: use %d for outputing port with failf (int)
+
+ Coverity CID 1517100
+
+ Also, remove some int typecasts in vtls.c for the port number
+
+ Closes #10001
+
+- KNOWN_BUGS: remove "Multi perform hangs waiting for threaded resolver"
+
+ We now offer a way to avoid that hang, using CURLOPT_QUICK_EXIT.
+
+ Follow-up to 49798cac832ab1 fixed via #9147
+
+ Closes #9999
+
+- KNOWN_BUGS: remove "--interface for ipv6 binds to unusable IP address"
+
+ Since years back the "if2ip" function verifies that it binds to a local IPv6
+ address that uses the same scope as the remote address.
+
+ This is not a bug.
+
+ Fixes #686
+ Closes #9998
+
+- test1276: verify lib/optiontable.pl
+
+ Checks that it generates an output identical to the file.
+
+- lib/optiontable.pl: adapt to CURLOPTDEPRECATED()
+
+ Follow-up from 6967571bf20624bc
+
+ Reported-by: Gisle Vanem
+
+ Fixes #9992
+ Closes #9993
+
+- docs/INSTALL.md: list OSes and CPUs quoted
+
+ to make them skip spellcheck. Also added a new CPU.
+
+ Follow-up to 4506cbf7f24a2a
+
+ Closes #9997
+
+Ikko Ashimine (28 Nov 2022)
+
+- vtls: fix typo in vtls_int.h
+
+ paramter -> parameter
+
+ Closes: #9996
+ Reviewed-by: Daniel Gustafsson
+
+Daniel Stenberg (28 Nov 2022)
+
+- curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
+
+ As OpenSSL's include files are all included using in curl
+ source code, we just risk that existing openssl files will "shadow"
+ include files without path if that path is provided.
+
+ Fixes #9989
+ Closes #9988
+
+- INSTALL: update operating systems and CPU archs
+
+ Update after recent runs on Twitter/Mastodon and my blog
+
+ Closes #9994
+
+Stefan Eissing (28 Nov 2022)
+
+- tls: backends use connection filters for IO, enabling HTTPS-proxy
+
+ - OpenSSL (and compatible)
+ - BearSSL
+ - gnutls
+ - mbedtls
+ - rustls
+ - schannel
+ - secure-transport
+ - wolfSSL (v5.0.0 and newer)
+
+ This leaves only the following without HTTPS-proxy support:
+ - gskit
+ - nss
+ - wolfSSL (versions earlier than v5.0.0)
+
+ Closes #9962
+
+Daniel Stenberg (28 Nov 2022)
+
+- include/curl/curl.h: bump the deprecated requirements to gcc 6.1
+
+ Reported-by: Michael Kaufmann
+ Fixes #9917
+ Closes #9987
+
+Patrick Monnerat (28 Nov 2022)
+
+- mime: relax easy/mime structures binding
+
+ Deprecation and removal of codeset conversion support from the library
+ have released the strict need for an early binding of mime structures to
+ an easy handle (https://github.com/curl/curl/commit/2610142).
+
+ This constraint currently forces to create the handle before the mime
+ structure and the latter cannot be attached to another handle once
+ created (see https://curl.se/mail/lib-2022-08/0027.html).
+
+ This commit removes the handle pointers from the mime structures
+ allowing more flexibility on their use.
+
+ When an easy handle is duplicated, bound mime structures must however
+ still be duplicated too as their components hold send-time dynamic
+ information.
+
+ Closes #9927
+
+fractal-access (26 Nov 2022)
+
+- test416: verify growing FTP file support
+
+ Added setting: RETRSIZE [size] in the section. When set this
+ will cause the test FTP server to return the size set (rather than the
+ actual size) in the acknowledgement from a RETR request.
+
+ Closes #9772
+
+- ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
+
+ When using the option CURLOPT_IGNORE_CONTENT_LENGTH (set.ignorecl in
+ code) to support growing files in FTP, the code should ignore the
+ initial size it gets from the server as this will not be the final size
+ of the file. This is done in ftp_state_quote() to prevent a size request
+ being issued in the initial sequence. However, in a later call to
+ ftp_state_get_resp() the code attempts to get the size of the content
+ again if it doesn't already have it, by parsing the response from the
+ RETR request. This fix prevents this parsing of the response to get the
+ size when the set.ignorecl option is set. This should maintain the size
+ value as -1, unknown, in this situation.
+
+ Closes #9772
+
+Stefan Eissing (26 Nov 2022)
+
+- cfilter: re-add `conn` as parameter to cfilter setup methods
+
+ - `Curl_ssl_get_config()` now returns the first config if no SSL proxy
+ filter is active
+
+ - socket filter starts connection only on first invocation of its
+ connect method
+
+ Fixes #9982
+ Closes #9983
+
+Daniel Stenberg (26 Nov 2022)
+
+- KNOWN_BUGS: remove five FTP related issues
+
+ - "FTP with CONNECT and slow server"
+
+ I believe this is not a problem these days.
+
+ - "FTP with NULs in URL parts"
+
+ The FTP protocol does not support them properly anyway.
+
+ - remove "FTP and empty path parts in the URL"
+
+ I don't think this has ever been reported as a real problem but was only
+ a hypothetical one.
+
+ - "Premature transfer end but healthy control channel"
+
+ This is not a bug, this is an optimization that *could* be performed but is
+ not an actual problem.
+
+ - "FTP without or slow 220 response"
+
+ Instead add to the documentation of the connect timeout that the
+ connection is considered complete at TCP/TLS/QUIC layer.
+
+ Closes #9979
+
+Stefan Eissing (26 Nov 2022)
+
+- tests: add authorityInfoAccess to generated certs
+
+ Generate stunnel.pem as well
+
+ Closes #9980
+
+Daniel Stenberg (25 Nov 2022)
+
+- runtests: --no-debuginfod now disables DEBUGINFOD_URLS
+
+ Prior to this change, DEBUGINFOD_URLS was always disabled by runtests
+ due to a report of it slowing down tests. However, some setups need it
+ to fetch debug symbols, and if it is disabled on those systems then curl
+ tests with valgrind will fail.
+
+ Reported-by: Mark Gaiser
+
+ Ref: #8805
+ Closes #9950
+
+Casey Bodley (25 Nov 2022)
+
+- test/aws_sigv4: test cases for content-sha256
+
+ 1956 adds the sha256 value corresponding to an empty buffer
+ 1957 adds an arbitrary value and confirms that the signature differs from 195
+ 6
+ 1958 adds whitespace to 1957 and confirms that the signature matches 1957
+ 1959 adds a value longer than 'char sha_hex[65]' in Curl_output_aws_sigv4()
+
+ Signed-off-by: Casey Bodley
+
+ Closes #9804
+
+- aws_sigv4: consult x-%s-content-sha256 for payload hash
+
+ `Curl_output_aws_sigv4()` doesn't always have the whole payload in
+ memory to generate a real payload hash. this commit allows the user to
+ pass in a header like `x-amz-content-sha256` to provide their desired
+ payload hash
+
+ some services like s3 require this header, and may support other values
+ like s3's `UNSIGNED-PAYLOAD` and `STREAMING-AWS4-HMAC-SHA256-PAYLOAD`
+ with special semantics. servers use this header's value as the payload
+ hash during signature validation, so it must match what the client uses
+ to generate the signature
+
+ CURLOPT_AWS_SIGV4.3 now describes the content-sha256 interaction
+
+ Signed-off-by: Casey Bodley
+
+ Closes #9804
+
+Philip Heiduck (25 Nov 2022)
+
+- GHA: NSS use clang instead of clang-9
+
+ Closes #9978
+
+Daniel Stenberg (25 Nov 2022)
+
+- RELEASE-NOTES: synced
+
+- tool_operate: override the numeric locale and set "C" by force
+
+ Makes curl always use dot as decimal separator for options,
+ independently of what the locale says. Makes scripts and command lines
+ portable.
+
+ Updated docs accordingly.
+
+ Reported-by: Daniel Faust
+
+ Fixes #9969
+ Closes #9972
+
+- test1662: verify formpost, 301 redirect, no rewind possible
+
+ Reproduces #9735 and verifies the subsequent fix. The original issue
+ uses a pipe that cannot be rewound, but this test case instead sets a
+ callback without rewind ability to get roughly the same properties but
+ being a much more portable test.
+
+- lib: rewind BEFORE request instead of AFTER previous
+
+ This makes a big difference for cases when the rewind is not actually
+ necessary to perofm (for example HTTP response code 301 converts to GET)
+ and therefore the rewind can be avoided. In particular for situations
+ when that rewind fails, for example when reading from a pipe or similar.
+
+ Reported-by: Ali Utku Selen
+
+ Fixes #9735
+ Closes #9958
+
+- vtls: repair build with disabled proxy
+
+ Closes #9974
+
+Daniel Gustafsson (23 Nov 2022)
+
+- packaging: remove traces of deleted files
+
+ Commit a8861b6cc removed packages/DOS but left a few traces of it
+ which broke the distcheck CI. Remove all traces.
+
+ Closes: #9971
+ Reviewed-by: Daniel Stenberg
+
+- openssl: silence compiler warning when not using IPv6
+
+ In non-IPv6 builds the conn parameter is unused, and compilers which
+ run with "-Werror=unused-parameter" (or similar) warnings turned on
+ fails to build. Below is an excerpt from a CI job:
+
+ vtls/openssl.c: In function ‘Curl_ossl_verifyhost’:
+ vtls/openssl.c:2016:75: error: unused parameter ‘conn’ [-Werror=unused-
+ parameter]
+ 2016 | CURLcode Curl_ossl_verifyhost(struct Curl_easy *data, struct connec
+ tdata *conn,
+ | ~~~~~~~~~~~~~
+ ~~~~~~~^~~~
+
+ Closes: #9970
+ Reviewed-by: Daniel Stenberg
+
+- netware: remove leftover traces
+
+ Commit 3b16575ae938dec2a29454631a12aa52b6ab9c67 removed support for
+ building on Novell Netware, but a few leftover traces remained. This
+ removes the last bits.
+
+ Closes: #9966
+ Reviewed-by: Daniel Stenberg
+
+Ryan Schmidt (23 Nov 2022)
+
+- curl_endian: remove Curl_write64_le from header
+
+ The actual function was already removed in 4331c6dc.
+
+ See #7280
+ Closes #9968
+
+Daniel Stenberg (22 Nov 2022)
+
+- docs: add more "SEE ALSO" links to CA related pages
+
+ Closes #9959
+
+- examples: update descriptions
+
+ Make them not say "this is an example showing..." and instead just say
+ what the example shows.
+
+ Closes #9960
+
+Stefan Eissing (22 Nov 2022)
+
+- vtls: localization of state data in filters
+
+ - almost all backend calls pass the Curl_cfilter intance instead of
+ connectdata+sockindex
+ - ssl_connect_data is remove from struct connectdata and made internal
+ to vtls
+ - ssl_connect_data is allocated in the added filter, kept at cf->ctx
+
+ - added function to let a ssl filter access its ssl_primary_config and
+ ssl_config_data this selects the propert subfields in conn and data,
+ for filters added as plain or proxy
+ - adjusted all backends to use the changed api
+ - adjusted all backends to access config data via the exposed
+ functions, no longer using conn or data directly
+
+ cfilter renames for clear purpose:
+
+ - methods `Curl_conn_*(data, conn, sockindex)` work on the complete
+ filter chain at `sockindex` and connection `conn`.
+ - methods `Curl_cf_*(cf, ...)` work on a specific Curl_cfilter
+ instance.
+ - methods `Curl_conn_cf()` work on/with filter instances at a
+ connection.
+ - rebased and resolved some naming conflicts
+ - hostname validation (und session lookup) on SECONDARY use the same
+ name as on FIRST (again).
+
+ new debug macros and removing connectdata from function signatures where not
+ needed.
+
+ adapting schannel for new Curl_read_plain paramter.
+
+ Closes #9919
+
+Daniel Stenberg (22 Nov 2022)
+
+- examples/10-at-a-time: fix possible skipped final transfers
+
+ Prior to this change if curl_multi_perform returned 0 running handles
+ and then all remaining transfers were added, then the perform loop would
+ end immediately without performing those transfers.
+
+ Reported-by: Mikhail Kuznetsov
+
+ Fixes https://github.com/curl/curl/issues/9953
+ Closes https://github.com/curl/curl/pull/9954
+
+Viktor Szakats (22 Nov 2022)
+
+- Makefile.mk: portable Makefile.m32
+
+ Update bare GNU Make `Makefile.m32` to:
+
+ - Move objects into a subdirectory.
+ - Add support for MS-DOS. Tested with DJGPP.
+ - Add support for Watt-32 (on MS-DOS).
+ - Add support for AmigaOS.
+ - Rename `Makefile.m32` to `Makefile.mk`
+ - Replace `ARCH` with `TRIPLET`.
+ - Build `tool_hugehelp.c` proper (when tools are available).
+ - Drop MS-DOS compatibility macro `USE_ZLIB` (replaced by `HAVE_LIBZ`)
+ - Add support for `ZLIB_LIBS` to override `-lz`.
+ - Omit object files when building examples.
+ - Default `CC` to `gcc` once again, for convenience. (Caveat: compiler
+ name `cc` cannot be set now.)
+ - Set `-DCURL_NO_OLDIES` for examples, like autotools does.
+ - Delete `makefile.dj` files. Notice the configuration details and
+ defaults are not retained with the new method.
+ - Delete `makefile.amiga` files. A successful build needs a few custom
+ options. We're also not retaining all build details from the existing
+ Amiga make files.
+ - Rename `Makefile.m32` to `Makefile.mk` to reflect that they are not
+ Windows/MinGW32-specific anymore.
+ - Add support for new `CFG` options: `-map`, `-debug`, `-trackmem`
+ - Set `-DNDEBUG` by default.
+ - Allow using `-DOS=...` in all `lib/config-*.h` headers, syncing this
+ with `config-win32.h`.
+ - Look for zlib parts in `ZLIB_PATH/include` and `ZLIB_PATH/lib`
+ instead of bare `ZLIB_PATH`.
+
+ Note that existing build configurations for MS-DOS and AmigaOS likely
+ become incompatible with this change.
+
+ Example AmigaOS configuration:
+ ```
+ export CROSSPREFIX=/opt/amiga/bin/m68k-amigaos-
+ export CC=gcc
+ export CPPFLAGS='-DHAVE_PROTO_BSDSOCKET_H'
+ export CFLAGS='-mcrt=clib2'
+ export LDFLAGS="${CFLAGS}"
+ export LIBS='-lnet -lm'
+ make -C lib -f Makefile.mk
+ make -C src -f Makefile.mk
+ ```
+
+ Example MS-DOS configuration:
+ ```
+ export CROSSPREFIX=/opt/djgpp/bin/i586-pc-msdosdjgpp-
+ export WATT_PATH=/opt/djgpp/net/watt
+ export ZLIB_PATH=/opt/djgpp
+ export OPENSSL_PATH=/opt/djgpp
+ export OPENSSL_LIBS='-lssl -lcrypt'
+ export CFG=-zlib-ssl
+ make -C lib -f Makefile.mk
+ make -C src -f Makefile.mk
+ ```
+
+ Closes #9764
+
+Stefan Eissing (22 Nov 2022)
+
+- cfiler: filter types have flags indicating what they do
+
+ - Adding Curl_conn_is_ip_connected() to check if network connectivity
+ has been reached
+
+ - having ftp wait for network connectivity before proceeding with
+ transfers.
+
+ Fixes test failures 1631 and 1632 with hyper.
+
+ Closes #9952
+
+Daniel Stenberg (21 Nov 2022)
+
+- RELEASE-NOTES: synced
+
+Jay Satiro (20 Nov 2022)
+
+- sendf: change Curl_read_plain to wrap Curl_recv_plain (take 2)
+
+ Prior to this change Curl_read_plain would attempt to read the
+ socket directly. On Windows that's a problem because recv data may be
+ cached by libcurl and that data is only drained using Curl_recv_plain.
+
+ Rather than rewrite Curl_read_plain to handle cached recv data, I
+ changed it to wrap Curl_recv_plain, in much the same way that
+ Curl_write_plain already wraps Curl_send_plain.
+
+ Curl_read_plain -> Curl_recv_plain
+ Curl_write_plain -> Curl_send_plain
+
+ This fixes a bug in the schannel backend where decryption of arbitrary
+ TLS records fails because cached recv data is never drained. We send
+ data (TLS records formed by Schannel) using Curl_write_plain, which
+ calls Curl_send_plain, and that may do a recv-before-send
+ ("pre-receive") to cache received data. The code calls Curl_read_plain
+ to read data (TLS records from the server), which prior to this change
+ did not call Curl_recv_plain and therefore cached recv data wasn't
+ retrieved, resulting in malformed TLS records and decryption failure
+ (SEC_E_DECRYPT_FAILURE).
+
+ The bug has only been observed during Schannel TLS 1.3 handshakes. Refer
+ to the issue and PR for more information.
+
+ --
+
+ This is take 2 of the original fix. It preserves the original behavior
+ of Curl_read_plain to write 0 to the bytes read parameter on error,
+ since apparently some callers expect that (SOCKS tests were hanging).
+ The original fix which landed in 12e1def5 and was later reverted in
+ 18383fbf failed to work properly because it did not do that.
+
+ Also, it changes Curl_write_plain the same way to complement
+ Curl_read_plain, and it changes Curl_send_plain to return -1 instead of
+ 0 on CURLE_AGAIN to complement Curl_recv_plain.
+
+ Behavior on error with these changes:
+
+ Curl_recv_plain returns -1 and *code receives error code.
+ Curl_send_plain returns -1 and *code receives error code.
+ Curl_read_plain returns error code and *n (bytes read) receives 0.
+ Curl_write_plain returns error code and *written receives 0.
+
+ --
+
+ Ref: https://github.com/curl/curl/issues/9431#issuecomment-1312420361
+
+ Assisted-by: Joel Depooter
+ Reported-by: Egor Pugin
+
+ Fixes https://github.com/curl/curl/issues/9431
+ Closes https://github.com/curl/curl/pull/9949
+
+Sean McArthur (19 Nov 2022)
+
+- hyper: classify headers as CONNECT and 1XX
+
+ Closes #9947
+
+Stefan Eissing (19 Nov 2022)
+
+- ftp: fix "AUTH TLS" on primary conn and for SSL in PASV second conn
+
+ Follow-up to dafdb20a26d0c89
+
+ Reported-by: Anthony Hu
+ Closes #9948
+
+Jay Satiro (19 Nov 2022)
+
+- CURLOPT_POST.3: Explain setting to 0 changes request type
+
+ Bug: https://github.com/curl/curl/issues/9849
+ Reported-by: MonkeybreadSoftware@users.noreply.github.com
+
+ Closes https://github.com/curl/curl/pull/9942
+
+Daniel Stenberg (19 Nov 2022)
+
+- docs/INSTALL.md: expand on static builds
+
+ Remove from KNOWN_BUGS
+
+ Closes #9944
+
+Stefan Eissing (19 Nov 2022)
+
+- http: restore h3 to working condition after connection filter introduction
+
+ Follow-up to dafdb20a26d0c
+
+ HTTP/3 needs a special filter chain, since it does the TLS handling
+ itself. This PR adds special setup handling in the HTTP protocol handler
+ that takes are of it.
+
+ When a handler, in its setup method, installs filters, the default
+ behaviour for managing the filter chain is overridden.
+
+ Reported-by: Karthikdasari0423 on github
+
+ Fixes #9931
+ Closes #9945
+
+Daniel Stenberg (18 Nov 2022)
+
+- urldata: change port num storage to int and unsigned short
+
+ Instead of long.
+
+ Closes #9946
+
+- Revert "sendf: change Curl_read_plain to wrap Curl_recv_plain"
+
+ This reverts commit 12e1def51a75392df62e65490416007d7e68dab9.
+
+ It introduced SOCKS proxy fails, like test 700 never ending.
+
+ Reopens #9431
+
+- HTTP-COOKIES.md: update the 6265bis link to draft-11
+
+ Closes #9940
+
+- docs/WEBSOCKET.md: explain the URL use
+
+ Fixes #9936
+ Closes #9941
+
+Jay Satiro (18 Nov 2022)
+
+- sendf: change Curl_read_plain to wrap Curl_recv_plain
+
+ Prior to this change Curl_read_plain would attempt to read the
+ socket directly. On Windows that's a problem because recv data may be
+ cached by libcurl and that data is only drained using Curl_recv_plain.
+
+ Rather than rewrite Curl_read_plain to handle cached recv data, I
+ changed it to wrap Curl_recv_plain, in much the same way that
+ Curl_write_plain already wraps Curl_send_plain.
+
+ Curl_read_plain -> Curl_recv_plain
+ Curl_write_plain -> Curl_send_plain
+
+ This fixes a bug in the schannel backend where decryption of arbitrary
+ TLS records fails because cached recv data is never drained. We send
+ data (TLS records formed by Schannel) using Curl_write_plain, which
+ calls Curl_send_plain, and that may do a recv-before-send
+ ("pre-receive") to cache received data. The code calls Curl_read_plain
+ to read data (TLS records from the server), which prior to this change
+ did not call Curl_recv_plain and therefore cached recv data wasn't
+ retrieved, resulting in malformed TLS records and decryption failure
+ (SEC_E_DECRYPT_FAILURE).
+
+ The bug has only been observed during Schannel TLS 1.3 handshakes. Refer
+ to the issue and PR for more information.
+
+ Ref: https://github.com/curl/curl/issues/9431#issuecomment-1312420361
+
+ Assisted-by: Joel Depooter
+ Reported-by: Egor Pugin
+
+ Fixes https://github.com/curl/curl/issues/9431
+ Closes https://github.com/curl/curl/pull/9904
+
+- test3026: reduce runtime in legacy mingw builds
+
+ - Load Windows system libraries secur32 and iphlpapi beforehand, so
+ that libcurl's repeated global init/cleanup only increases/decreases
+ the library's refcount rather than causing it to load/unload.
+
+ Assisted-by: Marc Hoersken
+
+ Closes https://github.com/curl/curl/pull/9412
+
+Daniel Stenberg (18 Nov 2022)
+
+- url: move back the IDN conversion of proxy names
+
+ Regression: in commit 53bcf55 we moved the IDN conversion calls to
+ happen before the HSTS checks. But the HSTS checks are only done on the
+ server host name, not the proxy names. By moving the proxy name IDN
+ conversions, we accidentally broke the verbose output showing the proxy
+ name.
+
+ This change moves back the IDN conversions for the proxy names to the
+ place in the code path they were before 53bcf55.
+
+ Reported-by: Andy Stamp
+ Fixes #9937
+ Closes #9939
+
+Alexandre Ferrieux (18 Nov 2022)
+
+- CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
+
+ Fixes #2975
+ Closes #9147
+
+Daniel Stenberg (17 Nov 2022)
+
+- HTTP-COOKIES.md: mention that http://localhost is a secure context
+
+ Reported-by: Trail of Bits
+
+ Closes #9938
+
+- lib: parse numbers with fixed known base 10
+
+ ... instead of using 0 argument that allows decimal, hex or octal when
+ the number is documented and assumed to use base 10.
+
+ Closes #9933
+
+- RELEASE-NOTES: synced
+
+- scripts/delta: adapt to curl.h changes for the opt counter
+
+- cookie: expire cookies at once when max-age is negative
+
+ Update test 329 to verify
+
+ Reported-by: godmar on github
+ Fixes #9930
+ Closes #9932
+
+Stefan Eissing (17 Nov 2022)
+
+- proxy: haproxy filter is only available when PROXY and HTTP are
+
+ Closes #9935
+
+Daniel Stenberg (16 Nov 2022)
+
+- OtherTests.cmake: check for cross-compile, not for toolchain
+
+ Build systems like vcpkg alway sets `CMAKE_TOOLCHAIN_FILE` so it should
+ not be used as a sign that this is a cross-compile.
+
+ Also indented the function correctly.
+
+ Reported-by: Philip Chan
+ Fixes #9921
+ Closes #9923
+
+- ntlm: improve comment for encrypt_des
+
+ Reported-by: Andrei Rybak
+ Fixes #9903
+ Closes #9925
+
+- include/curl/curl.h: bump the deprecated requirements to gcc 5.3
+
+ Reported-by: Stephan Guilloux
+ Fixes #9917
+ Closes #9918
+
+Stefan Eissing (15 Nov 2022)
+
+- proxy: refactor haproxy protocol handling as connection filter
+
+ Closes #9893
+
+Patrick Monnerat (15 Nov 2022)
+
+- lib: feature deprecation warnings in gcc >= 4.3
+
+ Add a deprecated attribute to functions and enum values that should not
+ be used anymore.
+ This uses a gcc 4.3 dialect, thus is only available for this version of
+ gcc and newer. Note that the _Pragma() keyword is introduced by C99, but
+ is available as part of the gcc dialect even when compiling in C89 mode.
+
+ It is still possible to disable deprecation at a calling module compile
+ time by defining CURL_DISABLE_DEPRECATION.
+
+ Gcc type checking macros are made aware of possible deprecations.
+
+ Some testing support Perl programs are adapted to the extended
+ declaration syntax.
+
+ Several test and unit test C programs intentionally use deprecated
+ functions/options and are annotated to not generate a warning.
+
+ New test 1222 checks the deprecation status in doc and header files.
+
+ Closes #9667
+
+Daniel Stenberg (15 Nov 2022)
+
+- log2changes.pl: wrap long lines at 80 columns
+
+ Also, only use author names in the output.
+
+ Fixes #9896
+ Reported-by: John Sherrill
+ Closes #9897
+
+- cfilters: use %zu for outputting size_t
+
+ Detected by Coverity CID 1516894
+
+ Closes #9907
+
+- Curl_closesocket: avoid using 'conn' if NULL
+
+ ... in debug-only code.
+
+ Reported by Coverity CID 1516896
+
+ Closes #9907
+
+- url: only acknowledge fresh_reuse for non-followed transfers
+
+ ... to make sure NTLM auth sticks to the connection it needs, as
+ verified by 2032.
+
+ Follow-up to fa0b9227616e
+
+ Assisted-by: Stefan Eissing
+ Closes #9905
+
+- netrc.d: provide mutext info
+
+ Reported-by: xianghongai on github
+ Fixes #9899
+ Closes #9901
+
+- cmdline-opts/page-footer: remove long option nroff formatting
+
+ As gen.pl adds them
+
+- nroff-scan.pl: detect double highlights
+
+- cmdline-opts/gen.pl: fix the linkifier
+
+ Improved logic for finding existing --options in text and replacing with
+ the full version with nroff syntax. This also makes the web version link
+ options better.
+
+ Reported-by: xianghongai on github
+ Fixes #9899
+ Closes #9902
+
+Patrick Monnerat (14 Nov 2022)
+
+- tool: use feature names instead of bit mask, when possible
+
+ If the run-time libcurl is too old to support feature names, the name
+ array is created locally from the bit masks. This is the only sequence
+ left that uses feature bit masks.
+
+ Closes #9583
+
+- docs: curl_version_info is not thread-safe before libcurl initialization
+
+ Closes #9583
+
+- version: add a feature names array to curl_version_info_data
+
+ Field feature_names contains a null-terminated sorted array of feature
+ names. Bitmask field features is deprecated.
+
+ Documentation is updated. Test 1177 and tests/version-scan.pl updated to
+ match new documentation format and extended to check feature names too.
+
+ Closes #9583
+
+Stefan Eissing (14 Nov 2022)
+
+- negtelnetserver.py: have it call its close() method
+
+ Closes #9894
+
+Nathan Moinvaziri (13 Nov 2022)
+
+- ntlm: silence ubsan warning about copying from null target_info pointer.
+
+ runtime error: null pointer passed as argument 2, which is declared to
+ never be null
+
+ Closes #9898
+
+Daniel Stenberg (12 Nov 2022)
+
+- RELEASE-NOTES: synced
+
+Stefan Eissing (12 Nov 2022)
+
+- Websocket: fixes for partial frames and buffer updates.
+
+ - buffers updated correctly when handling partial frames
+ - callbacks no longer invoked for incomplete payload data of 0 length
+ - curl_ws_recv no longer returns with 0 length partial payload
+
+ Closes #9890
+
+Daniel Stenberg (12 Nov 2022)
+
+- tool_operate: provide better errmsg for -G with bad URL
+
+ If the URL that -G would try to add a query to could not be parsed, it would
+ display
+
+ curl: (27) Out of memory
+
+ It now instead shows:
+
+ curl: (2) Could not parse the URL, failed to set query
+
+ Reported-by: Alex Xu
+ Fixes #9889
+ Closes #9892
+
+- vtls: fix build without proxy support
+
+ Follow-up to dafdb20a26d0c890
+
+ Closes #9895
+
+- tool_getparam: make --no-get work as the opposite of --get
+
+ ... as documented.
+
+ Closes #9891
+
+- http: mark it 'this_is_a_follow' in the Location: logic
+
+ To make regular auth "reloads" to not count as redirects.
+
+ Verified by test 3101
+
+ Fixes #9885
+ Closes #9887
+
+Viktor Szakats (11 Nov 2022)
+
+- config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
+
+ The previously set default value of 8 (64-bit) is only correct for
+ mingw-w64 and only when we set `_FILE_OFFSET_BITS` to 64 (the default
+ when building curl). For MSVC, old MinGW and other Windows compilers,
+ the correct value is 4 (32-bit). Adjust condition accordingly. Also
+ drop the manual override option.
+
+ Regression in 7.86.0 (from 68fa9bf3f5d7b4fcbb57619f70cb4aabb79a51f6)
+
+ Bug: https://github.com/curl/curl/pull/9712#issuecomment-1307330551
+
+ Reported-by: Peter Piekarski
+ Reviewed-by: Jay Satiro
+
+ Closes #9872
+
+Daniel Stenberg (11 Nov 2022)
+
+- lib: remove bad set.opt_no_body assignments
+
+ This struct field MUST remain what the application set it to, so that
+ handle reuse and handle duplication work.
+
+ Instead, the request state bit 'no_body' is introduced for code flows
+ that need to change this in run-time.
+
+ Closes #9888
+
+Stefan Eissing (11 Nov 2022)
+
+- lib: connection filters (cfilter) addition to curl:
+
+ - general construct/destroy in connectdata
+ - default implementations of callback functions
+ - connect: cfilters for connect and accept
+ - socks: cfilter for socks proxying
+ - http_proxy: cfilter for http proxy tunneling
+ - vtls: cfilters for primary and proxy ssl
+ - change in general handling of data/conn
+ - Curl_cfilter_setup() sets up filter chain based on data settings,
+ if none are installed by the protocol handler setup
+ - Curl_cfilter_connect() boot straps filters into `connected` status,
+ used by handlers and multi to reach further stages
+ - Curl_cfilter_is_connected() to check if a conn is connected,
+ e.g. all filters have done their work
+ - Curl_cfilter_get_select_socks() gets the sockets and READ/WRITE
+ indicators for multi select to work
+ - Curl_cfilter_data_pending() asks filters if the have incoming
+ data pending for recv
+ - Curl_cfilter_recv()/Curl_cfilter_send are the general callbacks
+ installed in conn->recv/conn->send for io handling
+ - Curl_cfilter_attach_data()/Curl_cfilter_detach_data() inform filters
+ and addition/removal of a `data` from their connection
+ - adding vtl functions to prevent use of Curl_ssl globals directly
+ in other parts of the code.
+
+ Reviewed-by: Daniel Stenberg
+ Closes #9855
+
+- curl-rustls.m4: on macOS, rustls also needs the Security framework
+
+ Closes #9883
+
+Daniel Stenberg (10 Nov 2022)
+
+- rtsp: only store first_host once
+
+ Suggested-by: Erik Janssen
+ URL: https://github.com/curl/curl/pull/9870#issuecomment-1309499744
+ Closes #9882
+
+Fata Nugraha (10 Nov 2022)
+
+- test3028: verify PROXY
+
+- http: do not send PROXY more than once
+
+ Unlike `CONNECT`, currently we don't keep track whether `PROXY` is
+ already sent or not. This causes `PROXY` header to be sent twice during
+ `MSTATE_TUNNELING` and `MSTATE_PROTOCONNECT`.
+
+ Closes #9878
+ Fixes #9442
+
+Jay Satiro (10 Nov 2022)
+
+- lib: add CURL_WRITEFUNC_ERROR to signal write callback error
+
+ Prior to this change if the user wanted to signal an error from their
+ write callbacks they would have to use logic to return a value different
+ from the number of bytes (nmemb) passed to the callback. Also, the
+ inclination of some users has been to just return 0 to signal error,
+ which is incorrect as that may be the number of bytes passed to the
+ callback.
+
+ To remedy this the user can now return CURL_WRITEFUNC_ERROR instead.
+
+ Ref: https://github.com/curl/curl/issues/9873
+
+ Closes https://github.com/curl/curl/pull/9874
+
+Daniel Stenberg (9 Nov 2022)
+
+- Revert "GHA: add scorecard.yml"
+
+ This reverts commit ca76c79b34f9d90105674a2151bf228ff7b13bef.
+
+- GHA: add scorecard.yml
+
+ add a "scorecard" scanner job
+
+Lorenzo Miniero (9 Nov 2022)
+
+- test3100: RTSP Basic authentication
+
+ Closes #9449
+
+Daniel Stenberg (9 Nov 2022)
+
+- rtsp: fix RTSP auth
+
+ Verified with test 3100
+
+ Fixes #4750
+ Closes #9870
+
+- KNOWN_BUGS: remove eight entries
+
+ - 1.2 Multiple methods in a single WWW-Authenticate: header
+
+ This is not considered a bug anymore but a restriction and one that we
+ keep because we have NEVER gotten this reported by users in the wild and
+ because of this I consider this a fringe edge case we don't need to
+ support.
+
+ - 1.6 Unnecessary close when 401 received waiting for 100
+
+ This is not a bug, but possibly an optimization that *can* be done.
+
+ - 1.7 Deflate error after all content was received
+
+ This is not a curl bug. This happens due to broken servers.
+
+ - 2.1 CURLINFO_SSL_VERIFYRESULT has limited support
+
+ This is not a bug. This is just the nature of the implementation.
+
+ - 2.2 DER in keychain
+
+ This is not a bug.
+
+ - 5.7 Visual Studio project gaps
+
+ This is not a bug.
+
+ - 15.14 cmake build is not thread-safe
+
+ Fixed in 109e9730ee5e2b
+
+ - 11.3 Disconnects do not do verbose
+
+ This is not a bug.
+
+ Closes #9871
+
+Hirotaka Tagawa (9 Nov 2022)
+
+- headers: add endif comments
+
+ Closes #9853
+
+Daniel Stenberg (8 Nov 2022)
+
+- test1221: verify --url-query
+
+- curl: add --url-query
+
+ This option adds a piece of data, usually a name + value pair, to the
+ end of the URL query part. The syntax is identical to that used for
+ --data-urlencode with one extension:
+
+ If the argument starts with a '+' (plus), the rest of the string is
+ provided as-is unencoded.
+
+ This allows users to "build" query parts with options and URL encoding
+ even when not doing GET requests, which the already provided option -G
+ (--get) is limited to.
+
+ This idea was born in a Twitter thread.
+
+ Closes #9691
+
+- maketgz: set the right version in lib/libcurl.plist
+
+ Follow-up to e498a9b1fe5964a18eb2a3a99dc52
+
+ Make sure the tarball gets a version of the libcurl.plist file that is
+ updated with the new version string.
+
+ Reported-by: jvreelanda on github
+ Fixes #9866
+ Closes #9867
+
+- RELEASE-NOTES: synced
+
+ Bumped version to 7.87.0
+
+Michael Drake (8 Nov 2022)
+
+- curl.h: add CURLOPT_CA_CACHE_TIMEOUT option
+
+ Adds a new option to control the maximum time that a cached
+ certificate store may be retained for.
+
+ Currently only the OpenSSL backend implements support for
+ caching certificate stores.
+
+ Closes #9620
+
+- openssl: reduce CA certificate bundle reparsing by caching
+
+ Closes #9620
+
+Rose (8 Nov 2022)
+
+- lib: fix some type mismatches and remove unneeded typecasts
+
+ Many of these castings are unneeded if we change the variables to work
+ better with each other.
+
+ Ref: https://github.com/curl/curl/pull/9823
+
+ Closes https://github.com/curl/curl/pull/9835
+
+Daniel Stenberg (8 Nov 2022)
+
+- cookie: compare cookie prefixes case insensitively
+
+ Adapted to language in rfc6265bis draft-11.
+
+ Closes #9863
+
+ Reviewed-by: Daniel Gustafsson
+
+- tool_operate: when aborting, make sure there is a non-NULL error buffer
+
+ To store custom errors in. Or SIGSEGVs will follow.
+
+ Reported-by: Trail of Bits
+ Closes #9865
+
+- WEBSOCKET.md: fix broken link
+
+ Reported-by: Felipe Gasper
+ Bug: https://curl.se/mail/lib-2022-10/0097.html
+ Closes #9864
+
+- CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
+
+ Reported-by: Oskar Sigvardsson
+
+ Bug: https://curl.se/mail/lib-2022-11/0016.html
+
+ Closes #9862
+
+Stefan Eissing (7 Nov 2022)
+
+- websockets: fix handling of partial frames
+
+ buffer used and send length calculations are fixed when a partial
+ websocket frame has been received.
+
+ Closes #9861
+
+Daniel Stenberg (7 Nov 2022)
+
+- mailmap: unify Stefan Eissing
+
+Stefan Eissing (7 Nov 2022)
+
+- hyper: fix handling of hyper_task's when reusing the same address
+
+ Fixes #9840
+ Closes #9860
+
+Jay Satiro (7 Nov 2022)
+
+- ws: return CURLE_NOT_BUILT_IN when websockets not built in
+
+ - Change curl_ws_recv & curl_ws_send to return CURLE_NOT_BUILT_IN when
+ websockets support is not built in.
+
+ Prior to this change they returned CURLE_OK.
+
+ Closes #9851
+
+Daniel Stenberg (7 Nov 2022)
+
+- noproxy: tailmatch like in 7.85.0 and earlier
+
+ A regfression in 7.86.0 (via 1e9a538e05c010) made the tailmatch work
+ differently than before. This restores the logic to how it used to work:
+
+ All names listed in NO_PROXY are tailmatched against the used domain
+ name, if the lengths are identical it needs a full match.
+
+ Update the docs, update test 1614.
+
+ Reported-by: Stuart Henderson
+ Fixes #9842
+ Closes #9858
+
+- configure: require fork for NTLM-WB
+
+ Reported-by: ウさん
+
+ Fixes #9847
+ Closes #9856
+
+- docs/EARLY-RELEASE.md: how to determine an early release
+
+ URL: https://curl.se/mail/lib-2022-10/0079.html
+
+ Closes #9820
+
+- RELEASE-NOTES: synced
+
+Zespre Schmidt (3 Nov 2022)
+
+- docs: add missing parameters for --retry flag
+
+ Closes #9848
+
+Adam Averay (3 Nov 2022)
+
+- libcurl-errors.3: remove duplicate word
+
+ Closes #9846
+
+Eric Vigeant (3 Nov 2022)
+
+- cur_path: do not add '/' if homedir ends with one
+
+ When using SFTP and a path relative to the user home, do not add a
+ trailing '/' to the user home dir if it already ends with one.
+
+ Closes #9844
+
+Viktor Szakats (1 Nov 2022)
+
+- windows: fail early with a missing windres in autotools
+
+ `windres` is not always auto-detected by autotools when building for
+ Windows. When this happened, the build failed with a confusing error due
+ to the empty `RC` command:
+
+ ```
+ /bin/bash ../libtool --tag=RC --mode=compile -I../include -DCURL_EMBED_MANIF
+ EST -i curl.rc -o curl.o
+ [...]
+ Usage: /sandbox/curl/libtool [OPTION]... [MODE-ARG]...
+ Try 'libtool --help' for more information.
+ libtool: error: unrecognised option: '-I../include'
+ ```
+
+ Improve this by verifying if `RC` is set, and fail with a clear error
+ otherwise.
+
+ Follow-up to 6de7322c03d5b4d91576a7d9fc893e03cc9d1057
+
+ Ref: https://curl.se/mail/lib-2022-10/0049.html
+ Reported-by: Thomas Glanzmann
+ Closes #9781
+
+- lib: sync guard for Curl_getaddrinfo_ex() definition and use
+
+ `Curl_getaddrinfo_ex()` gets _defined_ with `HAVE_GETADDRINFO` set. But,
+ `hostip4.c` _used_ it with `HAVE_GETADDRINFO_THREADSAFE` set alone. It
+ meant a build with the latter, but without the former flag could result
+ in calling this function but not defining it, and failing to link.
+
+ Patch this by adding an extra check for `HAVE_GETATTRINFO` around the
+ call.
+
+ Before this patch, build systems prevented this condition. Now they
+ don't need to.
+
+ While here, simplify the related CMake logic on Windows by setting
+ `HAVE_GETADDRINFO_THREADSAFE` to the detection result of
+ `HAVE_GETADDRINFO`. This expresses the following intent clearer than
+ the previous patch and keeps the logic in a single block of code:
+ When we have `getaddrinfo()` on Windows, it's always threadsafe.
+
+ Follow-up to 67d88626d44ec04b9e11dca4cfbf62cd29fe9781
+
+ Reviewed-by: Jay Satiro
+ Closes #9734
+
+- tidy-up: process.h detection and use
+
+ This patch aims to cleanup the use of `process.h` header and the macro
+ `HAVE_PROCESS_H` associated with it.
+
+ - `process.h` is always available on Windows. In curl, it is required
+ only for `_beginthreadex()` in `lib/curl_threads.c`.
+
+ - `process.h` is also available in MS-DOS. In curl, its only use was in
+ `lib/smb.c` for `getpid()`. But `getpid()` is in fact declared by
+ `unistd.h`, which is always enabled via `lib/config-dos.h`. So the
+ header is not necessary.
+
+ - `HAVE_PROCESS_H` was detected by CMake, forced to 1 on Windows and
+ left to real detection for other platforms.
+ It was also set to always-on in `lib/config-win32.h` and
+ `lib/config-dos.h`.
+ In autotools builds, there was no detection and the macro was never
+ set.
+
+ Based on these observations, in this patch we:
+
+ - Rework Windows `getpid` logic in `lib/smb.c` to always use the
+ equivalent direct Win32 API function `GetCurrentProcessId()`, as we
+ already did for Windows UWP apps. This makes `process.h` unnecessary
+ here on Windows.
+
+ - Stop #including `process.h` into files where it was not necessary.
+ This is everywhere, except `lib/curl_threads.c`.
+
+ > Strangely enough, `lib/curl_threads.c` compiled fine with autotools
+ > because `process.h` is also indirecty included via `unistd.h`. This
+ > might have been broken in autotools MSVC builds, where the latter
+ > header is missing.
+
+ - Delete all remaining `HAVE_PROCESS_H` feature guards, for they were
+ unnecessary.
+
+ - Delete `HAVE_PROCESS_H` detection from CMake and predefined values
+ from `lib/config-*.h` headers.
+
+ Reviewed-by: Jay Satiro
+ Closes #9703
+
+Daniel Stenberg (1 Nov 2022)
+
+- lib1301: unit103 turned into a libtest
+
+ It is not a unit test so moved over to libtests.
+
+- strcase: use curl_str(n)equal for case insensitive matches
+
+ No point in having two entry points for the same functions.
+
+ Also merged the *safe* function treatment into these so that they can
+ also be used when one or both pointers are NULL.
+
+ Closes #9837
+
+- README.md: remove badges and xmas-tree garnish
+
+ URL: https://curl.se/mail/lib-2022-10/0050.html
+
+ Closes #9833
+
+Patrick Monnerat (1 Nov 2022)
+
+- gen.pl: do not generate CURLHELP bitmask lines > 79 characters
+
+ If a command line option is in many help categories, there is a risk
+ that CURLHELP bitmask source lines generated for listhelp are longer
+ than 79 characters.
+
+ This change takes care of folding such long lines.
+
+ Cloes #9834
+
+Marc Hoersken (30 Oct 2022)
+
+- CI/cirrus: remove superfluous double-quotes and sudo
+
+ Follow up to #9565 and #9677
+ Closes #9738
+
+- tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
+
+ Ref: #9738
+
+Daniel Stenberg (30 Oct 2022)
+
+- style: use space after comment start and before comment end
+
+ /* like this */
+
+ /*not this*/
+
+ checksrc is updated accordingly
+
+ Closes #9828
+
+Patrick Schlangen (30 Oct 2022)
+
+- docs: remove performance note in CURLOPT_SSL_VERIFYPEER
+
+ This note became obsolete since PR #7892 (see also discussion in the PR
+ comments).
+
+ Closes #9832
+
+Daniel Stenberg (30 Oct 2022)
+
+- tests/server: make use of strcasecompare from lib/
+
+ ... instead of having a second private implementation.
+
+ Idea triggered by #9830
+
+ Closes #9831
+
+- curl: timeout in the read callback
+
+ The read callback can timeout if there's nothing to read within the
+ given maximum period. Example use case is when doing "curl -m 3
+ telnet://example.com" or anything else that expects input on stdin or
+ similar that otherwise would "hang" until something happens and then not
+ respect the timeout.
+
+ This fixes KNOWN_BUG 8.1, first filed in July 2009.
+
+ Bug: https://sourceforge.net/p/curl/bugs/846/
+
+ Closes #9815
+
+- noproxy: fix tail-matching
+
+ Also ignore trailing dots in both host name and comparison pattern.
+
+ Regression in 7.86.0 (from 1e9a538e05c0)
+
+ Extended test 1614 to verify better.
+
+ Reported-by: Henning Schild
+ Fixes #9821
+ Closes #9822
+
+- docs: explain the noproxy CIDR notation support
+
+ Follow-up to 1e9a538e05c0107c
+
+ Closes #9818
+
+Jon Rumsey (27 Oct 2022)
+
+- os400: use platform socklen_t in Curl_getnameinfo_a
+
+ Curl_getnameinfo_a() is prototyped before including curl.h as an
+ ASCII'fied wrapper for getnameinfo(), which itself is prototyped with
+ socklen_t arguments, so this should use the platform socklen_t and not
+ curl_socklen_t too.
+
+ Update setup-os400.h
+
+ Fixes #9811
+ Closes #9812
+
+Daniel Stenberg (27 Oct 2022)
+
+- noproxy: also match with adjacent comma
+
+ If the host name is an IP address and the noproxy string contained that
+ IP address with a following comma, it would erroneously not match.
+
+ Extended test 1614 to verify this combo as well.
+
+ Reported-by: Henning Schild
+
+ Fixes #9813
+ Closes #9814
+
+Randall S. Becker (27 Oct 2022)
+
+- build: fix for NonStop
+
+ - Include arpa/inet.h in all units where htonl is called.
+
+ Signed-off-by: Randall S. Becker
+
+ Closes https://github.com/curl/curl/pull/9816
+
+- system.h: support 64-bit curl_off_t for NonStop 32-bit
+
+ - Correctly define curl_off_t on NonStop (ie __TANDEM) ia64 and x86 for
+ 32-bit builds.
+
+ Signed-off-by: Randall S. Becker
+
+ Closes https://github.com/curl/curl/pull/9817
+
+Daniel Stenberg (27 Oct 2022)
+
+- spellcheck.words: remove 'github' as an accepted word
+
+ Prefer the properly cased version: GitHub
+
+ Use markdown for links and GitHub in text.
+
+ Closes #9810
+
+Ayesh Karunaratne (27 Oct 2022)
+
+- misc: typo and grammar fixes
+
+ - Replace `Github` with `GitHub`.
+ - Replace `windows` with `Windows`
+ - Replace `advice` with `advise` where a verb is used.
+ - A few fixes on removing repeated words.
+ - Replace `a HTTP` with `an HTTP`
+
+ Closes #9802
+
+Viktor Szakats (27 Oct 2022)
+
+- windows: fix linking .rc to shared curl with autotools
+
+ `./configure --enable-shared --disable-static` fails when trying to link
+ a shared `curl.exe`, due to `libtool` magically changing the output
+ filename of `windres` to one that it doesn't find when linking:
+
+ ```
+ /bin/sh ../libtool --tag=RC --mode=compile windres -I../../curl/include -DCUR
+ L_EMBED_MANIFEST -i ../../curl/src/curl.rc -o curl.o
+ libtool: compile: windres -I../../curl/include -DCURL_EMBED_MANIFEST -i ../.
+ ./curl/src/curl.rc -o .libs/curl.o
+ [...]
+ CCLD curl.exe
+ clang: error: no such file or directory: 'curl.o'
+ ```
+
+ Let's resolve this by skipping `libtool` and calling `windres` directly
+ when building `src` (aka `curl.exe`). Leave `lib` unchanged, as it does
+ need the `libtool` magic. This solution is compatible with building
+ a static `curl.exe`.
+
+ This build scenario is not CI-tested.
+
+ While here, delete an obsolete comment about a permanent `libtool`
+ warning that we've resolved earlier.
+
+ Regression from 6de7322c03d5b4d91576a7d9fc893e03cc9d1057
+
+ Reported-by: Christoph Reiter
+ Fixes #9803
+ Closes #9805
+
+- cmake: really enable warnings with clang
+
+ Even though `PICKY_COMPILER=ON` is the default, warnings were not
+ enabled when using llvm/clang, because `CMAKE_COMPILER_IS_CLANG` was
+ always false (in my tests at least).
+
+ This is the single use of this variable in curl, and in a different
+ place we already use `CMAKE_C_COMPILER_ID MATCHES "Clang"`, which works
+ as expected, so change the condition to use that instead.
+
+ Also fix the warnings uncovered by the above:
+
+ - lib: add casts to silence clang warnings
+
+ - schannel: add casts to silence clang warnings in ALPN code
+
+ Assuming the code is correct, solve the warnings with a cast.
+ This particular build case isn't CI tested.
+
+ There is a chance the warning is relevant for some platforms, perhaps
+ Windows 32-bit ARM7.
+
+ Closes #9783
+
+Joel Depooter (26 Oct 2022)
+
+- sendf: remove unnecessary if condition
+
+ At this point, the psnd->buffer will always exist. We have already
+ allocated a new buffer if one did not previously exist, and returned
+ from the function if the allocation failed.
+
+ Closes #9801
+
+Viktor Szakats (26 Oct 2022)
+
+- winidn: drop WANT_IDN_PROTOTYPES
+
+ `WANT_IDN_PROTOTYPES` was necessary to avoid using a header that came
+ via an optional package. MS stopped distributing this package some
+ years ago and the winidn definitions are part of standard headers (via
+ `windows.h`) since Vista.
+
+ Auto-detect Vista inside `lib/idn_win32.c` and enable the manual
+ definitions if building for an older Windows.
+
+ This allows to delete this manual knob from all build-systems.
+
+ Also drop the `_SAL_VERSION` sub-case:
+
+ Our manual definitions are now only enabled with old systems. We assume
+ that code analysis is not run on such systems, allowing us to delete the
+ SAL-friendly flavour of these.
+
+ Reviewed-by: Jay Satiro
+ Closes #9793
+
+Daniel Stenberg (26 Oct 2022)
+
+- misc: remove duplicated include files
+
+ Closes #9796
+
+- scripts/checksrc.pl: detect duplicated include files
+
+ After an idea by Dan Fandrich in #9794
+
+ Closes #9796
+
+- RELEASE-NOTES: synced
+
+ And bumped version to 7.86.1 for now
+
+- CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
+
+ The removal is brief or long, don't assume.
+
+ Reported-by: Luca Niccoli
+
+ Fixes #9799
+ Closes #9800
+
+Version 7.86.0 (26 Oct 2022)
+
+Daniel Stenberg (26 Oct 2022)
+
+- RELEASE: synced
+
+ The 7.86.0 release
+
+- THANKS: added from the 7.86.0 release
+
+Viktor Szakats (25 Oct 2022)
+
+- noproxy: include netinet/in.h for htonl()
+
+ Solve the Amiga build warning by including `netinet/in.h`.
+
+ `krb5.c` and `socketpair.c` are using `htonl()` too. This header is
+ already included in those sources.
+
+ Regression from 1e9a538e05c0107c54ef81d9de7cd0b27cd13309
+
+ Reviewed-by: Daniel Stenberg
+ Closes #9787
+
+Marc Hoersken (24 Oct 2022)
+
+- CI: fix AppVeyor status failing for starting jobs
+
+Daniel Stenberg (24 Oct 2022)
+
+- test445: verifies the protocols-over-http-proxy flaw and fix
+
+- http_proxy: restore the protocol pointer on error
+
+ Reported-by: Trail of Bits
+
+ Closes #9790
+
+- multi: remove duplicate include of connect.h
+
+ Reported-by: Martin Strunz
+ Fixes #9794
+ Closes #9795
+
+Daniel Gustafsson (24 Oct 2022)
+
+- idn: fix typo in test description
+
+ s/enabked/enabled/i
+
+Daniel Stenberg (24 Oct 2022)
+
+- url: use IDN decoded names for HSTS checks
+
+ Reported-by: Hiroki Kurosawa
+
+ Closes #9791
+
+- unit1614: fix disabled-proxy build
+
+ Follow-up to 1e9a538e05c01
+
+ Closes #9792
+
+Daniel Gustafsson (24 Oct 2022)
+
+- cookies: optimize control character check
+
+ When checking for invalid octets the strcspn() call will return the
+ position of the first found invalid char or the first NULL byte.
+ This means that we can check the indicated position in the search-
+ string saving a strlen() call.
+
+ Closes: #9736
+ Reviewed-by: Jay Satiro
+
+Daniel Stenberg (24 Oct 2022)
+
+- netrc: replace fgets with Curl_get_line
+
+ Make the parser only accept complete lines and avoid problems with
+ overly long lines.
+
+ Reported-by: Hiroki Kurosawa
+
+ Closes #9789
+
+- RELEASE-NOTES: add "Planned upcoming removals include"
+
+ URL: https://curl.se/mail/archive-2022-10/0001.html
+
+ Suggested-by: Dan Fandrich
+
+Viktor Szakats (23 Oct 2022)
+
+- ci: bump to gcc-11 for macos
+
+ Ref: https://github.blog/changelog/2022-10-03-github-actions-jobs-running-on-
+ macos-latest-are-now-running-on-macos-12/
+ Ref: https://github.com/actions/runner-images/blob/main/images/macos/macos-12
+ -Readme.md
+
+ Reviewed-by: Max Dymond
+ Closes #9785
+
+- Makefile.m32: reintroduce CROSSPREFIX and -W -Wall [ci skip]
+
+ - Reintroduce `CROSSPREFIX`:
+
+ If set, we add it to the `CC` and `AR` values, and to the _default_
+ value of `RC`, which is `windres`. This allows to control each of
+ these individidually, while also allowing to simplify configuration
+ via `CROSSPREFIX`.
+
+ This variable worked differently earlier. Hopefully this new solution
+ hits a better compromise in usefulness/complexity/flexibility.
+
+ Follow-up to: aa970c4c08775afcd0c2853be89b0a6f02582d50
+
+ - Enable warnings again:
+
+ This time with an option to override it via `CFLAGS`. Warnings are
+ also enabled by default in CMake, `makefile.dj` and `makefile.amiga`
+ builds (not in autotools though).
+
+ Follow-up to 10fbd8b4e3f83b967fd9ad9a41ab484c0e7e7ca3
+
+ Closes #9784
+
+- noproxy: silence unused variable warnings with no ipv6
+
+ Follow-up to 36474f1050c7f4117e3c8de6cc9217cfebfc717d
+
+ Reviewed-by: Daniel Stenberg
+ Closes #9782
+
+Daniel Stenberg (22 Oct 2022)
+
+- test644: verify --xattr (with redirect)
+
+- tool_xattr: save the original URL, not the final redirected one
+
+ Adjusted test 1621 accordingly.
+
+ Reported-by: Viktor Szakats
+ Fixes #9766
+ Closes #9768
+
+- docs: make sure libcurl opts examples pass in long arguments
+
+ Reported-by: Sergey
+ Fixes #9779
+ Closes #9780
+
+Marc Hoersken (21 Oct 2022)
+
+- CI: fix AppVeyor job links only working for most recent build
+
+ Ref: https://github.com/curl/curl/pull/9768#issuecomment-1286675916
+ Reported-by: Daniel Stenberg
+
+ Follow up to #9769
+
+Viktor Szakats (21 Oct 2022)
+
+- noproxy: fix builds without AF_INET6
+
+ Regression from 1e9a538e05c0107c54ef81d9de7cd0b27cd13309
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9778
+
+Daniel Stenberg (21 Oct 2022)
+
+- noproxy: support proxies specified using cidr notation
+
+ For both IPv4 and IPv6 addresses. Now also checks IPv6 addresses "correctly"
+ and not with string comparisons.
+
+ Split out the noproxy checks and functionality into noproxy.c
+
+ Added unit test 1614 to verify checking functions.
+
+ Reported-by: Mathieu Carbonneaux
+
+ Fixes #9773
+ Fixes #5745
+ Closes #9775
+
+- urlapi: remove two variable assigns
+
+ To please scan-build:
+
+ urlapi.c:1163:9: warning: Value stored to 'qlen' is never read
+ qlen = Curl_dyn_len(&enc);
+ ^ ~~~~~~~~~~~~~~~~~~
+ urlapi.c:1164:9: warning: Value stored to 'query' is never read
+ query = u->query = Curl_dyn_ptr(&enc);
+ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+ Follow-up to 7d6cf06f571d57
+
+ Closes #9777
+
+Jeremy Maitin-Shepard (21 Oct 2022)
+
+- cmake: improve usability of CMake build as a sub-project
+
+ - Renames `uninstall` -> `curl_uninstall`
+ - Ensures all export rules are guarded by CURL_ENABLE_EXPORT_TARGET
+
+ Closes #9638
+
+Don J Olmstead (21 Oct 2022)
+
+- easy_lock: check for HAVE_STDATOMIC_H as well
+
+ The check for `HAVE_STDATOMIC_H` looks to see if the `stdatomic.h`
+ header is present.
+
+ Closes #9755
+
+Daniel Stenberg (21 Oct 2022)
+
+- RELEASE-NOTES: synced
+
+Brad Harder (20 Oct 2022)
+
+- CURLMOPT_PIPELINING.3: dedup manpage xref
+
+ Closes #9776
+
+Marc Hoersken (20 Oct 2022)
+
+- CI: report AppVeyor build status for each job
+
+ Also give each job on AppVeyor CI a human-readable name.
+
+ This aims to make job and therefore build failures more visible.
+
+ Reviewed-by: Marcel Raad
+ Closes #9769
+
+Viktor Szakats (20 Oct 2022)
+
+- amiga: set SIZEOF_CURL_OFF_T=8 by default [ci skip]
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9771
+
+- connect: fix builds without AF_INET6
+
+ Regression from 2b309560c1e5d6ed5c0e542e6fdffa968b0521c9
+
+ Reviewed-by: Daniel Stenberg
+ Reviewed-by: Jay Satiro
+
+ Closes #9770
+
+Daniel Stenberg (20 Oct 2022)
+
+- test1105: adjust to work with a hyper build
+
+ Closes #9767
+
+- urlapi: fix parsing URL without slash with CURLU_URLENCODE
+
+ When CURLU_URLENCODE is set, the parser would mistreat the path
+ component if the URL was specified without a slash like in
+ http://local.test:80?-123
+
+ Extended test 1560 to reproduce and verify the fix.
+
+ Reported-by: Trail of Bits
+
+ Closes #9763
+
+Marc Hoersken (19 Oct 2022)
+
+- tests: avoid CreateThread if _beginthreadex is available
+
+ CreateThread is not threadsafe if mixed with CRT calls.
+ _beginthreadex on the other hand can be mixed with CRT.
+
+ Reviewed-by: Marcel Raad
+ Closes #9705
+
+Joel Depooter (19 Oct 2022)
+
+- schannel: Don't reset recv/send function pointers on renegotiation
+
+ These function pointers will have been set when the initial TLS
+ handshake was completed. If they are unchanged, there is no need to set
+ them again. If they have been changed, as is the case with HTTP/2, we
+ don't want to override that change. That would result in the
+ http22_recv/send functions being completely bypassed.
+
+ Prior to this change a connection that uses Schannel with HTTP/2 would
+ fail on renegotiation with error "Received HTTP/0.9 when not allowed".
+
+ Fixes https://github.com/curl/curl/issues/9451
+ Closes https://github.com/curl/curl/pull/9756
+
+Viktor Szakats (18 Oct 2022)
+
+- hostip: guard PF_INET6 use
+
+ Some platforms (e.g. Amiga OS) do not have `PF_INET6`. Adjust the code
+ for these.
+
+ ```
+ hostip.c: In function 'fetch_addr':
+ hostip.c:308:12: error: 'PF_INET6' undeclared (first use in this function)
+ pf = PF_INET6;
+ ^~~~~~~~
+ ```
+
+ Regression from 1902e8fc511078fb5e26fc2b907b4cce77e1240d
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9760
+
+- amiga: do not hardcode openssl/zlib into the os config [ci skip]
+
+ Enable them in `lib/makefile.amiga` and `src/makefile.amiga` instead.
+
+ This allows builds without openssl and/or zlib. E.g. with the
+ cross-compiler.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9762
+
+- amigaos: add missing curl header [ci skip]
+
+ Without it, `CURLcode` and `CURLE_*` are undefined. `lib/hostip.h` and
+ conditional local code need them.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9761
+
+Daniel Stenberg (18 Oct 2022)
+
+- cmdline/docs: add a required 'multi' keyword for each option
+
+ The keyword specifies how option works when specified multiple times:
+
+ - single: the last provided value replaces the earlier ones
+ - append: it supports being provided multiple times
+ - boolean: on/off values
+ - mutex: flag-like option that disable anoter flag
+
+ The 'gen.pl' script then outputs the proper and unified language for
+ each option's multi-use behavior in the generated man page.
+
+ The multi: header is requires in each .d file and will cause build error
+ if missing or set to an unknown value.
+
+ Closes #9759
+
+- CURLOPT_AUTOREFERER.3: highlight the privacy leak risk
+
+ Closes #9757
+
+- mprintf: reject two kinds of precision for the same argument
+
+ An input like "%.*1$.9999d" would first use the precision taken as an
+ argument *and* then the precision specified in the string, which is
+ confusing and wrong. pass1 will now instead return error on this double
+ use.
+
+ Adjusted unit test 1398 to verify
+
+ Reported-by: Peter Goodman
+
+ Closes #9754
+
+- ftp: remove redundant if
+
+ Reported-by: Trail of Bits
+
+ Closes #9753
+
+- tool_operate: more transfer cleanup after parallel transfer fail
+
+ In some circumstances when doing parallel transfers, the
+ single_transfer_cleanup() would not be called and then 'inglob' could
+ leak.
+
+ Test 496 verifies
+
+ Reported-by: Trail of Bits
+ Closes #9749
+
+- mqtt: spell out CONNECT in comments
+
+ Instead of calling it 'CONN' in several comments, use the full and
+ correct protocol packet name.
+
+ Suggested by Trail of Bits
+
+ Closes #9751
+
+- CURLOPT_POSTFIELDS.3: refer to CURLOPT_MIMEPOST
+
+ Not the deprecated CURLOPT_HTTPPOST option.
+
+ Also added two see-alsos.
+
+ Reported-by: Trail of Bits
+ Closes #9752
+
+- RELEASE-NOTES: synced
+
+Jay Satiro (17 Oct 2022)
+
+- ngtcp2: Fix build errors due to changes in ngtcp2 library
+
+ ngtcp2/ngtcp2@b0d86f60 changed:
+
+ - ngtcp2_conn_get_max_udp_payload_size =>
+ ngtcp2_conn_get_max_tx_udp_payload_size
+
+ - ngtcp2_conn_get_path_max_udp_payload_size =>
+ ngtcp2_conn_get_path_max_tx_udp_payload_size
+
+ ngtcp2/ngtcp2@ec59b873 changed:
+
+ - 'early_data_rejected' member added to ng_callbacks.
+
+ Assisted-by: Daniel Stenberg
+ Reported-by: jurisuk@users.noreply.github.com
+
+ Fixes https://github.com/curl/curl/issues/9747
+ Closes https://github.com/curl/curl/pull/9748
+
+Daniel Stenberg (16 Oct 2022)
+
+- curl_path: return error if given a NULL homedir
+
+ Closes #9740
+
+- libssh: if sftp_init fails, don't get the sftp error code
+
+ This flow extracted the wrong code (sftp code instead of ssh code), and
+ the code is sometimes (erroneously) returned as zero anyway, so skip
+ getting it and set a generic error.
+
+ Reported-by: David McLaughlin
+ Fixes #9737
+ Closes #9740
+
+- mqtt: return error for too long topic
+
+ Closes #9744
+
+Rickard Hallerbäck (16 Oct 2022)
+
+- tool_paramhlp: make the max argument a 'double'
+
+ To fix compiler warnings "Implicit conversion from 'long' to 'double'
+ may lose precision"
+
+ Closes #9700
+
+Philip Heiduck (15 Oct 2022)
+
+- cirrus-ci: add more macOS builds with m1 based on x86_64 builds
+
+ Also refactor macOS builds to use task matrix.
+
+ Assisted-by: Marc Hörsken
+ Closes #9565
+
+Viktor Szakats (14 Oct 2022)
+
+- cmake: set HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID on Windows
+
+ `lib/config-win32.h` enables this configuration option unconditionally.
+ Make it apply to CMake builds as well.
+
+ While here, delete a broken check for
+ `HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID` from `CMakeLists.txt`. This came with
+ the initial commit [1], but did not include the actual verification code
+ inside `CMake/CurlTests.c`, so it always failed. A later commit [2]
+ added a second test, for non-Windows platforms.
+
+ Enabling this flag causes test 1056 to fail with CMake builds, as they
+ do with autotools builds. Let's apply the same solution and ignore the
+ results here as well.
+
+ [1] 4c5307b45655ba75ab066564afdc0c111a8b9291
+ [2] aec7c5a87c8482b6ddffa352d7d220698652262e
+
+ Reviewed-by: Daniel Stenberg
+ Assisted-by: Marcel Raad
+
+ Closes #9726
+
+- cmake: set HAVE_GETADDRINFO_THREADSAFE on Windows
+
+ autotools enables this configuration option unconditionally for Windows
+ [^1]. Do the same in CMake.
+
+ The above will make this work for all reasonably recent environments.
+ The logic present in `lib/config-win32.h` [^2] has the following
+ exceptions which we did not cover in this CMake update:
+
+ - Builds targeting Windows 2000 and earlier
+ - MS Visual C++ 5.0 (1997) and earlier
+
+ Also make sure to disable this feature when `HAVE_GETADDRINFO` isn't
+ set, to avoid a broken build. We might want to handle that in the C
+ sources in a future commit.
+
+ [^1]: https://github.com/curl/curl/blob/68fa9bf3f5d7b4fcbb57619f70cb4aabb79a5
+ 1f6/m4/curl-functions.m4#L2067-L2070
+
+ [^2]: https://github.com/curl/curl/blob/68fa9bf3f5d7b4fcbb57619f70cb4aabb79a5
+ 1f6/lib/config-win32.h#L511-L528
+
+ Closes #9727
+
+- cmake: sync HAVE_SIGNAL detection with autotools
+
+ `HAVE_SIGNAL` means the availability of the `signal()` function in
+ autotools, while in CMake it meant the availability of that function
+ _and_ the symbol `SIGALRM`.
+
+ The latter is not available on Windows, but the function is, which means
+ on Windows, autotools did define `HAVE_SIGNAL`, but CMake did not,
+ introducing a slight difference into the binaries.
+
+ This patch syncs CMake behaviour with autotools to look for the function
+ only.
+
+ The logic came with the initial commit adding CMake support to curl, so
+ the commit history doesn't reveal the reason behind it. In any case,
+ it's best to check the existence of `SIGALRM` directly in the source
+ before use. For now, curl builds fine with `HAVE_SIGNAL` enabled and
+ `SIGALRM` missing.
+
+ Follow-up to 68fa9bf3f5d7b4fcbb57619f70cb4aabb79a51f6
+
+ Closes #9725
+
+- cmake: delete duplicate HAVE_GETADDRINFO test
+
+ A custom `HAVE_GETADDRINFO` check came with the initial CMake commit
+ [1]. A later commit [2] added a standard check for it as well. The
+ standard check run before the custom one, so CMake ignored the latter.
+
+ The custom check was also non-portable, so this patch deletes it in
+ favor of the standard check.
+
+ [1] 4c5307b45655ba75ab066564afdc0c111a8b9291
+ [2] aec7c5a87c8482b6ddffa352d7d220698652262e
+
+ Closes #9731
+
+Daniel Stenberg (14 Oct 2022)
+
+- tool_formparse: unroll the NULL_CHECK and CONST_FREE macros
+
+ To make the code read more obvious
+
+ Assisted-by: Jay Satiro
+
+ Closes #9710
+
+Christopher Sauer (14 Oct 2022)
+
+- docs/INSTALL: update Android Instructions for newer NDKs
+
+ Closes #9732
+
+Daniel Stenberg (14 Oct 2022)
+
+- markdown-uppercase: ignore quoted sections
+
+ Sections within the markdown ~~~ or ``` are now ignored.
+
+ Closes #9733
+
+- RELEASE-NOTES: synced
+
+- test8: update as cookies no longer can have "embedded" TABs in content
+
+- test1105: extend to verify TAB in name/content discarding cookies
+
+- cookie: reject cookie names or content with TAB characters
+
+ TABs in name and content seem allowed by RFC 6265: "the algorithm strips
+ leading and trailing whitespace from the cookie name and value (but
+ maintains internal whitespace)"
+
+ Cookies with TABs in the names are rejected by Firefox and Chrome.
+
+ TABs in content are stripped out by Firefox, while Chrome discards the
+ whole cookie.
+
+ TABs in cookies also cause issues in saved netscape cookie files.
+
+ Reported-by: Trail of Bits
+
+ URL: https://curl.se/mail/lib-2022-10/0032.html
+ URL: https://github.com/httpwg/http-extensions/issues/2262
+
+ Closes #9659
+
+- curl/add_parallel_transfers: better error handling
+
+ 1 - consider the transfer handled at once when in the function, to avoid
+ the same list entry to get added more than once in rare error
+ situations
+
+ 2 - set the ERRORBUFFER for the handle first after it has been added
+ successfully
+
+ Reported-by: Trail of Bits
+
+ Closes #9729
+
+- netrc: remove the two 'changed' arguments
+
+ As no user of these functions used the returned content.
+
+- test495: verify URL encoded user name + netrc-optional
+
+ Reproduced issue #9709
+
+- netrc: use the URL-decoded user
+
+ When the user name is provided in the URL it is URL encoded there, but
+ when used for authentication the encoded version should be used.
+
+ Regression introduced after 7.83.0
+
+ Reported-by: Jonas Haag
+ Fixes #9709
+ Closes #9715
+
+Shaun Mirani (13 Oct 2022)
+
+- url: allow non-HTTPS HSTS-matching for debug builds
+
+ Closes #9728
+
+Daniel Stenberg (13 Oct 2022)
+
+- test1275: remove the check of stderr
+
+ To avoid the mysterious test failures on Windows, instead rely on the
+ error code returned on failure.
+
+ Fixes #9716
+ Closes #9723
+
+Viktor Szakats (13 Oct 2022)
+
+- lib: set more flags in config-win32.h
+
+ The goal is to add any flag that affect the created binary, to get in
+ sync with the ones built with CMake and autotools.
+
+ I took these flags from curl-for-win [0], where they've been tested with
+ mingw-w64 and proven to work well.
+
+ This patch brings them to curl as follows:
+
+ - Enable unconditionally those force-enabled via
+ `CMake/WindowsCache.cmake`:
+
+ - `HAVE_SETJMP_H`
+ - `HAVE_STRING_H`
+ - `HAVE_SIGNAL` (CMake equivalent is `HAVE_SIGNAL_FUNC`)
+
+ - Expand existing guards with mingw-w64:
+
+ - `HAVE_STDBOOL_H`
+ - `HAVE_BOOL_T`
+
+ - Enable Win32 API functions for Windows Vista and later:
+
+ - `HAVE_INET_NTOP`
+ - `HAVE_INET_PTON`
+
+ - Set sizes, if not already set:
+
+ - `SIZEOF_OFF_T = 8`
+ - `_FILE_OFFSET_BITS = 64` when `USE_WIN32_LARGE_FILES` is set,
+ and using mingw-w64.
+
+ - Add the remaining for mingw-w64 only. Feel free to expand as desired:
+
+ - `HAVE_LIBGEN_H`
+ - `HAVE_FTRUNCATE`
+ - `HAVE_BASENAME`
+ - `HAVE_STRTOK_R`
+
+ Future TODO:
+
+ - `HAVE_SIGNAL` has a different meaning in CMake. It's enabled when both
+ the `signal()` function and the `SIGALRM` macro are found. In
+ autotools and this header, it means the function only. For the
+ function alone, CMake uses `HAVE_SIGNAL_FUNC`.
+
+ [0] https://github.com/curl/curl-for-win/blob/c9b9a5f273c94c73d2b565ee892c4df
+ f0ca97a8c/curl-m32.sh#L53-L58
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9712
+
+Daniel Stenberg (13 Oct 2022)
+
+- tests: add tests/markdown-uppercase.pl to dist tarball
+
+ Follow-up to aafb06c5928183d
+
+ Closes #9722
+
+- tool_paramhelp: asserts verify maximum sizes for string loading
+
+ The two defines MAX_FILE2MEMORY and MAX_FILE2STRING define the largest
+ strings accepted when loading files into memory, but as the size is
+ later used as input to functions that take the size as 'int' as
+ argument, the sizes must not be larger than INT_MAX.
+
+ These two new assert()s make the code error out if someone would bump
+ the sizes without this consideration.
+
+ Reported-by Trail of Bits
+
+ Closes #9719
+
+- http: try parsing Retry-After: as a number first
+
+ Since the date parser allows YYYYMMDD as a date format (due to it being
+ a bit too generic for parsing this particular header), a large integer
+ number could wrongly match that pattern and cause the parser to generate
+ a wrong value.
+
+ No date format accepted for this header starts with a decimal number, so
+ by reversing the check and trying a number first we can deduct that if
+ that works, it was not a date.
+
+ Reported-by Trail of Bits
+
+ Closes #9718
+
+Patrick Monnerat (13 Oct 2022)
+
+- doc: fix deprecation versions inconsistencies
+
+ Ref: https://curl.se/mail/lib-2022-10/0026.html
+
+ Closes #9711
+
+Daniel Stenberg (13 Oct 2022)
+
+- http_aws_sigv4: fix strlen() check
+
+ The check was off-by-one leading to buffer overflow.
+
+ Follow-up to 29c4aa00a16872
+
+ Detected by OSS-Fuzz
+
+ Closes #9714
+
+- curl/main_checkfds: check the fcntl return code better
+
+ fcntl() can (in theory) return a non-zero number for success, so a
+ better test for error is checking for -1 explicitly.
+
+ Follow-up to 41e1b30ea1b77e9ff
+
+ Mentioned-by: Dominik Klemba
+
+ Closes #9708
+
+Viktor Szakats (12 Oct 2022)
+
+- tidy-up: delete unused HAVE_STRUCT_POLLFD
+
+ It was only defined in `lib/config-win32.h`, when building for Vista.
+
+ It was only used in `select.h`, in a condition that also included a
+ check for `POLLIN` which is a superior choice for this detection and
+ which was already used by cmake and autotools builds.
+
+ Delete both instances of this macro.
+
+ Closes #9707
+
+Daniel Stenberg (12 Oct 2022)
+
+- test1275: verify upercase after period in markdown
+
+ Script based on the #9474 pull-request logic, but implemented in perl.
+
+ Updated docs/URL-SYNTAX.md accordingly.
+
+ Suggested-by: Dan Fandrich
+
+ Closes #9697
+
+12932 (12 Oct 2022)
+
+- misc: nitpick grammar in comments/docs
+
+ because the 'u' in URL is actually a consonant *sound* it is only
+ correct to write "a URL"
+
+ sorry this is a bit nitpicky :P
+
+ https://english.stackexchange.com/questions/152/when-should-i-use-a-vs-an
+ https://www.techtarget.com/whatis/feature/Which-is-correct-a-URL-or-an-URL
+
+ Closes #9699
+
+Viktor Szakats (11 Oct 2022)
+
+- Makefile.m32: drop CROSSPREFIX and our CC/AR defaults [ci skip]
+
+ This patch aimed to fix a regression [0], where `CC` initialization
+ moved beyond its first use. But, on closer inspection it turned out that
+ the `CC` initialization does not work as expected due to GNU Make
+ filling it with `cc` by default. So unless implicit values were
+ explicitly disabled via a GNU Make option, the default value of
+ `$CROSSPREFIX` + `gcc` was never used. At the same time the implicit
+ value `cc` maps to `gcc` in (most/all?) MinGW envs.
+
+ `AR` has the same issue, with a default value of `ar`.
+
+ We could reintroduce a separate variable to fix this without ill
+ effects, but for simplicity and flexibility, it seems better to drop
+ support for `CROSSPREFIX`, along with our own `CC`/`AR` init logic, and
+ require the caller to initialize `CC`, `AR` and `RC` to the full
+ (prefixed if necessary) names of these tools, as desired.
+
+ We keep `RC ?= windres` because `RC` is empty by default.
+
+ Also fix grammar in a comment.
+
+ [0] 10fbd8b4e3f83b967fd9ad9a41ab484c0e7e7ca3
+
+ Closes #9698
+
+- smb: replace CURL_WIN32 with WIN32
+
+ PR #9255 aimed to fix a Cygwin/MSYS issue (#8220). It used the
+ `CURL_WIN32` macro, but that one is not defined here, while compiling
+ curl itself. This patch changes this to `WIN32`, assuming this was the
+ original intent.
+
+ Regression from 1c52e8a3795ccdf8ec9c308f4f8f19cf10ea1f1a
+
+ Reviewed-by: Marcel Raad
+
+ Closes #9701
+
+Matthias Gatto (11 Oct 2022)
+
+- aws_sigv4: fix header computation
+
+ Handle canonical headers and signed headers creation as explained here:
+ https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.
+ html
+
+ The algo tells that signed and canonical must contain at last host and
+ x-amz-date.
+
+ So we check whatever thoses are present in the curl http headers list.
+ If they are, we use the one enter by curl user, otherwise we generate
+ them. then we to lower, and remove space from each http headers plus
+ host and x-amz-date, then sort them all by alphabetical order.
+
+ This patch also fix a bug with host header, which was ignoring the port.
+
+ Closes #7966
+
+Aftab Alam (11 Oct 2022)
+
+- README.md: link the curl logo to the website
+
+ - Link the curl:// image to https://curl.se/
+
+ Closes https://github.com/curl/curl/pull/9675
+
+Dustin Howett (11 Oct 2022)
+
+- schannel: when importing PFX, disable key persistence
+
+ By default, the PFXImportCertStore API persists the key in the user's
+ key store (as though the certificate was being imported for permanent,
+ ongoing use.)
+
+ The documentation specifies that keys that are not to be persisted
+ should be imported with the flag PKCS12_NO_PERSIST_KEY.
+ NOTE: this flag is only supported on versions of Windows newer than XP
+ and Server 2003.
+
+ --
+
+ This is take 2 of the original fix. It extends the lifetime of the
+ client certificate store to that of the credential handle. The original
+ fix which landed in 70d010d and was later reverted in aec8d30 failed to
+ work properly because it did not do that.
+
+ Minor changes were made to the schannel credential context to support
+ closing the client certificate store handle at the end of an SSL session.
+
+ --
+
+ Reported-by: ShadowZzj@users.noreply.github.com
+
+ Fixes https://github.com/curl/curl/issues/9300
+ Supersedes https://github.com/curl/curl/pull/9363
+ Closes https://github.com/curl/curl/pull/9460
+
+Viktor Szakats (11 Oct 2022)
+
+- Makefile.m32: support more options [ci skip]
+
+ - Add support for these options:
+ `-wolfssl`, `-wolfssh`, `-mbedtls`, `-libssh`, `-psl`
+
+ Caveats:
+ - `-wolfssh` requires `-wolfssl`.
+ - `-wolfssl` cannot be used with OpenSSL backends in parallel.
+ - `-libssh` has build issues with BoringSSL and LibreSSL, and also
+ what looks like a world-writable-config vulnerability on Windows.
+ Consider it experimental.
+ - `-psl` requires `-idn2` and extra libs passed via
+ `LIBS=-liconv -lunistring`.
+
+ - Detect BoringSSL/wolfSSL and set ngtcp2 crypto lib accordingly.
+ - Generalize MultiSSL detection.
+ - Use else-if syntax. Requires GNU Make 3.81 (2006-04-01).
+ - Document more customization options.
+
+ This brings over some configuration logic from `curl-for-win`.
+
+ Closes #9680
+
+- cmake: enable more detection on Windows
+
+ Enable `HAVE_UNISTD_H`, `HAVE_STRTOK_R` and `HAVE_STRCASECMP` detection
+ on Windows, instead of having predefined values.
+
+ With these features detected correctly, CMake Windows builds get closer
+ to the autotools and `config-win32.h` ones.
+
+ This also fixes detecting `HAVE_FTRUNCATE` correctly, which required
+ `unistd.h`.
+
+ Fixing `ftruncate()` in turn causes a build warning/error with legacy
+ MinGW/MSYS1 due to an offset type size mismatch. This env misses to
+ detect `HAVE_FILE_OFFSET_BITS`, which may be a reason. This patch
+ force-disables `HAVE_FTRUNCATE` for this platform.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9687
+
+- autotools: allow unix sockets on Windows
+
+ Fixes: https://github.com/curl/curl-for-win/blob/73a070d96fd906fdee929e2f1f00
+ a9149fb39239/curl-autotools.sh#L44-L47
+
+ On Windows this feature is present, but not the header used in the
+ detection logic. It also requires an elaborate enabler logic
+ (as seen in `lib/curl_setup.h`). Let's always allow it and let the
+ lib code deal with the details.
+
+ Closes #9688
+
+- cmake: add missing inet_ntop check
+
+ This adds the missing half of the check, next to the other half
+ already present in `lib/curl_config.h.cmake`.
+
+ Force disable `HAVE_INET_NTOP` for old MSVC where it caused compiler
+ warnings.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9689
+
+Daniel Stenberg (11 Oct 2022)
+
+- RELEASE-NOTES: synced
+
+bsergean on github (11 Oct 2022)
+
+- asyn-ares: set hint flags when calling ares_getaddrinfo
+
+ The hint flag is ARES_AI_NUMERICSERV, and it will save a call to
+ getservbyname or getservbyname_r to set it.
+
+ Closes #9694
+
+Daniel Stenberg (11 Oct 2022)
+
+- header.d: add category smtp and imap
+
+ They were previously (erroneously) added manually to tool_listhelp.c
+ which would make them get removed again when the file is updated next
+ time, unless added correctly here in header.d
+
+ Follow-up to 2437fac01
+
+ Closes #9690
+
+- curl/get_url_file_name: use libcurl URL parser
+
+ To avoid URL tricks, use the URL parser for this.
+
+ This update changes curl's behavior slightly in that it will ignore the
+ possible query part from the URL and only use the file name from the
+ actual path from the URL. I consider it a bugfix.
+
+ "curl -O localhost/name?giveme-giveme" will now save the output in the
+ local file named 'name'
+
+ Updated test 1210 to verify
+
+ Assisted-by: Jay Satiro
+
+ Closes #9684
+
+Martin Ågren (11 Oct 2022)
+
+- docs: fix grammar around needing pass phrase
+
+ "You never needed a pass phrase" reads like it's about to be followed by
+ something like "until version so-and-so", but that is not what is
+ intended. Change to "You never need a pass phrase". There are two
+ instances of this text, so make sure to update both.
+
+Xiang Xiao (10 Oct 2022)
+
+- cmake: add the check of HAVE_SOCKETPAIR
+
+ which is used by Curl_socketpair
+
+ Signed-off-by: Xiang Xiao
+
+ Closes #9686
+
+Daniel Stenberg (10 Oct 2022)
+
+- curl/add_file_name_to_url: use the libcurl URL parser
+
+ instead of the custom error-prone parser, to extract and update the path
+ of the given URL
+
+ Closes #9683
+
+- single_transfer: use the libcurl URL parser when appending query parts
+
+ Instead of doing "manual" error-prone parsing in another place.
+
+ Used when --data contents is added to the URL query when -G is provided.
+
+ Closes #9681
+
+- ws: fix buffer pointer use in the callback loop
+
+ Closes #9678
+
+Petr Štetiar (10 Oct 2022)
+
+- curl-wolfssl.m4: error out if wolfSSL is not usable
+
+ When I explicitly declare, that I would like to have curl built with
+ wolfSSL support using `--with-wolfssl` configure option, then I would
+ expect, that either I endup with curl having that support, for example
+ in form of https support or it wouldn't be available at all.
+
+ Downstream projects like for example OpenWrt build curl wolfSSL variant
+ with `--with-wolfssl` already, but in certain corner cases it does fail:
+
+ configure:25299: checking for wolfSSL_Init in -lwolfssl
+ configure:25321: x86_64-openwrt-linux-musl-gcc -o conftest [snip]
+ In file included from target-x86_64_musl/usr/include/wolfssl/wolfcrypt/dsa.
+ h:33,
+ from target-x86_64_musl/usr/include/wolfssl/wolfcrypt/asn_
+ public.h:35,
+ from target-x86_64_musl/usr/include/wolfssl/ssl.h:35,
+ from conftest.c:47:
+ target-x86_64_musl/usr/include/wolfssl/wolfcrypt/integer.h:37:14: fatal err
+ or: wolfssl/wolfcrypt/sp_int.h: No such file or directory
+ #include
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ compilation terminated.
+
+ and in the end thus produces curl without https support:
+
+ curl: (1) Protocol "https" not supported or disabled in libcurl
+
+ So fix it, by making the working wolfSSL mandatory and error out in
+ configure step when that's not the case:
+
+ checking for wolfSSL_Init in -lwolfssl... no
+ configure: error: --with-wolfssl but wolfSSL was not found or doesn't work
+
+ References: https://github.com/openwrt/packages/issues/19005
+ References: https://github.com/openwrt/packages/issues/19547
+ Signed-off-by: Petr Štetiar
+
+ Closes #9682
+
+Daniel Stenberg (10 Oct 2022)
+
+- tool_getparam: pass in the snprintf("%.*s") string length as 'int'
+
+ Reported by Coverity CID 1515928
+
+ Closes #9679
+
+Paul Seligman (9 Oct 2022)
+
+- ws: minor fixes for web sockets without the CONNECT_ONLY flag
+
+ - Fixed an issue where is_in_callback was getting cleared when using web
+ sockets with debug logging enabled
+ - Ensure the handle is is_in_callback when calling out to fwrite_func
+ - Change the write vs. send_data decision to whether or not the handle
+ is in CONNECT_ONLY mode.
+ - Account for buflen not including the header length in curl_ws_send
+
+ Closes #9665
+
+Marc Hoersken (8 Oct 2022)
+
+- CI/cirrus: merge existing macOS jobs into a job matrix
+
+ Ref: #9627
+ Reviewed-by: Philip H.
+
+ Closes #9672
+
+Daniel Stenberg (8 Oct 2022)
+
+- strcase: add and use Curl_timestrcmp
+
+ This is a strcmp() alternative function for comparing "secrets",
+ designed to take the same time no matter the content to not leak
+ match/non-match info to observers based on how fast it is.
+
+ The time this function takes is only a function of the shortest input
+ string.
+
+ Reported-by: Trail of Bits
+
+ Closes #9658
+
+- tool_getparam: split out data_urlencode() into its own function
+
+ Closes #9673
+
+- connect: fix Curl_updateconninfo for TRNSPRT_UNIX
+
+ Reported-by: Vasiliy Ulyanov
+ Fixes #9664
+ Closes #9670
+
+- ws: fix Coverity complaints
+
+ Coverity pointed out several flaws where variables remained
+ uninitialized after forks.
+
+ Follow-up to e3f335148adc6742728f
+
+ Closes #9666
+
+Marc Hoersken (7 Oct 2022)
+
+- CI/GHA: merge msh3 and openssl3 builds into linux workflow
+
+ Continue work on merging all Linux workflows into one file.
+
+ Follow up to #9501
+ Closes #9646
+
+Daniel Stenberg (7 Oct 2022)
+
+- curl_ws_send.3: call the argument 'fragsize'
+
+ Since WebSocket works with "fragments" not "frames"
+
+ Closes #9668
+
+- easy: avoid Intel error #2312: pointer cast involving 64-bit pointed-to type
+
+ Follow-up to e3f335148adc6742728ff8
+
+ Closes #9669
+
+- tool_main: exit at once if out of file descriptors
+
+ If the main_checkfds function cannot create new file descriptors in an
+ attempt to detect of stdin, stdout or stderr are closed.
+
+ Also changed the check to use fcntl() to check if the descriptors are
+ open, which avoids superfluously calling pipe() if they all already are.
+
+ Follow-up to facfa19cdd4d0094
+
+ Reported-by: Trail of Bits
+
+ Closes #9663
+
+- websockets: remodeled API to support 63 bit frame sizes
+
+ curl_ws_recv() now receives data to fill up the provided buffer, but can
+ return a partial fragment. The function now also get a pointer to a
+ curl_ws_frame struct with metadata that also mentions the offset and
+ total size of the fragment (of which you might be receiving a smaller
+ piece). This way, large incoming fragments will be "streamed" to the
+ application. When the curl_ws_frame struct field 'bytesleft' is 0, the
+ final fragment piece has been delivered.
+
+ curl_ws_recv() was also adjusted to work with a buffer size smaller than
+ the fragment size. (Possibly needless to say as the fragment size can
+ now be 63 bit large).
+
+ curl_ws_send() now supports sending a piece of a fragment, in a
+ streaming manner, in addition to sending the entire fragment in a single
+ call if it is small enough. To send a huge fragment, curl_ws_send() can
+ be used to send it in many small calls by first telling libcurl about
+ the total expected fragment size, and then send the payload in N number
+ of separate invokes and libcurl will stream those over the wire.
+
+ The struct curl_ws_meta() returns is now called 'curl_ws_frame' and it
+ has been extended with two new fields: *offset* and *bytesleft*. To help
+ describe the passed on data chunk when a fragment is delivered in many
+ smaller pieces.
+
+ The documentation has been updated accordingly.
+
+ Closes #9636
+
+Patrick Monnerat (7 Oct 2022)
+
+- docs/examples: avoid deprecated options in examples where possible
+
+ Example programs targeting a deprecated feature/option are commented with
+ a warning about it.
+ Other examples are adapted to not use deprecated options.
+
+ Closes #9661
+
+Viktor Szakats (6 Oct 2022)
+
+- cmake: fix enabling websocket support
+
+ Follow-up from 664249d095275ec532f55dd1752d80c8c1093a77
+
+ Closes #9660
+
+- tidy-up: delete parallel/unused feature flags
+
+ Detecting headers and lib separately makes sense when headers come in
+ variations or with extra ones, but this wasn't the case here. These were
+ duplicate/parallel macros that we had to keep in sync with each other
+ for a working build. This patch leaves a single macro for each of these
+ dependencies:
+
+ - Rely on `HAVE_LIBZ`, delete parallel `HAVE_ZLIB_H`.
+
+ Also delete CMake logic making sure these two were in sync, along with
+ a toggle to turn off that logic, called `CURL_SPECIAL_LIBZ`.
+
+ Also delete stray `HAVE_ZLIB` defines.
+
+ There is also a `USE_ZLIB` variant in `lib/config-dos.h`. This patch
+ retains it for compatibility and deprecates it.
+
+ - Rely on `USE_LIBSSH2`, delete parallel `HAVE_LIBSSH2_H`.
+
+ Also delete `LIBSSH2_WIN32`, `LIBSSH2_LIBRARY` from
+ `winbuild/MakefileBuild.vc`, these have a role when building libssh2
+ itself. And `CURL_USE_LIBSSH`, which had no use at all.
+
+ Also delete stray `HAVE_LIBSSH2` defines.
+
+ - Rely on `USE_LIBSSH`, delete parallel `HAVE_LIBSSH_LIBSSH_H`.
+
+ Also delete `LIBSSH_WIN32`, `LIBSSH_LIBRARY` and `HAVE_LIBSSH` from
+ `winbuild/MakefileBuild.vc`, these were the result of copy-pasting the
+ libssh2 line, and were not having any use.
+
+ - Delete unused `HAVE_LIBPSL_H` and `HAVE_LIBPSL`.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9652
+
+Daniel Stenberg (6 Oct 2022)
+
+- netrc: compare user name case sensitively
+
+ User name comparisions in netrc need to match the case.
+
+ Closes #9657
+
+- CURLOPT_COOKIEFILE: insist on "" for enable-without-file
+
+ The former way that also suggested using a non-existing file to just
+ enable the cookie engine could lead to developers maybe a bit carelessly
+ guessing a file name that will not exist, and then in a future due to
+ circumstances, such a file could be made to exist and then accidentally
+ libcurl would read cookies not actually meant to.
+
+ Reported-by: Trail of bits
+
+ Closes #9654
+
+- tests/Makefile: remove run time stats from ci-test
+
+ The ci-test is the normal makefile target invoked in CI jobs. This has
+ been using the -r option to runtests.pl since a long time, but I find
+ that it mostly just adds many lines to the test output report without
+ anyone caring much about those stats.
+
+ Remove it.
+
+ Closes #9656
+
+Patrick Monnerat (6 Oct 2022)
+
+- tool: reorganize function c_escape around a dynbuf
+
+ This is a bit shorter and a lot safer.
+
+ Substrings of unescaped characters are added by a single call to reduce
+ overhead.
+
+ Extend test 1465 to handle more kind of escapes.
+
+ Closes #9653
+
+Jay Satiro (5 Oct 2022)
+
+- CURLOPT_HTTPPOST.3: bolden the deprecation notice
+
+ Ref: https://github.com/curl/curl/pull/9621
+
+ Closes https://github.com/curl/curl/pull/9637
+
+John Bampton (5 Oct 2022)
+
+- misc: fix spelling in docs and comments
+
+ also: remove outdated sentence
+
+ Closes #9644
+
+Patrick Monnerat (5 Oct 2022)
+
+- tool: avoid generating ambiguous escaped characters in --libcurl
+
+ C string hexadecimal-escaped characters may have more than 2 digits.
+ This results in a wrong C compiler interpretation of a 2-digit escaped
+ character when followed by an hex digit character.
+
+ The solution retained here is to represent such characters as 3-digit
+ octal escapes.
+
+ Adjust and extend test 1465 for this case.
+
+ Closes #9643
+
+Daniel Stenberg (5 Oct 2022)
+
+- configure: the ngtcp2 option should default to 'no'
+
+ While still experimental.
+
+ Bug: https://curl.se/mail/lib-2022-10/0007.html
+ Reported-by: Daniel Hallberg
+
+ Closes #9650
+
+- CURLOPT_MIMEPOST.3: add an (inline) example
+
+ Reported-by: Jay Satiro
+ Bug: https://github.com/curl/curl/pull/9637#issuecomment-1268070723
+
+ Closes #9649
+
+Viktor Szakats (5 Oct 2022)
+
+- Makefile.m32: exclude libs & libpaths for shared mode exes [ci skip]
+
+ Exclude linker flags specifying depedency libs and libpaths, when
+ building against `libcurl.dll`. In such case these options are not
+ necessary (but may cause errors if not/wrongly configured.)
+
+ Also move and reword a comment on `CPPFLAGS` to not apply to
+ `UNICODE` options. These are necessary for all build targets.
+
+ Closes #9651
+
+Jay Satiro (5 Oct 2022)
+
+- runtests: fix uninitialized value on ignored tests
+
+ - Don't show TESTFAIL message (ie tests failed which aren't ignored) if
+ only ignored tests failed.
+
+ Before:
+ IGNORED: failed tests: 571 612 1056
+ TESTDONE: 1214 tests out of 1217 reported OK: 99%
+ Use of uninitialized value $failed in concatenation (.) or string at
+ ./runtests.pl line 6290.
+ TESTFAIL: These test cases failed:
+
+ After:
+ IGNORED: failed tests: 571 612 1056
+ TESTDONE: 1214 tests out of 1217 reported OK: 99%
+
+ Closes https://github.com/curl/curl/pull/9648
+
+- cirrus: use make LDFLAGS=-all-static instead of curl_LDFLAGS
+
+ - Correct the use of -all-static for static Windows CI builds.
+
+ curl_LDFLAGS was removed from the makefile when metalink support was
+ removed. LDFLAGS=-all-static is passed to make only, because it is not a
+ valid option for configure compilation tests.
+
+ Closes https://github.com/curl/curl/pull/9633
+
+Viktor Szakats (4 Oct 2022)
+
+- Makefile.m32: fix regression with tool_hugehelp [ci skip]
+
+ In a recent commit I mistakenly deleted this logic, after seeing a
+ reference to a filename ending with `.cvs` and thinking it must have
+ been long gone. Turns out this is an existing file. Restore the rule
+ and the necessary `COPY` definitions with it.
+
+ The restored logic is required for a successful build on a bare source
+ tree (as opposed to a source release tarball).
+
+ Also shorten an existing condition similar to the one added in this
+ patch.
+
+ Regression since 07a0047882dd3f1fbf73486c5dd9c15370877ad6
+
+ Closes #9645
+
+- Makefile.m32: deduplicate build rules [ci skip]
+
+ After this patch, we reduce the three copies of most `Makefile.m32`
+ logic to one. This now resides in `lib/Makefile.m32`. It makes future
+ updates easier, the code shorter, with a small amount of added
+ complexity.
+
+ `Makefile.m32` reduction:
+
+ | | bytes | LOC total | blank | comment | code |
+ |-------------------|-------:|----------:|-------:|---------:|------:|
+ | 7.85.0 | 34772 | 1337 | 79 | 192 | 1066 |
+ | before this patch | 17601 | 625 | 62 | 106 | 457 |
+ | after this patch | 11680 | 392 | 52 | 104 | 236 |
+
+ Details:
+
+ - Change rules to create objects for the `v*` subdirs in the `lib` dir.
+ This allows to use a shared compile rule and assumes that filenames
+ are not (and will not be) colliding across these directories.
+ `Makefile.m32` now also stores a list of these subdirs. They are
+ changing rarely though.
+
+ - Sync as much as possible between the three `Makefile.m32` scripts'
+ rules and their source/target sections.
+
+ - After this patch `CPPFLAGS` are all applied to the `src` sources once
+ again. This matches the behaviour of cmake/autotools. Only zlib ones
+ are actually required there.
+
+ - Use `.rc` names from `Makefile.inc` instead of keeping a duplicate.
+
+ - Change examples to link `libcurl.dll` by default. This makes building
+ trivial, even as a cross-build:
+ `CC=x86_64-w64-mingw32-gcc make -f Makefile.m32`
+ To run them, you need to move/copy or add-to-path `libcurl.dll`.
+ You can select static mode via `CFG=-static`.
+
+ - List more of the `Makefile.m32` config variables.
+
+ - Drop `.rc` support from examples. It made it fragile without much
+ benefit.
+
+ - Include a necessary system lib for the `externalsocket.c` example.
+
+ - Exclude unnecessary systems libs when building in `-dyn` mode.
+
+ Closes #9642
+
+Daniel Stenberg (4 Oct 2022)
+
+- RELEASE-NOTES: synced
+
+- CURLOPT_COOKIELIST.3: fix formatting mistake
+
+ Also, updated manpage-syntax.pl to make it detect this error in test
+ 1173.
+
+ Reported-by: ProceduralMan on github
+ Fixes #9639
+ Closes #9640
+
+Jay Satiro (4 Oct 2022)
+
+- connect: change verbose IPv6 address:port to [address]:port
+
+ - Use brackets for the IPv6 address shown in verbose message when the
+ format is address:port so that it is less confusing.
+
+ Before: Trying 2606:4700:4700::1111:443...
+ After: Trying [2606:4700:4700::1111]:443...
+
+ Bug: https://curl.se/mail/archive-2022-02/0041.html
+ Reported-by: David Hu
+
+ Closes #9635
+
+Viktor Szakats (3 Oct 2022)
+
+- Makefile.m32: major rework [ci skip]
+
+ This patch overhauls `Makefile.m32` scripts, fixing a list of quirks,
+ making its behaviour and customization envvars align better with other
+ build systems, aiming for less code, that is easier to read, use and
+ maintain.
+
+ Details:
+ - Rename customization envvars:
+ `CURL_CC` -> `CC`
+ `CURL_RC` -> `RC`
+ `CURL_AR` -> `AR`
+ `CURL_LDFLAG_EXTRAS_DLL` -> `CURL_LDFLAGS_LIB`
+ `CURL_LDFLAG_EXTRAS_EXE` -> `CURL_LDFLAGS_BIN`
+ - Drop `CURL_STRIP` and `CURL_RANLIB`. These tools are no longer used.
+ - Accept `CFLAGS`, `CPPFLAGS`, `RCFLAGS`, `LDFLAGS` and `LIBS` envvars.
+ - Drop `CURL_CFLAG_EXTRAS`, `CURL_LDFLAG_EXTRAS`, `CURL_RCFLAG_EXTRAS` in
+ favor of the above.
+ - Do not automatically enable `zlib` with `libssh2`. `zlib` is optional
+ with `libssh2`.
+ - Omit unnecessary `CPPFLAGS` options when building `curl.exe` and
+ examples.
+ - Drop support for deprecated `-winssl` `CFG` option. Use `-schannel`
+ instead.
+ - Avoid late evaluation where not necessary (`=` -> `:=`).
+ - Drop support for `CURL_DLL_A_SUFFIX` to override the implib suffix.
+ Instead, use the standard naming scheme by default: `libcurl.dll.a`.
+ The toolchain recognizes the name, and selects it automatically when
+ asking for a `-shared` vs. `-static` build.
+ - Stop applying `strip` to `libcurl.a`. Follow-up from
+ 16a58e9f93c7e89e1f87720199388bcfcfa148a4. There was no debug info to
+ strip since then.
+ - Stop setting `-O3`, `-W`, `-Wall` options. You can add these to
+ `CFLAGS` as desired.
+ - Always enable `-DCURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG` with OpenSSL,
+ to avoid that vulnerability on Windows.
+ - Add `-lbrotlicommon` to `LIBS` when using `brotli`.
+ - Do not enable `-nghttp3` without `-ngtcp2`.
+ - `-ssh2` and `-rtmp` options no longer try to auto-select a TLS-backend.
+ You need to set the backend explicitly. This scales better and avoids
+ issues with certain combinations (e.g. `libssh2` + `wolfssl` with no
+ `schannel`).
+ - Default to OpenSSL TLS-backend with `ngtcp2`. Possible to override via
+ `NGTCP2_LIBS`.
+ - Old, alternate method of enabling components (e.g. `SSH2=1`) no longer
+ supported.
+ - Delete `SPNEGO` references. They were no-ops.
+ - Drop support for Win9x environments.
+ - Allow setting `OPENSSL_LIBS` independently from `OPENSSL_LIBPATH`.
+ - Support autotools/CMake `libssh2` builds by default.
+ - Respect `CURL_DLL_SUFFIX` in `-dyn` mode when building `curl.exe` and
+ examples.
+ - Assume standard directory layout with `LIBCARES_PATH`. (Instead of the
+ long gone embedded one.)
+ - Stop static linking with c-ares by default. Add
+ `CPPFLAGS=-DCARES_STATICLIB` to enable it.
+ - Reorganize internal layout to avoid redundancy and emit clean diffs
+ between src/lib and example make files.
+ - Delete unused variables.
+ - Code cleanups/rework.
+ - Comment and indentation fixes.
+
+ Closes #9632
+
+- scripts/release-notes.pl: strip ci skip tag [ci skip]
+
+ Ref: https://github.com/curl/curl/commit/e604a82cae922bf86403a94f5803ac5e4303
+ ae97#commitcomment-85637701
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9634
+
+- Makefile.m32: delete legacy component bits [ci skip]
+
+ - Drop auto-detection of OpenSSL 1.0.2 and earlier. Now always defaulting
+ to OpenSSL 1.1.0 and later, LibreSSL and BoringSSL.
+
+ - Drop `Invalid path to OpenSSL package` detection. OpenSSL has been
+ using a standard file layout since 1.1.0, so this seems unnecessary
+ now.
+
+ - Drop special logic to enable Novell LDAP SDK support.
+
+ - Drop special logic to enable OpenLDAP LDAP SDK support. This seems
+ to be distinct from native OpenLDAP, with support implemented inside
+ `lib/ldap.c` (vs. `lib/openldap.c`) back when the latter did not exist
+ yet in curl.
+
+ - Add `-lwldap32` only if there is no other LDAP library (either native
+ OpenLDAP, or SDKs above) present.
+
+ - Update `doc/INSTALL.md` accordingly.
+
+ After this patch, it's necessary to make configration changes when using
+ OpenSSL 1.0.2 or earlier, or the two LDAP SDKs.
+
+ OpenSSL 1.0.2 and earlier:
+ ```
+ export OPENSSL_INCLUDE = /outinc
+ export OPENSSL_LIBPATH = /out
+ export OPENSSL_LIBS = -lssl32 -leay32 -lgdi32
+ ```
+
+ Novell LDAP SDK, previously enabled via `USE_LDAP_NOVELL=1`:
+ ```
+ export CURL_CFLAG_EXTRAS = -I/inc -DCURL_HAS_NOVELL_LDAPSDK
+ export CURL_LDFLAG_EXTRAS = -L/lib/mscvc -lldapsdk -lldapssl -ll
+ dapx
+ ```
+
+ OpenLDAP LDAP SDK, previously enabled via `USE_LDAP_OPENLDAP=1`:
+ ```
+ export CURL_CFLAG_EXTRAS = -I/include -DCURL_HAS_OPENLDAP_LDAPSD
+ K
+ export CURL_LDFLAG_EXTRAS = -L/lib -lldap -llber
+ ```
+
+ I haven't tested these scenarios, and in general we recommend using
+ a recent OpenSSL release. Also, WinLDAP (the Windows default) and
+ OpenLDAP (via `-DUSE_OPENLDAP`) are the LDAP options actively worked on
+ in curl.
+
+ Closes #9631
+
+Daniel Stenberg (2 Oct 2022)
+
+- vauth/ntlm.h: make line shorter than 80 columns
+
+ Follow-up from 265fbd937
+
+Viktor Szakats (1 Oct 2022)
+
+- docs: update sourceforge project links [ci skip]
+
+ SourceForge projects can now choose between two hostnames, with .io and
+ .net ending. Both support HTTPS by default now. Opening the other variant
+ will perm-redirected to the one chosen by the project.
+
+ The .io -> .net redirection is done insecurely.
+
+ Let's update the URLs to point to the current canonical endpoints to
+ avoid any redirects.
+
+ Closes #9630
+
+Daniel Stenberg (1 Oct 2022)
+
+- curl_url_set.3: document CURLU_APPENDQUERY proper
+
+ Listed among the other supported flags.
+
+ Reported-by: Robby Simpson
+ Fixes #9628
+ Closes #9629
+
+Viktor Szakats (1 Oct 2022)
+
+- Makefile.m32: cleanups and fixes [ci skip]
+
+ - Add `-lcrypt32` once, and add it always for simplicity.
+ - Delete broken link and reference to the pre-Vista WinIDN add-on.
+ MS no longer distribute it.
+ - Delete related `WINIDN_PATH` option. IDN is a system lib since Vista.
+ - Sync `LIBCARES_PATH` default with the rest of dependencies.
+ - Delete version numbers from dependency path defaults.
+ - `libgsasl` package is now called `gsasl`.
+ - Delete `libexpat` and `libxml2` references. No longer used by curl.
+ - Delete `Edit the path below...` comments. We recommend to predefine
+ those envvars instead.
+ - `libcares.a` is not an internal dependency anymore. Stop using it as
+ such.
+ - `windres` `--include-dir` -> `-I`, `-F` -> `--target=` for readability.
+ - Delete `STRIP`, `CURL_STRIP`, `AR` references from `src/Makefile.m32`.
+ They were never used.
+ - Stop to `clean` some objects twice in `src/Makefile.m32`.
+ - Delete cvs-specific leftovers.
+ - Finish resource support in examples make file.
+ - Delete `-I/lib` from examples make file.
+ - Fix copyright start year in examples make file.
+ - Delete duplicate `ftpuploadresume` input in examples make file.
+ - Sync OpenSSL lib order, `SYNC` support, `PROOT` use, dependency path
+ defaults, variables names and other internal bits between the three
+ make files.
+ - `lib/Makefile.m32` accepted custom options via `DLL_LIBS` envvar. This
+ was lib-specific and possibly accidental. Use `CURL_LDFLAG_EXTRAS_DLL`
+ envvar for the same effect.
+ - Fix linking `curl.exe` and examples to wrong static libs with
+ auto-detected OpenSSL 1.0.2 or earlier.
+ - Add `-lgdi32` for OpenSSL 1.0.2 and earlier only.
+ - Add link to Novell LDAP SDK and use a relative default path. Latest
+ version is from 2016, linked to an outdated OpenSSL 1.0.1.
+ - Whitespace and comment cleanups.
+
+ TODO in a next commit:
+
+ Delete built-in detection/logic for OpenSSL 1.0.2 and earlier, the Novell
+ LDAP SDK and the other LDAP SDK (which is _not_ OpenLDAP). Write up the
+ necessary custom envvars to configure them.
+
+ Closes #9616
+
+Daniel Stenberg (30 Sep 2022)
+
+- RELEASE-NOTES: synced
+
+Matt Holt (30 Sep 2022)
+
+- HTTP3.md: update Caddy example
+
+ Closes #9623
+
+Daniel Stenberg (30 Sep 2022)
+
+- easy: fix the altsvc init for curl_easy_duphandle
+
+ It was using the old #ifdef which nothing sets anymore
+
+ Closes #9624
+
+- GHA: build tests in a separate step from the running of them
+
+ ... to make the output smaller for when you want to look at test
+ failures.
+
+ Removed the examples build from msh3
+
+ Closes #9619
+
+Viktor Szakats (29 Sep 2022)
+
+- ldap: delete stray CURL_HAS_MOZILLA_LDAP reference
+
+ Added in 68b215157fdf69612edebdb220b3804822277822, while adding openldap
+ support. This is also the single mention of this constant in the source
+ tree and also in that commit. Based on these, it seems like an accident.
+
+ Delete this reference.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9625
+
+- docs: spelling nits
+
+ - MingW -> MinGW (Minimalist GNU for Windows)
+ - f.e. -> e.g.
+ - some whitespace and punctuation.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9622
+
+Philip Heiduck (29 Sep 2022)
+
+- cirrus-ci: add macOS build with m1
+
+ Signed-off-by: Philip H <47042125+pheiduck@users.noreply.github.com>
+
+ Closes #9565
+
+Patrick Monnerat (29 Sep 2022)
+
+- lib: sanitize conditional exclusion around MIME
+
+ The introduction of CURL_DISABLE_MIME came with some additional bugs:
+ - Disabled MIME is compiled-in anyway if SMTP and/or IMAP is enabled.
+ - CURLOPT_MIMEPOST, CURLOPT_MIME_OPTIONS and CURLOPT_HTTPHEADER are
+ conditioned on HTTP, although also needed for SMTP and IMAP MIME mail
+ uploads.
+
+ In addition, the CURLOPT_HTTPHEADER and --header documentation does not
+ mention their use for MIME mail.
+
+ This commit fixes the problems above.
+
+ Closes #9610
+
+Thiago Suchorski (29 Sep 2022)
+
+- docs: minor grammar fixes
+
+ Closes #9609
+
+Daniel Stenberg (28 Sep 2022)
+
+- CURLSHOPT_UNLOCKFUNC.3: the callback as no 'access' argument
+
+ Probably a copy and paste error from the lock function man page.
+
+ Reported-by: Robby Simpson
+ Fixes #9612
+ Closes #9613
+
+- CURLOPT_ACCEPT_ENCODING.3: remove "four" as they are five
+
+ ... instead just list the supported encodings.
+
+ Reported-by: ProceduralMan on github
+ Fixes #9614
+ Closes #9615
+
+Dan Fandrich (28 Sep 2022)
+
+- tests: Remove a duplicated keyword
+
+- docs: document more server names for test files
+
+Daniel Stenberg (28 Sep 2022)
+
+- altsvc: reject bad port numbers
+
+ The existing code tried but did not properly reject alternative services
+ using negative or too large port numbers.
+
+ With this fix, the logic now also flushes the old entries immediately
+ before adding a new one, making a following header with an illegal entry
+ not flush the already stored entry.
+
+ Report from the ongoing source code audit by Trail of Bits.
+
+ Adjusted test 356 to verify.
+
+ Closes #9607
+
+- functypes: provide the recv and send arg and return types
+
+ This header is for providing the argument types for recv() and send()
+ when built to not use a dedicated config-[platfor].h file.
+
+ Remove the slow brute-force checks from configure and cmake.
+
+ This change also removes the use of the types for select, as they were
+ not used in code.
+
+ Closes #9592
+
+- urlapi: reject more bad characters from the host name field
+
+ Extended test 1560 to verify
+
+ Report from the ongoing source code audit by Trail of Bits.
+
+ Closes #9608
+
+- configure: deprecate builds with small curl_off_t
+
+ If curl_off_t turns out to be smaller than 8 bytes,
+ --with-n64-deprecated needs to be used to allow the build to
+ continue. This is to highlight the fact that support for such builds is
+ going away next year.
+
+ Also mentioned in DEPRECATED.md
+
+ Closes #9605
+
+Patrick Monnerat (27 Sep 2022)
+
+- http, vauth: always provide Curl_allow_auth_to_host() functionality
+
+ This function is currently located in the lib/http.c module and is
+ therefore disabled by the CURL_DISABLE_HTTP conditional token.
+
+ As it may be called by TLS backends, disabling HTTP results in an
+ undefined reference error at link time.
+
+ Move this function to vauth/vauth.c to always provide it and rename it
+ as Curl_auth_allowed_to_host() to respect the vauth module naming
+ convention.
+
+ Closes #9600
+
+Daniel Stenberg (27 Sep 2022)
+
+- ngtcp2: fix C89 compliance nit
+
+- openssl: make certinfo available for QUIC
+
+ Curl_ossl_certchain() is now an exported function in lib/vtls/openssl.c that
+ can also be used from quiche.c and ngtcp2.c to get the cert chain for QUIC
+ connections as well.
+
+ The *certchain function was moved to the top of the file for this reason.
+
+ Reported-by: Eloy Degen
+ Fixes #9584
+ Closes #9597
+
+- RELEASE-NOTES: synced
+
+- DEPRECATE.md: Support for systems without 64 bit data types
+
+ Closes #9604
+
+Patrick Monnerat (27 Sep 2022)
+
+- tests: skip mime/form tests when mime is not built-in
+
+ Closes #9596
+
+Daniel Stenberg (27 Sep 2022)
+
+- url: rename function due to name-clash in Watt-32
+
+ Follow-up to 2481dbe5f4f58 and applies the change the way it was
+ intended.
+
+Viktor Szakats (26 Sep 2022)
+
+- windows: adjust name of two internal public functions
+
+ According to `docs/INTERNALS.md`, internal function names spanning source
+ files start with uppercase `Curl_`. Bring these two functions in
+ alignment with this.
+
+ This also stops exporting them from `libcurl.dll` in autotools builds.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9598
+
+Gisle Vanem (26 Sep 2022)
+
+- url: rename function due to name-clash in Watt-32
+
+ Since the commit 764c958c52edb427f39, there was a new function called
+ resolve_ip(). This clashes with an internal function in Watt-32.
+
+ Closes #9585
+
+Jay Satiro (26 Sep 2022)
+
+- schannel: ban server ALPN change during recv renegotiation
+
+ By the time schannel_recv is renegotiating the connection, libcurl has
+ already decided on a protocol and it is too late for the server to
+ select a protocol via ALPN except for the originally selected protocol.
+
+ Ref: https://github.com/curl/curl/issues/9451
+
+ Closes https://github.com/curl/curl/pull/9463
+
+Daniel Stenberg (26 Sep 2022)
+
+- url: a zero-length userinfo part in the URL is still a (blank) user
+
+ Adjusted test 1560 to verify
+
+ Reported-by: Jay Satiro
+
+ Fixes #9088
+ Closes #9590
+
+Viktor Szakats (25 Sep 2022)
+
+- autotools: allow --enable-symbol-hiding with windows
+
+ This local autotools logic was put in place in
+ 9e24b9c7afbcb81120af4cf3f6cdee49a06d8224 (in 2012) which disabled it for
+ Windows unconditionally. Testing reveals that it actually works with
+ tested toolchains (mingw-w64 and CI ones), so let's allow this build
+ feature on that platform. Bringing this in sync with CMake, which already
+ supported this.
+
+ Reviewed-by: Jay Satiro
+
+ Closes #9586
+
+- autotools: reduce brute-force when detecting recv/send arg list
+
+ autotools uses brute-force to detect `recv`/`send`/`select` argument
+ lists, by interating through _all_ argument type combinations on each
+ `./configure` run. This logic exists since
+ 01fa02d0b545e1433dced2430561f8c0c72b74a9 (from 2006) and was a bit later
+ extended with Windows support.
+
+ This results in a worst-case number of compile + link cycles as below:
+ - `recv`: 96
+ - `send`: 192
+ - `select`: 60
+ Total: 348 (the number of curl C source files is 195, for comparison)
+
+ Notice that e.g. curl-for-win autotools builds require two `./configure`
+ invocations, doubling these numbers.
+
+ `recv` on Windows was especially unlucky because `SOCKET` (the correct
+ choice there) was listed _last_ in one of the outer trial loops. This
+ resulted in lengthy waits while autotools was trying all invalid
+ combinations first, wasting cycles, disk writes and slowing down
+ iteration.
+
+ This patch reduces the amount of idle work by reordering the tests in
+ a way to succeed first on a well-known platform such as Windows, and
+ also on non-Windows by testing for POSIX prototypes first, on the
+ assumption that these are the most likely candidates these days. (We do
+ not touch `select`, where the order was already optimal for these
+ platforms.)
+
+ For non-Windows, this means to try a return value of `ssize_t` first,
+ then `int`, reordering the buffer argument type to try `void *` first,
+ then `byte *`, and prefer the `const` flavor with `send`. If we are
+ here, also stop testing for `SOCKET` type in non-Windows builds.
+
+ After the patch, detection on Windows is instantaneous. It should also be
+ faster on popular platforms such as Linux and BSD-based ones.
+
+ If there are known-good variations for other platforms, they can also be
+ fast-tracked like above, given a way to check for that platform inside
+ the autotools logic.
+
+ Reviewed-by: Daniel Stenberg
+
+ Closes #9591
+
+Daniel Stenberg (23 Sep 2022)
+
+- TODO: Provide the error body from a CONNECT response
+
+ Spellchecked-by: Jay Satiro
+
+ Closes #9513
+ Closes #9581
+
+Viktor Szakats (23 Sep 2022)
+
+- windows: autotools .rc warnings fixup
+
+ Move `LT_LANG([Windows Resource])` after `XC_LIBTOOL`, fixing:
+
+ - Warnings when running `autoreconf -fi`.
+
+ - Warning when compiling .rc files:
+ libtool: compile: unable to infer tagged configuration
+ libtool: error: specify a tag with '--tag'
+
+ Follow up to 6de7322c03d5b4d91576a7d9fc893e03cc9d1057
+ Ref: https://github.com/curl/curl/pull/9521#issuecomment-1256291156
+
+ Suggested-by: Patrick Monnerat
+ Closes #9582
+
+Randall S. Becker (23 Sep 2022)
+
+- curl_setup: disable use of FLOSS for 64-bit NonStop builds
+
+ Older 32-bit builds currently need FLOSS. This dependency may be removed
+ in future OS releases.
+
+ Signed-off-by: Randall S. Becker
+
+ Closes #9575
+
+Patrick Monnerat (23 Sep 2022)
+
+- tool: remove dead code
+
+ Add a debug assertion to verify protocols included/excluded in a set
+ are always tokenized.
+
+ Follow-up to commit 677266c.
+
+ Closes #9576
+
+- lib: prepare the incoming of additional protocols
+
+ Move the curl_prot_t to its own conditional block. Introduce symbol
+ PROTO_TYPE_SMALL to control it.
+
+ Fix a cast in a curl_prot_t assignment.
+ Remove an outdated comment.
+
+ Follow-up to cd5ca80.
+
+ Closes #9534
+
+Daniel Stenberg (23 Sep 2022)
+
+- msh3: change the static_assert to make the code C89
+
+- bearssl: make it proper C89 compliant
+
+- curl-compilers.m4: for gcc + want warnings, set gnu89 standard
+
+ To better verify that the code is C89
+
+ Closes #9542
+
+Patrick Monnerat (22 Sep 2022)
+
+- lib517: fix C89 constant signedness
+
+ In C89, positive integer literals that overflow an int but not an
+ unsigned int may be understood as a negative int.
+
+ lib517.c:129:3: warning: this decimal constant is unsigned only in ISO C90
+ {"Sun, 06 Nov 2044 08:49:37 GMT", 2362034977 },
+ ^
+
+ Closes #9572
+
+Daniel Stenberg (22 Sep 2022)
+
+- mprintf: use snprintf if available
+
+ This is the single place in libcurl code where it uses the "native"
+ s(n)printf() function. Used for writing floats. The use has been
+ reviewed and vetted and uses a HUGE target buffer, but switching to
+ snprintf() still makes this safer and removes build-time warnings.
+
+ Reported-by: Philip Heiduck
+
+ Fixes #9569
+ Closes #9570
+
+- docs: tag curl options better in man pages
+
+ As it makes them links in the HTML versions.
+
+ Verified by the extended test 1176
+
+- symbols-in-versions: CURLOPT_ENCODING is deprecated since 7.21.6
+
+- manpage-syntax.pl: all libcurl option symbols should be \fI-tagged
+
+ ... as that makes them links to their corresponding man page.
+
+ This script is used for test 1173.
+
+ Closes #9574
+
+- RELEASE-NOTES: synced
+
+Patrick Monnerat (22 Sep 2022)
+
+- tool: remove protocol count limitation
+
+ Replace bit mask protocol sets by null-terminated arrays of protocol
+ tokens. These are the addresses of the protocol names returned by
+ curl_version_info().
+
+ Protocol names are sorted case-insensitively before output to satisfy CI
+ tests matches consistency.
+
+ The protocol list returned by curl_version_info() is augmented with all
+ RTMP protocol variants.
+
+ Test 1401 adjusted for new alpha ordered output.
+
+ Closes #9546
+
+Daniel Stenberg (22 Sep 2022)
+
+- test972: verify the output without using external tool
+
+ It seems too restrictive to assume and use an external tool to verify
+ the JSON. This now verifies the outut byte per byte. We could consider
+ building a local "JSON verifyer" in a future.
+
+ Remove 'jsonlint' from the CI job.
+
+ Reported-by: Marcel Raad
+ Fixes #9563
+ Closes #9564
+
+- hostip: lazily wait to figure out if IPv6 works until needed
+
+ The check may take many milliseconds, so now it is performed once the
+ value is first needed. Also, this change makes sure that the value is
+ not used if the resolve is set to be IPv4-only.
+
+ Closes #9553
+
+- curl.h: fix mention of wrong error code in comment
+
+ The same error and comment were also used and is now corrected in
+ CURLOPT_SSH_KEYFUNCTION.3
+
+- symbol-scan.pl: scan and verify .3 man pages
+
+ This script now also finds all .3 man pages in docs/include and
+ docs/include/opts, extracts all uses of CURL* symbols and verifies that all
+ symbols mentioned in docs are defined in public headers.
+
+ A "global symbol" is one of those matching a known prefix and the script make
+ s
+ an attempt to check all/most of them. Just using *all* symbols that match
+ CURL* proved matching a little too many other references as well and turned
+ difficult turning into something useful.
+
+ Closes #9544
+
+- symbols-in-versions: add missing LIBCURL* symbols
+
+- symbol-scan.pl: also check for LIBCURL* symbols
+
+ Closes #9544
+
+- docs/libcurl/symbols-in-versions: add several missing symbols
+
+- test1119: scan all public headers
+
+ Previously this test only scanned a subset of the headers, which made us
+ accidentally miss symbols that were provided in the others. Now, the script
+ iterates over all headers present in include/curl.
+
+ Closes #9544
+
+Patrick Monnerat (21 Sep 2022)
+
+- examples/chkspeed: improve portability
+
+ The example program chkspeed uses strncasecmp() which is not portable
+ across systems. Replace calls to this function by tests on characters.
+
+ Closes #9562
+
+Daniel Stenberg (21 Sep 2022)
+
+- easy: fix the #include order
+
+ The mentioned "last 3 includes" order should be respected. easy_lock.h should
+ be included before those three.
+
+ Reported-by: Yuriy Chernyshov
+ Fixes #9560
+ Closes #9561
+
+- docs: spellfixes
+
+ Pointed by the new CI job
+
+- GHA: spellcheck
+
+ This spellchecker checks markdown files. For this reason this job
+ converts all man pages in the repository to markdown with pandoc before
+ the check runs.
+
+ The perl script 'cleanspell' filters out details from the man page in
+ the process, to avoid the spellchecker trying to spellcheck things it
+ can't. Like curl specific symbols and the SYNOPSIS and EXAMPLE sections
+ of libcurl man pages.
+
+ The spell checker does not check words in sections that are within pre,
+ strong and em tags.
+
+ 'spellcheck.words' is a custom word list with additional accepted words.
+
+ Closes #9523
+
+- connect: fix the wrong error message on connect failures
+
+ The "Failed to connect to" message after a connection failure would
+ include the strerror message based on the presumed previous socket
+ error, but in times it seems that error number is not set when reaching
+ this code and therefore it would include the wrong error message.
+
+ The strerror message is now removed from here and the curl_easy_strerror
+ error is used instead.
+
+ Reported-by: Edoardo Lolletti
+ Fixes #9549
+ Closes #9554
+
+- httpput-postfields.c: shorten string for C89 compliance
+
+ httpput-postfields.c:41:3: error: string length ‘522’ is greater than the
+ length ‘509’ ISO C90 compilers are required to support [-Woverlength-str
+ ings]
+ 41 | "this chapter.";
+ | ^~~~~~~~~~~~~~~
+
+ Closes #9555
+
+- ws: fix a C89 compliance nit
+
+ Closes #9541
+
+Patrick Monnerat (21 Sep 2022)
+
+- unit test 1655: make it C89-compliant
+
+ Initializations performed in unit test 1655 use automatic variables in
+ aggregates and thus can only be computed at run-time. Using gcc in C89
+ dialect mode produces warning messages like:
+
+ unit1655.c:96:7: warning: initializer element is not computable at load time
+ [-Wpedantic]
+ 96 | { toolong, DOH_DNS_NAME_TOO_LONG }, /* expect early failure */
+ | ^~~~~~~
+
+ Fix the problem by converting these automatic pointer variables to
+ static arrays.
+
+ Closes #9551
+
+Tobias Schaefer (20 Sep 2022)
+
+- curl_strequal.3: fix typo
+
+ Closes #9548
+
+Dmitry Karpov (20 Sep 2022)
+
+- resolve: make forced IPv4 resolve only use A queries
+
+ This protects IPv4-only transfers from undesired bad IPv6-related side
+ effects and make IPv4 transfers in dual-stack libcurl behave the same
+ way as in IPv4 single-stack libcurl.
+
+ Closes #9540
+
+Daniel Stenberg (20 Sep 2022)
+
+- RELEASE-NOTES: synced
+
+- winbuild/MakefileBuild.vc: handle spaces in libssh(2) include paths
+
+ Patched-by: Mark Itzcovitz
+ Bug: https://curl.se/mail/lib-2022-09/0038.html
+
+ Closes #9536
+
+- TODO: Reduce CA certificate bundle reparsing
+
+ By adding some sort of cache.
+
+ Reported-by: Michael Drake
+ Closes #9379
+ Closes #9538
+
+Marc Hoersken (19 Sep 2022)
+
+- CI/GHA: cancel outdated CI runs on new PR changes
+
+ Avoid letting outdated CI runs continue if a PR receives
+ new changes. Outside a PR we let them continue running
+ by tying the concurrency to the commit hash instead.
+
+ Also only let one CodeQL or Hacktoberfest job run at a time.
+
+ Other CI platforms we use have this build in, but GitHub
+ unfortunately neither by default nor with a simple option.
+
+ This saves CI resources and therefore a little energy.
+
+ Approved-by: Daniel Stenberg
+ Approved-by: Max Dymond
+ Closes #9533
+
+Daniel Stenberg (19 Sep 2022)
+
+- docs: fix proselint complaints
+
+- GHA: run proselint on markdown files
+
+ Co-authored-by: Marc Hörsken
+
+ Closes #9520
+
+- lib: the number four in a sequence is the "fourth"
+
+ Spelling is hard
+
+ Closes #9535
+
+John Bampton (19 Sep 2022)
+
+- misc: fix spelling in two source files
+
+ Closes #9529
+
+Viktor Szakats (18 Sep 2022)
+
+- windows: add .rc support to autotools builds
+
+ After this update autotools builds will compile and link `.rc` resources
+ to Windows executables. Bringing this feature on par with CMake and
+ Makefile.m32 builds. And also making it unnecessary to improvise these
+ steps manually, while monkey patching build files, e.g. [0].
+
+ You can customize the resource compiler via the `RC` envvar, and its
+ options via `RCFLAGS`.
+
+ This harmless warning may appear throughout the build, even though the
+ autotools manual documents [1] `RC` as a valid tag, and it fails when
+ omitting one:
+ `libtool: error: ignoring unknown tag RC`
+
+ [0] https://github.com/curl/curl-for-win/blob/535f19060d4b708f72e75dd849409ce
+ 50baa1b84/curl-autotools.sh#L376-L382
+ [1] https://www.gnu.org/software/libtool/manual/html_node/Tags.html
+
+ Closes #9521
+
+Marc Hoersken (18 Sep 2022)
+
+- CI/linkcheck: only run if a Markdown file is changed
+
+ This saves CI resources and therefore a little energy.
+
+ Reviewed-by: Max Dymond
+ Closes #9531
+
+- README.md: add GHA status badges for Linux and macOS builds
+
+ This makes sense now that Linux builds are being consolidated.
+
+ Approved-by: Daniel Stenberg
+ Closes #9530
+
+ [skip ci]
+
+Daniel Stenberg (17 Sep 2022)
+
+- misc: null-terminate
+
+ Make use of this term consistently.
+
+ Closes #9527
+
+Marc Hoersken (17 Sep 2022)
+
+- CI/GHA: merge intel CC and more TLS libs into linux workflow
+
+ Continue work on merging all Linux workflows into one file.
+
+ Reviewed-by: Max Dymond
+ Follow up to #9501
+ Closes #9514
+
+Patrick Monnerat (17 Sep 2022)
+
+- lib1597: make it C89-compliant again
+
+ Automatic variable addresses cannot be used in an initialisation
+ aggregate.
+
+ Follow-up to 9d51329
+
+ Reported-by: Daniel Stenberg
+ Fixes: #9524
+ Closes #9525
+
+Daniel Stenberg (17 Sep 2022)
+
+- tool_libinfo: silence "different 'const' qualifiers" in qsort()
+
+ MSVC 15.0.30729.1 warned about it
+
+ Follow-up to dd2a024323dcc
+
+ Closes #9522
+
+Patrick Monnerat (16 Sep 2022)
+
+- docs: tell about disabled protocols in CURLOPT_*PROTOCOLS_STR.
+
+ Disabled protocols are now handled as if they were unknown.
+ Also update the possible protocol list.
+
+- cli tool: do not use disabled protocols
+
+ As they are now rejected by the library, take care of not passing
+ disabled protocol names to CURLOPT_PROTOCOLS_STR and
+ CURLOPT_REDIR_PROTOCOLS_STR.
+
+ Rather than using the CURLPROTO_* constants, dynamically assign protocol
+ numbers based on the order they are listed by curl_version_info().
+
+ New type proto_set_t implements prototype bit masks: it should therefore
+ be large enough to accomodate all library-enabled protocols. If not,
+ protocol numbers beyond the bit count of proto_set_t are recognized but
+ "inaccessible": when used, a warning is displayed and the value is
+ ignored. Should proto_set_t overflows, enabled protocols are reordered to
+ force those having a public CURLPROTO_* representation to be accessible.
+
+ Code has been added to subordinate RTMP?* protocols to the presence of
+ RTMP in the enabled protocol list, being returned by curl_version_info()
+ or not.
+
+- setopt: use the handler table for protocol name to number conversions
+
+ This also returns error CURLE_UNSUPPORTED_PROTOCOL rather than
+ CURLE_BAD_FUNCTION_ARGUMENT when a listed protocol name is not found.
+
+ A new schemelen parameter is added to Curl_builtin_scheme() to support
+ this extended use.
+
+ Note that disabled protocols are not recognized anymore.
+
+ Tests adapted accordingly.
+
+ Closes #9472
+
+Daniel Stenberg (16 Sep 2022)
+
+- altsvc: use 'h3' for h3
+
+ Since the official and real version has been out for a while now and servers
+ are deployed out there using it, there is no point in sticking to h3-29.
+
+ Reported-by: ウさん
+ Fixes #9515
+ Closes #9516
+
+chemodax (16 Sep 2022)
+
+- winbuild: Use NMake batch-rules for compilation
+
+ - Invoke cl compiler once for each group of .c files.
+
+ This is significantly improves compilation time. For example in my
+ environment: 40 s --> 20 s.
+
+ Prior to this change cl was invoked per .c file.
+
+ Closes https://github.com/curl/curl/pull/9512
+
+Daniel Stenberg (16 Sep 2022)
+
+- ws: the infof() flags should be %zu
+
+ Follow-up to e5e9e0c5e49ae0
+
+ Closes #9518
+
+- curl: warn for --ssl use, considered insecure
+
+ Closes #9519
+
+Sergey Bronnikov (16 Sep 2022)
+
+- curl_escape.3: fix typo
+
+ lengthf -> length
+
+ Closes #9517
+
+Daniel Stenberg (16 Sep 2022)
+
+- mailmap: merge Philip Heiduck's two addresses into one
+
+- test1948: verify PUT + POST reusing the same handle
+
+ Reproduced #9507, verifies the fix
+
+- setopt: when POST is set, reset the 'upload' field
+
+ Reported-by: RobBotic1 on github
+ Fixes #9507
+ Closes #9511
+
+Marc Hoersken (15 Sep 2022)
+
+- github: initial CODEOWNERS setup for CI configuration
+
+ Reviewed-by: Daniel Stenberg
+ Reviewed-by: Marcel Raad
+ Reviewed-by: Max Dymond
+
+ Closes #9505
+
+ [skip ci]
+
+Philip Heiduck (15 Sep 2022)
+
+- CI: optimize some more dependencies install
+
+ Signed-off-by: Philip Heiduck
+
+ Closes #9500
+
+Marc Hoersken (15 Sep 2022)
+
+- CI/GHA: merge event-based and NSS into new linux workflow
+
+ Continue work on merging all Linux workflows into one file.
+
+ Follow up to #9501
+ Closes #9506
+
+Daniel Stenberg (15 Sep 2022)
+
+- include/curl/websockets.h: add extern "C" for C++
+
+ Reported-by: n0name321 on github
+ Fixes #9509
+ Closes #9510
+
+- lib1560: extended to verify detect/reject of unknown schemes
+
+ ... when no guessing is allowed.
+
+- urlapi: detect scheme better when not guessing
+
+ When the parser is not allowed to guess scheme, it should consider the
+ word ending at the first colon to be the scheme, independently of number
+ of slashes.
+
+ The parser now checks that the scheme is known before it counts slashes,
+ to improve the error messge for URLs with unknown schemes and maybe no
+ slashes.
+
+ When following redirects, no scheme guessing is allowed and therefore
+ this change effectively prevents redirects to unknown schemes such as
+ "data".
+
+ Fixes #9503
+
+- strerror: improve two URL API error messages
+
+Marc Hoersken (14 Sep 2022)
+
+- CI/GHA: merge bearssl and hyper into initial linux workflow
+
+ Begin work on merging all Linux workflows into one file.
+
+ Closes #9501
+
+Daniel Stenberg (14 Sep 2022)
+
+- RELEASE-NOTES: synced
+
+- cmake: define BUILDING_LIBCURL in lib/CMakeLists, not config.h
+
+ Since the config file might also get included by the tool code at times.
+ This syncs with how other builds do it.
+
+ Closes #9498
+
+- tool_hugehelp: make hugehelp a blank macro when disabled
+
+ Closes #9485
+
+- getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
+
+ ... to improve the output in this situation. Now it doesn't say "option
+ unknown" anymore.
+
+ Closes #9485
+
+- setopt: fix compiler warning
+
+ Follow-up to cd5ca80f00d2
+
+ closes #9502
+
+Philip Heiduck (13 Sep 2022)
+
+- CI: skip make, do make install at once for dependencies
+
+ Signed-off-by: Philip Heiduck
+
+ Closes #9477
+
+Daniel Stenberg (13 Sep 2022)
+
+- formdata: typecast the va_arg return value
+
+ To avoid "enumerated type mixed with another type" warnings
+
+ Follow-up from 0f52dd5fd5aa3592691a
+
+ Closes #9499
+
+- RELEASE-PROCEDURE.md: mention patch releases
+
+ - When to make them and how to argue for them
+ - Refreshed the release date list
+
+ Closes #9495
+
+- urldata: use a curl_prot_t type for storing protocol bits
+
+ This internal-use-only storage type can be bumped to a curl_off_t once
+ we need to use bit 32 as the previous 'unsigned int' can no longer hold
+ them all then.
+
+ The websocket protocols take bit 30 and 31 so they are the last ones
+ that fit within 32 bits - but cannot properly be exported through APIs
+ since those use *signed* 32 bit types (long) in places.
+
+ Closes #9481
+
+zhanghu on xiaomi (13 Sep 2022)
+
+- formdata: fix warning: 'CURLformoption' is promoted to 'int'
+
+ curl/lib/formdata.c: In function 'FormAdd':
+ curl/lib/formdata.c:249:31: warning: 'CURLformoption' is promoted to 'int' wh
+ en passed through '...'
+ 249 | option = va_arg(params, CURLformoption);
+ | ^
+ curl/lib/formdata.c:249:31: note: (so you should pass 'int' not 'CURLformopti
+ on' to 'va_arg')
+ curl/lib/formdata.c:249:31: note: if this code is reached, the program will a
+ bort
+
+ Closes #9484
+
+Daniel Stenberg (13 Sep 2022)
+
+- CURLOPT_CONNECT_ONLY.3: for ws(s) as well
+
+ and correct the version number for when that support comes. Even if it
+ is still experimental for WebSocket.
+
+ Closes #9487
+
+- tool_operate: avoid a few #ifdefs for disabled-libcurl builds
+
+ By providing empty macros in the header file instead, the code gets
+ easier to read and yet is disabled on demand.
+
+ Closes #9486
+
+a1346054 on github (13 Sep 2022)
+
+- scripts: use `grep -E` instead of `egrep`
+
+ egrep is deprecated
+
+ Closes #9491
+
+Hayden Roche (13 Sep 2022)
+
+- wolfSSL: fix session management bug.
+
+ Prior to this commit, non-persistent pointers were being used to store
+ sessions. When a WOLFSSL object was then freed, that freed the session
+ it owned, and thus invalidated the pointer held in curl's cache. This
+ commit makes it so we get a persistent (deep copied) session pointer
+ that we then add to the cache. Accordingly, wolfssl_session_free, which
+ was previously a no-op, now needs to actually call SSL_SESSION_free.
+
+ This bug was discovered by a wolfSSL customer.
+
+ Closes #9492
+
+Daniel Stenberg (13 Sep 2022)
+
+- docs: use "WebSocket" in singular
+
+ This is how the RFC calls the protocol. Also rename the file in docs/ to
+ WEBSOCKET.md in uppercase to match how we have done it for many other
+ protocol docs in similar fashion.
+
+ Add the WebSocket docs to the tarball.
+
+ Closes #9496
+
+Marcel Raad (12 Sep 2022)
+
+- ws: fix build without `USE_WEBSOCKETS`
+
+ The curl.h include is required unconditionally.
+
+- ws: add missing curl.h include
+
+ A conflict between commits 664249d0952 and e5839f4ee70 broke the build.
+
+Daniel Stenberg (12 Sep 2022)
+
+- ws: fix an infof() call to use %uz for size_t output
+
+ Detected by Coverity, CID 1514665.
+
+ Closes #9480
+
+Marcel Raad (12 Sep 2022)
+
+- curl_setup: include only system.h instead of curl.h
+
+ As done before commit 9506d01ee50.
+
+ Ref: https://github.com/curl/curl/pull/9375#discussion_r957010158
+ Closes https://github.com/curl/curl/pull/9453
+
+- lib: add missing limits.h includes
+
+ Closes https://github.com/curl/curl/pull/9453
+
+- lib and tests: add missing curl.h includes
+
+ Closes https://github.com/curl/curl/pull/9453
+
+- curl_setup: include curl.h after platform setup headers
+
+ The platform setup headers might set definitions required for the
+ includes in curl.h.
+
+ Ref: https://github.com/curl/curl/pull/9375#discussion_r956998269
+ Closes https://github.com/curl/curl/pull/9453
+
+Benjamin Loison (12 Sep 2022)
+
+- docs: correct missing uppercase in Markdown files
+
+ To detect these typos I used:
+
+ ```
+ clear && grep -rn '\. [a-z]' . | uniq | grep -v '\. lib' | grep -v '[0-9]\. [
+ a-z]' | grep -v '\.\. [a-z]' | grep -v '\. curl' | grep -v 'e.g. [a-z]' | gre
+ p -v 'eg. [a-z]' | grep -v '\etc. [a-z]' | grep -v 'i.e\. [a-z]' | grep --col
+ or=always '\. [a-z]' | grep '\.md'
+ ```
+
+ Closes #9474
+
+Daniel Stenberg (12 Sep 2022)
+
+- tool_setopt: use better English in --libcurl source comments
+
+ Like this:
+
+ XYZ was set to an object pointer
+ ABC was set to a function pointer
+
+ Closes #9475
+
+- setopt: make protocol2num use a curl_off_t for the protocol bit
+
+ ... since WSS does not fit within 32 bit.
+
+ Bug: https://github.com/curl/curl/pull/9467#issuecomment-1243014887
+ Closes #9476
+
+- RELEASE-NOTES: synced
+
+- configure: polish the grep -E message a bit further
+
+ Suggested-by: Emanuele Torre
+ Closes #9473
+
+- GHA: add a gcc-11 -O3 build using OpenSSL
+
+ Since -O3 might trigger other warnings
+
+ Closes #9454
+
+Patrick Monnerat (11 Sep 2022)
+
+- content_encoding: use writer struct subclasses for different encodings
+
+ The variable-sized encoding-specific storage of a struct contenc_writer
+ currently relies on void * alignment that may be insufficient with
+ regards to the specific storage fields, although having not caused any
+ problems yet.
+
+ In addition, gcc 11.3 issues a warning on access to fields of partially
+ allocated structures that can occur when the specific storage size is 0:
+
+ content_encoding.c: In function ‘Curl_build_unencoding_stack’:
+ content_encoding.c:980:21: warning: array subscript ‘struct contenc_write
+ r[0]’ is partly outside array bounds of ‘unsigned char[16]’ [-Warray-bo
+ unds]
+ 980 | writer->handler = handler;
+ | ~~~~~~~~~~~~~~~~^~~~~~~~~
+ In file included from content_encoding.c:49:
+ memdebug.h:115:29: note: referencing an object of size 16 allocated by ‘c
+ url_dbg_calloc’
+ 115 | #define calloc(nbelem,size) curl_dbg_calloc(nbelem, size, __LINE__,
+ __FILE__)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~
+ content_encoding.c:977:60: note: in expansion of macro ‘calloc’
+ 977 | struct contenc_writer *writer = (struct contenc_writer *)calloc(1
+ , sz);
+
+ To solve both these problems, the current commit replaces the
+ contenc_writer/params structure pairs by "subclasses" of struct
+ contenc_writer. These are structures that contain a contenc_writer at
+ offset 0. Proper field alignment is therefore handled by the compiler and
+ full structure allocation is performed, silencing the warnings.
+
+ Closes #9455
+
+Daniel Stenberg (11 Sep 2022)
+
+- configure: correct the wording when checking grep -E
+
+ The check first checks that grep -E works, and only as a fallback tries
+ to find and use egrep. egrep is deprecated.
+
+ This change only corrects the output wording, not the checks themselves.
+
+ Closes #9471
+
+Viktor Szakats (10 Sep 2022)
+
+- websockets: sync prototypes in docs with implementation [ci skip]
+
+ Docs for the new send/recv functions synced with the committed versions
+ of these.
+
+ Closes #9470
+
+Daniel Stenberg (10 Sep 2022)
+
+- setopt: make protocols2num() work with websockets
+
+ So that CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR can
+ specify those as well.
+
+ Reported-by: Patrick Monnerat
+ Bug: https://curl.se/mail/lib-2022-09/0016.html
+ Closes #9467
+
+- curl/websockets.h: remove leftover bad typedef
+
+ Just a leftover trace of a development thing that did not stay like
+ that.
+
+ Reported-by: Marc Hörsken
+ Fixes #9465
+ Cloes #9466
+
+Orgad Shaneh (10 Sep 2022)
+
+- fix Cygwin/MSYS compilation
+
+ _getpid is Windows API. On Cygwin variants it should remain getpid.
+
+ Fixes #8220
+ Closes #9255
+
+Marc Hoersken (10 Sep 2022)
+
+- GHA: prepare workflow merge by aligning structure again
+
+ Closes #9413
+
+Daniel Stenberg (9 Sep 2022)
+
+- docs: the websockets symbols are added in 7.86.0
+
+ Nothing else
+
+ Closes #9459
+
+- tests/libtest/Makefile.inc: fixup merge conflict mistake
+
+- EXPERIMENTAL.md: add WebSockets
+
+- appveyor: enable websockets
+
+- cirrus: enable websockets in the windows builds
+
+- GHA: add websockets to macos, openssl3 and hyper builds
+
+- tests: add websockets tests
+
+ - add websockets support to sws
+ - 2300: first very basic websockets test
+ - 2301: first libcurl test for ws (not working yet)
+ - 2302: use the ws callback
+ - 2303: test refused upgrade
+
+- curl_ws_meta: initial implementation
+
+- curl_ws_meta.3: added docs
+
+- ws: initial websockets support
+
+ Closes #8995
+
+- version: add ws + wss
+
+- libtest/lib1560: test basic websocket URL parsing
+
+- configure: add --enable-websockets
+
+- docs/WebSockets.md: docs
+
+- test415: verify Content-Length parser with control code + negative value
+
+- strtoofft: after space, there cannot be a control code
+
+ With the change from ISSPACE() to ISBLANK() this function no longer
+ deals with (ignores) control codes the same way, which could lead to
+ this function returning unexpected values like in the case of
+ "Content-Length: \r-12354".
+
+ Follow-up to 6f9fb7ec2d7cb389a0da5
+
+ Detected by OSS-fuzz
+ Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51140
+ Assisted-by: Max Dymond
+ Closes #9458
+
+- headers: reset the requests counter at transfer start
+
+ If not, reusing an easy handle to do a subsequent transfer would
+ continue the counter from the previous invoke, which then would make use
+ of the header API difficult/impossible as the request counter
+ mismatched.
+
+ Add libtest 1947 to verify.
+
+ Reported-by: Andrew Lambert
+ Fixes #9424
+ Closes #9447
+
+Jay Satiro (8 Sep 2022)
+
+- header: define public API functions as extern c
+
+ Prior to this change linker errors would occur if curl_easy_header or
+ curl_easy_nextheader was called from a C++ unit.
+
+ Bug: https://github.com/curl/curl/issues/9424#issuecomment-1238818007
+ Reported-by: Andrew Lambert
+
+ Closes https://github.com/curl/curl/pull/9446
+
+Daniel Stenberg (8 Sep 2022)
+
+- http2: make nghttp2 less picky about field whitespace
+
+ In nghttp2 1.49.0 it returns error on leading and trailing whitespace in
+ header fields according to language in the recently shipped RFC 9113.
+
+ nghttp2 1.50.0 introduces an option to switch off this strict check and
+ this change enables this option by default which should make curl behave
+ more similar to how it did with nghttp2 1.48.0 and earlier.
+
+ We might want to consider making this an option in the future.
+
+ Closes #9448
+
+- RELEASE-NOTES: synced
+
+ And bump to 7.86.0 for the pending next release
diff --git a/curl-8.0.1_9-win64-mingw/COPYING.txt b/curl-8.0.1_9-win64-mingw/COPYING.txt
new file mode 100644
index 0000000..d1eab3e
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/COPYING.txt
@@ -0,0 +1,22 @@
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright (c) 1996 - 2023, Daniel Stenberg, , and many
+contributors, see the THANKS file.
+
+All rights reserved.
+
+Permission to use, copy, modify, and distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright
+notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
+NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+OR OTHER DEALINGS IN THE SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall not
+be used in advertising or otherwise to promote the sale, use or other dealings
+in this Software without prior written authorization of the copyright holder.
diff --git a/curl-8.0.1_9-win64-mingw/README.txt b/curl-8.0.1_9-win64-mingw/README.txt
new file mode 100644
index 0000000..f5efbd7
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/README.txt
@@ -0,0 +1,55 @@
+ _ _ ____ _
+ ___| | | | _ \| |
+ / __| | | | |_) | |
+ | (__| |_| | _ <| |___
+ \___|\___/|_| \_\_____|
+
+README
+
+ Curl is a command line tool for transferring data specified with URL
+ syntax. Find out how to use curl by reading the curl.1 man page or the
+ MANUAL document. Find out how to install Curl by reading the INSTALL
+ document.
+
+ libcurl is the library curl is using to do its job. It is readily
+ available to be used by your software. Read the libcurl.3 man page to
+ learn how.
+
+ You find answers to the most frequent questions we get in the FAQ document.
+
+ Study the COPYING file for distribution terms.
+
+ Those documents and more can be found in the docs/ directory.
+
+CONTACT
+
+ If you have problems, questions, ideas or suggestions, please contact us
+ by posting to a suitable mailing list. See https://curl.se/mail/
+
+ All contributors to the project are listed in the THANKS document.
+
+WEBSITE
+
+ Visit the curl website for the latest news and downloads:
+
+ https://curl.se/
+
+GIT
+
+ To download the latest source code off the GIT server, do this:
+
+ git clone https://github.com/curl/curl.git
+
+ (you will get a directory named curl created, filled with the source code)
+
+SECURITY PROBLEMS
+
+ Report suspected security problems via our HackerOne page and not in public.
+
+ https://hackerone.com/curl
+
+NOTICE
+
+ Curl contains pieces of source code that is Copyright (c) 1998, 1999
+ Kungliga Tekniska Högskolan. This notice is included here to comply with the
+ distribution terms.
diff --git a/curl-8.0.1_9-win64-mingw/RELEASE-NOTES.txt b/curl-8.0.1_9-win64-mingw/RELEASE-NOTES.txt
new file mode 100644
index 0000000..d9ac4e6
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/RELEASE-NOTES.txt
@@ -0,0 +1,33 @@
+curl and libcurl 8.0.1
+
+ Public curl releases: 216
+ Command line options: 250
+ curl_easy_setopt() options: 302
+ Public functions in libcurl: 91
+ Contributors: 2841
+
+This release includes the following bugfixes:
+
+ o Revert "multi: remove PENDING + MSGSENT handles" [1]
+
+This release includes the following known bugs:
+
+ o see docs/KNOWN_BUGS (https://curl.se/docs/knownbugs.html)
+
+Planned upcoming removals include:
+
+ o gskit
+ o NSS
+ o support for space-separated NOPROXY patterns
+ o support for the original legacy mingw version 1
+
+ See https://curl.se/dev/deprecate.html for details
+
+This release would not have looked like this without help, code, reports and
+advice from friends like these:
+
+ Daniel Stenberg, Kamil Dudka
+
+References to bug reports and discussions on issues:
+
+ [1] = https://curl.se/bug/?i=10795
diff --git a/curl-8.0.1_9-win64-mingw/bin/curl-ca-bundle.crt b/curl-8.0.1_9-win64-mingw/bin/curl-ca-bundle.crt
new file mode 100644
index 0000000..2ae7b6c
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/bin/curl-ca-bundle.crt
@@ -0,0 +1,3372 @@
+##
+## Bundle of CA Root Certificates
+##
+## Certificate data from Mozilla as of: Tue Jan 10 04:12:06 2023 GMT
+##
+## This is a bundle of X.509 certificates of public Certificate Authorities
+## (CA). These were automatically extracted from Mozilla's root certificates
+## file (certdata.txt). This file can be found in the mozilla source tree:
+## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
+##
+## It contains the certificates in PEM format and therefore
+## can be directly used with curl / libcurl / php_curl, or with
+## an Apache+mod_ssl webserver for SSL client authentication.
+## Just configure this file as the SSLCACertificateFile.
+##
+## Conversion done with mk-ca-bundle.pl version 1.29.
+## SHA256: 90c470e705b4b5f36f09684dc50e2b79c8b86989a848b62cd1a7bd6460ee65f6
+##
+
+
+GlobalSign Root CA
+==================
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx
+GTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jvb3QgQ0ExGzAZBgNVBAMTEkds
+b2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAwMDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNV
+BAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYD
+VQQDExJHbG9iYWxTaWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDa
+DuaZjc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavpxy0Sy6sc
+THAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp1Wrjsok6Vjk4bwY8iGlb
+Kk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdGsnUOhugZitVtbNV4FpWi6cgKOOvyJBNP
+c1STE4U6G7weNLWLBYy5d4ux2x8gkasJU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrX
+gzT/LCrBbBlDSgeF59N89iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0BAQUF
+AAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOzyj1hTdNGCbM+w6Dj
+Y1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE38NflNUVyRRBnMRddWQVDf9VMOyG
+j/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymPAbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhH
+hm4qxFYxldBniYUr+WymXUadDKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveC
+X4XSQRjbgbMEHMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
+-----END CERTIFICATE-----
+
+Entrust.net Premium 2048 Secure Server CA
+=========================================
+-----BEGIN CERTIFICATE-----
+MIIEKjCCAxKgAwIBAgIEOGPe+DANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChMLRW50cnVzdC5u
+ZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBpbmNvcnAuIGJ5IHJlZi4gKGxp
+bWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNV
+BAMTKkVudHJ1c3QubmV0IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQx
+NzUwNTFaFw0yOTA3MjQxNDE1MTJaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3
+d3d3LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTEl
+MCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50cnVzdC5u
+ZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEArU1LqRKGsuqjIAcVFmQqK0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOL
+Gp18EzoOH1u3Hs/lJBQesYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSr
+hRSGlVuXMlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVTXTzW
+nLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/HoZdenoVve8AjhUi
+VBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH4QIDAQABo0IwQDAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVeSB0RGAvtiJuQijMfmhJAkWuXAwDQYJ
+KoZIhvcNAQEFBQADggEBADubj1abMOdTmXx6eadNl9cZlZD7Bh/KM3xGY4+WZiT6QBshJ8rmcnPy
+T/4xmf3IDExoU8aAghOY+rat2l098c5u9hURlIIM7j+VrxGrD9cv3h8Dj1csHsm7mhpElesYT6Yf
+zX1XEC+bBAlahLVu2B064dae0Wx5XnkcFMXj0EyTO2U87d89vqbllRrDtRnDvV5bu/8j72gZyxKT
+J1wDLW8w0B62GqzeWvfRqqgnpv55gcR5mTNXuhKwqeBCbJPKVt7+bYQLCIt+jerXmCHG8+c8eS9e
+nNFMFY3h7CI3zJpDC5fcgJCNs2ebb0gIFVbPv/ErfF6adulZkMV8gzURZVE=
+-----END CERTIFICATE-----
+
+Baltimore CyberTrust Root
+=========================
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJRTESMBAGA1UE
+ChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3li
+ZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoXDTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMC
+SUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFs
+dGltb3JlIEN5YmVyVHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKME
+uyKrmD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjrIZ3AQSsB
+UnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeKmpYcqWe4PwzV9/lSEy/C
+G9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSuXmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9
+XbIGevOF6uvUA65ehD5f/xXtabz5OTZydc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjpr
+l3RjM71oGDHweI12v/yejl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoI
+VDaGezq1BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEB
+BQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT929hkTI7gQCvlYpNRh
+cL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3WgxjkzSswF07r51XgdIGn9w/xZchMB5
+hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsa
+Y71k5h+3zvDyny67G7fyUIhzksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9H
+RCwBXbsdtTLSR9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp
+-----END CERTIFICATE-----
+
+Entrust Root Certification Authority
+====================================
+-----BEGIN CERTIFICATE-----
+MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMCVVMxFjAUBgNV
+BAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0Lm5ldC9DUFMgaXMgaW5jb3Jw
+b3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMWKGMpIDIwMDYgRW50cnVzdCwgSW5jLjEtMCsG
+A1UEAxMkRW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEyNzIwMjM0
+MloXDTI2MTEyNzIwNTM0MlowgbAxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMu
+MTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZlcmVu
+Y2UxHzAdBgNVBAsTFihjKSAyMDA2IEVudHJ1c3QsIEluYy4xLTArBgNVBAMTJEVudHJ1c3QgUm9v
+dCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ALaVtkNC+sZtKm9I35RMOVcF7sN5EUFoNu3s/poBj6E4KPz3EEZmLk0eGrEaTsbRwJWIsMn/MYsz
+A9u3g3s+IIRe7bJWKKf44LlAcTfFy0cOlypowCKVYhXbR9n10Cv/gkvJrT7eTNuQgFA/CYqEAOww
+Cj0Yzfv9KlmaI5UXLEWeH25DeW0MXJj+SKfFI0dcXv1u5x609mhF0YaDW6KKjbHjKYD+JXGIrb68
+j6xSlkuqUY3kEzEZ6E5Nn9uss2rVvDlUccp6en+Q3X0dgNmBu1kmwhH+5pPi94DkZfs0Nw4pgHBN
+rziGLp5/V6+eF67rHMsoIV+2HNjnogQi+dPa2MsCAwEAAaOBsDCBrTAOBgNVHQ8BAf8EBAMCAQYw
+DwYDVR0TAQH/BAUwAwEB/zArBgNVHRAEJDAigA8yMDA2MTEyNzIwMjM0MlqBDzIwMjYxMTI3MjA1
+MzQyWjAfBgNVHSMEGDAWgBRokORnpKZTgMeGZqTx90tD+4S9bTAdBgNVHQ4EFgQUaJDkZ6SmU4DH
+hmak8fdLQ/uEvW0wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqGSIb3DQEBBQUA
+A4IBAQCT1DCw1wMgKtD5Y+iRDAUgqV8ZyntyTtSx29CW+1RaGSwMCPeyvIWonX9tO1KzKtvn1ISM
+Y/YPyyYBkVBs9F8U4pN0wBOeMDpQ47RgxRzwIkSNcUesyBrJ6ZuaAGAT/3B+XxFNSRuzFVJ7yVTa
+v52Vr2ua2J7p8eRDjeIRRDq/r72DQnNSi6q7pynP9WQcCk3RvKqsnyrQ/39/2n3qse0wJcGE2jTS
+W3iDVuycNsMm4hH2Z0kdkquM++v/eu6FSqdQgPCnXEqULl8FmTxSQeDNtGPPAUO6nIPcj2A781q0
+tHuu2guQOHXvgR1m0vdXcDazv/wor3ElhVsT/h5/WrQ8
+-----END CERTIFICATE-----
+
+Comodo AAA Services root
+========================
+-----BEGIN CERTIFICATE-----
+MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwS
+R3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0Eg
+TGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAw
+MFoXDTI4MTIzMTIzNTk1OVowezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hl
+c3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQuaBtDFcCLNSS1UY8y2bmhG
+C1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe3M/vg4aijJRPn2jymJBGhCfHdr/jzDUs
+i14HZGWCwEiwqJH5YZ92IFCokcdmtet4YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszW
+Y19zjNoFmag4qMsXeDZRrOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjH
+Ypy+g8cmez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQUoBEK
+Iz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wewYDVR0f
+BHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNl
+cy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2Vz
+LmNybDANBgkqhkiG9w0BAQUFAAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm
+7l3sAg9g1o1QGE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
+Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2G9w84FoVxp7Z
+8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsil2D4kF501KKaU73yqWjgom7C
+12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
+-----END CERTIFICATE-----
+
+QuoVadis Root CA 2
+==================
+-----BEGIN CERTIFICATE-----
+MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0xGTAXBgNVBAoT
+EFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJvb3QgQ0EgMjAeFw0wNjExMjQx
+ODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
+aW1pdGVkMRswGQYDVQQDExJRdW9WYWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQCaGMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6
+XJxgFyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55JWpzmM+Yk
+lvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bBrrcCaoF6qUWD4gXmuVbB
+lDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp+ARz8un+XJiM9XOva7R+zdRcAitMOeGy
+lZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt
+66/3FsvbzSUr5R/7mp/iUcw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1Jdxn
+wQ5hYIizPtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og/zOh
+D7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UHoycR7hYQe7xFSkyy
+BNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuIyV77zGHcizN300QyNQliBJIWENie
+J0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1Ud
+DgQWBBQahGK8SEwzJQTU7tD2A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGU
+a6FJpEcwRTELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT
+ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2fBluornFdLwUv
+Z+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzng/iN/Ae42l9NLmeyhP3ZRPx3
+UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2BlfF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodm
+VjB3pjd4M1IQWK4/YY7yarHvGH5KWWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK
++JDSV6IZUaUtl0HaB0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrW
+IozchLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPRTUIZ3Ph1
+WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWDmbA4CD/pXvk1B+TJYm5X
+f6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0ZohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II
+4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8
+VCLAAVBpQ570su9t+Oza8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u
+-----END CERTIFICATE-----
+
+QuoVadis Root CA 3
+==================
+-----BEGIN CERTIFICATE-----
+MIIGnTCCBIWgAwIBAgICBcYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0xGTAXBgNVBAoT
+EFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJvb3QgQ0EgMzAeFw0wNjExMjQx
+OTExMjNaFw0zMTExMjQxOTA2NDRaMEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
+aW1pdGVkMRswGQYDVQQDExJRdW9WYWRpcyBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQDMV0IWVJzmmNPTTe7+7cefQzlKZbPoFog02w1ZkXTPkrgEQK0CSzGrvI2RaNgg
+DhoB4hp7Thdd4oq3P5kazethq8Jlph+3t723j/z9cI8LoGe+AaJZz3HmDyl2/7FWeUUrH556VOij
+KTVopAFPD6QuN+8bv+OPEKhyq1hX51SGyMnzW9os2l2ObjyjPtr7guXd8lyyBTNvijbO0BNO/79K
+DDRMpsMhvVAEVeuxu537RR5kFd5VAYwCdrXLoT9CabwvvWhDFlaJKjdhkf2mrk7AyxRllDdLkgbv
+BNDInIjbC3uBr7E9KsRlOni27tyAsdLTmZw67mtaa7ONt9XOnMK+pUsvFrGeaDsGb659n/je7Mwp
+p5ijJUMv7/FfJuGITfhebtfZFG4ZM2mnO4SJk8RTVROhUXhA+LjJou57ulJCg54U7QVSWllWp5f8
+nT8KKdjcT5EOE7zelaTfi5m+rJsziO+1ga8bxiJTyPbH7pcUsMV8eFLI8M5ud2CEpukqdiDtWAEX
+MJPpGovgc2PZapKUSU60rUqFxKMiMPwJ7Wgic6aIDFUhWMXhOp8q3crhkODZc6tsgLjoC2SToJyM
+Gf+z0gzskSaHirOi4XCPLArlzW1oUevaPwV/izLmE1xr/l9A4iLItLRkT9a6fUg+qGkM17uGcclz
+uD87nSVL2v9A6wIDAQABo4IBlTCCAZEwDwYDVR0TAQH/BAUwAwEB/zCB4QYDVR0gBIHZMIHWMIHT
+BgkrBgEEAb5YAAMwgcUwgZMGCCsGAQUFBwICMIGGGoGDQW55IHVzZSBvZiB0aGlzIENlcnRpZmlj
+YXRlIGNvbnN0aXR1dGVzIGFjY2VwdGFuY2Ugb2YgdGhlIFF1b1ZhZGlzIFJvb3QgQ0EgMyBDZXJ0
+aWZpY2F0ZSBQb2xpY3kgLyBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVudC4wLQYIKwYB
+BQUHAgEWIWh0dHA6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL2NwczALBgNVHQ8EBAMCAQYwHQYD
+VR0OBBYEFPLAE+CCQz777i9nMpY1XNu4ywLQMG4GA1UdIwRnMGWAFPLAE+CCQz777i9nMpY1XNu4
+ywLQoUmkRzBFMQswCQYDVQQGEwJCTTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UE
+AxMSUXVvVmFkaXMgUm9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZV
+qyM07ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSemd1o417+s
+hvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62Iix2rFo1bZhfZFvSLgNLd+LJ2w/w4E6oM3kJpK27z
+POuAJ9v1pkQNn1pVWQvVDVJIxa6f8i+AxeoyUDUSly7B4f/xI4hROJ/yZlZ25w9Rl6VSDE1JUZU2
+Pb+iSwwQHYaZTKrzchGT5Or2m9qoXadNt54CrnMAyNojA+j56hl0YgCUyyIgvpSnWbWCar6ZeXqp
+8kokUvd0/bpO5qgdAm6xDYBEwa7TIzdfu4V8K5Iu6H6li92Z4b8nby1dqnuH/grdS/yO9SbkbnBC
+bjPsMZ57k8HkyWkaPcBrTiJt7qtYTcbQQcEr6k8Sh17rRdhs9ZgC06DYVYoGmRmioHfRMJ6szHXu
+g/WwYjnPbFfiTNKRCw51KBuav/0aQ/HKd/s7j2G4aSgWQgRecCocIdiP4b0jWy10QJLZYxkNc91p
+vGJHvOB0K7Lrfb5BG7XARsWhIstfTsEokt4YutUqKLsRixeTmJlglFwjz1onl14LBQaTNx47aTbr
+qZ5hHY8y2o4M1nQ+ewkk2gF3R8Q7zTSMmfXK4SVhM7JZG+Ju1zdXtg2pEto=
+-----END CERTIFICATE-----
+
+Security Communication Root CA
+==============================
+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMP
+U0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEw
+HhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMP
+U0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw
+8yl89f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJDKaVv0uM
+DPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9Ms+k2Y7CI9eNqPPYJayX
+5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/NQV3Is00qVUarH9oe4kA92819uZKAnDfd
+DJZkndwi92SL32HeFZRSFaB9UslLqCHJxrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2
+JChzAgMBAAGjPzA9MB0GA1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYw
+DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vGkl3g
+0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfrUj94nK9NrvjVT8+a
+mCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5Bw+SUEmK3TGXX8npN6o7WWWXlDLJ
+s58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJUJRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ
+6rBK+1YWc26sTfcioU+tHXotRSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAi
+FL39vmwLAw==
+-----END CERTIFICATE-----
+
+XRamp Global CA Root
+====================
+-----BEGIN CERTIFICATE-----
+MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCBgjELMAkGA1UE
+BhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2Vj
+dXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkwHhcNMDQxMTAxMTcxNDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMx
+HjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkg
+U2VydmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
+dHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS638eMpSe2OAtp87ZOqCwu
+IR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCPKZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMx
+foArtYzAQDsRhtDLooY2YKTVMIJt2W7QDxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FE
+zG+gSqmUsE3a56k0enI4qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqs
+AxcZZPRaJSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNViPvry
+xS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1Ud
+EwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASsjVy16bYbMDYGA1UdHwQvMC0wK6Ap
+oCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMC
+AQEwDQYJKoZIhvcNAQEFBQADggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc
+/Kh4ZzXxHfARvbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt
+qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLaIR9NmXmd4c8n
+nxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSyi6mx5O+aGtA9aZnuqCij4Tyz
+8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQO+7ETPTsJ3xCwnR8gooJybQDJbw=
+-----END CERTIFICATE-----
+
+Go Daddy Class 2 CA
+===================
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMY
+VGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRp
+ZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkG
+A1UEBhMCVVMxITAfBgNVBAoTGFRoZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28g
+RGFkZHkgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQAD
+ggENADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCAPVYYYwhv
+2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6wwdhFJ2+qN1j3hybX2C32
+qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXiEqITLdiOr18SPaAIBQi2XKVlOARFmR6j
+YGB0xUGlcmIbYsUfb18aQr4CUWWoriMYavx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmY
+vLEHZ6IVDd2gWMZEewo+YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0O
+BBYEFNLEsNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h/t2o
+atTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMu
+MTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggEAMAwG
+A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wim
+PQoZ+YeAEW5p5JYXMP80kWNyOO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKt
+I3lpjbi2Tc7PTMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ
+HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mERdEr/VxqHD3VI
+Ls9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5CufReYNnyicsbkqWletNw+vHX/b
+vZ8=
+-----END CERTIFICATE-----
+
+Starfield Class 2 CA
+====================
+-----BEGIN CERTIFICATE-----
+MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzElMCMGA1UEChMc
+U3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZpZWxkIENsYXNzIDIg
+Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQwNjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBo
+MQswCQYDVQQGEwJVUzElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAG
+A1UECxMpU3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqG
+SIb3DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf8MOh2tTY
+bitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN+lq2cwQlZut3f+dZxkqZ
+JRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVm
+epsZGD3/cVE8MC5fvj13c7JdBmzDI1aaK4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSN
+F4Azbl5KXZnJHoe0nRrA1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HF
+MIHCMB0GA1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fRzt0f
+hvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0YXJmaWVsZCBUZWNo
+bm9sb2dpZXMsIEluYy4xMjAwBgNVBAsTKVN0YXJmaWVsZCBDbGFzcyAyIENlcnRpZmljYXRpb24g
+QXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAAWdP4id0ckaVaGs
+afPzWdqbAYcaT1epoXkJKtv3L7IezMdeatiDh6GX70k1PncGQVhiv45YuApnP+yz3SFmH8lU+nLM
+PUxA2IGvd56Deruix/U0F47ZEUD0/CwqTRV/p2JdLiXTAAsgGh1o+Re49L2L7ShZ3U0WixeDyLJl
+xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynpVSJYACPq4xJD
+KVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEYWQPJIrSPnNVeKtelttQKbfi3
+QBFGmh95DmK/D5fs4C8fF5Q=
+-----END CERTIFICATE-----
+
+DigiCert Assured ID Root CA
+===========================
+-----BEGIN CERTIFICATE-----
+MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBlMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQw
+IgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzEx
+MTEwMDAwMDAwWjBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQL
+ExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0Ew
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7cJpSIqvTO
+9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYPmDI2dsze3Tyoou9q+yHy
+UmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW
+/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpy
+oeb6pNnVFzF1roV9Iq4/AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whf
+GHdPAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRF
+66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzANBgkq
+hkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRCdWKuh+vy1dneVrOfzM4UKLkNl2Bc
+EkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTffwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38Fn
+SbNd67IJKusm7Xi+fT8r87cmNW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i
+8b5QZ7dsvfPxH2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe
++o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
+-----END CERTIFICATE-----
+
+DigiCert Global Root CA
+=======================
+-----BEGIN CERTIFICATE-----
+MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBhMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAw
+HgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAw
+MDAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3
+dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsBCSDMAZOn
+TjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97nh6Vfe63SKMI2tavegw5
+BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt43C/dxC//AH2hdmoRBBYMql1GNXRor5H
+4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7PT19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y
+7vrTC0LUq7dBMtoM1O/4gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQAB
+o2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbRTLtm
+8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJKoZIhvcNAQEF
+BQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/EsrhMAtudXH/vTBH1jLuG2cenTnmCmr
+EbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIt
+tep3Sp+dWOIrWcBAI+0tKIJFPnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886
+UAb3LujEV0lsYSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
+CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
+-----END CERTIFICATE-----
+
+DigiCert High Assurance EV Root CA
+==================================
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBsMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSsw
+KQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAw
+MFoXDTMxMTExMDAwMDAwMFowbDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZ
+MBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFu
+Y2UgRVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm+9S75S0t
+Mqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTWPNt0OKRKzE0lgvdKpVMS
+OO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEMxChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3
+MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFBIk5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQ
+NAQTXKFx01p8VdteZOE3hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUe
+h10aUAsgEsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSY
+JhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3NecnzyIZgYIVyHbIUf4KmeqvxgydkAQ
+V8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6zeM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFp
+myPInngiK3BD41VHMWEZ71jFhS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkK
+mNEVX58Svnw2Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
+vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep+OkuE6N36B9K
+-----END CERTIFICATE-----
+
+SwissSign Gold CA - G2
+======================
+-----BEGIN CERTIFICATE-----
+MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkNIMRUw
+EwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMTFlN3aXNzU2lnbiBHb2xkIENBIC0gRzIwHhcN
+MDYxMDI1MDgzMDM1WhcNMzYxMDI1MDgzMDM1WjBFMQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dp
+c3NTaWduIEFHMR8wHQYDVQQDExZTd2lzc1NpZ24gR29sZCBDQSAtIEcyMIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAr+TufoskDhJuqVAtFkQ7kpJcyrhdhJJCEyq8ZVeCQD5XJM1QiyUq
+t2/876LQwB8CJEoTlo8jE+YoWACjR8cGp4QjK7u9lit/VcyLwVcfDmJlD909Vopz2q5+bbqBHH5C
+jCA12UNNhPqE21Is8w4ndwtrvxEvcnifLtg+5hg3Wipy+dpikJKVyh+c6bM8K8vzARO/Ws/BtQpg
+vd21mWRTuKCWs2/iJneRjOBiEAKfNA+k1ZIzUd6+jbqEemA8atufK+ze3gE/bk3lUIbLtK/tREDF
+ylqM2tIrfKjuvqblCqoOpd8FUrdVxyJdMmqXl2MT28nbeTZ7hTpKxVKJ+STnnXepgv9VHKVxaSvR
+AiTysybUa9oEVeXBCsdtMDeQKuSeFDNeFhdVxVu1yzSJkvGdJo+hB9TGsnhQ2wwMC3wLjEHXuend
+jIj3o02yMszYF9rNt85mndT9Xv+9lz4pded+p2JYryU0pUHHPbwNUMoDAw8IWh+Vc3hiv69yFGkO
+peUDDniOJihC8AcLYiAQZzlG+qkDzAQ4embvIIO1jEpWjpEA/I5cgt6IoMPiaG59je883WX0XaxR
+7ySArqpWl2/5rX3aYT+YdzylkbYcjCbaZaIJbcHiVOO5ykxMgI93e2CaHt+28kgeDrpOVG2Y4OGi
+GqJ3UM/EY5LsRxmd6+ZrzsECAwEAAaOBrDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUWyV7lqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64
+OfPAeGZe6Drn8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov
+L3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe645R88a7A3hfm
+5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD2StiGwC5+OlgzczOUYrHUDFu4Up+GC9pWbY9ZIEr
+44OE5iKHjn3g7gKZYbge9LgriBIWhMIxkziWMaa5O1M/wySTVltpkuzFwbs4AOPsF6m43Md8AYOf
+Mke6UiI0HTJ6CVanfCU2qT1L2sCCbwq7EsiHSycR+R4tx5M/nttfJmtS2S6K8RTGRI0Vqbe/vd6m
+Gu6uLftIdxf+u+yvGPUqUfA5hJeVbG4bwyvEdGB5JbAKJ9/fXtI5z0V9QkvfsywexcZdylU6oJxp
+mo/a77KwPJ+HbBIrZXAVUjEaJM9vMSNQH4xPjyPDdEFjHFWoFN0+4FFQz/EbMFYOkrCChdiDyyJk
+vC24JdVUorgG6q2SpCSgwYa1ShNqR88uC1aVVMvOmttqtKay20EIhid392qgQmwLOM7XdVAyksLf
+KzAiSNDVQTglXaTpXZ/GlHXQRf0wl0OPkKsKx4ZzYEppLd6leNcG2mqeSz53OiATIgHQv2ieY2Br
+NU0LbbqhPcCT4H8js1WtciVORvnSFu+wZMEBnunKoGqYDs/YYPIvSbjkQuE4NRb0yG5P94FW6Lqj
+viOvrv1vA+ACOzB2+httQc8Bsem4yWb02ybzOqR08kkkW8mw0FfB+j564ZfJ
+-----END CERTIFICATE-----
+
+SwissSign Silver CA - G2
+========================
+-----BEGIN CERTIFICATE-----
+MIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UEBhMCQ0gxFTAT
+BgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMB4X
+DTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0NlowRzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3
+aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644
+N0MvFz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gREpzn5/ASLHvGiTSf5YXu6t+WiE7brYT7QbNHm
++/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieFnbAVlDLaYQ1HTWBCrpJH
+6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH6ATK72oxh9TAtvmUcXtnZLi2kUpCe2Uu
+MGoM9ZDulebyzYLs2aFK7PayS+VFheZteJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5h
+qAaEuSh6XzjZG6k4sIN/c8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0mRmrVn5bi4Y5
+FZGkECwJMoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRHHTBs
+ROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTfjNFusB3hB48IHpmc
+celM2KX3RxIfdNFRnobzwqIjQAtz20um53MGjMGg6cFZrEb65i/4z3GcRm25xBWNOHkDRUjvxF3X
+CO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOBrDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQUF6DNweRBtjpbO8tFnb0cwpj6hlgwHwYDVR0jBBgwFoAUF6DNweRB
+tjpbO8tFnb0cwpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0
+cDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBAHPGgeAn0i0P
+4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShpWJHckRE1qTodvBqlYJ7YH39F
+kWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9xCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/L
+3XWgwF15kIwb4FDm3jH+mHtwX6WQ2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx
+/uNncqCxv1yL5PqZIseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFa
+DGi8aRl5xB9+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2Xem1ZqSqP
+e97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQRdAtq/gsD/KNVV4n+Ssuu
+WxcFyPKNIzFTONItaj+CuY0IavdeQXRuwxF+B6wpYJE/OMpXEA29MC/HpeZBoNquBYeaoKRlbEwJ
+DIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+hAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ub
+DgEj8Z+7fNzcbBGXJbLytGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u
+-----END CERTIFICATE-----
+
+SecureTrust CA
+==============
+-----BEGIN CERTIFICATE-----
+MIIDuDCCAqCgAwIBAgIQDPCOXAgWpa1Cf/DrJxhZ0DANBgkqhkiG9w0BAQUFADBIMQswCQYDVQQG
+EwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24xFzAVBgNVBAMTDlNlY3VyZVRy
+dXN0IENBMB4XDTA2MTEwNzE5MzExOFoXDTI5MTIzMTE5NDA1NVowSDELMAkGA1UEBhMCVVMxIDAe
+BgNVBAoTF1NlY3VyZVRydXN0IENvcnBvcmF0aW9uMRcwFQYDVQQDEw5TZWN1cmVUcnVzdCBDQTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKukgeWVzfX2FI7CT8rU4niVWJxB4Q2ZQCQX
+OZEzZum+4YOvYlyJ0fwkW2Gz4BERQRwdbvC4u/jep4G6pkjGnx29vo6pQT64lO0pGtSO0gMdA+9t
+DWccV9cGrcrI9f4Or2YlSASWC12juhbDCE/RRvgUXPLIXgGZbf2IzIaowW8xQmxSPmjL8xk037uH
+GFaAJsTQ3MBv396gwpEWoGQRS0S8Hvbn+mPeZqx2pHGj7DaUaHp3pLHnDi+BeuK1cobvomuL8A/b
+01k/unK8RCSc43Oz969XL0Imnal0ugBS8kvNU3xHCzaFDmapCJcWNFfBZveA4+1wVMeT4C4oFVmH
+ursCAwEAAaOBnTCBmjATBgkrBgEEAYI3FAIEBh4EAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQUQjK2FvoE/f5dS3rD/fdMQB1aQ68wNAYDVR0fBC0wKzApoCegJYYj
+aHR0cDovL2NybC5zZWN1cmV0cnVzdC5jb20vU1RDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQAwDQYJ
+KoZIhvcNAQEFBQADggEBADDtT0rhWDpSclu1pqNlGKa7UTt36Z3q059c4EVlew3KW+JwULKUBRSu
+SceNQQcSc5R+DCMh/bwQf2AQWnL1mA6s7Ll/3XpvXdMc9P+IBWlCqQVxyLesJugutIxq/3HcuLHf
+mbx8IVQr5Fiiu1cprp6poxkmD5kuCLDv/WnPmRoJjeOnnyvJNjR7JLN4TJUXpAYmHrZkUjZfYGfZ
+nMUFdAvnZyPSCPyI6a6Lf+Ew9Dd+/cYy2i2eRDAwbO4H3tI0/NL/QPZL9GZGBlSm8jIKYyYwa5vR
+3ItHuuG51WLQoqD0ZwV4KWMabwTW+MZMo5qxN7SN5ShLHZ4swrhovO0C7jE=
+-----END CERTIFICATE-----
+
+Secure Global CA
+================
+-----BEGIN CERTIFICATE-----
+MIIDvDCCAqSgAwIBAgIQB1YipOjUiolN9BPI8PjqpTANBgkqhkiG9w0BAQUFADBKMQswCQYDVQQG
+EwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBH
+bG9iYWwgQ0EwHhcNMDYxMTA3MTk0MjI4WhcNMjkxMjMxMTk1MjA2WjBKMQswCQYDVQQGEwJVUzEg
+MB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwg
+Q0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNS7YrGxVaQZx5RNoJLNP2MwhR/jx
+YDiJiQPpvepeRlMJ3Fz1Wuj3RSoC6zFh1ykzTM7HfAo3fg+6MpjhHZevj8fcyTiW89sa/FHtaMbQ
+bqR8JNGuQsiWUGMu4P51/pinX0kuleM5M2SOHqRfkNJnPLLZ/kG5VacJjnIFHovdRIWCQtBJwB1g
+8NEXLJXr9qXBkqPFwqcIYA1gBBCWeZ4WNOaptvolRTnIHmX5k/Wq8VLcmZg9pYYaDDUz+kulBAYV
+HDGA76oYa8J719rO+TMg1fW9ajMtgQT7sFzUnKPiXB3jqUJ1XnvUd+85VLrJChgbEplJL4hL/VBi
+0XPnj3pDAgMBAAGjgZ0wgZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1Ud
+EwEB/wQFMAMBAf8wHQYDVR0OBBYEFK9EBMJBfkiD2045AuzshHrmzsmkMDQGA1UdHwQtMCswKaAn
+oCWGI2h0dHA6Ly9jcmwuc2VjdXJldHJ1c3QuY29tL1NHQ0EuY3JsMBAGCSsGAQQBgjcVAQQDAgEA
+MA0GCSqGSIb3DQEBBQUAA4IBAQBjGghAfaReUw132HquHw0LURYD7xh8yOOvaliTFGCRsoTciE6+
+OYo68+aCiV0BN7OrJKQVDpI1WkpEXk5X+nXOH0jOZvQ8QCaSmGwb7iRGDBezUqXbpZGRzzfTb+cn
+CDpOGR86p1hcF895P4vkp9MmI50mD1hp/Ed+stCNi5O/KU9DaXR2Z0vPB4zmAve14bRDtUstFJ/5
+3CYNv6ZHdAbYiNE6KTCEztI5gGIbqMdXSbxqVVFnFUq+NQfk1XWYN3kwFNspnWzFacxHVaIw98xc
+f8LDmBxrThaA63p4ZUWiABqvDA1VZDRIuJK58bRQKfJPIx/abKwfROHdI3hRW8cW
+-----END CERTIFICATE-----
+
+COMODO Certification Authority
+==============================
+-----BEGIN CERTIFICATE-----
+MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCBgTELMAkGA1UE
+BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG
+A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNVBAMTHkNPTU9ETyBDZXJ0aWZpY2F0aW9uIEF1
+dGhvcml0eTAeFw0wNjEyMDEwMDAwMDBaFw0yOTEyMzEyMzU5NTlaMIGBMQswCQYDVQQGEwJHQjEb
+MBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFD
+T01PRE8gQ0EgTGltaXRlZDEnMCUGA1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ECLi3LjkRv3UcEbVASY06m/weaKXTuH
++7uIzg3jLz8GlvCiKVCZrts7oVewdFFxze1CkU1B/qnI2GqGd0S7WWaXUF601CxwRM/aN5VCaTww
+xHGzUvAhTaHYujl8HJ6jJJ3ygxaYqhZ8Q5sVW7euNJH+1GImGEaaP+vB+fGQV+useg2L23IwambV
+4EajcNxo2f8ESIl33rXp+2dtQem8Ob0y2WIC8bGoPW43nOIv4tOiJovGuFVDiOEjPqXSJDlqR6sA
+1KGzqSX+DT+nHbrTUcELpNqsOO9VUCQFZUaTNE8tja3G1CEZ0o7KBWFxB3NH5YoZEr0ETc5OnKVI
+rLsm9wIDAQABo4GOMIGLMB0GA1UdDgQWBBQLWOWLxkwVN6RAqTCpIb5HNlpW/zAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zBJBgNVHR8EQjBAMD6gPKA6hjhodHRwOi8vY3JsLmNvbW9k
+b2NhLmNvbS9DT01PRE9DZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDANBgkqhkiG9w0BAQUFAAOC
+AQEAPpiem/Yb6dc5t3iuHXIYSdOH5EOC6z/JqvWote9VfCFSZfnVDeFs9D6Mk3ORLgLETgdxb8CP
+OGEIqB6BCsAvIC9Bi5HcSEW88cbeunZrM8gALTFGTO3nnc+IlP8zwFboJIYmuNg4ON8qa90SzMc/
+RxdMosIGlgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmc
+IGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5ddBA6+C4OmF4O5MBKgxTMVBbkN
++8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IBZQ==
+-----END CERTIFICATE-----
+
+COMODO ECC Certification Authority
+==================================
+-----BEGIN CERTIFICATE-----
+MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTELMAkGA1UEBhMC
+R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE
+ChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkwHhcNMDgwMzA2MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0Ix
+GzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
+Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRo
+b3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQDR3svdcmCFYX7deSRFtSrYpn1PlILBs5BAH+X
+4QokPB0BBO490o0JlwzgdeT6+3eKKvUDYEs2ixYjFq0JcfRK9ChQtP6IHG4/bC8vCVlbpVsLM5ni
+wz2J+Wos77LTBumjQjBAMB0GA1UdDgQWBBR1cacZSBm8nZ3qQUfflMRId5nTeTAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjEA7wNbeqy3eApyt4jf/7VG
+FAkK+qDmfQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdvGDeA
+U/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY=
+-----END CERTIFICATE-----
+
+Certigna
+========
+-----BEGIN CERTIFICATE-----
+MIIDqDCCApCgAwIBAgIJAP7c4wEPyUj/MA0GCSqGSIb3DQEBBQUAMDQxCzAJBgNVBAYTAkZSMRIw
+EAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hMB4XDTA3MDYyOTE1MTMwNVoXDTI3
+MDYyOTE1MTMwNVowNDELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCURoaW15b3RpczERMA8GA1UEAwwI
+Q2VydGlnbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIaPHJ1tazNHUmgh7stL7q
+XOEm7RFHYeGifBZ4QCHkYJ5ayGPhxLGWkv8YbWkj4Sti993iNi+RB7lIzw7sebYs5zRLcAglozyH
+GxnygQcPOJAZ0xH+hrTy0V4eHpbNgGzOOzGTtvKg0KmVEn2lmsxryIRWijOp5yIVUxbwzBfsV1/p
+ogqYCd7jX5xv3EjjhQsVWqa6n6xI4wmy9/Qy3l40vhx4XUJbzg4ij02Q130yGLMLLGq/jj8UEYkg
+DncUtT2UCIf3JR7VsmAA7G8qKCVuKj4YYxclPz5EIBb2JsglrgVKtOdjLPOMFlN+XPsRGgjBRmKf
+Irjxwo1p3Po6WAbfAgMBAAGjgbwwgbkwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGu3+QTmQ
+tCRZvgHyUtVF9lo53BEwZAYDVR0jBF0wW4AUGu3+QTmQtCRZvgHyUtVF9lo53BGhOKQ2MDQxCzAJ
+BgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hggkA/tzjAQ/J
+SP8wDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG9w0BAQUFAAOCAQEA
+hQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8hbV6lUmPOEvjvKtpv6zf+EwLHyzs+
+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFncfca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1klu
+PBS1xp81HlDQwY9qcEQCYsuuHWhBp6pX6FOqB9IG9tUUBguRA3UsbHK1YZWaDYu5Def131TN3ubY
+1gkIl2PlwS6wt0QmwCbAr1UwnjvVNioZBPRcHv/PLLf/0P2HQBHVESO7SMAhqaQoLf0V+LBOK/Qw
+WyH8EZE0vkHve52Xdf+XlcCWWC/qu0bXu+TZLg==
+-----END CERTIFICATE-----
+
+ePKI Root Certification Authority
+=================================
+-----BEGIN CERTIFICATE-----
+MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQG
+EwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0ZC4xKjAoBgNVBAsMIWVQS0kg
+Um9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNDEyMjAwMjMxMjdaFw0zNDEyMjAwMjMx
+MjdaMF4xCzAJBgNVBAYTAlRXMSMwIQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEq
+MCgGA1UECwwhZVBLSSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEhajfqhFAHSyZbCUNs
+IZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrBp0xtInAhijHyl3SJCRImHJ7K2RKi
+lTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3XDZoTM1PRYfl61dd4s5oz9wCGzh1NlDiv
+qOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX
+12ruOzjjK9SXDrkb5wdJfzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0O
+WQqraffAsgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uUWH1+
+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6ebClAZLSnT0IFaUQAS2zMnao
+lQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iVBmoKs2pHdmX2Os+PYhcZewoozRrSgx4hxyy/
+vv9haLdnG7t4TY3OZ+XkwY63I2binZB1NJipNiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXi
+Zo1jDiVN1Rmy5nk3pyKdVDECAwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/Qkqi
+MAwGA1UdEwQFMAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLH
+ClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGBuvl2ICO1J2B0
+1GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6YlPwZpVnPDimZI+ymBV3QGypzq
+KOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkPJXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdV
+xrsStZf0X4OFunHB2WyBEXYKCrC/gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltabrNMdjmEP
+NXubrjlpC2JgQCA2j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc7b3jajWvY9+r
+GNm65ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8GrBQAuUBo2M3IUxE
+xJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS/jQ6fbjpKdx2qcgw+BRx
+gMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2zGp1iro2C6pSe3VkQw63d4k3jMdXH7Ojy
+sP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTEW9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmOD
+BCEIZ43ygknQW/2xzQ+DhNQ+IIX3Sj0rnP0qCglN6oH4EZw=
+-----END CERTIFICATE-----
+
+certSIGN ROOT CA
+================
+-----BEGIN CERTIFICATE-----
+MIIDODCCAiCgAwIBAgIGIAYFFnACMA0GCSqGSIb3DQEBBQUAMDsxCzAJBgNVBAYTAlJPMREwDwYD
+VQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBDQTAeFw0wNjA3MDQxNzIwMDRa
+Fw0zMTA3MDQxNzIwMDRaMDsxCzAJBgNVBAYTAlJPMREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UE
+CxMQY2VydFNJR04gUk9PVCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALczuX7I
+JUqOtdu0KBuqV5Do0SLTZLrTk+jUrIZhQGpgV2hUhE28alQCBf/fm5oqrl0Hj0rDKH/v+yv6efHH
+rfAQUySQi2bJqIirr1qjAOm+ukbuW3N7LBeCgV5iLKECZbO9xSsAfsT8AzNXDe3i+s5dRdY4zTW2
+ssHQnIFKquSyAVwdj1+ZxLGt24gh65AIgoDzMKND5pCCrlUoSe1b16kQOA7+j0xbm0bqQfWwCHTD
+0IgztnzXdN/chNFDDnU5oSVAKOp4yw4sLjmdjItuFhwvJoIQ4uNllAoEwF73XVv4EOLQunpL+943
+AAAaWyjj0pxzPjKHmKHJUS/X3qwzs08CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B
+Af8EBAMCAcYwHQYDVR0OBBYEFOCMm9slSbPxfIbWskKHC9BroNnkMA0GCSqGSIb3DQEBBQUAA4IB
+AQA+0hyJLjX8+HXd5n9liPRyTMks1zJO890ZeUe9jjtbkw9QSSQTaxQGcu8J06Gh40CEyecYMnQ8
+SG4Pn0vU9x7Tk4ZkVJdjclDVVc/6IJMCopvDI5NOFlV2oHB5bc0hH88vLbwZ44gx+FkagQnIl6Z0
+x2DEW8xXjrJ1/RsCCdtZb3KTafcxQdaIOL+Hsr0Wefmq5L6IJd1hJyMctTEHBDa0GpC9oHRxUIlt
+vBTjD4au8as+x6AJzKNI0eDbZOeStc+vckNwi/nDhDwTqn6Sm1dTk/pwwpEOMfmbZ13pljheX7Nz
+TogVZ96edhBiIL5VaZVDADlN9u6wWk5JRFRYX0KD
+-----END CERTIFICATE-----
+
+NetLock Arany (Class Gold) Főtanúsítvány
+========================================
+-----BEGIN CERTIFICATE-----
+MIIEFTCCAv2gAwIBAgIGSUEs5AAQMA0GCSqGSIb3DQEBCwUAMIGnMQswCQYDVQQGEwJIVTERMA8G
+A1UEBwwIQnVkYXBlc3QxFTATBgNVBAoMDE5ldExvY2sgS2Z0LjE3MDUGA1UECwwuVGFuw7pzw610
+dsOhbnlraWFkw7NrIChDZXJ0aWZpY2F0aW9uIFNlcnZpY2VzKTE1MDMGA1UEAwwsTmV0TG9jayBB
+cmFueSAoQ2xhc3MgR29sZCkgRsWRdGFuw7pzw610dsOhbnkwHhcNMDgxMjExMTUwODIxWhcNMjgx
+MjA2MTUwODIxWjCBpzELMAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxO
+ZXRMb2NrIEtmdC4xNzA1BgNVBAsMLlRhbsO6c8OtdHbDoW55a2lhZMOzayAoQ2VydGlmaWNhdGlv
+biBTZXJ2aWNlcykxNTAzBgNVBAMMLE5ldExvY2sgQXJhbnkgKENsYXNzIEdvbGQpIEbFkXRhbsO6
+c8OtdHbDoW55MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCRec75LbRTDofTjl5Bu
+0jBFHjzuZ9lk4BqKf8owyoPjIMHj9DrTlF8afFttvzBPhCf2nx9JvMaZCpDyD/V/Q4Q3Y1GLeqVw
+/HpYzY6b7cNGbIRwXdrzAZAj/E4wqX7hJ2Pn7WQ8oLjJM2P+FpD/sLj916jAwJRDC7bVWaaeVtAk
+H3B5r9s5VA1lddkVQZQBr17s9o3x/61k/iCa11zr/qYfCGSji3ZVrR47KGAuhyXoqq8fxmRGILdw
+fzzeSNuWU7c5d+Qa4scWhHaXWy+7GRWF+GmF9ZmnqfI0p6m2pgP8b4Y9VHx2BJtr+UBdADTHLpl1
+neWIA6pN+APSQnbAGwIDAKiLo0UwQzASBgNVHRMBAf8ECDAGAQH/AgEEMA4GA1UdDwEB/wQEAwIB
+BjAdBgNVHQ4EFgQUzPpnk/C2uNClwB7zU/2MU9+D15YwDQYJKoZIhvcNAQELBQADggEBAKt/7hwW
+qZw8UQCgwBEIBaeZ5m8BiFRhbvG5GK1Krf6BQCOUL/t1fC8oS2IkgYIL9WHxHG64YTjrgfpioTta
+YtOUZcTh5m2C+C8lcLIhJsFyUR+MLMOEkMNaj7rP9KdlpeuY0fsFskZ1FSNqb4VjMIDw1Z4fKRzC
+bLBQWV2QWzuoDTDPv31/zvGdg73JRm4gpvlhUbohL3u+pRVjodSVh/GeufOJ8z2FuLjbvrW5Kfna
+NwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2XjG4Kvte9nHfRCaexOYNkbQu
+dZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E=
+-----END CERTIFICATE-----
+
+Hongkong Post Root CA 1
+=======================
+-----BEGIN CERTIFICATE-----
+MIIDMDCCAhigAwIBAgICA+gwDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UEBhMCSEsxFjAUBgNVBAoT
+DUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3QgUm9vdCBDQSAxMB4XDTAzMDUx
+NTA1MTMxNFoXDTIzMDUxNTA0NTIyOVowRzELMAkGA1UEBhMCSEsxFjAUBgNVBAoTDUhvbmdrb25n
+IFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3QgUm9vdCBDQSAxMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEArP84tulmAknjorThkPlAj3n54r15/gK97iSSHSL22oVyaf7XPwnU3ZG1
+ApzQjVrhVcNQhrkpJsLj2aDxaQMoIIBFIi1WpztUlVYiWR8o3x8gPW2iNr4joLFutbEnPzlTCeqr
+auh0ssJlXI6/fMN4hM2eFvz1Lk8gKgifd/PFHsSaUmYeSF7jEAaPIpjhZY4bXSNmO7ilMlHIhqqh
+qZ5/dpTCpmy3QfDVyAY45tQM4vM7TG1QjMSDJ8EThFk9nnV0ttgCXjqQesBCNnLsak3c78QA3xMY
+V18meMjWCnl3v/evt3a5pQuEF10Q6m/hq5URX208o1xNg1vysxmKgIsLhwIDAQABoyYwJDASBgNV
+HRMBAf8ECDAGAQH/AgEDMA4GA1UdDwEB/wQEAwIBxjANBgkqhkiG9w0BAQUFAAOCAQEADkbVPK7i
+h9legYsCmEEIjEy82tvuJxuC52pF7BaLT4Wg87JwvVqWuspube5Gi27nKi6Wsxkz67SfqLI37pio
+l7Yutmcn1KZJ/RyTZXaeQi/cImyaT/JaFTmxcdcrUehtHJjA2Sr0oYJ71clBoiMBdDhViw+5Lmei
+IAQ32pwL0xch4I+XeTRvhEgCIDMb5jREn5Fw9IBehEPCKdJsEhTkYY2sEJCehFC78JZvRZ+K88ps
+T/oROhUVRsPNH4NbLUES7VBnQRM9IauUiqpOfMGx+6fWtScvl6tu4B3i0RwsH0Ti/L6RoZz71ilT
+c4afU9hDDl3WY4JxHYB0yvbiAmvZWg==
+-----END CERTIFICATE-----
+
+SecureSign RootCA11
+===================
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBATANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJKUDErMCkGA1UEChMi
+SmFwYW4gQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcywgSW5jLjEcMBoGA1UEAxMTU2VjdXJlU2lnbiBS
+b290Q0ExMTAeFw0wOTA0MDgwNDU2NDdaFw0yOTA0MDgwNDU2NDdaMFgxCzAJBgNVBAYTAkpQMSsw
+KQYDVQQKEyJKYXBhbiBDZXJ0aWZpY2F0aW9uIFNlcnZpY2VzLCBJbmMuMRwwGgYDVQQDExNTZWN1
+cmVTaWduIFJvb3RDQTExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/XeqpRyQBTvL
+TJszi1oURaTnkBbR31fSIRCkF/3frNYfp+TbfPfs37gD2pRY/V1yfIw/XwFndBWW4wI8h9uuywGO
+wvNmxoVF9ALGOrVisq/6nL+k5tSAMJjzDbaTj6nU2DbysPyKyiyhFTOVMdrAG/LuYpmGYz+/3ZMq
+g6h2uRMft85OQoWPIucuGvKVCbIFtUROd6EgvanyTgp9UK31BQ1FT0Zx/Sg+U/sE2C3XZR1KG/rP
+O7AxmjVuyIsG0wCR8pQIZUyxNAYAeoni8McDWc/V1uinMrPmmECGxc0nEovMe863ETxiYAcjPitA
+bpSACW22s293bzUIUPsCh8U+iQIDAQABo0IwQDAdBgNVHQ4EFgQUW/hNT7KlhtQ60vFjmqC+CfZX
+t94wDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAKCh
+OBZmLqdWHyGcBvod7bkixTgm2E5P7KN/ed5GIaGHd48HCJqypMWvDzKYC3xmKbabfSVSSUOrTC4r
+bnpwrxYO4wJs+0LmGJ1F2FXI6Dvd5+H0LgscNFxsWEr7jIhQX5Ucv+2rIrVls4W6ng+4reV6G4pQ
+Oh29Dbx7VFALuUKvVaAYga1lme++5Jy/xIWrQbJUb9wlze144o4MjQlJ3WN7WmmWAiGovVJZ6X01
+y8hSyn+B/tlr0/cR7SXf+Of5pPpyl4RTDaXQMhhRdlkUbA/r7F+AjHVDg8OFmP9Mni0N5HeDk061
+lgeLKBObjBmNQSdJQO7e5iNEOdyhIta6A/I=
+-----END CERTIFICATE-----
+
+Microsec e-Szigno Root CA 2009
+==============================
+-----BEGIN CERTIFICATE-----
+MIIECjCCAvKgAwIBAgIJAMJ+QwRORz8ZMA0GCSqGSIb3DQEBCwUAMIGCMQswCQYDVQQGEwJIVTER
+MA8GA1UEBwwIQnVkYXBlc3QxFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMMHk1pY3Jv
+c2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0GCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5o
+dTAeFw0wOTA2MTYxMTMwMThaFw0yOTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UE
+BwwIQnVkYXBlc3QxFjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUt
+U3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0GCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOn4j/NjrdqG2KfgQvvPkd6mJviZpWNwrZuuyjNA
+fW2WbqEORO7hE52UQlKavXWFdCyoDh2Tthi3jCyoz/tccbna7P7ofo/kLx2yqHWH2Leh5TvPmUpG
+0IMZfcChEhyVbUr02MelTTMuhTlAdX4UfIASmFDHQWe4oIBhVKZsTh/gnQ4H6cm6M+f+wFUoLAKA
+pxn1ntxVUwOXewdI/5n7N4okxFnMUBBjjqqpGrCEGob5X7uxUG6k0QrM1XF+H6cbfPVTbiJfyyvm
+1HxdrtbCxkzlBQHZ7Vf8wSN5/PrIJIOV87VqUQHQd9bpEqH5GoP7ghu5sJf0dgYzQ0mg/wu1+rUC
+AwEAAaOBgDB+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTLD8bf
+QkPMPcu1SCOhGnqmKrs0aDAfBgNVHSMEGDAWgBTLD8bfQkPMPcu1SCOhGnqmKrs0aDAbBgNVHREE
+FDASgRBpbmZvQGUtc3ppZ25vLmh1MA0GCSqGSIb3DQEBCwUAA4IBAQDJ0Q5eLtXMs3w+y/w9/w0o
+lZMEyL/azXm4Q5DwpL7v8u8hmLzU1F0G9u5C7DBsoKqpyvGvivo/C3NqPuouQH4frlRheesuCDfX
+I/OMn74dseGkddug4lQUsbocKaQY9hK6ohQU4zE1yED/t+AFdlfBHFny+L/k7SViXITwfn4fs775
+tyERzAMBVnCnEJIeGzSBHq2cGsMEPO0CYdYeBvNfOofyK/FFh+U9rNHHV4S9a67c2Pm2G2JwCz02
+yULyMtd6YebS2z3PyKnJm9zbWETXbzivf3jTo60adbocwTZ8jx5tHMN1Rq41Bab2XD0h7lbwyYIi
+LXpUq3DDfSJlgnCW
+-----END CERTIFICATE-----
+
+GlobalSign Root CA - R3
+=======================
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4GA1UECxMXR2xv
+YmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2Jh
+bFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxT
+aWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2ln
+bjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWt
+iHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsTgHeMCOFJ
+0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmmKPZpO/bLyCiR5Z2KYVc3
+rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjl
+OCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2
+xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE
+FI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZURUm7
+lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMpjjM5RcOO5LlXbKr8
+EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV3XpYKBovHd7NADdBj+1E
+bddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18
+YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7r
+kpeDMdmztcpHWD9f
+-----END CERTIFICATE-----
+
+Autoridad de Certificacion Firmaprofesional CIF A62634068
+=========================================================
+-----BEGIN CERTIFICATE-----
+MIIGFDCCA/ygAwIBAgIIU+w77vuySF8wDQYJKoZIhvcNAQEFBQAwUTELMAkGA1UEBhMCRVMxQjBA
+BgNVBAMMOUF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1hcHJvZmVzaW9uYWwgQ0lGIEE2
+MjYzNDA2ODAeFw0wOTA1MjAwODM4MTVaFw0zMDEyMzEwODM4MTVaMFExCzAJBgNVBAYTAkVTMUIw
+QAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNhY2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBB
+NjI2MzQwNjgwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKlmuO6vj78aI14H9M2uDD
+Utd9thDIAl6zQyrET2qyyhxdKJp4ERppWVevtSBC5IsP5t9bpgOSL/UR5GLXMnE42QQMcas9UX4P
+B99jBVzpv5RvwSmCwLTaUbDBPLutN0pcyvFLNg4kq7/DhHf9qFD0sefGL9ItWY16Ck6WaVICqjaY
+7Pz6FIMMNx/Jkjd/14Et5cS54D40/mf0PmbR0/RAz15iNA9wBj4gGFrO93IbJWyTdBSTo3OxDqqH
+ECNZXyAFGUftaI6SEspd/NYrspI8IM/hX68gvqB2f3bl7BqGYTM+53u0P6APjqK5am+5hyZvQWyI
+plD9amML9ZMWGxmPsu2bm8mQ9QEM3xk9Dz44I8kvjwzRAv4bVdZO0I08r0+k8/6vKtMFnXkIoctX
+MbScyJCyZ/QYFpM6/EfY0XiWMR+6KwxfXZmtY4laJCB22N/9q06mIqqdXuYnin1oKaPnirjaEbsX
+LZmdEyRG98Xi2J+Of8ePdG1asuhy9azuJBCtLxTa/y2aRnFHvkLfuwHb9H/TKI8xWVvTyQKmtFLK
+bpf7Q8UIJm+K9Lv9nyiqDdVF8xM6HdjAeI9BZzwelGSuewvF6NkBiDkal4ZkQdU7hwxu+g/GvUgU
+vzlN1J5Bto+WHWOWk9mVBngxaJ43BjuAiUVhOSPHG0SjFeUc+JIwuwIDAQABo4HvMIHsMBIGA1Ud
+EwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlzeurNR4APn7VdMActHNH
+DhpkLzCBpgYDVR0gBIGeMIGbMIGYBgRVHSAAMIGPMC8GCCsGAQUFBwIBFiNodHRwOi8vd3d3LmZp
+cm1hcHJvZmVzaW9uYWwuY29tL2NwczBcBggrBgEFBQcCAjBQHk4AUABhAHMAZQBvACAAZABlACAA
+bABhACAAQgBvAG4AYQBuAG8AdgBhACAANAA3ACAAQgBhAHIAYwBlAGwAbwBuAGEAIAAwADgAMAAx
+ADcwDQYJKoZIhvcNAQEFBQADggIBABd9oPm03cXF661LJLWhAqvdpYhKsg9VSytXjDvlMd3+xDLx
+51tkljYyGOylMnfX40S2wBEqgLk9am58m9Ot/MPWo+ZkKXzR4Tgegiv/J2Wv+xYVxC5xhOW1//qk
+R71kMrv2JYSiJ0L1ILDCExARzRAVukKQKtJE4ZYm6zFIEv0q2skGz3QeqUvVhyj5eTSSPi5E6PaP
+T481PyWzOdxjKpBrIF/EUhJOlywqrJ2X3kjyo2bbwtKDlaZmp54lD+kLM5FlClrD2VQS3a/DTg4f
+Jl4N3LON7NWBcN7STyQF82xO9UxJZo3R/9ILJUFI/lGExkKvgATP0H5kSeTy36LssUzAKh3ntLFl
+osS88Zj0qnAHY7S42jtM+kAiMFsRpvAFDsYCA0irhpuF3dvd6qJ2gHN99ZwExEWN57kci57q13XR
+crHedUTnQn3iV2t93Jm8PYMo6oCTjcVMZcFwgbg4/EMxsvYDNEeyrPsiBsse3RdHHF9mudMaotoR
+saS8I8nkvof/uZS2+F0gStRf571oe2XyFR7SOqkt6dhrJKyXWERHrVkY8SFlcN7ONGCoQPHzPKTD
+KCOM/iczQ0CgFzzr6juwcqajuUpLXhZI9LK8yIySxZ2frHI2vDSANGupi5LAuBft7HZT9SQBjLMi
+6Et8Vcad+qMUu2WFbm5PEn4KPJ2V
+-----END CERTIFICATE-----
+
+Izenpe.com
+==========
+-----BEGIN CERTIFICATE-----
+MIIF8TCCA9mgAwIBAgIQALC3WhZIX7/hy/WL1xnmfTANBgkqhkiG9w0BAQsFADA4MQswCQYDVQQG
+EwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6ZW5wZS5jb20wHhcNMDcxMjEz
+MTMwODI4WhcNMzcxMjEzMDgyNzI1WjA4MQswCQYDVQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMu
+QS4xEzARBgNVBAMMCkl6ZW5wZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJ
+03rKDx6sp4boFmVqscIbRTJxldn+EFvMr+eleQGPicPK8lVx93e+d5TzcqQsRNiekpsUOqHnJJAK
+ClaOxdgmlOHZSOEtPtoKct2jmRXagaKH9HtuJneJWK3W6wyyQXpzbm3benhB6QiIEn6HLmYRY2xU
++zydcsC8Lv/Ct90NduM61/e0aL6i9eOBbsFGb12N4E3GVFWJGjMxCrFXuaOKmMPsOzTFlUFpfnXC
+PCDFYbpRR6AgkJOhkEvzTnyFRVSa0QUmQbC1TR0zvsQDyCV8wXDbO/QJLVQnSKwv4cSsPsjLkkxT
+OTcj7NMB+eAJRE1NZMDhDVqHIrytG6P+JrUV86f8hBnp7KGItERphIPzidF0BqnMC9bC3ieFUCbK
+F7jJeodWLBoBHmy+E60QrLUk9TiRodZL2vG70t5HtfG8gfZZa88ZU+mNFctKy6lvROUbQc/hhqfK
+0GqfvEyNBjNaooXlkDWgYlwWTvDjovoDGrQscbNYLN57C9saD+veIR8GdwYDsMnvmfzAuU8Lhij+
+0rnq49qlw0dpEuDb8PYZi+17cNcC1u2HGCgsBCRMd+RIihrGO5rUD8r6ddIBQFqNeb+Lz0vPqhbB
+leStTIo+F5HUsWLlguWABKQDfo2/2n+iD5dPDNMN+9fR5XJ+HMh3/1uaD7euBUbl8agW7EekFwID
+AQABo4H2MIHzMIGwBgNVHREEgagwgaWBD2luZm9AaXplbnBlLmNvbaSBkTCBjjFHMEUGA1UECgw+
+SVpFTlBFIFMuQS4gLSBDSUYgQTAxMzM3MjYwLVJNZXJjLlZpdG9yaWEtR2FzdGVpeiBUMTA1NSBG
+NjIgUzgxQzBBBgNVBAkMOkF2ZGEgZGVsIE1lZGl0ZXJyYW5lbyBFdG9yYmlkZWEgMTQgLSAwMTAx
+MCBWaXRvcmlhLUdhc3RlaXowDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0O
+BBYEFB0cZQ6o8iV7tJHP5LGx5r1VdGwFMA0GCSqGSIb3DQEBCwUAA4ICAQB4pgwWSp9MiDrAyw6l
+Fn2fuUhfGI8NYjb2zRlrrKvV9pF9rnHzP7MOeIWblaQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbga
+kEyrkgPH7UIBzg/YsfqikuFgba56awmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8q
+hT/AQKM6WfxZSzwoJNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Cs
+g1lwLDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6kfLqCTVyvehQP5
+aTfLnnhqBbTFMXiJ7HqnheG5ezzevh55hM6fcA5ZwjUukCox2eRFekGkLhObNA5me0mrZJfQRsN5
+nXJQY6aYWwa9SG3YOYNw6DXwBdGqvOPbyALqfP2C2sJbUjWumDqtujWTI6cfSN01RpiyEGjkpTHC
+ClguGYEQyVB1/OpaFs4R1+7vUIgtYf8/QnMFlEPVjjxOAToZpR9GTnfQXeWBIiGH/pR9hNiTrdZo
+Q0iy2+tzJOeRf1SktoA+naM8THLCV8Sg1Mw4J87VBp6iSNnpn86CcDaTmjvfliHjWbcM2pE38P1Z
+WrOZyGlsQyYBNWNgVYkDOnXYukrZVP/u3oDYLdE41V4tC5h9Pmzb/CaIxw==
+-----END CERTIFICATE-----
+
+Go Daddy Root Certificate Authority - G2
+========================================
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+B0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoTEUdvRGFkZHkuY29tLCBJbmMu
+MTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5
+MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgYMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6
+b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjExMC8G
+A1UEAxMoR28gRGFkZHkgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAL9xYgjx+lk09xvJGKP3gElY6SKDE6bFIEMBO4Tx5oVJnyfq
+9oQbTqC023CYxzIBsQU+B07u9PpPL1kwIuerGVZr4oAH/PMWdYA5UXvl+TW2dE6pjYIT5LY/qQOD
++qK+ihVqf94Lw7YZFAXK6sOoBJQ7RnwyDfMAZiLIjWltNowRGLfTshxgtDj6AozO091GB94KPutd
+fMh8+7ArU6SSYmlRJQVhGkSBjCypQ5Yj36w6gZoOKcUcqeldHraenjAKOc7xiID7S13MMuyFYkMl
+NAJWJwGRtDtwKj9useiciAF9n9T521NtYJ2/LOdYq7hfRvzOxBsDPAnrSTFcaUaz4EcCAwEAAaNC
+MEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFDqahQcQZyi27/a9
+BUFuIMGU2g/eMA0GCSqGSIb3DQEBCwUAA4IBAQCZ21151fmXWWcDYfF+OwYxdS2hII5PZYe096ac
+vNjpL9DbWu7PdIxztDhC2gV7+AJ1uP2lsdeu9tfeE8tTEH6KRtGX+rcuKxGrkLAngPnon1rpN5+r
+5N9ss4UXnT3ZJE95kTXWXwTrgIOrmgIttRD02JDHBHNA7XIloKmf7J6raBKZV8aPEjoJpL1E/QYV
+N8Gb5DKj7Tjo2GTzLH4U/ALqn83/B2gX2yKQOC16jdFU8WnjXzPKej17CuPKf1855eJ1usV2GDPO
+LPAvTK33sefOT6jEm0pUBsV/fdUID+Ic/n4XuKxe9tQWskMJDE32p2u0mYRlynqI4uJEvlz36hz1
+-----END CERTIFICATE-----
+
+Starfield Root Certificate Authority - G2
+=========================================
+-----BEGIN CERTIFICATE-----
+MIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+B0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoTHFN0YXJmaWVsZCBUZWNobm9s
+b2dpZXMsIEluYy4xMjAwBgNVBAMTKVN0YXJmaWVsZCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0
+eSAtIEcyMB4XDTA5MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgY8xCzAJBgNVBAYTAlVTMRAw
+DgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFyZmllbGQg
+VGVjaG5vbG9naWVzLCBJbmMuMTIwMAYDVQQDEylTdGFyZmllbGQgUm9vdCBDZXJ0aWZpY2F0ZSBB
+dXRob3JpdHkgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL3twQP89o/8ArFv
+W59I2Z154qK3A2FWGMNHttfKPTUuiUP3oWmb3ooa/RMgnLRJdzIpVv257IzdIvpy3Cdhl+72WoTs
+bhm5iSzchFvVdPtrX8WJpRBSiUZV9Lh1HOZ/5FSuS/hVclcCGfgXcVnrHigHdMWdSL5stPSksPNk
+N3mSwOxGXn/hbVNMYq/NHwtjuzqd+/x5AJhhdM8mgkBj87JyahkNmcrUDnXMN/uLicFZ8WJ/X7Nf
+ZTD4p7dNdloedl40wOiWVpmKs/B/pM293DIxfJHP4F8R+GuqSVzRmZTRouNjWwl2tVZi4Ut0HZbU
+JtQIBFnQmA4O5t78w+wfkPECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwHQYDVR0OBBYEFHwMMh+n2TB/xH1oo2Kooc6rB1snMA0GCSqGSIb3DQEBCwUAA4IBAQARWfol
+TwNvlJk7mh+ChTnUdgWUXuEok21iXQnCoKjUsHU48TRqneSfioYmUeYs0cYtbpUgSpIB7LiKZ3sx
+4mcujJUDJi5DnUox9g61DLu34jd/IroAow57UvtruzvE03lRTs2Q9GcHGcg8RnoNAX3FWOdt5oUw
+F5okxBDgBPfg8n/Uqgr/Qh037ZTlZFkSIHc40zI+OIF1lnP6aI+xy84fxez6nH7PfrHxBy22/L/K
+pL/QlwVKvOoYKAKQvVR4CSFx09F9HdkWsKlhPdAKACL8x3vLCWRFCztAgfd9fDL1mMpYjn0q7pBZ
+c2T5NnReJaH1ZgUufzkVqSr7UIuOhWn0
+-----END CERTIFICATE-----
+
+Starfield Services Root Certificate Authority - G2
+==================================================
+-----BEGIN CERTIFICATE-----
+MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+B0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoTHFN0YXJmaWVsZCBUZWNobm9s
+b2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVsZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRl
+IEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgZgxCzAJBgNV
+BAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxT
+dGFyZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTswOQYDVQQDEzJTdGFyZmllbGQgU2VydmljZXMg
+Um9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBANUMOsQq+U7i9b4Zl1+OiFOxHz/Lz58gE20pOsgPfTz3a3Y4Y9k2YKibXlwAgLIvWX/2
+h/klQ4bnaRtSmpDhcePYLQ1Ob/bISdm28xpWriu2dBTrz/sm4xq6HZYuajtYlIlHVv8loJNwU4Pa
+hHQUw2eeBGg6345AWh1KTs9DkTvnVtYAcMtS7nt9rjrnvDH5RfbCYM8TWQIrgMw0R9+53pBlbQLP
+LJGmpufehRhJfGZOozptqbXuNC66DQO4M99H67FrjSXZm86B0UVGMpZwh94CDklDhbZsc7tk6mFB
+rMnUVN+HL8cisibMn1lUaJ/8viovxFUcdUBgF4UCVTmLfwUCAwEAAaNCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJxfAN+qAdcwKziIorhtSpzyEZGDMA0GCSqG
+SIb3DQEBCwUAA4IBAQBLNqaEd2ndOxmfZyMIbw5hyf2E3F/YNoHN2BtBLZ9g3ccaaNnRbobhiCPP
+E95Dz+I0swSdHynVv/heyNXBve6SbzJ08pGCL72CQnqtKrcgfU28elUSwhXqvfdqlS5sdJ/PHLTy
+xQGjhdByPq1zqwubdQxtRbeOlKyWN7Wg0I8VRw7j6IPdj/3vQQF3zCepYoUz8jcI73HPdwbeyBkd
+iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn0q23KXB56jza
+YyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCNsSi6
+-----END CERTIFICATE-----
+
+AffirmTrust Commercial
+======================
+-----BEGIN CERTIFICATE-----
+MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UEBhMCVVMxFDAS
+BgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVzdCBDb21tZXJjaWFsMB4XDTEw
+MDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDELMAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmly
+bVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVzdCBDb21tZXJjaWFsMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEA9htPZwcroRX1BiLLHwGy43NFBkRJLLtJJRTWzsO3qyxPxkEylFf6Eqdb
+DuKPHx6GGaeqtS25Xw2Kwq+FNXkyLbscYjfysVtKPcrNcV/pQr6U6Mje+SJIZMblq8Yrba0F8PrV
+C8+a5fBQpIs7R6UjW3p6+DM/uO+Zl+MgwdYoic+U+7lF7eNAFxHUdPALMeIrJmqbTFeurCA+ukV6
+BfO9m2kVrn1OIGPENXY6BwLJN/3HR+7o8XYdcxXyl6S1yHp52UKqK39c/s4mT6NmgTWvRLpUHhww
+MmWd5jyTXlBOeuM61G7MGvv50jeuJCqrVwMiKA1JdX+3KNp1v47j3A55MQIDAQABo0IwQDAdBgNV
+HQ4EFgQUnZPGU4teyq8/nx4P5ZmVvCT2lI8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQELBQADggEBAFis9AQOzcAN/wr91LoWXym9e2iZWEnStB03TX8nfUYGXUPG
+hi4+c7ImfU+TqbbEKpqrIZcUsd6M06uJFdhrJNTxFq7YpFzUf1GO7RgBsZNjvbz4YYCanrHOQnDi
+qX0GJX0nof5v7LMeJNrjS1UaADs1tDvZ110w/YETifLCBivtZ8SOyUOyXGsViQK8YvxO8rUzqrJv
+0wqiUOP2O+guRMLbZjipM1ZI8W0bM40NjD9gN53Tym1+NH4Nn3J2ixufcv1SNUFFApYvHLKac0kh
+sUlHRUe072o0EclNmsxZt9YCnlpOZbWUrhvfKbAW8b8Angc6F2S1BLUjIZkKlTuXfO8=
+-----END CERTIFICATE-----
+
+AffirmTrust Networking
+======================
+-----BEGIN CERTIFICATE-----
+MIIDTDCCAjSgAwIBAgIIfE8EORzUmS0wDQYJKoZIhvcNAQEFBQAwRDELMAkGA1UEBhMCVVMxFDAS
+BgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVzdCBOZXR3b3JraW5nMB4XDTEw
+MDEyOTE0MDgyNFoXDTMwMTIzMTE0MDgyNFowRDELMAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmly
+bVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVzdCBOZXR3b3JraW5nMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAtITMMxcua5Rsa2FSoOujz3mUTOWUgJnLVWREZY9nZOIG41w3SfYvm4SE
+Hi3yYJ0wTsyEheIszx6e/jarM3c1RNg1lho9Nuh6DtjVR6FqaYvZ/Ls6rnla1fTWcbuakCNrmreI
+dIcMHl+5ni36q1Mr3Lt2PpNMCAiMHqIjHNRqrSK6mQEubWXLviRmVSRLQESxG9fhwoXA3hA/Pe24
+/PHxI1Pcv2WXb9n5QHGNfb2V1M6+oF4nI979ptAmDgAp6zxG8D1gvz9Q0twmQVGeFDdCBKNwV6gb
+h+0t+nvujArjqWaJGctB+d1ENmHP4ndGyH329JKBNv3bNPFyfvMMFr20FQIDAQABo0IwQDAdBgNV
+HQ4EFgQUBx/S55zawm6iQLSwelAQUHTEyL0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQEFBQADggEBAIlXshZ6qML91tmbmzTCnLQyFE2npN/svqe++EPbkTfOtDIu
+UFUaNU52Q3Eg75N3ThVwLofDwR1t3Mu1J9QsVtFSUzpE0nPIxBsFZVpikpzuQY0x2+c06lkh1QF6
+12S4ZDnNye2v7UsDSKegmQGA3GWjNq5lWUhPgkvIZfFXHeVZLgo/bNjR9eUJtGxUAArgFU2HdW23
+WJZa3W3SAKD0m0i+wzekujbgfIeFlxoVot4uolu9rxj5kFDNcFn4J2dHy8egBzp90SxdbBk6ZrV9
+/ZFvgrG+CJPbFEfxojfHRZ48x3evZKiT3/Zpg4Jg8klCNO1aAFSFHBY2kgxc+qatv9s=
+-----END CERTIFICATE-----
+
+AffirmTrust Premium
+===================
+-----BEGIN CERTIFICATE-----
+MIIFRjCCAy6gAwIBAgIIbYwURrGmCu4wDQYJKoZIhvcNAQEMBQAwQTELMAkGA1UEBhMCVVMxFDAS
+BgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVzdCBQcmVtaXVtMB4XDTEwMDEy
+OTE0MTAzNloXDTQwMTIzMTE0MTAzNlowQTELMAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRy
+dXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVzdCBQcmVtaXVtMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEAxBLfqV/+Qd3d9Z+K4/as4Tx4mrzY8H96oDMq3I0gW64tb+eT2TZwamjPjlGjhVtn
+BKAQJG9dKILBl1fYSCkTtuG+kU3fhQxTGJoeJKJPj/CihQvL9Cl/0qRY7iZNyaqoe5rZ+jjeRFcV
+5fiMyNlI4g0WJx0eyIOFJbe6qlVBzAMiSy2RjYvmia9mx+n/K+k8rNrSs8PhaJyJ+HoAVt70VZVs
++7pk3WKL3wt3MutizCaam7uqYoNMtAZ6MMgpv+0GTZe5HMQxK9VfvFMSF5yZVylmd2EhMQcuJUmd
+GPLu8ytxjLW6OQdJd/zvLpKQBY0tL3d770O/Nbua2Plzpyzy0FfuKE4mX4+QaAkvuPjcBukumj5R
+p9EixAqnOEhss/n/fauGV+O61oV4d7pD6kh/9ti+I20ev9E2bFhc8e6kGVQa9QPSdubhjL08s9NI
+S+LI+H+SqHZGnEJlPqQewQcDWkYtuJfzt9WyVSHvutxMAJf7FJUnM7/oQ0dG0giZFmA7mn7S5u04
+6uwBHjxIVkkJx0w3AJ6IDsBz4W9m6XJHMD4Q5QsDyZpCAGzFlH5hxIrff4IaC1nEWTJ3s7xgaVY5
+/bQGeyzWZDbZvUjthB9+pSKPKrhC9IK31FOQeE4tGv2Bb0TXOwF0lkLgAOIua+rF7nKsu7/+6qqo
++Nz2snmKtmcCAwEAAaNCMEAwHQYDVR0OBBYEFJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB
+/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByv
+MiPIs0laUZx2KI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg
+Nt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0QNiigfV4Py/VpfzZotReBA4Xrf5B8OWycvpEgjNC
+6C1Y91aMYj+6QrCcDFx+LmUmXFNPALJ4fqENmS2NuB2OosSw/WDQMKSOyARiqcTtNd56l+0OOF6S
+L5Nwpamcb6d9Ex1+xghIsV5n61EIJenmJWtSKZGc0jlzCFfemQa0W50QBuHCAKi4HEoCChTQwUHK
++4w1IX2COPKpVJEZNZOUbWo6xbLQu4mGk+ibyQ86p3q4ofB4Rvr8Ny/lioTz3/4E2aFooC8k4gmV
+BtWVyuEklut89pMFu+1z6S3RdTnX5yTb2E5fQ4+e0BQ5v1VwSJlXMbSc7kqYA5YwH2AG7hsj/oFg
+IxpHYoWlzBk0gG+zrBrjn/B7SK3VAdlntqlyk+otZrWyuOQ9PLLvTIzq6we/qzWaVYa8GKa1qF60
+g2xraUDTn9zxw2lrueFtCfTxqlB2Cnp9ehehVZZCmTEJ3WARjQUwfuaORtGdFNrHF+QFlozEJLUb
+zxQHskD4o55BhrwE0GuWyCqANP2/7waj3VjFhT0+j/6eKeC2uAloGRwYQw==
+-----END CERTIFICATE-----
+
+AffirmTrust Premium ECC
+=======================
+-----BEGIN CERTIFICATE-----
+MIIB/jCCAYWgAwIBAgIIdJclisc/elQwCgYIKoZIzj0EAwMwRTELMAkGA1UEBhMCVVMxFDASBgNV
+BAoMC0FmZmlybVRydXN0MSAwHgYDVQQDDBdBZmZpcm1UcnVzdCBQcmVtaXVtIEVDQzAeFw0xMDAx
+MjkxNDIwMjRaFw00MDEyMzExNDIwMjRaMEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1U
+cnVzdDEgMB4GA1UEAwwXQWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0MwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAQNMF4bFZ0D0KF5Nbc6PJJ6yhUczWLznCZcBz3lVPqj1swS6vQUX+iOGasvLkjmrBhDeKzQ
+N8O9ss0s5kfiGuZjuD0uL3jET9v0D6RoTFVya5UdThhClXjMNzyR4ptlKymjQjBAMB0GA1UdDgQW
+BBSaryl6wBE1NSZRMADDav5A1a7WPDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAK
+BggqhkjOPQQDAwNnADBkAjAXCfOHiFBar8jAQr9HX/VsaobgxCd05DhT1wV/GzTjxi+zygk8N53X
+57hG8f2h4nECMEJZh0PUUd+60wkyWs6Iflc9nF9Ca/UHLbXwgpP5WW+uZPpY5Yse42O+tYHNbwKM
+eQ==
+-----END CERTIFICATE-----
+
+Certum Trusted Network CA
+=========================
+-----BEGIN CERTIFICATE-----
+MIIDuzCCAqOgAwIBAgIDBETAMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK
+ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0EwHhcNMDgxMDIy
+MTIwNzM3WhcNMjkxMjMxMTIwNzM3WjB+MQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBU
+ZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5
+MSIwIAYDVQQDExlDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEA4/t9o3K6wvDJFIf1awFO4W5AB7ptJ11/91sts1rHUV+rpDKmYYe2bg+G0jAC
+l/jXaVehGDldamR5xgFZrDwxSjh80gTSSyjoIF87B6LMTXPb865Px1bVWqeWifrzq2jUI4ZZJ88J
+J7ysbnKDHDBy3+Ci6dLhdHUZvSqeexVUBBvXQzmtVSjF4hq79MDkrjhJM8x2hZ85RdKknvISjFH4
+fOQtf/WsX+sWn7Et0brMkUJ3TCXJkDhv2/DM+44el1k+1WBO5gUo7Ul5E0u6SNsv+XLTOcr+H9g0
+cvW0QM8xAcPs3hEtF10fuFDRXhmnad4HMyjKUJX5p1TLVIZQRan5SQIDAQABo0IwQDAPBgNVHRMB
+Af8EBTADAQH/MB0GA1UdDgQWBBQIds3LB/8k9sXN7buQvOKEN0Z19zAOBgNVHQ8BAf8EBAMCAQYw
+DQYJKoZIhvcNAQEFBQADggEBAKaorSLOAT2mo/9i0Eidi15ysHhE49wcrwn9I0j6vSrEuVUEtRCj
+jSfeC4Jj0O7eDDd5QVsisrCaQVymcODU0HfLI9MA4GxWL+FpDQ3Zqr8hgVDZBqWo/5U30Kr+4rP1
+mS1FhIrlQgnXdAIv94nYmem8J9RHjboNRhx3zxSkHLmkMcScKHQDNP8zGSal6Q10tz6XxnboJ5aj
+Zt3hrvJBW8qYVoNzcOSGGtIxQbovvi0TWnZvTuhOgQ4/WwMioBK+ZlgRSssDxLQqKi2WF+A5VLxI
+03YnnZotBqbJ7DnSq9ufmgsnAjUpsUCV5/nonFWIGUbWtzT1fs45mtk48VH3Tyw=
+-----END CERTIFICATE-----
+
+TWCA Root Certification Authority
+=================================
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJUVzESMBAGA1UECgwJ
+VEFJV0FOLUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlmaWNh
+dGlvbiBBdXRob3JpdHkwHhcNMDgwODI4MDcyNDMzWhcNMzAxMjMxMTU1OTU5WjBfMQswCQYDVQQG
+EwJUVzESMBAGA1UECgwJVEFJV0FOLUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFUV0NB
+IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFEAcK0HMMx
+QhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HHK3XLfJ+utdGdIzdjp9xC
+oi2SBBtQwXu4PhvJVgSLL1KbralW6cH/ralYhzC2gfeXRfwZVzsrb+RH9JlF/h3x+JejiB03HFyP
+4HYlmlD4oFT/RJB2I9IyxsOrBr/8+7/zrX2SYgJbKdM1o5OaQ2RgXbL6Mv87BK9NQGr5x+PvI/1r
+y+UPizgN7gr8/g+YnzAx3WxSZfmLgb4i4RxYA7qRG4kHAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIB
+BjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqOFsmjd6LWvJPelSDGRjjCDWmujANBgkqhkiG
+9w0BAQUFAAOCAQEAPNV3PdrfibqHDAhUaiBQkr6wQT25JmSDCi/oQMCXKCeCMErJk/9q56YAf4lC
+mtYR5VPOL8zy2gXE/uJQxDqGfczafhAJO5I1KlOy/usrBdlsXebQ79NqZp4VKIV66IIArB6nCWlW
+QtNoURi+VJq/REG6Sb4gumlc7rh3zc5sH62Dlhh9DrUUOYTxKOkto557HnpyWoOzeW/vtPzQCqVY
+T0bf+215WfKEIlKuD8z7fDvnaspHYcN6+NOSBB+4IIThNlQWx0DeO4pz3N/GCUzf7Nr/1FNCocny
+Yh0igzyXxfkZYiesZSLX0zzG5Y6yU8xJzrww/nsOM5D77dIUkR8Hrw==
+-----END CERTIFICATE-----
+
+Security Communication RootCA2
+==============================
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIBADANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJKUDElMCMGA1UEChMc
+U0VDT00gVHJ1c3QgU3lzdGVtcyBDTy4sTFRELjEnMCUGA1UECxMeU2VjdXJpdHkgQ29tbXVuaWNh
+dGlvbiBSb290Q0EyMB4XDTA5MDUyOTA1MDAzOVoXDTI5MDUyOTA1MDAzOVowXTELMAkGA1UEBhMC
+SlAxJTAjBgNVBAoTHFNFQ09NIFRydXN0IFN5c3RlbXMgQ08uLExURC4xJzAlBgNVBAsTHlNlY3Vy
+aXR5IENvbW11bmljYXRpb24gUm9vdENBMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANAVOVKxUrO6xVmCxF1SrjpDZYBLx/KWvNs2l9amZIyoXvDjChz335c9S672XewhtUGrzbl+dp++
++T42NKA7wfYxEUV0kz1XgMX5iZnK5atq1LXaQZAQwdbWQonCv/Q4EpVMVAX3NuRFg3sUZdbcDE3R
+3n4MqzvEFb46VqZab3ZpUql6ucjrappdUtAtCms1FgkQhNBqyjoGADdH5H5XTz+L62e4iKrFvlNV
+spHEfbmwhRkGeC7bYRr6hfVKkaHnFtWOojnflLhwHyg/i/xAXmODPIMqGplrz95Zajv8bxbXH/1K
+EOtOghY6rCcMU/Gt1SSwawNQwS08Ft1ENCcadfsCAwEAAaNCMEAwHQYDVR0OBBYEFAqFqXdlBZh8
+QIH4D5csOPEK7DzPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB
+CwUAA4IBAQBMOqNErLlFsceTfsgLCkLfZOoc7llsCLqJX2rKSpWeeo8HxdpFcoJxDjrSzG+ntKEj
+u/Ykn8sX/oymzsLS28yN/HH8AynBbF0zX2S2ZTuJbxh2ePXcokgfGT+Ok+vx+hfuzU7jBBJV1uXk
+3fs+BXziHV7Gp7yXT2g69ekuCkO2r1dcYmh8t/2jioSgrGK+KwmHNPBqAbubKVY8/gA3zyNs8U6q
+tnRGEmyR7jTV7JqR50S+kDFy1UkC9gLl9B/rfNmWVan/7Ir5mUf/NVoCqgTLiluHcSmRvaS0eg29
+mvVXIwAHIRc/SjnRBUkLp7Y3gaVdjKozXoEofKd9J+sAro03
+-----END CERTIFICATE-----
+
+Actalis Authentication Root CA
+==============================
+-----BEGIN CERTIFICATE-----
+MIIFuzCCA6OgAwIBAgIIVwoRl0LE48wwDQYJKoZIhvcNAQELBQAwazELMAkGA1UEBhMCSVQxDjAM
+BgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8wMzM1ODUyMDk2NzEnMCUGA1UE
+AwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290IENBMB4XDTExMDkyMjExMjIwMloXDTMwMDky
+MjExMjIwMlowazELMAkGA1UEBhMCSVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlz
+IFMucC5BLi8wMzM1ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290
+IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAp8bEpSmkLO/lGMWwUKNvUTufClrJ
+wkg4CsIcoBh/kbWHuUA/3R1oHwiD1S0eiKD4j1aPbZkCkpAW1V8IbInX4ay8IMKx4INRimlNAJZa
+by/ARH6jDuSRzVju3PvHHkVH3Se5CAGfpiEd9UEtL0z9KK3giq0itFZljoZUj5NDKd45RnijMCO6
+zfB9E1fAXdKDa0hMxKufgFpbOr3JpyI/gCczWw63igxdBzcIy2zSekciRDXFzMwujt0q7bd9Zg1f
+YVEiVRvjRuPjPdA1YprbrxTIW6HMiRvhMCb8oJsfgadHHwTrozmSBp+Z07/T6k9QnBn+locePGX2
+oxgkg4YQ51Q+qDp2JE+BIcXjDwL4k5RHILv+1A7TaLndxHqEguNTVHnd25zS8gebLra8Pu2Fbe8l
+EfKXGkJh90qX6IuxEAf6ZYGyojnP9zz/GPvG8VqLWeICrHuS0E4UT1lF9gxeKF+w6D9Fz8+vm2/7
+hNN3WpVvrJSEnu68wEqPSpP4RCHiMUVhUE4Q2OM1fEwZtN4Fv6MGn8i1zeQf1xcGDXqVdFUNaBr8
+EBtiZJ1t4JWgw5QHVw0U5r0F+7if5t+L4sbnfpb2U8WANFAoWPASUHEXMLrmeGO89LKtmyuy/uE5
+jF66CyCU3nuDuP/jVo23Eek7jPKxwV2dpAtMK9myGPW1n0sCAwEAAaNjMGEwHQYDVR0OBBYEFFLY
+iDrIn3hm7YnzezhwlMkCAjbQMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUUtiIOsifeGbt
+ifN7OHCUyQICNtAwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQALe3KHwGCmSUyI
+WOYdiPcUZEim2FgKDk8TNd81HdTtBjHIgT5q1d07GjLukD0R0i70jsNjLiNmsGe+b7bAEzlgqqI0
+JZN1Ut6nna0Oh4lScWoWPBkdg/iaKWW+9D+a2fDzWochcYBNy+A4mz+7+uAwTc+G02UQGRjRlwKx
+K3JCaKygvU5a2hi/a5iB0P2avl4VSM0RFbnAKVy06Ij3Pjaut2L9HmLecHgQHEhb2rykOLpn7VU+
+Xlff1ANATIGk0k9jpwlCCRT8AKnCgHNPLsBA2RF7SOp6AsDT6ygBJlh0wcBzIm2Tlf05fbsq4/aC
+4yyXX04fkZT6/iyj2HYauE2yOE+b+h1IYHkm4vP9qdCa6HCPSXrW5b0KDtst842/6+OkfcvHlXHo
+2qN8xcL4dJIEG4aspCJTQLas/kx2z/uUMsA1n3Y/buWQbqCmJqK4LL7RK4X9p2jIugErsWx0Hbhz
+lefut8cl8ABMALJ+tguLHPPAUJ4lueAI3jZm/zel0btUZCzJJ7VLkn5l/9Mt4blOvH+kQSGQQXem
+OR/qnuOf0GZvBeyqdn6/axag67XH/JJULysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9
+vwGYT7JZVEc+NHt4bVaTLnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg==
+-----END CERTIFICATE-----
+
+Buypass Class 2 Root CA
+=======================
+-----BEGIN CERTIFICATE-----
+MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEdMBsGA1UECgwU
+QnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3MgQ2xhc3MgMiBSb290IENBMB4X
+DTEwMTAyNjA4MzgwM1oXDTQwMTAyNjA4MzgwM1owTjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1
+eXBhc3MgQVMtOTgzMTYzMzI3MSAwHgYDVQQDDBdCdXlwYXNzIENsYXNzIDIgUm9vdCBDQTCCAiIw
+DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANfHXvfBB9R3+0Mh9PT1aeTuMgHbo4Yf5FkNuud1
+g1Lr6hxhFUi7HQfKjK6w3Jad6sNgkoaCKHOcVgb/S2TwDCo3SbXlzwx87vFKu3MwZfPVL4O2fuPn
+9Z6rYPnT8Z2SdIrkHJasW4DptfQxh6NR/Md+oW+OU3fUl8FVM5I+GC911K2GScuVr1QGbNgGE41b
+/+EmGVnAJLqBcXmQRFBoJJRfuLMR8SlBYaNByyM21cHxMlAQTn/0hpPshNOOvEu/XAFOBz3cFIqU
+CqTqc/sLUegTBxj6DvEr0VQVfTzh97QZQmdiXnfgolXsttlpF9U6r0TtSsWe5HonfOV116rLJeff
+awrbD02TTqigzXsu8lkBarcNuAeBfos4GzjmCleZPe4h6KP1DBbdi+w0jpwqHAAVF41og9JwnxgI
+zRFo1clrUs3ERo/ctfPYV3Me6ZQ5BL/T3jjetFPsaRyifsSP5BtwrfKi+fv3FmRmaZ9JUaLiFRhn
+Bkp/1Wy1TbMz4GHrXb7pmA8y1x1LPC5aAVKRCfLf6o3YBkBjqhHk/sM3nhRSP/TizPJhk9H9Z2vX
+Uq6/aKtAQ6BXNVN48FP4YUIHZMbXb5tMOA1jrGKvNouicwoN9SG9dKpN6nIDSdvHXx1iY8f93ZHs
+M+71bbRuMGjeyNYmsHVee7QHIJihdjK4TWxPAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFMmAd+BikoL1RpzzuvdMw964o605MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsF
+AAOCAgEAU18h9bqwOlI5LJKwbADJ784g7wbylp7ppHR/ehb8t/W2+xUbP6umwHJdELFx7rxP462s
+A20ucS6vxOOto70MEae0/0qyexAQH6dXQbLArvQsWdZHEIjzIVEpMMpghq9Gqx3tOluwlN5E40EI
+osHsHdb9T7bWR9AUC8rmyrV7d35BH16Dx7aMOZawP5aBQW9gkOLo+fsicdl9sz1Gv7SEr5AcD48S
+aq/v7h56rgJKihcrdv6sVIkkLE8/trKnToyokZf7KcZ7XC25y2a2t6hbElGFtQl+Ynhw/qlqYLYd
+DnkM/crqJIByw5c/8nerQyIKx+u2DISCLIBrQYoIwOula9+ZEsuK1V6ADJHgJgg2SMX6OBE1/yWD
+LfJ6v9r9jv6ly0UsH8SIU653DtmadsWOLB2jutXsMq7Aqqz30XpN69QH4kj3Io6wpJ9qzo6ysmD0
+oyLQI+uUWnpp3Q+/QFesa1lQ2aOZ4W7+jQF5JyMV3pKdewlNWudLSDBaGOYKbeaP4NK75t98biGC
+wWg5TbSYWGZizEqQXsP6JwSxeRV0mcy+rSDeJmAc61ZRpqPq5KM/p/9h3PFaTWwyI0PurKju7koS
+CTxdccK+efrCh2gdC/1cacwG0Jp9VJkqyTkaGa9LKkPzY11aWOIv4x3kqdbQCtCev9eBCfHJxyYN
+rJgWVqA=
+-----END CERTIFICATE-----
+
+Buypass Class 3 Root CA
+=======================
+-----BEGIN CERTIFICATE-----
+MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEdMBsGA1UECgwU
+QnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3MgQ2xhc3MgMyBSb290IENBMB4X
+DTEwMTAyNjA4Mjg1OFoXDTQwMTAyNjA4Mjg1OFowTjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1
+eXBhc3MgQVMtOTgzMTYzMzI3MSAwHgYDVQQDDBdCdXlwYXNzIENsYXNzIDMgUm9vdCBDQTCCAiIw
+DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKXaCpUWUOOV8l6ddjEGMnqb8RB2uACatVI2zSRH
+sJ8YZLya9vrVediQYkwiL944PdbgqOkcLNt4EemOaFEVcsfzM4fkoF0LXOBXByow9c3EN3coTRiR
+5r/VUv1xLXA+58bEiuPwKAv0dpihi4dVsjoT/Lc+JzeOIuOoTyrvYLs9tznDDgFHmV0ST9tD+leh
+7fmdvhFHJlsTmKtdFoqwNxxXnUX/iJY2v7vKB3tvh2PX0DJq1l1sDPGzbjniazEuOQAnFN44wOwZ
+ZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH
+2xc519woe2v1n/MuwU8XKhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV
+/afmiSTYzIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvSO1UQ
+RwUVZ2J+GGOmRj8JDlQyXr8NYnon74Do29lLBlo3WiXQCBJ31G8JUJc9yB3D34xFMFbG02SrZvPA
+Xpacw8Tvw3xrizp5f7NJzz3iiZ+gMEuFuZyUJHmPfWupRWgPK9Dx2hzLabjKSWJtyNBjYt1gD1iq
+j6G8BaVmos8bdrKEZLFMOVLAMLrwjEsCsLa3AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFEe4zf/lb+74suwvTg75JbCOPGvDMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsF
+AAOCAgEAACAjQTUEkMJAYmDv4jVM1z+s4jSQuKFvdvoWFqRINyzpkMLyPPgKn9iB5btb2iUspKdV
+cSQy9sgL8rxq+JOssgfCX5/bzMiKqr5qb+FJEMwx14C7u8jYog5kV+qi9cKpMRXSIGrs/CIBKM+G
+uIAeqcwRpTzyFrNHnfzSgCHEy9BHcEGhyoMZCCxt8l13nIoUE9Q2HJLw5QY33KbmkJs4j1xrG0aG
+Q0JfPgEHU1RdZX33inOhmlRaHylDFCfChQ+1iHsaO5S3HWCntZznKWlXWpuTekMwGwPXYshApqr8
+ZORK15FTAaggiG6cX0S5y2CBNOxv033aSF/rtJC8LakcC6wc1aJoIIAE1vyxjy+7SjENSoYc6+I2
+KSb12tjE8nVhz36udmNKekBlk4f4HoCMhuWG1o8O/FMsYOgWYRqiPkN7zTlgVGr18okmAWiDSKIz
+6MkEkbIRNBE+6tBDGR8Dk5AM/1E9V/RBbuHLoL7ryWPNbczk+DaqaJ3tvV2XcEQNtg413OEMXbug
+UZTLfhbrES+jkkXITHHZvMmZUldGL1DPvTVp9D0VzgalLA8+9oG6lLvDu79leNKGef9JOxqDDPDe
+eOzI8k1MGt6CKfjBWtrt7uYnXuhF0J0cUahoq0Tj0Itq4/g7u9xN12TyUb7mqqta6THuBrxzvxNi
+Cp/HuZc=
+-----END CERTIFICATE-----
+
+T-TeleSec GlobalRoot Class 3
+============================
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoM
+IlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBU
+cnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDMwHhcNMDgx
+MDAxMTAyOTU2WhcNMzMxMDAxMjM1OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lz
+dGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBD
+ZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDMwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQC9dZPwYiJvJK7genasfb3ZJNW4t/zN8ELg63iIVl6bmlQdTQyK
+9tPPcPRStdiTBONGhnFBSivwKixVA9ZIw+A5OO3yXDw/RLyTPWGrTs0NvvAgJ1gORH8EGoel15YU
+NpDQSXuhdfsaa3Ox+M6pCSzyU9XDFES4hqX2iys52qMzVNn6chr3IhUciJFrf2blw2qAsCTz34ZF
+iP0Zf3WHHx+xGwpzJFu5ZeAsVMhg02YXP+HMVDNzkQI6pn97djmiH5a2OK61yJN0HZ65tOVgnS9W
+0eDrXltMEnAMbEQgqxHY9Bn20pxSN+f6tsIxO0rUFJmtxxr1XV/6B7h8DR/Wgx6zAgMBAAGjQjBA
+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS1A/d2O2GCahKqGFPr
+AyGUv/7OyjANBgkqhkiG9w0BAQsFAAOCAQEAVj3vlNW92nOyWL6ukK2YJ5f+AbGwUgC4TeQbIXQb
+fsDuXmkqJa9c1h3a0nnJ85cp4IaH3gRZD/FZ1GSFS5mvJQQeyUapl96Cshtwn5z2r3Ex3XsFpSzT
+ucpH9sry9uetuUg/vBa3wW306gmv7PO15wWeph6KU1HWk4HMdJP2udqmJQV0eVp+QD6CSyYRMG7h
+P0HHRwA11fXT91Q+gT3aSWqas+8QPebrb9HIIkfLzM8BMZLZGOMivgkeGj5asuRrDFR6fUNOuIml
+e9eiPZaGzPImNC1qkp2aGtAw4l1OBLBfiyB+d8E9lYLRRpo7PHi4b6HQDWSieB4pTpPDpFQUWw==
+-----END CERTIFICATE-----
+
+D-TRUST Root Class 3 CA 2 2009
+==============================
+-----BEGIN CERTIFICATE-----
+MIIEMzCCAxugAwIBAgIDCYPzMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQK
+DAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTAe
+Fw0wOTExMDUwODM1NThaFw0yOTExMDUwODM1NThaME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxE
+LVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANOySs96R+91myP6Oi/WUEWJNTrGa9v+2wBoqOAD
+ER03UAifTUpolDWzU9GUY6cgVq/eUXjsKj3zSEhQPgrfRlWLJ23DEE0NkVJD2IfgXU42tSHKXzlA
+BF9bfsyjxiupQB7ZNoTWSPOSHjRGICTBpFGOShrvUD9pXRl/RcPHAY9RySPocq60vFYJfxLLHLGv
+KZAKyVXMD9O0Gu1HNVpK7ZxzBCHQqr0ME7UAyiZsxGsMlFqVlNpQmvH/pStmMaTJOKDfHR+4CS7z
+p+hnUquVH+BGPtikw8paxTGA6Eian5Rp/hnd2HN8gcqW3o7tszIFZYQ05ub9VxC1X3a/L7AQDcUC
+AwEAAaOCARowggEWMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3aFMSfMN4hvR5COfyrYyNJ
+4PGEMA4GA1UdDwEB/wQEAwIBBjCB0wYDVR0fBIHLMIHIMIGAoH6gfIZ6bGRhcDovL2RpcmVjdG9y
+eS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwUm9vdCUyMENsYXNzJTIwMyUyMENBJTIwMiUyMDIw
+MDksTz1ELVRydXN0JTIwR21iSCxDPURFP2NlcnRpZmljYXRlcmV2b2NhdGlvbmxpc3QwQ6BBoD+G
+PWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3JsL2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAw
+OS5jcmwwDQYJKoZIhvcNAQELBQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm
+2H6NMLVwMeniacfzcNsgFYbQDfC+rAF1hM5+n02/t2A7nPPKHeJeaNijnZflQGDSNiH+0LS4F9p0
+o3/U37CYAqxva2ssJSRyoWXuJVrl5jLn8t+rSfrzkGkj2wTZ51xY/GXUl77M/C4KzCUqNQT4YJEV
+dT1B/yMfGchs64JTBKbkTCJNjYy6zltz7GRUUG3RnFX7acM2w4y8PIWmawomDeCTmGCufsYkl4ph
+X5GOZpIJhzbNi5stPvZR1FDUWSi9g/LMKHtThm3YJohw1+qRzT65ysCQblrGXnRl11z+o+I=
+-----END CERTIFICATE-----
+
+D-TRUST Root Class 3 CA 2 EV 2009
+=================================
+-----BEGIN CERTIFICATE-----
+MIIEQzCCAyugAwIBAgIDCYP0MA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQK
+DAxELVRydXN0IEdtYkgxKjAoBgNVBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAw
+OTAeFw0wOTExMDUwODUwNDZaFw0yOTExMDUwODUwNDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQK
+DAxELVRydXN0IEdtYkgxKjAoBgNVBAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAw
+OTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfS
+egpnljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JUut8Mxk2og+KbgPCdM03TP1YtHh
+zRnp7hhPTFiu4h7WDFsVWtg6uMQYZB7jM7K1iXdODL/ZlGsTl28So/6ZqQTMFexgaDbtCHu39b+T
+7WYxg4zGcTSHThfqr4uRjRxWQa4iN1438h3Z0S0NL2lRp75mpoo6Kr3HGrHhFPC+Oh25z1uxav60
+sUYgovseO3Dvk5h9jHOW8sXvhXCtKSb8HgQ+HKDYD8tSg2J87otTlZCpV6LqYQXY+U3EJ/pure35
+11H3a6UCAwEAAaOCASQwggEgMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNOUikxiEyoZLsyv
+cop9NteaHNxnMA4GA1UdDwEB/wQEAwIBBjCB3QYDVR0fBIHVMIHSMIGHoIGEoIGBhn9sZGFwOi8v
+ZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xhc3MlMjAzJTIwQ0El
+MjAyJTIwRVYlMjAyMDA5LE89RC1UcnVzdCUyMEdtYkgsQz1ERT9jZXJ0aWZpY2F0ZXJldm9jYXRp
+b25saXN0MEagRKBChkBodHRwOi8vd3d3LmQtdHJ1c3QubmV0L2NybC9kLXRydXN0X3Jvb3RfY2xh
+c3NfM19jYV8yX2V2XzIwMDkuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQA07XtaPKSUiO8aEXUHL7P+
+PPoeUSbrh/Yp3uDx1MYkCenBz1UbtDDZzhr+BlGmFaQt77JLvyAoJUnRpjZ3NOhk31KxEcdzes05
+nsKtjHEh8lprr988TlWvsoRlFIm5d8sqMb7Po23Pb0iUMkZv53GMoKaEGTcH8gNFCSuGdXzfX2lX
+ANtu2KZyIktQ1HWYVt+3GP9DQ1CuekR78HlR10M9p9OB0/DJT7naxpeG0ILD5EJt/rDiZE4OJudA
+NCa1CInXCGNjOCd1HjPqbqjdn5lPdE2BiYBL3ZqXKVwvvoFBuYz/6n1gBp7N1z3TLqMVvKjmJuVv
+w9y4AyHqnxbxLFS1
+-----END CERTIFICATE-----
+
+CA Disig Root R2
+================
+-----BEGIN CERTIFICATE-----
+MIIFaTCCA1GgAwIBAgIJAJK4iNuwisFjMA0GCSqGSIb3DQEBCwUAMFIxCzAJBgNVBAYTAlNLMRMw
+EQYDVQQHEwpCcmF0aXNsYXZhMRMwEQYDVQQKEwpEaXNpZyBhLnMuMRkwFwYDVQQDExBDQSBEaXNp
+ZyBSb290IFIyMB4XDTEyMDcxOTA5MTUzMFoXDTQyMDcxOTA5MTUzMFowUjELMAkGA1UEBhMCU0sx
+EzARBgNVBAcTCkJyYXRpc2xhdmExEzARBgNVBAoTCkRpc2lnIGEucy4xGTAXBgNVBAMTEENBIERp
+c2lnIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCio8QACdaFXS1tFPbC
+w3OeNcJxVX6B+6tGUODBfEl45qt5WDza/3wcn9iXAng+a0EE6UG9vgMsRfYvZNSrXaNHPWSb6Wia
+xswbP7q+sos0Ai6YVRn8jG+qX9pMzk0DIaPY0jSTVpbLTAwAFjxfGs3Ix2ymrdMxp7zo5eFm1tL7
+A7RBZckQrg4FY8aAamkw/dLukO8NJ9+flXP04SXabBbeQTg06ov80egEFGEtQX6sx3dOy1FU+16S
+GBsEWmjGycT6txOgmLcRK7fWV8x8nhfRyyX+hk4kLlYMeE2eARKmK6cBZW58Yh2EhN/qwGu1pSqV
+g8NTEQxzHQuyRpDRQjrOQG6Vrf/GlK1ul4SOfW+eioANSW1z4nuSHsPzwfPrLgVv2RvPN3YEyLRa
+5Beny912H9AZdugsBbPWnDTYltxhh5EF5EQIM8HauQhl1K6yNg3ruji6DOWbnuuNZt2Zz9aJQfYE
+koopKW1rOhzndX0CcQ7zwOe9yxndnWCywmZgtrEE7snmhrmaZkCo5xHtgUUDi/ZnWejBBhG93c+A
+Ak9lQHhcR1DIm+YfgXvkRKhbhZri3lrVx/k6RGZL5DJUfORsnLMOPReisjQS1n6yqEm70XooQL6i
+Fh/f5DcfEXP7kAplQ6INfPgGAVUzfbANuPT1rqVCV3w2EYx7XsQDnYx5nQIDAQABo0IwQDAPBgNV
+HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUtZn4r7CU9eMg1gqtzk5WpC5u
+Qu0wDQYJKoZIhvcNAQELBQADggIBACYGXnDnZTPIgm7ZnBc6G3pmsgH2eDtpXi/q/075KMOYKmFM
+tCQSin1tERT3nLXK5ryeJ45MGcipvXrA1zYObYVybqjGom32+nNjf7xueQgcnYqfGopTpti72TVV
+sRHFqQOzVju5hJMiXn7B9hJSi+osZ7z+Nkz1uM/Rs0mSO9MpDpkblvdhuDvEK7Z4bLQjb/D907Je
+dR+Zlais9trhxTF7+9FGs9K8Z7RiVLoJ92Owk6Ka+elSLotgEqv89WBW7xBci8QaQtyDW2QOy7W8
+1k/BfDxujRNt+3vrMNDcTa/F1balTFtxyegxvug4BkihGuLq0t4SOVga/4AOgnXmt8kHbA7v/zjx
+mHHEt38OFdAlab0inSvtBfZGR6ztwPDUO+Ls7pZbkBNOHlY667DvlruWIxG68kOGdGSVyCh13x01
+utI3gzhTODY7z2zp+WsO0PsE6E9312UBeIYMej4hYvF/Y3EMyZ9E26gnonW+boE+18DrG5gPcFw0
+sorMwIUY6256s/daoQe/qUKS82Ail+QUoQebTnbAjn39pCXHR+3/H3OszMOl6W8KjptlwlCFtaOg
+UxLMVYdh84GuEEZhvUQhuMI9dM9+JDX6HAcOmz0iyu8xL4ysEr3vQCj8KWefshNPZiTEUxnpHikV
+7+ZtsH8tZ/3zbBt1RqPlShfppNcL
+-----END CERTIFICATE-----
+
+ACCVRAIZ1
+=========
+-----BEGIN CERTIFICATE-----
+MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UEAwwJQUNDVlJB
+SVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQswCQYDVQQGEwJFUzAeFw0xMTA1
+MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQBgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwH
+UEtJQUNDVjENMAsGA1UECgwEQUNDVjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQCbqau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gM
+jmoYHtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWoG2ioPej0
+RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpAlHPrzg5XPAOBOp0KoVdD
+aaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhrIA8wKFSVf+DuzgpmndFALW4ir50awQUZ
+0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDG
+WuzndN9wrqODJerWx5eHk6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs7
+8yM2x/474KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMOm3WR
+5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpacXpkatcnYGMN285J
+9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPluUsXQA+xtrn13k/c4LOsOxFwYIRK
+Q26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYIKwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRw
+Oi8vd3d3LmFjY3YuZXMvZmlsZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEu
+Y3J0MB8GCCsGAQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
+VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeTVfZW6oHlNsyM
+Hj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIGCCsGAQUFBwICMIIBFB6CARAA
+QQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUAcgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBh
+AO0AegAgAGQAZQAgAGwAYQAgAEEAQwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUA
+YwBuAG8AbABvAGcA7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBj
+AHQAcgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAAQwBQAFMA
+IABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUAczAwBggrBgEFBQcCARYk
+aHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2MuaHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0
+dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRtaW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2
+MV9kZXIuY3JsMA4GA1UdDwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZI
+hvcNAQEFBQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdpD70E
+R9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gUJyCpZET/LtZ1qmxN
+YEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+mAM/EKXMRNt6GGT6d7hmKG9Ww7Y49
+nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepDvV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJ
+TS+xJlsndQAJxGJ3KQhfnlmstn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3
+sCPdK6jT2iWH7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
+I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szAh1xA2syVP1Xg
+Nce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xFd3+YJ5oyXSrjhO7FmGYvliAd
+3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2HpPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3p
+EfbRD0tVNEYqi4Y7
+-----END CERTIFICATE-----
+
+TWCA Global Root CA
+===================
+-----BEGIN CERTIFICATE-----
+MIIFQTCCAymgAwIBAgICDL4wDQYJKoZIhvcNAQELBQAwUTELMAkGA1UEBhMCVFcxEjAQBgNVBAoT
+CVRBSVdBTi1DQTEQMA4GA1UECxMHUm9vdCBDQTEcMBoGA1UEAxMTVFdDQSBHbG9iYWwgUm9vdCBD
+QTAeFw0xMjA2MjcwNjI4MzNaFw0zMDEyMzExNTU5NTlaMFExCzAJBgNVBAYTAlRXMRIwEAYDVQQK
+EwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jvb3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3Qg
+Q0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCwBdvI64zEbooh745NnHEKH1Jw7W2C
+nJfF10xORUnLQEK1EjRsGcJ0pDFfhQKX7EMzClPSnIyOt7h52yvVavKOZsTuKwEHktSz0ALfUPZV
+r2YOy+BHYC8rMjk1Ujoog/h7FsYYuGLWRyWRzvAZEk2tY/XTP3VfKfChMBwqoJimFb3u/Rk28OKR
+Q4/6ytYQJ0lM793B8YVwm8rqqFpD/G2Gb3PpN0Wp8DbHzIh1HrtsBv+baz4X7GGqcXzGHaL3SekV
+tTzWoWH1EfcFbx39Eb7QMAfCKbAJTibc46KokWofwpFFiFzlmLhxpRUZyXx1EcxwdE8tmx2RRP1W
+KKD+u4ZqyPpcC1jcxkt2yKsi2XMPpfRaAok/T54igu6idFMqPVMnaR1sjjIsZAAmY2E2TqNGtz99
+sy2sbZCilaLOz9qC5wc0GZbpuCGqKX6mOL6OKUohZnkfs8O1CWfe1tQHRvMq2uYiN2DLgbYPoA/p
+yJV/v1WRBXrPPRXAb94JlAGD1zQbzECl8LibZ9WYkTunhHiVJqRaCPgrdLQABDzfuBSO6N+pjWxn
+kjMdwLfS7JLIvgm/LCkFbwJrnu+8vyq8W8BQj0FwcYeyTbcEqYSjMq+u7msXi7Kx/mzhkIyIqJdI
+zshNy/MGz19qCkKxHh53L46g5pIOBvwFItIm4TFRfTLcDwIDAQABoyMwITAOBgNVHQ8BAf8EBAMC
+AQYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6g
+cFGn90xHNcgL1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn
+LhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WFH6vPNOw/KP4M
+8VeGTslV9xzU2KV9Bnpv1d8Q34FOIWWxtuEXeZVFBs5fzNxGiWNoRI2T9GRwoD2dKAXDOXC4Ynsg
+/eTb6QihuJ49CcdP+yz4k3ZB3lLg4VfSnQO8d57+nile98FRYB/e2guyLXW3Q0iT5/Z5xoRdgFlg
+lPx4mI88k1HtQJAH32RjJMtOcQWh15QaiDLxInQirqWm2BJpTGCjAu4r7NRjkgtevi92a6O2JryP
+A9gK8kxkRr05YuWW6zRjESjMlfGt7+/cgFhI6Uu46mWs6fyAtbXIRfmswZ/ZuepiiI7E8UuDEq3m
+i4TWnsLrgxifarsbJGAzcMzs9zLzXNl5fe+epP7JI8Mk7hWSsT2RTyaGvWZzJBPqpK5jwa19hAM8
+EHiGG3njxPPyBJUgriOCxLM6AGK/5jYk4Ve6xx6QddVfP5VhK8E7zeWzaGHQRiapIVJpLesux+t3
+zqY6tQMzT3bR51xUAV3LePTJDL/PEo4XLSNolOer/qmyKwbQBM0=
+-----END CERTIFICATE-----
+
+TeliaSonera Root CA v1
+======================
+-----BEGIN CERTIFICATE-----
+MIIFODCCAyCgAwIBAgIRAJW+FqD3LkbxezmCcvqLzZYwDQYJKoZIhvcNAQEFBQAwNzEUMBIGA1UE
+CgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJvb3QgQ0EgdjEwHhcNMDcxMDE4
+MTIwMDUwWhcNMzIxMDE4MTIwMDUwWjA3MRQwEgYDVQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwW
+VGVsaWFTb25lcmEgUm9vdCBDQSB2MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMK+
+6yfwIaPzaSZVfp3FVRaRXP3vIb9TgHot0pGMYzHw7CTww6XScnwQbfQ3t+XmfHnqjLWCi65ItqwA
+3GV17CpNX8GH9SBlK4GoRz6JI5UwFpB/6FcHSOcZrr9FZ7E3GwYq/t75rH2D+1665I+XZ75Ljo1k
+B1c4VWk0Nj0TSO9P4tNmHqTPGrdeNjPUtAa9GAH9d4RQAEX1jF3oI7x+/jXh7VB7qTCNGdMJjmhn
+Xb88lxhTuylixcpecsHHltTbLaC0H2kD7OriUPEMPPCs81Mt8Bz17Ww5OXOAFshSsCPN4D7c3TxH
+oLs1iuKYaIu+5b9y7tL6pe0S7fyYGKkmdtwoSxAgHNN/Fnct7W+A90m7UwW7XWjH1Mh1Fj+JWov3
+F0fUTPHSiXk+TT2YqGHeOh7S+F4D4MHJHIzTjU3TlTazN19jY5szFPAtJmtTfImMMsJu7D0hADnJ
+oWjiUIMusDor8zagrC/kb2HCUQk5PotTubtn2txTuXZZNp1D5SDgPTJghSJRt8czu90VL6R4pgd7
+gUY2BIbdeTXHlSw7sKMXNeVzH7RcWe/a6hBle3rQf5+ztCo3O3CLm1u5K7fsslESl1MpWtTwEhDc
+TwK7EpIvYtQ/aUN8Ddb8WHUBiJ1YFkveupD/RwGJBmr2X7KQarMCpgKIv7NHfirZ1fpoeDVNAgMB
+AAGjPzA9MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBTwj1k4ALP1j5qW
+DNXr+nuqF+gTEjANBgkqhkiG9w0BAQUFAAOCAgEAvuRcYk4k9AwI//DTDGjkk0kiP0Qnb7tt3oNm
+zqjMDfz1mgbldxSR651Be5kqhOX//CHBXfDkH1e3damhXwIm/9fH907eT/j3HEbAek9ALCI18Bmx
+0GtnLLCo4MBANzX2hFxc469CeP6nyQ1Q6g2EdvZR74NTxnr/DlZJLo961gzmJ1TjTQpgcmLNkQfW
+pb/ImWvtxBnmq0wROMVvMeJuScg/doAmAyYp4Db29iBT4xdwNBedY2gea+zDTYa4EzAvXUYNR0PV
+G6pZDrlcjQZIrXSHX8f8MVRBE+LHIQ6e4B4N4cB7Q4WQxYpYxmUKeFfyxiMPAdkgS94P+5KFdSpc
+c41teyWRyu5FrgZLAMzTsVlQ2jqIOylDRl6XK1TOU2+NSueW+r9xDkKLfP0ooNBIytrEgUy7onOT
+JsjrDNYmiLbAJM+7vVvrdX3pCI6GMyx5dwlppYn8s3CQh3aP0yK7Qs69cwsgJirQmz1wHiRszYd2
+qReWt88NkvuOGKmYSdGe/mBEciG5Ge3C9THxOUiIkCR1VBatzvT4aRRkOfujuLpwQMcnHL/EVlP6
+Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVxSK236thZiNSQvxaz2ems
+WWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY=
+-----END CERTIFICATE-----
+
+E-Tugra Certification Authority
+===============================
+-----BEGIN CERTIFICATE-----
+MIIGSzCCBDOgAwIBAgIIamg+nFGby1MwDQYJKoZIhvcNAQELBQAwgbIxCzAJBgNVBAYTAlRSMQ8w
+DQYDVQQHDAZBbmthcmExQDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamls
+ZXJpIHZlIEhpem1ldGxlcmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBN
+ZXJrZXppMSgwJgYDVQQDDB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEzMDMw
+NTEyMDk0OFoXDTIzMDMwMzEyMDk0OFowgbIxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmthcmEx
+QDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhpem1ldGxl
+cmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBNZXJrZXppMSgwJgYDVQQD
+DB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEA4vU/kwVRHoViVF56C/UYB4Oufq9899SKa6VjQzm5S/fDxmSJPZQuVIBSOTkHS0vd
+hQd2h8y/L5VMzH2nPbxHD5hw+IyFHnSOkm0bQNGZDbt1bsipa5rAhDGvykPL6ys06I+XawGb1Q5K
+CKpbknSFQ9OArqGIW66z6l7LFpp3RMih9lRozt6Plyu6W0ACDGQXwLWTzeHxE2bODHnv0ZEoq1+g
+ElIwcxmOj+GMB6LDu0rw6h8VqO4lzKRG+Bsi77MOQ7osJLjFLFzUHPhdZL3Dk14opz8n8Y4e0ypQ
+BaNV2cvnOVPAmJ6MVGKLJrD3fY185MaeZkJVgkfnsliNZvcHfC425lAcP9tDJMW/hkd5s3kc91r0
+E+xs+D/iWR+V7kI+ua2oMoVJl0b+SzGPWsutdEcf6ZG33ygEIqDUD13ieU/qbIWGvaimzuT6w+Gz
+rt48Ue7LE3wBf4QOXVGUnhMMti6lTPk5cDZvlsouDERVxcr6XQKj39ZkjFqzAQqptQpHF//vkUAq
+jqFGOjGY5RH8zLtJVor8udBhmm9lbObDyz51Sf6Pp+KJxWfXnUYTTjF2OySznhFlhqt/7x3U+Lzn
+rFpct1pHXFXOVbQicVtbC/DP3KBhZOqp12gKY6fgDT+gr9Oq0n7vUaDmUStVkhUXU8u3Zg5mTPj5
+dUyQ5xJwx0UCAwEAAaNjMGEwHQYDVR0OBBYEFC7j27JJ0JxUeVz6Jyr+zE7S6E5UMA8GA1UdEwEB
+/wQFMAMBAf8wHwYDVR0jBBgwFoAULuPbsknQnFR5XPonKv7MTtLoTlQwDgYDVR0PAQH/BAQDAgEG
+MA0GCSqGSIb3DQEBCwUAA4ICAQAFNzr0TbdF4kV1JI+2d1LoHNgQk2Xz8lkGpD4eKexd0dCrfOAK
+kEh47U6YA5n+KGCRHTAduGN8qOY1tfrTYXbm1gdLymmasoR6d5NFFxWfJNCYExL/u6Au/U5Mh/jO
+XKqYGwXgAEZKgoClM4so3O0409/lPun++1ndYYRP0lSWE2ETPo+Aab6TR7U1Q9Jauz1c77NCR807
+VRMGsAnb/WP2OogKmW9+4c4bU2pEZiNRCHu8W1Ki/QY3OEBhj0qWuJA3+GbHeJAAFS6LrVE1Uweo
+a2iu+U48BybNCAVwzDk/dr2l02cmAYamU9JgO3xDf1WKvJUawSg5TB9D0pH0clmKuVb8P7Sd2nCc
+dlqMQ1DujjByTd//SffGqWfZbawCEeI6FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEV
+KV0jq9BgoRJP3vQXzTLlyb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gT
+Dx4JnW2PAJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpDy4Q0
+8ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8dNL/+I5c30jn6PQ0G
+C7TbO6Orb1wdtn7os4I07QZcJA==
+-----END CERTIFICATE-----
+
+T-TeleSec GlobalRoot Class 2
+============================
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoM
+IlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBU
+cnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgx
+MDAxMTA0MDE0WhcNMzMxMDAxMjM1OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lz
+dGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBD
+ZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUdAqSzm1nzHoqvNK38DcLZ
+SBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiCFoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/F
+vudocP05l03Sx5iRUKrERLMjfTlH6VJi1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx970
+2cu+fjOlbpSD8DT6IavqjnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGV
+WOHAD3bZwI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGjQjBA
+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/WSA2AHmgoCJrjNXy
+YdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhyNsZt+U2e+iKo4YFWz827n+qrkRk4
+r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPACuvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNf
+vNoBYimipidx5joifsFvHZVwIEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR
+3p1m0IvVVGb6g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
+9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlPBSeOE6Fuwg==
+-----END CERTIFICATE-----
+
+Atos TrustedRoot 2011
+=====================
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UEAwwVQXRvcyBU
+cnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQGEwJERTAeFw0xMTA3MDcxNDU4
+MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMMFUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsG
+A1UECgwEQXRvczELMAkGA1UEBhMCREUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCV
+hTuXbyo7LjvPpvMpNb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr
+54rMVD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+SZFhyBH+
+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ4J7sVaE3IqKHBAUsR320
+HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0Lcp2AMBYHlT8oDv3FdU9T1nSatCQujgKR
+z3bFmx5VdJx4IbHwLfELn8LVlhgf8FQieowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7R
+l+lwrrw7GWzbITAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZ
+bNshMBgGA1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8jvZfza1zv7v1Apt+h
+k6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kPDpFrdRbhIfzYJsdHt6bPWHJxfrrh
+TZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pcmaHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a9
+61qn8FYiqTxlVMYVqL2Gns2Dlmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G
+3mB/ufNPRJLvKrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
+-----END CERTIFICATE-----
+
+QuoVadis Root CA 1 G3
+=====================
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIUeFhfLq0sGUvjNwc1NBMotZbUZZMwDQYJKoZIhvcNAQELBQAwSDELMAkG
+A1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAcBgNVBAMTFVF1b1ZhZGlzIFJv
+b3QgQ0EgMSBHMzAeFw0xMjAxMTIxNzI3NDRaFw00MjAxMTIxNzI3NDRaMEgxCzAJBgNVBAYTAkJN
+MRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDEg
+RzMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCgvlAQjunybEC0BJyFuTHK3C3kEakE
+PBtVwedYMB0ktMPvhd6MLOHBPd+C5k+tR4ds7FtJwUrVu4/sh6x/gpqG7D0DmVIB0jWerNrwU8lm
+PNSsAgHaJNM7qAJGr6Qc4/hzWHa39g6QDbXwz8z6+cZM5cOGMAqNF34168Xfuw6cwI2H44g4hWf6
+Pser4BOcBRiYz5P1sZK0/CPTz9XEJ0ngnjybCKOLXSoh4Pw5qlPafX7PGglTvF0FBM+hSo+LdoIN
+ofjSxxR3W5A2B4GbPgb6Ul5jxaYA/qXpUhtStZI5cgMJYr2wYBZupt0lwgNm3fME0UDiTouG9G/l
+g6AnhF4EwfWQvTA9xO+oabw4m6SkltFi2mnAAZauy8RRNOoMqv8hjlmPSlzkYZqn0ukqeI1RPToV
+7qJZjqlc3sX5kCLliEVx3ZGZbHqfPT2YfF72vhZooF6uCyP8Wg+qInYtyaEQHeTTRCOQiJ/GKubX
+9ZqzWB4vMIkIG1SitZgj7Ah3HJVdYdHLiZxfokqRmu8hqkkWCKi9YSgxyXSthfbZxbGL0eUQMk1f
+iyA6PEkfM4VZDdvLCXVDaXP7a3F98N/ETH3Goy7IlXnLc6KOTk0k+17kBL5yG6YnLUlamXrXXAkg
+t3+UuU/xDRxeiEIbEbfnkduebPRq34wGmAOtzCjvpUfzUwIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUo5fW816iEOGrRZ88F2Q87gFwnMwwDQYJKoZI
+hvcNAQELBQADggIBABj6W3X8PnrHX3fHyt/PX8MSxEBd1DKquGrX1RUVRpgjpeaQWxiZTOOtQqOC
+MTaIzen7xASWSIsBx40Bz1szBpZGZnQdT+3Btrm0DWHMY37XLneMlhwqI2hrhVd2cDMT/uFPpiN3
+GPoajOi9ZcnPP/TJF9zrx7zABC4tRi9pZsMbj/7sPtPKlL92CiUNqXsCHKnQO18LwIE6PWThv6ct
+Tr1NxNgpxiIY0MWscgKCP6o6ojoilzHdCGPDdRS5YCgtW2jgFqlmgiNR9etT2DGbe+m3nUvriBbP
++V04ikkwj+3x6xn0dxoxGE1nVGwvb2X52z3sIexe9PSLymBlVNFxZPT5pqOBMzYzcfCkeF9OrYMh
+3jRJjehZrJ3ydlo28hP0r+AJx2EqbPfgna67hkooby7utHnNkDPDs3b69fBsnQGQ+p6Q9pxyz0fa
+wx/kNSBT8lTR32GDpgLiJTjehTItXnOQUl1CxM49S+H5GYQd1aJQzEH7QRTDvdbJWqNjZgKAvQU6
+O0ec7AAmTPWIUb+oI38YB7AL7YsmoWTTYUrrXJ/es69nA7Mf3W1daWhpq1467HxpvMc7hU6eFbm0
+FU/DlXpY18ls6Wy58yljXrQs8C097Vpl4KlbQMJImYFtnh8GKjwStIsPm6Ik8KaN1nrgS7ZklmOV
+hMJKzRwuJIczYOXD
+-----END CERTIFICATE-----
+
+QuoVadis Root CA 2 G3
+=====================
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIURFc0JFuBiZs18s64KztbpybwdSgwDQYJKoZIhvcNAQELBQAwSDELMAkG
+A1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAcBgNVBAMTFVF1b1ZhZGlzIFJv
+b3QgQ0EgMiBHMzAeFw0xMjAxMTIxODU5MzJaFw00MjAxMTIxODU5MzJaMEgxCzAJBgNVBAYTAkJN
+MRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDIg
+RzMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQChriWyARjcV4g/Ruv5r+LrI3HimtFh
+ZiFfqq8nUeVuGxbULX1QsFN3vXg6YOJkApt8hpvWGo6t/x8Vf9WVHhLL5hSEBMHfNrMWn4rjyduY
+NM7YMxcoRvynyfDStNVNCXJJ+fKH46nafaF9a7I6JaltUkSs+L5u+9ymc5GQYaYDFCDy54ejiK2t
+oIz/pgslUiXnFgHVy7g1gQyjO/Dh4fxaXc6AcW34Sas+O7q414AB+6XrW7PFXmAqMaCvN+ggOp+o
+MiwMzAkd056OXbxMmO7FGmh77FOm6RQ1o9/NgJ8MSPsc9PG/Srj61YxxSscfrf5BmrODXfKEVu+l
+V0POKa2Mq1W/xPtbAd0jIaFYAI7D0GoT7RPjEiuA3GfmlbLNHiJuKvhB1PLKFAeNilUSxmn1uIZo
+L1NesNKqIcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz8eQQ
+sSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43ehvNURG3YBZwjgQQvD
+6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l7ZizlWNof/k19N+IxWA1ksB8aRxh
+lRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwNkALGcC4BrTwV1wIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU7edvdlq/YOxJW8ald7tyFnGbxD0wDQYJKoZI
+hvcNAQELBQADggIBAJHfgD9DCX5xwvfrs4iP4VGyvD11+ShdyLyZm3tdquXK4Qr36LLTn91nMX66
+AarHakE7kNQIXLJgapDwyM4DYvmL7ftuKtwGTTwpD4kWilhMSA/ohGHqPHKmd+RCroijQ1h5fq7K
+pVMNqT1wvSAZYaRsOPxDMuHBR//47PERIjKWnML2W2mWeyAMQ0GaW/ZZGYjeVYg3UQt4XAoeo0L9
+x52ID8DyeAIkVJOviYeIyUqAHerQbj5hLja7NQ4nlv1mNDthcnPxFlxHBlRJAHpYErAK74X9sbgz
+dWqTHBLmYF5vHX/JHyPLhGGfHoJE+V+tYlUkmlKY7VHnoX6XOuYvHxHaU4AshZ6rNRDbIl9qxV6X
+U/IyAgkwo1jwDQHVcsaxfGl7w/U2Rcxhbl5MlMVerugOXou/983g7aEOGzPuVBj+D77vfoRrQ+Nw
+mNtddbINWQeFFSM51vHfqSYP1kjHs6Yi9TM3WpVHn3u6GBVv/9YUZINJ0gpnIdsPNWNgKCLjsZWD
+zYWm3S8P52dSbrsvhXz1SnPnxT7AvSESBT/8twNJAlvIJebiVDj1eYeMHVOyToV7BjjHLPj4sHKN
+JeV3UvQDHEimUF+IIDBu8oJDqz2XhOdT+yHBTw8imoa4WSr2Rz0ZiC3oheGe7IUIarFsNMkd7Egr
+O3jtZsSOeWmD3n+M
+-----END CERTIFICATE-----
+
+QuoVadis Root CA 3 G3
+=====================
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIULvWbAiin23r/1aOp7r0DoM8Sah0wDQYJKoZIhvcNAQELBQAwSDELMAkG
+A1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAcBgNVBAMTFVF1b1ZhZGlzIFJv
+b3QgQ0EgMyBHMzAeFw0xMjAxMTIyMDI2MzJaFw00MjAxMTIyMDI2MzJaMEgxCzAJBgNVBAYTAkJN
+MRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDMg
+RzMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCzyw4QZ47qFJenMioKVjZ/aEzHs286
+IxSR/xl/pcqs7rN2nXrpixurazHb+gtTTK/FpRp5PIpM/6zfJd5O2YIyC0TeytuMrKNuFoM7pmRL
+Mon7FhY4futD4tN0SsJiCnMK3UmzV9KwCoWdcTzeo8vAMvMBOSBDGzXRU7Ox7sWTaYI+FrUoRqHe
+6okJ7UO4BUaKhvVZR74bbwEhELn9qdIoyhA5CcoTNs+cra1AdHkrAj80//ogaX3T7mH1urPnMNA3
+I4ZyYUUpSFlob3emLoG+B01vr87ERRORFHAGjx+f+IdpsQ7vw4kZ6+ocYfx6bIrc1gMLnia6Et3U
+VDmrJqMz6nWB2i3ND0/kA9HvFZcba5DFApCTZgIhsUfei5pKgLlVj7WiL8DWM2fafsSntARE60f7
+5li59wzweyuxwHApw0BiLTtIadwjPEjrewl5qW3aqDCYz4ByA4imW0aucnl8CAMhZa634RylsSqi
+Md5mBPfAdOhx3v89WcyWJhKLhZVXGqtrdQtEPREoPHtht+KPZ0/l7DxMYIBpVzgeAVuNVejH38DM
+dyM0SXV89pgR6y3e7UEuFAUCf+D+IOs15xGsIs5XPd7JMG0QA4XN8f+MFrXBsj6IbGB/kE+V9/Yt
+rQE5BwT6dYB9v0lQ7e/JxHwc64B+27bQ3RP+ydOc17KXqQIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUxhfQvKjqAkPyGwaZXSuQILnXnOQwDQYJKoZI
+hvcNAQELBQADggIBADRh2Va1EodVTd2jNTFGu6QHcrxfYWLopfsLN7E8trP6KZ1/AvWkyaiTt3px
+KGmPc+FSkNrVvjrlt3ZqVoAh313m6Tqe5T72omnHKgqwGEfcIHB9UqM+WXzBusnIFUBhynLWcKzS
+t/Ac5IYp8M7vaGPQtSCKFWGafoaYtMnCdvvMujAWzKNhxnQT5WvvoxXqA/4Ti2Tk08HS6IT7SdEQ
+TXlm66r99I0xHnAUrdzeZxNMgRVhvLfZkXdxGYFgu/BYpbWcC/ePIlUnwEsBbTuZDdQdm2NnL9Du
+DcpmvJRPpq3t/O5jrFc/ZSXPsoaP0Aj/uHYUbt7lJ+yreLVTubY/6CD50qi+YUbKh4yE8/nxoGib
+Ih6BJpsQBJFxwAYf3KDTuVan45gtf4Od34wrnDKOMpTwATwiKp9Dwi7DmDkHOHv8XgBCH/MyJnmD
+hPbl8MFREsALHgQjDFSlTC9JxUrRtm5gDWv8a4uFJGS3iQ6rJUdbPM9+Sb3H6QrG2vd+DhcI00iX
+0HGS8A85PjRqHH3Y8iKuu2n0M7SmSFXRDw4m6Oy2Cy2nhTXN/VnIn9HNPlopNLk9hM6xZdRZkZFW
+dSHBd575euFgndOtBBj0fOtek49TSiIp+EgrPk2GrFt/ywaZWWDYWGWVjUTR939+J399roD1B0y2
+PpxxVJkES/1Y+Zj0
+-----END CERTIFICATE-----
+
+DigiCert Assured ID Root G2
+===========================
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn6gAwIBAgIQC5McOtY5Z+pnI7/Dr5r0SzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQw
+IgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzIwHhcNMTMwODAxMTIwMDAwWhcNMzgw
+MTE1MTIwMDAwWjBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQL
+ExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzIw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ5ygvUj82ckmIkzTz+GoeMVSAn61UQbVH
+35ao1K+ALbkKz3X9iaV9JPrjIgwrvJUXCzO/GU1BBpAAvQxNEP4HteccbiJVMWWXvdMX0h5i89vq
+bFCMP4QMls+3ywPgym2hFEwbid3tALBSfK+RbLE4E9HpEgjAALAcKxHad3A2m67OeYfcgnDmCXRw
+VWmvo2ifv922ebPynXApVfSr/5Vh88lAbx3RvpO704gqu52/clpWcTs/1PPRCv4o76Pu2ZmvA9OP
+YLfykqGxvYmJHzDNw6YuYjOuFgJ3RFrngQo8p0Quebg/BLxcoIfhG69Rjs3sLPr4/m3wOnyqi+Rn
+lTGNAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBTO
+w0q5mVXyuNtgv6l+vVa1lzan1jANBgkqhkiG9w0BAQsFAAOCAQEAyqVVjOPIQW5pJ6d1Ee88hjZv
+0p3GeDgdaZaikmkuOGybfQTUiaWxMTeKySHMq2zNixya1r9I0jJmwYrA8y8678Dj1JGG0VDjA9tz
+d29KOVPt3ibHtX2vK0LRdWLjSisCx1BL4GnilmwORGYQRI+tBev4eaymG+g3NJ1TyWGqolKvSnAW
+hsI6yLETcDbYz+70CjTVW0z9B5yiutkBclzzTcHdDrEcDcRjvq30FPuJ7KJBDkzMyFdA0G4Dqs0M
+jomZmWzwPDCvON9vvKO+KSAnq3T/EyJ43pdSVR6DtVQgA+6uwE9W3jfMw3+qBCe703e4YtsXfJwo
+IhNzbM8m9Yop5w==
+-----END CERTIFICATE-----
+
+DigiCert Assured ID Root G3
+===========================
+-----BEGIN CERTIFICATE-----
+MIICRjCCAc2gAwIBAgIQC6Fa+h3foLVJRK/NJKBs7DAKBggqhkjOPQQDAzBlMQswCQYDVQQGEwJV
+UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYD
+VQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzMwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1
+MTIwMDAwWjBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzMwdjAQ
+BgcqhkjOPQIBBgUrgQQAIgNiAAQZ57ysRGXtzbg/WPuNsVepRC0FFfLvC/8QdJ+1YlJfZn4f5dwb
+RXkLzMZTCp2NXQLZqVneAlr2lSoOjThKiknGvMYDOAdfVdp+CW7if17QRSAPWXYQ1qAk8C3eNvJs
+KTmjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBTL0L2p4ZgF
+UaFNN6KDec6NHSrkhDAKBggqhkjOPQQDAwNnADBkAjAlpIFFAmsSS3V0T8gj43DydXLefInwz5Fy
+YZ5eEJJZVrmDxxDnOOlYJjZ91eQ0hjkCMHw2U/Aw5WJjOpnitqM7mzT6HtoQknFekROn3aRukswy
+1vUhZscv6pZjamVFkpUBtA==
+-----END CERTIFICATE-----
+
+DigiCert Global Root G2
+=======================
+-----BEGIN CERTIFICATE-----
+MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAw
+HgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUx
+MjAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3
+dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI2/Ou8jqJ
+kTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx1x7e/dfgy5SDN67sH0NO
+3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQq2EGnI/yuum06ZIya7XzV+hdG82MHauV
+BJVJ8zUtluNJbd134/tJS7SsVQepj5WztCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyM
+UNGPHgm+F6HmIcr9g+UQvIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQAB
+o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV5uNu
+5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY1Yl9PMWLSn/pvtsr
+F9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4NeF22d+mQrvHRAiGfzZ0JFrabA0U
+WTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NGFdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBH
+QRFXGU7Aj64GxJUTFy8bJZ918rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/
+iyK5S9kJRaTepLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl
+MrY=
+-----END CERTIFICATE-----
+
+DigiCert Global Root G3
+=======================
+-----BEGIN CERTIFICATE-----
+MIICPzCCAcWgAwIBAgIQBVVWvPJepDU1w6QP1atFcjAKBggqhkjOPQQDAzBhMQswCQYDVQQGEwJV
+UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYD
+VQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMzAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAw
+MDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5k
+aWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEczMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAE3afZu4q4C/sLfyHS8L6+c/MzXRq8NOrexpu80JX28MzQC7phW1FGfp4tn+6O
+YwwX7Adw9c+ELkCDnOg/QW07rdOkFFk2eJ0DQ+4QE2xy3q6Ip6FrtUPOZ9wj/wMco+I+o0IwQDAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUs9tIpPmhxdiuNkHMEWNp
+Yim8S8YwCgYIKoZIzj0EAwMDaAAwZQIxAK288mw/EkrRLTnDCgmXc/SINoyIJ7vmiI1Qhadj+Z4y
+3maTD/HMsQmP3Wyr+mt/oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34
+VOKa5Vt8sycX
+-----END CERTIFICATE-----
+
+DigiCert Trusted Root G4
+========================
+-----BEGIN CERTIFICATE-----
+MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBiMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSEw
+HwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1
+MTIwMDAwWjBiMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3yithZwuEp
+pz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1Ifxp4VpX6+n6lXFllVcq9o
+k3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7Fsa
+vOvJz82sNEBfsXpm7nfISKhmV1efVFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGY
+QJB5w3jHtrHEtWoYOAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6
+MUSaM0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCiEhtm
+mnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADMfRyVw4/3IbKyEbe7
+f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFH
+dL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8
+oR7FwI+isX4KJpn15GkvmB0t9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBhjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
+ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2SV1EY+CtnJYY
+ZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd+SeuMIW59mdNOj6PWTkiU0Tr
+yF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWcfFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy
+7zBZLq7gcfJW5GqXb5JQbZaNaHqasjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iah
+ixTXTBmyUEFxPT9NcCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN
+5r5N0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie4u1Ki7wb
+/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mIr/OSmbaz5mEP0oUA51Aa
+5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tK
+G48BtieVU+i2iW1bvGjUI+iLUaJW+fCmgKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP
+82Z+
+-----END CERTIFICATE-----
+
+COMODO RSA Certification Authority
+==================================
+-----BEGIN CERTIFICATE-----
+MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE
+BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG
+A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkwHhcNMTAwMTE5MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMC
+R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE
+ChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR6FSS0gpWsawNJN3Fz0Rn
+dJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8Xpz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZ
+FGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+
+5eNu/Nio5JIk2kNrYrhV/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pG
+x8cgoLEfZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z+pUX
+2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7wqP/0uK3pN/u6uPQL
+OvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZahSL0896+1DSJMwBGB7FY79tOi4lu3
+sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVICu9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+C
+GCe01a60y1Dma/RMhnEw6abfFobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5
+WdYgGq/yapiqcrxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E
+FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvlwFTPoCWOAvn9sKIN9SCYPBMt
+rFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+
+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSg
+tZx8jb8uk2IntznaFxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwW
+sRqZCuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiKboHGhfKp
+pC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmckejkk9u+UJueBPSZI9FoJA
+zMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yLS0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHq
+ZJx64SIDqZxubw5lT2yHh17zbqD5daWbQOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk52
+7RH89elWsn2/x20Kk4yl0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7I
+LaZRfyHBNVOFBkpdn627G190
+-----END CERTIFICATE-----
+
+USERTrust RSA Certification Authority
+=====================================
+-----BEGIN CERTIFICATE-----
+MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCBiDELMAkGA1UE
+BhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQK
+ExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNh
+dGlvbiBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UE
+BhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQK
+ExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNh
+dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAEmUXNg7D2wiz
+0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2j
+Y0K2dvKpOyuR+OJv0OwWIJAJPuLodMkYtJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFn
+RghRy4YUVD+8M/5+bJz/Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O
++T23LLb2VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT79uq
+/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6c0Plfg6lZrEpfDKE
+Y1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmTYo61Zs8liM2EuLE/pDkP2QKe6xJM
+lXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97lc6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8
+yexDJtC/QV9AqURE9JnnV4eeUB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+
+eLf8ZxXhyVeEHg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
+BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
+MAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPFUp/L+M+ZBn8b2kMVn54CVVeW
+FPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KOVWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ
+7l8wXEskEVX/JJpuXior7gtNn3/3ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQ
+Eg9zKC7F4iRO/Fjs8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM
+8WcRiQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYzeSf7dNXGi
+FSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZXHlKYC6SQK5MNyosycdi
+yA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9c
+J2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRBVXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGw
+sAvgnEzDHNb842m1R0aBL6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gx
+Q+6IHdfGjjxDah2nGN59PRbxYvnKkKj9
+-----END CERTIFICATE-----
+
+USERTrust ECC Certification Authority
+=====================================
+-----BEGIN CERTIFICATE-----
+MIICjzCCAhWgAwIBAgIQXIuZxVqUxdJxVt7NiYDMJjAKBggqhkjOPQQDAzCBiDELMAkGA1UEBhMC
+VVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
+aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkwHhcNMTAwMjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMC
+VVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
+aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQarFRaqfloI+d61SRvU8Za2EurxtW2
+0eZzca7dnNYMYf3boIkDuAUU7FfO7l0/4iGzzvfUinngo4N+LZfQYcTxmdwlkWOrfzCjtHDix6Ez
+nPO/LlxTsV+zfTJ/ijTjeXmjQjBAMB0GA1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAOBgNV
+HQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjA2Z6EWCNzklwBB
+HU6+4WMBzzuqQhFkoJ2UOQIReVx7Hfpkue4WQrO/isIJxOzksU0CMQDpKmFHjFJKS04YcPbWRNZu
+9YO6bVi9JNlWSOrvxKJGgYhqOkbRqZtNyWHa0V1Xahg=
+-----END CERTIFICATE-----
+
+GlobalSign ECC Root CA - R5
+===========================
+-----BEGIN CERTIFICATE-----
+MIICHjCCAaSgAwIBAgIRYFlJ4CYuu1X5CneKcflK2GwwCgYIKoZIzj0EAwMwUDEkMCIGA1UECxMb
+R2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQD
+EwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoXDTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMb
+R2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQD
+EwpHbG9iYWxTaWduMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6
+SFkc8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8kehOvRnkmS
+h5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUPeYpSJvqB8ohREom3m7e0oPQn1kwCgYIKoZIzj0EAwMDaAAwZQIxAOVpEslu28Yx
+uglB4Zf4+/2a4n0Sye18ZNPLBSWLVtmg515dTguDnFt2KaAJJiFqYgIwcdK1j1zqO+F4CYWodZI7
+yFz9SO8NdCKoCOJuxUnOxwy8p2Fp8fc74SrL+SvzZpA3
+-----END CERTIFICATE-----
+
+IdenTrust Commercial Root CA 1
+==============================
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIQCgFCgAAAAUUjyES1AAAAAjANBgkqhkiG9w0BAQsFADBKMQswCQYDVQQG
+EwJVUzESMBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBS
+b290IENBIDEwHhcNMTQwMTE2MTgxMjIzWhcNMzQwMTE2MTgxMjIzWjBKMQswCQYDVQQGEwJVUzES
+MBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBSb290IENB
+IDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnUBneP5k91DNG8W9RYYKyqU+PZ4ld
+hNlT3Qwo2dfw/66VQ3KZ+bVdfIrBQuExUHTRgQ18zZshq0PirK1ehm7zCYofWjK9ouuU+ehcCuz/
+mNKvcbO0U59Oh++SvL3sTzIwiEsXXlfEU8L2ApeN2WIrvyQfYo3fw7gpS0l4PJNgiCL8mdo2yMKi
+1CxUAGc1bnO/AljwpN3lsKImesrgNqUZFvX9t++uP0D1bVoE/c40yiTcdCMbXTMTEl3EASX2MN0C
+XZ/g1Ue9tOsbobtJSdifWwLziuQkkORiT0/Br4sOdBeo0XKIanoBScy0RnnGF7HamB4HWfp1IYVl
+3ZBWzvurpWCdxJ35UrCLvYf5jysjCiN2O/cz4ckA82n5S6LgTrx+kzmEB/dEcH7+B1rlsazRGMzy
+NeVJSQjKVsk9+w8YfYs7wRPCTY/JTw436R+hDmrfYi7LNQZReSzIJTj0+kuniVyc0uMNOYZKdHzV
+WYfCP04MXFL0PfdSgvHqo6z9STQaKPNBiDoT7uje/5kdX7rL6B7yuVBgwDHTc+XvvqDtMwt0viAg
+xGds8AgDelWAf0ZOlqf0Hj7h9tgJ4TNkK2PXMl6f+cB7D3hvl7yTmvmcEpB4eoCHFddydJxVdHix
+uuFucAS6T6C6aMN7/zHwcz09lCqxC0EOoP5NiGVreTO01wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMC
+AQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7UQZwNPwBovupHu+QucmVMiONnYwDQYJKoZI
+hvcNAQELBQADggIBAA2ukDL2pkt8RHYZYR4nKM1eVO8lvOMIkPkp165oCOGUAFjvLi5+U1KMtlwH
+6oi6mYtQlNeCgN9hCQCTrQ0U5s7B8jeUeLBfnLOic7iPBZM4zY0+sLj7wM+x8uwtLRvM7Kqas6pg
+ghstO8OEPVeKlh6cdbjTMM1gCIOQ045U8U1mwF10A0Cj7oV+wh93nAbowacYXVKV7cndJZ5t+qnt
+ozo00Fl72u1Q8zW/7esUTTHHYPTa8Yec4kjixsU3+wYQ+nVZZjFHKdp2mhzpgq7vmrlR94gjmmmV
+YjzlVYA211QC//G5Xc7UI2/YRYRKW2XviQzdFKcgyxilJbQN+QHwotL0AMh0jqEqSI5l2xPE4iUX
+feu+h1sXIFRRk0pTAwvsXcoz7WL9RccvW9xYoIA55vrX/hMUpu09lEpCdNTDd1lzzY9GvlU47/ro
+kTLql1gEIt44w8y8bckzOmoKaT+gyOpyj4xjhiO9bTyWnpXgSUyqorkqG5w2gXjtw+hG4iZZRHUe
+2XWJUc0QhJ1hYMtd+ZciTY6Y5uN/9lu7rs3KSoFrXgvzUeF0K+l+J6fZmUlO+KWA2yUPHGNiiskz
+Z2s8EIPGrd6ozRaOjfAHN3Gf8qv8QfXBi+wAN10J5U6A7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7R
+cGzM7vRX+Bi6hG6H
+-----END CERTIFICATE-----
+
+IdenTrust Public Sector Root CA 1
+=================================
+-----BEGIN CERTIFICATE-----
+MIIFZjCCA06gAwIBAgIQCgFCgAAAAUUjz0Z8AAAAAjANBgkqhkiG9w0BAQsFADBNMQswCQYDVQQG
+EwJVUzESMBAGA1UEChMJSWRlblRydXN0MSowKAYDVQQDEyFJZGVuVHJ1c3QgUHVibGljIFNlY3Rv
+ciBSb290IENBIDEwHhcNMTQwMTE2MTc1MzMyWhcNMzQwMTE2MTc1MzMyWjBNMQswCQYDVQQGEwJV
+UzESMBAGA1UEChMJSWRlblRydXN0MSowKAYDVQQDEyFJZGVuVHJ1c3QgUHVibGljIFNlY3RvciBS
+b290IENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2IpT8pEiv6EdrCvsnduTy
+P4o7ekosMSqMjbCpwzFrqHd2hCa2rIFCDQjrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGyRBb06tD6
+Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlSbdsHyo+1W/CD80/HLaXI
+rcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF/YTLNiCBWS2ab21ISGHKTN9T0a9SvESf
+qy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R3j6HEDbhuaR672BQssvKplbgN6+rNBM5Jeg5ZuSYeqoS
+mJxZZoY+rfGwyj4GD3vwEUs3oERte8uojHH01bWRNszwFcYr3lEXsZdMUD2xlVl8BX0tIdUAvwFn
+ol57plzy9yLxkA2T26pEUWbMfXYD62qoKjgZl3YNa4ph+bz27nb9cCvdKTz4Ch5bQhyLVi9VGxyh
+LrXHFub4qjySjmm2AcG1hp2JDws4lFTo6tyePSW8Uybt1as5qsVATFSrsrTZ2fjXctscvG29ZV/v
+iDUqZi/u9rNl8DONfJhBaUYPQxxp+pu10GFqzcpL2UyQRqsVWaFHVCkugyhfHMKiq3IXAAaOReyL
+4jM9f9oZRORicsPfIsbyVtTdX5Vy7W1f90gDW/3FKqD2cyOEEBsB5wIDAQABo0IwQDAOBgNVHQ8B
+Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU43HgntinQtnbcZFrlJPrw6PRFKMw
+DQYJKoZIhvcNAQELBQADggIBAEf63QqwEZE4rU1d9+UOl1QZgkiHVIyqZJnYWv6IAcVYpZmxI1Qj
+t2odIFflAWJBF9MJ23XLblSQdf4an4EKwt3X9wnQW3IV5B4Jaj0z8yGa5hV+rVHVDRDtfULAj+7A
+mgjVQdZcDiFpboBhDhXAuM/FSRJSzL46zNQuOAXeNf0fb7iAaJg9TaDKQGXSc3z1i9kKlT/YPyNt
+GtEqJBnZhbMX73huqVjRI9PHE+1yJX9dsXNw0H8GlwmEKYBhHfpe/3OsoOOJuBxxFcbeMX8S3OFt
+m6/n6J91eEyrRjuazr8FGF1NFTwWmhlQBJqymm9li1JfPFgEKCXAZmExfrngdbkaqIHWchezxQMx
+NRF4eKLg6TCMf4DfWN88uieW4oA0beOY02QnrEh+KHdcxiVhJfiFDGX6xDIvpZgF5PgLZxYWxoK4
+Mhn5+bl53B/N66+rDt0b20XkeucC4pVd/GnwU2lhlXV5C15V5jgclKlZM57IcXR5f1GJtshquDDI
+ajjDbp7hNxbqBWJMWxJH7ae0s1hWx0nzfxJoCTFx8G34Tkf71oXuxVhAGaQdp/lLQzfcaFpPz+vC
+ZHTetBXZ9FRUGi8c15dxVJCO2SCdUyt/q4/i6jC8UDfv8Ue1fXwsBOxonbRJRBD0ckscZOf85muQ
+3Wl9af0AVqW3rLatt8o+Ae+c
+-----END CERTIFICATE-----
+
+Entrust Root Certification Authority - G2
+=========================================
+-----BEGIN CERTIFICATE-----
+MIIEPjCCAyagAwIBAgIESlOMKDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCVVMxFjAUBgNV
+BAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVy
+bXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ug
+b25seTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIw
+HhcNMDkwNzA3MTcyNTU0WhcNMzAxMjA3MTc1NTU0WjCBvjELMAkGA1UEBhMCVVMxFjAUBgNVBAoT
+DUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMx
+OTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25s
+eTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6hLZy254Ma+KZ6TABp3bqMriVQRrJ2mFOWHLP
+/vaCeb9zYQYKpSfYs1/TRU4cctZOMvJyig/3gxnQaoCAAEUesMfnmr8SVycco2gvCoe9amsOXmXz
+HHfV1IWNcCG0szLni6LVhjkCsbjSR87kyUnEO6fe+1R9V77w6G7CebI6C1XiUJgWMhNcL3hWwcKU
+s/Ja5CeanyTXxuzQmyWC48zCxEXFjJd6BmsqEZ+pCm5IO2/b1BEZQvePB7/1U1+cPvQXLOZprE4y
+TGJ36rfo5bs0vBmLrpxR57d+tVOxMyLlbc9wPBr64ptntoP0jaWvYkxN4FisZDQSA/i2jZRjJKRx
+AgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqciZ6
+0B7vfec7aVHUbI2fkBJmqzANBgkqhkiG9w0BAQsFAAOCAQEAeZ8dlsa2eT8ijYfThwMEYGprmi5Z
+iXMRrEPR9RP/jTkrwPK9T3CMqS/qF8QLVJ7UG5aYMzyorWKiAHarWWluBh1+xLlEjZivEtRh2woZ
+Rkfz6/djwUAFQKXSt/S1mja/qYh2iARVBCuch38aNzx+LaUa2NSJXsq9rD1s2G2v1fN2D807iDgi
+nWyTmsQ9v4IbZT+mD12q/OWyFcq1rca8PdCE6OoGcrBNOTJ4vz4RnAuknZoh8/CbCzB428Hch0P+
+vGOaysXCHMnHjf87ElgI5rY97HosTvuDls4MPGmHVHOkc8KT/1EQrBVUAdj8BbGJoX90g5pJ19xO
+e4pIb4tF9g==
+-----END CERTIFICATE-----
+
+Entrust Root Certification Authority - EC1
+==========================================
+-----BEGIN CERTIFICATE-----
+MIIC+TCCAoCgAwIBAgINAKaLeSkAAAAAUNCR+TAKBggqhkjOPQQDAzCBvzELMAkGA1UEBhMCVVMx
+FjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVn
+YWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDEyIEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXpl
+ZCB1c2Ugb25seTEzMDEGA1UEAxMqRW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5
+IC0gRUMxMB4XDTEyMTIxODE1MjUzNloXDTM3MTIxODE1NTUzNlowgb8xCzAJBgNVBAYTAlVTMRYw
+FAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3QubmV0L2xlZ2Fs
+LXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxMiBFbnRydXN0LCBJbmMuIC0gZm9yIGF1dGhvcml6ZWQg
+dXNlIG9ubHkxMzAxBgNVBAMTKkVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt
+IEVDMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABIQTydC6bUF74mzQ61VfZgIaJPRbiWlH47jCffHy
+AsWfoPZb1YsGGYZPUxBtByQnoaD41UcZYUx9ypMn6nQM72+WCf5j7HBdNq1nd67JnXxVRDqiY1Ef
+9eNi1KlHBz7MIKNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE
+FLdj5xrdjekIplWDpOBqUEFlEUJJMAoGCCqGSM49BAMDA2cAMGQCMGF52OVCR98crlOZF7ZvHH3h
+vxGU0QOIdeSNiaSKd0bebWHvAvX7td/M/k7//qnmpwIwW5nXhTcGtXsI/esni0qU+eH6p44mCOh8
+kmhtc9hvJqwhAriZtyZBWyVgrtBIGu4G
+-----END CERTIFICATE-----
+
+CFCA EV ROOT
+============
+-----BEGIN CERTIFICATE-----
+MIIFjTCCA3WgAwIBAgIEGErM1jANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJDTjEwMC4GA1UE
+CgwnQ2hpbmEgRmluYW5jaWFsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRUwEwYDVQQDDAxDRkNB
+IEVWIFJPT1QwHhcNMTIwODA4MDMwNzAxWhcNMjkxMjMxMDMwNzAxWjBWMQswCQYDVQQGEwJDTjEw
+MC4GA1UECgwnQ2hpbmEgRmluYW5jaWFsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRUwEwYDVQQD
+DAxDRkNBIEVWIFJPT1QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXXWvNED8fBVnV
+BU03sQ7smCuOFR36k0sXgiFxEFLXUWRwFsJVaU2OFW2fvwwbwuCjZ9YMrM8irq93VCpLTIpTUnrD
+7i7es3ElweldPe6hL6P3KjzJIx1qqx2hp/Hz7KDVRM8Vz3IvHWOX6Jn5/ZOkVIBMUtRSqy5J35DN
+uF++P96hyk0g1CXohClTt7GIH//62pCfCqktQT+x8Rgp7hZZLDRJGqgG16iI0gNyejLi6mhNbiyW
+ZXvKWfry4t3uMCz7zEasxGPrb382KzRzEpR/38wmnvFyXVBlWY9ps4deMm/DGIq1lY+wejfeWkU7
+xzbh72fROdOXW3NiGUgthxwG+3SYIElz8AXSG7Ggo7cbcNOIabla1jj0Ytwli3i/+Oh+uFzJlU9f
+py25IGvPa931DfSCt/SyZi4QKPaXWnuWFo8BGS1sbn85WAZkgwGDg8NNkt0yxoekN+kWzqotaK8K
+gWU6cMGbrU1tVMoqLUuFG7OA5nBFDWteNfB/O7ic5ARwiRIlk9oKmSJgamNgTnYGmE69g60dWIol
+hdLHZR4tjsbftsbhf4oEIRUpdPA+nJCdDC7xij5aqgwJHsfVPKPtl8MeNPo4+QgO48BdK4PRVmrJ
+tqhUUy54Mmc9gn900PvhtgVguXDbjgv5E1hvcWAQUhC5wUEJ73IfZzF4/5YFjQIDAQABo2MwYTAf
+BgNVHSMEGDAWgBTj/i39KNALtbq2osS/BqoFjJP7LzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBBjAdBgNVHQ4EFgQU4/4t/SjQC7W6tqLEvwaqBYyT+y8wDQYJKoZIhvcNAQELBQADggIB
+ACXGumvrh8vegjmWPfBEp2uEcwPenStPuiB/vHiyz5ewG5zz13ku9Ui20vsXiObTej/tUxPQ4i9q
+ecsAIyjmHjdXNYmEwnZPNDatZ8POQQaIxffu2Bq41gt/UP+TqhdLjOztUmCypAbqTuv0axn96/Ua
+4CUqmtzHQTb3yHQFhDmVOdYLO6Qn+gjYXB74BGBSESgoA//vU2YApUo0FmZ8/Qmkrp5nGm9BC2sG
+E5uPhnEFtC+NiWYzKXZUmhH4J/qyP5Hgzg0b8zAarb8iXRvTvyUFTeGSGn+ZnzxEk8rUQElsgIfX
+BDrDMlI1Dlb4pd19xIsNER9Tyx6yF7Zod1rg1MvIB671Oi6ON7fQAUtDKXeMOZePglr4UeWJoBjn
+aH9dCi77o0cOPaYjesYBx4/IXr9tgFa+iiS6M+qf4TIRnvHST4D2G0CvOJ4RUHlzEhLN5mydLIhy
+PDCBBpEi6lmt2hkuIsKNuYyH4Ga8cyNfIWRjgEj1oDwYPZTISEEdQLpe/v5WOaHIz16eGWRGENoX
+kbcFgKyLmZJ956LYBws2J+dIeWCKw9cTXPhyQN9Ky8+ZAAoACxGV2lZFA4gKn2fQ1XmxqI1AbQ3C
+ekD6819kR5LLU7m7Wc5P/dAVUwHY3+vZ5nbv0CO7O6l5s9UCKc2Jo5YPSjXnTkLAdc0Hz+Ys63su
+-----END CERTIFICATE-----
+
+OISTE WISeKey Global Root GB CA
+===============================
+-----BEGIN CERTIFICATE-----
+MIIDtTCCAp2gAwIBAgIQdrEgUnTwhYdGs/gjGvbCwDANBgkqhkiG9w0BAQsFADBtMQswCQYDVQQG
+EwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUgRm91bmRhdGlvbiBFbmRvcnNl
+ZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwgUm9vdCBHQiBDQTAeFw0xNDEyMDExNTAw
+MzJaFw0zOTEyMDExNTEwMzFaMG0xCzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYD
+VQQLExlPSVNURSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEds
+b2JhbCBSb290IEdCIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2Be3HEokKtaX
+scriHvt9OO+Y9bI5mE4nuBFde9IllIiCFSZqGzG7qFshISvYD06fWvGxWuR51jIjK+FTzJlFXHtP
+rby/h0oLS5daqPZI7H17Dc0hBt+eFf1Biki3IPShehtX1F1Q/7pn2COZH8g/497/b1t3sWtuuMlk
+9+HKQUYOKXHQuSP8yYFfTvdv37+ErXNku7dCjmn21HYdfp2nuFeKUWdy19SouJVUQHMD9ur06/4o
+Qnc/nSMbsrY9gBQHTC5P99UKFg29ZkM3fiNDecNAhvVMKdqOmq0NpQSHiB6F4+lT1ZvIiwNjeOvg
+GUpuuy9rM2RYk61pv48b74JIxwIDAQABo1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQUNQ/INmNe4qPs+TtmFc5RUuORmj0wEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZI
+hvcNAQELBQADggEBAEBM+4eymYGQfp3FsLAmzYh7KzKNbrghcViXfa43FK8+5/ea4n32cZiZBKpD
+dHij40lhPnOMTZTg+XHEthYOU3gf1qKHLwI5gSk8rxWYITD+KJAAjNHhy/peyP34EEY7onhCkRd0
+VQreUGdNZtGn//3ZwLWoo4rOZvUPQ82nK1d7Y0Zqqi5S2PTt4W2tKZB4SLrhI6qjiey1q5bAtEui
+HZeeevJuQHHfaPFlTc58Bd9TZaml8LGXBHAVRgOY1NK/VLSgWH1Sb9pWJmLU2NuJMW8c8CLC02Ic
+Nc1MaRVUGpCY3useX8p3x8uOPUNpnJpY0CQ73xtAln41rYHHTnG6iBM=
+-----END CERTIFICATE-----
+
+SZAFIR ROOT CA2
+===============
+-----BEGIN CERTIFICATE-----
+MIIDcjCCAlqgAwIBAgIUPopdB+xV0jLVt+O2XwHrLdzk1uQwDQYJKoZIhvcNAQELBQAwUTELMAkG
+A1UEBhMCUEwxKDAmBgNVBAoMH0tyYWpvd2EgSXpiYSBSb3psaWN6ZW5pb3dhIFMuQS4xGDAWBgNV
+BAMMD1NaQUZJUiBST09UIENBMjAeFw0xNTEwMTkwNzQzMzBaFw0zNTEwMTkwNzQzMzBaMFExCzAJ
+BgNVBAYTAlBMMSgwJgYDVQQKDB9LcmFqb3dhIEl6YmEgUm96bGljemVuaW93YSBTLkEuMRgwFgYD
+VQQDDA9TWkFGSVIgUk9PVCBDQTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3vD5Q
+qEvNQLXOYeeWyrSh2gwisPq1e3YAd4wLz32ohswmUeQgPYUM1ljj5/QqGJ3a0a4m7utT3PSQ1hNK
+DJA8w/Ta0o4NkjrcsbH/ON7Dui1fgLkCvUqdGw+0w8LBZwPd3BucPbOw3gAeqDRHu5rr/gsUvTaE
+2g0gv/pby6kWIK05YO4vdbbnl5z5Pv1+TW9NL++IDWr63fE9biCloBK0TXC5ztdyO4mTp4CEHCdJ
+ckm1/zuVnsHMyAHs6A6KCpbns6aH5db5BSsNl0BwPLqsdVqc1U2dAgrSS5tmS0YHF2Wtn2yIANwi
+ieDhZNRnvDF5YTy7ykHNXGoAyDw4jlivAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P
+AQH/BAQDAgEGMB0GA1UdDgQWBBQuFqlKGLXLzPVvUPMjX/hd56zwyDANBgkqhkiG9w0BAQsFAAOC
+AQEAtXP4A9xZWx126aMqe5Aosk3AM0+qmrHUuOQn/6mWmc5G4G18TKI4pAZw8PRBEew/R40/cof5
+O/2kbytTAOD/OblqBw7rHRz2onKQy4I9EYKL0rufKq8h5mOGnXkZ7/e7DDWQw4rtTw/1zBLZpD67
+oPwglV9PJi8RI4NOdQcPv5vRtB3pEAT+ymCPoky4rc/hkA/NrgrHXXu3UNLUYfrVFdvXn4dRVOul
+4+vJhaAlIDf7js4MNIThPIGyd05DpYhfhmehPea0XGG2Ptv+tyjFogeutcrKjSoS75ftwjCkySp6
++/NNIxuZMzSgLvWpCz/UXeHPhJ/iGcJfitYgHuNztw==
+-----END CERTIFICATE-----
+
+Certum Trusted Network CA 2
+===========================
+-----BEGIN CERTIFICATE-----
+MIIF0jCCA7qgAwIBAgIQIdbQSk8lD8kyN/yqXhKN6TANBgkqhkiG9w0BAQ0FADCBgDELMAkGA1UE
+BhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAlBgNVBAsTHkNlcnR1
+bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMbQ2VydHVtIFRydXN0ZWQgTmV0d29y
+ayBDQSAyMCIYDzIwMTExMDA2MDgzOTU2WhgPMjA0NjEwMDYwODM5NTZaMIGAMQswCQYDVQQGEwJQ
+TDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl
+cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENB
+IDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9+Xj45tWADGSdhhuWZGc/IjoedQF9
+7/tcZ4zJzFxrqZHmuULlIEub2pt7uZld2ZuAS9eEQCsn0+i6MLs+CRqnSZXvK0AkwpfHp+6bJe+o
+CgCXhVqqndwpyeI1B+twTUrWwbNWuKFBOJvR+zF/j+Bf4bE/D44WSWDXBo0Y+aomEKsq09DRZ40b
+Rr5HMNUuctHFY9rnY3lEfktjJImGLjQ/KUxSiyqnwOKRKIm5wFv5HdnnJ63/mgKXwcZQkpsCLL2p
+uTRZCr+ESv/f/rOf69me4Jgj7KZrdxYq28ytOxykh9xGc14ZYmhFV+SQgkK7QtbwYeDBoz1mo130
+GO6IyY0XRSmZMnUCMe4pJshrAua1YkV/NxVaI2iJ1D7eTiew8EAMvE0Xy02isx7QBlrd9pPPV3WZ
+9fqGGmd4s7+W/jTcvedSVuWz5XV710GRBdxdaeOVDUO5/IOWOZV7bIBaTxNyxtd9KXpEulKkKtVB
+Rgkg/iKgtlswjbyJDNXXcPiHUv3a76xRLgezTv7QCdpw75j6VuZt27VXS9zlLCUVyJ4ueE742pye
+hizKV/Ma5ciSixqClnrDvFASadgOWkaLOusm+iPJtrCBvkIApPjW/jAux9JG9uWOdf3yzLnQh1vM
+BhBgu4M1t15n3kfsmUjxpKEV/q2MYo45VU85FrmxY53/twIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBS2oVQ5AsOgP46KvPrU+Bym0ToO/TAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZI
+hvcNAQENBQADggIBAHGlDs7k6b8/ONWJWsQCYftMxRQXLYtPU2sQF/xlhMcQSZDe28cmk4gmb3DW
+Al45oPePq5a1pRNcgRRtDoGCERuKTsZPpd1iHkTfCVn0W3cLN+mLIMb4Ck4uWBzrM9DPhmDJ2vuA
+L55MYIR4PSFk1vtBHxgP58l1cb29XN40hz5BsA72udY/CROWFC/emh1auVbONTqwX3BNXuMp8SMo
+clm2q8KMZiYcdywmdjWLKKdpoPk79SPdhRB0yZADVpHnr7pH1BKXESLjokmUbOe3lEu6LaTaM4tM
+pkT/WjzGHWTYtTHkpjx6qFcL2+1hGsvxznN3Y6SHb0xRONbkX8eftoEq5IVIeVheO/jbAoJnwTnb
+w3RLPTYe+SmTiGhbqEQZIfCn6IENLOiTNrQ3ssqwGyZ6miUfmpqAnksqP/ujmv5zMnHCnsZy4Ypo
+J/HkD7TETKVhk/iXEAcqMCWpuchxuO9ozC1+9eB+D4Kob7a6bINDd82Kkhehnlt4Fj1F4jNy3eFm
+ypnTycUm/Q1oBEauttmbjL4ZvrHG8hnjXALKLNhvSgfZyTXaQHXyxKcZb55CEJh15pWLYLztxRLX
+is7VmFxWlgPF7ncGNf/P5O4/E2Hu29othfDNrp2yGAlFw5Khchf8R7agCyzxxN5DaAhqXzvwdmP7
+zAYspsbiDrW5viSP
+-----END CERTIFICATE-----
+
+Hellenic Academic and Research Institutions RootCA 2015
+=======================================================
+-----BEGIN CERTIFICATE-----
+MIIGCzCCA/OgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBpjELMAkGA1UEBhMCR1IxDzANBgNVBAcT
+BkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0
+aW9ucyBDZXJ0LiBBdXRob3JpdHkxQDA+BgNVBAMTN0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgUm9vdENBIDIwMTUwHhcNMTUwNzA3MTAxMTIxWhcNNDAwNjMwMTAx
+MTIxWjCBpjELMAkGA1UEBhMCR1IxDzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMg
+QWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxQDA+BgNV
+BAMTN0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgUm9vdENBIDIw
+MTUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDC+Kk/G4n8PDwEXT2QNrCROnk8Zlrv
+bTkBSRq0t89/TSNTt5AA4xMqKKYx8ZEA4yjsriFBzh/a/X0SWwGDD7mwX5nh8hKDgE0GPt+sr+eh
+iGsxr/CL0BgzuNtFajT0AoAkKAoCFZVedioNmToUW/bLy1O8E00BiDeUJRtCvCLYjqOWXjrZMts+
+6PAQZe104S+nfK8nNLspfZu2zwnI5dMK/IhlZXQK3HMcXM1AsRzUtoSMTFDPaI6oWa7CJ06CojXd
+FPQf/7J31Ycvqm59JCfnxssm5uX+Zwdj2EUN3TpZZTlYepKZcj2chF6IIbjV9Cz82XBST3i4vTwr
+i5WY9bPRaM8gFH5MXF/ni+X1NYEZN9cRCLdmvtNKzoNXADrDgfgXy5I2XdGj2HUb4Ysn6npIQf1F
+GQatJ5lOwXBH3bWfgVMS5bGMSF0xQxfjjMZ6Y5ZLKTBOhE5iGV48zpeQpX8B653g+IuJ3SWYPZK2
+fu/Z8VFRfS0myGlZYeCsargqNhEEelC9MoS+L9xy1dcdFkfkR2YgP/SWxa+OAXqlD3pk9Q0Yh9mu
+iNX6hME6wGkoLfINaFGq46V3xqSQDqE3izEjR8EJCOtu93ib14L8hCCZSRm2Ekax+0VVFqmjZayc
+Bw/qa9wfLgZy7IaIEuQt218FL+TwA9MmM+eAws1CoRc0CwIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUcRVnyMjJvXVdctA4GGqd83EkVAswDQYJKoZI
+hvcNAQELBQADggIBAHW7bVRLqhBYRjTyYtcWNl0IXtVsyIe9tC5G8jH4fOpCtZMWVdyhDBKg2mF+
+D1hYc2Ryx+hFjtyp8iY/xnmMsVMIM4GwVhO+5lFc2JsKT0ucVlMC6U/2DWDqTUJV6HwbISHTGzrM
+d/K4kPFox/la/vot9L/J9UUbzjgQKjeKeaO04wlshYaT/4mWJ3iBj2fjRnRUjtkNaeJK9E10A/+y
+d+2VZ5fkscWrv2oj6NSU4kQoYsRL4vDY4ilrGnB+JGGTe08DMiUNRSQrlrRGar9KC/eaj8GsGsVn
+82800vpzY4zvFrCopEYq+OsS7HK07/grfoxSwIuEVPkvPuNVqNxmsdnhX9izjFk0WaSrT2y7Hxjb
+davYy5LNlDhhDgcGH0tGEPEVvo2FXDtKK4F5D7Rpn0lQl033DlZdwJVqwjbDG2jJ9SrcR5q+ss7F
+Jej6A7na+RZukYT1HCjI/CbM1xyQVqdfbzoEvM14iQuODy+jqk+iGxI9FghAD/FGTNeqewjBCvVt
+J94Cj8rDtSvK6evIIVM4pcw72Hc3MKJP2W/R8kCtQXoXxdZKNYm3QdV8hn9VTYNKpXMgwDqvkPGa
+JI7ZjnHKe7iG2rKPmT4dEw0SEe7Uq/DpFXYC5ODfqiAeW2GFZECpkJcNrVPSWh2HagCXZWK0vm9q
+p/UsQu0yrbYhnr68
+-----END CERTIFICATE-----
+
+Hellenic Academic and Research Institutions ECC RootCA 2015
+===========================================================
+-----BEGIN CERTIFICATE-----
+MIICwzCCAkqgAwIBAgIBADAKBggqhkjOPQQDAjCBqjELMAkGA1UEBhMCR1IxDzANBgNVBAcTBkF0
+aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9u
+cyBDZXJ0LiBBdXRob3JpdHkxRDBCBgNVBAMTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgRUNDIFJvb3RDQSAyMDE1MB4XDTE1MDcwNzEwMzcxMloXDTQwMDYzMDEw
+MzcxMlowgaoxCzAJBgNVBAYTAkdSMQ8wDQYDVQQHEwZBdGhlbnMxRDBCBgNVBAoTO0hlbGxlbmlj
+IEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUQwQgYD
+VQQDEztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIEVDQyBSb290
+Q0EgMjAxNTB2MBAGByqGSM49AgEGBSuBBAAiA2IABJKgQehLgoRc4vgxEZmGZE4JJS+dQS8KrjVP
+dJWyUWRrjWvmP3CV8AVER6ZyOFB2lQJajq4onvktTpnvLEhvTCUp6NFxW98dwXU3tNf6e3pCnGoK
+Vlp8aQuqgAkkbH7BRqNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0O
+BBYEFLQiC4KZJAEOnLvkDv2/+5cgk5kqMAoGCCqGSM49BAMCA2cAMGQCMGfOFmI4oqxiRaeplSTA
+GiecMjvAwNW6qef4BENThe5SId6d9SWDPp5YSy/XZxMOIQIwBeF1Ad5o7SofTUwJCA3sS61kFyjn
+dc5FZXIhF8siQQ6ME5g4mlRtm8rifOoCWCKR
+-----END CERTIFICATE-----
+
+ISRG Root X1
+============
+-----BEGIN CERTIFICATE-----
+MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UE
+BhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQD
+EwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQG
+EwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMT
+DElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54r
+Vygch77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+0TM8ukj1
+3Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6UA5/TR5d8mUgjU+g4rk8K
+b4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sWT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCN
+Aymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyHB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ
+4Q7e2RCOFvu396j3x+UCB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf
+1b0SHzUvKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWnOlFu
+hjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTnjh8BCNAw1FtxNrQH
+usEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbwqHyGO0aoSCqI3Haadr8faqU9GY/r
+OPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CIrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4G
+A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY
+9umbbjANBgkqhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
+ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ3BebYhtF8GaV
+0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KKNFtY2PwByVS5uCbMiogziUwt
+hDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJw
+TdwJx4nLCgdNbOhdjsnvzqvHu7UrTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nx
+e5AW0wdeRlN8NwdCjNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZA
+JzVcoyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq4RgqsahD
+YVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPAmRGunUHBcnWEvgJBQl9n
+JEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57demyPxgcYxn/eR44/KJ4EBs+lVDR3veyJ
+m+kXQ99b21/+jh5Xos1AnX5iItreGCc=
+-----END CERTIFICATE-----
+
+AC RAIZ FNMT-RCM
+================
+-----BEGIN CERTIFICATE-----
+MIIFgzCCA2ugAwIBAgIPXZONMGc2yAYdGsdUhGkHMA0GCSqGSIb3DQEBCwUAMDsxCzAJBgNVBAYT
+AkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTTAeFw0wODEw
+MjkxNTU5NTZaFw0zMDAxMDEwMDAwMDBaMDsxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJD
+TTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBALpxgHpMhm5/yBNtwMZ9HACXjywMI7sQmkCpGreHiPibVmr75nuOi5KOpyVdWRHbNi63URcf
+qQgfBBckWKo3Shjf5TnUV/3XwSyRAZHiItQDwFj8d0fsjz50Q7qsNI1NOHZnjrDIbzAzWHFctPVr
+btQBULgTfmxKo0nRIBnuvMApGGWn3v7v3QqQIecaZ5JCEJhfTzC8PhxFtBDXaEAUwED653cXeuYL
+j2VbPNmaUtu1vZ5Gzz3rkQUCwJaydkxNEJY7kvqcfw+Z374jNUUeAlz+taibmSXaXvMiwzn15Cou
+08YfxGyqxRxqAQVKL9LFwag0Jl1mpdICIfkYtwb1TplvqKtMUejPUBjFd8g5CSxJkjKZqLsXF3mw
+WsXmo8RZZUc1g16p6DULmbvkzSDGm0oGObVo/CK67lWMK07q87Hj/LaZmtVC+nFNCM+HHmpxffnT
+tOmlcYF7wk5HlqX2doWjKI/pgG6BU6VtX7hI+cL5NqYuSf+4lsKMB7ObiFj86xsc3i1w4peSMKGJ
+47xVqCfWS+2QrYv6YyVZLag13cqXM7zlzced0ezvXg5KkAYmY6252TUtB7p2ZSysV4999AeU14EC
+ll2jB0nVetBX+RvnU0Z1qrB5QstocQjpYL05ac70r8NWQMetUqIJ5G+GR4of6ygnXYMgrwTJbFaa
+i0b1AgMBAAGjgYMwgYAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
+FPd9xf3E6Jobd2Sn9R2gzL+HYJptMD4GA1UdIAQ3MDUwMwYEVR0gADArMCkGCCsGAQUFBwIBFh1o
+dHRwOi8vd3d3LmNlcnQuZm5tdC5lcy9kcGNzLzANBgkqhkiG9w0BAQsFAAOCAgEAB5BK3/MjTvDD
+nFFlm5wioooMhfNzKWtN/gHiqQxjAb8EZ6WdmF/9ARP67Jpi6Yb+tmLSbkyU+8B1RXxlDPiyN8+s
+D8+Nb/kZ94/sHvJwnvDKuO+3/3Y3dlv2bojzr2IyIpMNOmqOFGYMLVN0V2Ue1bLdI4E7pWYjJ2cJ
+j+F3qkPNZVEI7VFY/uY5+ctHhKQV8Xa7pO6kO8Rf77IzlhEYt8llvhjho6Tc+hj507wTmzl6NLrT
+Qfv6MooqtyuGC2mDOL7Nii4LcK2NJpLuHvUBKwrZ1pebbuCoGRw6IYsMHkCtA+fdZn71uSANA+iW
++YJF1DngoABd15jmfZ5nc8OaKveri6E6FO80vFIOiZiaBECEHX5FaZNXzuvO+FB8TxxuBEOb+dY7
+Ixjp6o7RTUaN8Tvkasq6+yO3m/qZASlaWFot4/nUbQ4mrcFuNLwy+AwF+mWj2zs3gyLp1txyM/1d
+8iC9djwj2ij3+RvrWWTV3F9yfiD8zYm1kGdNYno/Tq0dwzn+evQoFt9B9kiABdcPUXmsEKvU7ANm
+5mqwujGSQkBqvjrTcuFqN1W8rB2Vt2lh8kORdOag0wokRqEIr9baRRmW1FMdW4R58MD3R++Lj8UG
+rp1MYp3/RgT408m2ECVAdf4WqslKYIYvuu8wd+RU4riEmViAqhOLUTpPSPaLtrM=
+-----END CERTIFICATE-----
+
+Amazon Root CA 1
+================
+-----BEGIN CERTIFICATE-----
+MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsFADA5MQswCQYD
+VQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24gUm9vdCBDQSAxMB4XDTE1
+MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTELMAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpv
+bjEZMBcGA1UEAxMQQW1hem9uIFJvb3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBALJ4gHHKeNXjca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgH
+FzZM9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qwIFAGbHrQ
+gLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6VOujw5H5SNz/0egwLX0t
+dHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L93FcXmn/6pUCyziKrlA4b9v7LWIbxcce
+VOF34GfID5yHI9Y/QCB/IIDEgEw+OyQmjgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB
+/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3
+DQEBCwUAA4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDIU5PM
+CCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUsN+gDS63pYaACbvXy
+8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vvo/ufQJVtMVT8QtPHRh8jrdkPSHCa
+2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2
+xJNDd2ZhwLnoQdeXeGADbkpyrqXRfboQnoZsG4q5WTP468SQvvG5
+-----END CERTIFICATE-----
+
+Amazon Root CA 2
+================
+-----BEGIN CERTIFICATE-----
+MIIFQTCCAymgAwIBAgITBmyf0pY1hp8KD+WGePhbJruKNzANBgkqhkiG9w0BAQwFADA5MQswCQYD
+VQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24gUm9vdCBDQSAyMB4XDTE1
+MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpv
+bjEZMBcGA1UEAxMQQW1hem9uIFJvb3QgQ0EgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBAK2Wny2cSkxKgXlRmeyKy2tgURO8TW0G/LAIjd0ZEGrHJgw12MBvIITplLGbhQPDW9tK6Mj4
+kHbZW0/jTOgGNk3Mmqw9DJArktQGGWCsN0R5hYGCrVo34A3MnaZMUnbqQ523BNFQ9lXg1dKmSYXp
+N+nKfq5clU1Imj+uIFptiJXZNLhSGkOQsL9sBbm2eLfq0OQ6PBJTYv9K8nu+NQWpEjTj82R0Yiw9
+AElaKP4yRLuH3WUnAnE72kr3H9rN9yFVkE8P7K6C4Z9r2UXTu/Bfh+08LDmG2j/e7HJV63mjrdvd
+fLC6HM783k81ds8P+HgfajZRRidhW+mez/CiVX18JYpvL7TFz4QuK/0NURBs+18bvBt+xa47mAEx
+kv8LV/SasrlX6avvDXbR8O70zoan4G7ptGmh32n2M8ZpLpcTnqWHsFcQgTfJU7O7f/aS0ZzQGPSS
+btqDT6ZjmUyl+17vIWR6IF9sZIUVyzfpYgwLKhbcAS4y2j5L9Z469hdAlO+ekQiG+r5jqFoz7Mt0
+Q5X5bGlSNscpb/xVA1wf+5+9R+vnSUeVC06JIglJ4PVhHvG/LopyboBZ/1c6+XUyo05f7O0oYtlN
+c/LMgRdg7c3r3NunysV+Ar3yVAhU/bQtCSwXVEqY0VThUWcI0u1ufm8/0i2BWSlmy5A5lREedCf+
+3euvAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSw
+DPBMMPQFWAJI/TPlUq9LhONmUjANBgkqhkiG9w0BAQwFAAOCAgEAqqiAjw54o+Ci1M3m9Zh6O+oA
+A7CXDpO8Wqj2LIxyh6mx/H9z/WNxeKWHWc8w4Q0QshNabYL1auaAn6AFC2jkR2vHat+2/XcycuUY
++gn0oJMsXdKMdYV2ZZAMA3m3MSNjrXiDCYZohMr/+c8mmpJ5581LxedhpxfL86kSk5Nrp+gvU5LE
+YFiwzAJRGFuFjWJZY7attN6a+yb3ACfAXVU3dJnJUH/jWS5E4ywl7uxMMne0nxrpS10gxdr9HIcW
+xkPo1LsmmkVwXqkLN1PiRnsn/eBG8om3zEK2yygmbtmlyTrIQRNg91CMFa6ybRoVGld45pIq2WWQ
+gj9sAq+uEjonljYE1x2igGOpm/HlurR8FLBOybEfdF849lHqm/osohHUqS0nGkWxr7JOcQ3AWEbW
+aQbLU8uz/mtBzUF+fUwPfHJ5elnNXkoOrJupmHN5fLT0zLm4BwyydFy4x2+IoZCn9Kr5v2c69BoV
+Yh63n749sSmvZ6ES8lgQGVMDMBu4Gon2nL2XA46jCfMdiyHxtN/kHNGfZQIG6lzWE7OE76KlXIx3
+KadowGuuQNKotOrN8I1LOJwZmhsoVLiJkO/KdYE+HvJkJMcYr07/R54H9jVlpNMKVv/1F2Rs76gi
+JUmTtt8AF9pYfl3uxRuw0dFfIRDH+fO6AgonB8Xx1sfT4PsJYGw=
+-----END CERTIFICATE-----
+
+Amazon Root CA 3
+================
+-----BEGIN CERTIFICATE-----
+MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5MQswCQYDVQQG
+EwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24gUm9vdCBDQSAzMB4XDTE1MDUy
+NjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZ
+MBcGA1UEAxMQQW1hem9uIFJvb3QgQ0EgMzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCmXp8ZB
+f8ANm+gBG1bG8lKlui2yEujSLtf6ycXYqm0fc4E7O5hrOXwzpcVOho6AF2hiRVd9RFgdszflZwjr
+Zt6jQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSrttvXBp43
+rDCGB5Fwx5zEGbF4wDAKBggqhkjOPQQDAgNJADBGAiEA4IWSoxe3jfkrBqWTrBqYaGFy+uGh0Psc
+eGCmQ5nFuMQCIQCcAu/xlJyzlvnrxir4tiz+OpAUFteMYyRIHN8wfdVoOw==
+-----END CERTIFICATE-----
+
+Amazon Root CA 4
+================
+-----BEGIN CERTIFICATE-----
+MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5MQswCQYDVQQG
+EwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24gUm9vdCBDQSA0MB4XDTE1MDUy
+NjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZ
+MBcGA1UEAxMQQW1hem9uIFJvb3QgQ0EgNDB2MBAGByqGSM49AgEGBSuBBAAiA2IABNKrijdPo1MN
+/sGKe0uoe0ZLY7Bi9i0b2whxIdIA6GO9mif78DluXeo9pcmBqqNbIJhFXRbb/egQbeOc4OO9X4Ri
+83BkM6DLJC9wuoihKqB1+IGuYgbEgds5bimwHvouXKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
+HQ8BAf8EBAMCAYYwHQYDVR0OBBYEFNPsxzplbszh2naaVvuc84ZtV+WBMAoGCCqGSM49BAMDA2gA
+MGUCMDqLIfG9fhGt0O9Yli/W651+kI0rz2ZVwyzjKKlwCkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1
+AE47xDqUEpHJWEadIRNyp4iciuRMStuW1KyLa2tJElMzrdfkviT8tQp21KW8EA==
+-----END CERTIFICATE-----
+
+TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1
+=============================================
+-----BEGIN CERTIFICATE-----
+MIIEYzCCA0ugAwIBAgIBATANBgkqhkiG9w0BAQsFADCB0jELMAkGA1UEBhMCVFIxGDAWBgNVBAcT
+D0dlYnplIC0gS29jYWVsaTFCMEAGA1UEChM5VHVya2l5ZSBCaWxpbXNlbCB2ZSBUZWtub2xvamlr
+IEFyYXN0aXJtYSBLdXJ1bXUgLSBUVUJJVEFLMS0wKwYDVQQLEyRLYW11IFNlcnRpZmlrYXN5b24g
+TWVya2V6aSAtIEthbXUgU00xNjA0BgNVBAMTLVRVQklUQUsgS2FtdSBTTSBTU0wgS29rIFNlcnRp
+ZmlrYXNpIC0gU3VydW0gMTAeFw0xMzExMjUwODI1NTVaFw00MzEwMjUwODI1NTVaMIHSMQswCQYD
+VQQGEwJUUjEYMBYGA1UEBxMPR2ViemUgLSBLb2NhZWxpMUIwQAYDVQQKEzlUdXJraXllIEJpbGlt
+c2VsIHZlIFRla25vbG9qaWsgQXJhc3Rpcm1hIEt1cnVtdSAtIFRVQklUQUsxLTArBgNVBAsTJEth
+bXUgU2VydGlmaWthc3lvbiBNZXJrZXppIC0gS2FtdSBTTTE2MDQGA1UEAxMtVFVCSVRBSyBLYW11
+IFNNIFNTTCBLb2sgU2VydGlmaWthc2kgLSBTdXJ1bSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAr3UwM6q7a9OZLBI3hNmNe5eA027n/5tQlT6QlVZC1xl8JoSNkvoBHToP4mQ4t4y8
+6Ij5iySrLqP1N+RAjhgleYN1Hzv/bKjFxlb4tO2KRKOrbEz8HdDc72i9z+SqzvBV96I01INrN3wc
+wv61A+xXzry0tcXtAA9TNypN9E8Mg/uGz8v+jE69h/mniyFXnHrfA2eJLJ2XYacQuFWQfw4tJzh0
+3+f92k4S400VIgLI4OD8D62K18lUUMw7D8oWgITQUVbDjlZ/iSIzL+aFCr2lqBs23tPcLG07xxO9
+WSMs5uWk99gL7eqQQESolbuT1dCANLZGeA4fAJNG4e7p+exPFwIDAQABo0IwQDAdBgNVHQ4EFgQU
+ZT/HiobGPN08VFw1+DrtUgxHV8gwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJ
+KoZIhvcNAQELBQADggEBACo/4fEyjq7hmFxLXs9rHmoJ0iKpEsdeV31zVmSAhHqT5Am5EM2fKifh
+AHe+SMg1qIGf5LgsyX8OsNJLN13qudULXjS99HMpw+0mFZx+CFOKWI3QSyjfwbPfIPP54+M638yc
+lNhOT8NrF7f3cuitZjO1JVOr4PhMqZ398g26rrnZqsZr+ZO7rqu4lzwDGrpDxpa5RXI4s6ehlj2R
+e37AIVNMh+3yC1SVUZPVIqUNivGTDj5UDrDYyU7c8jEyVupk+eq1nRZmQnLzf9OxMUP8pI4X8W0j
+q5Rm+K37DwhuJi1/FwcJsoz7UMCflo3Ptv0AnVoUmr8CRPXBwp8iXqIPoeM=
+-----END CERTIFICATE-----
+
+GDCA TrustAUTH R5 ROOT
+======================
+-----BEGIN CERTIFICATE-----
+MIIFiDCCA3CgAwIBAgIIfQmX/vBH6nowDQYJKoZIhvcNAQELBQAwYjELMAkGA1UEBhMCQ04xMjAw
+BgNVBAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZIENPLixMVEQuMR8wHQYDVQQD
+DBZHRENBIFRydXN0QVVUSCBSNSBST09UMB4XDTE0MTEyNjA1MTMxNVoXDTQwMTIzMTE1NTk1OVow
+YjELMAkGA1UEBhMCQ04xMjAwBgNVBAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZ
+IENPLixMVEQuMR8wHQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEA2aMW8Mh0dHeb7zMNOwZ+Vfy1YI92hhJCfVZmPoiC7XJjDp6L3TQs
+AlFRwxn9WVSEyfFrs0yw6ehGXTjGoqcuEVe6ghWinI9tsJlKCvLriXBjTnnEt1u9ol2x8kECK62p
+OqPseQrsXzrj/e+APK00mxqriCZ7VqKChh/rNYmDf1+uKU49tm7srsHwJ5uu4/Ts765/94Y9cnrr
+pftZTqfrlYwiOXnhLQiPzLyRuEH3FMEjqcOtmkVEs7LXLM3GKeJQEK5cy4KOFxg2fZfmiJqwTTQJ
+9Cy5WmYqsBebnh52nUpmMUHfP/vFBu8btn4aRjb3ZGM74zkYI+dndRTVdVeSN72+ahsmUPI2JgaQ
+xXABZG12ZuGR224HwGGALrIuL4xwp9E7PLOR5G62xDtw8mySlwnNR30YwPO7ng/Wi64HtloPzgsM
+R6flPri9fcebNaBhlzpBdRfMK5Z3KpIhHtmVdiBnaM8Nvd/WHwlqmuLMc3GkL30SgLdTMEZeS1SZ
+D2fJpcjyIMGC7J0R38IC+xo70e0gmu9lZJIQDSri3nDxGGeCjGHeuLzRL5z7D9Ar7Rt2ueQ5Vfj4
+oR24qoAATILnsn8JuLwwoC8N9VKejveSswoAHQBUlwbgsQfZxw9cZX08bVlX5O2ljelAU58VS6Bx
+9hoh49pwBiFYFIeFd3mqgnkCAwEAAaNCMEAwHQYDVR0OBBYEFOLJQJ9NzuiaoXzPDj9lxSmIahlR
+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQDRSVfg
+p8xoWLoBDysZzY2wYUWsEe1jUGn4H3++Fo/9nesLqjJHdtJnJO29fDMylyrHBYZmDRd9FBUb1Ov9
+H5r2XpdptxolpAqzkT9fNqyL7FeoPueBihhXOYV0GkLH6VsTX4/5COmSdI31R9KrO9b7eGZONn35
+6ZLpBN79SWP8bfsUcZNnL0dKt7n/HipzcEYwv1ryL3ml4Y0M2fmyYzeMN2WFcGpcWwlyua1jPLHd
++PwyvzeG5LuOmCd+uh8W4XAR8gPfJWIyJyYYMoSf/wA6E7qaTfRPuBRwIrHKK5DOKcFw9C+df/KQ
+HtZa37dG/OaG+svgIHZ6uqbL9XzeYqWxi+7egmaKTjowHz+Ay60nugxe19CxVsp3cbK1daFQqUBD
+F8Io2c9Si1vIY9RCPqAzekYu9wogRlR+ak8x8YF+QnQ4ZXMn7sZ8uI7XpTrXmKGcjBBV09tL7ECQ
+8s1uV9JiDnxXk7Gnbc2dg7sq5+W2O3FYrf3RRbxake5TFW/TRQl1brqQXR4EzzffHqhmsYzmIGrv
+/EhOdJhCrylvLmrH+33RZjEizIYAfmaDDEL0vTSSwxrqT8p+ck0LcIymSLumoRT2+1hEmRSuqguT
+aaApJUqlyyvdimYHFngVV3Eb7PVHhPOeMTd61X8kreS8/f3MboPoDKi3QWwH3b08hpcv0g==
+-----END CERTIFICATE-----
+
+SSL.com Root Certification Authority RSA
+========================================
+-----BEGIN CERTIFICATE-----
+MIIF3TCCA8WgAwIBAgIIeyyb0xaAMpkwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxDjAM
+BgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9yYXRpb24x
+MTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBSU0EwHhcNMTYw
+MjEyMTczOTM5WhcNNDEwMjEyMTczOTM5WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx
+EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NM
+LmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAPkP3aMrfcvQKv7sZ4Wm5y4bunfh4/WvpOz6Sl2RxFdHaxh3a3by/ZPkPQ/C
+Fp4LZsNWlJ4Xg4XOVu/yFv0AYvUiCVToZRdOQbngT0aXqhvIuG5iXmmxX9sqAn78bMrzQdjt0Oj8
+P2FI7bADFB0QDksZ4LtO7IZl/zbzXmcCC52GVWH9ejjt/uIZALdvoVBidXQ8oPrIJZK0bnoix/ge
+oeOy3ZExqysdBP+lSgQ36YWkMyv94tZVNHwZpEpox7Ko07fKoZOI68GXvIz5HdkihCR0xwQ9aqkp
+k8zruFvh/l8lqjRYyMEjVJ0bmBHDOJx+PYZspQ9AhnwC9FwCTyjLrnGfDzrIM/4RJTXq/LrFYD3Z
+fBjVsqnTdXgDciLKOsMf7yzlLqn6niy2UUb9rwPW6mBo6oUWNmuF6R7As93EJNyAKoFBbZQ+yODJ
+gUEAnl6/f8UImKIYLEJAs/lvOCdLToD0PYFH4Ih86hzOtXVcUS4cK38acijnALXRdMbX5J+tB5O2
+UzU1/Dfkw/ZdFr4hc96SCvigY2q8lpJqPvi8ZVWb3vUNiSYE/CUapiVpy8JtynziWV+XrOvvLsi8
+1xtZPCvM8hnIk2snYxnP/Okm+Mpxm3+T/jRnhE6Z6/yzeAkzcLpmpnbtG3PrGqUNxCITIJRWCk4s
+bE6x/c+cCbqiM+2HAgMBAAGjYzBhMB0GA1UdDgQWBBTdBAkHovV6fVJTEpKV7jiAJQ2mWTAPBgNV
+HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFN0ECQei9Xp9UlMSkpXuOIAlDaZZMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAIBgRlCn7Jp0cHh5wYfGVcpNxJK1ok1iOMq8bs3AD/CUr
+dIWQPXhq9LmLpZc7tRiRux6n+UBbkflVma8eEdBcHadm47GUBwwyOabqG7B52B2ccETjit3E+ZUf
+ijhDPwGFpUenPUayvOUiaPd7nNgsPgohyC0zrL/FgZkxdMF1ccW+sfAjRfSda/wZY52jvATGGAsl
+u1OJD7OAUN5F7kR/q5R4ZJjT9ijdh9hwZXT7DrkT66cPYakylszeu+1jTBi7qUD3oFRuIIhxdRjq
+erQ0cuAjJ3dctpDqhiVAq+8zD8ufgr6iIPv2tS0a5sKFsXQP+8hlAqRSAUfdSSLBv9jra6x+3uxj
+MxW3IwiPxg+NQVrdjsW5j+VFP3jbutIbQLH+cU0/4IGiul607BXgk90IH37hVZkLId6Tngr75qNJ
+vTYw/ud3sqB1l7UtgYgXZSD32pAAn8lSzDLKNXz1PQ/YK9f1JmzJBjSWFupwWRoyeXkLtoh/D1JI
+Pb9s2KJELtFOt3JY04kTlf5Eq/jXixtunLwsoFvVagCvXzfh1foQC5ichucmj87w7G6KVwuA406y
+wKBjYZC6VWg3dGq2ktufoYYitmUnDuy2n0Jg5GfCtdpBC8TTi2EbvPofkSvXRAdeuims2cXp71NI
+WuuA8ShYIc2wBlX7Jz9TkHCpBB5XJ7k=
+-----END CERTIFICATE-----
+
+SSL.com Root Certification Authority ECC
+========================================
+-----BEGIN CERTIFICATE-----
+MIICjTCCAhSgAwIBAgIIdebfy8FoW6gwCgYIKoZIzj0EAwIwfDELMAkGA1UEBhMCVVMxDjAMBgNV
+BAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9yYXRpb24xMTAv
+BgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEy
+MTgxNDAzWhcNNDEwMjEyMTgxNDAzWjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAO
+BgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNv
+bSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49AgEGBSuBBAAiA2IA
+BEVuqVDEpiM2nl8ojRfLliJkP9x6jh3MCLOicSS6jkm5BBtHllirLZXI7Z4INcgn64mMU1jrYor+
+8FsPazFSY0E7ic3s7LaNGdM0B9y7xgZ/wkWV7Mt/qCPgCemB+vNH06NjMGEwHQYDVR0OBBYEFILR
+hXMw5zUE044CkvvlpNHEIejNMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUgtGFczDnNQTT
+jgKS++Wk0cQh6M0wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2cAMGQCMG/n61kRpGDPYbCW
+e+0F+S8Tkdzt5fxQaxFGRrMcIQBiu77D5+jNB5n5DQtdcj7EqgIwH7y6C+IwJPt8bYBVCpk+gA0z
+5Wajs6O7pdWLjwkspl1+4vAHCGht0nxpbl/f5Wpl
+-----END CERTIFICATE-----
+
+SSL.com EV Root Certification Authority RSA R2
+==============================================
+-----BEGIN CERTIFICATE-----
+MIIF6zCCA9OgAwIBAgIIVrYpzTS8ePYwDQYJKoZIhvcNAQELBQAwgYIxCzAJBgNVBAYTAlVTMQ4w
+DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9u
+MTcwNQYDVQQDDC5TU0wuY29tIEVWIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIy
+MB4XDTE3MDUzMTE4MTQzN1oXDTQyMDUzMDE4MTQzN1owgYIxCzAJBgNVBAYTAlVTMQ4wDAYDVQQI
+DAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTcwNQYD
+VQQDDC5TU0wuY29tIEVWIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyMIICIjAN
+BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjzZlQOHWTcDXtOlG2mvqM0fNTPl9fb69LT3w23jh
+hqXZuglXaO1XPqDQCEGD5yhBJB/jchXQARr7XnAjssufOePPxU7Gkm0mxnu7s9onnQqG6YE3Bf7w
+cXHswxzpY6IXFJ3vG2fThVUCAtZJycxa4bH3bzKfydQ7iEGonL3Lq9ttewkfokxykNorCPzPPFTO
+Zw+oz12WGQvE43LrrdF9HSfvkusQv1vrO6/PgN3B0pYEW3p+pKk8OHakYo6gOV7qd89dAFmPZiw+
+B6KjBSYRaZfqhbcPlgtLyEDhULouisv3D5oi53+aNxPN8k0TayHRwMwi8qFG9kRpnMphNQcAb9Zh
+CBHqurj26bNg5U257J8UZslXWNvNh2n4ioYSA0e/ZhN2rHd9NCSFg83XqpyQGp8hLH94t2S42Oim
+9HizVcuE0jLEeK6jj2HdzghTreyI/BXkmg3mnxp3zkyPuBQVPWKchjgGAGYS5Fl2WlPAApiiECto
+RHuOec4zSnaqW4EWG7WK2NAAe15itAnWhmMOpgWVSbooi4iTsjQc2KRVbrcc0N6ZVTsj9CLg+Slm
+JuwgUHfbSguPvuUCYHBBXtSuUDkiFCbLsjtzdFVHB3mBOagwE0TlBIqulhMlQg+5U8Sb/M3kHN48
++qvWBkofZ6aYMBzdLNvcGJVXZsb/XItW9XcCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNV
+HSMEGDAWgBT5YLvU49U09rj1BoAlp3PbRmmonjAdBgNVHQ4EFgQU+WC71OPVNPa49QaAJadz20Zp
+qJ4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBWs47LCp1Jjr+kxJG7ZhcFUZh1
+++VQLHqe8RT6q9OKPv+RKY9ji9i0qVQBDb6Thi/5Sm3HXvVX+cpVHBK+Rw82xd9qt9t1wkclf7nx
+Y/hoLVUE0fKNsKTPvDxeH3jnpaAgcLAExbf3cqfeIg29MyVGjGSSJuM+LmOW2puMPfgYCdcDzH2G
+guDKBAdRUNf/ktUM79qGn5nX67evaOI5JpS6aLe/g9Pqemc9YmeuJeVy6OLk7K4S9ksrPJ/psEDz
+OFSz/bdoyNrGj1E8svuR3Bznm53htw1yj+KkxKl4+esUrMZDBcJlOSgYAsOCsp0FvmXtll9ldDz7
+CTUue5wT/RsPXcdtgTpWD8w74a8CLyKsRspGPKAcTNZEtF4uXBVmCeEmKf7GUmG6sXP/wwyc5Wxq
+lD8UykAWlYTzWamsX0xhk23RO8yilQwipmdnRC652dKKQbNmC1r7fSOl8hqw/96bg5Qu0T/fkreR
+rwU7ZcegbLHNYhLDkBvjJc40vG93drEQw/cFGsDWr3RiSBd3kmmQYRzelYB0VI8YHMPzA9C/pEN1
+hlMYegouCRw2n5H9gooiS9EOUCXdywMMF8mDAAhONU2Ki+3wApRmLER/y5UnlhetCTCstnEXbosX
+9hwJ1C07mKVx01QT2WDz9UtmT/rx7iASjbSsV7FFY6GsdqnC+w==
+-----END CERTIFICATE-----
+
+SSL.com EV Root Certification Authority ECC
+===========================================
+-----BEGIN CERTIFICATE-----
+MIIClDCCAhqgAwIBAgIILCmcWxbtBZUwCgYIKoZIzj0EAwIwfzELMAkGA1UEBhMCVVMxDjAMBgNV
+BAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9TU0wgQ29ycG9yYXRpb24xNDAy
+BgNVBAMMK1NTTC5jb20gRVYgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYw
+MjEyMTgxNTIzWhcNNDEwMjEyMTgxNTIzWjB/MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx
+EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrU1NM
+LmNvbSBFViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABKoSR5CYG/vvw0AHgyBO8TCCogbR8pKGYfL2IWjKAMTH6kMAVIbc/R/fALhBYlzccBYy
+3h+Z1MzFB8gIH2EWB1E9fVwHU+M1OIzfzZ/ZLg1KthkuWnBaBu2+8KGwytAJKaNjMGEwHQYDVR0O
+BBYEFFvKXuXe0oGqzagtZFG22XKbl+ZPMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUW8pe
+5d7SgarNqC1kUbbZcpuX5k8wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2gAMGUCMQCK5kCJ
+N+vp1RPZytRrJPOwPYdGWBrssd9v+1a6cGvHOMzosYxPD/fxZ3YOg9AeUY8CMD32IygmTMZgh5Mm
+m7I1HrrW9zzRHM76JTymGoEVW/MSD2zuZYrJh6j5B+BimoxcSg==
+-----END CERTIFICATE-----
+
+GlobalSign Root CA - R6
+=======================
+-----BEGIN CERTIFICATE-----
+MIIFgzCCA2ugAwIBAgIORea7A4Mzw4VlSOb/RVEwDQYJKoZIhvcNAQEMBQAwTDEgMB4GA1UECxMX
+R2xvYmFsU2lnbiBSb290IENBIC0gUjYxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkds
+b2JhbFNpZ24wHhcNMTQxMjEwMDAwMDAwWhcNMzQxMjEwMDAwMDAwWjBMMSAwHgYDVQQLExdHbG9i
+YWxTaWduIFJvb3QgQ0EgLSBSNjETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFs
+U2lnbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJUH6HPKZvnsFMp7PPcNCPG0RQss
+grRIxutbPK6DuEGSMxSkb3/pKszGsIhrxbaJ0cay/xTOURQh7ErdG1rG1ofuTToVBu1kZguSgMpE
+3nOUTvOniX9PeGMIyBJQbUJmL025eShNUhqKGoC3GYEOfsSKvGRMIRxDaNc9PIrFsmbVkJq3MQbF
+vuJtMgamHvm566qjuL++gmNQ0PAYid/kD3n16qIfKtJwLnvnvJO7bVPiSHyMEAc4/2ayd2F+4OqM
+PKq0pPbzlUoSB239jLKJz9CgYXfIWHSw1CM69106yqLbnQneXUQtkPGBzVeS+n68UARjNN9rkxi+
+azayOeSsJDa38O+2HBNXk7besvjihbdzorg1qkXy4J02oW9UivFyVm4uiMVRQkQVlO6jxTiWm05O
+WgtH8wY2SXcwvHE35absIQh1/OZhFj931dmRl4QKbNQCTXTAFO39OfuD8l4UoQSwC+n+7o/hbguy
+CLNhZglqsQY6ZZZZwPA1/cnaKI0aEYdwgQqomnUdnjqGBQCe24DWJfncBZ4nWUx2OVvq+aWh2IMP
+0f/fMBH5hc8zSPXKbWQULHpYT9NLCEnFlWQaYw55PfWzjMpYrZxCRXluDocZXFSxZba/jJvcE+kN
+b7gu3GduyYsRtYQUigAZcIN5kZeR1BonvzceMgfYFGM8KEyvAgMBAAGjYzBhMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSubAWjkxPioufi1xzWx/B/yGdToDAfBgNV
+HSMEGDAWgBSubAWjkxPioufi1xzWx/B/yGdToDANBgkqhkiG9w0BAQwFAAOCAgEAgyXt6NH9lVLN
+nsAEoJFp5lzQhN7craJP6Ed41mWYqVuoPId8AorRbrcWc+ZfwFSY1XS+wc3iEZGtIxg93eFyRJa0
+lV7Ae46ZeBZDE1ZXs6KzO7V33EByrKPrmzU+sQghoefEQzd5Mr6155wsTLxDKZmOMNOsIeDjHfrY
+BzN2VAAiKrlNIC5waNrlU/yDXNOd8v9EDERm8tLjvUYAGm0CuiVdjaExUd1URhxN25mW7xocBFym
+Fe944Hn+Xds+qkxV/ZoVqW/hpvvfcDDpw+5CRu3CkwWJ+n1jez/QcYF8AOiYrg54NMMl+68KnyBr
+3TsTjxKM4kEaSHpzoHdpx7Zcf4LIHv5YGygrqGytXm3ABdJ7t+uA/iU3/gKbaKxCXcPu9czc8FB1
+0jZpnOZ7BN9uBmm23goJSFmH63sUYHpkqmlD75HHTOwY3WzvUy2MmeFe8nI+z1TIvWfspA9MRf/T
+uTAjB0yPEL+GltmZWrSZVxykzLsViVO6LAUP5MSeGbEYNNVMnbrt9x+vJJUEeKgDu+6B5dpffItK
+oZB0JaezPkvILFa9x8jvOOJckvB595yEunQtYQEgfn7R8k8HWV+LLUNS60YMlOH1Zkd5d9VUWx+t
+JDfLRVpOoERIyNiwmcUVhAn21klJwGW45hpxbqCo8YLoRT5s1gLXCmeDBVrJpBA=
+-----END CERTIFICATE-----
+
+OISTE WISeKey Global Root GC CA
+===============================
+-----BEGIN CERTIFICATE-----
+MIICaTCCAe+gAwIBAgIQISpWDK7aDKtARb8roi066jAKBggqhkjOPQQDAzBtMQswCQYDVQQGEwJD
+SDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUgRm91bmRhdGlvbiBFbmRvcnNlZDEo
+MCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwgUm9vdCBHQyBDQTAeFw0xNzA1MDkwOTQ4MzRa
+Fw00MjA1MDkwOTU4MzNaMG0xCzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQL
+ExlPSVNURSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2Jh
+bCBSb290IEdDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAETOlQwMYPchi82PG6s4nieUqjFqdr
+VCTbUf/q9Akkwwsin8tqJ4KBDdLArzHkdIJuyiXZjHWd8dvQmqJLIX4Wp2OQ0jnUsYd4XxiWD1Ab
+NTcPasbc2RNNpI6QN+a9WzGRo1QwUjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUSIcUrOPDnpBgOtfKie7TrYy0UGYwEAYJKwYBBAGCNxUBBAMCAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwJsdpW9zV57LnyAyMjMPdeYwbY9XJUpROTYJKcx6ygISpJcBMWm1JKWB4E+J+SOtk
+AjEA2zQgMgj/mkkCtojeFK9dbJlxjRo/i9fgojaGHAeCOnZT/cKi7e97sIBPWA9LUzm9
+-----END CERTIFICATE-----
+
+UCA Global G2 Root
+==================
+-----BEGIN CERTIFICATE-----
+MIIFRjCCAy6gAwIBAgIQXd+x2lqj7V2+WmUgZQOQ7zANBgkqhkiG9w0BAQsFADA9MQswCQYDVQQG
+EwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxGzAZBgNVBAMMElVDQSBHbG9iYWwgRzIgUm9vdDAeFw0x
+NjAzMTEwMDAwMDBaFw00MDEyMzEwMDAwMDBaMD0xCzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlU
+cnVzdDEbMBkGA1UEAwwSVUNBIEdsb2JhbCBHMiBSb290MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEAxeYrb3zvJgUno4Ek2m/LAfmZmqkywiKHYUGRO8vDaBsGxUypK8FnFyIdK+35KYmT
+oni9kmugow2ifsqTs6bRjDXVdfkX9s9FxeV67HeToI8jrg4aA3++1NDtLnurRiNb/yzmVHqUwCoV
+8MmNsHo7JOHXaOIxPAYzRrZUEaalLyJUKlgNAQLx+hVRZ2zA+te2G3/RVogvGjqNO7uCEeBHANBS
+h6v7hn4PJGtAnTRnvI3HLYZveT6OqTwXS3+wmeOwcWDcC/Vkw85DvG1xudLeJ1uK6NjGruFZfc8o
+LTW4lVYa8bJYS7cSN8h8s+1LgOGN+jIjtm+3SJUIsUROhYw6AlQgL9+/V087OpAh18EmNVQg7Mc/
+R+zvWr9LesGtOxdQXGLYD0tK3Cv6brxzks3sx1DoQZbXqX5t2Okdj4q1uViSukqSKwxW/YDrCPBe
+KW4bHAyvj5OJrdu9o54hyokZ7N+1wxrrFv54NkzWbtA+FxyQF2smuvt6L78RHBgOLXMDj6DlNaBa
+4kx1HXHhOThTeEDMg5PXCp6dW4+K5OXgSORIskfNTip1KnvyIvbJvgmRlld6iIis7nCs+dwp4wwc
+OxJORNanTrAmyPPZGpeRaOrvjUYG0lZFWJo8DA+DuAUlwznPO6Q0ibd5Ei9Hxeepl2n8pndntd97
+8XplFeRhVmUCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFIHEjMz15DD/pQwIX4wVZyF0Ad/fMA0GCSqGSIb3DQEBCwUAA4ICAQATZSL1jiutROTL/7lo
+5sOASD0Ee/ojL3rtNtqyzm325p7lX1iPyzcyochltq44PTUbPrw7tgTQvPlJ9Zv3hcU2tsu8+Mg5
+1eRfB70VVJd0ysrtT7q6ZHafgbiERUlMjW+i67HM0cOU2kTC5uLqGOiiHycFutfl1qnN3e92mI0A
+Ds0b+gO3joBYDic/UvuUospeZcnWhNq5NXHzJsBPd+aBJ9J3O5oUb3n09tDh05S60FdRvScFDcH9
+yBIw7m+NESsIndTUv4BFFJqIRNow6rSn4+7vW4LVPtateJLbXDzz2K36uGt/xDYotgIVilQsnLAX
+c47QN6MUPJiVAAwpBVueSUmxX8fjy88nZY41F7dXyDDZQVu5FLbowg+UMaeUmMxq67XhJ/UQqAHo
+jhJi6IjMtX9Gl8CbEGY4GjZGXyJoPd/JxhMnq1MGrKI8hgZlb7F+sSlEmqO6SWkoaY/X5V+tBIZk
+bxqgDMUIYs6Ao9Dz7GjevjPHF1t/gMRMTLGmhIrDO7gJzRSBuhjjVFc2/tsvfEehOjPI+Vg7RE+x
+ygKJBJYoaMVLuCaJu9YzL1DV/pqJuhgyklTGW+Cd+V7lDSKb9triyCGyYiGqhkCyLmTTX8jjfhFn
+RR8F/uOi77Oos/N9j/gMHyIfLXC0uAE0djAA5SN4p1bXUB+K+wb1whnw0A==
+-----END CERTIFICATE-----
+
+UCA Extended Validation Root
+============================
+-----BEGIN CERTIFICATE-----
+MIIFWjCCA0KgAwIBAgIQT9Irj/VkyDOeTzRYZiNwYDANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQG
+EwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxJTAjBgNVBAMMHFVDQSBFeHRlbmRlZCBWYWxpZGF0aW9u
+IFJvb3QwHhcNMTUwMzEzMDAwMDAwWhcNMzgxMjMxMDAwMDAwWjBHMQswCQYDVQQGEwJDTjERMA8G
+A1UECgwIVW5pVHJ1c3QxJTAjBgNVBAMMHFVDQSBFeHRlbmRlZCBWYWxpZGF0aW9uIFJvb3QwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCpCQcoEwKwmeBkqh5DFnpzsZGgdT6o+uM4AHrs
+iWogD4vFsJszA1qGxliG1cGFu0/GnEBNyr7uaZa4rYEwmnySBesFK5pI0Lh2PpbIILvSsPGP2KxF
+Rv+qZ2C0d35qHzwaUnoEPQc8hQ2E0B92CvdqFN9y4zR8V05WAT558aopO2z6+I9tTcg1367r3CTu
+eUWnhbYFiN6IXSV8l2RnCdm/WhUFhvMJHuxYMjMR83dksHYf5BA1FxvyDrFspCqjc/wJHx4yGVMR
+59mzLC52LqGj3n5qiAno8geK+LLNEOfic0CTuwjRP+H8C5SzJe98ptfRr5//lpr1kXuYC3fUfugH
+0mK1lTnj8/FtDw5lhIpjVMWAtuCeS31HJqcBCF3RiJ7XwzJE+oJKCmhUfzhTA8ykADNkUVkLo4KR
+el7sFsLzKuZi2irbWWIQJUoqgQtHB0MGcIfS+pMRKXpITeuUx3BNr2fVUbGAIAEBtHoIppB/TuDv
+B0GHr2qlXov7z1CymlSvw4m6WC31MJixNnI5fkkE/SmnTHnkBVfblLkWU41Gsx2VYVdWf6/wFlth
+WG82UBEL2KwrlRYaDh8IzTY0ZRBiZtWAXxQgXy0MoHgKaNYs1+lvK9JKBZP8nm9rZ/+I8U6laUpS
+NwXqxhaN0sSZ0YIrO7o1dfdRUVjzyAfd5LQDfwIDAQABo0IwQDAdBgNVHQ4EFgQU2XQ65DA9DfcS
+3H5aBZ8eNJr34RQwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQEL
+BQADggIBADaNl8xCFWQpN5smLNb7rhVpLGsaGvdftvkHTFnq88nIua7Mui563MD1sC3AO6+fcAUR
+ap8lTwEpcOPlDOHqWnzcSbvBHiqB9RZLcpHIojG5qtr8nR/zXUACE/xOHAbKsxSQVBcZEhrxH9cM
+aVr2cXj0lH2RC47skFSOvG+hTKv8dGT9cZr4QQehzZHkPJrgmzI5c6sq1WnIeJEmMX3ixzDx/BR4
+dxIOE/TdFpS/S2d7cFOFyrC78zhNLJA5wA3CXWvp4uXViI3WLL+rG761KIcSF3Ru/H38j9CHJrAb
++7lsq+KePRXBOy5nAliRn+/4Qh8st2j1da3Ptfb/EX3C8CSlrdP6oDyp+l3cpaDvRKS+1ujl5BOW
+F3sGPjLtx7dCvHaj2GU4Kzg1USEODm8uNBNA4StnDG1KQTAYI1oyVZnJF+A83vbsea0rWBmirSwi
+GpWOvpaQXUJXxPkUAzUrHC1RVwinOt4/5Mi0A3PCwSaAuwtCH60NryZy2sy+s6ODWA2CxR9GUeOc
+GMyNm43sSet1UNWMKFnKdDTajAshqx7qG+XH/RU+wBeq+yNuJkbL+vmxcmtpzyKEC2IPrNkZAJSi
+djzULZrtBJ4tBmIQN1IchXIbJ+XMxjHsN+xjWZsLHXbMfjKaiJUINlK73nZfdklJrX+9ZSCyycEr
+dhh2n1ax
+-----END CERTIFICATE-----
+
+Certigna Root CA
+================
+-----BEGIN CERTIFICATE-----
+MIIGWzCCBEOgAwIBAgIRAMrpG4nxVQMNo+ZBbcTjpuEwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UE
+BhMCRlIxEjAQBgNVBAoMCURoaW15b3RpczEcMBoGA1UECwwTMDAwMiA0ODE0NjMwODEwMDAzNjEZ
+MBcGA1UEAwwQQ2VydGlnbmEgUm9vdCBDQTAeFw0xMzEwMDEwODMyMjdaFw0zMzEwMDEwODMyMjda
+MFoxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYz
+MDgxMDAwMzYxGTAXBgNVBAMMEENlcnRpZ25hIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQDNGDllGlmx6mQWDoyUJJV8g9PFOSbcDO8WV43X2KyjQn+Cyu3NW9sOty3tRQgX
+stmzy9YXUnIo245Onoq2C/mehJpNdt4iKVzSs9IGPjA5qXSjklYcoW9MCiBtnyN6tMbaLOQdLNyz
+KNAT8kxOAkmhVECe5uUFoC2EyP+YbNDrihqECB63aCPuI9Vwzm1RaRDuoXrC0SIxwoKF0vJVdlB8
+JXrJhFwLrN1CTivngqIkicuQstDuI7pmTLtipPlTWmR7fJj6o0ieD5Wupxj0auwuA0Wv8HT4Ks16
+XdG+RCYyKfHx9WzMfgIhC59vpD++nVPiz32pLHxYGpfhPTc3GGYo0kDFUYqMwy3OU4gkWGQwFsWq
+4NYKpkDfePb1BHxpE4S80dGnBs8B92jAqFe7OmGtBIyT46388NtEbVncSVmurJqZNjBBe3YzIoej
+wpKGbvlw7q6Hh5UbxHq9MfPU0uWZ/75I7HX1eBYdpnDBfzwboZL7z8g81sWTCo/1VTp2lc5ZmIoJ
+lXcymoO6LAQ6l73UL77XbJuiyn1tJslV1c/DeVIICZkHJC1kJWumIWmbat10TWuXekG9qxf5kBdI
+jzb5LdXF2+6qhUVB+s06RbFo5jZMm5BX7CO5hwjCxAnxl4YqKE3idMDaxIzb3+KhF1nOJFl0Mdp/
+/TBt2dzhauH8XwIDAQABo4IBGjCCARYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+HQYDVR0OBBYEFBiHVuBud+4kNTxOc5of1uHieX4rMB8GA1UdIwQYMBaAFBiHVuBud+4kNTxOc5of
+1uHieX4rMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8GCCsGAQUFBwIBFiNodHRwczovL3d3d3cuY2Vy
+dGlnbmEuZnIvYXV0b3JpdGVzLzBtBgNVHR8EZjBkMC+gLaArhilodHRwOi8vY3JsLmNlcnRpZ25h
+LmZyL2NlcnRpZ25hcm9vdGNhLmNybDAxoC+gLYYraHR0cDovL2NybC5kaGlteW90aXMuY29tL2Nl
+cnRpZ25hcm9vdGNhLmNybDANBgkqhkiG9w0BAQsFAAOCAgEAlLieT/DjlQgi581oQfccVdV8AOIt
+OoldaDgvUSILSo3L6btdPrtcPbEo/uRTVRPPoZAbAh1fZkYJMyjhDSSXcNMQH+pkV5a7XdrnxIxP
+TGRGHVyH41neQtGbqH6mid2PHMkwgu07nM3A6RngatgCdTer9zQoKJHyBApPNeNgJgH60BGM+RFq
+7q89w1DTj18zeTyGqHNFkIwgtnJzFyO+B2XleJINugHA64wcZr+shncBlA2c5uk5jR+mUYyZDDl3
+4bSb+hxnV29qao6pK0xXeXpXIs/NX2NGjVxZOob4Mkdio2cNGJHc+6Zr9UhhcyNZjgKnvETq9Emd
+8VRY+WCv2hikLyhF3HqgiIZd8zvn/yk1gPxkQ5Tm4xxvvq0OKmOZK8l+hfZx6AYDlf7ej0gcWtSS
+6Cvu5zHbugRqh5jnxV/vfaci9wHYTfmJ0A6aBVmknpjZbyvKcL5kwlWj9Omvw5Ip3IgWJJk8jSaY
+tlu3zM63Nwf9JtmYhST/WSMDmu2dnajkXjjO11INb9I/bbEFa0nOipFGc/T2L/Coc3cOZayhjWZS
+aX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw3kAP+HwV96LOPNde
+E4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0=
+-----END CERTIFICATE-----
+
+emSign Root CA - G1
+===================
+-----BEGIN CERTIFICATE-----
+MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYDVQQGEwJJTjET
+MBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBHMTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgx
+ODMwMDBaMGcxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVk
+aHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQzf2N4aLTN
+LnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO8oG0x5ZOrRkVUkr+PHB1
+cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aqd7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHW
+DV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhMtTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ
+6DqS0hdW5TUaQBw+jSztOd9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrH
+hQIDAQABo0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQDAgEG
+MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31xPaOfG1vR2vjTnGs2
+vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjMwiI/aTvFthUvozXGaCocV685743Q
+NcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6dGNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q
++Mri/Tm3R7nrft8EI6/6nAYH6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeih
+U80Bv2noWgbyRQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx
+iN66zB+Afko=
+-----END CERTIFICATE-----
+
+emSign ECC Root CA - G3
+=======================
+-----BEGIN CERTIFICATE-----
+MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQGEwJJTjETMBEG
+A1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEg
+MB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4
+MTgzMDAwWjBrMQswCQYDVQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11
+ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
+RzMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0WXTsuwYc
+58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xySfvalY8L1X44uT6EYGQIr
+MgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuBzhccLikenEhjQjAOBgNVHQ8BAf8EBAMC
+AQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+D
+CBeQyh+KTOgNG3qxrdWBCUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7
+jHvrZQnD+JbNR6iC8hZVdyR+EhCVBCyj
+-----END CERTIFICATE-----
+
+emSign Root CA - C1
+===================
+-----BEGIN CERTIFICATE-----
+MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UEBhMCVVMx
+EzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNp
+Z24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAwMFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UE
+BhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQD
+ExNlbVNpZ24gUm9vdCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+up
+ufGZBczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZHdPIWoU/
+Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH3DspVpNqs8FqOp099cGX
+OFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvHGPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4V
+I5b2P/AgNBbeCsbEBEV5f6f9vtKppa+cxSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleooms
+lMuoaJuvimUnzYnu3Yy1aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+
+XJGFehiqTbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQAD
+ggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87/kOXSTKZEhVb3xEp
+/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4kqNPEjE2NuLe/gDEo2APJ62gsIq1
+NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrGYQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9
+wC68AivTxEDkigcxHpvOJpkT+xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQ
+BmIMMMAVSKeoWXzhriKi4gp6D/piq1JM4fHfyr6DDUI=
+-----END CERTIFICATE-----
+
+emSign ECC Root CA - C3
+=======================
+-----BEGIN CERTIFICATE-----
+MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQGEwJVUzETMBEG
+A1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMxIDAeBgNVBAMTF2VtU2lnbiBF
+Q0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAwMFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UE
+BhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQD
+ExdlbVNpZ24gRUNDIFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd
+6bciMK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4OjavtisIGJAnB9
+SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0OBBYEFPtaSNCAIEDyqOkA
+B2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2gA
+MGUCMQC02C8Cif22TGK6Q04ThHK1rt0c3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwU
+ZOR8loMRnLDRWmFLpg9J0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ==
+-----END CERTIFICATE-----
+
+Hongkong Post Root CA 3
+=======================
+-----BEGIN CERTIFICATE-----
+MIIFzzCCA7egAwIBAgIUCBZfikyl7ADJk0DfxMauI7gcWqQwDQYJKoZIhvcNAQELBQAwbzELMAkG
+A1UEBhMCSEsxEjAQBgNVBAgTCUhvbmcgS29uZzESMBAGA1UEBxMJSG9uZyBLb25nMRYwFAYDVQQK
+Ew1Ib25na29uZyBQb3N0MSAwHgYDVQQDExdIb25na29uZyBQb3N0IFJvb3QgQ0EgMzAeFw0xNzA2
+MDMwMjI5NDZaFw00MjA2MDMwMjI5NDZaMG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtv
+bmcxEjAQBgNVBAcTCUhvbmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMX
+SG9uZ2tvbmcgUG9zdCBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCz
+iNfqzg8gTr7m1gNt7ln8wlffKWihgw4+aMdoWJwcYEuJQwy51BWy7sFOdem1p+/l6TWZ5Mwc50tf
+jTMwIDNT2aa71T4Tjukfh0mtUC1Qyhi+AViiE3CWu4mIVoBc+L0sPOFMV4i707mV78vH9toxdCim
+5lSJ9UExyuUmGs2C4HDaOym71QP1mbpV9WTRYA6ziUm4ii8F0oRFKHyPaFASePwLtVPLwpgchKOe
+sL4jpNrcyCse2m5FHomY2vkALgbpDDtw1VAliJnLzXNg99X/NWfFobxeq81KuEXryGgeDQ0URhLj
+0mRiikKYvLTGCAj4/ahMZJx2Ab0vqWwzD9g/KLg8aQFChn5pwckGyuV6RmXpwtZQQS4/t+TtbNe/
+JgERohYpSms0BpDsE9K2+2p20jzt8NYt3eEV7KObLyzJPivkaTv/ciWxNoZbx39ri1UbSsUgYT2u
+y1DhCDq+sI9jQVMwCFk8mB13umOResoQUGC/8Ne8lYePl8X+l2oBlKN8W4UdKjk60FSh0Tlxnf0h
++bV78OLgAo9uliQlLKAeLKjEiafv7ZkGL7YKTE/bosw3Gq9HhS2KX8Q0NEwA/RiTZxPRN+ZItIsG
+xVd7GYYKecsAyVKvQv83j+GjHno9UKtjBucVtT+2RTeUN7F+8kjDf8V1/peNRY8apxpyKBpADwID
+AQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQXnc0e
+i9Y5K3DTXNSguB+wAPzFYTAdBgNVHQ4EFgQUF53NHovWOStw01zUoLgfsAD8xWEwDQYJKoZIhvcN
+AQELBQADggIBAFbVe27mIgHSQpsY1Q7XZiNc4/6gx5LS6ZStS6LG7BJ8dNVI0lkUmcDrudHr9Egw
+W62nV3OZqdPlt9EuWSRY3GguLmLYauRwCy0gUCCkMpXRAJi70/33MvJJrsZ64Ee+bs7Lo3I6LWld
+y8joRTnU+kLBEUx3XZL7av9YROXrgZ6voJmtvqkBZss4HTzfQx/0TW60uhdG/H39h4F5ag0zD/ov
++BS5gLNdTaqX4fnkGMX41TiMJjz98iji7lpJiCzfeT2OnpA8vUFKOt1b9pq0zj8lMH8yfaIDlNDc
+eqFS3m6TjRgm/VWsvY+b0s+v54Ysyx8Jb6NvqYTUc79NoXQbTiNg8swOqn+knEwlqLJmOzj/2ZQw
+9nKEvmhVEA/GcywWaZMH/rFF7buiVWqw2rVKAiUnhde3t4ZEFolsgCs+l6mc1X5VTMbeRRAc6uk7
+nwNT7u56AQIWeNTowr5GdogTPyK7SBIdUgC0An4hGh6cJfTzPV4e0hz5sy229zdcxsshTrD3mUcY
+hcErulWuBurQB7Lcq9CClnXO0lD+mefPL5/ndtFhKvshuzHQqp9HpLIiyhY6UFfEW0NnxWViA0kB
+60PZ2Pierc+xYw5F9KBaLJstxabArahH9CdMOA0uG0k7UvToiIMrVCjU8jVStDKDYmlkDJGcn5fq
+dBb9HxEGmpv0
+-----END CERTIFICATE-----
+
+Entrust Root Certification Authority - G4
+=========================================
+-----BEGIN CERTIFICATE-----
+MIIGSzCCBDOgAwIBAgIRANm1Q3+vqTkPAAAAAFVlrVgwDQYJKoZIhvcNAQELBQAwgb4xCzAJBgNV
+BAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3Qu
+bmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxNSBFbnRydXN0LCBJbmMuIC0gZm9yIGF1
+dGhvcml6ZWQgdXNlIG9ubHkxMjAwBgNVBAMTKUVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1
+dGhvcml0eSAtIEc0MB4XDTE1MDUyNzExMTExNloXDTM3MTIyNzExNDExNlowgb4xCzAJBgNVBAYT
+AlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3QubmV0
+L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxNSBFbnRydXN0LCBJbmMuIC0gZm9yIGF1dGhv
+cml6ZWQgdXNlIG9ubHkxMjAwBgNVBAMTKUVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhv
+cml0eSAtIEc0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsewsQu7i0TD/pZJH4i3D
+umSXbcr3DbVZwbPLqGgZ2K+EbTBwXX7zLtJTmeH+H17ZSK9dE43b/2MzTdMAArzE+NEGCJR5WIoV
+3imz/f3ET+iq4qA7ec2/a0My3dl0ELn39GjUu9CH1apLiipvKgS1sqbHoHrmSKvS0VnM1n4j5pds
+8ELl3FFLFUHtSUrJ3hCX1nbB76W1NhSXNdh4IjVS70O92yfbYVaCNNzLiGAMC1rlLAHGVK/XqsEQ
+e9IFWrhAnoanw5CGAlZSCXqc0ieCU0plUmr1POeo8pyvi73TDtTUXm6Hnmo9RR3RXRv06QqsYJn7
+ibT/mCzPfB3pAqoEmh643IhuJbNsZvc8kPNXwbMv9W3y+8qh+CmdRouzavbmZwe+LGcKKh9asj5X
+xNMhIWNlUpEbsZmOeX7m640A2Vqq6nPopIICR5b+W45UYaPrL0swsIsjdXJ8ITzI9vF01Bx7owVV
+7rtNOzK+mndmnqxpkCIHH2E6lr7lmk/MBTwoWdPBDFSoWWG9yHJM6Nyfh3+9nEg2XpWjDrk4JFX8
+dWbrAuMINClKxuMrLzOg2qOGpRKX/YAr2hRC45K9PvJdXmd0LhyIRyk0X+IyqJwlN4y6mACXi0mW
+Hv0liqzc2thddG5msP9E36EYxr5ILzeUePiVSj9/E15dWf10hkNjc0kCAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJ84xFYjwznooHFs6FRM5Og6sb9n
+MA0GCSqGSIb3DQEBCwUAA4ICAQAS5UKme4sPDORGpbZgQIeMJX6tuGguW8ZAdjwD+MlZ9POrYs4Q
+jbRaZIxowLByQzTSGwv2LFPSypBLhmb8qoMi9IsabyZIrHZ3CL/FmFz0Jomee8O5ZDIBf9PD3Vht
+7LGrhFV0d4QEJ1JrhkzO3bll/9bGXp+aEJlLdWr+aumXIOTkdnrG0CSqkM0gkLpHZPt/B7NTeLUK
+YvJzQ85BK4FqLoUWlFPUa19yIqtRLULVAJyZv967lDtX/Zr1hstWO1uIAeV8KEsD+UmDfLJ/fOPt
+jqF/YFOOVZ1QNBIPt5d7bIdKROf1beyAN/BYGW5KaHbwH5Lk6rWS02FREAutp9lfx1/cH6NcjKF+
+m7ee01ZvZl4HliDtC3T7Zk6LERXpgUl+b7DUUH8i119lAg2m9IUe2K4GS0qn0jFmwvjO5QimpAKW
+RGhXxNUzzxkvFMSUHHuk2fCfDrGA4tGeEWSpiBE6doLlYsKA2KSD7ZPvfC+QsDJMlhVoSFLUmQjA
+JOgc47OlIQ6SwJAfzyBfyjs4x7dtOvPmRLgOMWuIjnDrnBdSqEGULoe256YSxXXfW8AKbnuk5F6G
++TaU33fD6Q3AOfF5u0aOq0NZJ7cguyPpVkAh7DE9ZapD8j3fcEThuk0mEDuYn/PIjhs4ViFqUZPT
+kcpG2om3PVODLAgfi49T3f+sHw==
+-----END CERTIFICATE-----
+
+Microsoft ECC Root Certificate Authority 2017
+=============================================
+-----BEGIN CERTIFICATE-----
+MIICWTCCAd+gAwIBAgIQZvI9r4fei7FK6gxXMQHC7DAKBggqhkjOPQQDAzBlMQswCQYDVQQGEwJV
+UzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYwNAYDVQQDEy1NaWNyb3NvZnQgRUND
+IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTcwHhcNMTkxMjE4MjMwNjQ1WhcNNDIwNzE4
+MjMxNjA0WjBlMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYw
+NAYDVQQDEy1NaWNyb3NvZnQgRUNDIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTcwdjAQ
+BgcqhkjOPQIBBgUrgQQAIgNiAATUvD0CQnVBEyPNgASGAlEvaqiBYgtlzPbKnR5vSmZRogPZnZH6
+thaxjG7efM3beaYvzrvOcS/lpaso7GMEZpn4+vKTEAXhgShC48Zo9OYbhGBKia/teQ87zvH2RPUB
+eMCjVDBSMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTIy5lycFIM
++Oa+sgRXKSrPQhDtNTAQBgkrBgEEAYI3FQEEAwIBADAKBggqhkjOPQQDAwNoADBlAjBY8k3qDPlf
+Xu5gKcs68tvWMoQZP3zVL8KxzJOuULsJMsbG7X7JNpQS5GiFBqIb0C8CMQCZ6Ra0DvpWSNSkMBaR
+eNtUjGUBiudQZsIxtzm6uBoiB078a1QWIP8rtedMDE2mT3M=
+-----END CERTIFICATE-----
+
+Microsoft RSA Root Certificate Authority 2017
+=============================================
+-----BEGIN CERTIFICATE-----
+MIIFqDCCA5CgAwIBAgIQHtOXCV/YtLNHcB6qvn9FszANBgkqhkiG9w0BAQwFADBlMQswCQYDVQQG
+EwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYwNAYDVQQDEy1NaWNyb3NvZnQg
+UlNBIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTcwHhcNMTkxMjE4MjI1MTIyWhcNNDIw
+NzE4MjMwMDIzWjBlMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u
+MTYwNAYDVQQDEy1NaWNyb3NvZnQgUlNBIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTcw
+ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKW76UM4wplZEWCpW9R2LBifOZNt9GkMml
+7Xhqb0eRaPgnZ1AzHaGm++DlQ6OEAlcBXZxIQIJTELy/xztokLaCLeX0ZdDMbRnMlfl7rEqUrQ7e
+S0MdhweSE5CAg2Q1OQT85elss7YfUJQ4ZVBcF0a5toW1HLUX6NZFndiyJrDKxHBKrmCk3bPZ7Pw7
+1VdyvD/IybLeS2v4I2wDwAW9lcfNcztmgGTjGqwu+UcF8ga2m3P1eDNbx6H7JyqhtJqRjJHTOoI+
+dkC0zVJhUXAoP8XFWvLJjEm7FFtNyP9nTUwSlq31/niol4fX/V4ggNyhSyL71Imtus5Hl0dVe49F
+yGcohJUcaDDv70ngNXtk55iwlNpNhTs+VcQor1fznhPbRiefHqJeRIOkpcrVE7NLP8TjwuaGYaRS
+MLl6IE9vDzhTyzMMEyuP1pq9KsgtsRx9S1HKR9FIJ3Jdh+vVReZIZZ2vUpC6W6IYZVcSn2i51BVr
+lMRpIpj0M+Dt+VGOQVDJNE92kKz8OMHY4Xu54+OU4UZpyw4KUGsTuqwPN1q3ErWQgR5WrlcihtnJ
+0tHXUeOrO8ZV/R4O03QK0dqq6mm4lyiPSMQH+FJDOvTKVTUssKZqwJz58oHhEmrARdlns87/I6KJ
+ClTUFLkqqNfs+avNJVgyeY+QW5g5xAgGwax/Dj0ApQIDAQABo1QwUjAOBgNVHQ8BAf8EBAMCAYYw
+DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUCctZf4aycI8awznjwNnpv7tNsiMwEAYJKwYBBAGC
+NxUBBAMCAQAwDQYJKoZIhvcNAQEMBQADggIBAKyvPl3CEZaJjqPnktaXFbgToqZCLgLNFgVZJ8og
+6Lq46BrsTaiXVq5lQ7GPAJtSzVXNUzltYkyLDVt8LkS/gxCP81OCgMNPOsduET/m4xaRhPtthH80
+dK2Jp86519efhGSSvpWhrQlTM93uCupKUY5vVau6tZRGrox/2KJQJWVggEbbMwSubLWYdFQl3JPk
++ONVFT24bcMKpBLBaYVu32TxU5nhSnUgnZUP5NbcA/FZGOhHibJXWpS2qdgXKxdJ5XbLwVaZOjex
+/2kskZGT4d9Mozd2TaGf+G0eHdP67Pv0RR0Tbc/3WeUiJ3IrhvNXuzDtJE3cfVa7o7P4NHmJweDy
+AmH3pvwPuxwXC65B2Xy9J6P9LjrRk5Sxcx0ki69bIImtt2dmefU6xqaWM/5TkshGsRGRxpl/j8nW
+ZjEgQRCHLQzWwa80mMpkg/sTV9HB8Dx6jKXB/ZUhoHHBk2dxEuqPiAppGWSZI1b7rCoucL5mxAyE
+7+WL85MB+GqQk2dLsmijtWKP6T+MejteD+eMuMZ87zf9dOLITzNy4ZQ5bb0Sr74MTnB8G2+NszKT
+c0QWbej09+CVgI+WXTik9KveCjCHk9hNAHFiRSdLOkKEW39lt2c0Ui2cFmuqqNh7o0JMcccMyj6D
+5KbvtwEwXlGjefVwaaZBRA+GsCyRxj3qrg+E
+-----END CERTIFICATE-----
+
+e-Szigno Root CA 2017
+=====================
+-----BEGIN CERTIFICATE-----
+MIICQDCCAeWgAwIBAgIMAVRI7yH9l1kN9QQKMAoGCCqGSM49BAMCMHExCzAJBgNVBAYTAkhVMREw
+DwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMgTHRkLjEXMBUGA1UEYQwOVkFUSFUt
+MjM1ODQ0OTcxHjAcBgNVBAMMFWUtU3ppZ25vIFJvb3QgQ0EgMjAxNzAeFw0xNzA4MjIxMjA3MDZa
+Fw00MjA4MjIxMjA3MDZaMHExCzAJBgNVBAYTAkhVMREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UE
+CgwNTWljcm9zZWMgTHRkLjEXMBUGA1UEYQwOVkFUSFUtMjM1ODQ0OTcxHjAcBgNVBAMMFWUtU3pp
+Z25vIFJvb3QgQ0EgMjAxNzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJbcPYrYsHtvxie+RJCx
+s1YVe45DJH0ahFnuY2iyxl6H0BVIHqiQrb1TotreOpCmYF9oMrWGQd+HWyx7xf58etqjYzBhMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSHERUI0arBeAyxr87GyZDv
+vzAEwDAfBgNVHSMEGDAWgBSHERUI0arBeAyxr87GyZDvvzAEwDAKBggqhkjOPQQDAgNJADBGAiEA
+tVfd14pVCzbhhkT61NlojbjcI4qKDdQvfepz7L9NbKgCIQDLpbQS+ue16M9+k/zzNY9vTlp8tLxO
+svxyqltZ+efcMQ==
+-----END CERTIFICATE-----
+
+certSIGN Root CA G2
+===================
+-----BEGIN CERTIFICATE-----
+MIIFRzCCAy+gAwIBAgIJEQA0tk7GNi02MA0GCSqGSIb3DQEBCwUAMEExCzAJBgNVBAYTAlJPMRQw
+EgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJR04gUk9PVCBDQSBHMjAeFw0xNzAy
+MDYwOTI3MzVaFw00MjAyMDYwOTI3MzVaMEExCzAJBgNVBAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lH
+TiBTQTEcMBoGA1UECxMTY2VydFNJR04gUk9PVCBDQSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIP
+ADCCAgoCggIBAMDFdRmRfUR0dIf+DjuW3NgBFszuY5HnC2/OOwppGnzC46+CjobXXo9X69MhWf05
+N0IwvlDqtg+piNguLWkh59E3GE59kdUWX2tbAMI5Qw02hVK5U2UPHULlj88F0+7cDBrZuIt4Imfk
+abBoxTzkbFpG583H+u/E7Eu9aqSs/cwoUe+StCmrqzWaTOTECMYmzPhpn+Sc8CnTXPnGFiWeI8Mg
+wT0PPzhAsP6CRDiqWhqKa2NYOLQV07YRaXseVO6MGiKscpc/I1mbySKEwQdPzH/iV8oScLumZfNp
+dWO9lfsbl83kqK/20U6o2YpxJM02PbyWxPFsqa7lzw1uKA2wDrXKUXt4FMMgL3/7FFXhEZn91Qqh
+ngLjYl/rNUssuHLoPj1PrCy7Lobio3aP5ZMqz6WryFyNSwb/EkaseMsUBzXgqd+L6a8VTxaJW732
+jcZZroiFDsGJ6x9nxUWO/203Nit4ZoORUSs9/1F3dmKh7Gc+PoGD4FapUB8fepmrY7+EF3fxDTvf
+95xhszWYijqy7DwaNz9+j5LP2RIUZNoQAhVB/0/E6xyjyfqZ90bp4RjZsbgyLcsUDFDYg2WD7rlc
+z8sFWkz6GZdr1l0T08JcVLwyc6B49fFtHsufpaafItzRUZ6CeWRgKRM+o/1Pcmqr4tTluCRVLERL
+iohEnMqE0yo7AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1Ud
+DgQWBBSCIS1mxteg4BXrzkwJd8RgnlRuAzANBgkqhkiG9w0BAQsFAAOCAgEAYN4auOfyYILVAzOB
+ywaK8SJJ6ejqkX/GM15oGQOGO0MBzwdw5AgeZYWR5hEit/UCI46uuR59H35s5r0l1ZUa8gWmr4UC
+b6741jH/JclKyMeKqdmfS0mbEVeZkkMR3rYzpMzXjWR91M08KCy0mpbqTfXERMQlqiCA2ClV9+BB
+/AYm/7k29UMUA2Z44RGx2iBfRgB4ACGlHgAoYXhvqAEBj500mv/0OJD7uNGzcgbJceaBxXntC6Z5
+8hMLnPddDnskk7RI24Zf3lCGeOdA5jGokHZwYa+cNywRtYK3qq4kNFtyDGkNzVmf9nGvnAvRCjj5
+BiKDUyUM/FHE5r7iOZULJK2v0ZXkltd0ZGtxTgI8qoXzIKNDOXZbbFD+mpwUHmUUihW9o4JFWklW
+atKcsWMy5WHgUyIOpwpJ6st+H6jiYoD2EEVSmAYY3qXNL3+q1Ok+CHLsIwMCPKaq2LxndD0UF/tU
+Sxfj03k9bWtJySgOLnRQvwzZRjoQhsmnP+mg7H/rpXdYaXHmgwo38oZJar55CJD2AhZkPuXaTH4M
+NMn5X7azKFGnpyuqSfqNZSlO42sTp5SjLVFteAxEy9/eCG/Oo2Sr05WE1LlSVHJ7liXMvGnjSG4N
+0MedJ5qq+BOS3R7fY581qRY27Iy4g/Q9iY/NtBde17MXQRBdJ3NghVdJIgc=
+-----END CERTIFICATE-----
+
+Trustwave Global Certification Authority
+========================================
+-----BEGIN CERTIFICATE-----
+MIIF2jCCA8KgAwIBAgIMBfcOhtpJ80Y1LrqyMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJV
+UzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28xITAfBgNVBAoMGFRydXN0d2F2
+ZSBIb2xkaW5ncywgSW5jLjExMC8GA1UEAwwoVHJ1c3R3YXZlIEdsb2JhbCBDZXJ0aWZpY2F0aW9u
+IEF1dGhvcml0eTAeFw0xNzA4MjMxOTM0MTJaFw00MjA4MjMxOTM0MTJaMIGIMQswCQYDVQQGEwJV
+UzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28xITAfBgNVBAoMGFRydXN0d2F2
+ZSBIb2xkaW5ncywgSW5jLjExMC8GA1UEAwwoVHJ1c3R3YXZlIEdsb2JhbCBDZXJ0aWZpY2F0aW9u
+IEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALldUShLPDeS0YLOvR29
+zd24q88KPuFd5dyqCblXAj7mY2Hf8g+CY66j96xz0XznswuvCAAJWX/NKSqIk4cXGIDtiLK0thAf
+LdZfVaITXdHG6wZWiYj+rDKd/VzDBcdu7oaJuogDnXIhhpCujwOl3J+IKMujkkkP7NAP4m1ET4Bq
+stTnoApTAbqOl5F2brz81Ws25kCI1nsvXwXoLG0R8+eyvpJETNKXpP7ScoFDB5zpET71ixpZfR9o
+WN0EACyW80OzfpgZdNmcc9kYvkHHNHnZ9GLCQ7mzJ7Aiy/k9UscwR7PJPrhq4ufogXBeQotPJqX+
+OsIgbrv4Fo7NDKm0G2x2EOFYeUY+VM6AqFcJNykbmROPDMjWLBz7BegIlT1lRtzuzWniTY+HKE40
+Cz7PFNm73bZQmq131BnW2hqIyE4bJ3XYsgjxroMwuREOzYfwhI0Vcnyh78zyiGG69Gm7DIwLdVcE
+uE4qFC49DxweMqZiNu5m4iK4BUBjECLzMx10coos9TkpoNPnG4CELcU9402x/RpvumUHO1jsQkUm
++9jaJXLE9gCxInm943xZYkqcBW89zubWR2OZxiRvchLIrH+QtAuRcOi35hYQcRfO3gZPSEF9NUqj
+ifLJS3tBEW1ntwiYTOURGa5CgNz7kAXU+FDKvuStx8KU1xad5hePrzb7AgMBAAGjQjBAMA8GA1Ud
+EwEB/wQFMAMBAf8wHQYDVR0OBBYEFJngGWcNYtt2s9o9uFvo/ULSMQ6HMA4GA1UdDwEB/wQEAwIB
+BjANBgkqhkiG9w0BAQsFAAOCAgEAmHNw4rDT7TnsTGDZqRKGFx6W0OhUKDtkLSGm+J1WE2pIPU/H
+PinbbViDVD2HfSMF1OQc3Og4ZYbFdada2zUFvXfeuyk3QAUHw5RSn8pk3fEbK9xGChACMf1KaA0H
+ZJDmHvUqoai7PF35owgLEQzxPy0QlG/+4jSHg9bP5Rs1bdID4bANqKCqRieCNqcVtgimQlRXtpla
+4gt5kNdXElE1GYhBaCXUNxeEFfsBctyV3lImIJgm4nb1J2/6ADtKYdkNy1GTKv0WBpanI5ojSP5R
+vbbEsLFUzt5sQa0WZ37b/TjNuThOssFgy50X31ieemKyJo90lZvkWx3SD92YHJtZuSPTMaCm/zjd
+zyBP6VhWOmfD0faZmZ26NraAL4hHT4a/RDqA5Dccprrql5gR0IRiR2Qequ5AvzSxnI9O4fKSTx+O
+856X3vOmeWqJcU9LJxdI/uz0UA9PSX3MReO9ekDFQdxhVicGaeVyQYHTtgGJoC86cnn+OjC/QezH
+Yj6RS8fZMXZC+fc8Y+wmjHMMfRod6qh8h6jCJ3zhM0EPz8/8AKAigJ5Kp28AsEFFtyLKaEjFQqKu
+3R3y4G5OBVixwJAWKqQ9EEC+j2Jjg6mcgn0tAumDMHzLJ8n9HmYAsC7TIS+OMxZsmO0QqAfWzJPP
+29FpHOTKyeC2nOnOcXHebD8WpHk=
+-----END CERTIFICATE-----
+
+Trustwave Global ECC P256 Certification Authority
+=================================================
+-----BEGIN CERTIFICATE-----
+MIICYDCCAgegAwIBAgIMDWpfCD8oXD5Rld9dMAoGCCqGSM49BAMCMIGRMQswCQYDVQQGEwJVUzER
+MA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRydXN0d2F2ZSBI
+b2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBFQ0MgUDI1NiBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eTAeFw0xNzA4MjMxOTM1MTBaFw00MjA4MjMxOTM1MTBaMIGRMQswCQYD
+VQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRy
+dXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBFQ0MgUDI1
+NiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABH77bOYj
+43MyCMpg5lOcunSNGLB4kFKA3TjASh3RqMyTpJcGOMoNFWLGjgEqZZ2q3zSRLoHB5DOSMcT9CTqm
+P62jQzBBMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQUo0EGrJBt
+0UrrdaVKEJmzsaGLSvcwCgYIKoZIzj0EAwIDRwAwRAIgB+ZU2g6gWrKuEZ+Hxbb/ad4lvvigtwjz
+RM4q3wghDDcCIC0mA6AFvWvR9lz4ZcyGbbOcNEhjhAnFjXca4syc4XR7
+-----END CERTIFICATE-----
+
+Trustwave Global ECC P384 Certification Authority
+=================================================
+-----BEGIN CERTIFICATE-----
+MIICnTCCAiSgAwIBAgIMCL2Fl2yZJ6SAaEc7MAoGCCqGSM49BAMDMIGRMQswCQYDVQQGEwJVUzER
+MA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRydXN0d2F2ZSBI
+b2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBFQ0MgUDM4NCBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eTAeFw0xNzA4MjMxOTM2NDNaFw00MjA4MjMxOTM2NDNaMIGRMQswCQYD
+VQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRy
+dXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBFQ0MgUDM4
+NCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGvaDXU1CDFH
+Ba5FmVXxERMuSvgQMSOjfoPTfygIOiYaOs+Xgh+AtycJj9GOMMQKmw6sWASr9zZ9lCOkmwqKi6vr
+/TklZvFe/oyujUF5nQlgziip04pt89ZF1PKYhDhloKNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNV
+HQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBRVqYSJ0sEyvRjLbKYHTsjnnb6CkDAKBggqhkjOPQQDAwNn
+ADBkAjA3AZKXRRJ+oPM+rRk6ct30UJMDEr5E0k9BpIycnR+j9sKS50gU/k6bpZFXrsY3crsCMGcl
+CrEMXu6pY5Jv5ZAL/mYiykf9ijH3g/56vxC+GCsej/YpHpRZ744hN8tRmKVuSw==
+-----END CERTIFICATE-----
+
+NAVER Global Root Certification Authority
+=========================================
+-----BEGIN CERTIFICATE-----
+MIIFojCCA4qgAwIBAgIUAZQwHqIL3fXFMyqxQ0Rx+NZQTQ0wDQYJKoZIhvcNAQEMBQAwaTELMAkG
+A1UEBhMCS1IxJjAkBgNVBAoMHU5BVkVSIEJVU0lORVNTIFBMQVRGT1JNIENvcnAuMTIwMAYDVQQD
+DClOQVZFUiBHbG9iYWwgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xNzA4MTgwODU4
+NDJaFw0zNzA4MTgyMzU5NTlaMGkxCzAJBgNVBAYTAktSMSYwJAYDVQQKDB1OQVZFUiBCVVNJTkVT
+UyBQTEFURk9STSBDb3JwLjEyMDAGA1UEAwwpTkFWRVIgR2xvYmFsIFJvb3QgQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC21PGTXLVAiQqrDZBb
+UGOukJR0F0Vy1ntlWilLp1agS7gvQnXp2XskWjFlqxcX0TM62RHcQDaH38dq6SZeWYp34+hInDEW
++j6RscrJo+KfziFTowI2MMtSAuXaMl3Dxeb57hHHi8lEHoSTGEq0n+USZGnQJoViAbbJAh2+g1G7
+XNr4rRVqmfeSVPc0W+m/6imBEtRTkZazkVrd/pBzKPswRrXKCAfHcXLJZtM0l/aM9BhK4dA9WkW2
+aacp+yPOiNgSnABIqKYPszuSjXEOdMWLyEz59JuOuDxp7W87UC9Y7cSw0BwbagzivESq2M0UXZR4
+Yb8ObtoqvC8MC3GmsxY/nOb5zJ9TNeIDoKAYv7vxvvTWjIcNQvcGufFt7QSUqP620wbGQGHfnZ3z
+VHbOUzoBppJB7ASjjw2i1QnK1sua8e9DXcCrpUHPXFNwcMmIpi3Ua2FzUCaGYQ5fG8Ir4ozVu53B
+A0K6lNpfqbDKzE0K70dpAy8i+/Eozr9dUGWokG2zdLAIx6yo0es+nPxdGoMuK8u180SdOqcXYZai
+cdNwlhVNt0xz7hlcxVs+Qf6sdWA7G2POAN3aCJBitOUt7kinaxeZVL6HSuOpXgRM6xBtVNbv8ejy
+YhbLgGvtPe31HzClrkvJE+2KAQHJuFFYwGY6sWZLxNUxAmLpdIQM201GLQIDAQABo0IwQDAdBgNV
+HQ4EFgQU0p+I36HNLL3s9TsBAZMzJ7LrYEswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+Af8wDQYJKoZIhvcNAQEMBQADggIBADLKgLOdPVQG3dLSLvCkASELZ0jKbY7gyKoNqo0hV4/GPnrK
+21HUUrPUloSlWGB/5QuOH/XcChWB5Tu2tyIvCZwTFrFsDDUIbatjcu3cvuzHV+YwIHHW1xDBE1UB
+jCpD5EHxzzp6U5LOogMFDTjfArsQLtk70pt6wKGm+LUx5vR1yblTmXVHIloUFcd4G7ad6Qz4G3bx
+hYTeodoS76TiEJd6eN4MUZeoIUCLhr0N8F5OSza7OyAfikJW4Qsav3vQIkMsRIz75Sq0bBwcupTg
+E34h5prCy8VCZLQelHsIJchxzIdFV4XTnyliIoNRlwAYl3dqmJLJfGBs32x9SuRwTMKeuB330DTH
+D8z7p/8Dvq1wkNoL3chtl1+afwkyQf3NosxabUzyqkn+Zvjp2DXrDige7kgvOtB5CTh8piKCk5XQ
+A76+AqAF3SAi428diDRgxuYKuQl1C/AH6GmWNcf7I4GOODm4RStDeKLRLBT/DShycpWbXgnbiUSY
+qqFJu3FS8r/2/yehNq+4tneI3TqkbZs0kNwUXTC/t+sX5Ie3cdCh13cV1ELX8vMxmV2b3RZtP+oG
+I/hGoiLtk/bdmuYqh7GYVPEi92tF4+KOdh2ajcQGjTa3FPOdVGm3jjzVpG2Tgbet9r1ke8LJaDmg
+kpzNNIaRkPpkUZ3+/uul9XXeifdy
+-----END CERTIFICATE-----
+
+AC RAIZ FNMT-RCM SERVIDORES SEGUROS
+===================================
+-----BEGIN CERTIFICATE-----
+MIICbjCCAfOgAwIBAgIQYvYybOXE42hcG2LdnC6dlTAKBggqhkjOPQQDAzB4MQswCQYDVQQGEwJF
+UzERMA8GA1UECgwIRk5NVC1SQ00xDjAMBgNVBAsMBUNlcmVzMRgwFgYDVQRhDA9WQVRFUy1RMjgy
+NjAwNEoxLDAqBgNVBAMMI0FDIFJBSVogRk5NVC1SQ00gU0VSVklET1JFUyBTRUdVUk9TMB4XDTE4
+MTIyMDA5MzczM1oXDTQzMTIyMDA5MzczM1oweDELMAkGA1UEBhMCRVMxETAPBgNVBAoMCEZOTVQt
+UkNNMQ4wDAYDVQQLDAVDZXJlczEYMBYGA1UEYQwPVkFURVMtUTI4MjYwMDRKMSwwKgYDVQQDDCNB
+QyBSQUlaIEZOTVQtUkNNIFNFUlZJRE9SRVMgU0VHVVJPUzB2MBAGByqGSM49AgEGBSuBBAAiA2IA
+BPa6V1PIyqvfNkpSIeSX0oNnnvBlUdBeh8dHsVnyV0ebAAKTRBdp20LHsbI6GA60XYyzZl2hNPk2
+LEnb80b8s0RpRBNm/dfF/a82Tc4DTQdxz69qBdKiQ1oKUm8BA06Oi6NCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFAG5L++/EYZg8k/QQW6rcx/n0m5JMAoGCCqG
+SM49BAMDA2kAMGYCMQCuSuMrQMN0EfKVrRYj3k4MGuZdpSRea0R7/DjiT8ucRRcRTBQnJlU5dUoD
+zBOQn5ICMQD6SmxgiHPz7riYYqnOK8LZiqZwMR2vsJRM60/G49HzYqc8/5MuB1xJAWdpEgJyv+c=
+-----END CERTIFICATE-----
+
+GlobalSign Root R46
+===================
+-----BEGIN CERTIFICATE-----
+MIIFWjCCA0KgAwIBAgISEdK7udcjGJ5AXwqdLdDfJWfRMA0GCSqGSIb3DQEBDAUAMEYxCzAJBgNV
+BAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYDVQQDExNHbG9iYWxTaWduIFJv
+b3QgUjQ2MB4XDTE5MDMyMDAwMDAwMFoXDTQ2MDMyMDAwMDAwMFowRjELMAkGA1UEBhMCQkUxGTAX
+BgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExHDAaBgNVBAMTE0dsb2JhbFNpZ24gUm9vdCBSNDYwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCsrHQy6LNl5brtQyYdpokNRbopiLKkHWPd08Es
+CVeJOaFV6Wc0dwxu5FUdUiXSE2te4R2pt32JMl8Nnp8semNgQB+msLZ4j5lUlghYruQGvGIFAha/
+r6gjA7aUD7xubMLL1aa7DOn2wQL7Id5m3RerdELv8HQvJfTqa1VbkNud316HCkD7rRlr+/fKYIje
+2sGP1q7Vf9Q8g+7XFkyDRTNrJ9CG0Bwta/OrffGFqfUo0q3v84RLHIf8E6M6cqJaESvWJ3En7YEt
+bWaBkoe0G1h6zD8K+kZPTXhc+CtI4wSEy132tGqzZfxCnlEmIyDLPRT5ge1lFgBPGmSXZgjPjHvj
+K8Cd+RTyG/FWaha/LIWFzXg4mutCagI0GIMXTpRW+LaCtfOW3T3zvn8gdz57GSNrLNRyc0NXfeD4
+12lPFzYE+cCQYDdF3uYM2HSNrpyibXRdQr4G9dlkbgIQrImwTDsHTUB+JMWKmIJ5jqSngiCNI/on
+ccnfxkF0oE32kRbcRoxfKWMxWXEM2G/CtjJ9++ZdU6Z+Ffy7dXxd7Pj2Fxzsx2sZy/N78CsHpdls
+eVR2bJ0cpm4O6XkMqCNqo98bMDGfsVR7/mrLZqrcZdCinkqaByFrgY/bxFn63iLABJzjqls2k+g9
+vXqhnQt2sQvHnf3PmKgGwvgqo6GDoLclcqUC4wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYD
+VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA1yrc4GHqMywptWU4jaWSf8FmSwwDQYJKoZIhvcNAQEM
+BQADggIBAHx47PYCLLtbfpIrXTncvtgdokIzTfnvpCo7RGkerNlFo048p9gkUbJUHJNOxO97k4Vg
+JuoJSOD1u8fpaNK7ajFxzHmuEajwmf3lH7wvqMxX63bEIaZHU1VNaL8FpO7XJqti2kM3S+LGteWy
+gxk6x9PbTZ4IevPuzz5i+6zoYMzRx6Fcg0XERczzF2sUyQQCPtIkpnnpHs6i58FZFZ8d4kuaPp92
+CC1r2LpXFNqD6v6MVenQTqnMdzGxRBF6XLE+0xRFFRhiJBPSy03OXIPBNvIQtQ6IbbjhVp+J3pZm
+OUdkLG5NrmJ7v2B0GbhWrJKsFjLtrWhV/pi60zTe9Mlhww6G9kuEYO4Ne7UyWHmRVSyBQ7N0H3qq
+JZ4d16GLuc1CLgSkZoNNiTW2bKg2SnkheCLQQrzRQDGQob4Ez8pn7fXwgNNgyYMqIgXQBztSvwye
+qiv5u+YfjyW6hY0XHgL+XVAEV8/+LbzvXMAaq7afJMbfc2hIkCwU9D9SGuTSyxTDYWnP4vkYxboz
+nxSjBF25cfe1lNj2M8FawTSLfJvdkzrnE6JwYZ+vj+vYxXX4M2bUdGc6N3ec592kD3ZDZopD8p/7
+DEJ4Y9HiD2971KE9dJeFt0g5QdYg/NA6s/rob8SKunE3vouXsXgxT7PntgMTzlSdriVZzH81Xwj3
+QEUxeCp6
+-----END CERTIFICATE-----
+
+GlobalSign Root E46
+===================
+-----BEGIN CERTIFICATE-----
+MIICCzCCAZGgAwIBAgISEdK7ujNu1LzmJGjFDYQdmOhDMAoGCCqGSM49BAMDMEYxCzAJBgNVBAYT
+AkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYDVQQDExNHbG9iYWxTaWduIFJvb3Qg
+RTQ2MB4XDTE5MDMyMDAwMDAwMFoXDTQ2MDMyMDAwMDAwMFowRjELMAkGA1UEBhMCQkUxGTAXBgNV
+BAoTEEdsb2JhbFNpZ24gbnYtc2ExHDAaBgNVBAMTE0dsb2JhbFNpZ24gUm9vdCBFNDYwdjAQBgcq
+hkjOPQIBBgUrgQQAIgNiAAScDrHPt+ieUnd1NPqlRqetMhkytAepJ8qUuwzSChDH2omwlwxwEwkB
+jtjqR+q+soArzfwoDdusvKSGN+1wCAB16pMLey5SnCNoIwZD7JIvU4Tb+0cUB+hflGddyXqBPCCj
+QjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQxCpCPtsad0kRL
+gLWi5h+xEk8blTAKBggqhkjOPQQDAwNoADBlAjEA31SQ7Zvvi5QCkxeCmb6zniz2C5GMn0oUsfZk
+vLtoURMMA/cVi4RguYv/Uo7njLwcAjA8+RHUjE7AwWHCFUyqqx0LMV87HOIAl0Qx5v5zli/altP+
+CAezNIm8BZ/3Hobui3A=
+-----END CERTIFICATE-----
+
+GLOBALTRUST 2020
+================
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgILWku9WvtPilv6ZeUwDQYJKoZIhvcNAQELBQAwTTELMAkGA1UEBhMCQVQx
+IzAhBgNVBAoTGmUtY29tbWVyY2UgbW9uaXRvcmluZyBHbWJIMRkwFwYDVQQDExBHTE9CQUxUUlVT
+VCAyMDIwMB4XDTIwMDIxMDAwMDAwMFoXDTQwMDYxMDAwMDAwMFowTTELMAkGA1UEBhMCQVQxIzAh
+BgNVBAoTGmUtY29tbWVyY2UgbW9uaXRvcmluZyBHbWJIMRkwFwYDVQQDExBHTE9CQUxUUlVTVCAy
+MDIwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAri5WrRsc7/aVj6B3GyvTY4+ETUWi
+D59bRatZe1E0+eyLinjF3WuvvcTfk0Uev5E4C64OFudBc/jbu9G4UeDLgztzOG53ig9ZYybNpyrO
+VPu44sB8R85gfD+yc/LAGbaKkoc1DZAoouQVBGM+uq/ufF7MpotQsjj3QWPKzv9pj2gOlTblzLmM
+CcpL3TGQlsjMH/1WljTbjhzqLL6FLmPdqqmV0/0plRPwyJiT2S0WR5ARg6I6IqIoV6Lr/sCMKKCm
+fecqQjuCgGOlYx8ZzHyyZqjC0203b+J+BlHZRYQfEs4kUmSFC0iAToexIiIwquuuvuAC4EDosEKA
+A1GqtH6qRNdDYfOiaxaJSaSjpCuKAsR49GiKweR6NrFvG5Ybd0mN1MkGco/PU+PcF4UgStyYJ9OR
+JitHHmkHr96i5OTUawuzXnzUJIBHKWk7buis/UDr2O1xcSvy6Fgd60GXIsUf1DnQJ4+H4xj04KlG
+DfV0OoIu0G4skaMxXDtG6nsEEFZegB31pWXogvziB4xiRfUg3kZwhqG8k9MedKZssCz3AwyIDMvU
+clOGvGBG85hqwvG/Q/lwIHfKN0F5VVJjjVsSn8VoxIidrPIwq7ejMZdnrY8XD2zHc+0klGvIg5rQ
+mjdJBKuxFshsSUktq6HQjJLyQUp5ISXbY9e2nKd+Qmn7OmMCAwEAAaNjMGEwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFNwuH9FhN3nkq9XVsxJxaD1qaJwiMB8GA1Ud
+IwQYMBaAFNwuH9FhN3nkq9XVsxJxaD1qaJwiMA0GCSqGSIb3DQEBCwUAA4ICAQCR8EICaEDuw2jA
+VC/f7GLDw56KoDEoqoOOpFaWEhCGVrqXctJUMHytGdUdaG/7FELYjQ7ztdGl4wJCXtzoRlgHNQIw
+4Lx0SsFDKv/bGtCwr2zD/cuz9X9tAy5ZVp0tLTWMstZDFyySCstd6IwPS3BD0IL/qMy/pJTAvoe9
+iuOTe8aPmxadJ2W8esVCgmxcB9CpwYhgROmYhRZf+I/KARDOJcP5YBugxZfD0yyIMaK9MOzQ0MAS
+8cE54+X1+NZK3TTN+2/BT+MAi1bikvcoskJ3ciNnxz8RFbLEAwW+uxF7Cr+obuf/WEPPm2eggAe2
+HcqtbepBEX4tdJP7wry+UUTF72glJ4DjyKDUEuzZpTcdN3y0kcra1LGWge9oXHYQSa9+pTeAsRxS
+vTOBTI/53WXZFM2KJVj04sWDpQmQ1GwUY7VA3+vA/MRYfg0UFodUJ25W5HCEuGwyEn6CMUO+1918
+oa2u1qsgEu8KwxCMSZY13At1XrFP1U80DhEgB3VDRemjEdqso5nCtnkn4rnvyOL2NSl6dPrFf4IF
+YqYK6miyeUcGbvJXqBUzxvd4Sj1Ce2t+/vdG6tHrju+IaFvowdlxfv1k7/9nR4hYJS8+hge9+6jl
+gqispdNpQ80xiEmEU5LAsTkbOYMBMMTyqfrQA71yN2BWHzZ8vTmR9W0Nv3vXkg==
+-----END CERTIFICATE-----
+
+ANF Secure Server Root CA
+=========================
+-----BEGIN CERTIFICATE-----
+MIIF7zCCA9egAwIBAgIIDdPjvGz5a7EwDQYJKoZIhvcNAQELBQAwgYQxEjAQBgNVBAUTCUc2MzI4
+NzUxMDELMAkGA1UEBhMCRVMxJzAlBgNVBAoTHkFORiBBdXRvcmlkYWQgZGUgQ2VydGlmaWNhY2lv
+bjEUMBIGA1UECxMLQU5GIENBIFJhaXoxIjAgBgNVBAMTGUFORiBTZWN1cmUgU2VydmVyIFJvb3Qg
+Q0EwHhcNMTkwOTA0MTAwMDM4WhcNMzkwODMwMTAwMDM4WjCBhDESMBAGA1UEBRMJRzYzMjg3NTEw
+MQswCQYDVQQGEwJFUzEnMCUGA1UEChMeQU5GIEF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uMRQw
+EgYDVQQLEwtBTkYgQ0EgUmFpejEiMCAGA1UEAxMZQU5GIFNlY3VyZSBTZXJ2ZXIgUm9vdCBDQTCC
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvrayvmZFSVgpCjcqQZAZ2cC4Ffc0m6p6zz
+BE57lgvsEeBbphzOG9INgxwruJ4dfkUyYA8H6XdYfp9qyGFOtibBTI3/TO80sh9l2Ll49a2pcbnv
+T1gdpd50IJeh7WhM3pIXS7yr/2WanvtH2Vdy8wmhrnZEE26cLUQ5vPnHO6RYPUG9tMJJo8gN0pcv
+B2VSAKduyK9o7PQUlrZXH1bDOZ8rbeTzPvY1ZNoMHKGESy9LS+IsJJ1tk0DrtSOOMspvRdOoiXse
+zx76W0OLzc2oD2rKDF65nkeP8Nm2CgtYZRczuSPkdxl9y0oukntPLxB3sY0vaJxizOBQ+OyRp1RM
+VwnVdmPF6GUe7m1qzwmd+nxPrWAI/VaZDxUse6mAq4xhj0oHdkLePfTdsiQzW7i1o0TJrH93PB0j
+7IKppuLIBkwC/qxcmZkLLxCKpvR/1Yd0DVlJRfbwcVw5Kda/SiOL9V8BY9KHcyi1Swr1+KuCLH5z
+JTIdC2MKF4EA/7Z2Xue0sUDKIbvVgFHlSFJnLNJhiQcND85Cd8BEc5xEUKDbEAotlRyBr+Qc5RQe
+8TZBAQIvfXOn3kLMTOmJDVb3n5HUA8ZsyY/b2BzgQJhdZpmYgG4t/wHFzstGH6wCxkPmrqKEPMVO
+Hj1tyRRM4y5Bu8o5vzY8KhmqQYdOpc5LMnndkEl/AgMBAAGjYzBhMB8GA1UdIwQYMBaAFJxf0Gxj
+o1+TypOYCK2Mh6UsXME3MB0GA1UdDgQWBBScX9BsY6Nfk8qTmAitjIelLFzBNzAOBgNVHQ8BAf8E
+BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEATh65isagmD9uw2nAalxJ
+UqzLK114OMHVVISfk/CHGT0sZonrDUL8zPB1hT+L9IBdeeUXZ701guLyPI59WzbLWoAAKfLOKyzx
+j6ptBZNscsdW699QIyjlRRA96Gejrw5VD5AJYu9LWaL2U/HANeQvwSS9eS9OICI7/RogsKQOLHDt
+dD+4E5UGUcjohybKpFtqFiGS3XNgnhAY3jyB6ugYw3yJ8otQPr0R4hUDqDZ9MwFsSBXXiJCZBMXM
+5gf0vPSQ7RPi6ovDj6MzD8EpTBNO2hVWcXNyglD2mjN8orGoGjR0ZVzO0eurU+AagNjqOknkJjCb
+5RyKqKkVMoaZkgoQI1YS4PbOTOK7vtuNknMBZi9iPrJyJ0U27U1W45eZ/zo1PqVUSlJZS2Db7v54
+EX9K3BR5YLZrZAPbFYPhor72I5dQ8AkzNqdxliXzuUJ92zg/LFis6ELhDtjTO0wugumDLmsx2d1H
+hk9tl5EuT+IocTUW0fJz/iUrB0ckYyfI+PbZa/wSMVYIwFNCr5zQM378BvAxRAMU8Vjq8moNqRGy
+g77FGr8H6lnco4g175x2MjxNBiLOFeXdntiP2t7SxDnlF4HPOEfrf4htWRvfn0IUrn7PqLBmZdo3
+r5+qPeoott7VMVgWglvquxl1AnMaykgaIZOQCo6ThKd9OyMYkomgjaw=
+-----END CERTIFICATE-----
+
+Certum EC-384 CA
+================
+-----BEGIN CERTIFICATE-----
+MIICZTCCAeugAwIBAgIQeI8nXIESUiClBNAt3bpz9DAKBggqhkjOPQQDAzB0MQswCQYDVQQGEwJQ
+TDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkxGTAXBgNVBAMTEENlcnR1bSBFQy0zODQgQ0EwHhcNMTgwMzI2
+MDcyNDU0WhcNNDMwMzI2MDcyNDU0WjB0MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERh
+dGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkx
+GTAXBgNVBAMTEENlcnR1bSBFQy0zODQgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATEKI6rGFtq
+vm5kN2PkzeyrOvfMobgOgknXhimfoZTy42B4mIF4Bk3y7JoOV2CDn7TmFy8as10CW4kjPMIRBSqn
+iBMY81CE1700LCeJVf/OTOffph8oxPBUw7l8t1Ot68KjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFI0GZnQkdjrzife81r1HfS+8EF9LMA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNo
+ADBlAjADVS2m5hjEfO/JUG7BJw+ch69u1RsIGL2SKcHvlJF40jocVYli5RsJHrpka/F2tNQCMQC0
+QoSZ/6vnnvuRlydd3LBbMHHOXjgaatkl5+r3YZJW+OraNsKHZZYuciUvf9/DE8k=
+-----END CERTIFICATE-----
+
+Certum Trusted Root CA
+======================
+-----BEGIN CERTIFICATE-----
+MIIFwDCCA6igAwIBAgIQHr9ZULjJgDdMBvfrVU+17TANBgkqhkiG9w0BAQ0FADB6MQswCQYDVQQG
+EwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0g
+Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHzAdBgNVBAMTFkNlcnR1bSBUcnVzdGVkIFJvb3QgQ0Ew
+HhcNMTgwMzE2MTIxMDEzWhcNNDMwMzE2MTIxMDEzWjB6MQswCQYDVQQGEwJQTDEhMB8GA1UEChMY
+QXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkxHzAdBgNVBAMTFkNlcnR1bSBUcnVzdGVkIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQDRLY67tzbqbTeRn06TpwXkKQMlzhyC93yZn0EGze2jusDbCSzBfN8p
+fktlL5On1AFrAygYo9idBcEq2EXxkd7fO9CAAozPOA/qp1x4EaTByIVcJdPTsuclzxFUl6s1wB52
+HO8AU5853BSlLCIls3Jy/I2z5T4IHhQqNwuIPMqw9MjCoa68wb4pZ1Xi/K1ZXP69VyywkI3C7Te2
+fJmItdUDmj0VDT06qKhF8JVOJVkdzZhpu9PMMsmN74H+rX2Ju7pgE8pllWeg8xn2A1bUatMn4qGt
+g/BKEiJ3HAVz4hlxQsDsdUaakFjgao4rpUYwBI4Zshfjvqm6f1bxJAPXsiEodg42MEx51UGamqi4
+NboMOvJEGyCI98Ul1z3G4z5D3Yf+xOr1Uz5MZf87Sst4WmsXXw3Hw09Omiqi7VdNIuJGmj8PkTQk
+fVXjjJU30xrwCSss0smNtA0Aq2cpKNgB9RkEth2+dv5yXMSFytKAQd8FqKPVhJBPC/PgP5sZ0jeJ
+P/J7UhyM9uH3PAeXjA6iWYEMspA90+NZRu0PqafegGtaqge2Gcu8V/OXIXoMsSt0Puvap2ctTMSY
+njYJdmZm/Bo/6khUHL4wvYBQv3y1zgD2DGHZ5yQD4OMBgQ692IU0iL2yNqh7XAjlRICMb/gv1SHK
+HRzQ+8S1h9E6Tsd2tTVItQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSM+xx1
+vALTn04uSNn5YFSqxLNP+jAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIBAEii1QAL
+LtA/vBzVtVRJHlpr9OTy4EA34MwUe7nJ+jW1dReTagVphZzNTxl4WxmB82M+w85bj/UvXgF2Ez8s
+ALnNllI5SW0ETsXpD4YN4fqzX4IS8TrOZgYkNCvozMrnadyHncI013nR03e4qllY/p0m+jiGPp2K
+h2RX5Rc64vmNueMzeMGQ2Ljdt4NR5MTMI9UGfOZR0800McD2RrsLrfw9EAUqO0qRJe6M1ISHgCq8
+CYyqOhNf6DR5UMEQGfnTKB7U0VEwKbOukGfWHwpjscWpxkIxYxeU72nLL/qMFH3EQxiJ2fAyQOaA
+4kZf5ePBAFmo+eggvIksDkc0C+pXwlM2/KfUrzHN/gLldfq5Jwn58/U7yn2fqSLLiMmq0Uc9Nneo
+WWRrJ8/vJ8HjJLWG965+Mk2weWjROeiQWMODvA8s1pfrzgzhIMfatz7DP78v3DSk+yshzWePS/Tj
+6tQ/50+6uaWTRRxmHyH6ZF5v4HaUMst19W7l9o/HuKTMqJZ9ZPskWkoDbGs4xugDQ5r3V7mzKWmT
+OPQD8rv7gmsHINFSH5pkAnuYZttcTVoP0ISVoDwUQwbKytu4QTbaakRnh6+v40URFWkIsr4WOZck
+bxJF0WddCajJFdr60qZfE2Efv4WstK2tBZQIgx51F9NxO5NQI1mg7TyRVJ12AMXDuDjb
+-----END CERTIFICATE-----
+
+TunTrust Root CA
+================
+-----BEGIN CERTIFICATE-----
+MIIFszCCA5ugAwIBAgIUEwLV4kBMkkaGFmddtLu7sms+/BMwDQYJKoZIhvcNAQELBQAwYTELMAkG
+A1UEBhMCVE4xNzA1BgNVBAoMLkFnZW5jZSBOYXRpb25hbGUgZGUgQ2VydGlmaWNhdGlvbiBFbGVj
+dHJvbmlxdWUxGTAXBgNVBAMMEFR1blRydXN0IFJvb3QgQ0EwHhcNMTkwNDI2MDg1NzU2WhcNNDQw
+NDI2MDg1NzU2WjBhMQswCQYDVQQGEwJUTjE3MDUGA1UECgwuQWdlbmNlIE5hdGlvbmFsZSBkZSBD
+ZXJ0aWZpY2F0aW9uIEVsZWN0cm9uaXF1ZTEZMBcGA1UEAwwQVHVuVHJ1c3QgUm9vdCBDQTCCAiIw
+DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMPN0/y9BFPdDCA61YguBUtB9YOCfvdZn56eY+hz
+2vYGqU8ftPkLHzmMmiDQfgbU7DTZhrx1W4eI8NLZ1KMKsmwb60ksPqxd2JQDoOw05TDENX37Jk0b
+bjBU2PWARZw5rZzJJQRNmpA+TkBuimvNKWfGzC3gdOgFVwpIUPp6Q9p+7FuaDmJ2/uqdHYVy7BG7
+NegfJ7/Boce7SBbdVtfMTqDhuazb1YMZGoXRlJfXyqNlC/M4+QKu3fZnz8k/9YosRxqZbwUN/dAd
+gjH8KcwAWJeRTIAAHDOFli/LQcKLEITDCSSJH7UP2dl3RxiSlGBcx5kDPP73lad9UKGAwqmDrViW
+VSHbhlnUr8a83YFuB9tgYv7sEG7aaAH0gxupPqJbI9dkxt/con3YS7qC0lH4Zr8GRuR5KiY2eY8f
+Tpkdso8MDhz/yV3A/ZAQprE38806JG60hZC/gLkMjNWb1sjxVj8agIl6qeIbMlEsPvLfe/ZdeikZ
+juXIvTZxi11Mwh0/rViizz1wTaZQmCXcI/m4WEEIcb9PuISgjwBUFfyRbVinljvrS5YnzWuioYas
+DXxU5mZMZl+QviGaAkYt5IPCgLnPSz7ofzwB7I9ezX/SKEIBlYrilz0QIX32nRzFNKHsLA4KUiwS
+VXAkPcvCFDVDXSdOvsC9qnyW5/yeYa1E0wCXAgMBAAGjYzBhMB0GA1UdDgQWBBQGmpsfU33x9aTI
+04Y+oXNZtPdEITAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFAaamx9TffH1pMjThj6hc1m0
+90QhMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAqgVutt0Vyb+zxiD2BkewhpMl
+0425yAA/l/VSJ4hxyXT968pk21vvHl26v9Hr7lxpuhbI87mP0zYuQEkHDVneixCwSQXi/5E/S7fd
+Ao74gShczNxtr18UnH1YeA32gAm56Q6XKRm4t+v4FstVEuTGfbvE7Pi1HE4+Z7/FXxttbUcoqgRY
+YdZ2vyJ/0Adqp2RT8JeNnYA/u8EH22Wv5psymsNUk8QcCMNE+3tjEUPRahphanltkE8pjkcFwRJp
+adbGNjHh/PqAulxPxOu3Mqz4dWEX1xAZufHSCe96Qp1bWgvUxpVOKs7/B9dPfhgGiPEZtdmYu65x
+xBzndFlY7wyJz4sfdZMaBBSSSFCp61cpABbjNhzI+L/wM9VBD8TMPN3pM0MBkRArHtG5Xc0yGYuP
+jCB31yLEQtyEFpslbei0VXF/sHyz03FJuc9SpAQ/3D2gu68zngowYI7bnV2UqL1g52KAdoGDDIzM
+MEZJ4gzSqK/rYXHv5yJiqfdcZGyfFoxnNidF9Ql7v/YQCvGwjVRDjAS6oz/v4jXH+XTgbzRB0L9z
+ZVcg+ZtnemZoJE6AZb0QmQZZ8mWvuMZHu/2QeItBcy6vVR/cO5JyboTT0GFMDcx2V+IthSIVNg3r
+AZ3r2OvEhJn7wAzMMujjd9qDRIueVSjAi1jTkD5OGwDxFa2DK5o=
+-----END CERTIFICATE-----
+
+HARICA TLS RSA Root CA 2021
+===========================
+-----BEGIN CERTIFICATE-----
+MIIFpDCCA4ygAwIBAgIQOcqTHO9D88aOk8f0ZIk4fjANBgkqhkiG9w0BAQsFADBsMQswCQYDVQQG
+EwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9u
+cyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0EgUm9vdCBDQSAyMDIxMB4XDTIxMDIxOTEwNTUz
+OFoXDTQ1MDIxMzEwNTUzN1owbDELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRl
+bWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgUlNB
+IFJvb3QgQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIvC569lmwVnlskN
+JLnQDmT8zuIkGCyEf3dRywQRNrhe7Wlxp57kJQmXZ8FHws+RFjZiPTgE4VGC/6zStGndLuwRo0Xu
+a2s7TL+MjaQenRG56Tj5eg4MmOIjHdFOY9TnuEFE+2uva9of08WRiFukiZLRgeaMOVig1mlDqa2Y
+Ulhu2wr7a89o+uOkXjpFc5gH6l8Cct4MpbOfrqkdtx2z/IpZ525yZa31MJQjB/OCFks1mJxTuy/K
+5FrZx40d/JiZ+yykgmvwKh+OC19xXFyuQnspiYHLA6OZyoieC0AJQTPb5lh6/a6ZcMBaD9YThnEv
+dmn8kN3bLW7R8pv1GmuebxWMevBLKKAiOIAkbDakO/IwkfN4E8/BPzWr8R0RI7VDIp4BkrcYAuUR
+0YLbFQDMYTfBKnya4dC6s1BG7oKsnTH4+yPiAwBIcKMJJnkVU2DzOFytOOqBAGMUuTNe3QvboEUH
+GjMJ+E20pwKmafTCWQWIZYVWrkvL4N48fS0ayOn7H6NhStYqE613TBoYm5EPWNgGVMWX+Ko/IIqm
+haZ39qb8HOLubpQzKoNQhArlT4b4UEV4AIHrW2jjJo3Me1xR9BQsQL4aYB16cmEdH2MtiKrOokWQ
+CPxrvrNQKlr9qEgYRtaQQJKQCoReaDH46+0N0x3GfZkYVVYnZS6NRcUk7M7jAgMBAAGjQjBAMA8G
+A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFApII6ZgpJIKM+qTW8VX6iVNvRLuMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAPpBIqm5iFSVmewzVjIuJndftTgfvnNAUX15QvWiWkKQU
+EapobQk1OUAJ2vQJLDSle1mESSmXdMgHHkdt8s4cUCbjnj1AUz/3f5Z2EMVGpdAgS1D0NTsY9FVq
+QRtHBmg8uwkIYtlfVUKqrFOFrJVWNlar5AWMxajaH6NpvVMPxP/cyuN+8kyIhkdGGvMA9YCRotxD
+QpSbIPDRzbLrLFPCU3hKTwSUQZqPJzLB5UkZv/HywouoCjkxKLR9YjYsTewfM7Z+d21+UPCfDtcR
+j88YxeMn/ibvBZ3PzzfF0HvaO7AWhAw6k9a+F9sPPg4ZeAnHqQJyIkv3N3a6dcSFA1pj1bF1BcK5
+vZStjBWZp5N99sXzqnTPBIWUmAD04vnKJGW/4GKvyMX6ssmeVkjaef2WdhW+o45WxLM0/L5H9MG0
+qPzVMIho7suuyWPEdr6sOBjhXlzPrjoiUevRi7PzKzMHVIf6tLITe7pTBGIBnfHAT+7hOtSLIBD6
+Alfm78ELt5BGnBkpjNxvoEppaZS3JGWg/6w/zgH7IS79aPib8qXPMThcFarmlwDB31qlpzmq6YR/
+PFGoOtmUW4y/Twhx5duoXNTSpv4Ao8YWxw/ogM4cKGR0GQjTQuPOAF1/sdwTsOEFy9EgqoZ0njnn
+kf3/W9b3raYvAwtt41dU63ZTGI0RmLo=
+-----END CERTIFICATE-----
+
+HARICA TLS ECC Root CA 2021
+===========================
+-----BEGIN CERTIFICATE-----
+MIICVDCCAdugAwIBAgIQZ3SdjXfYO2rbIvT/WeK/zjAKBggqhkjOPQQDAzBsMQswCQYDVQQGEwJH
+UjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBD
+QTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9vdCBDQSAyMDIxMB4XDTIxMDIxOTExMDExMFoX
+DTQ1MDIxMzExMDEwOVowbDELMAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWlj
+IGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgRUNDIFJv
+b3QgQ0EgMjAyMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDgI/rGgltJ6rK9JOtDA4MM7KKrxcm1l
+AEeIhPyaJmuqS7psBAqIXhfyVYf8MLA04jRYVxqEU+kw2anylnTDUR9YSTHMmE5gEYd103KUkE+b
+ECUqqHgtvpBBWJAVcqeht6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUyRtTgRL+BNUW
+0aq8mm+3oJUZbsowDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2cAMGQCMBHervjcToiwqfAi
+rcJRQO9gcS3ujwLEXQNwSaSS6sUUiHCm0w2wqsosQJz76YJumgIwK0eaB8bRwoF8yguWGEEbo/Qw
+CZ61IygNnxS2PFOiTAZpffpskcYqSUXm7LcT4Tps
+-----END CERTIFICATE-----
+
+Autoridad de Certificacion Firmaprofesional CIF A62634068
+=========================================================
+-----BEGIN CERTIFICATE-----
+MIIGFDCCA/ygAwIBAgIIG3Dp0v+ubHEwDQYJKoZIhvcNAQELBQAwUTELMAkGA1UEBhMCRVMxQjBA
+BgNVBAMMOUF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1hcHJvZmVzaW9uYWwgQ0lGIEE2
+MjYzNDA2ODAeFw0xNDA5MjMxNTIyMDdaFw0zNjA1MDUxNTIyMDdaMFExCzAJBgNVBAYTAkVTMUIw
+QAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNhY2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBB
+NjI2MzQwNjgwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKlmuO6vj78aI14H9M2uDD
+Utd9thDIAl6zQyrET2qyyhxdKJp4ERppWVevtSBC5IsP5t9bpgOSL/UR5GLXMnE42QQMcas9UX4P
+B99jBVzpv5RvwSmCwLTaUbDBPLutN0pcyvFLNg4kq7/DhHf9qFD0sefGL9ItWY16Ck6WaVICqjaY
+7Pz6FIMMNx/Jkjd/14Et5cS54D40/mf0PmbR0/RAz15iNA9wBj4gGFrO93IbJWyTdBSTo3OxDqqH
+ECNZXyAFGUftaI6SEspd/NYrspI8IM/hX68gvqB2f3bl7BqGYTM+53u0P6APjqK5am+5hyZvQWyI
+plD9amML9ZMWGxmPsu2bm8mQ9QEM3xk9Dz44I8kvjwzRAv4bVdZO0I08r0+k8/6vKtMFnXkIoctX
+MbScyJCyZ/QYFpM6/EfY0XiWMR+6KwxfXZmtY4laJCB22N/9q06mIqqdXuYnin1oKaPnirjaEbsX
+LZmdEyRG98Xi2J+Of8ePdG1asuhy9azuJBCtLxTa/y2aRnFHvkLfuwHb9H/TKI8xWVvTyQKmtFLK
+bpf7Q8UIJm+K9Lv9nyiqDdVF8xM6HdjAeI9BZzwelGSuewvF6NkBiDkal4ZkQdU7hwxu+g/GvUgU
+vzlN1J5Bto+WHWOWk9mVBngxaJ43BjuAiUVhOSPHG0SjFeUc+JIwuwIDAQABo4HvMIHsMB0GA1Ud
+DgQWBBRlzeurNR4APn7VdMActHNHDhpkLzASBgNVHRMBAf8ECDAGAQH/AgEBMIGmBgNVHSAEgZ4w
+gZswgZgGBFUdIAAwgY8wLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuZmlybWFwcm9mZXNpb25hbC5j
+b20vY3BzMFwGCCsGAQUFBwICMFAeTgBQAGEAcwBlAG8AIABkAGUAIABsAGEAIABCAG8AbgBhAG4A
+bwB2AGEAIAA0ADcAIABCAGEAcgBjAGUAbABvAG4AYQAgADAAOAAwADEANzAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQELBQADggIBAHSHKAIrdx9miWTtj3QuRhy7qPj4Cx2Dtjqn6EWKB7fgPiDL
+4QjbEwj4KKE1soCzC1HA01aajTNFSa9J8OA9B3pFE1r/yJfY0xgsfZb43aJlQ3CTkBW6kN/oGbDb
+LIpgD7dvlAceHabJhfa9NPhAeGIQcDq+fUs5gakQ1JZBu/hfHAsdCPKxsIl68veg4MSPi3i1O1il
+I45PVf42O+AMt8oqMEEgtIDNrvx2ZnOorm7hfNoD6JQg5iKj0B+QXSBTFCZX2lSX3xZEEAEeiGaP
+cjiT3SC3NL7X8e5jjkd5KAb881lFJWAiMxujX6i6KtoaPc1A6ozuBRWV1aUsIC+nmCjuRfzxuIgA
+LI9C2lHVnOUTaHFFQ4ueCyE8S1wF3BqfmI7avSKecs2tCsvMo2ebKHTEm9caPARYpoKdrcd7b/+A
+lun4jWq9GJAd/0kakFI3ky88Al2CdgtR5xbHV/g4+afNmyJU72OwFW1TZQNKXkqgsqeOSQBZONXH
+9IBk9W6VULgRfhVwOEqwf9DEMnDAGf/JOC0ULGb0QkTmVXYbgBVX/8Cnp6o5qtjTcNAuuuuUavpf
+NIbnYrX9ivAwhZTJryQCL2/W3Wf+47BVTwSYT6RBVuKT0Gro1vP7ZeDOdcQxWQzugsgMYDNKGbqE
+ZycPvEJdvSRUDewdcAZfpLz6IHxV
+-----END CERTIFICATE-----
+
+vTrus ECC Root CA
+=================
+-----BEGIN CERTIFICATE-----
+MIICDzCCAZWgAwIBAgIUbmq8WapTvpg5Z6LSa6Q75m0c1towCgYIKoZIzj0EAwMwRzELMAkGA1UE
+BhMCQ04xHDAaBgNVBAoTE2lUcnVzQ2hpbmEgQ28uLEx0ZC4xGjAYBgNVBAMTEXZUcnVzIEVDQyBS
+b290IENBMB4XDTE4MDczMTA3MjY0NFoXDTQzMDczMTA3MjY0NFowRzELMAkGA1UEBhMCQ04xHDAa
+BgNVBAoTE2lUcnVzQ2hpbmEgQ28uLEx0ZC4xGjAYBgNVBAMTEXZUcnVzIEVDQyBSb290IENBMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEZVBKrox5lkqqHAjDo6LN/llWQXf9JpRCux3NCNtzslt188+c
+ToL0v/hhJoVs1oVbcnDS/dtitN9Ti72xRFhiQgnH+n9bEOf+QP3A2MMrMudwpremIFUde4BdS49n
+TPEQo0IwQDAdBgNVHQ4EFgQUmDnNvtiyjPeyq+GtJK97fKHbH88wDwYDVR0TAQH/BAUwAwEB/zAO
+BgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwMDaAAwZQIwV53dVvHH4+m4SVBrm2nDb+zDfSXkV5UT
+QJtS0zvzQBm8JsctBp61ezaf9SXUY2sAAjEA6dPGnlaaKsyh2j/IZivTWJwghfqrkYpwcBE4YGQL
+YgmRWAD5Tfs0aNoJrSEGGJTO
+-----END CERTIFICATE-----
+
+vTrus Root CA
+=============
+-----BEGIN CERTIFICATE-----
+MIIFVjCCAz6gAwIBAgIUQ+NxE9izWRRdt86M/TX9b7wFjUUwDQYJKoZIhvcNAQELBQAwQzELMAkG
+A1UEBhMCQ04xHDAaBgNVBAoTE2lUcnVzQ2hpbmEgQ28uLEx0ZC4xFjAUBgNVBAMTDXZUcnVzIFJv
+b3QgQ0EwHhcNMTgwNzMxMDcyNDA1WhcNNDMwNzMxMDcyNDA1WjBDMQswCQYDVQQGEwJDTjEcMBoG
+A1UEChMTaVRydXNDaGluYSBDby4sTHRkLjEWMBQGA1UEAxMNdlRydXMgUm9vdCBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAL1VfGHTuB0EYgWgrmy3cLRB6ksDXhA/kFocizuwZots
+SKYcIrrVQJLuM7IjWcmOvFjai57QGfIvWcaMY1q6n6MLsLOaXLoRuBLpDLvPbmyAhykUAyyNJJrI
+ZIO1aqwTLDPxn9wsYTwaP3BVm60AUn/PBLn+NvqcwBauYv6WTEN+VRS+GrPSbcKvdmaVayqwlHeF
+XgQPYh1jdfdr58tbmnDsPmcF8P4HCIDPKNsFxhQnL4Z98Cfe/+Z+M0jnCx5Y0ScrUw5XSmXX+6KA
+YPxMvDVTAWqXcoKv8R1w6Jz1717CbMdHflqUhSZNO7rrTOiwCcJlwp2dCZtOtZcFrPUGoPc2BX70
+kLJrxLT5ZOrpGgrIDajtJ8nU57O5q4IikCc9Kuh8kO+8T/3iCiSn3mUkpF3qwHYw03dQ+A0Em5Q2
+AXPKBlim0zvc+gRGE1WKyURHuFE5Gi7oNOJ5y1lKCn+8pu8fA2dqWSslYpPZUxlmPCdiKYZNpGvu
+/9ROutW04o5IWgAZCfEF2c6Rsffr6TlP9m8EQ5pV9T4FFL2/s1m02I4zhKOQUqqzApVg+QxMaPnu
+1RcN+HFXtSXkKe5lXa/R7jwXC1pDxaWG6iSe4gUH3DRCEpHWOXSuTEGC2/KmSNGzm/MzqvOmwMVO
+9fSddmPmAsYiS8GVP1BkLFTltvA8Kc9XAgMBAAGjQjBAMB0GA1UdDgQWBBRUYnBj8XWEQ1iO0RYg
+scasGrz2iTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOC
+AgEAKbqSSaet8PFww+SX8J+pJdVrnjT+5hpk9jprUrIQeBqfTNqK2uwcN1LgQkv7bHbKJAs5EhWd
+nxEt/Hlk3ODg9d3gV8mlsnZwUKT+twpw1aA08XXXTUm6EdGz2OyC/+sOxL9kLX1jbhd47F18iMjr
+jld22VkE+rxSH0Ws8HqA7Oxvdq6R2xCOBNyS36D25q5J08FsEhvMKar5CKXiNxTKsbhm7xqC5PD4
+8acWabfbqWE8n/Uxy+QARsIvdLGx14HuqCaVvIivTDUHKgLKeBRtRytAVunLKmChZwOgzoy8sHJn
+xDHO2zTlJQNgJXtxmOTAGytfdELSS8VZCAeHvsXDf+eW2eHcKJfWjwXj9ZtOyh1QRwVTsMo554Wg
+icEFOwE30z9J4nfrI8iIZjs9OXYhRvHsXyO466JmdXTBQPfYaJqT4i2pLr0cox7IdMakLXogqzu4
+sEb9b91fUlV1YvCXoHzXOP0l382gmxDPi7g4Xl7FtKYCNqEeXxzP4padKar9mK5S4fNBUvupLnKW
+nyfjqnN9+BojZns7q2WwMgFLFT49ok8MKzWixtlnEjUwzXYuFrOZnk1PTi07NEPhmg4NpGaXutIc
+SkwsKouLgU9xGqndXHt7CMUADTdA43x7VF8vhV929vensBxXVsFy6K2ir40zSbofitzmdHxghm+H
+l3s=
+-----END CERTIFICATE-----
+
+ISRG Root X2
+============
+-----BEGIN CERTIFICATE-----
+MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQswCQYDVQQGEwJV
+UzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElT
+UkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00MDA5MTcxNjAwMDBaME8xCzAJBgNVBAYTAlVT
+MSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNS
+RyBSb290IFgyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
+ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9ItgKbppb
+d9/w+kHsOdx1ymgHDB/qo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
+HQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwCgYIKoZIzj0EAwMDaAAwZQIwe3lORlCEwkSHRhtF
+cP9Ymd70/aTSVaYgLXTWNLxBo1BfASdWtL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5
+U6VR5CmD1/iQMVtCnwr1/q4AaOeMSQ+2b1tbFfLn
+-----END CERTIFICATE-----
+
+HiPKI Root CA - G1
+==================
+-----BEGIN CERTIFICATE-----
+MIIFajCCA1KgAwIBAgIQLd2szmKXlKFD6LDNdmpeYDANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQG
+EwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0ZC4xGzAZBgNVBAMMEkhpUEtJ
+IFJvb3QgQ0EgLSBHMTAeFw0xOTAyMjIwOTQ2MDRaFw0zNzEyMzExNTU5NTlaME8xCzAJBgNVBAYT
+AlRXMSMwIQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEbMBkGA1UEAwwSSGlQS0kg
+Um9vdCBDQSAtIEcxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9B5/UnMyDHPkvRN0
+o9QwqNCuS9i233VHZvR85zkEHmpwINJaR3JnVfSl6J3VHiGh8Ge6zCFovkRTv4354twvVcg3Px+k
+wJyz5HdcoEb+d/oaoDjq7Zpy3iu9lFc6uux55199QmQ5eiY29yTw1S+6lZgRZq2XNdZ1AYDgr/SE
+YYwNHl98h5ZeQa/rh+r4XfEuiAU+TCK72h8q3VJGZDnzQs7ZngyzsHeXZJzA9KMuH5UHsBffMNsA
+GJZMoYFL3QRtU6M9/Aes1MU3guvklQgZKILSQjqj2FPseYlgSGDIcpJQ3AOPgz+yQlda22rpEZfd
+hSi8MEyr48KxRURHH+CKFgeW0iEPU8DtqX7UTuybCeyvQqww1r/REEXgphaypcXTT3OUM3ECoWqj
+1jOXTyFjHluP2cFeRXF3D4FdXyGarYPM+l7WjSNfGz1BryB1ZlpK9p/7qxj3ccC2HTHsOyDry+K4
+9a6SsvfhhEvyovKTmiKe0xRvNlS9H15ZFblzqMF8b3ti6RZsR1pl8w4Rm0bZ/W3c1pzAtH2lsN0/
+Vm+h+fbkEkj9Bn8SV7apI09bA8PgcSojt/ewsTu8mL3WmKgMa/aOEmem8rJY5AIJEzypuxC00jBF
+8ez3ABHfZfjcK0NVvxaXxA/VLGGEqnKG/uY6fsI/fe78LxQ+5oXdUG+3Se0CAwEAAaNCMEAwDwYD
+VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU8ncX+l6o/vY9cdVouslGDDjYr7AwDgYDVR0PAQH/BAQD
+AgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBQUfB13HAE4/+qddRxosuej6ip0691x1TPOhwEmSKsxBHi
+7zNKpiMdDg1H2DfHb680f0+BazVP6XKlMeJ45/dOlBhbQH3PayFUhuaVevvGyuqcSE5XCV0vrPSl
+tJczWNWseanMX/mF+lLFjfiRFOs6DRfQUsJ748JzjkZ4Bjgs6FzaZsT0pPBWGTMpWmWSBUdGSquE
+wx4noR8RkpkndZMPvDY7l1ePJlsMu5wP1G4wB9TcXzZoZjmDlicmisjEOf6aIW/Vcobpf2Lll07Q
+JNBAsNB1CI69aO4I1258EHBGG3zgiLKecoaZAeO/n0kZtCW+VmWuF2PlHt/o/0elv+EmBYTksMCv
+5wiZqAxeJoBF1PhoL5aPruJKHJwWDBNvOIf2u8g0X5IDUXlwpt/L9ZlNec1OvFefQ05rLisY+Gpz
+jLrFNe85akEez3GoorKGB1s6yeHvP2UEgEcyRHCVTjFnanRbEEV16rCf0OY1/k6fi8wrkkVbbiVg
+hUbN0aqwdmaTd5a+g744tiROJgvM7XpWGuDpWsZkrUx6AEhEL7lAuxM+vhV4nYWBSipX3tUZQ9rb
+yltHhoMLP7YNdnhzeSJesYAfz77RP1YQmCuVh6EfnWQUYDksswBVLuT1sw5XxJFBAJw/6KXf6vb/
+yPCtbVKoF6ubYfwSUTXkJf2vqmqGOQ==
+-----END CERTIFICATE-----
+
+GlobalSign ECC Root CA - R4
+===========================
+-----BEGIN CERTIFICATE-----
+MIIB3DCCAYOgAwIBAgINAgPlfvU/k/2lCSGypjAKBggqhkjOPQQDAjBQMSQwIgYDVQQLExtHbG9i
+YWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkds
+b2JhbFNpZ24wHhcNMTIxMTEzMDAwMDAwWhcNMzgwMTE5MDMxNDA3WjBQMSQwIgYDVQQLExtHbG9i
+YWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkds
+b2JhbFNpZ24wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS4xnnTj2wlDp8uORkcA6SumuU5BwkW
+ymOxuYb4ilfBV85C+nOh92VC/x7BALJucw7/xyHlGKSq2XE/qNS5zowdo0IwQDAOBgNVHQ8BAf8E
+BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVLB7rUW44kB/+wpu+74zyTyjhNUwCgYI
+KoZIzj0EAwIDRwAwRAIgIk90crlgr/HmnKAWBVBfw147bmF0774BxL4YSFlhgjICICadVGNA3jdg
+UM/I2O2dgq43mLyjj0xMqTQrbO/7lZsm
+-----END CERTIFICATE-----
+
+GTS Root R1
+===========
+-----BEGIN CERTIFICATE-----
+MIIFVzCCAz+gAwIBAgINAgPlk28xsBNJiGuiFzANBgkqhkiG9w0BAQwFADBHMQswCQYDVQQGEwJV
+UzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3Qg
+UjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UE
+ChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaM
+f/vo27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vXmX7wCl7raKb0
+xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7zUjwTcLCeoiKu7rPWRnWr4+w
+B7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0PfyblqAj+lug8aJRT7oM6iCsVlgmy4HqMLnXW
+nOunVmSPlk9orj2XwoSPwLxAwAtcvfaHszVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk
+9+aCEI3oncKKiPo4Zor8Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zq
+kUspzBmkMiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOORc92wO1A
+K/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYWk70paDPvOmbsB4om3xPX
+V2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+DVrNVjzRlwW5y0vtOUucxD/SVRNuJLDW
+cfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgFlQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQAD
+ggIBAJ+qQibbC5u+/x6Wki4+omVKapi6Ist9wTrYggoGxval3sBOh2Z5ofmmWJyq+bXmYOfg6LEe
+QkEzCzc9zolwFcq1JKjPa7XSQCGYzyI0zzvFIoTgxQ6KfF2I5DUkzps+GlQebtuyh6f88/qBVRRi
+ClmpIgUxPoLW7ttXNLwzldMXG+gnoot7TiYaelpkttGsN/H9oPM47HLwEXWdyzRSjeZ2axfG34ar
+J45JK3VmgRAhpuo+9K4l/3wV3s6MJT/KYnAK9y8JZgfIPxz88NtFMN9iiMG1D53Dn0reWVlHxYci
+NuaCp+0KueIHoI17eko8cdLiA6EfMgfdG+RCzgwARWGAtQsgWSl4vflVy2PFPEz0tv/bal8xa5me
+LMFrUKTX5hgUvYU/Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJF
+fbdT6u9AWpQKXCBfTkBdYiJ23//OYb2MI3jSNwLgjt7RETeJ9r/tSQdirpLsQBqvFAnZ0E6yove+
+7u7Y/9waLd64NnHi/Hm3lCXRSHNboTXns5lndcEZOitHTtNCjv0xyBZm2tIMPNuzjsmhDYAPexZ3
+FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bbbP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3
+gm3c
+-----END CERTIFICATE-----
+
+GTS Root R2
+===========
+-----BEGIN CERTIFICATE-----
+MIIFVzCCAz+gAwIBAgINAgPlrsWNBCUaqxElqjANBgkqhkiG9w0BAQwFADBHMQswCQYDVQQGEwJV
+UzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3Qg
+UjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UE
+ChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3Lv
+CvptnfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3KgGjSY6Dlo7JUl
+e3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9BuXvAuMC6C/Pq8tBcKSOWIm8Wb
+a96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOdre7kRXuJVfeKH2JShBKzwkCX44ofR5GmdFrS
++LFjKBC4swm4VndAoiaYecb+3yXuPuWgf9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7M
+kogwTZq9TwtImoS1mKPV+3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJG
+r61K8YzodDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqjx5RWIr9q
+S34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsRnTKaG73VululycslaVNV
+J1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0kzCqgc7dGtxRcw1PcOnlthYhGXmy5okL
+dWTK1au8CcEYof/UVKGFPP0UJAOyh9OktwIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQAD
+ggIBAB/Kzt3HvqGf2SdMC9wXmBFqiN495nFWcrKeGk6c1SuYJF2ba3uwM4IJvd8lRuqYnrYb/oM8
+0mJhwQTtzuDFycgTE1XnqGOtjHsB/ncw4c5omwX4Eu55MaBBRTUoCnGkJE+M3DyCB19m3H0Q/gxh
+swWV7uGugQ+o+MePTagjAiZrHYNSVc61LwDKgEDg4XSsYPWHgJ2uNmSRXbBoGOqKYcl3qJfEycel
+/FVL8/B/uWU9J2jQzGv6U53hkRrJXRqWbTKH7QMgyALOWr7Z6v2yTcQvG99fevX4i8buMTolUVVn
+jWQye+mew4K6Ki3pHrTgSAai/GevHyICc/sgCq+dVEuhzf9gR7A/Xe8bVr2XIZYtCtFenTgCR2y5
+9PYjJbigapordwj6xLEokCZYCDzifqrXPW+6MYgKBesntaFJ7qBFVHvmJ2WZICGoo7z7GJa7Um8M
+7YNRTOlZ4iBgxcJlkoKM8xAfDoqXvneCbT+PHV28SSe9zE8P4c52hgQjxcCMElv924SgJPFI/2R8
+0L5cFtHvma3AH/vLrrw4IgYmZNralw4/KBVEqE8AyvCazM90arQ+POuV7LXTWtiBmelDGDfrs7vR
+WGJB82bSj6p4lVQgw1oudCvV0b4YacCs1aTPObpRhANl6WLAYv7YTVWW4tAR+kg0Eeye7QUd5MjW
+HYbL
+-----END CERTIFICATE-----
+
+GTS Root R3
+===========
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEi
+MCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMw
+HhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZ
+R29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjO
+PQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout
+736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBA
+MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/Eq
+Er24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azT
+L818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV
+11RZt+cRLInUue4X
+-----END CERTIFICATE-----
+
+GTS Root R4
+===========
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEi
+MCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQw
+HhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZ
+R29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjO
+PQIBBgUrgQQAIgNiAATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzu
+hXyiQHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvRHYqjQjBA
+MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSATNbrdP9JNqPV2Py1
+PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/C
+r8deVl5c1RxYIigL9zC2L7F8AjEA8GE8p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh
+4rsUecrNIdSUtUlD
+-----END CERTIFICATE-----
+
+Telia Root CA v2
+================
+-----BEGIN CERTIFICATE-----
+MIIFdDCCA1ygAwIBAgIPAWdfJ9b+euPkrL4JWwWeMA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYT
+AkZJMRowGAYDVQQKDBFUZWxpYSBGaW5sYW5kIE95ajEZMBcGA1UEAwwQVGVsaWEgUm9vdCBDQSB2
+MjAeFw0xODExMjkxMTU1NTRaFw00MzExMjkxMTU1NTRaMEQxCzAJBgNVBAYTAkZJMRowGAYDVQQK
+DBFUZWxpYSBGaW5sYW5kIE95ajEZMBcGA1UEAwwQVGVsaWEgUm9vdCBDQSB2MjCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBALLQPwe84nvQa5n44ndp586dpAO8gm2h/oFlH0wnrI4AuhZ7
+6zBqAMCzdGh+sq/H1WKzej9Qyow2RCRj0jbpDIX2Q3bVTKFgcmfiKDOlyzG4OiIjNLh9vVYiQJ3q
+9HsDrWj8soFPmNB06o3lfc1jw6P23pLCWBnglrvFxKk9pXSW/q/5iaq9lRdU2HhE8Qx3FZLgmEKn
+pNaqIJLNwaCzlrI6hEKNfdWV5Nbb6WLEWLN5xYzTNTODn3WhUidhOPFZPY5Q4L15POdslv5e2QJl
+tI5c0BE0312/UqeBAMN/mUWZFdUXyApT7GPzmX3MaRKGwhfwAZ6/hLzRUssbkmbOpFPlob/E2wnW
+5olWK8jjfN7j/4nlNW4o6GwLI1GpJQXrSPjdscr6bAhR77cYbETKJuFzxokGgeWKrLDiKca5JLNr
+RBH0pUPCTEPlcDaMtjNXepUugqD0XBCzYYP2AgWGLnwtbNwDRm41k9V6lS/eINhbfpSQBGq6WT0E
+BXWdN6IOLj3rwaRSg/7Qa9RmjtzG6RJOHSpXqhC8fF6CfaamyfItufUXJ63RDolUK5X6wK0dmBR4
+M0KGCqlztft0DbcbMBnEWg4cJ7faGND/isgFuvGqHKI3t+ZIpEYslOqodmJHixBTB0hXbOKSTbau
+BcvcwUpej6w9GU7C7WB1K9vBykLVAgMBAAGjYzBhMB8GA1UdIwQYMBaAFHKs5DN5qkWH9v2sHZ7W
+xy+G2CQ5MB0GA1UdDgQWBBRyrOQzeapFh/b9rB2e1scvhtgkOTAOBgNVHQ8BAf8EBAMCAQYwDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAoDtZpwmUPjaE0n4vOaWWl/oRrfxn83EJ
+8rKJhGdEr7nv7ZbsnGTbMjBvZ5qsfl+yqwE2foH65IRe0qw24GtixX1LDoJt0nZi0f6X+J8wfBj5
+tFJ3gh1229MdqfDBmgC9bXXYfef6xzijnHDoRnkDry5023X4blMMA8iZGok1GTzTyVR8qPAs5m4H
+eW9q4ebqkYJpCh3DflminmtGFZhb069GHWLIzoBSSRE/yQQSwxN8PzuKlts8oB4KtItUsiRnDe+C
+y748fdHif64W1lZYudogsYMVoe+KTTJvQS8TUoKU1xrBeKJR3Stwbbca+few4GeXVtt8YVMJAygC
+QMez2P2ccGrGKMOF6eLtGpOg3kuYooQ+BXcBlj37tCAPnHICehIv1aO6UXivKitEZU61/Qrowc15
+h2Er3oBXRb9n8ZuRXqWk7FlIEA04x7D6w0RtBPV4UBySllva9bguulvP5fBqnUsvWHMtTy3EHD70
+sz+rFQ47GUGKpMFXEmZxTPpT41frYpUJnlTd0cI8Vzy9OK2YZLe4A5pTVmBds9hCG1xLEooc6+t9
+xnppxyd/pPiL8uSUZodL6ZQHCRJ5irLrdATczvREWeAWysUsWNc8e89ihmpQfTU2Zqf7N+cox9jQ
+raVplI/owd8k+BsHMYeB2F326CjYSlKArBPuUBQemMc=
+-----END CERTIFICATE-----
+
+D-TRUST BR Root CA 1 2020
+=========================
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAmCgAwIBAgIQfMmPK4TX3+oPyWWa00tNljAKBggqhkjOPQQDAzBIMQswCQYDVQQGEwJE
+RTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSIwIAYDVQQDExlELVRSVVNUIEJSIFJvb3QgQ0EgMSAy
+MDIwMB4XDTIwMDIxMTA5NDUwMFoXDTM1MDIxMTA5NDQ1OVowSDELMAkGA1UEBhMCREUxFTATBgNV
+BAoTDEQtVHJ1c3QgR21iSDEiMCAGA1UEAxMZRC1UUlVTVCBCUiBSb290IENBIDEgMjAyMDB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABMbLxyjR+4T1mu9CFCDhQ2tuda38KwOE1HaTJddZO0Flax7mNCq7
+dPYSzuht56vkPE4/RAiLzRZxy7+SmfSk1zxQVFKQhYN4lGdnoxwJGT11NIXe7WB9xwy0QVK5buXu
+QqOCAQ0wggEJMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHOREKv/VbNafAkl1bK6CKBrqx9t
+MA4GA1UdDwEB/wQEAwIBBjCBxgYDVR0fBIG+MIG7MD6gPKA6hjhodHRwOi8vY3JsLmQtdHJ1c3Qu
+bmV0L2NybC9kLXRydXN0X2JyX3Jvb3RfY2FfMV8yMDIwLmNybDB5oHegdYZzbGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwQlIlMjBSb290JTIwQ0ElMjAxJTIwMjAyMCxP
+PUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDAKBggqhkjOPQQD
+AwNpADBmAjEAlJAtE/rhY/hhY+ithXhUkZy4kzg+GkHaQBZTQgjKL47xPoFWwKrY7RjEsK70Pvom
+AjEA8yjixtsrmfu3Ubgko6SUeho/5jbiA1czijDLgsfWFBHVdWNbFJWcHwHP2NVypw87
+-----END CERTIFICATE-----
+
+D-TRUST EV Root CA 1 2020
+=========================
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAmCgAwIBAgIQXwJB13qHfEwDo6yWjfv/0DAKBggqhkjOPQQDAzBIMQswCQYDVQQGEwJE
+RTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSIwIAYDVQQDExlELVRSVVNUIEVWIFJvb3QgQ0EgMSAy
+MDIwMB4XDTIwMDIxMTEwMDAwMFoXDTM1MDIxMTA5NTk1OVowSDELMAkGA1UEBhMCREUxFTATBgNV
+BAoTDEQtVHJ1c3QgR21iSDEiMCAGA1UEAxMZRC1UUlVTVCBFViBSb290IENBIDEgMjAyMDB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABPEL3YZDIBnfl4XoIkqbz52Yv7QFJsnL46bSj8WeeHsxiamJrSc8
+ZRCC/N/DnU7wMyPE0jL1HLDfMxddxfCxivnvubcUyilKwg+pf3VlSSowZ/Rk99Yad9rDwpdhQntJ
+raOCAQ0wggEJMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFH8QARY3OqQo5FD4pPfsazK2/umL
+MA4GA1UdDwEB/wQEAwIBBjCBxgYDVR0fBIG+MIG7MD6gPKA6hjhodHRwOi8vY3JsLmQtdHJ1c3Qu
+bmV0L2NybC9kLXRydXN0X2V2X3Jvb3RfY2FfMV8yMDIwLmNybDB5oHegdYZzbGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwRVYlMjBSb290JTIwQ0ElMjAxJTIwMjAyMCxP
+PUQtVHJ1c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDAKBggqhkjOPQQD
+AwNpADBmAjEAyjzGKnXCXnViOTYAYFqLwZOZzNnbQTs7h5kXO9XMT8oi96CAy/m0sRtW9XLS/BnR
+AjEAkfcwkz8QRitxpNA7RJvAKQIFskF3UfN5Wp6OFKBOQtJbgfM0agPnIjhQW+0ZT0MW
+-----END CERTIFICATE-----
+
+DigiCert TLS ECC P384 Root G5
+=============================
+-----BEGIN CERTIFICATE-----
+MIICGTCCAZ+gAwIBAgIQCeCTZaz32ci5PhwLBCou8zAKBggqhkjOPQQDAzBOMQswCQYDVQQGEwJV
+UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xJjAkBgNVBAMTHURpZ2lDZXJ0IFRMUyBFQ0MgUDM4
+NCBSb290IEc1MB4XDTIxMDExNTAwMDAwMFoXDTQ2MDExNDIzNTk1OVowTjELMAkGA1UEBhMCVVMx
+FzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMSYwJAYDVQQDEx1EaWdpQ2VydCBUTFMgRUNDIFAzODQg
+Um9vdCBHNTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMFEoc8Rl1Ca3iOCNQfN0MsYndLxf3c1Tzvd
+lHJS7cI7+Oz6e2tYIOyZrsn8aLN1udsJ7MgT9U7GCh1mMEy7H0cKPGEQQil8pQgO4CLp0zVozptj
+n4S1mU1YoI71VOeVyaNCMEAwHQYDVR0OBBYEFMFRRVBZqz7nLFr6ICISB4CIfBFqMA4GA1UdDwEB
+/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQCJao1H5+z8blUD2Wds
+Jk6Dxv3J+ysTvLd6jLRl0mlpYxNjOyZQLgGheQaRnUi/wr4CMEfDFXuxoJGZSZOoPHzoRgaLLPIx
+AJSdYsiJvRmEFOml+wG4DXZDjC5Ty3zfDBeWUA==
+-----END CERTIFICATE-----
+
+DigiCert TLS RSA4096 Root G5
+============================
+-----BEGIN CERTIFICATE-----
+MIIFZjCCA06gAwIBAgIQCPm0eKj6ftpqMzeJ3nzPijANBgkqhkiG9w0BAQwFADBNMQswCQYDVQQG
+EwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xJTAjBgNVBAMTHERpZ2lDZXJ0IFRMUyBSU0E0
+MDk2IFJvb3QgRzUwHhcNMjEwMTE1MDAwMDAwWhcNNDYwMTE0MjM1OTU5WjBNMQswCQYDVQQGEwJV
+UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xJTAjBgNVBAMTHERpZ2lDZXJ0IFRMUyBSU0E0MDk2
+IFJvb3QgRzUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCz0PTJeRGd/fxmgefM1eS8
+7IE+ajWOLrfn3q/5B03PMJ3qCQuZvWxX2hhKuHisOjmopkisLnLlvevxGs3npAOpPxG02C+JFvuU
+AT27L/gTBaF4HI4o4EXgg/RZG5Wzrn4DReW+wkL+7vI8toUTmDKdFqgpwgscONyfMXdcvyej/Ces
+tyu9dJsXLfKB2l2w4SMXPohKEiPQ6s+d3gMXsUJKoBZMpG2T6T867jp8nVid9E6P/DsjyG244gXa
+zOvswzH016cpVIDPRFtMbzCe88zdH5RDnU1/cHAN1DrRN/BsnZvAFJNY781BOHW8EwOVfH/jXOnV
+DdXifBBiqmvwPXbzP6PosMH976pXTayGpxi0KcEsDr9kvimM2AItzVwv8n/vFfQMFawKsPHTDU9q
+TXeXAaDxZre3zu/O7Oyldcqs4+Fj97ihBMi8ez9dLRYiVu1ISf6nL3kwJZu6ay0/nTvEF+cdLvvy
+z6b84xQslpghjLSR6Rlgg/IwKwZzUNWYOwbpx4oMYIwo+FKbbuH2TbsGJJvXKyY//SovcfXWJL5/
+MZ4PbeiPT02jP/816t9JXkGPhvnxd3lLG7SjXi/7RgLQZhNeXoVPzthwiHvOAbWWl9fNff2C+MIk
+wcoBOU+NosEUQB+cZtUMCUbW8tDRSHZWOkPLtgoRObqME2wGtZ7P6wIDAQABo0IwQDAdBgNVHQ4E
+FgQUUTMc7TZArxfTJc1paPKvTiM+s0EwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQEMBQADggIBAGCmr1tfV9qJ20tQqcQjNSH/0GEwhJG3PxDPJY7Jv0Y02cEhJhxw
+GXIeo8mH/qlDZJY6yFMECrZBu8RHANmfGBg7sg7zNOok992vIGCukihfNudd5N7HPNtQOa27PShN
+lnx2xlv0wdsUpasZYgcYQF+Xkdycx6u1UQ3maVNVzDl92sURVXLFO4uJ+DQtpBflF+aZfTCIITfN
+MBc9uPK8qHWgQ9w+iUuQrm0D4ByjoJYJu32jtyoQREtGBzRj7TG5BO6jm5qu5jF49OokYTurWGT/
+u4cnYiWB39yhL/btp/96j1EuMPikAdKFOV8BmZZvWltwGUb+hmA+rYAQCd05JS9Yf7vSdPD3Rh9G
+OUrYU9DzLjtxpdRv/PNn5AeP3SYZ4Y1b+qOTEZvpyDrDVWiakuFSdjjo4bq9+0/V77PnSIMx8IIh
+47a+p6tv75/fTM8BuGJqIz3nCU2AG3swpMPdB380vqQmsvZB6Akd4yCYqjdP//fx4ilwMUc/dNAU
+FvohigLVigmUdy7yWSiLfFCSCmZ4OIN1xLVaqBHG5cGdZlXPU8Sv13WFqUITVuwhd4GTWgzqltlJ
+yqEI8pc7bZsEGCREjnwB8twl2F6GmrE52/WRMmrRpnCKovfepEWFJqgejF0pW8hL2JpqA15w8oVP
+bEtoL8pU9ozaMv7Da4M/OMZ+
+-----END CERTIFICATE-----
+
+Certainly Root R1
+=================
+-----BEGIN CERTIFICATE-----
+MIIFRzCCAy+gAwIBAgIRAI4P+UuQcWhlM1T01EQ5t+AwDQYJKoZIhvcNAQELBQAwPTELMAkGA1UE
+BhMCVVMxEjAQBgNVBAoTCUNlcnRhaW5seTEaMBgGA1UEAxMRQ2VydGFpbmx5IFJvb3QgUjEwHhcN
+MjEwNDAxMDAwMDAwWhcNNDYwNDAxMDAwMDAwWjA9MQswCQYDVQQGEwJVUzESMBAGA1UEChMJQ2Vy
+dGFpbmx5MRowGAYDVQQDExFDZXJ0YWlubHkgUm9vdCBSMTCCAiIwDQYJKoZIhvcNAQEBBQADggIP
+ADCCAgoCggIBANA21B/q3avk0bbm+yLA3RMNansiExyXPGhjZjKcA7WNpIGD2ngwEc/csiu+kr+O
+5MQTvqRoTNoCaBZ0vrLdBORrKt03H2As2/X3oXyVtwxwhi7xOu9S98zTm/mLvg7fMbedaFySpvXl
+8wo0tf97ouSHocavFwDvA5HtqRxOcT3Si2yJ9HiG5mpJoM610rCrm/b01C7jcvk2xusVtyWMOvwl
+DbMicyF0yEqWYZL1LwsYpfSt4u5BvQF5+paMjRcCMLT5r3gajLQ2EBAHBXDQ9DGQilHFhiZ5shGI
+XsXwClTNSaa/ApzSRKft43jvRl5tcdF5cBxGX1HpyTfcX35pe0HfNEXgO4T0oYoKNp43zGJS4YkN
+KPl6I7ENPT2a/Z2B7yyQwHtETrtJ4A5KVpK8y7XdeReJkd5hiXSSqOMyhb5OhaRLWcsrxXiOcVTQ
+AjeZjOVJ6uBUcqQRBi8LjMFbvrWhsFNunLhgkR9Za/kt9JQKl7XsxXYDVBtlUrpMklZRNaBA2Cnb
+rlJ2Oy0wQJuK0EJWtLeIAaSHO1OWzaMWj/Nmqhexx2DgwUMFDO6bW2BvBlyHWyf5QBGenDPBt+U1
+VwV/J84XIIwc/PH72jEpSe31C4SnT8H2TsIonPru4K8H+zMReiFPCyEQtkA6qyI6BJyLm4SGcprS
+p6XEtHWRqSsjAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBTgqj8ljZ9EXME66C6ud0yEPmcM9DANBgkqhkiG9w0BAQsFAAOCAgEAuVevuBLaV4OPaAsz
+HQNTVfSVcOQrPbA56/qJYv331hgELyE03fFo8NWWWt7CgKPBjcZq91l3rhVkz1t5BXdm6ozTaw3d
+8VkswTOlMIAVRQdFGjEitpIAq5lNOo93r6kiyi9jyhXWx8bwPWz8HA2YEGGeEaIi1wrykXprOQ4v
+MMM2SZ/g6Q8CRFA3lFV96p/2O7qUpUzpvD5RtOjKkjZUbVwlKNrdrRT90+7iIgXr0PK3aBLXWopB
+GsaSpVo7Y0VPv+E6dyIvXL9G+VoDhRNCX8reU9ditaY1BMJH/5n9hN9czulegChB8n3nHpDYT3Y+
+gjwN/KUD+nsa2UUeYNrEjvn8K8l7lcUq/6qJ34IxD3L/DCfXCh5WAFAeDJDBlrXYFIW7pw0WwfgH
+JBu6haEaBQmAupVjyTrsJZ9/nbqkRxWbRHDxakvWOF5D8xh+UG7pWijmZeZ3Gzr9Hb4DJqPb1OG7
+fpYnKx3upPvaJVQTA945xsMfTZDsjxtK0hzthZU4UHlG1sGQUDGpXJpuHfUzVounmdLyyCwzk5Iw
+x06MZTMQZBf9JBeW0Y3COmor6xOLRPIh80oat3df1+2IpHLlOR+Vnb5nwXARPbv0+Em34yaXOp/S
+X3z7wJl8OSngex2/DaeP0ik0biQVy96QXr8axGbqwua6OV+KmalBWQewLK8=
+-----END CERTIFICATE-----
+
+Certainly Root E1
+=================
+-----BEGIN CERTIFICATE-----
+MIIB9zCCAX2gAwIBAgIQBiUzsUcDMydc+Y2aub/M+DAKBggqhkjOPQQDAzA9MQswCQYDVQQGEwJV
+UzESMBAGA1UEChMJQ2VydGFpbmx5MRowGAYDVQQDExFDZXJ0YWlubHkgUm9vdCBFMTAeFw0yMTA0
+MDEwMDAwMDBaFw00NjA0MDEwMDAwMDBaMD0xCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlDZXJ0YWlu
+bHkxGjAYBgNVBAMTEUNlcnRhaW5seSBSb290IEUxMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3m/4
+fxzf7flHh4axpMCK+IKXgOqPyEpeKn2IaKcBYhSRJHpcnqMXfYqGITQYUBsQ3tA3SybHGWCA6TS9
+YBk2QNYphwk8kXr2vBMj3VlOBF7PyAIcGFPBMdjaIOlEjeR2o0IwQDAOBgNVHQ8BAf8EBAMCAQYw
+DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU8ygYy2R17ikq6+2uI1g4hevIIgcwCgYIKoZIzj0E
+AwMDaAAwZQIxALGOWiDDshliTd6wT99u0nCK8Z9+aozmut6Dacpps6kFtZaSF4fC0urQe87YQVt8
+rgIwRt7qy12a7DLCZRawTDBcMPPaTnOGBtjOiQRINzf43TNRnXCve1XYAS59BWQOhriR
+-----END CERTIFICATE-----
+
+E-Tugra Global Root CA RSA v3
+=============================
+-----BEGIN CERTIFICATE-----
+MIIF8zCCA9ugAwIBAgIUDU3FzRYilZYIfrgLfxUGNPt5EDQwDQYJKoZIhvcNAQELBQAwgYAxCzAJ
+BgNVBAYTAlRSMQ8wDQYDVQQHEwZBbmthcmExGTAXBgNVBAoTEEUtVHVncmEgRUJHIEEuUy4xHTAb
+BgNVBAsTFEUtVHVncmEgVHJ1c3QgQ2VudGVyMSYwJAYDVQQDEx1FLVR1Z3JhIEdsb2JhbCBSb290
+IENBIFJTQSB2MzAeFw0yMDAzMTgwOTA3MTdaFw00NTAzMTIwOTA3MTdaMIGAMQswCQYDVQQGEwJU
+UjEPMA0GA1UEBxMGQW5rYXJhMRkwFwYDVQQKExBFLVR1Z3JhIEVCRyBBLlMuMR0wGwYDVQQLExRF
+LVR1Z3JhIFRydXN0IENlbnRlcjEmMCQGA1UEAxMdRS1UdWdyYSBHbG9iYWwgUm9vdCBDQSBSU0Eg
+djMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCiZvCJt3J77gnJY9LTQ91ew6aEOErx
+jYG7FL1H6EAX8z3DeEVypi6Q3po61CBxyryfHUuXCscxuj7X/iWpKo429NEvx7epXTPcMHD4QGxL
+sqYxYdE0PD0xesevxKenhOGXpOhL9hd87jwH7eKKV9y2+/hDJVDqJ4GohryPUkqWOmAalrv9c/SF
+/YP9f4RtNGx/ardLAQO/rWm31zLZ9Vdq6YaCPqVmMbMWPcLzJmAy01IesGykNz709a/r4d+ABs8q
+QedmCeFLl+d3vSFtKbZnwy1+7dZ5ZdHPOrbRsV5WYVB6Ws5OUDGAA5hH5+QYfERaxqSzO8bGwzrw
+bMOLyKSRBfP12baqBqG3q+Sx6iEUXIOk/P+2UNOMEiaZdnDpwA+mdPy70Bt4znKS4iicvObpCdg6
+04nmvi533wEKb5b25Y08TVJ2Glbhc34XrD2tbKNSEhhw5oBOM/J+JjKsBY04pOZ2PJ8QaQ5tndLB
+eSBrW88zjdGUdjXnXVXHt6woq0bM5zshtQoK5EpZ3IE1S0SVEgpnpaH/WwAH0sDM+T/8nzPyAPiM
+bIedBi3x7+PmBvrFZhNb/FAHnnGGstpvdDDPk1Po3CLW3iAfYY2jLqN4MpBs3KwytQXk9TwzDdbg
+h3cXTJ2w2AmoDVf3RIXwyAS+XF1a4xeOVGNpf0l0ZAWMowIDAQABo2MwYTAPBgNVHRMBAf8EBTAD
+AQH/MB8GA1UdIwQYMBaAFLK0ruYt9ybVqnUtdkvAG1Mh0EjvMB0GA1UdDgQWBBSytK7mLfcm1ap1
+LXZLwBtTIdBI7zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAImocn+M684uGMQQ
+gC0QDP/7FM0E4BQ8Tpr7nym/Ip5XuYJzEmMmtcyQ6dIqKe6cLcwsmb5FJ+Sxce3kOJUxQfJ9emN4
+38o2Fi+CiJ+8EUdPdk3ILY7r3y18Tjvarvbj2l0Upq7ohUSdBm6O++96SmotKygY/r+QLHUWnw/q
+ln0F7psTpURs+APQ3SPh/QMSEgj0GDSz4DcLdxEBSL9htLX4GdnLTeqjjO/98Aa1bZL0SmFQhO3s
+SdPkvmjmLuMxC1QLGpLWgti2omU8ZgT5Vdps+9u1FGZNlIM7zR6mK7L+d0CGq+ffCsn99t2HVhjY
+sCxVYJb6CH5SkPVLpi6HfMsg2wY+oF0Dd32iPBMbKaITVaA9FCKvb7jQmhty3QUBjYZgv6Rn7rWl
+DdF/5horYmbDB7rnoEgcOMPpRfunf/ztAmgayncSd6YAVSgU7NbHEqIbZULpkejLPoeJVF3Zr52X
+nGnnCv8PWniLYypMfUeUP95L6VPQMPHF9p5J3zugkaOj/s1YzOrfr28oO6Bpm4/srK4rVJ2bBLFH
+IK+WEj5jlB0E5y67hscMmoi/dkfv97ALl2bSRM9gUgfh1SxKOidhd8rXj+eHDjD/DLsE4mHDosiX
+YY60MGo8bcIHX0pzLz/5FooBZu+6kcpSV3uu1OYP3Qt6f4ueJiDPO++BcYNZ
+-----END CERTIFICATE-----
+
+E-Tugra Global Root CA ECC v3
+=============================
+-----BEGIN CERTIFICATE-----
+MIICpTCCAiqgAwIBAgIUJkYZdzHhT28oNt45UYbm1JeIIsEwCgYIKoZIzj0EAwMwgYAxCzAJBgNV
+BAYTAlRSMQ8wDQYDVQQHEwZBbmthcmExGTAXBgNVBAoTEEUtVHVncmEgRUJHIEEuUy4xHTAbBgNV
+BAsTFEUtVHVncmEgVHJ1c3QgQ2VudGVyMSYwJAYDVQQDEx1FLVR1Z3JhIEdsb2JhbCBSb290IENB
+IEVDQyB2MzAeFw0yMDAzMTgwOTQ2NThaFw00NTAzMTIwOTQ2NThaMIGAMQswCQYDVQQGEwJUUjEP
+MA0GA1UEBxMGQW5rYXJhMRkwFwYDVQQKExBFLVR1Z3JhIEVCRyBBLlMuMR0wGwYDVQQLExRFLVR1
+Z3JhIFRydXN0IENlbnRlcjEmMCQGA1UEAxMdRS1UdWdyYSBHbG9iYWwgUm9vdCBDQSBFQ0MgdjMw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAASOmCm/xxAeJ9urA8woLNheSBkQKczLWYHMjLiSF4mDKpL2
+w6QdTGLVn9agRtwcvHbB40fQWxPa56WzZkjnIZpKT4YKfWzqTTKACrJ6CZtpS5iB4i7sAnCWH/31
+Rs7K3IKjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU/4Ixcj75xGZsrTie0bBRiKWQ
+zPUwHQYDVR0OBBYEFP+CMXI++cRmbK04ntGwUYilkMz1MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjO
+PQQDAwNpADBmAjEA5gVYaWHlLcoNy/EZCL3W/VGSGn5jVASQkZo1kTmZ+gepZpO6yGjUij/67W4W
+Aie3AjEA3VoXK3YdZUKWpqxdinlW2Iob35reX8dQj7FbcQwm32pAAOwzkSFxvmjkI6TZraE3
+-----END CERTIFICATE-----
+
+Security Communication RootCA3
+==============================
+-----BEGIN CERTIFICATE-----
+MIIFfzCCA2egAwIBAgIJAOF8N0D9G/5nMA0GCSqGSIb3DQEBDAUAMF0xCzAJBgNVBAYTAkpQMSUw
+IwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENPLixMVEQuMScwJQYDVQQDEx5TZWN1cml0eSBD
+b21tdW5pY2F0aW9uIFJvb3RDQTMwHhcNMTYwNjE2MDYxNzE2WhcNMzgwMTE4MDYxNzE2WjBdMQsw
+CQYDVQQGEwJKUDElMCMGA1UEChMcU0VDT00gVHJ1c3QgU3lzdGVtcyBDTy4sTFRELjEnMCUGA1UE
+AxMeU2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBSb290Q0EzMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEA48lySfcw3gl8qUCBWNO0Ot26YQ+TUG5pPDXC7ltzkBtnTCHsXzW7OT4rCmDvu20r
+hvtxosis5FaU+cmvsXLUIKx00rgVrVH+hXShuRD+BYD5UpOzQD11EKzAlrenfna84xtSGc4RHwsE
+NPXY9Wk8d/Nk9A2qhd7gCVAEF5aEt8iKvE1y/By7z/MGTfmfZPd+pmaGNXHIEYBMwXFAWB6+oHP2
+/D5Q4eAvJj1+XCO1eXDe+uDRpdYMQXF79+qMHIjH7Iv10S9VlkZ8WjtYO/u62C21Jdp6Ts9EriGm
+npjKIG58u4iFW/vAEGK78vknR+/RiTlDxN/e4UG/VHMgly1s2vPUB6PmudhvrvyMGS7TZ2crldtY
+XLVqAvO4g160a75BflcJdURQVc1aEWEhCmHCqYj9E7wtiS/NYeCVvsq1e+F7NGcLH7YMx3weGVPK
+p7FKFSBWFHA9K4IsD50VHUeAR/94mQ4xr28+j+2GaR57GIgUssL8gjMunEst+3A7caoreyYn8xrC
+3PsXuKHqy6C0rtOUfnrQq8PsOC0RLoi/1D+tEjtCrI8Cbn3M0V9hvqG8OmpI6iZVIhZdXw3/JzOf
+GAN0iltSIEdrRU0id4xVJ/CvHozJgyJUt5rQT9nO/NkuHJYosQLTA70lUhw0Zk8jq/R3gpYd0Vcw
+CBEF/VfR2ccCAwEAAaNCMEAwHQYDVR0OBBYEFGQUfPxYchamCik0FW8qy7z8r6irMA4GA1UdDwEB
+/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQDcAiMI4u8hOscNtybS
+YpOnpSNyByCCYN8Y11StaSWSntkUz5m5UoHPrmyKO1o5yGwBQ8IibQLwYs1OY0PAFNr0Y/Dq9HHu
+Tofjcan0yVflLl8cebsjqodEV+m9NU1Bu0soo5iyG9kLFwfl9+qd9XbXv8S2gVj/yP9kaWJ5rW4O
+H3/uHWnlt3Jxs/6lATWUVCvAUm2PVcTJ0rjLyjQIUYWg9by0F1jqClx6vWPGOi//lkkZhOpn2ASx
+YfQAW0q3nHE3GYV5v4GwxxMOdnE+OoAGrgYWp421wsTL/0ClXI2lyTrtcoHKXJg80jQDdwj98ClZ
+XSEIx2C/pHF7uNkegr4Jr2VvKKu/S7XuPghHJ6APbw+LP6yVGPO5DtxnVW5inkYO0QR4ynKudtml
++LLfiAlhi+8kTtFZP1rUPcmTPCtk9YENFpb3ksP+MW/oKjJ0DvRMmEoYDjBU1cXrvMUVnuiZIesn
+KwkK2/HmcBhWuwzkvvnoEKQTkrgc4NtnHVMDpCKn3F2SEDzq//wbEBrD2NCcnWXL0CsnMQMeNuE9
+dnUM/0Umud1RvCPHX9jYhxBAEg09ODfnRDwYwFMJZI//1ZqmfHAuc1Uh6N//g7kdPjIe1qZ9LPFm
+6Vwdp6POXiUyK+OVrCoHzrQoeIY8LaadTdJ0MN1kURXbg4NR16/9M51NZg==
+-----END CERTIFICATE-----
+
+Security Communication ECC RootCA1
+==================================
+-----BEGIN CERTIFICATE-----
+MIICODCCAb6gAwIBAgIJANZdm7N4gS7rMAoGCCqGSM49BAMDMGExCzAJBgNVBAYTAkpQMSUwIwYD
+VQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENPLixMVEQuMSswKQYDVQQDEyJTZWN1cml0eSBDb21t
+dW5pY2F0aW9uIEVDQyBSb290Q0ExMB4XDTE2MDYxNjA1MTUyOFoXDTM4MDExODA1MTUyOFowYTEL
+MAkGA1UEBhMCSlAxJTAjBgNVBAoTHFNFQ09NIFRydXN0IFN5c3RlbXMgQ08uLExURC4xKzApBgNV
+BAMTIlNlY3VyaXR5IENvbW11bmljYXRpb24gRUNDIFJvb3RDQTEwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAASkpW9gAwPDvTH00xecK4R1rOX9PVdu12O/5gSJko6BnOPpR27KkBLIE+CnnfdldB9sELLo
+5OnvbYUymUSxXv3MdhDYW72ixvnWQuRXdtyQwjWpS4g8EkdtXP9JTxpKULGjQjBAMB0GA1UdDgQW
+BBSGHOf+LaVKiwj+KBH6vqNm+GBZLzAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAwNoADBlAjAVXUI9/Lbu9zuxNuie9sRGKEkz0FhDKmMpzE2xtHqiuQ04pV1IKv3L
+snNdo4gIxwwCMQDAqy0Obe0YottT6SXbVQjgUMzfRGEWgqtJsLKB7HOHeLRMsmIbEvoWTSVLY70e
+N9k=
+-----END CERTIFICATE-----
diff --git a/curl-8.0.1_9-win64-mingw/bin/curl.exe b/curl-8.0.1_9-win64-mingw/bin/curl.exe
new file mode 100644
index 0000000..37d302b
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/bin/curl.exe differ
diff --git a/curl-8.0.1_9-win64-mingw/bin/libcurl-x64.def b/curl-8.0.1_9-win64-mingw/bin/libcurl-x64.def
new file mode 100644
index 0000000..5aea1cb
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/bin/libcurl-x64.def
@@ -0,0 +1,92 @@
+EXPORTS
+ curl_easy_cleanup @1
+ curl_easy_duphandle @2
+ curl_easy_escape @3
+ curl_easy_getinfo @4
+ curl_easy_header @5
+ curl_easy_init @6
+ curl_easy_nextheader @7
+ curl_easy_option_by_id @8
+ curl_easy_option_by_name @9
+ curl_easy_option_next @10
+ curl_easy_pause @11
+ curl_easy_perform @12
+ curl_easy_recv @13
+ curl_easy_reset @14
+ curl_easy_send @15
+ curl_easy_setopt @16
+ curl_easy_strerror @17
+ curl_easy_unescape @18
+ curl_easy_upkeep @19
+ curl_escape @20
+ curl_formadd @21
+ curl_formfree @22
+ curl_formget @23
+ curl_free @24
+ curl_getdate @25
+ curl_getenv @26
+ curl_global_cleanup @27
+ curl_global_init @28
+ curl_global_init_mem @29
+ curl_global_sslset @30
+ curl_maprintf @31
+ curl_mfprintf @32
+ curl_mime_addpart @33
+ curl_mime_data @34
+ curl_mime_data_cb @35
+ curl_mime_encoder @36
+ curl_mime_filedata @37
+ curl_mime_filename @38
+ curl_mime_free @39
+ curl_mime_headers @40
+ curl_mime_init @41
+ curl_mime_name @42
+ curl_mime_subparts @43
+ curl_mime_type @44
+ curl_mprintf @45
+ curl_msnprintf @46
+ curl_msprintf @47
+ curl_multi_add_handle @48
+ curl_multi_assign @49
+ curl_multi_cleanup @50
+ curl_multi_fdset @51
+ curl_multi_info_read @52
+ curl_multi_init @53
+ curl_multi_perform @54
+ curl_multi_poll @55
+ curl_multi_remove_handle @56
+ curl_multi_setopt @57
+ curl_multi_socket @58
+ curl_multi_socket_action @59
+ curl_multi_socket_all @60
+ curl_multi_strerror @61
+ curl_multi_timeout @62
+ curl_multi_wait @63
+ curl_multi_wakeup @64
+ curl_mvaprintf @65
+ curl_mvfprintf @66
+ curl_mvprintf @67
+ curl_mvsnprintf @68
+ curl_mvsprintf @69
+ curl_pushheader_byname @70
+ curl_pushheader_bynum @71
+ curl_share_cleanup @72
+ curl_share_init @73
+ curl_share_setopt @74
+ curl_share_strerror @75
+ curl_slist_append @76
+ curl_slist_free_all @77
+ curl_strequal @78
+ curl_strnequal @79
+ curl_unescape @80
+ curl_url @81
+ curl_url_cleanup @82
+ curl_url_dup @83
+ curl_url_get @84
+ curl_url_set @85
+ curl_url_strerror @86
+ curl_version @87
+ curl_version_info @88
+ curl_ws_meta @89
+ curl_ws_recv @90
+ curl_ws_send @91
diff --git a/curl-8.0.1_9-win64-mingw/bin/libcurl-x64.dll b/curl-8.0.1_9-win64-mingw/bin/libcurl-x64.dll
new file mode 100644
index 0000000..5c2f243
Binary files /dev/null and b/curl-8.0.1_9-win64-mingw/bin/libcurl-x64.dll differ
diff --git a/curl-8.0.1_9-win64-mingw/dep/brotli/LICENSE.txt b/curl-8.0.1_9-win64-mingw/dep/brotli/LICENSE.txt
new file mode 100644
index 0000000..33b7cdd
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/brotli/LICENSE.txt
@@ -0,0 +1,19 @@
+Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/curl-8.0.1_9-win64-mingw/dep/brotli/README.md b/curl-8.0.1_9-win64-mingw/dep/brotli/README.md
new file mode 100644
index 0000000..3bacbbc
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/brotli/README.md
@@ -0,0 +1,104 @@
+
+
+# SECURITY NOTE
+
+Please consider updating brotli to version 1.0.9 (latest).
+
+Version 1.0.9 contains a fix to "integer overflow" problem. This happens when "one-shot" decoding API is used (or input chunk for streaming API is not limited), input size (chunk size) is larger than 2GiB, and input contains uncompressed blocks. After the overflow happens, `memcpy` is invoked with a gigantic `num` value, that will likely cause the crash.
+
+### Introduction
+
+Brotli is a generic-purpose lossless compression algorithm that compresses data
+using a combination of a modern variant of the LZ77 algorithm, Huffman coding
+and 2nd order context modeling, with a compression ratio comparable to the best
+currently available general-purpose compression methods. It is similar in speed
+with deflate but offers more dense compression.
+
+The specification of the Brotli Compressed Data Format is defined in [RFC 7932](https://tools.ietf.org/html/rfc7932).
+
+Brotli is open-sourced under the MIT License, see the LICENSE file.
+
+Brotli mailing list:
+https://groups.google.com/forum/#!forum/brotli
+
+[](https://travis-ci.org/google/brotli)
+[](https://ci.appveyor.com/project/szabadka/brotli)
+[](https://oss-fuzz-build-logs.storage.googleapis.com/index.html#brotli)
+
+### Build instructions
+
+#### Vcpkg
+
+You can download and install brotli using the [vcpkg](https://github.com/Microsoft/vcpkg/) dependency manager:
+
+ git clone https://github.com/Microsoft/vcpkg.git
+ cd vcpkg
+ ./bootstrap-vcpkg.sh
+ ./vcpkg integrate install
+ vcpkg install brotli
+
+The brotli port in vcpkg is kept up to date by Microsoft team members and community contributors. If the version is out of date, please [create an issue or pull request](https://github.com/Microsoft/vcpkg) on the vcpkg repository.
+
+#### Autotools-style CMake
+
+[configure-cmake](https://github.com/nemequ/configure-cmake) is an
+autotools-style configure script for CMake-based projects (not supported on Windows).
+
+The basic commands to build, test and install brotli are:
+
+ $ mkdir out && cd out
+ $ ../configure-cmake
+ $ make
+ $ make test
+ $ make install
+
+By default, debug binaries are built. To generate "release" `Makefile` specify `--disable-debug` option to `configure-cmake`.
+
+#### Bazel
+
+See [Bazel](http://www.bazel.build/)
+
+#### CMake
+
+The basic commands to build and install brotli are:
+
+ $ mkdir out && cd out
+ $ cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=./installed ..
+ $ cmake --build . --config Release --target install
+
+You can use other [CMake](https://cmake.org/) configuration.
+
+#### Premake5
+
+See [Premake5](https://premake.github.io/)
+
+#### Python
+
+To install the latest release of the Python module, run the following:
+
+ $ pip install brotli
+
+To install the tip-of-the-tree version, run:
+
+ $ pip install --upgrade git+https://github.com/google/brotli
+
+See the [Python readme](python/README.md) for more details on installing
+from source, development, and testing.
+
+### Benchmarks
+* [Squash Compression Benchmark](https://quixdb.github.io/squash-benchmark/) / [Unstable Squash Compression Benchmark](https://quixdb.github.io/squash-benchmark/unstable/)
+* [Large Text Compression Benchmark](http://mattmahoney.net/dc/text.html)
+* [Lzturbo Benchmark](https://sites.google.com/site/powturbo/home/benchmark)
+
+### Related projects
+> **Disclaimer:** Brotli authors take no responsibility for the third party projects mentioned in this section.
+
+Independent [decoder](https://github.com/madler/brotli) implementation by Mark Adler, based entirely on format specification.
+
+JavaScript port of brotli [decoder](https://github.com/devongovett/brotli.js). Could be used directly via `npm install brotli`
+
+Hand ported [decoder / encoder](https://github.com/dominikhlbg/BrotliHaxe) in haxe by Dominik Homberger. Output source code: JavaScript, PHP, Python, Java and C#
+
+7Zip [plugin](https://github.com/mcmilk/7-Zip-Zstd)
+
+Dart [native bindings](https://github.com/thosakwe/brotli)
diff --git a/curl-8.0.1_9-win64-mingw/dep/cacert/LICENSE.url b/curl-8.0.1_9-win64-mingw/dep/cacert/LICENSE.url
new file mode 100644
index 0000000..3819c02
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/cacert/LICENSE.url
@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://www.mozilla.org/media/MPL/2.0/index.txt
diff --git a/curl-8.0.1_9-win64-mingw/dep/gsasl/AUTHORS.txt b/curl-8.0.1_9-win64-mingw/dep/gsasl/AUTHORS.txt
new file mode 100644
index 0000000..96a7855
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/gsasl/AUTHORS.txt
@@ -0,0 +1,20 @@
+GNU SASL AUTHORS -- Information about the authors.
+Copyright (C) 2002-2022 Simon Josefsson
+See the end for copying conditions.
+
+Simon Josefsson
+Designed and implemented GNU SASL.
+
+Dirk Armand Marcel Dierckx
+Implemented gsasl_client/server_suggest_mechanism.
+
+James Canete
+Fixed digest-md5 to not add excessive commas.
+
+Adam Strzelecki
+Contributed Windows Visual Studio project files.
+
+----------------------------------------------------------------------
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
diff --git a/curl-8.0.1_9-win64-mingw/dep/gsasl/COPYING.txt b/curl-8.0.1_9-win64-mingw/dep/gsasl/COPYING.txt
new file mode 100644
index 0000000..f288702
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/gsasl/COPYING.txt
@@ -0,0 +1,674 @@
+ GNU GENERAL PUBLIC LICENSE
+ Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc.
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+ Preamble
+
+ The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+ The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users. We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors. You can apply it to
+your programs, too.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+ To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights. Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+ For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received. You must make sure that they, too, receive
+or can get the source code. And you must show them these terms so they
+know their rights.
+
+ Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+ For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software. For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+ Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so. This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software. The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable. Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products. If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+ Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary. To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+ The precise terms and conditions for copying, distribution and
+modification follow.
+
+ TERMS AND CONDITIONS
+
+ 0. Definitions.
+
+ "This License" refers to version 3 of the GNU General Public License.
+
+ "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+ "The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+ To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy. The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+ A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+ To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+ To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+ An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+ 1. Source Code.
+
+ The "source code" for a work means the preferred form of the work
+for making modifications to it. "Object code" means any non-source
+form of a work.
+
+ A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+ The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+ The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+ The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+ The Corresponding Source for a work in source code form is that
+same work.
+
+ 2. Basic Permissions.
+
+ All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+ You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force. You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright. Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+ Conveying under any other circumstances is permitted solely under
+the conditions stated below. Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+ 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+ No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+ When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+ 4. Conveying Verbatim Copies.
+
+ You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+ You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+ 5. Conveying Modified Source Versions.
+
+ You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified
+ it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is
+ released under this License and any conditions added under section
+ 7. This requirement modifies the requirement in section 4 to
+ "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this
+ License to anyone who comes into possession of a copy. This
+ License will therefore apply, along with any applicable section 7
+ additional terms, to the whole of the work, and all its parts,
+ regardless of how they are packaged. This License gives no
+ permission to license the work in any other way, but it does not
+ invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display
+ Appropriate Legal Notices; however, if the Program has interactive
+ interfaces that do not display Appropriate Legal Notices, your
+ work need not make them do so.
+
+ A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+ 6. Conveying Non-Source Forms.
+
+ You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by the
+ Corresponding Source fixed on a durable physical medium
+ customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by a
+ written offer, valid for at least three years and valid for as
+ long as you offer spare parts or customer support for that product
+ model, to give anyone who possesses the object code either (1) a
+ copy of the Corresponding Source for all the software in the
+ product that is covered by this License, on a durable physical
+ medium customarily used for software interchange, for a price no
+ more than your reasonable cost of physically performing this
+ conveying of source, or (2) access to copy the
+ Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the
+ written offer to provide the Corresponding Source. This
+ alternative is allowed only occasionally and noncommercially, and
+ only if you received the object code with such an offer, in accord
+ with subsection 6b.
+
+ d) Convey the object code by offering access from a designated
+ place (gratis or for a charge), and offer equivalent access to the
+ Corresponding Source in the same way through the same place at no
+ further charge. You need not require recipients to copy the
+ Corresponding Source along with the object code. If the place to
+ copy the object code is a network server, the Corresponding Source
+ may be on a different server (operated by you or a third party)
+ that supports equivalent copying facilities, provided you maintain
+ clear directions next to the object code saying where to find the
+ Corresponding Source. Regardless of what server hosts the
+ Corresponding Source, you remain obligated to ensure that it is
+ available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided
+ you inform other peers where the object code and Corresponding
+ Source of the work are being offered to the general public at no
+ charge under subsection 6d.
+
+ A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+ A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling. In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage. For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product. A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+ "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source. The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+ If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+ The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed. Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+ Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+ 7. Additional Terms.
+
+ "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+ When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+ Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the
+ terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or
+ author attributions in that material or in the Appropriate Legal
+ Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or
+ requiring that modified versions of such material be marked in
+ reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or
+ authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some
+ trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that
+ material by anyone who conveys the material (or modified versions of
+ it) with contractual assumptions of liability to the recipient, for
+ any liability that these contractual assumptions directly impose on
+ those licensors and authors.
+
+ All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+ If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+ Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+ 8. Termination.
+
+ You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+ However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+ Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+ Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+ 9. Acceptance Not Required for Having Copies.
+
+ You are not required to accept this License in order to receive or
+run a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+ 10. Automatic Licensing of Downstream Recipients.
+
+ Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+ An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+ You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+ 11. Patents.
+
+ A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+ A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+ Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+ In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+ If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+ If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+ A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License. You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+ Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+ 12. No Surrender of Others' Freedom.
+
+ If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+ 13. Use with the GNU Affero General Public License.
+
+ Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+ 14. Revised Versions of this License.
+
+ The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time. Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+ Each version is given a distinguishing version number. If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+ If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+ Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+ 15. Disclaimer of Warranty.
+
+ THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. Limitation of Liability.
+
+ IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+ 17. Interpretation of Sections 15 and 16.
+
+ If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+ If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+ Copyright (C)
+ This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+ This is free software, and you are welcome to redistribute it
+ under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License. Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+ You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+.
+
+ The GNU General Public License does not permit incorporating your program
+into proprietary programs. If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library. If this is what you want to do, use the GNU Lesser General
+Public License instead of this License. But first, please read
+.
diff --git a/curl-8.0.1_9-win64-mingw/dep/gsasl/NEWS.txt b/curl-8.0.1_9-win64-mingw/dep/gsasl/NEWS.txt
new file mode 100644
index 0000000..d40f038
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/gsasl/NEWS.txt
@@ -0,0 +1,1337 @@
+GNU SASL NEWS -- History of user-visible changes. -*- outline -*-
+
+* Noteworthy changes in release 2.2.0 (2022-09-03) [stable]
+
+** Fix build error with too old GnuTLS.
+
+** Tests: New tests/gsasl-mailutils-tls.sh.
+It performs integration checks between GNU SASL and GNU MailUtils
+imapd with TLS enabled, thereby testing TLS support in the 'gsasl'
+command line tool.
+
+** Various minor bug fixes and improvements.
+Mainly to pacify improved CI/CD checking.
+
+* Noteworthy changes in release 2.1.1 (2022-08-16) [beta]
+
+** Tests: New tests/gsasl-mailutils-gs2krb5-gssapi.sh.
+It perform integration checks between GNU SASL and GNU MailUtils imapd
+(GSSAPI and GS2-KRB5). They can be used externally from the GNU SASL
+build environment to perform system integration tests, see
+.gitlab-ci.yml for inspiration.
+
+** Various minor bug fixes and improvements.
+Fix two crashes in 'gsasl' introduced in 2.1.0.
+
+* Noteworthy changes in release 2.1.0 (2022-08-05) [beta]
+
+** Support new "tls-exporter" channel binding.
+The "tls-exporter" channel binding is specified in RFC 9266
+. Now we can support
+SCRAM-*-PLUS over TLS 1.3 channels, and address some of the security
+problems with "tls-unique".
+
+The library add new callback property GSASL_CB_TLS_EXPORTER and error
+code GSASL_NO_CB_TLS_EXPORTER. These are documented in the manual.
+
+The 'gsasl' command-line tool set it if system GnuTLS has
+GNUTLS_CB_TLS_EXPORTER, which was introduced with GnuTLS 3.7.2
+released on 2021-05-29.
+
+** SCRAM: Support for "tls-exporter".
+The SCRAM client will now query the application for
+GSASL_CB_TLS_EXPORTER before it query for GSASL_CB_TLS_UNIQUE. Supply
+it to support TLS 1.3. The SCRAM server will query the application
+for the channel binding type requested by the client (tls-unique or
+tls-exporter), and it is up to the application to decide what to do.
+
+** SCRAM: Fix memory leaks on incremental application usage.
+See tests/scram-incremental.c for application behaviour that trigger
+the leaks. We run valgrind --leak-check=full to catch future
+regressions.
+
+** Tests: New tests/gsasl-dovecot-gssapi.sh & tests/gsasl-mailutils-cram.sh.
+These perform integration checks between GNU SASL and Dovecot
+(GSS-API) and GNU MailUtils imapd (CRAM-MD5, DIGEST-MD5, SCRAM-SHA-*).
+They can be used externally from the GNU SASL build environment to
+perform system integration tests, see .gitlab-ci.yml for inspiration.
+
+** API and ABI modifications.
+GSASL_CB_TLS_EXPORTER: Added.
+GSASL_NO_CB_TLS_EXPORTER: Added.
+
+* Noteworthy changes in release 2.0.1 (2022-07-15) [stable]
+
+** Support for the libgssglue GSS-API library were added.
+We encourage you to build with libgssglue, as that allows system
+administrators and end-users to chose between MIT Kerberos, Heimdal
+and GNU GSS during run-time. Read about the background here:
+https://blog.josefsson.org/2022/07/14/towards-pluggable-gss-api-modules/
+
+** GSSAPI client: don't use AUTHID as fallback for AUTHZID.
+The code historically used the AUTHID as authorization identity, but
+in 2012 we changed it to first query for AUTHZID, and only if that is
+not available, fall back to using AUTHID as the authorization
+identity. The change was not released until version 1.8.1 on
+2019-08-02, when it was properly documented to be removed 'after the
+year 2012'. While documented behaviour, this seems like just
+surprising behaviour and we now finally make the change.
+
+** GSSAPI server: don't set AUTHZID to empty string when absent.
+The GSS-API SASL protocol does not differentiate between an absent
+authorization identity and an authorization identity that is the empty
+string. Previously libgsasl would set it to the empty string but now
+it is set to NULL. The manual explains that this is a protocol
+limitation.
+
+** The examples/smtp-server.c now supports GSSAPI/GS2-KRB5.
+The example is used during CI/CD testing of GNU SASL and thus it made
+sense to extend it. Some bugs related to getline error conditions
+were also fixed.
+
+** GSSAPI server: Fix out-of-bounds read.
+A malicious client can after it has authenticated with Kerberos send a
+specially crafted message that causes Libgsasl to read out of bounds
+and cause a crash in the server.
+
+* Noteworthy changes in release 2.0.0 (2022-06-20) [stable]
+
+** Compared to last stable branch 1.10.x the 2.0.0 release
+** drops all obsolete APIs, drops the abandoned KERBEROS_V5 mechanism,
+** stops shipping a separate tarball for only the library, adds new APIs
+** gsasl_mechanism_name_p() and gsasl_property_free().
+Numerous other translation improvements, code cleanups, bug fixes,
+documentation additions, build improvements and portability
+enhancements were made as well.
+
+* Noteworthy changes in release 1.11.3 (2022-06-13) [beta]
+
+** libgsasl: Fix substring prefix bug in gsasl_client_suggest_mechanism.
+Reported by "Kevin J. McCarthy" in
+ in
+.
+
+** libgsasl: Fix DIGEST-MD5 compiler warnings.
+Reported by Martin Liška in
+
+and Dirk Müller in
+.
+
+** libgsasl: Rename gsasl_is_mechanism_name_valid to gsasl_mechanism_name_p.
+For better sorting of public APIs and consistency with other *_p
+function name usage.
+
+*** Various cleanups, build/bug fixes and portability improvements.
+
+* Noteworthy changes in release 1.11.2 (2021-10-25) [beta]
+
+** libgsasl: New API gsasl_is_mechanism_name_valid().
+This can be used to check if a mechanism name string is valid, i.e.,
+validate string length and characters used. This function is the
+recommended upgrade path for code using
+GSASL_VALID_MECHANISM_CHARACTERS, in the majority of use-cases.
+
+** libgsasl: The following variables have been removed:
+GSASL_VALID_MECHANISM_CHARACTERS: The reason for removing this is that
+exporting static global variables from shared libraries has
+portability concerns, and this is not a widely used variable anyway.
+
+*** Various cleanups, build/bug fixes and portability improvements.
+
+* Noteworthy changes in release 1.11.1 (2021-01-19) [alpha]
+
+** New header gsasl-version.h is now installed.
+
+** Deprecated enum Gsasl_cipher removed (forgotten in last release).
+
+** Fix symbol versioning.
+The goal of the 1.11.x branch is now to release 2.0.0.
+
+* Noteworthy changes in release 1.11.0 (2021-01-07) [alpha]
+
+** Stop shipping a separate tarball for libgsasl.
+This allowed us to avoid a second lib/configure script.
+
+** Build modernization.
+Among other improvements, gsasl now use gnulib's bootstrap script for
+building from git, see README-hacking (in git) for more information.
+
+** The KERBEROS_V5 mechanism was removed.
+It has not been enabled by default and was never standardized nor
+widely deployed.
+
+** Lasso is no longer an optional dependency.
+It was only used for building the 'gsasl-saml20-request' helper-tool
+for the example code for the SAML20 mechanism. The example is still
+shipped as part of this package, but the helper tool will now have to
+be built manually by anyone interested in this.
+
+** Functions gsasl_property_set() and gsasl_property_set_raw() now
+** return GSASL_MALLOC_ERROR on memory allocation errors.
+Updating code to use the return value is not critical. Everything
+will continue to work the same as before if you ignore the return
+value -- that is, if the property had to be set successfully, and
+memory allocation happened to occur, the application will get an error
+message later on about the missing property.
+
+If you want to support both new and old library versions, to report
+memory allocation errors as such, you may use a construct like this:
+
+#if GSASL_VERSION_NUMBER >= 0x010b00
+ res =
+#endif
+ gsasl_property_set (sctx, GSASL_AUTHID, "simon");
+#if GSASL_VERSION_NUMBER >= 0x010b00
+ if (res != GSASL_OK)
+ return res;
+#endif
+
+You may put this in a wrapper function to avoid repeating the
+construct elsewhere in your code.
+
+The function signatures are modified, before the return value was
+'void' now it is 'int'. The shared library version has been
+incremented.
+
+Noticed by Daniel Stenberg in
+.
+
+** New API gsasl_property_free().
+This is used to deallocate resources associated with a property.
+
+** All deprecated interfaces have been removed.
+
+*** The following functions have been removed:
+gsasl_appinfo_get
+gsasl_appinfo_set
+gsasl_application_data_get
+gsasl_application_data_set
+gsasl_base64_decode
+gsasl_base64_encode
+gsasl_client_application_data_get
+gsasl_client_application_data_set
+gsasl_client_callback_anonymous_get
+gsasl_client_callback_anonymous_set
+gsasl_client_callback_authentication_id_get
+gsasl_client_callback_authentication_id_set
+gsasl_client_callback_authorization_id_get
+gsasl_client_callback_authorization_id_set
+gsasl_client_callback_maxbuf_get
+gsasl_client_callback_maxbuf_set
+gsasl_client_callback_passcode_get
+gsasl_client_callback_passcode_set
+gsasl_client_callback_password_get
+gsasl_client_callback_password_set
+gsasl_client_callback_pin_get
+gsasl_client_callback_pin_set
+gsasl_client_callback_qop_get
+gsasl_client_callback_qop_set
+gsasl_client_callback_realm_get
+gsasl_client_callback_realm_set
+gsasl_client_callback_service_get
+gsasl_client_callback_service_set
+gsasl_client_ctx_get
+gsasl_client_finish
+gsasl_client_listmech
+gsasl_client_step
+gsasl_client_step_base64
+gsasl_ctx_get
+gsasl_decode_inline
+gsasl_encode_inline
+gsasl_hmac_md5
+gsasl_hmac_sha1
+gsasl_md5
+gsasl_md5pwd_get_password
+gsasl_randomize
+gsasl_server_application_data_get
+gsasl_server_application_data_set
+gsasl_server_callback_anonymous_get
+gsasl_server_callback_anonymous_set
+gsasl_server_callback_cipher_get
+gsasl_server_callback_cipher_set
+gsasl_server_callback_cram_md5_get
+gsasl_server_callback_cram_md5_set
+gsasl_server_callback_digest_md5_get
+gsasl_server_callback_digest_md5_set
+gsasl_server_callback_external_get
+gsasl_server_callback_external_set
+gsasl_server_callback_gssapi_get
+gsasl_server_callback_gssapi_set
+gsasl_server_callback_maxbuf_get
+gsasl_server_callback_maxbuf_set
+gsasl_server_callback_qop_get
+gsasl_server_callback_qop_set
+gsasl_server_callback_realm_get
+gsasl_server_callback_realm_set
+gsasl_server_callback_retrieve_get
+gsasl_server_callback_retrieve_set
+gsasl_server_callback_securid_get
+gsasl_server_callback_securid_set
+gsasl_server_callback_service_get
+gsasl_server_callback_service_set
+gsasl_server_callback_validate_get
+gsasl_server_callback_validate_set
+gsasl_server_ctx_get
+gsasl_server_finish
+gsasl_server_listmech
+gsasl_server_step
+gsasl_server_step_base64
+gsasl_server_suggest_mechanism
+gsasl_sha1
+gsasl_stringprep_nfkc
+gsasl_stringprep_saslprep
+gsasl_stringprep_trace
+
+*** The following declarations have been removed:
+Gsasl_ctx
+Gsasl_session_ctx
+GSASL_CANNOT_GET_CTX
+GSASL_FCLOSE_ERROR
+GSASL_FOPEN_ERROR
+GSASL_GCRYPT_ERROR
+GSASL_INVALID_HANDLE
+GSASL_KERBEROS_V5_INIT_ERROR
+GSASL_KERBEROS_V5_INTERNAL_ERROR
+GSASL_NEED_CLIENT_ANONYMOUS_CALLBACK
+GSASL_NEED_CLIENT_AUTHENTICATION_ID_CALLBACK
+GSASL_NEED_CLIENT_AUTHORIZATION_ID_CALLBACK
+GSASL_NEED_CLIENT_PASSCODE_CALLBACK
+GSASL_NEED_CLIENT_PASSWORD_CALLBACK
+GSASL_NEED_CLIENT_PIN_CALLBACK
+GSASL_NEED_CLIENT_SERVICE_CALLBACK
+GSASL_NEED_SERVER_ANONYMOUS_CALLBACK
+GSASL_NEED_SERVER_CRAM_MD5_CALLBACK
+GSASL_NEED_SERVER_DIGEST_MD5_CALLBACK
+GSASL_NEED_SERVER_EXTERNAL_CALLBACK
+GSASL_NEED_SERVER_GSSAPI_CALLBACK
+GSASL_NEED_SERVER_REALM_CALLBACK
+GSASL_NEED_SERVER_RETRIEVE_CALLBACK
+GSASL_NEED_SERVER_SECURID_CALLBACK
+GSASL_NEED_SERVER_SERVICE_CALLBACK
+GSASL_NEED_SERVER_VALIDATE_CALLBACK
+GSASL_NO_MORE_REALMS
+GSASL_SHISHI_ERROR
+GSASL_TOO_SMALL_BUFFER
+GSASL_UNICODE_NORMALIZATION_ERROR
+Gsasl_client_callback_anonymous
+Gsasl_client_callback_authentication_id
+Gsasl_client_callback_authorization_id
+Gsasl_client_callback_maxbuf
+Gsasl_client_callback_passcode
+Gsasl_client_callback_password
+Gsasl_client_callback_pin
+Gsasl_client_callback_qop
+Gsasl_client_callback_realm
+Gsasl_client_callback_service
+Gsasl_server_callback_anonymous
+Gsasl_server_callback_cipher
+Gsasl_server_callback_cram_md5
+Gsasl_server_callback_digest_md5
+Gsasl_server_callback_external
+Gsasl_server_callback_gssapi
+Gsasl_server_callback_maxbuf
+Gsasl_server_callback_qop
+Gsasl_server_callback_realm
+Gsasl_server_callback_retrieve
+Gsasl_server_callback_securid
+Gsasl_server_callback_service
+Gsasl_server_callback_validate
+
+* Noteworthy changes in release 1.10.0 (2021-01-01) [stable]
+
+** This is a new major stable release. Brief changes compared to 1.8.x:
+
+*** SCRAM-SHA-256 and SCRAM-SHA-256-PLUS support per RFC 7677.
+
+*** SCRAM supports password-less usage (StoredKey/ServerKey).
+
+*** New 'gsasl --mkpasswd' command to prepare SCRAM salted/hashed passwords.
+
+*** Final warning that obsolete APIs will be removed.
+
+*** Various cleanups, portability and other bug fixes.
+See the entries in NEWS and lib/NEWS covering the 1.9.x branch for details.
+
+* Noteworthy changes in release 1.9.3 (2021-01-01) [beta]
+
+** Fix build/portability problems. GnuTLS >= 3.4 is required.
+Thanks to Bruno Haible for reports.
+
+* Noteworthy changes in release 1.9.2 (2020-12-24) [beta]
+
+** gsasl: Don't abort command on some exepected TLS events (for TLS 1.3).
+Patch from Enrico Scholz in:
+https://lists.gnu.org/archive/html/help-gsasl/2020-08/msg00000.html
+
+** gsasl: Use GnuTLS system trust settings by default for X.509 server
+** certificate validation.
+Before it was documented behaviour that unless --x509-ca-file was
+used, no verification of the server-side certificate was performed.
+Now instead it will use the system trust settings, which on properly
+configured systems results in verification of the server certificate.
+As a result, you may now start to get server certificate verification
+errors in situations where you didn't expect them. Use --x509-ca-file
+with the empty string ("") as a file name to use the old behaviour to
+not abort on server certificate verification failures.
+
+** SCRAM, GS2 and GSSAPI retrieve properties later in
+** the authentication process.
+Before the property GSASL_CB_TLS_UNIQUE was retrieved during SCRAM
+gsasl_client_start() and gsasl_server_start(), and the properties
+GSSAPI_SERVICE and GSSAPI_HOSTNAME was retrived during GS2/GSSAPI
+gsasl_server_start(). Now they are retrieved during the first call to
+gsasl_step().
+
+The only user-visible impact of this should be that 'gsasl
+--client-mechanisms' and 'gsasl --server-mechanisms' will now not
+query for parameters before giving a list of supported mechanisms,
+which arguable gives a better user experience. The downside of this
+is that SCRAM-*-PLUS, GS2 and GSSAPI may be advertised even though
+completing the server mechanism may not complete.
+
+The problem with calling callbacks in the start() function is that the
+callback will have no per-session context at that point, only a global
+context, so the only way to give per-session unique callback responses
+is to use a separate global handle per session. This was discovered
+in the Exim implementation of gsasl with SCRAM that used to request
+the GSASL_CB_TLS_UNIQUE property in the start() function. After
+noticing this design issue, and writing this self test, it was
+discovered that it also happened for the GSSAPI/GS2 server (not
+client) mechanism for the GSASL_SERVICE and GSASL_HOSTNAME properties.
+
+Thanks to Jeremy Harris for noticing the problem and discussion, see
+https://lists.gnu.org/archive/html/help-gsasl/2020-01/msg00035.html
+
+** gsasl: The --mkpasswd output format follows Dovecot 'doveadm pw'.
+
+** Filenames of images in the manual are now prefixed with 'gsasl-'.
+This makes /usr/share/info more understandable, and it is suggested by
+at least Debian to do this in upstream.
+
+** Build changes.
+Some more compiler warnings used and code fixed. Improved ./configure
+diagnostics.
+
+* Noteworthy changes in release 1.9.1 (2020-01-14) [beta]
+
+** gsasl: New --mkpasswd argument to prepare salted/hashed passwords.
+Currently mechanisms SCRAM-SHA-1 and SCRAM-SHA-256 are supported. New
+parameter --iteration-count to indicate number of PBKDF2 rounds,
+default being 65536. New parameter --salt to specify PBKDF2 salt.
+
+* Noteworthy changes in release 1.9.0 (2020-01-03) [beta]
+
+** Client and server support for SCRAM-SHA-256 and SCRAM-SHA-256-PLUS.
+
+** gsasl: If PORT argument is "587" or "submission", SMTP mode is used.
+Further, unrecognized PORT arguments will now on raise an error to
+specify --smtp or --imap.
+
+* Noteworthy changes in release 1.8.1 (2019-08-02) [stable]
+
+** gsasl: IMAP client code now permits empty SASL tokens prefixed with '+'.
+Normally servers should send '+ '. Buggy servers include Microsoft
+Exchange. Reported by Adam Sjøgren.
+
+** GSSAPI client: Now retrieves GSASL_AUTHZID for authorization identity.
+** GSSAPI client: Can now transmit an empty/missing authorization identity.
+See lib/NEWS for more information.
+
+** Build fixes.
+Update of gnulib, including how it is bootstrapped.
+
+** i18n: Updated translations.
+
+* Noteworthy changes in release 1.8.0 (2012-05-28) [stable]
+
+** This is a new major stable release. Brief changes compared to 1.6.x:
+
+*** SAML20 support following RFC 6595.
+
+*** OPENID20 support following RFC 6616.
+
+*** Added SMTP server examples (for e.g., SCRAM, SAML20, OPENID20).
+
+*** Various cleanups, portability and other bug fixes.
+See the NEWS entries during the 1.7.x branch for details.
+
+* Noteworthy changes in release 1.7.6 (2012-05-23) [beta]
+
+** i18n: Updated translations.
+
+** Build fixes.
+
+* Noteworthy changes in release 1.7.5 (2012-05-22) [beta]
+
+** i18n: Updated translations.
+
+** Build fixes.
+
+* Noteworthy changes in release 1.7.4 (2012-05-16) [alpha]
+
+** Doc fixes and updates for the callback/property change in the library.
+See lib/NEWS for details. This affects SAML and OpenID.
+
+** Slight fixes to Windows build script.
+
+* Noteworthy changes in release 1.7.3 (2012-04-03) [alpha]
+
+** The SAML20 mechanism has been updated and is now enabled by default.
+
+** Doc fixes and updates for the callback/property change in the library.
+See lib/NEWS for details.
+
+** examples: Added example SMTP server with SAML 2.0 support.
+See examples/saml20/README. It uses Lasso as the SAML implementation.
+You may disable Lasso by using --without-lasso. Note that Lasso is
+only needed for this example server, it is not needed by the GNU SASL
+library or command line tools itself.
+
+* Noteworthy changes in release 1.7.2 (2012-03-28) [alpha]
+
+** gsasl: The client lets the server decide when authentication is complete.
+Before the client quit from the authentication loop when the local
+mechanism was finished, but some mechanisms (OPENID20) have optional
+additional round-trips.
+
+** gsasl: Added OPENID20 support.
+
+** gsasl: The --no-cb parameter now avoids even attempting to get the
+** channel binding data from GnuTLS.
+Apparently this can avoid issues when GnuTLS fails to provide the CB.
+
+** examples: Added stand-alone example SMTP server.
+See examples/smtp-server.c. This illustrate how to write a server
+using GNU SASL, but it can also be used for interop testing of
+clients.
+
+** examples: Added example SMTP server with OpenID 2.0 support.
+See examples/openid20/README.
+
+* Noteworthy changes in release 1.7.1 (2012-02-09) [alpha]
+
+** gsasl: Don't crash after getpass() on Mac OS X.
+Reported by Wim Lewis .
+
+** gsasl: Ignore untagged responses during IMAP authentication.
+Patch from Enrico Scholz .
+
+** tests: Disable the test-poll self-test, it doesn't seem to work on Solaris.
+Reported by Dagobert Michelsen .
+
+** libgsasl: Implement OPENID20 mechanism for OpenID authentication.
+Following draft-ietf-kitten-sasl-openid-03.
+
+** Demand gettext >= 0.18.1 in order to get newer M4 files.
+The old M4 files associated with 0.17 caused problems on Solaris,
+which will hopefully be fixed with this. Reported by Dagobert
+Michelsen .
+
+** build: Added MinGW build script for Windows binaries, windows/gsasl4win.mk.
+
+** doc: Typo fix in autoconf snippet.
+
+** i18n: Updated translations.
+
+** examples: Added client-xmpp-saml20 and server-xmpp-saml20.
+The examples illustrates a sample SAML20 client and server.
+
+* Noteworthy changes in release 1.7.0 (2010-10-22) [alpha]
+
+** Support for SAML20 mechanism as per -01 IETF draft. See lib/NEWS.
+Implements draft-ietf-kitten-sasl-saml-01.
+
+** doc: Mention new SAML properties.
+
+** tests: New tests/saml20.c file.
+
+* Noteworthy changes in release 1.6.1 (2011-05-01) [stable]
+
+** build: Demand gettext >= 0.18.1 in order to get newer M4 files.
+The old M4 files associated with 0.17 caused problems on Solaris,
+which will hopefully be fixed with this. Reported by Dagobert
+Michelsen .
+
+** doc: Typo fix in autoconf snippet.
+
+** i18n: Updated translations.
+
+* Noteworthy changes in release 1.6.0 (2010-12-14) [beta]
+
+** No changes since release candidate 1.5.5.
+
+* Noteworthy changes in release 1.5.5 (2010-12-09) [beta]
+
+** gsasl: Add --no-cb to disable use of TLS channel bindings.
+
+** build: Use silent build rules via automake.
+Use 'make V=99' to see the command lines used.
+
+* Noteworthy changes in release 1.5.4 (2010-11-14) [beta]
+
+** Update gnulib files.
+
+* Noteworthy changes in release 1.5.3 (2010-11-14) [beta]
+
+** gsasl: Support for TLS channel bindings.
+Requires GnuTLS 2.11.4 or later for the gnutls_session_channel_binding
+function. Used by the SCRAM-SHA-1-PLUS mechanism.
+
+** doc: Mention new property GSASL_CB_TLS_UNIQUE and SCRAM-SHA-1-PLUS.
+
+** tests: Added self-tests for SCRAM-SHA-1-PLUS.
+
+* Noteworthy changes in release 1.5.2 (2010-09-27) [beta]
+
+** gsasl: Avoid fixed size buffers.
+This caused problems on Windows where the BUFSIZ was too small for
+some line lengths with GS2-KRB5.
+
+** tests: Fix error strings to be more unique.
+
+** doc: Added section on how to build with MIT Kerberos for Windows.
+
+** doc: Added PDF version of API reference manual.
+See doc/reference/gsasl.pdf.
+
+** i18n: Updated translations.
+Thanks to Benno Schulenberg.
+
+** Update gnulib files.
+
+* Noteworthy changes in release 1.5.1 (2010-04-21) [beta]
+
+** Update gnulib files.
+
+* Noteworthy changes in release 1.5.0 (2010-03-31) [beta]
+
+** doc: Explain GS2-related changes.
+
+** doc: GTK-DOC manual improved.
+Now almost all symbols and types are explained.
+
+** gsasl: Fix crash when getaddrinfo does not get a canonical name.
+
+** gsasl: Improve error message when server rejects authentication.
+
+** tests: Self checks are improved.
+
+* Noteworthy changes in release 1.4.4 (2010-03-25) [stable]
+
+** See lib/NEWS.
+
+* Noteworthy changes in release 1.4.3 (2010-03-25) [stable]
+
+** See lib/NEWS.
+
+* Noteworthy changes in release 1.4.2 (2010-03-15) [stable]
+
+** i18n: Updated translations.
+
+* Noteworthy changes in release 1.4.1 (2010-02-16) [stable]
+
+** gsasl: Improve application data throughput.
+Patch from Enrico Scholz in
+.
+
+** Improve MinGW builds.
+
+** i18n: Updated German translation.
+
+* Noteworthy changes in release 1.4.0 (2009-11-17) [stable]
+
+** No changes since 1.3.91 release candidate.
+The release numbering scheme has changed compared to the last stable
+release. In the future we will use version numbers X.Y.Z with even Y
+to indicate stable releases and odd Y to indicate experimental
+releases. Z is incremented by one for every release on a particular
+branch. For example, the next stable release will either be 1.4.1 or
+1.6.0 and the next experimental release will be 1.5.0. The intention
+is that the stable branches can be used for security bug fixes if/when
+there is a need. Other changes or new features will (typically) not
+be back-ported to a stable branch but instead will have to wait for
+the next stable branch to be released.
+
+* Noteworthy changes in release 1.3.91 (2009-11-06) [experimental]
+
+** doc: Fix doc/cyclo/ output.
+
+* Noteworthy changes in release 1.3.90 (2009-11-06) [experimental]
+
+** tests/crypto: Also test newly added SHA-1 interfaces.
+
+** tests/scram: Also test GSASL_SCRAM_SALTED_PASSWORD case.
+This code path triggered a crash in v1.3.
+
+** i18n: Added Finnish translation.
+Thanks to Jorma Karvonen .
+
+* Noteworthy changes in release 1.3 (2009-10-08)
+
+** Experimental support for SCRAM-SHA-1 added.
+Please test it but don't put it into production use, the RFC have not
+been finalized yet. For this reason, the mechanism priority list is
+such that SCRAM-SHA-1 will never be selected over any other mechanism
+(including PLAIN, CRAM-MD5, and DIGEST-MD5). When it has been tested
+further, we'll make SCRAM-SHA-1 the preferred mechanism after GSSAPI.
+
+** gsasl: Fix libintl-related build errors on MinGW.
+Tiny patch from "carlo.bramix" .
+
+** doc: Typo fixes to manual.
+Based on report by Marco Maggi in
+.
+
+** tests: Rewrite basic self test using modern API.
+
+** tests: New self-test 'crypto' to increase code coverage.
+
+* Noteworthy changes in release 1.2 (2009-06-13)
+
+** gsasl: Fix out of bounds write when in IMAP/SMTP mode.
+Reported by Enrico Scholz in
+.
+
+** doc: Rewritten introduction material.
+
+** doc: Improved sections for the info manual.
+We now follow the advice given by the texinfo manual on which
+directory categories to use. In particular, libgsasl moved from the
+'GNU Libraries' section to the 'Software libraries' as GNU SASL, and
+'Invoking gsasl' moved from 'GNU utilities' to 'Security'.
+
+** examples: Removed unneeded 'ctx' parameter from client_authenticate.
+
+** Building with many warning flags now requires --enable-gcc-warnings.
+This avoids crying wolf for normal compiles.
+
+** New configure parameters to set packaging specific information.
+The parameters are --with-packager, --with-packager-version, and
+--with-packager-bug-reports. See
+ for more
+details.
+
+* Noteworthy changes in release 1.1 (2009-03-25)
+
+** gsasl: Reading integrity protected data from server now works.
+Before it didn't decode data.
+
+** gsasl: The --quality-of-protection parameter now works.
+It was just a dummy before. Only relevant for DIGEST-MD5. Note that
+the parameter value have been modified to match the library keywords.
+
+** Only detect sufficiently recent GnuTLS versions.
+Version 2.2.x or later is required.
+
+* Noteworthy changes in release 1.0 (2009-01-23)
+
+** gsasl: New parameter --priority to specify GnuTLS priority strings.
+Can be used to change TLS settings, which may be needed to talk to
+some servers.
+
+** gsasl: Print web page links in --help, per new GNU coding standard.
+
+** tests: New self-test for the gsasl_client_suggest_mechanism function.
+
+** doc: Modernize doxygen configuration.
+
+** doc: Use permissive license for man pages.
+
+** doc: Change license on the manual to GFDLv1.3+.
+
+* Noteworthy changes in release 0.2.29 (2008-10-21)
+
+** gsasl: Don't use poll with POLLOUT to avoid busy-waiting.
+Reported by Enrico Scholz .
+
+** doc: Error codes are now extracted using official library APIs.
+
+** doc: Included cyclomatic code complexity charts of the library code.
+See doc/cyclo/.
+
+** tests: Add self test of obsolete base64 functions.
+
+** Update gnulib files.
+Improves Windows compatibility.
+
+* Noteworthy changes in release 0.2.28 (2008-08-20)
+
+** gsasl: Rewrite to use poll instead of select.
+Will allow easier porting to Mingw32 in the future.
+
+** doc: Improve Windows installation instructions in the manual.
+
+** tests: New self test of gsasl_mechanism_name function.
+
+* Noteworthy changes in release 0.2.27 (2008-07-01)
+
+** Fix SASL operations through TLS.
+Report and tiny patch from Enrico Scholz
+ in
+.
+
+** Update gnulib files, and include gnulib self-tests.
+
+** Update translations.
+
+* Noteworthy changes in release 0.2.26 (2008-05-05)
+
+** Translations files not stored directly in git to avoid merge conflicts.
+This allows us to avoid use of --no-location which makes the
+translation teams happier.
+
+** Build fixes for the documentation.
+
+** Update gnulib files.
+
+* Noteworthy changes in release 0.2.25 (2008-03-10)
+
+** gsasl: Fix buffering issue to avoid mixing stdout/stderr outputs.
+This would manifest itself when redirecting output to a pipe, such as
+when used with Gnus. Reported by Enrico Scholz
+, see
+.
+
+** Fix non-portable use of brace expansion in makefiles.
+
+* Noteworthy changes in release 0.2.24 (2008-01-15)
+
+** Link self-tests with gnulib, to fix link failures under MinGW.
+
+* Noteworthy changes in release 0.2.23 (2008-01-15)
+
+** Improve CRAM-MD5 self-test to detect if challenges are the same.
+
+** Improve gsasl --help and --version to conform with GNU standards.
+
+** Use gettext 0.17.
+
+** Update gnulib files.
+
+* Noteworthy changes in release 0.2.22 (2007-10-08)
+
+** Development git tree moved to savannah.
+See .
+
+** Fix warnings when building the tool 'gsasl'.
+
+** Update gnulib files.
+
+* Noteworthy changes in release 0.2.21 (2007-08-22)
+
+** Fix typos in manual.
+Tiny patch from Brad Hards .
+
+** Update gnulib files.
+
+* Noteworthy changes in release 0.2.20 (2007-08-11)
+
+** Update gnulib files.
+
+* Noteworthy changes in release 0.2.19 (2007-08-09)
+
+** Command-line tools, examples, etc are now licensed under the
+** GPL version 3 (or later).
+The library remains licensed under LGPL version 2.1 (or later).
+
+** Updated documentation as per license change.
+
+** Update gnulib files.
+
+** Update translations.
+
+* Noteworthy changes in release 0.2.18 (2007-06-07)
+
+** Update gnulib files.
+Fixes cross-compilation to uClinux.
+
+* Noteworthy changes in release 0.2.17 (2007-06-01)
+
+** GNU SASL is now developed using Git instead of CVS.
+A public git mirror is available from .
+
+** Update gnulib files.
+
+** Polish, Swedish and Vietnamese translations updated.
+Thanks to Jakub Bogusz, Daniel Nylander, and Clytie Siddall.
+
+* Noteworthy changes in release 0.2.16 (2007-04-20)
+
+** Fix IMAP protocol usage in the 'gsasl' command-line tool server.
+
+** Support GSSAPI server in 'gsasl' command-line tool.
+
+** Add self-test of the gsasl_check_version API.
+
+** Translation updates.
+
+** Update of gnulib files.
+
+** Now uses autoconf 2.61, automake 1.10, gettext 0.16.1.
+
+* Noteworthy changes in release 0.2.15 (2006-08-22)
+
+** Changed libgsasl shared library version.
+The shared library version was not incremented correctly in the last
+release, even though new APIs were added.
+
+* Noteworthy changes in release 0.2.14 (2006-08-19)
+
+** New section "Requirements" in the manual, lists the external components.
+Suggested by James Mansion.
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.13 (2006-06-14)
+
+** Update of gnulib files.
+Further improves portability to MinGW.
+
+** Various improvements in the manuals.
+
+** The tests are run under valgrind, if it is installed.
+Use --disable-valgrind-tests to unconditionally disable this. It is
+disabled by default for cross compiles.
+
+** Various minor fixes.
+
+* Noteworthy changes in release 0.2.12 (2006-03-08)
+
+** Update of gnulib files.
+Improves portability to Mingw32.
+
+* Noteworthy changes in release 0.2.11 (2006-02-07)
+
+** Ported to Windows by cross-compiling using Mingw32.
+Using Debian's mingw32 compiler, you can build it for Windows by invoking
+`./configure --host=i586-mingw32msvc --disable-gssapi'.
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.10 (2005-10-23)
+
+** Work around bug in GnuTLS that made the command line tool exit after
+** failing to write a zero length message to the peer.
+
+** Don't use GnuTLS if gnutls_certificate_verify_peers2 isn't present.
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.9 (2005-10-07)
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.8 (2005-09-08)
+
+** The gsasl tool now support STARTTLS for IMAP and SMTP using GnuTLS.
+
+** The --client and --server parameters for the gsasl tool now work properly.
+
+** The --client and --server stdin/stdout modes now use the readline library.
+
+** Fixed build problems in getpass on uClibc and Mingw32 platforms.
+
+** Kinyarwanda translation added.
+
+* Noteworthy changes in release 0.2.7 (2005-08-25)
+
+** Fix build problems when cross-compiling to uClibc and Mingw32 platforms.
+
+** Detecting and using the readline library has been improved.
+
+* Noteworthy changes in release 0.2.6 (2005-08-08)
+
+** The gsasl tool now try to connect to all addresses for a server name.
+
+** The help-gsasl@gnu.org mailing list is now mentioned in documentation.
+
+** The license template in files were updated with the new FSF address.
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.5 (2005-02-08)
+
+** Added self test of EXTERNAL mechanism.
+
+** Vietnamese translation added, thanks to Clytie Siddall.
+
+* Noteworthy changes in release 0.2.4 (2005-01-01)
+
+** The CRAM-MD5 mechanism is now preferred over DIGEST-MD5.
+This decision was based on recent public research that suggest MD5 is
+broken, while HMAC-MD5 not immediately compromised, and the lack of
+public analysis on what consequences the MD5 break have for
+DIGEST-MD5. Support for CRAM-SHA1 is under investigation, to enable
+users to avoid MD5 completely
+
+** Fixed a bug that prevented SMTP client from working.
+
+** New configure option --disable-obsolete to remove backwards compatibility.
+This is mostly intended to be used when compiling for platforms with
+constrained memory/space resources.
+
+** DIGEST-MD5 rewritten and enabled by default (see lib/NEWS for details).
+
+** Command line tool now query for realm, hostname and service name properly.
+
+** Documentation updates and improvements.
+
+** Self test improvements.
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.3 (2004-12-15)
+
+** Fix example code to handle base64 encoded data properly.
+
+** DIGEST-MD5 is disabled by default, pending a rewrite for the new API.
+
+** Command line tool uses new callback interface to the library.
+
+** Command line tool uses "iconvme" from gnulib for UTF-8 string conversion.
+
+** Server mode in the command line tool does not work currently.
+It is unclear if this feature was ever that useful. If there are no
+objections, it will be removed completely in future versions.
+
+** Documentation fixes.
+
+** Fix self test bugs.
+
+* Noteworthy changes in release 0.2.2 (2004-11-29)
+
+** Update of gnulib files.
+
+* Noteworthy changes in release 0.2.1 (2004-11-19)
+
+** Documentation fixes; the old callback API functions are marked as obsolete.
+
+* Noteworthy changes in release 0.2.0 (2004-11-07)
+
+** Added new directory examples/ with complete examples for new API.
+
+** Documentation improvements.
+For example, you can now browse the GNU SASL API manual using DevHelp.
+
+** Update of gnulib files.
+
+** More self tests.
+
+** Translation fixes.
+
+* Noteworthy changes in release 0.1.4 (2004-08-08)
+
+** Revamp of gnulib compatibility files.
+
+** More translations.
+German (by Roland Illig), Basque (by Mikel Olasagasti), French (by
+Michel Robitaille), Irish (by Kevin Patrick Scannell), Dutch (by Elros
+Cyriatan), Polish (by Jakub Bogusz), Romanian (by Laurentiu Buzdugan),
+and Serbian (by Aleksandar Jelenak).
+
+* Noteworthy changes in release 0.1.3 (2004-08-04)
+
+** Command line tool support IPv6 (and other protocol families).
+Requires that your system has `getaddrinfo'.
+
+** Command line behaviour for gsasl tool improved.
+The --client and --imap parameters are now the default. The --connect
+host and port can now be specified directly. If --authentication-id
+is not specified, the username of the user invoking gsasl is used
+(i.e., getpwuid(getuid)->pw_name). Alltogether, this allows simple
+usage, as in `gsasl mail.example.com' to connect, via IMAP, to
+mail.example.com.
+
+* Noteworthy changes in release 0.1.2 (2004-07-16)
+
+** The SMTP mode in `gsasl' should now work.
+
+** Cross compile builds should work.
+It should work for any sane cross compile target, but the only tested
+platform is uClibc/uClinux on Motorola Coldfire.
+
+** The GNU Readline library is used to read data, if available.
+
+** Passwords read from stdin are not echoed to the terminal.
+
+* Noteworthy changes in release 0.1.1 (2004-06-26)
+
+** In the command line client, the default quality of protection is now none.
+
+* Noteworthy changes in release 0.1.0 (2004-04-16)
+
+** The library re-licensed to LGPL and distributed as a separate package.
+This means a fork of this NEWS file, all the entries below relate to
+the combined work of earlier versions. New entries above does not
+document user visible changes for the library ("libgsasl"), for that
+see NEWS in the lib/ sub-directory, which is also distributed as a
+stand-alone package.
+
+* Noteworthy changes in release 0.0.14 (2004-01-22)
+
+** Moved all mechanism specific code into sub-directories of lib/.
+Each backend is built into its own library (e.g., libgsasl-plain.so),
+to facilitate future possible use of dlopen to dynamically load
+backends.
+
+** Moved compatibility files (getopt*) to gl/, and added more (strdup*).
+
+* Noteworthy changes in release 0.0.13 (2004-01-17)
+
+** Nettle (the crypto functionality, crypto/) has been updated.
+This fixes two portability issues, the new code should work on
+platforms that doesn't have inttypes.h and alloca.
+
+* Noteworthy changes in release 0.0.12 (2004-01-15)
+
+** Protocol line parser in 'gsasl' tool more reliable.
+Earlier it assumed two lines were sent in one packet in one place, and
+sent as two packets in another place.
+
+** Various bugfixes.
+
+* Noteworthy changes in release 0.0.11 (2004-01-06)
+
+** The client part of CRAM-MD5 now uses SASLprep instead of NFKC.
+This aligns with draft-ietf-sasl-crammd5-01.
+
+** The CRAM-MD5 challenge string now conform to the proper syntax.
+
+** The string preparation (SASLprep and trace) functions now work correctly.
+
+** DocBook manuals no longer included.
+The reason is that recent DocBook tools from the distribution I use
+(Debian) fails with an error. DocBook manuals may be included in the
+future, if I can get the tools to work.
+
+** API and ABI modifications.
+GSASL_SASLPREP_ERROR: ADD.
+
+* Noteworthy changes in release 0.0.10 (2003-11-22)
+
+** The CRAM-MD5 server now reject invalid passwords.
+The logic flaw was introduced in 0.0.9, after blindly making code
+changes to shut up valgrind just before the release.
+
+** Various build improvements.
+Pkg-config is no longer needed. GTK-DOC is only used if present.
+
+* Noteworthy changes in release 0.0.9 (2003-11-21)
+
+** Command line client can talk to SMTP servers with --smtp.
+
+** DocBook manuals in XML, PDF, PostScript, ASCII and HTML formats included.
+
+** Token parser in DIGEST-MD5 fixed, improve interoperability of DIGEST-MD5.
+
+** Libgcrypt >= 1.1.42 is used if available (for CRAM-MD5 and DIGEST-MD5).
+The previous libgcrypt API is no longer supported.
+
+** CRAM-MD5 and DIGEST-MD5 no longer require libgcrypt (but can still use it).
+If libgcrypt 1.1.42 or later is not found, it uses a minimalistic
+cryptographic library based on Nettle, from crypto/. Currently only
+MD5 and HMAC-MD5 is needed, making a dependence on libgcrypt overkill.
+
+** Listing supported server mechanisms with gsasl_server_mechlist work.
+
+** Autoconf 2.59, Automake 1.8 beta, Libtool CVS used.
+
+** Source code for each SASL mechanism moved to its own sub-directory in lib/.
+
+** The command line interface now uses getopt instead of argp.
+The reason is portability, this also means we no longer use gnulib.
+
+** API and ABI modifications.
+gsasl_randomize: ADD.
+gsasl_md5: ADD.
+gsasl_hmac_md5: ADD.
+
+gsasl_hexdump: REMOVED. Never intended to be exported.
+
+gsasl_step: ADD.
+gsasl_step64: ADD.
+gsasl_client_step: DEPRECATED: use gsasl_step instead.
+gsasl_server_step: DEPRECATED: use gsasl_step instead.
+gsasl_client_step_base64: DEPRECATED: use gsasl_step64 instead.
+gsasl_server_step_base64: DEPRECATED: use gsasl_step64 instead.
+
+gsasl_finish: ADD.
+gsasl_client_finish: DEPRECATED: use gsasl_finish instead.
+gsasl_server_finish: DEPRECATED: use gsasl_finish instead.
+
+gsasl_ctx_get: ADD.
+gsasl_client_ctx_get: DEPRECATED: use gsasl_ctx_get instead.
+gsasl_server_ctx_get: DEPRECATED: use gsasl_ctx_get instead.
+
+gsasl_appinfo_get: ADD.
+gsasl_appinfo_set: ADD.
+gsasl_client_application_data_get: DEPRECATED: use gsasl_appinfo_get instead.
+gsasl_client_application_data_set: DEPRECATED: use gsasl_appinfo_set instead.
+gsasl_server_application_data_get: DEPRECATED: use gsasl_appinfo_get instead.
+gsasl_server_application_data_set: DEPRECATED: use gsasl_appinfo_set instead.
+
+Gsasl: ADD.
+Gsasl_ctx: DEPRECATED: use Gsasl instead.
+Gsasl_session: ADD.
+Gsasl_session_ctx: DEPRECATED: use Gsasl_session instead.
+
+GSASL_CRYPTO_ERROR: ADD, replaces deprecated GSASL_LIBGCRYPT_ERROR.
+GSASL_LIBGCRYPT_ERROR: DEPRECATED: use GSASL_CRYPTO_ERROR instead.
+
+GSASL_KERBEROS_V5_INTERNAL_ERROR: ADD, replaces deprecated GSASL_SHISHI_ERROR.
+GSASL_SHISHI_ERROR: DEPRECATED: use GSASL_KERBEROS_V5_INTERNAL_ERROR instead.
+
+GSASL_INVALID_HANDLE: ADD.
+
+* Noteworthy changes in release 0.0.8 (2003-10-11)
+
+** Improved GSSAPI implementation detection.
+Auto detection should work, unless you have both MIT and Heimdal, or
+wish to override the default that prefer GSS over Heimdal over MIT.
+In that case, use --enable-gssapi=mit or --enable-gssapi=heimdal.
+
+** GNU SASL contain APIs for internationalized string processing via SASLprep.
+You no longer have to use Libidn directly.
+
+** Man pages for all public functions are included.
+
+** GNULib is used for compatibility functions.
+The directory gl/ is dedicated for GNULib functions, and replace the
+earlier ad-hoc usage of argp, memset, etc.
+
+** GNU SASL will be C89 compatible.
+The library itself (lib/*) only use C89. The remaining parts (src/
+and tests/) can use C89 and any functionality from GNULib. This
+decision may be revised in the future, if it turns out there are
+problems with this.
+
+** Improvements for embedded or otherwise limited systems.
+The math library (-lm) is no longer required. All client code can be
+disabled by --disable-client, and all server code can be disabled by
+--disable-server. The internationalized string processing library can
+be disabled by --without-stringprep.
+
+** Gettext 0.12.1 and Libtool 1.5 is used.
+
+** Libgcrypt from CVS (1.1.42) is not supported.
+Recent libgcrypt is API incompatible with earlier released versions.
+If a too recent version is installed, it will not be used.
+
+** Fix command line tool '--connect --imap' on Solaris.
+
+** Bug fixes.
+
+** API and ABI modifications.
+Gsasl_client_callback_maxbuf: CHANGED: 'int' was replaced with 'size_t'.
+Gsasl_server_callback_maxbuf: CHANGED: 'int' was replaced with 'size_t'.
+gsasl_client_mechlist: NEW.
+gsasl_server_mechlist: NEW.
+gsasl_client_listmech: DEPRECATED: use gsasl_client_mechlist instead.
+gsasl_server_listmech: DEPRECATED: use gsasl_server_mechlist instead.
+gsasl_stringprep_nfkc: NEW.
+gsasl_stringprep_saslprep: NEW.
+gsasl_stringprep_trace: NEW.
+
+* Noteworthy changes in release 0.0.7 (2003-06-02)
+
+** Two new GSS libraries supported for the GSS-API mechanism.
+See http://josefsson.org/gss/ for GSS, which uses Shishi for Kerberos 5.
+See http://www.pdc.kth.se/heimdal/ for Heimdal (Kerberos 5).
+
+** Bug fixes.
+
+* Noteworthy changes in release 0.0.6 (2003-03-17)
+
+** Gettext not included.
+Due to some conflicts between libtool and gettext, if you want i18n on
+platforms that does not already have a useful gettext implementation,
+you must install GNU gettext before building this package. If you
+don't care about i18n, this package should work fine (except for i18n,
+of course).
+
+** Rudimentary support for KERBEROS_V5.
+Only enable if you want to write code. This adds two new API errors;
+GSASL_KERBEROS_V5_INIT_ERROR, GSASL_SHISHI_ERROR.
+
+** Added API function: gsasl_client_callback_realm_set.
+Specifies which realm the client belongs to.
+
+** Bugfixes.
+User visible aspects includes not building the API Reference Manual
+with GTK-DOC by default, if you want it use configure parameter
+--enable-gtk-doc.
+
+* Noteworthy changes in release 0.0.5 (2003-01-27)
+
+** Command line application "gsasl" now supports --imap and --connect.
+The --imap parameter makes it use a IMAP-like negotiation on
+stdin/stdout. The --connect parameter makes it connect to a host over
+TCP, and talk to it instead of stdin/stdout. This allows it to be
+used as a simple test tool to connect to IMAP servers. Currently
+integrity and confidentiality is not working properly, so if you use
+DIGEST-MD5 you currently have to specify --quality-of-protection=auth.
+
+** Texinfo documentation added for command line tool.
+
+** Libgcrypt initialization no longer causes a warning to be printed.
+
+** Added API reference manual in HTML format, generated using GTK-DOC.
+See doc/reference/, in particular doc/reference/html/index.html.
+
+** GNU Libidn replaces Libstringprep.
+Although it is still stored in the libstringprep/ directory for CVS
+reasons.
+
+** Bug fixes for DIGEST-MD5 and GSSAPI.
+
+* Noteworthy changes in release 0.0.4 (2002-12-13)
+
+** License changed to GPL.
+
+** Official GNU project.
+
+* Noteworthy changes in release 0.0.3 (2002-12-05)
+
+** New gsasl arguments --application-data and --no-client-first.
+
+** Bug fixes (client sends first, memory leaks, compiler warnings, more).
+
+* Noteworthy changes in release 0.0.2 (2002-11-07)
+
+** Includes a copy of libstringprep 0.0.2 for Unicode NFKC
+normalization and locale charset to UTF-8 string conversion, and
+preparation for the future if a SASL Stringprep profile is created.
+If libstringprep is already installed, it is used by default. You can
+force the use of the internal version with
+--without-system-libstringprep.
+
+** Uses pkg-config instead of libgsasl.m4 + libgsasl-config.in, and
+for finding libntlm (requires libntlm 0.3.1 or later).
+
+** Self tests for several mechanisms.
+
+** The API now allows mechanisms to return data even when returning
+GSASL_OK (earlier only on GSASL_NEEDS_MORE).
+
+** Bug fixes.
+
+* Noteworthy changes in release 0.0.1 (2002-10-12)
+
+** APIs for integrity and confidentiality protection of application
+payload data.
+
+** DIGEST-MD5 support for integrity protection.
+
+* Noteworthy changes in release 0.0.0 (2002-10-07)
+
+** Initial release.
+
+----------------------------------------------------------------------
+Copyright (C) 2002-2022 Simon Josefsson
+
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
diff --git a/curl-8.0.1_9-win64-mingw/dep/gsasl/README.txt b/curl-8.0.1_9-win64-mingw/dep/gsasl/README.txt
new file mode 100644
index 0000000..aa54f17
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/gsasl/README.txt
@@ -0,0 +1,75 @@
+# GNU SASL README -- Important introductory notes.
+
+GNU SASL is an implementation of the Simple Authentication and
+Security Layer (SASL) framework and a few common SASL mechanisms.
+SASL is used by network servers (e.g., IMAP, SMTP, XMPP) to request
+authentication from clients, and in clients to authenticate against
+servers.
+
+GNU SASL consists of a C library (libgsasl), a command-line
+application (gsasl), and a manual. The library supports the
+ANONYMOUS, CRAM-MD5, DIGEST-MD5, EXTERNAL, GS2-KRB5, GSSAPI, LOGIN,
+NTLM, OPENID20, PLAIN, SCRAM-SHA-1, SCRAM-SHA-1-PLUS, SCRAM-SHA-256,
+SCRAM-SHA-256-PLUS, SAML20, and SECURID mechanisms.
+
+The library is widely portable to any C89 platform. The command-line
+application requires POSIX or Windows for network communication.
+
+The [GNU SASL web page](https://www.gnu.org/software/gsasl/) provides
+current information about the project.
+
+# License
+
+The GNU SASL Library (lib/) is licensed under the GNU Lesser General
+Public License (LGPL) version 2.1 (or later). See the file
+COPYING.LIB. The GNU project typically uses the GNU General Public
+License (GPL) for libraries, and not the LGPL, but for this project we
+decided that we would get more help from the community if we used the
+LGPLv2.1+, as other free SASL implementations exists. See also
+.
+
+The command-line application and test suite (src/ and tests/) are
+licensed under the GNU General Public License license version 3.0 (or
+later). See the file COPYING.
+
+The documentation (doc/) is licensed under the GNU Free Documentation
+License version 1.3 (or later). See the file doc/fdl-1.3.texi.
+
+For any copyright year range specified as YYYY-ZZZZ in this package
+note that the range specifies every single year in that closed
+interval.
+
+# Support
+
+If you need help to use GNU SASL, or wish to help others, you are
+invited to join our mailing list help-gsasl@gnu.org, see
+.
+
+Things left to do below. If you like to start working on anything,
+please let me know so work duplication can be avoided.
+
+* Support channel bindings in GS2.
+* Authentication infrastructure implementing the callbacks for PAM,
+ Kerberos, SQL, etc. Separate project? GNU Mailutils has some
+ starting points for this, but the API is inflexible.
+* Provide standard callbacks for tty, GTK, gpg-agent etc. Probably
+ should be a separate library.
+* Port applications to use libgsasl
+* Bug: If gsasl_decode is handed a string longer than one SASL token,
+ the remaining data will be discarded. This means if the sender
+ packed two SASL tokens in one network packet, only the first will be
+ seen. The en/de-code functions should buffer the left over data
+ until the next invocation. Later: it isn't clear that people
+ actually need the security layer feature, and it seems better to
+ punt to TLS.
+* Security layer improvements (e.g., DES and AES in DIGEST-MD5).
+* Cleanup code, possibly by using some string abstraction library.
+* Privacy separation (authenticate in one process, pass state to another).
+* Improve documentation
+* Port to Cyclone? CCured?
+
+----------------------------------------------------------------------
+Copyright (C) 2002-2022 Simon Josefsson
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/COPYING.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/COPYING.txt
new file mode 100644
index 0000000..937ed32
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/COPYING.txt
@@ -0,0 +1,44 @@
+/* Copyright (c) 2004-2007 Sara Golemon
+ * Copyright (c) 2005,2006 Mikhail Gusarov
+ * Copyright (c) 2006-2007 The Written Word, Inc.
+ * Copyright (c) 2007 Eli Fant
+ * Copyright (c) 2009-2021 Daniel Stenberg
+ * Copyright (C) 2008, 2009 Simon Josefsson
+ * Copyright (c) 2000 Markus Friedl
+ * Copyright (c) 2015 Microsoft Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms,
+ * with or without modification, are permitted provided
+ * that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above
+ * copyright notice, this list of conditions and the
+ * following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following
+ * disclaimer in the documentation and/or other materials
+ * provided with the distribution.
+ *
+ * Neither the name of the copyright holder nor the names
+ * of any other contributors may be used to endorse or
+ * promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+ * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ */
+
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/NEWS.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/NEWS.txt
new file mode 100644
index 0000000..7e22b3d
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/NEWS.txt
@@ -0,0 +1,6831 @@
+ Changelog for the libssh2 project. Generated with git2news.pl
+
+Daniel Stenberg (29 Aug 2021)
+- [Will Cosgrove brought this change]
+
+ updated docs for 1.10.0 release
+
+Marc Hörsken (30 May 2021)
+- [Laurent Stacul brought this change]
+
+ [tests] Try several times to connect the ssh server
+
+ Sometimes, as the OCI container is run in detached mode, it is possible
+ the actual server is not ready yet to handle SSH traffic. The goal of
+ this PR is to try several times (max 3). The mechanism is the same as
+ for the connection to the docker machine.
+
+- [Laurent Stacul brought this change]
+
+ Remove openssh_server container on test exit
+
+- [Laurent Stacul brought this change]
+
+ Allow the tests to run inside a container
+
+ The current tests suite starts SSH server as OCI container. This commit
+ add the possibility to run the tests in a container provided that:
+
+ * the docker client is installed builder container
+ * the host docker daemon unix socket has been mounted in the builder
+ container (with, if needed, the DOCKER_HOST environment variable
+ accordingly set, and the permission to write on this socket)
+ * the builder container is run on the default bridge network, or the
+ host network. This PR does not handle the case where the builder
+ container is on another network.
+
+Marc Hoersken (28 May 2021)
+- CI/appveyor: run SSH server for tests on GitHub Actions (#607)
+
+ No longer rely on DigitalOcean to host the Docker container.
+
+ Unfortunately we require a small dispatcher script that has
+ access to a GitHub access token with scope repo in order to
+ trigger the daemon workflow on GitHub Actions also for PRs.
+
+ This script is hosted by myself for the time being until GitHub
+ provides a tighter scope to trigger the workflow_dispatch event.
+
+GitHub (26 May 2021)
+- [Will Cosgrove brought this change]
+
+ openssl.c: guards around calling FIPS_mode() #596 (#603)
+
+ Notes:
+ FIPS_mode() is not implemented in LibreSSL and this API is removed in OpenSSL 3.0 and was introduced in 0.9.7. Added guards around making this call.
+
+ Credit:
+ Will Cosgrove
+
+- [Will Cosgrove brought this change]
+
+ configure.ac: don't undefine scoped variable (#594)
+
+ * configure.ac: don't undefine scoped variable
+
+ To get this script to run with Autoconf 2.71 on macOS I had to remove the undefine of the backend for loop variable. It seems scoped to the for loop and also isn't referenced later in the script so it seems OK to remove it.
+
+ * configure.ac: remove cygwin specific CFLAGS #598
+
+ Notes:
+ Remove cygwin specific Win32 CFLAGS and treat the build like a posix build
+
+ Credit:
+ Will Cosgrove, Brian Inglis
+
+- [Laurent Stacul brought this change]
+
+ tests: Makefile.am: Add missing tests client keys in distribution tarball (#604)
+
+ Notes:
+ Added missing test keys.
+
+ Credit:
+ Laurent Stacul
+
+- [Laurent Stacul brought this change]
+
+ Makefile.am: Add missing test keys in the distribution tarball (#601)
+
+ Notes:
+ Fix tests missing key to build the OCI image
+
+ Credit:
+ Laurent Stacul
+
+Daniel Stenberg (16 May 2021)
+- dist: add src/agent.h
+
+ Fixes #597
+ Closes #599
+
+GitHub (12 May 2021)
+- [Will Cosgrove brought this change]
+
+ packet.c: Reset read timeout after received a packet (#576) (#586)
+
+ File:
+ packet.c
+
+ Notes:
+ Attempt keyboard interactive login (Azure AD 2FA login) and use more than 60 seconds to complete the login, the connection fails.
+
+ The _libssh2_packet_require function does almost the same as _libssh2_packet_requirev but this function sets state->start = 0 before returning.
+
+ Credit:
+ teottin, Co-authored-by: Tor Erik Ottinsen
+
+- [kkoenig brought this change]
+
+ Support ECDSA certificate authentication (#570)
+
+ Files: hostkey.c, userauth.c, test_public_key_auth_succeeds_with_correct_ecdsa_key.c
+
+ Notes:
+ Support ECDSA certificate authentication
+
+ Add a test for:
+ - Existing ecdsa basic public key authentication
+ - ecdsa public key authentication with a signed public key
+
+ Credit:
+ kkoenig
+
+- [Gabriel Smith brought this change]
+
+ agent.c: Add support for Windows OpenSSH agent (#517)
+
+ Files: agent.c, agent.h, agent_win.c
+
+ Notes:
+ * agent: Add support for Windows OpenSSH agent
+
+ The implementation was partially taken and modified from that found in
+ the Portable OpenSSH port to Win32 by the PowerShell team, but mostly
+ based on the existing Unix OpenSSH agent support.
+
+ https://github.com/PowerShell/openssh-portable
+
+ Regarding the partial transfer support implementation: partial transfers
+ are easy to deal with, but you need to track additional state when
+ non-blocking IO enters the picture. A tracker of how many bytes have
+ been transfered has been placed in the transfer context struct as that's
+ where it makes most sense. This tracker isn't placed behind a WIN32
+ #ifdef as it will probably be useful for other agent implementations.
+
+ * agent: win32 openssh: Disable overlapped IO
+
+ Non-blocking IO is not currently supported by the surrounding agent
+ code, despite a lot of the code having everything set up to handle it.
+
+ Credit:
+ Co-authored-by: Gabriel Smith
+
+- [Zenju brought this change]
+
+ Fix detailed _libssh2_error being overwritten (#473)
+
+ Files: openssl.c, pem.c, userauth.c
+
+ Notes:
+ * Fix detailed _libssh2_error being overwritten by generic errors
+ * Unified error handling
+
+ Credit:
+ Zenju
+
+- [Paul Capron brought this change]
+
+ Fix _libssh2_random() silently discarding errors (#520)
+
+ Notes:
+ * Make _libssh2_random return code consistent
+
+ Previously, _libssh2_random was advertized in HACKING.CRYPTO as
+ returning `void` (and was implemented that way in os400qc3.c), but that
+ was in other crypto backends a lie; _libssh2_random is (a macro
+ expanding) to an int-value expression or function.
+
+ Moreover, that returned code was:
+ — 0 or success, -1 on error for the MbedTLS & WinCNG crypto backends
+ But also:
+ — 1 on success, -1 or 0 on error for the OpenSSL backend!
+ – 1 on success, error cannot happen for libgcrypt!
+
+ This commit makes explicit that _libssh2_random can fail (because most of
+ the underlying crypto functions can indeed fail!), and it makes its result
+ code consistent: 0 on success, -1 on error.
+
+ This is related to issue #519 https://github.com/libssh2/libssh2/issues/519
+ It fixes the first half of it.
+
+ * Don't silent errors of _libssh2_random
+
+ Make sure to check the returned code of _libssh2_random(), and
+ propagates any failure.
+
+ A new LIBSSH_ERROR_RANDGEN constant is added to libssh2.h
+ None of the existing error constants seemed fit.
+
+ This commit is related to d74285b68450c0e9ea6d5f8070450837fb1e74a7
+ and to https://github.com/libssh2/libssh2/issues/519 (see the issue
+ for more info.) It closes #519.
+
+ Credit:
+ Paul Capron
+
+- [Gabriel Smith brought this change]
+
+ ci: Remove caching of docker image layers (#589)
+
+ Notes:
+ continued ci reliability work.
+
+ Credit:
+ Gabriel Smith
+
+- [Gabriel Smith brought this change]
+
+ ci: Speed up docker builds for tests (#587)
+
+ Notes:
+ The OpenSSH server docker image used for tests is pre-built to prevent
+ wasting time building it during a test, and unneeded rebuilds are
+ prevented by caching the image layers.
+
+ Credit:
+ Gabriel Smith
+
+- [Will Cosgrove brought this change]
+
+ userauth.c: don't error if using keys without RSA (#555)
+
+ file: userauth.c
+
+ notes: libssh2 now supports many other key types besides RSA, if the library is built without RSA support and a user attempts RSA auth it shouldn't be an automatic error
+
+ credit:
+ Will Cosgrove
+
+- [Marc brought this change]
+
+ openssl.c: Avoid OpenSSL latent error in FIPS mode (#528)
+
+ File:
+ openssl.c
+
+ Notes:
+ Avoid initing MD5 digest, which is not permitted in OpenSSL FIPS certified cryptography mode.
+
+ Credit:
+ Marc
+
+- [Laurent Stacul brought this change]
+
+ openssl.c: Fix EVP_Cipher interface change in openssl 3 #463
+
+ File:
+ openssl.c
+
+ Notes:
+ Fixes building with OpenSSL 3, #463.
+
+ The change is described there:
+ https://github.com/openssl/openssl/commit/f7397f0d58ce7ddf4c5366cd1846f16b341fbe43
+
+ Credit:
+ Laurent Stacul, reported by Sergei
+
+- [Gabriel Smith brought this change]
+
+ openssh_fixture.c: Fix potential overwrite of buffer when reading stdout of command (#580)
+
+ File:
+ openssh_fixture.c
+ Notes:
+ If reading the full output from the executed command took multiple
+ passes (such as when reading multiple lines) the old code would read
+ into the buffer starting at the some position (the start) every time.
+ The old code only works if fgets updated p or had an offset parameter,
+ both of which are not true.
+
+ Credit:
+ Gabriel Smith
+
+- [Gabriel Smith brought this change]
+
+ ci: explicitly state the default branch (#585)
+
+ Notes:
+ It looks like the $default-branch macro only works in templates, not
+ workflows. This is not explicitly stated anywhere except the linked PR
+ comment.
+
+ https://github.com/actions/starter-workflows/pull/590#issuecomment-672360634
+
+ credit:
+ Gabriel Smith
+
+- [Gabriel Smith brought this change]
+
+ ci: Swap from Travis to Github Actions (#581)
+
+ Files: ci files
+
+ Notes:
+ Move Linux CI using Github Actions
+
+ Credit:
+ Gabriel Smith, Marc Hörsken
+
+- [Mary brought this change]
+
+ libssh2_priv.h: add iovec on 3ds (#575)
+
+ file: libssh2_priv.h
+ note: include iovec for 3DS
+ credit: Mary Mstrodl
+
+- [Laurent Stacul brought this change]
+
+ Tests: Fix unused variables warning (#561)
+
+ file: test_public_key_auth_succeeds_with_correct_ed25519_key_from_mem.c
+
+ notes: fixed unused vars
+
+ credit:
+ Laurent Stacul
+
+- [Viktor Szakats brought this change]
+
+ bcrypt_pbkdf.c: fix clang10 false positive warning (#563)
+
+ File: bcrypt_pbkdf.c
+
+ Notes:
+ blf_enc() takes a number of 64-bit blocks to encrypt, but using
+ sizeof(uint64_t) in the calculation triggers a warning with
+ clang 10 because the actual data type is uint32_t. Pass
+ BCRYPT_BLOCKS / 2 for the number of blocks like libc bcrypt(3)
+ does.
+
+ Ref: https://github.com/openbsd/src/commit/04a2240bd8f465bcae6b595d912af3e2965856de
+
+ Fixes #562
+
+ Credit:
+ Viktor Szakats
+
+- [Will Cosgrove brought this change]
+
+ transport.c: release payload on error (#554)
+
+ file: transport.c
+ notes: If the payload is invalid and there is an early return, we could leak the payload
+ credit:
+ Will Cosgrove
+
+- [Will Cosgrove brought this change]
+
+ ssh2_client_fuzzer.cc: fixed building
+
+ The GitHub web editor did some funky things
+
+- [Will Cosgrove brought this change]
+
+ ssh_client_fuzzer.cc: set blocking mode on (#553)
+
+ file: ssh_client_fuzzer.cc
+
+ notes: the session needs blocking mode turned on to avoid EAGAIN being returned from libssh2_session_handshake()
+
+ credit:
+ Will Cosgrove, reviewed by Michael Buckley
+
+- [Etienne Samson brought this change]
+
+ Add a LINT option to CMake (#372)
+
+ * ci: make style-checking available locally
+
+ * cmake: add a linting target
+
+ * tests: check test suite syntax with checksrc.pl
+
+- [Will Cosgrove brought this change]
+
+ kex.c: kex_agree_instr() improve string reading (#552)
+
+ * kex.c: kex_agree_instr() improve string reading
+
+ file: kex.c
+ notes: if haystack isn't null terminated we should use memchr() not strchar(). We should also make sure we don't walk off the end of the buffer.
+ credit:
+ Will Cosgrove, reviewed by Michael Buckley
+
+- [Will Cosgrove brought this change]
+
+ kex.c: use string_buf in ecdh_sha2_nistp (#551)
+
+ * kex.c: use string_buf in ecdh_sha2_nistp
+
+ file: kex.c
+
+ notes:
+ use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
+
+- [Will Cosgrove brought this change]
+
+ kex.c: move EC macro outside of if check #549 (#550)
+
+ File: kex.c
+
+ Notes:
+ Moved the macro LIBSSH2_KEX_METHOD_EC_SHA_HASH_CREATE_VERIFY outside of the LIBSSH2_ECDSA since it's also now used by the ED25519 code.
+
+ Sha 256, 384 and 512 need to be defined for all backends now even if they aren't used directly. I believe this is already the case, but just a heads up.
+
+ Credit:
+ Stefan-Ghinea
+
+- [Tim Gates brought this change]
+
+ kex.c: fix simple typo, niumber -> number (#545)
+
+ File: kex.c
+
+ Notes:
+ There is a small typo in src/kex.c.
+
+ Should read `number` rather than `niumber`.
+
+ Credit:
+ Tim Gates
+
+- [Tseng Jun brought this change]
+
+ session.c: Correct a typo which may lead to stack overflow (#533)
+
+ File: session.c
+
+ Notes:
+ Seems the author intend to terminate banner_dup buffer, later, print it to the debug console.
+
+ Author:
+ Tseng Jun
+
+Marc Hoersken (10 Oct 2020)
+- wincng: fix random big number generation to match openssl
+
+ The old function would set the least significant bits in
+ the most significant byte instead of the most significant bits.
+
+ The old function would also zero pad too much bits in the
+ most significant byte. This lead to a reduction of key space
+ in the most significant byte according to the following listing:
+ - 8 bits reduced to 0 bits => eg. 2048 bits to 2040 bits DH key
+ - 7 bits reduced to 1 bits => eg. 2047 bits to 2041 bits DH key
+ - 6 bits reduced to 2 bits => eg. 2046 bits to 2042 bits DH key
+ - 5 bits reduced to 3 bits => eg. 2045 bits to 2043 bits DH key
+
+ No change would occur for the case of 4 significant bits.
+ For 1 to 3 significant bits in the most significant byte
+ the DH key would actually be expanded instead of reduced:
+ - 3 bits expanded to 5 bits => eg. 2043 bits to 2045 bits DH key
+ - 2 bits expanded to 6 bits => eg. 2042 bits to 2046 bits DH key
+ - 1 bits expanded to 7 bits => eg. 2041 bits to 2047 bits DH key
+
+ There is no case of 0 significant bits in the most significant byte
+ since this would be a case of 8 significant bits in the next byte.
+
+ At the moment only the following case applies due to a fixed
+ DH key size value currently being used in libssh2:
+
+ The DH group_order is fixed to 256 (bytes) which leads to a
+ 2047 bits DH key size by calculating (256 * 8) - 1.
+
+ This means the DH keyspace was previously reduced from 2047 bits
+ to 2041 bits (while the top and bottom bits are always set), so the
+ keyspace is actually always reduced from 2045 bits to 2039 bits.
+
+ All of this is only relevant for Windows versions supporting the
+ WinCNG backend (Vista or newer) before Windows 10 version 1903.
+
+ Closes #521
+
+Daniel Stenberg (28 Sep 2020)
+- libssh2_session_callback_set.3: explain the recv/send callbacks
+
+ Describe how to actually use these callbacks.
+
+ Closes #518
+
+GitHub (23 Sep 2020)
+- [Will Cosgrove brought this change]
+
+ agent.c: formatting
+
+ Improved formatting of RECV_SEND_ALL macro.
+
+- [Will Cosgrove brought this change]
+
+ CMakeLists.txt: respect install lib dir #405 (#515)
+
+ Files:
+ CMakeLists.txt
+
+ Notes:
+ Use CMAKE_INSTALL_LIBDIR directory
+
+ Credit: Arfrever
+
+- [Will Cosgrove brought this change]
+
+ kex.c: group16-sha512 and group18-sha512 support #457 (#468)
+
+ Files: kex.c
+
+ Notes:
+ Added key exchange group16-sha512 and group18-sha512. As a result did the following:
+
+ Abstracted diffie_hellman_sha256() to diffie_hellman_sha_algo() which is now algorithm agnostic and takes the algorithm as a parameter since we needed sha512 support. Unfortunately it required some helper functions but they are simple.
+ Deleted diffie_hellman_sha1()
+ Deleted diffie_hellman_sha1 specific macro
+ Cleaned up some formatting
+ Defined sha384 in os400 and wincng backends
+ Defined LIBSSH2_DH_MAX_MODULUS_BITS to abort the connection if we receive too large of p from the server doing sha1 key exchange.
+ Reorder the default key exchange list to match OpenSSH and improve security
+
+ Credit:
+ Will Cosgrove
+
+- [Igor Klevanets brought this change]
+
+ agent.c: Recv and send all bytes via network in agent_transact_unix() (#510)
+
+ Files: agent.c
+
+ Notes:
+ Handle sending/receiving partial packet replies in agent.c API.
+
+ Credit: Klevanets Igor
+
+- [Daniel Stenberg brought this change]
+
+ Makefile.am: include all test files in the dist #379
+
+ File:
+ Makefile.am
+
+ Notes:
+ No longer conditionally include OpenSSL specific test files, they aren't run if we're not building against OpenSSL 1.1.x anyway.
+
+ Credit:
+ Daniel Stenberg
+
+- [Max Dymond brought this change]
+
+ Add support for an OSS Fuzzer fuzzing target (#392)
+
+ Files:
+ .travis.yml, configure.ac, ossfuzz
+
+ Notes:
+ This adds support for an OSS-Fuzz fuzzing target in ssh2_client_fuzzer,
+ which is a cut down example of ssh2.c. Future enhancements can improve
+ coverage.
+
+ Credit:
+ Max Dymond
+
+- [Sebastián Katzer brought this change]
+
+ mbedtls.c: ECDSA support for mbed TLS (#385)
+
+ Files:
+ mbedtls.c, mbedtls.h, .travis.yml
+
+ Notes:
+ This PR adds support for ECDSA for both key exchange and host key algorithms.
+
+ The following elliptic curves are supported:
+
+ 256-bit curve defined by FIPS 186-4 and SEC1
+ 384-bit curve defined by FIPS 186-4 and SEC1
+ 521-bit curve defined by FIPS 186-4 and SEC1
+
+ Credit:
+ Sebastián Katzer
+
+Marc Hoersken (1 Sep 2020)
+- buildconf: exec autoreconf to avoid additional process (#512)
+
+ Also make buildconf exit with the return code of autoreconf.
+
+ Follow up to #224
+
+- scp.c: fix indentation in shell_quotearg documentation
+
+- wincng: make more use of new helper functions (#496)
+
+- wincng: make sure algorithm providers are closed once (#496)
+
+GitHub (10 Jul 2020)
+- [David Benjamin brought this change]
+
+ openssl.c: clean up curve25519 code (#499)
+
+ File: openssl.c, openssl.h, crypto.h, kex.c
+
+ Notes:
+ This cleans up a few things in the curve25519 implementation:
+
+ - There is no need to create X509_PUBKEYs or PKCS8_PRIV_KEY_INFOs to
+ extract key material. EVP_PKEY_get_raw_private_key and
+ EVP_PKEY_get_raw_public_key work fine.
+
+ - libssh2_x25519_ctx was never used (and occasionally mis-typedefed to
+ libssh2_ed25519_ctx). Remove it. The _libssh2_curve25519_new and
+ _libssh2_curve25519_gen_k interfaces use the bytes. Note, if it needs
+ to be added back, there is no need to roundtrip through
+ EVP_PKEY_new_raw_private_key. EVP_PKEY_keygen already generated an
+ EVP_PKEY.
+
+ - Add some missing error checks.
+
+ Credit:
+ David Benjamin
+
+- [Will Cosgrove brought this change]
+
+ transport.c: socket is disconnected, return error (#500)
+
+ File: transport.c
+
+ Notes:
+ This is to fix #102, instead of continuing to attempt to read a disconnected socket, it will now error out.
+
+ Credit:
+ TDi-jonesds
+
+- [Will Cosgrove brought this change]
+
+ stale.yml
+
+ Increasing stale values.
+
+Marc Hoersken (6 Jul 2020)
+- wincng: try newer DH API first, fallback to legacy RSA API
+
+ Avoid the use of RtlGetVersion or similar Win32 functions,
+ since these depend on version information from manifests.
+
+ This commit makes the WinCNG backend first try to use the
+ new DH algorithm API with the raw secret derivation feature.
+ In case this feature is not available the WinCNG backend
+ will fallback to the classic approach of using RSA-encrypt
+ to perform the required modular exponentiation of BigNums.
+
+ The feature availability test is done during the first handshake
+ and the result is stored in the crypto backends global state.
+
+ Follow up to #397
+ Closes #484
+
+- wincng: fix indentation of function arguments and comments
+
+ Follow up to #397
+
+- [Wez Furlong brought this change]
+
+ wincng: use newer DH API for Windows 8.1+
+
+ Since Windows 1903 the approach used to perform DH kex with the CNG
+ API has been failing.
+
+ This commit switches to using the `DH` algorithm provider to perform
+ generation of the key pair and derivation of the shared secret.
+
+ It uses a feature of CNG that is not yet documented. The sources of
+ information that I've found on this are:
+
+ * https://stackoverflow.com/a/56378698/149111
+ * https://github.com/wbenny/mini-tor/blob/5d39011e632be8e2b6b1819ee7295e8bd9b7a769/mini/crypto/cng/dh.inl#L355
+
+ With this change I am able to successfully connect from Windows 10 to my
+ ubuntu system.
+
+ Refs: https://github.com/alexcrichton/ssh2-rs/issues/122
+ Fixes: https://github.com/libssh2/libssh2/issues/388
+ Closes: https://github.com/libssh2/libssh2/pull/397
+
+GitHub (1 Jul 2020)
+- [Zenju brought this change]
+
+ comp.c: Fix name clash with ZLIB macro "compress" (#418)
+
+ File: comp.c
+
+ Notes:
+ * Fix name clash with ZLIB macro "compress".
+
+ Credit:
+ Zenju
+
+- [yann-morin-1998 brought this change]
+
+ buildsystem: drop custom buildconf script, rely on autoreconf (#224)
+
+ Notes:
+ The buildconf script is currently required, because we need to copy a
+ header around, because it is used both from the library and the examples
+ sources.
+
+ However, having a custom 'buildconf'-like script is not needed if we can
+ ensure that the header exists by the time it is needed. For that, we can
+ just append the src/ directory to the headers search path for the
+ examples.
+
+ And then it means we no longer need to generate the same header twice,
+ so we remove the second one from configure.ac.
+
+ Now, we can just call "autoreconf -fi" to generate the autotools files,
+ instead of relying on the canned sequence in "buildconf", since
+ autoreconf has now long known what to do at the correct moment (future
+ versions of autotools, automake, autopoint, autoheader etc... may
+ require an other ordering, or other intermediate steps, etc...).
+
+ Eventually, get rid of buildconf now it is no longer needed. In fact, we
+ really keep it for legacy, but have it just call autoreconf (and print a
+ nice user-friendly warning). Don't include it in the release tarballs,
+ though.
+
+ Update doc, gitignore, and travis-CI jobs accordingly.
+
+ Credit:
+ Signed-off-by: "Yann E. MORIN"
+ Cc: Sam Voss
+
+- [Will Cosgrove brought this change]
+
+ libssh2.h: Update Diffie Hellman group values (#493)
+
+ File: libssh2.h
+
+ Notes:
+ Update the min, preferred and max DH group values based on RFC 8270.
+
+ Credit:
+ Will Cosgrove, noted from email list by Mitchell Holland
+
+Marc Hoersken (22 Jun 2020)
+- travis: use existing Makefile target to run checksrc
+
+- Makefile: also run checksrc on test source files
+
+- tests: avoid use of deprecated function _sleep (#490)
+
+- tests: avoid use of banned function strncat (#489)
+
+- tests: satisfy checksrc regarding max line length of 79 chars
+
+ Follow up to 2764bc8e06d51876b6796d6080c6ac51e20f3332
+
+- tests: satisfy checksrc with whitespace only fixes
+
+ checksrc.pl -i4 -m79 -ASIZEOFNOPAREN -ASNPRINTF
+ -ACOPYRIGHT -AFOPENMODE tests/*.[ch]
+
+- tests: add support for ports published via Docker for Windows
+
+- tests: restore retry behaviour for docker-machine ip command
+
+- tests: fix mix of declarations and code failing C89 compliance
+
+- wincng: add and improve checks in bit counting function
+
+- wincng: align bits to bytes calculation in all functions
+
+- wincng: do not disable key validation that can be enabled
+
+ The modular exponentiation also works with key validation enabled.
+
+- wincng: fix return value in _libssh2_dh_secret
+
+ Do not ignore return value of modular exponentiation.
+
+- appveyor: build and run tests for WinCNG crypto backend
+
+GitHub (1 Jun 2020)
+- [suryakalpo brought this change]
+
+ INSTALL_CMAKE.md: Update formatting (#481)
+
+ File: INSTALL_CMAKE.md
+
+ Notes:
+ Although the original text would be immediately clear to seasoned users of CMAKE and/or Unix shell, the lack of newlines may cause some confusion for newcomers. Hence, wrapping the texts in a md code-block such that the newlines appear as intended.
+
+ credit:
+ suryakalpo
+
+Marc Hoersken (31 May 2020)
+- src: add new and align include guards in header files (#480)
+
+ Make sure all include guards exist and follow the same format.
+
+- wincng: fix multiple definition of `_libssh2_wincng' (#479)
+
+ Add missing include guard and move global state
+ from header to source file by using extern.
+
+GitHub (28 May 2020)
+- [Will Cosgrove brought this change]
+
+ transport.c: moving total_num check from #476 (#478)
+
+ file: transport.c
+
+ notes:
+ moving total_num zero length check from #476 up to the prior bounds check which already includes a total_num check. Makes it slightly more readable.
+
+ credit:
+ Will Cosgrove
+
+- [lutianxiong brought this change]
+
+ transport.c: fix use-of-uninitialized-value (#476)
+
+ file:transport.c
+
+ notes:
+ return error if malloc(0)
+
+ credit:
+ lutianxiong
+
+- [Dr. Koutheir Attouchi brought this change]
+
+ libssh2_sftp.h: Changed type of LIBSSH2_FX_* constants to unsigned long, fixes #474
+
+ File:
+ libssh2_sftp.h
+
+ Notes:
+ Error constants `LIBSSH2_FX_*` are only returned by `libssh2_sftp_last_error()` which returns `unsigned long`.
+ Therefore these constants should be defined as unsigned long literals, instead of int literals.
+
+ Credit:
+ Dr. Koutheir Attouchi
+
+- [monnerat brought this change]
+
+ os400qc3.c: constify libssh2_os400qc3_hash_update() data parameter. (#469)
+
+ Files: os400qc3.c, os400qc3.h
+
+ Notes:
+ Fixes building on OS400. #426
+
+ Credit:
+ Reported-by: hjindra on github, dev by Monnerat
+
+- [monnerat brought this change]
+
+ HACKING.CRYPTO: keep up to date with new crypto definitions from code. (#466)
+
+ File: HACKING.CRYPTO
+
+ Notes:
+ This commit updates the HACKING.CRYPTO documentation file in an attempt to make it in sync with current code.
+ New documented features are:
+
+ SHA384
+ SHA512
+ ECDSA
+ ED25519
+
+ Credit:
+ monnerat
+
+- [Harry Sintonen brought this change]
+
+ kex.c: Add diffie-hellman-group14-sha256 Key Exchange Method (#464)
+
+ File: kex.c
+
+ Notes: Added diffie-hellman-group14-sha256 kex
+
+ Credit: Harry Sintonen
+
+- [Will Cosgrove brought this change]
+
+ os400qc3.h: define sha512 macros (#465)
+
+ file: os400qc3.h
+ notes: fixes for building libssh2 1.9.x
+
+- [Will Cosgrove brought this change]
+
+ os400qc3.h: define EC types to fix building #426 (#462)
+
+ File: os400qc3.h
+ Notes: define missing EC types which prevents building
+ Credit: hjindra
+
+- [Brendan Shanks brought this change]
+
+ hostkey.c: Fix 'unsigned int'/'uint32_t' mismatch (#461)
+
+ File: hostkey.c
+
+ Notes:
+ These types are the same size so most compilers are fine with it, but CodeWarrior (on classic MacOS) throws an ‘illegal implicit conversion’ error
+
+ Credit: Brendan Shanks
+
+- [Thomas Klausner brought this change]
+
+ Makefile.am: Fix unportable test(1) operator. (#459)
+
+ file: Makefile.am
+
+ Notes:
+ The POSIX comparison operator for test(1) is =; bash supports == but not even test from GNU coreutils does.
+
+ Credit:
+ Thomas Klausner
+
+- [Tseng Jun brought this change]
+
+ openssl.c: minor changes of coding style (#454)
+
+ File: openssl.c
+
+ Notes:
+ minor changes of coding style and align preprocessor conditional for #439
+
+ Credit:
+ Tseng Jun
+
+- [Hans Meier brought this change]
+
+ openssl.c: Fix for use of uninitialized aes_ctr_cipher.key_len (#453)
+
+ File:
+ Openssl.c
+
+ Notes:
+ * Fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression from #439
+
+ Credit:
+ Hans Meirer, Tseng Jun
+
+- [Zenju brought this change]
+
+ agent.c: Fix Unicode builds on Windows (#417)
+
+ File: agent.c
+
+ Notes:
+ Fixes unicode builds for Windows in Visual Studio 16.3.2.
+
+ Credit:
+ Zenju
+
+- [Hans Meier brought this change]
+
+ openssl.c: Fix use-after-free crash in openssl backend without memory leak (#439)
+
+ Files: openssl.c
+
+ Notes:
+ Fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
+
+ Credit:
+ Hans Meier
+
+- [Romain Geissler @ Amadeus brought this change]
+
+ Session.c: Fix undefined warning when mixing with LTO-enabled libcurl. (#449)
+
+ File: Session.c
+
+ Notes:
+ With gcc 9, libssh2, libcurl and LTO enabled for all binaries I see this
+ warning (error with -Werror):
+
+ vssh/libssh2.c: In function ‘ssh_statemach_act’:
+ /data/mwrep/rgeissler/ospack/ssh2/BUILD/libssh2-libssh2-03c7c4a/src/session.c:579:9: error: ‘seconds_to_next’ is used uninitialized in this function [-Werror=uninitialized]
+ 579 | int seconds_to_next;
+ | ^
+ lto1: all warnings being treated as errors
+
+ Gcc normally issues -Wuninitialized when it is sure there is a problem,
+ and -Wmaybe-uninitialized when it's not sure, but it's possible. Here
+ the compiler seems to have find a real case where this could happen. I
+ looked in your code and overall it seems you always check if the return
+ code is non null, not often that it's below zero. I think we should do
+ the same here. With this patch, gcc is fine.
+
+ Credit:
+ Romain-Geissler-1A
+
+- [Zenju brought this change]
+
+ transport.c: Fix crash with delayed compression (#443)
+
+ Files: transport.c
+
+ Notes:
+ Fixes crash with delayed compression option using Bitvise server.
+
+ Contributor:
+ Zenju
+
+- [Will Cosgrove brought this change]
+
+ Update INSTALL_MAKE path to INSTALL_MAKE.md (#446)
+
+ Included for #429
+
+- [Will Cosgrove brought this change]
+
+ Update INSTALL_CMAKE filename to INSTALL_CMAKE.md (#445)
+
+ Fixing for #429
+
+- [Wallace Souza brought this change]
+
+ Rename INSTALL_CMAKE to INTALL_CMAKE.md (#429)
+
+ Adding Markdown file extension in order to Github render the instructions properly
+
+Will Cosgrove (17 Dec 2019)
+- [Daniel Stenberg brought this change]
+
+ include/libssh2.h: fix comment: the known host key uses 4 bits (#438)
+
+- [Zenju brought this change]
+
+ ssh-ed25519: Support PKIX + calc pubkey from private (#416)
+
+ Files: openssl.c/h
+ Author: Zenju
+ Notes:
+ Adds support for PKIX key reading by fixing:
+
+ _libssh2_pub_priv_keyfile() is missing the code to extract the ed25519 public key from a given private key
+
+ _libssh2_ed25519_new_private_frommemory is only parsing the openssh key format but does not understand PKIX (as retrieved via PEM_read_bio_PrivateKey)
+
+GitHub (15 Oct 2019)
+- [Will Cosgrove brought this change]
+
+ .travis.yml: Fix Chrome and 32 bit builds (#423)
+
+ File: .travis.yml
+
+ Notes:
+ * Fix Chrome installing by using Travis build in directive
+ * Update to use libgcrypt20-dev package to fix 32 bit builds based on comments found here:
+ https://launchpad.net/ubuntu/xenial/i386/libgcrypt11-dev
+
+- [Will Cosgrove brought this change]
+
+ packet.c: improved parsing in packet_x11_open (#410)
+
+ Use new API to parse data in packet_x11_open() for better bounds checking.
+
+Will Cosgrove (12 Sep 2019)
+- [Michael Buckley brought this change]
+
+ knownhost.c: Double the static buffer size when reading and writing known hosts (#409)
+
+ Notes:
+ We had a user who was being repeatedly prompted to accept a server key repeatedly. It turns out the base64-encoded key was larger than the static buffers allocated to read and write known hosts. I doubled the size of these buffers.
+
+ Credit:
+ Michael Buckley
+
+GitHub (4 Sep 2019)
+- [Will Cosgrove brought this change]
+
+ packet.c: improved packet parsing in packet_queue_listener (#404)
+
+ * improved bounds checking in packet_queue_listener
+
+ file: packet.c
+
+ notes:
+ improved parsing packet in packet_queue_listener
+
+- [Will Cosgrove brought this change]
+
+ packet.c: improve message parsing (#402)
+
+ * packet.c: improve parsing of packets
+
+ file: packet.c
+
+ notes:
+ Use _libssh2_get_string API in SSH_MSG_DEBUG/SSH_MSG_DISCONNECT. Additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST.
+
+- [Will Cosgrove brought this change]
+
+ misc.c: _libssh2_ntohu32 cast bit shifting (#401)
+
+ To quite overly aggressive analyzers.
+
+ Note, the builds pass, Travis is having some issues with Docker images.
+
+- [Will Cosgrove brought this change]
+
+ kex.c: improve bounds checking in kex_agree_methods() (#399)
+
+ file: kex.c
+
+ notes:
+ use _libssh2_get_string instead of kex_string_pair which does additional checks
+
+Will Cosgrove (23 Aug 2019)
+- [Fabrice Fontaine brought this change]
+
+ acinclude.m4: add mbedtls to LIBS (#371)
+
+ Notes:
+ This is useful for static builds so that the Libs.private field in
+ libssh2.pc contains correct info for the benefit of pkg-config users.
+ Static link with libssh2 requires this information.
+
+ Signed-off-by: Baruch Siach
+ [Retrieved from:
+ https://git.buildroot.net/buildroot/tree/package/libssh2/0002-acinclude.m4-add-mbedtls-to-LIBS.patch]
+ Signed-off-by: Fabrice Fontaine
+
+ Credit:
+ Fabrice Fontaine
+
+- [jethrogb brought this change]
+
+ Generate debug info when building with MSVC (#178)
+
+ files: CMakeLists.txt
+
+ notes: Generate debug info when building with MSVC
+
+ credit:
+ jethrogb
+
+- [Panos brought this change]
+
+ Add agent forwarding implementation (#219)
+
+ files: channel.c, test_agent_forward_succeeds.c, libssh2_priv.h, libssh2.h, ssh2_agent_forwarding.c
+
+ notes:
+ * Adding SSH agent forwarding.
+ * Fix agent forwarding message, updated example.
+ Added integration test code and cmake target. Added example to cmake list.
+
+ credit:
+ pkittenis
+
+GitHub (2 Aug 2019)
+- [Will Cosgrove brought this change]
+
+ Update EditorConfig
+
+ Added max_line_length = 80
+
+- [Will Cosgrove brought this change]
+
+ global.c : fixed call to libssh2_crypto_exit #394 (#396)
+
+ * global.c : fixed call to libssh2_crypto_exit #394
+
+ File: global.c
+
+ Notes: Don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
+
+ Credit: seba30
+
+Will Cosgrove (30 Jul 2019)
+- [hlefebvre brought this change]
+
+ misc.c : Add an EWOULDBLOCK check for better portability (#172)
+
+ File: misc.c
+
+ Notes: Added support for all OS' that implement EWOULDBLOCK, not only VMS
+
+ Credit: hlefebvre
+
+- [Etienne Samson brought this change]
+
+ userauth.c: fix off by one error when loading public keys with no id (#386)
+
+ File: userauth.c
+
+ Credit:
+ Etienne Samson
+
+ Notes:
+ Caught by ASAN:
+
+ =================================================================
+ ==73797==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700001bcf0 at pc 0x00010026198d bp 0x7ffeefbfed30 sp 0x7ffeefbfe4d8
+ READ of size 69 at 0x60700001bcf0 thread T0
+ 2019-07-04 08:35:30.292502+0200 atos[73890:2639175] examining /Users/USER/*/libssh2_clar [73797]
+ #0 0x10026198c in wrap_memchr (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1f98c)
+ #1 0x1000f8e66 in file_read_publickey userauth.c:633
+ #2 0x1000f2dc9 in userauth_publickey_fromfile userauth.c:1513
+ #3 0x1000f2948 in libssh2_userauth_publickey_fromfile_ex userauth.c:1590
+ #4 0x10000e254 in test_userauth_publickey__ed25519_auth_ok publickey.c:69
+ #5 0x1000090c3 in clar_run_test clar.c:260
+ #6 0x1000038f3 in clar_run_suite clar.c:343
+ #7 0x100003272 in clar_test_run clar.c:522
+ #8 0x10000c3cc in main runner.c:60
+ #9 0x7fff5b43b3d4 in start (libdyld.dylib:x86_64+0x163d4)
+
+ 0x60700001bcf0 is located 0 bytes to the right of 80-byte region [0x60700001bca0,0x60700001bcf0)
+ allocated by thread T0 here:
+ #0 0x10029e053 in wrap_malloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c053)
+ #1 0x1000b4978 in libssh2_default_alloc session.c:67
+ #2 0x1000f8aba in file_read_publickey userauth.c:597
+ #3 0x1000f2dc9 in userauth_publickey_fromfile userauth.c:1513
+ #4 0x1000f2948 in libssh2_userauth_publickey_fromfile_ex userauth.c:1590
+ #5 0x10000e254 in test_userauth_publickey__ed25519_auth_ok publickey.c:69
+ #6 0x1000090c3 in clar_run_test clar.c:260
+ #7 0x1000038f3 in clar_run_suite clar.c:343
+ #8 0x100003272 in clar_test_run clar.c:522
+ #9 0x10000c3cc in main runner.c:60
+ #10 0x7fff5b43b3d4 in start (libdyld.dylib:x86_64+0x163d4)
+
+ SUMMARY: AddressSanitizer: heap-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x1f98c) in wrap_memchr
+ Shadow bytes around the buggy address:
+ 0x1c0e00003740: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd
+ 0x1c0e00003750: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
+ 0x1c0e00003760: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00
+ 0x1c0e00003770: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd
+ 0x1c0e00003780: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fa
+ =>0x1c0e00003790: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[fa]fa
+ 0x1c0e000037a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+ 0x1c0e000037b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+ 0x1c0e000037c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+ 0x1c0e000037d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+ 0x1c0e000037e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
+ Shadow byte legend (one shadow byte represents 8 application bytes):
+ Addressable: 00
+ Partially addressable: 01 02 03 04 05 06 07
+ Heap left redzone: fa
+ Freed heap region: fd
+ Stack left redzone: f1
+ Stack mid redzone: f2
+ Stack right redzone: f3
+ Stack after return: f5
+ Stack use after scope: f8
+ Global redzone: f9
+ Global init order: f6
+ Poisoned by user: f7
+ Container overflow: fc
+ Array cookie: ac
+ Intra object redzone: bb
+ ASan internal: fe
+ Left alloca redzone: ca
+ Right alloca redzone: cb
+ Shadow gap: cc
+
+- [Thilo Schulz brought this change]
+
+ openssl.c : Fix use-after-free crash on reinitialization of openssl backend
+
+ file : openssl.c
+
+ notes :
+ libssh2's openssl backend has a use-after-free condition if HAVE_OPAQUE_STRUCTS is defined and you call libssh2_init() again after prior initialisation/deinitialisation of libssh2
+
+ credit : Thilo Schulz
+
+- [axjowa brought this change]
+
+ openssl.h : Use of ifdef where if should be used (#389)
+
+ File : openssl.h
+
+ Notes :
+ LIBSSH2_ECDSA and LIBSSH2_ED25519 are always defined so the #ifdef
+ checks would never be false.
+
+ This change makes it possible to build libssh2 against OpenSSL built
+ without EC support.
+
+ Change-Id: I0a2f07c2d80178314dcb7d505d1295d19cf15afd
+
+ Credit : axjowa
+
+- [Zenju brought this change]
+
+ Agent.c : Preserve error info from agent_list_identities() (#374)
+
+ Files : agent.c
+
+ Notes :
+ Currently the error details as returned by agent_transact_pageant() are overwritten by a generic "agent list id failed" message by int agent_list_identities(LIBSSH2_AGENT* agent).
+
+ Credit :
+ Zenju
+
+- [Who? Me?! brought this change]
+
+ Channel.c: Make sure the error code is set in _libssh2_channel_open() (#381)
+
+ File : Channel.c
+
+ Notes :
+ if _libssh2_channel_open() fails, set the error code.
+
+ Credit :
+ mark-i-m
+
+- [Orgad Shaneh brought this change]
+
+ Kex.c, Remove unneeded call to strlen (#373)
+
+ File : Kex.c
+
+ Notes :
+ Removed call to strlen
+
+ Credit :
+ Orgad Shaneh
+
+- [Pedro Monreal brought this change]
+
+ Spelling corrections (#380)
+
+ Files :
+ libssh2.h, libssh2_sftp.h, bcrypt_pbkdf.c, mbedtls.c, sftp.c, ssh2.c
+
+ Notes :
+ * Fixed misspellings
+
+ Credit :
+ Pedro Monreal
+
+- [Sebastián Katzer brought this change]
+
+ Fix Potential typecast error for `_libssh2_ecdsa_key_get_curve_type` (#383)
+
+ Issue : #383
+
+ Files : hostkey.c, crypto.h, openssl.c
+
+ Notes :
+ * Fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
+ * Rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type
+
+ Credit :
+ Sebastián Katzer
+
+GitHub (20 Jun 2019)
+- [Will Cosgrove brought this change]
+
+ bump copyright date
+
+Version 1.9.0 (19 Jun 2019)
+
+GitHub (19 Jun 2019)
+- [Will Cosgrove brought this change]
+
+ 1.9 Formatting
+
+- [Will Cosgrove brought this change]
+
+ 1.9 Release notes
+
+Will Cosgrove (17 May 2019)
+- [Alexander Curtiss brought this change]
+
+ libgcrypt.c : Fixed _libssh2_rsa_sha1_sign memory leak. (#370)
+
+ File: libgcrypt.c
+
+ Notes : Added calls to gcry_sexp_release to free memory allocated by gcry_sexp_find_token
+
+ Credit :
+ Reporter : beckmi
+ PR by: Alexander Curtiss
+
+- [Orivej Desh brought this change]
+
+ libssh2_priv.h : Fix musl build warning on sys/poll.h (#346)
+
+ File : libssh2_priv.h
+
+ Notes :
+ musl prints `redirecting incorrect #include to `
+ http://git.musl-libc.org/cgit/musl/commit/include/sys/poll.h?id=54446d730cfb17c5f7bcf57f139458678f5066cc
+
+ poll is defined by POSIX to be in poll.h:
+ http://pubs.opengroup.org/onlinepubs/7908799/xsh/poll.html
+
+ Credit : Orivej Desh
+
+GitHub (1 May 2019)
+- [Will Cosgrove brought this change]
+
+ kex.c : additional bounds checks in diffie_hellman_sha1/256 (#361)
+
+ Files : kex.c, misc.c, misc.h
+
+ Notes :
+ Fixed possible out of bounds memory access when reading malformed data in diffie_hellman_sha1() and diffie_hellman_sha256().
+
+ Added _libssh2_copy_string() to misc.c to return an allocated and filled char buffer from a string_buf offset. Removed no longer needed s var in kmdhgGPshakex_state_t.
+
+Will Cosgrove (26 Apr 2019)
+- [Tseng Jun brought this change]
+
+ sftp.c : sftp_bin2attr() Correct attrs->gid assignment (#366)
+
+ Regression with fix for #339
+
+ Credit : Tseng Jun
+
+- [Tseng Jun brought this change]
+
+ kex.c : Correct type cast in curve25519_sha256() (#365)
+
+GitHub (24 Apr 2019)
+- [Will Cosgrove brought this change]
+
+ transport.c : scope local total_num var (#364)
+
+ file : transport.c
+ notes : move local `total_num` variable inside of if block to prevent scope access issues which caused #360.
+
+Will Cosgrove (24 Apr 2019)
+- [doublex brought this change]
+
+ transport.c : fixes bounds check if partial packet is read
+
+ Files : transport.c
+
+ Issue : #360
+
+ Notes :
+ 'p->total_num' instead of local value total_num when doing bounds check.
+
+ Credit : Doublex
+
+GitHub (23 Apr 2019)
+- [Will Cosgrove brought this change]
+
+ Editor config file for source files (#322)
+
+ Simple start to an editor config file when editing source files to make sure they are configured correctly.
+
+- [Will Cosgrove brought this change]
+
+ misc.c : String buffer API improvements (#332)
+
+ Files : misc.c, hostkey.c, kex.c, misc.h, openssl.c, sftp.c
+
+ Notes :
+ * updated _libssh2_get_bignum_bytes and _libssh2_get_string. Now pass in length as an argument instead of returning it to keep signedness correct. Now returns -1 for failure, 0 for success.
+
+ _libssh2_check_length now returns 0 on success and -1 on failure to match the other string_buf functions. Added comment to _libssh2_check_length.
+
+ Credit : Will Cosgrove
+
+Will Cosgrove (19 Apr 2019)
+- [doublex brought this change]
+
+ mbedtls.c : _libssh2_mbedtls_rsa_new_private_frommemory() allow private-key from memory (#359)
+
+ File : mbedtls.c
+
+ Notes: _libssh2_mbedtls_rsa_new_private_frommemory() fixes private-key from memory reading to by adding NULL terminator before parsing; adds passphrase support.
+
+ Credit: doublex
+
+- [Ryan Kelley brought this change]
+
+ Session.c : banner_receive() from leaking when accessing non ssh ports (#356)
+
+ File : session.c
+
+ Release previous banner in banner_receive() if the session is reused after a failed connection.
+
+ Credit : Ryan Kelley
+
+GitHub (11 Apr 2019)
+- [Will Cosgrove brought this change]
+
+ Formatting in agent.c
+
+ Removed whitespace.
+
+- [Will Cosgrove brought this change]
+
+ Fixed formatting in agent.c
+
+ Quiet linter around a couple if blocks and pointer.
+
+Will Cosgrove (11 Apr 2019)
+- [Zhen-Huan HWANG brought this change]
+
+ sftp.c : discard and reset oversized packet in sftp_packet_read() (#269)
+
+ file : sftp.c
+
+ notes : when sftp_packet_read() encounters an sftp packet which exceeds SFTP max packet size it now resets the reading state so it can continue reading.
+
+ credit : Zhen-Huan HWANG
+
+GitHub (11 Apr 2019)
+- [Will Cosgrove brought this change]
+
+ Add agent functions libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() (#308)
+
+ File : agent.c
+
+ Notes :
+ Libssh2 uses the SSH_AUTH_SOCK env variable to read the system agent location. However, when using a custom agent path you have to set this value using setenv which is not thread-safe. The new functions allow for a way to set a custom agent socket path in a thread safe manor.
+
+- [Will Cosgrove brought this change]
+
+ Simplified _libssh2_check_length (#350)
+
+ * Simplified _libssh2_check_length
+
+ misc.c : _libssh2_check_length()
+
+ Removed cast and improved bounds checking and format.
+
+ Credit : Yuriy M. Kaminskiy
+
+- [Will Cosgrove brought this change]
+
+ _libssh2_check_length() : additional bounds check (#348)
+
+ Misc.c : _libssh2_check_length()
+
+ Ensure the requested length is less than the total length before doing the additional bounds check
+
+Daniel Stenberg (25 Mar 2019)
+- misc: remove 'offset' from string_buf
+
+ It isn't necessary.
+
+ Closes #343
+
+- sftp: repair mtime from e1ead35e475
+
+ A regression from e1ead35e4759 broke the SFTP mtime logic in
+ sftp_bin2attr
+
+ Also simplified the _libssh2_get_u32/u64 functions slightly.
+
+ Closes #342
+
+- session_disconnect: don't zero state, just clear the right bit
+
+ If we clear the entire field, the freeing of data in session_free() is
+ skipped. Instead just clear the bit that risk making the code get stuck
+ in the transport functions.
+
+ Regression from 4d66f6762ca3fc45d9.
+
+ Reported-by: dimmaq on github
+ Fixes #338
+ Closes #340
+
+- libssh2_sftp.h: restore broken ABI
+
+ Commit 41fbd44 changed variable sizes/types in a public struct which
+ broke the ABI, which breaks applications!
+
+ This reverts that change.
+
+ Closes #339
+
+- style: make includes and examples code style strict
+
+ make travis and the makefile rule verify them too
+
+ Closes #334
+
+GitHub (21 Mar 2019)
+- [Daniel Stenberg brought this change]
+
+ create a github issue template
+
+Daniel Stenberg (21 Mar 2019)
+- stale-bot: activated
+
+ The stale bot will automatically mark stale issues (inactive for 90
+ days) and if still untouched after 21 more days, close them.
+
+ See https://probot.github.io/apps/stale/
+
+- libssh2_session_supported_algs.3: fix formatting mistakes
+
+ Reported-by: Max Horn
+ Fixes #57
+
+- [Zenju brought this change]
+
+ libssh2.h: Fix Error C2371 'ssize_t': redefinition
+
+ Closes #331
+
+- travis: add code style check
+
+ Closes #324
+
+- code style: unify code style
+
+ Indent-level: 4
+ Max columns: 79
+ No spaces after if/for/while
+ Unified brace positions
+ Unified white spaces
+
+- src/checksrc.pl: code style checker
+
+ imported as-is from curl
+
+Will Cosgrove (19 Mar 2019)
+- Merge branch 'MichaelBuckley-michaelbuckley-security-fixes'
+
+- Silence unused var warnings (#329)
+
+ Silence warnings about unused variables in this test
+
+- Removed unneeded > 0 check
+
+ When checking `userauth_kybd_num_prompts > 100` we don't care if it's also above zero.
+
+- [Matthew D. Fuller brought this change]
+
+ Spell OpenSS_H_ right when talking about their specific private key (#321)
+
+ Good catch, thanks.
+
+GitHub (19 Mar 2019)
+- [Will Cosgrove brought this change]
+
+ Silence unused var warnings (#329)
+
+ Silence warnings about unused variables in this test
+
+Michael Buckley (19 Mar 2019)
+- Fix more scope and printf warning errors
+
+- Silence unused variable warning
+
+GitHub (19 Mar 2019)
+- [Will Cosgrove brought this change]
+
+ Removed unneeded > 0 check
+
+ When checking `userauth_kybd_num_prompts > 100` we don't care if it's also above zero.
+
+Will Cosgrove (19 Mar 2019)
+- [Matthew D. Fuller brought this change]
+
+ Spell OpenSS_H_ right when talking about their specific private key (#321)
+
+ Good catch, thanks.
+
+Michael Buckley (18 Mar 2019)
+- Fix errors identified by the build process
+
+- Fix casting errors after merge
+
+GitHub (18 Mar 2019)
+- [Michael Buckley brought this change]
+
+ Merge branch 'master' into michaelbuckley-security-fixes
+
+Michael Buckley (18 Mar 2019)
+- Move fallback SIZE_MAX and UINT_MAX to libssh2_priv.h
+
+- Fix type and logic issues with _libssh2_get_u64
+
+Daniel Stenberg (17 Mar 2019)
+- examples: fix various compiler warnings
+
+- lib: fix various compiler warnings
+
+- session: ignore pedantic warnings for funcpointer <=> void *
+
+- travis: add a build using configure
+
+ Closes #320
+
+- configure: provide --enable-werror
+
+- appveyor: remove old builds that mostly cause failures
+
+ ... and only run on master branch.
+
+ Closes #323
+
+- cmake: add two missing man pages to get installed too
+
+ Both libssh2_session_handshake.3 and
+ libssh2_userauth_publickey_frommemory.3 were installed by the configure
+ build already.
+
+ Reported-by: Arfrever on github
+ Fixes #278
+
+- include/libssh2.h: warning: "_WIN64" is not defined, evaluates to 0
+
+ We don't use #if for defines that might not be defined.
+
+- pem: //-comments are not allowed
+
+Will Cosgrove (14 Mar 2019)
+- [Daniel Stenberg brought this change]
+
+ userauth: fix "Function call argument is an uninitialized value" (#318)
+
+ Detected by scan-build.
+
+- fixed unsigned/signed issue
+
+Daniel Stenberg (15 Mar 2019)
+- session_disconnect: clear state
+
+ If authentication is started but not completed before the application
+ gives up and instead wants to shut down the session, the '->state' field
+ might still be set and thus effectively dead-lock session_disconnect.
+
+ This happens because both _libssh2_transport_send() and
+ _libssh2_transport_read() refuse to do anything as long as state is set
+ without the LIBSSH2_STATE_KEX_ACTIVE bit.
+
+ Reported in curl bug https://github.com/curl/curl/issues/3650
+
+ Closes #310
+
+Will Cosgrove (14 Mar 2019)
+- Release notes from 1.8.1
+
+Michael Buckley (14 Mar 2019)
+- Use string_buf in sftp_init().
+
+- Guard against out-of-bounds reads in publickey.c
+
+- Guard against out-of-bounds reads in session.c
+
+- Guard against out-of-bounds reads in userauth.c
+
+- Use LIBSSH2_ERROR_BUFFER_TOO_SMALL instead of LIBSSH2_ERROR_OUT_OF_BOUNDARY in sftp.c
+
+- Additional bounds checking in sftp.c
+
+- Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add(). https://libssh2.org/CVE-2019-3862.html
+
+- Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short. https://libssh2.org/CVE-2019-3860.html
+
+- Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.
+
+- Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read. https://libssh2.org/CVE-2019-3858.html
+
+- Sanitize padding_length - _libssh2_transport_read(). https://libssh2.org/CVE-2019-3861.html
+
+ This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.
+
+- Defend against writing beyond the end of the payload in _libssh2_transport_read().
+
+- Defend against possible integer overflows in comp_method_zlib_decomp.
+
+GitHub (14 Mar 2019)
+- [Will Cosgrove brought this change]
+
+ Security fixes (#315)
+
+ * Bounds checks
+
+ Fixes for CVEs
+ https://www.libssh2.org/CVE-2019-3863.html
+ https://www.libssh2.org/CVE-2019-3856.html
+
+ * Packet length bounds check
+
+ CVE
+ https://www.libssh2.org/CVE-2019-3855.html
+
+ * Response length check
+
+ CVE
+ https://www.libssh2.org/CVE-2019-3859.html
+
+ * Bounds check
+
+ CVE
+ https://www.libssh2.org/CVE-2019-3857.html
+
+ * Bounds checking
+
+ CVE
+ https://www.libssh2.org/CVE-2019-3859.html
+
+ and additional data validation
+
+ * Check bounds before reading into buffers
+
+ * Bounds checking
+
+ CVE
+ https://www.libssh2.org/CVE-2019-3859.html
+
+ * declare SIZE_MAX and UINT_MAX if needed
+
+- [Will Cosgrove brought this change]
+
+ fixed type warnings (#309)
+
+- [Will Cosgrove brought this change]
+
+ Bumping version number for pending 1.8.1 release
+
+Will Cosgrove (4 Mar 2019)
+- [Daniel Stenberg brought this change]
+
+ _libssh2_string_buf_free: use correct free (#304)
+
+ Use LIBSSH2_FREE() here, not free(). We allow memory function
+ replacements so free() is rarely the right choice...
+
+GitHub (26 Feb 2019)
+- [Will Cosgrove brought this change]
+
+ Fix for building against libreSSL #302
+
+ Changed to use the check we use elsewhere.
+
+- [Will Cosgrove brought this change]
+
+ Fix for when building against LibreSSL #302
+
+Will Cosgrove (25 Feb 2019)
+- [gartens brought this change]
+
+ docs: update libssh2_hostkey_hash.3 [ci skip] (#301)
+
+GitHub (21 Feb 2019)
+- [Will Cosgrove brought this change]
+
+ fix malloc/free mismatches #296 (#297)
+
+- [Will Cosgrove brought this change]
+
+ Replaced malloc with calloc #295
+
+- [Will Cosgrove brought this change]
+
+ Abstracted OpenSSL calls out of hostkey.c (#294)
+
+- [Will Cosgrove brought this change]
+
+ Fix memory dealloc impedance mis-match #292 (#293)
+
+ When using ed25519 host keys and a custom memory allocator.
+
+- [Will Cosgrove brought this change]
+
+ Added call to OpenSSL_add_all_digests() #288
+
+ For OpenSSL 1.0.x we need to call OpenSSL_add_all_digests().
+
+Will Cosgrove (12 Feb 2019)
+- [Zhen-Huan HWANG brought this change]
+
+ SFTP: increase maximum packet size to 256K (#268)
+
+ to match implementations like OpenSSH.
+
+- [Zenju brought this change]
+
+ Fix https://github.com/libssh2/libssh2/pull/271 (#284)
+
+GitHub (16 Jan 2019)
+- [Will Cosgrove brought this change]
+
+ Agent NULL check in shutdown #281
+
+Will Cosgrove (15 Jan 2019)
+- [Adrian Moran brought this change]
+
+ mbedtls: Fix leak of 12 bytes by each key exchange. (#280)
+
+ Correctly free ducts by calling _libssh2_mbedtls_bignum_free() in dtor.
+
+- [alex-weaver brought this change]
+
+ Fix error compiling on Win32 with STDCALL=ON (#275)
+
+GitHub (8 Nov 2018)
+- [Will Cosgrove brought this change]
+
+ Allow default permissions to be used in sftp_mkdir (#271)
+
+ Added constant LIBSSH2_SFTP_DEFAULT_MODE to use the server default permissions when making a new directory
+
+Will Cosgrove (13 Sep 2018)
+- [Giulio Benetti brought this change]
+
+ openssl: fix dereferencing ambiguity potentially causing build failure (#267)
+
+ When dereferencing from *aes_ctr_cipher, being a pointer itself,
+ ambiguity can occur; fixed possible build errors.
+
+Viktor Szakats (12 Sep 2018)
+- win32/GNUmakefile: define HAVE_WINDOWS_H
+
+ This macro was only used in test/example code before, now it is
+ also used in library code, but only defined automatically by
+ automake/cmake, so let's do the same for the standalone win32
+ make file.
+
+ It'd be probably better to just rely on the built-in _WIN32 macro
+ to detect the presence of windows.h though. It's already used
+ in most of libssh2 library code. There is a 3rd, similar macro
+ named LIBSSH2_WIN32, which might also be replaced with _WIN32.
+
+ Ref: https://github.com/libssh2/libssh2/commit/8b870ad771cbd9cd29edbb3dbb0878e950f868ab
+ Closes https://github.com/libssh2/libssh2/pull/266
+
+Marc Hoersken (2 Sep 2018)
+- Fix conditional check for HAVE_DECL_SECUREZEROMEMORY
+
+ "Unlike the other `AC_CHECK_*S' macros, when a symbol is not declared,
+ HAVE_DECL_symbol is defined to `0' instead of leaving HAVE_DECL_symbol
+ undeclared. When you are sure that the check was performed,
+ use HAVE_DECL_symbol in #if."
+
+ Source: autoconf documentation for AC_CHECK_DECLS.
+
+- Fix implicit declaration of function 'SecureZeroMemory'
+
+ Include window.h in order to use SecureZeroMemory on Windows.
+
+- Fix implicit declaration of function 'free' by including stdlib.h
+
+GitHub (27 Aug 2018)
+- [Will Cosgrove brought this change]
+
+ Use malloc abstraction function in pem parse
+
+ Fix warning on WinCNG build.
+
+- [Will Cosgrove brought this change]
+
+ Fixed possible junk memory read in sftp_stat #258
+
+- [Will Cosgrove brought this change]
+
+ removed INT64_C define (#260)
+
+ No longer used.
+
+- [Will Cosgrove brought this change]
+
+ Added conditional around engine.h include
+
+Will Cosgrove (6 Aug 2018)
+- [Alex Crichton brought this change]
+
+ Fix OpenSSL link error with `no-engine` support (#259)
+
+ This commit fixes linking against an OpenSSL library that was compiled with
+ `no-engine` support by bypassing the initialization routines as they won't be
+ available anyway.
+
+GitHub (2 Aug 2018)
+- [Will Cosgrove brought this change]
+
+ ED25519 Key Support #39 (#248)
+
+ OpenSSH Key and ED25519 support #39
+ Added _libssh2_explicit_zero() to explicitly zero sensitive data in memory #120
+
+ * ED25519 Key file support - Requires OpenSSL 1.1.1 or later
+ * OpenSSH Key format reading support - Supports RSA/DSA/ECDSA/ED25519 types
+ * New string buffer reading functions - These add build-in bounds checking and convenance methods. Used for OpenSSL PEM file reading.
+ * Added new tests for OpenSSH formatted Keys
+
+- [Will Cosgrove brought this change]
+
+ ECDSA key types are now explicit (#251)
+
+ * ECDSA key types are now explicit
+
+ Issue was brough up in pull request #248
+
+Will Cosgrove (2 May 2018)
+- [Jakob Egger brought this change]
+
+ Add Instructions for building from Master (#249)
+
+GitHub (27 Apr 2018)
+- [Will Cosgrove brought this change]
+
+ Initialize sb_intl #226
+
+Will Cosgrove (19 Apr 2018)
+- [doublex brought this change]
+
+ buffer overflow (valgrind) (#159)
+
+- [Brendan Shanks brought this change]
+
+ mbedTLS: Remove some C99-style intermingled variable declarations (#196)
+
+GitHub (18 Apr 2018)
+- [Will Cosgrove brought this change]
+
+ fix for #160
+
+Will Cosgrove (18 Apr 2018)
+- [doublex brought this change]
+
+ fix memory leak when using mbedtls backend (#158)
+
+ _libssh2_bn_init_from_bin/_libssh2_bn_free would leak bignum from mbedtls_calloc().
+
+- [Brendan Shanks brought this change]
+
+ mbedTLS: Avoid multiple definition errors for context handles (#197)
+
+- [Tseng Jun brought this change]
+
+ Fix the EVP cipher meth memory leakage problem (#244)
+
+ * Fix the EVP cipher meth memory leakage problem
+
+ Looks good, thanks for the fixes.
+
+Marc Hörsken (31 Mar 2018)
+- [Will Cosgrove brought this change]
+
+ Added ECDSA defines for WinCNG (#245)
+
+ Fixed missing defines preventing building using WinCNG
+
+GitHub (30 Mar 2018)
+- [Will Cosgrove brought this change]
+
+ Fix for _libssh2_rsa_new with OpenSSL 1.0.x
+
+ missing d value assignment.
+
+Will Cosgrove (20 Mar 2018)
+- [Etienne Samson brought this change]
+
+ A collection of small fixes (#198)
+
+ * tests: Remove if-pyramids
+
+ * tests: Switch run_command arguments
+
+ * tests: Make run_command a vararg function
+
+ * tests: Xcode doesn't obey CMake's test working directory
+
+ * openssl: move manual AES-CTR cipher into crypto init
+
+ * cmake: Move our include dir before all other include paths
+
+GitHub (15 Mar 2018)
+- [Will Cosgrove brought this change]
+
+ Fixes incorrect indexing of KEX prefs string
+
+ After stripping out an invalid KEX pref entry, it would incorrectly advance again leaving invalid values in the list.
+
+Viktor Szakats (13 Mar 2018)
+- tests: fix checksrc warnings
+
+ Also:
+ * add 'static' qualifier to file-wide const buffers
+ * fix a non-ANSI C89 comment
+ * silence a mismatched fprintf() mask warning by adding a cast
+
+- cmake: recognize OpenSSL 1.1 .dll names
+
+ Also fix some comment typos and a stray tab.
+
+- docs: update an URL [ci skip]
+
+Daniel Stenberg (12 Mar 2018)
+- docs/SECURITY: the max embargo is 14 days now
+
+Viktor Szakats (12 Mar 2018)
+- docs: spelling fixes [ci skip]
+
+ Closes https://github.com/libssh2/libssh2/pull/222
+
+GitHub (12 Mar 2018)
+- [Will Cosgrove brought this change]
+
+ Fixed minor tabs/spacing issues
+
+- [Will Cosgrove brought this change]
+
+ Update kex.c
+
+- [Will Cosgrove brought this change]
+
+ Added basic bounds checking #206
+
+ Basic bounds checking in ecdh_sha2_nistp()
+
+- [Will Cosgrove brought this change]
+
+ Fixed Clang warning #206
+
+ Fixed possible garbage value for secret in an error case
+
+- [Will Cosgrove brought this change]
+
+ Fixed incorrect #if to #ifdef #206
+
+ When checking HAVE_OPAQUE_STRUCTS.
+
+Viktor Szakats (12 Mar 2018)
+- src: suppress two checksrc warnings
+
+ Ref: https://github.com/libssh2/libssh2/pull/235
+
+- src: address fopen() warnings, add missing copyright headers
+
+ Ref: https://github.com/libssh2/libssh2/pull/235
+
+- src: replace sprintf() with snprintf()
+
+ Ref: https://github.com/libssh2/libssh2/pull/235
+
+- src: fix checksrc warnings
+
+ Use checksrc.pl from the curl project, with (for now)
+ suppressed long line warnings and indentation set to
+ 4 spaces. Fixes are whitespace for the most part.
+
+ Warning count went down from 2704 to 12.
+
+ Also fix codespell typos, two non-ANSI C89 comments
+ and a stray tab in include/libssh2.h.
+
+ Ref: https://github.com/libssh2/libssh2/pull/235
+
+- checksrc: add source style checker
+
+ This is a slightly extended version of this original source
+ from the curl project:
+ https://github.com/curl/curl/blob/8b754c430b9a4c51aa606c687ee5014faf7c7b06/lib/checksrc.pl
+
+ This version adds the following options to customize it for
+ libssh2 (plus some whitespace formatting):
+
+ `-i` to override indentation spaces (2)
+ `-m` to override maximum line length (79)
+
+ Command-line used to check libssh2 sources:
+
+ $ ./checksrc.pl -i4 -m500 *.c *.h
+
+ Closes https://github.com/libssh2/libssh2/pull/236
+
+- src: add static qualifier
+
+ To private, const strings.
+
+ Closes https://github.com/libssh2/libssh2/pull/237
+
+- [Will Cosgrove brought this change]
+
+ Add support for ECDSA keys and host keys (#41)
+
+ This commit lands full ECDSA key support when using the OpenSSL
+ backend. Which includes:
+
+ New KEX methods:
+ ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521
+
+ Can now read OpenSSL formatted ECDSA key files.
+
+ Now supports known host keys of type ecdsa-sha2-nistp256.
+
+ New curve types:
+ NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1
+
+ Default host key preferred ordering is now nistp256, nistp384,
+ nistp521, rsa, dss.
+
+ Ref: https://github.com/libssh2/libssh2/issues/41
+
+ Closes https://github.com/libssh2/libssh2/pull/206
+
+GitHub (15 Dec 2017)
+- [Will Cosgrove brought this change]
+
+ Fixed possible crash when decoding invalid data
+
+ When trying to decode invalid data, it frees the buffer but doesn't nil it so the caller gets a junk memory pointer which they could potentially double free.
+
+- [Will Cosgrove brought this change]
+
+ Remove call to OpenSSL_add_all_ciphers()
+
+ Now lives in libssh2 init() from PR #189
+
+- [Will Cosgrove brought this change]
+
+ Fixed incorrect reference to decrypted block
+
+ Fixed incorrectly copied memory from p->buf into init instead of from the decrypted buffer block. The only reason this worked was because the crypt() function decrypts the value in-place and overwrites p->buf. I'm working on a fork that no longer does this and exposed this bug.
+
+Will Cosgrove (20 Oct 2017)
+- [Pan brought this change]
+
+ Fix typo in crypt.c (#218)
+
+Kamil Dudka (17 Oct 2017)
+- session: avoid printing misleading debug messages
+
+ ... while throwing LIBSSH2_ERROR_EAGAIN out of session_startup()
+
+ If the session runs in blocking mode, LIBSSH2_ERROR_EAGAIN never reaches
+ the libssh2 API boundary and, in non-blocking mode, these messages are
+ suppressed by the condition in _libssh2_error_flags() anyway.
+
+ Closes #211
+
+Viktor Szakats (15 Oct 2017)
+- win32/GNUmakefile: allow customizing dll suffixes
+
+ - New `LIBSSH2_DLL_SUFFIX` envvar will add a suffix to the generated
+ libssh2 dll name. Useful to add `-x64` to 64-bit builds so that
+ it can live in the same directory as the 32-bit one. By default
+ this is empty.
+
+ - New `LIBSSH2_DLL_A_SUFFIX` envvar to customize the suffix of the
+ generated import library (implib) for libssh2 .dll. It defaults
+ to `dll`, and it's useful to modify that to `.dll` to have the
+ standard naming scheme for mingw-built .dlls, i.e. `libssh2.dll.a`.
+
+ Ref: https://github.com/curl/curl/commit/aaa16f80256abc1463fd9374815130a165222257
+
+ Closes https://github.com/libssh2/libssh2/pull/215
+
+- makefile.m32: allow to override gcc, ar and ranlib
+
+ Allow to ovverride certain build tools, making it possible to
+ use LLVM/Clang to build libssh2. The default behavior is unchanged.
+ To build with clang (as offered by MSYS2), these settings can
+ be used:
+
+ LIBSSH2_CC=clang
+ LIBSSH2_AR=llvm-ar
+ LIBSSH2_RANLIB=llvm-ranlib
+
+ Also adjust ranlib parameters to be compatible with LLVM/Clang's
+ ranlib tool.
+
+ Closes https://github.com/libssh2/libssh2/pull/214
+
+GitHub (27 Sep 2017)
+- [Will Cosgrove brought this change]
+
+ Fixes out of bounds memory access (#210)
+
+ If an invalid PEM file is read and the lines are longer than 128 characters it will go out of bounds and crash on line 91.
+
+Will Cosgrove (11 Sep 2017)
+- [Kamil Dudka brought this change]
+
+ scp: do not NUL-terminate the command for remote exec (#208)
+
+ It breaks SCP download/upload from/to certain server implementations.
+
+ The bug does not manifest with OpenSSH, which silently drops the NUL
+ byte (eventually with any garbage that follows the NUL byte) before
+ executing it.
+
+ Bug: https://bugzilla.redhat.com/1489736
+
+GitHub (21 Aug 2017)
+- [Viktor Szakats brought this change]
+
+ openssl.c: remove no longer used variable (#204)
+
+ after e378d2e30a40bd9bcee06dc3a4250f269098e200
+
+- [Will Cosgrove brought this change]
+
+ Fix for #188 (#189)
+
+ * Update openssl.c
+
+ * Create openssl.h
+
+Will Cosgrove (24 May 2017)
+- [Marcel Raad brought this change]
+
+ openssl: fix build with OpenSSL 1.1 API (#176)
+
+ When building with OPENSSL_API_COMPAT=0x10100000L, OpenSSL_add_all_algorithms
+ and OpenSSL_add_all_ciphers don't exist. The corresponding functionality is
+ handled automatically with OpenSSL 1.1.
+
+- [Sune Bredahl brought this change]
+
+ Add support for SHA256 hostkey fingerprints (#180)
+
+ Looks good, thanks!
+
+GitHub (12 May 2017)
+- [Will Cosgrove brought this change]
+
+ Fix memory leak of crypt_ctx->h using openSSL 1.1+ (#177)
+
+ Need to use EVP_CIPHER_CTX_free instead of EVP_CIPHER_CTX_reset.
+
+Marc Hoersken (2 Mar 2017)
+- tests/openssh_server/authorized_keys: add key_rsa_encrypted.pub
+
+- tests: add simple test for passphrase-protected PEM file support
+
+- os400qc3: enable passphrase-protected PEM file support using pem.c
+
+- pem: fix indentation and replace assert after 386e012292
+
+- [Keno Fischer brought this change]
+
+ pem: add passphrase-protected PEM file support for libgcrypt and wincng
+
+ Since they use our own PEM parser which did not support encrypted
+ PEM files, trying to use such files on these backends failed.
+ Fix that by augmenting the PEM parser to support encrypted PEM files.
+
+- [Thomas brought this change]
+
+ misc: use time constant implementation for AES CTR increment
+
+- [Thomas brought this change]
+
+ wincng: add AES CTR mode support (aes128-ctr, aes192-ctr, aes256-ctr)
+
+- [Thomas brought this change]
+
+ openssl: move shared AES-CTR code into misc
+
+Daniel Stenberg (20 Dec 2016)
+- [Alex Crichton brought this change]
+
+ kex: acknowledge error code from libssh2_dh_key_pair()
+
+ Fixes a segfault using ssh-agent on Windows
+
+ This commit fixes a segfault seen dereferencing a null pointer on
+ Windows when using ssh-agent. The problem ended up being that errors
+ weren't being communicated all the way through, causing null pointers to
+ be used when functions should have bailed out sooner.
+
+ The `_libssh2_dh_key_pair` function for WinCNG was modified to propagate
+ errors, and then the two callsites in kex.c of
+ `diffie_hellman_sha{1,256}` were updated to recognize this error and
+ bail out.
+
+ Fixes #162
+ Closes #163
+
+Alexander Lamaison (27 Nov 2016)
+- [monnerat brought this change]
+
+ Implement Diffie-Hellman computations in crypto backends. (#149)
+
+ Not all backends feature the low level API needed to compute a Diffie-Hellman
+ secret, but some of them directly implement Diffie-Hellman support with opaque
+ private data. The later approach is now generalized and backends are
+ responsible for all Diffie Hellman computations.
+ As a side effect, procedures/macros _libssh2_bn_rand and _libssh2_bn_mod_exp
+ are no longer needed outside the backends.
+
+Peter Stuge (16 Nov 2016)
+- acinclude.m4: The mbedtls crypto backend actually requires libmbedcrypto
+
+ Examples can't be linked with libmbedtls but need libmbedcrypto, and
+ any users of libssh2 which use libtool and libssh2.la would encounter
+ the same problem.
+
+ This changes the mbedtls detection to search for libmbedcrypto, which
+ is the actual dependency for the backend.
+
+- acinclude.m4: Add CPPFLAGS=-I$prefix-dir/include in LIBSSH2_LIB_HAVE_LINKFLAGS
+
+ This is absolutely neccessary for header files to be found when
+ AC_LIB_HAVE_LINKFLAGS searches for libraries.
+
+- acinclude.m4: Make saved variables in LIBSSH2_LIB_HAVE_LINKFLAGS uniform
+
+- docs/HACKING.CRYPTO: Improve documentation for autoconf build system
+
+Alexander Lamaison (16 Nov 2016)
+- [Alex Arslan brought this change]
+
+ Check for netinet/in.h in the tests cmake file (#148)
+
+- [Patrick Monnerat brought this change]
+
+ Define new Diffie-Hellman context for mbedTLS
+
+- [monnerat brought this change]
+
+ Make libssh2 work again on os400. (#118)
+
+ * os400: minimum supported OS version is now V6R1.
+ Do not log compiler informational messages.
+
+ * Implement crypto backend specific Diffie-Hellman computation.
+
+ This feature is now needed on os400 because the QC3 library does not
+ implement bn_mod_exp() natively. Up to now, this function was emulated using
+ an RSA encryption, but commits ca5222ea819cc5ed797860070b4c6c1aeeb28420 and
+ 7934c9ce2a029c43e3642a492d3b9e494d1542be (CVE-2016-0787) broke the emulation
+ because QC3 only supports RSA exponents up to 512 bits.
+
+ Happily, QC3 supports a native API for Diffie-Hellman computation, with
+ opaque random value: this commit implements the use of this API and, as a
+ side effect, enables support of this feature for any other crypto backend that
+ would use it.
+
+ A "generic" Diffie-Hellman computation internal API supports crypto backends
+ not implementing their own: this generic API uses the same functions as before.
+
+ * Fix typos in docs/HACKING.CRYPTO.
+
+- [Peter Stuge brought this change]
+
+ acinclude.m4: Fixup OpenSSL EVP_aes_128_ctr() detection
+
+- [Peter Stuge brought this change]
+
+ configure.ac: Add --with-crypto= instead of many different --with-$backend
+
+ The new --with-crypto option replaces the previous backend-specific
+ --with-{openssl,libgcrypt,mbedtls,wincng} options and fixes some issues.
+
+ * libgcrypt or mbedtls would previously be used whenever found, even
+ if configure was passed --without-libgcrypt or --without-mbedtls.
+
+ * If --with-$backend was specified then configure would not fail even
+ if that library could not be found, and would instead use whichever
+ crypto library was found first.
+
+ The new option defaults to `auto`, which makes configure check for all
+ supported crypto libraries in turn, choosing the first one found, or
+ exiting with an error if none can be found.
+
+- [Tony Kelman brought this change]
+
+ Build mbedtls from source on Travis (#133)
+
+ * Revert "Revert "travis: Test mbedtls too""
+
+ This reverts commit c4c60eac5ca756333034b07dd9e0b97741493ed3.
+
+ * travis: Build mbedtls from source on Travis
+
+ Use TOOLCHAIN_OPTION when calling cmake on mbedtls
+
+ * tests: only run DSA tests for non-mbedtls
+
+ crypto backends
+
+- [Peter Stuge brought this change]
+
+ configure.ac src/Makefile.am: Remove dead AM_CONDITIONAL(OS400QC3)
+
+ According to os400/README400 this backend can not be built
+ with configure+make, and the conditional is hard coded to false.
+
+- [Peter Stuge brought this change]
+
+ configure.ac: Add -DNDEBUG to CPPFLAGS in non-debug builds
+
+ There are a few uses of assert() in channel.c, sftp.c and transport.c.
+
+- [Peter Stuge brought this change]
+
+ src/global.c: Fix conditional AES-CTR support
+
+ Most of libssh2 already has conditional support for AES-CTR according to
+ the LIBSSH2_AES_CTR crypto backend #define, but global.c needed fixing.
+
+- [Peter Stuge brought this change]
+
+ src/crypto.h src/userauth.c: Fix conditional RSA support
+
+ Most of libssh2 already has conditional support for RSA according to
+ the LIBSSH2_RSA crypto backend #define, but crypto.h and userauth.c
+ needed a few small fixes.
+
+- [Peter Stuge brought this change]
+
+ src/kex.c: Cast libssh2_sha{1,256}_update data arguments properly
+
+ The update functions take a const unsigned char * but were called
+ with (const) char * in some places, causing unneccessary warnings.
+
+- [Peter Stuge brought this change]
+
+ docs/HACKING.CRYPTO: Fix two type typos
+
+- [Sergei Trofimovich brought this change]
+
+ acinclude.m4: fix ./configure --with-libgcrypt
+
+ The change fixes passing of bogus gcrypt prefix.
+ Reproducible as:
+
+ $ ./configure --with-libgcrypt
+ $ make V=1
+ ...
+ /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Iyes/include -version-info 1:1:0 -no-undefined -export-symbols-regex '^libssh2_.*' -lgcrypt -lz -Lyes/lib -o libssh2.la -rpath /usr/local/lib channel.lo comp.lo crypt.lo hostkey.lo kex.lo mac.lo misc.lo packet.lo publickey.lo scp.lo session.lo sftp.lo userauth.lo transport.lo version.lo knownhost.lo agent.lo libgcrypt.lo pem.lo keepalive.lo global.lo -lgcrypt
+ ../libtool: line 7475: cd: yes/lib: No such file or directory
+ libtool: error: cannot determine absolute directory name of 'yes/lib'
+
+ These
+ -Iyes/include
+ -Lyes/lib
+ come from libgcrypt code autodetection:
+ if test -n "$use_libgcrypt" && test "$use_libgcrypt" != "no"; then
+ LDFLAGS="$LDFLAGS -L$use_libgcrypt/lib"
+ CFLAGS="$CFLAGS -I$use_libgcrypt/include"
+
+ I assume it's a typo to use yes/no flag as a prefix and changed
+ it to '$with_libgcrypt_prefix'.
+
+ Reported-by: Mikhail Pukhlikov
+ Signed-off-by: Sergei Trofimovich
+
+- [Zenju brought this change]
+
+ libssh2_sftp_init hang: last error not set
+
+ The problem is that the original if statement simply returns NULL, but does not set the session last error code. The consequence is that libssh2_sftp_init() also returns NULL and libssh2_session_last_errno(sshSession) == LIBSSH2_ERROR_NONE.
+
+ In my test the LIBSSH2_ERROR_EAGAIN is coming from sftp.c row 337:
+ if(4 != sftp->partial_size_len)
+ /* we got a short read for the length part */
+ return LIBSSH2_ERROR_EAGAIN;
+
+ with "partial_size_len == 0". Not sure if this is expected.
+
+- [Aidan Hobson Sayers brought this change]
+
+ docs: correctly describe channel_wait_eof
+
+ channel_wait_eof waits for channel->remote.eof, which is set on
+ receiving a `SSH_MSG_CHANNEL_EOF` message. This message is sent
+ when a party has no more data to send on a channel.
+
+- [Zenju brought this change]
+
+ Fix MSVC 14 compilation warning (#92)
+
+ 1> sftp.c
+ 1>libssh2-files\src\sftp.c(3393): warning C4456: declaration of 'retcode' hides previous local declaration
+ 1> libssh2-files\src\sftp.c(3315): note: see declaration of 'retcode'
+
+- [Salvador Fandino brought this change]
+
+ LIBSSH2_ERROR_CHANNEL_WINDOW_FULL: add new error code
+
+ In order to signal that the requested operation can not succeed
+ because the receiving window had been exhausted, the error code
+ LIBSSH2_ERROR_BUFFER_TOO_SMALL has been reused but I have found
+ that in certain context it may be ambigous.
+
+ This patch introduces a new error code,
+ LIBSSH2_ERROR_CHANNEL_WINDOW_FULL, exclusive to signal that condition.
+
+- [Salvador Fandino brought this change]
+
+ channel_wait_eof: handle receive window exhaustion
+
+ Until now, in blocking mode, if the remote receiving window is
+ exhausted this function hangs forever as data is not read and the
+ remote side just keeps waiting for the window to grow before sending
+ more data.
+
+ This patch, makes this function check for that condition and abort
+ with an error when it happens.
+
+- [Salvador Fandino brought this change]
+
+ channel_wait_closed: don't fail when unread data is queued
+
+ This function was calling channel_wait_eof to ensure that the EOF
+ packet has already been received, but that function also checks that
+ the read data queue is empty before reporting the EOF. That caused
+ channel_wait_closed to fail with a LIBSSH2_ERROR_INVAL when some data
+ was queued even after a successful call to libssh2_channel_wait_eof.
+
+ This patch changes libssh2_channel_wait_closed to look directly into
+ channel->remote.eof so that both libssh2_channel_wait_eof and
+ libssh2_channel_wait_closed bahave consistently.
+
+- [Salvador Fandino brought this change]
+
+ channel_wait_eof: fix debug message
+
+Daniel Stenberg (25 Oct 2016)
+- libssh2.h: start working on 1.8.1
+
+Version 1.8.0 (25 Oct 2016)
+
+Daniel Stenberg (25 Oct 2016)
+- RELEASE-NOTES: adjusted for 1.8.0
+
+Kamil Dudka (20 Oct 2016)
+- Revert "aes: the init function fails when OpenSSL has AES support"
+
+ This partially reverts commit f4f2298ef3635acd031cc2ee0e71026cdcda5864
+ because it caused the compatibility code to call initialization routines
+ redundantly, leading to memory leakage with OpenSSL 1.1 and broken curl
+ test-suite in Fedora:
+
+ 88 bytes in 1 blocks are definitely lost in loss record 5 of 8
+ at 0x4C2DB8D: malloc (vg_replace_malloc.c:299)
+ by 0x72C607D: CRYPTO_zalloc (mem.c:100)
+ by 0x72A2480: EVP_CIPHER_meth_new (cmeth_lib.c:18)
+ by 0x4E5A550: make_ctr_evp.isra.0 (openssl.c:407)
+ by 0x4E5A8E8: _libssh2_init_aes_ctr (openssl.c:471)
+ by 0x4E5BB5A: libssh2_init (global.c:49)
+
+Daniel Stenberg (19 Oct 2016)
+- [Charles Collicutt brought this change]
+
+ libssh2_wait_socket: Fix comparison with api_timeout to use milliseconds (#134)
+
+ Fixes #74
+
+- [Charles Collicutt brought this change]
+
+ Set err_msg on _libssh2_wait_socket errors (#135)
+
+- Revert "travis: Test mbedtls too"
+
+ This reverts commit 3e6de50a24815e72ec5597947f1831f6083b7da8.
+
+ Travis doesn't seem to support the mbedtls-dev package
+
+- maketgz: support "only" to only update version number locally
+
+ and fix the date output locale
+
+- configure: make the --with-* options override the OpenSSL default
+
+ ... previously it would default to OpenSSL even with the --with-[crypto]
+ options used unless you specificly disabled OpenSSL. Now, enabling another
+ backend will automatically disable OpenSSL if the other one is found.
+
+- [Keno Fischer brought this change]
+
+ docs: Add documentation on new cmake/configure options
+
+- [Keno Fischer brought this change]
+
+ configure: Add support for building with mbedtls
+
+- [wildart brought this change]
+
+ travis: Test mbedtls too
+
+- [wildart brought this change]
+
+ crypto: add support for the mbedTLS backend
+
+ Closes #132
+
+- [wildart brought this change]
+
+ cmake: Add CLEAR_MEMORY option, analogously to that for autoconf
+
+- README.md: fix link typo
+
+- README: markdown version to look nicer on github
+
+Viktor Szakats (5 Sep 2016)
+- [Taylor Holberton brought this change]
+
+ openssl: add OpenSSL 1.1.0 compatibility
+
+Daniel Stenberg (4 Sep 2016)
+- [Antenore Gatta brought this change]
+
+ tests: HAVE_NETINET_IN_H was not defined correctly (#127)
+
+ Fixes #125
+
+- SECURITY: fix web site typo
+
+- SECURITY: security process
+
+GitHub (14 Aug 2016)
+- [Alexander Lamaison brought this change]
+
+ Basic dockerised test suite.
+
+ This introduces a test suite for libssh2. It runs OpenSSH in a Docker
+ container because that works well on Windows (via docker-machine) as
+ well as Linux. Presumably it works on Mac too with docker-machine, but
+ I've not tested that.
+
+ Because the test suite is docker-machine aware, you can also run it
+ against a cloud provider, for more realistic network testing, by setting
+ your cloud provider as your active docker machine. The Appveyor CI setup
+ in this commit does that because Appveyor doesn't support docker
+ locally.
+
+Kamil Dudka (3 Aug 2016)
+- [Viktor Szakats brought this change]
+
+ misc.c: Delete unused static variables
+
+ Closes #114
+
+Daniel Stenberg (9 Apr 2016)
+- [Will Cosgrove brought this change]
+
+ Merge pull request #103 from willco007/patch-2
+
+ Fix for security issue CVE-2016-0787
+
+Alexander Lamaison (2 Apr 2016)
+- [Zenju brought this change]
+
+ Fix MSVC 14 compilation errors
+
+ For _MSC_VER == 1900 these macros are not needed and create problems:
+
+
+
+ 1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.10240.0\ucrt\stdio.h(1925): warning C4005: 'snprintf': macro redefinition (compiling source file libssh2-files\src\mac.c)
+
+ 1> \win32\libssh2_config.h(27): note: see previous definition of 'snprintf' (compiling source file libssh2-files\src\mac.c)
+
+ 1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.10240.0\ucrt\stdio.h(1927): fatal error C1189: #error: Macro definition of snprintf conflicts with Standard Library function declaration (compiling source file libssh2-files\src\mac.c)
+
+Daniel Stenberg (26 Mar 2016)
+- [Brad Harder brought this change]
+
+ _libssh2_channel_open: speeling error fixed in channel error message
+
+Alexander Lamaison (15 Mar 2016)
+- Link with crypt32.lib on Windows.
+
+ Makes linking with static OpenSSL work again. Although it's not
+ required for dynamic OpenSSL, it does no harm.
+
+ Fixes #98.
+
+- [Craig A. Berry brought this change]
+
+ Tweak VMS help file building.
+
+ Primarily this is handling cases where top-level files moved into
+ the docs/ directory. I also corrected a typo and removed the
+ claim that libssh2 is public domain.
+
+- [Craig A. Berry brought this change]
+
+ Build with standard stat structure on VMS.
+
+ This gets us large file support, is available on any VMS release
+ in the last decade and more, and gives stat other modern features
+ such as 64-bit ino_t.
+
+- [Craig A. Berry brought this change]
+
+ Update vms/libssh2_config.h.
+
+ VMS does have stdlib.h, gettimeofday(), and OpenSSL. The latter
+ is appropriate to hard-wire in the configuration because it's
+ installed by default as part of the base operating system and
+ there is currently no libgcrypt port.
+
+- [Craig A. Berry brought this change]
+
+ VMS can't use %zd for off_t format.
+
+ %z is a C99-ism that VMS doesn't currently have; even though the
+ compiler is C99-compliant, the library isn't quite. The off_t used
+ for the st_size element of the stat can be 32-bit or 64-bit, so
+ detect what we've got and pick a format accordingly.
+
+- [Craig A. Berry brought this change]
+
+ Normalize line endings in libssh2_sftp_get_channel.3.
+
+ Somehow it got Windows-style CRLF endings so convert to just LF,
+ for consistency as well as not to confuse tools that will regard
+ the \r as content (e.g. the OpenVMS help librarian).
+
+Dan Fandrich (29 Feb 2016)
+- libgcrypt: Fixed a NULL pointer dereference on OOM
+
+Daniel Stenberg (24 Feb 2016)
+- [Viktor Szakats brought this change]
+
+ url updates, HTTP => HTTPS
+
+ Closes #87
+
+Dan Fandrich (23 Feb 2016)
+- RELEASE-NOTES: removed some duplicated names
+
+Version 1.7.0 (23 Feb 2016)
+
+Daniel Stenberg (23 Feb 2016)
+- web: the site is now HTTPS
+
+- RELEASE-NOTES: 1.7.0 release
+
+- diffie_hellman_sha256: convert bytes to bits
+
+ As otherwise we get far too small numbers.
+
+ Reported-by: Andreas Schneider
+
+ CVE-2016-0787
+
+Alexander Lamaison (18 Feb 2016)
+- Allow CI failures with VS 2008 x64.
+
+ Appveyor doesn't support this combination.
+
+Daniel Stenberg (16 Feb 2016)
+- [Viktor Szakats brought this change]
+
+ GNUmakefile: list system libs after user libs
+
+ Otherwise some referenced WinSock functions will fail to
+ resolve when linking against LibreSSL 2.3.x static libraries
+ with mingw.
+
+ Closes #80
+
+- [Viktor Szakats brought this change]
+
+ openssl: apply new HAVE_OPAQUE_STRUCTS macro
+
+ Closes #81
+
+- [Viktor Szakats brought this change]
+
+ openssl: fix LibreSSL support after OpenSSL 1.1.0-pre1/2 support
+
+Alexander Lamaison (14 Feb 2016)
+- sftp.h: Fix non-C90 type.
+
+ uint64_t does not exist in C90. Use libssh2_uint64_t instead.
+
+- Exclude sshd tests from AppVeyor.
+
+ They fail complaining that sshd wasn't invoked with an absolute path.
+
+- Test on more versions of Visual Studio.
+
+- Fix Appveyor builds.
+
+Daniel Stenberg (14 Feb 2016)
+- [Viktor Szakats brought this change]
+
+ openssl: add OpenSSL 1.1.0-pre3-dev compatibility
+
+ by using API instead of accessing an internal structure.
+
+ Closes #83
+
+- RELEASE-NOTES: synced with 996b04ececdf
+
+- include/libssh2.h: next version is 1.7.0
+
+- configure: build "silent" if possible
+
+- sftp: re-indented some minor stuff
+
+- [Jakob Egger brought this change]
+
+ sftp.c: ensure minimum read packet size
+
+ For optimum performance we need to ensure we don't request tiny packets.
+
+- [Jakob Egger brought this change]
+
+ sftp.c: Explicit return values & sanity checks
+
+- [Jakob Egger brought this change]
+
+ sftp.c: Check Read Packet File Offset
+
+ This commit adds a simple check to see if the offset of the read
+ request matches the expected file offset.
+
+ We could try to recover, from this condition at some point in the future.
+ Right now it is better to return an error instead of corrupted data.
+
+- [Jakob Egger brought this change]
+
+ sftp.c: Don't return EAGAIN if data was written to buffer
+
+- [Jakob Egger brought this change]
+
+ sftp.c: Send at least one read request before reading
+
+ This commit ensures that we have sent at least one read request before
+ we try to read data in sftp_read().
+
+ Otherwise sftp_read() would return 0 bytes (indicating EOF) if the
+ socket is not ready for writing.
+
+- [Jakob Egger brought this change]
+
+ sftp.c: stop reading when buffer is full
+
+ Since we can only store data from a single chunk in filep,
+ we have to stop receiving data as soon as the buffer is full.
+
+ This adresses the following bug report:
+ https://github.com/libssh2/libssh2/issues/50
+
+Salvador Fandiño (21 Jan 2016)
+- agent_disconnect_unix: unset the agent fd after closing it
+
+ "agent_disconnect_unix", called by "libssh2_agent_disconnect", was
+ leaving the file descriptor in the agent structure unchanged. Later,
+ "libssh2_agent_free" would call again "libssh2_agent_disconnect" under
+ the hood and it would try to close again the same file descriptor. In
+ most cases that resulted in just a harmless error, but it is also
+ possible that the file descriptor had been reused between the two
+ calls resulting in the closing of an unrelated file descriptor.
+
+ This patch sets agent->fd to LIBSSH2_INVALID_SOCKET avoiding that
+ issue.
+
+ Signed-off-by: Salvador Fandiño
+
+Daniel Stenberg (18 Jan 2016)
+- [Patrick Monnerat brought this change]
+
+ os400qc3: support encrypted private keys
+
+ PKCS#8 EncryptedPrivateKeyinfo structures are recognized and decoded to get
+ values accepted by the Qc3 crypto library.
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3: New PKCS#5 decoder
+
+ The Qc3 library is not able to handle PKCS#8 EncryptedPrivateKeyInfo structures
+ by itself. It is only capable of decrypting the (encrypted) PrivateKeyInfo
+ part, providing a key encryption key and an encryption algorithm are given.
+ Since the encryption key and algorithm description part in a PKCS#8
+ EncryptedPrivateKeyInfo is a PKCS#5 structure, such a decoder is needed to
+ get the derived key method and hash, as well as encryption algorith and
+ initialisation vector.
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3: force continuous update on non-final hash/hmac computation
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3: Be sure hmac keys have a minimum length
+
+ The Qc3 library requires a minimum key length depending on the target
+ hash algorithm. Append binary zeroes to the given key if not long enough.
+ This matches RFC 2104 specifications.
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3: Slave descriptor for key encryption key
+
+ The Qc3 library requires the key encryption key to exist as long as
+ the encrypted key is used. Its descriptor token is then kept as an
+ "encrypted key slave" for recursive release.
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3.c: comment PEM/DER decoding
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3.c: improve ASN.1 header byte checks
+
+- [Patrick Monnerat brought this change]
+
+ os400qc3.c: improve OID matching
+
+- [Patrick Monnerat brought this change]
+
+ os400: os400qc3.c: replace malloc by LIBSSH2_ALLOC or alloca where possible
+
+- [Patrick Monnerat brought this change]
+
+ os400: asn1_new_from_bytes(): use data from a single element only
+
+- [Patrick Monnerat brought this change]
+
+ os400: fix an ILE/RPG prototype
+
+- [Patrick Monnerat brought this change]
+
+ os400: implement character encoding conversion support
+
+- [Patrick Monnerat brought this change]
+
+ os400: do not miss some external prototypes
+
+ Build procedure extproto() did not strip braces from header files, thus
+ possibly prepended them to true prototypes. This prevented the prototype to
+ be recognized as such.
+ The solution implemented here is to map braces to semicolons, effectively
+ considering them as potential prototype delimiters.
+
+- [Patrick Monnerat brought this change]
+
+ os400: Really add specific README
+
+- [Patrick Monnerat brought this change]
+
+ os400: Add specific README and include new files in dist tarball
+
+- [Patrick Monnerat brought this change]
+
+ os400: add compilation scripts
+
+- [Patrick Monnerat brought this change]
+
+ os400: include files for ILE/RPG
+
+ In addition, file os400/macros.h declares all procedures originally
+ defined as macros. It must not be used for real inclusion and is only
+ intended to be used as a `database' for macro wrapping procedures generation.
+
+- [Patrick Monnerat brought this change]
+
+ os400: add supplementary header files/wrappers. Define configuration.
+
+- [Patrick Monnerat brought this change]
+
+ Protect callback function calls from macro substitution
+
+ Some structure fields holding callback addresses have the same name as the
+ underlying system function (connect, send, recv). Set parentheses around
+ their reference to suppress a possible macro substitution.
+
+ Use a macro for connect() on OS/400 to resolve a const/nonconst parameter
+ problem.
+
+- [Patrick Monnerat brought this change]
+
+ Add interface for OS/400 crypto library QC3
+
+- [Patrick Monnerat brought this change]
+
+ misc: include stdarg.h for debug code
+
+- [Patrick Monnerat brought this change]
+
+ Document crypto library interface
+
+- [Patrick Monnerat brought this change]
+
+ Feature an optional crypto-specific macro to rsa sign a data fragment vector
+
+ OS/400 crypto library is unable to sign a precomputed SHA1 hash: however
+ it does support a procedure that hashes data fragments and rsa signs.
+ If defined, the new macro _libssh2_rsa_sha1_signv() implements this function
+ and disables use of _libssh2_rsa_sha1_sign().
+
+ The function described above requires that the struct iovec unused slacks are
+ cleared: for this reason, macro libssh2_prepare_iovec() has been introduced.
+ It should be defined as empty for crypto backends that are not sensitive
+ to struct iovec unused slack values.
+
+- [Patrick Monnerat brought this change]
+
+ Fold long lines in include files
+
+- [Viktor Szakats brought this change]
+
+ kex.c: fix indentation
+
+ Closes #71
+
+- [Viktor Szakats brought this change]
+
+ add OpenSSL-1.1.0-pre2 compatibility
+
+ Closes #70
+
+- [Viktor Szakats brought this change]
+
+ add OpenSSL 1.1.0-pre1 compatibility
+
+ * close https://github.com/libssh2/libssh2/issues/69
+ * sync a declaration with the rest of similar ones
+ * handle EVP_MD_CTX_new() returning NULL with OpenSSL 1.1.0
+ * fix potential memory leak with OpenSSL 1.1.0 in
+ _libssh2_*_init() functions, when EVP_MD_CTX_new() succeeds,
+ but EVP_DigestInit() fails.
+
+Marc Hoersken (22 Dec 2015)
+- wincng.c: fixed _libssh2_wincng_hash_final return value
+
+ _libssh2_wincng_hash_final was returning the internal BCRYPT
+ status code instead of a valid libssh2 return value (0 or -1).
+
+ This also means that _libssh2_wincng_hash never returned 0.
+
+- wincng.c: fixed possible memory leak in _libssh2_wincng_hash
+
+ If _libssh2_wincng_hash_update failed _libssh2_wincng_hash_final
+ would never have been called before.
+
+ Reported by Zenju.
+
+Kamil Dudka (15 Dec 2015)
+- [Paul Howarth brought this change]
+
+ libssh2.pc.in: fix the output of pkg-config --libs
+
+ ... such that it does not include LDFLAGS used to build libssh2 itself.
+ There was a similar fix in the curl project long time ago:
+
+ https://github.com/bagder/curl/commit/curl-7_19_7-56-g4c8adc8
+
+ Bug: https://bugzilla.redhat.com/1279966
+ Signed-off-by: Kamil Dudka
+
+Marc Hoersken (6 Dec 2015)
+- hostkey.c: align code path of ssh_rsa_init to ssh_dss_init
+
+- hostkey.c: fix invalid memory access if libssh2_dsa_new fails
+
+ Reported by dimmaq, fixes #66
+
+Daniel Stenberg (3 Nov 2015)
+- [Will Cosgrove brought this change]
+
+ gcrypt: define libssh2_sha256_ctx
+
+ Looks like it didn't make it into the latest commit for whatever reason.
+
+ Closes #58
+
+- [Salvador Fandino brought this change]
+
+ libssh2_session_set_last_error: Add function
+
+ Net::SSH2, the Perl wrapping module for libssh2 implements several features*
+ on top of libssh2 that can fail and so need some mechanism to report the error
+ condition to the user.
+
+ Until now, besides the error state maintained internally by libssh2, another
+ error state was maintained at the Perl level for every session object and then
+ additional logic was used to merge both error states. That is a maintenance
+ nighmare, and actually there is no way to do it correctly and consistently.
+
+ In order to allow the high level language to add new features to the library
+ but still rely in its error reporting features the new function
+ libssh2_session_set_last_error (that just exposses _libssh2_error_flags) is
+ introduced.
+
+ *) For instance, connecting to a remote SSH service giving the hostname and
+ port.
+
+ Signed-off-by: Salvador Fandino
+ Signed-off-by: Salvador Fandiño
+
+- [Salvador Fandino brought this change]
+
+ _libssh2_error: Support allocating the error message
+
+ Before this patch "_libssh2_error" required the error message to be a
+ static string.
+
+ This patch adds a new function "_libssh2_error_flags" accepting an
+ additional "flags" argument and specifically the flag
+ "LIBSSH2_ERR_FLAG_DUP" indicating that the passed string must be
+ duplicated into the heap.
+
+ Then, the method "_libssh2_error" has been rewritten to use that new
+ function under the hood.
+
+ Signed-off-by: Salvador Fandino
+ Signed-off-by: Salvador Fandiño
+
+- [Will Cosgrove brought this change]
+
+ added engine.h include to fix warning
+
+- [sune brought this change]
+
+ kex.c: removed dupe entry from libssh2_kex_methods[]
+
+ Closes #51
+
+- [Salvador Fandiño brought this change]
+
+ userauth: Fix off by one error when reading public key file
+
+ After reading the public key from file the size was incorrectly
+ decremented by one.
+
+ This was usually a harmless error as the last character on the public
+ key file is an unimportant EOL. But if due to some error the public key
+ file is empty, the public key size becomes (uint)(0 - 1), resulting in
+ an unrecoverable out of memory error later.
+
+ Signed-off-by: Salvador Fandi??o
+
+- [Salvador Fandino brought this change]
+
+ channel: Detect bad usage of libssh2_channel_process_startup
+
+ A common novice programmer error (at least among those using the
+ wrapping Perl module Net::SSH2), is to try to reuse channels.
+
+ This patchs detects that incorrect usage and fails with a
+ LIBSSH2_ERROR_BAD_USE error instead of hanging.
+
+ Signed-off-by: Salvador Fandino
+
+- [Will Cosgrove brought this change]
+
+ kex: Added diffie-hellman-group-exchange-sha256 support
+
+ ... and fixed HMAC_Init depricated usage
+
+ Closes #48
+
+Alexander Lamaison (21 Sep 2015)
+- Prefixed new #defines to prevent collisions.
+
+ Other libraries might have their own USE_WIN32_*FILES.
+
+- [keith-daigle brought this change]
+
+ Update examples/scp.c to fix bug where large files on win32 would cause got to wrap and go negative
+
+- [David Byron brought this change]
+
+ add libssh2_scp_recv2 to support large (> 2GB) files on windows
+
+Daniel Stenberg (17 Sep 2015)
+- [sune brought this change]
+
+ WinCNG: support for SHA256/512 HMAC
+
+ Closes #47
+
+- [brian m. carlson brought this change]
+
+ Add support for HMAC-SHA-256 and HMAC-SHA-512.
+
+ Implement support for these algorithms and wire them up to the libgcrypt
+ and OpenSSL backends. Increase the maximum MAC buffer size to 64 bytes
+ to prevent buffer overflows. Prefer HMAC-SHA-256 over HMAC-SHA-512, and
+ that over HMAC-SHA-1, as OpenSSH does.
+
+ Closes #40
+
+- [Zenju brought this change]
+
+ kex: free server host key before allocating it (again)
+
+ Fixes a memory leak when Synology server requests key exchange
+
+ Closes #43
+
+- [Viktor Szakats brought this change]
+
+ GNUmakefile: up OpenSSL version
+
+ closes #23
+
+- [Viktor Szakats brought this change]
+
+ GNUmakefile: add -m64 CFLAGS when targeting mingw64, add -m32/-m64 to LDFLAGS
+
+ libssh2 equivalent of curl patch https://github.com/bagder/curl/commit/d21b66835f2af781a3c2a685abc92ef9f0cd86be
+
+ This allows to build for the non-default target when using a multi-target mingw distro.
+ Also bump default OpenSSL dependency path to 1.0.2c.
+
+- [Viktor Szakats brought this change]
+
+ GNUmakefile: add support for LIBSSH2_LDFLAG_EXTRAS
+
+ It is similar to existing LIBSSH2_CFLAG_EXTRAS, but for
+ extra linker options.
+
+ Also delete some line/file ending whitespace.
+
+ closes #27
+
+- [nasacj brought this change]
+
+ hostkey.c: Fix compiling error when OPENSSL_NO_MD5 is defined
+
+ Closes #32
+
+- [Mizunashi Mana brought this change]
+
+ openssl.h: adjust the rsa/dsa includes
+
+ ... to work when built without DSA support.
+
+ Closes #36
+
+Alexander Lamaison (26 Jul 2015)
+- Let CMake build work as a subproject.
+
+ Patch contributed by JasonHaslam.
+
+- Fix builds with Visual Studio 2015.
+
+ VS2015 moved stdio functions to the header files as inline function. That means check_function_exists can't detect them because it doesn't use header files - just does a link check. Instead we need to use check_symbol_exists with the correct headers.
+
+Kamil Dudka (2 Jul 2015)
+- cmake: include CMake files in the release tarballs
+
+ Despite we announced the CMake support in libssh2-1.6.0 release notes,
+ the files required by the CMake build system were not included in the
+ release tarballs. Hence, the only way to use CMake for build was the
+ upstream git repository.
+
+ This commit makes CMake actually supported in the release tarballs.
+
+- tests/mansyntax.sh: fix 'make distcheck' with recent autotools
+
+ Do not create symbolic links off the build directory. Recent autotools
+ verify that out-of-source build works even if the source directory tree
+ is not writable.
+
+- openssl: fix memleak in _libssh2_dsa_sha1_verify()
+
+Daniel Stenberg (12 Jun 2015)
+- openssl: make libssh2_sha1 return error code
+
+ - use the internal prefix _libssh2_ for non-exported functions
+
+ - removed libssh2_md5() since it wasn't used
+
+ Reported-by: Kamil Dudka
+
+- [LarsNordin-LNdata brought this change]
+
+ SFTP: Increase speed and datasize in SFTP read
+
+ The function sftp_read never return more then 2000 bytes (as it should
+ when I asked Daniel). I increased the MAX_SFTP_READ_SIZE to 30000 but
+ didn't get the same speed as a sftp read in SecureSSH. I analyzed the
+ code and found that a return always was dona when a chunk has been read.
+ I changed it to a sliding buffer and worked on all available chunks. I
+ got an increase in speed and non of the test I have done has failed
+ (both local net and over Internet). Please review and test. I think
+ 30000 is still not the optimal MAX_SFTP_READ_SIZE, my next goal is to
+ make an API to enable changing this value (The SecureSSH sftp_read has
+ more complete filled packages when comparing the network traffic)
+
+- bump: start working on 1.6.1
+
+Version 1.6.0 (5 Jun 2015)
+
+Daniel Stenberg (5 Jun 2015)
+- RELEASE-NOTES: synced with 858930cae5c6a
+
+Marc Hoersken (19 May 2015)
+- wincng.c: fixed indentation
+
+- [sbredahl brought this change]
+
+ wincng.c: fixed memleak in (block) cipher destructor
+
+Alexander Lamaison (6 May 2015)
+- [Jakob Egger brought this change]
+
+ libssh2_channel_open: more detailed error message
+
+ The error message returned by libssh2_channel_open in case of a server side channel open failure is now more detailed and includes the four standard error conditions in RFC 4254.
+
+- [Hannes Domani brought this change]
+
+ kex: fix libgcrypt memory leaks of bignum
+
+ Fixes #168.
+
+Marc Hoersken (3 Apr 2015)
+- configure.ac: check for SecureZeroMemory for clear memory feature
+
+- Revert "wincng.c: fix clear memory feature compilation with mingw"
+
+ This reverts commit 2d2744efdd0497b72b3e1ff6e732aa4c0037fc43.
+
+ Autobuilds show that this did not solve the issue.
+ And it seems like RtlFillMemory is defined to memset,
+ which would be optimized out by some compilers.
+
+- wincng.c: fix clear memory feature compilation with mingw
+
+Alexander Lamaison (1 Apr 2015)
+- [LarsNordin-LNdata brought this change]
+
+ Enable use of OpenSSL that doesn't have DSA.
+
+ Added #if LIBSSH2_DSA for all DSA functions.
+
+- [LarsNordin-LNdata brought this change]
+
+ Use correct no-blowfish #define with OpenSSL.
+
+ The OpenSSL define is OPENSSL_NO_BF, not OPENSSL_NO_BLOWFISH.
+
+Marc Hoersken (25 Mar 2015)
+- configure: error if explicitly enabled clear-memory is not supported
+
+ This takes 22bd8d81d8fab956085e2079bf8c29872455ce59 and
+ b8289b625e291bbb785ed4add31f4759241067f3 into account,
+ but still makes it enabled by default if it is supported
+ and error out in case it is unsupported and was requested.
+
+Daniel Stenberg (25 Mar 2015)
+- configure: make clear-memory default but only WARN if backend unsupported
+
+ ... instead of previous ERROR.
+
+Marc Hoersken (24 Mar 2015)
+- wincng.h: fix warning about computed return value not being used
+
+- nonblocking examples: fix warning about unused tvdiff on Mac OS X
+
+Daniel Stenberg (24 Mar 2015)
+- openssl: fix compiler warnings
+
+- cofigure: fix --disable-clear-memory check
+
+Marc Hoersken (23 Mar 2015)
+- scp.c: improved command length calculation
+
+ Reduced number of calls to strlen, because shell_quotearg already
+ returns the length of the resulting string (e.q. quoted path)
+ which we can add to the existing and known cmd_len.
+ Removed obsolete call to memset again, because we can put a final
+ NULL-byte at the end of the string using the calculated length.
+
+- scp.c: improved and streamlined formatting
+
+- scp.c: fix that scp_recv may transmit not initialised memory
+
+- scp.c: fix that scp_send may transmit not initialised memory
+
+ Fixes ticket 244. Thanks Torsten.
+
+- kex: do not ignore failure of libssh2_sha1_init()
+
+ Based upon 43b730ce56f010e9d33573fcb020df49798c1ed8.
+ Fixes ticket 290. Thanks for the suggestion, mstrsn.
+
+- wincng.h: fix return code of libssh2_md5_init()
+
+- openssl.c: fix possible segfault in case EVP_DigestInit fails
+
+- wincng.c: fix possible use of uninitialized variables
+
+- wincng.c: fix unused argument warning if clear memory is not enabled
+
+- wincng: Added explicit clear memory feature to WinCNG backend
+
+ This re-introduces the original feature proposed during
+ the development of the WinCNG crypto backend. It still needs
+ to be added to libssh2 itself and probably other backends.
+
+ Memory is cleared using the function SecureZeroMemory which is
+ available on Windows systems, just like the WinCNG backend.
+
+- wincng.c: fixed mixed line-endings
+
+- wincng.c: fixed use of invalid parameter types in a8d14c5dcf
+
+- wincng.c: only try to load keys corresponding to the algorithm
+
+- wincng.c: moved PEM headers into definitions
+
+- wincng.h: fixed invalid parameter name
+
+- wincng: fixed mismatch with declarations in crypto.h
+
+- userauth.c: fixed warning C6001: using uninitialized sig and sig_len
+
+- pem.c: fixed warning C6269: possible incorrect order of operations
+
+- wincng: add support for authentication keys to be passed in memory
+
+ Based upon 18cfec8336e and daa2dfa2db.
+
+- pem.c: add _libssh2_pem_parse_memory to parse PEM from memory
+
+ Requirement to implement 18cfec8336e for Libgcrypt and WinCNG.
+
+- pem.c: fix copy and paste mistake from 55d030089b8
+
+- userauth.c: fix another possible dereference of a null pointer
+
+- userauth.c: fix possible dereference of a null pointer
+
+- pem.c: reduce number of calls to strlen in readline
+
+Alexander Lamaison (17 Mar 2015)
+- [Will Cosgrove brought this change]
+
+ Initialise HMAC_CTX in more places.
+
+ Missed a couple more places we init ctx to avoid openssl threading crash.
+
+- Build build breakage in WinCNG backend caused when adding libssh2_userauth_publickey_frommemory.
+
+ The new feature isn't implemented for the WinCNG backend currently, but the WinCNG backend didn't contain any implementation of the required backend functions - even ones that returns an error. That caused link errors.
+
+ This change fixes the problem by providing an implementation of the backend functions that returns an error.
+
+- Fix breakage in WinCNG backend caused by introducing libssh2_hmac_ctx_init.
+
+ The macro was defined to nothing for the libgcrypt backend, but not for WinCNG. This brings the latter into line with the former.
+
+Daniel Stenberg (15 Mar 2015)
+- userauth_publickey_frommemory.3: add AVAILABILITY
+
+ ... it will be added in 1.6.0
+
+- libssh2: next version will be called 1.6.0
+
+ ... since we just added a new function.
+
+- docs: add libssh2_userauth_publickey_frommemory.3 to dist
+
+ The function and man page were added in commit 18cfec8336e
+
+- [Jakob Egger brought this change]
+
+ direct_tcpip: Fixed channel write
+
+ There were 3 bugs in this loop:
+ 1) Started from beginning after partial writes
+ 2) Aborted when 0 bytes were sent
+ 3) Ignored LIBSSH2_ERROR_EAGAIN
+
+ See also:
+ https://trac.libssh2.org/ticket/281
+ https://trac.libssh2.org/ticket/293
+
+Alexander Lamaison (15 Mar 2015)
+- [Will Cosgrove brought this change]
+
+ Must init HMAC_CTX before using it.
+
+ Must init ctx before using it or openssl will reuse the hmac which is not thread safe and causes a crash.
+ Added libssh2_hmac_ctx_init macro.
+
+- Add continuous integration configurations.
+
+ Linux-based CI is done by Travis CI. Windows-based CI is done by Appveyor.
+
+- [David Calavera brought this change]
+
+ Allow authentication keys to be passed in memory.
+
+ All credits go to Joe Turpin, I'm just reaplying and cleaning his patch:
+ http://www.libssh2.org/mail/libssh2-devel-archive-2012-01/0015.shtml
+
+ * Use an unimplemented error for extracting keys from memory with libgcrypt.
+
+Daniel Stenberg (14 Mar 2015)
+- docs: include the renamed INSTALL* files in dist
+
+Alexander Lamaison (13 Mar 2015)
+- Prevent collisions between CMake and Autotools in examples/ and tests/.
+
+- Avoid clash between CMake build and Autotools.
+
+ Autotools expects a configuration template file at src/libssh2_config.h.in, which buildconf generates. But the CMake build system has its CMake-specific version of the file at this path. This means that, if you don't run buildconf, the Autotools build will fail because it configured the wrong header template.
+
+ See https://github.com/libssh2/libssh2/pull/8.
+
+- Merge pull request #8 from alamaison/cmake
+
+ CMake build system.
+
+- CMake build system.
+
+ Tested:
+ - Windows:
+ - Visual C++ 2005/2008/2010/2012/2013/MinGW-w64
+ - static/shared
+ - 32/64-bit
+ - OpenSSL/WinCNG
+ - Without zlib
+ - Linux:
+ - GCC 4.6.3/Clang 3.4
+ - static/shared
+ - 32/64-bit
+ - OpenSSL/Libgcrypt
+ - With/Without zlib
+ - MacOS X
+ - AppleClang 6.0.0
+ - static
+ - 64-bit
+ - OpenSSL
+ - Without zlib
+
+ Conflicts:
+ README
+
+- Man man syntax tests fail gracefully if man version is not suitable.
+
+- Return valid code from test fixture on failure.
+
+ The sshd test fixture was returning -1 if an error occurred, but negative error codes aren't technically valid (google it). Bash on Windows converted them to 0 which made setup failure look as though all tests were passing.
+
+- Let mansyntax.sh work regardless of where it is called from.
+
+Daniel Stenberg (12 Mar 2015)
+- [Viktor Szakáts brought this change]
+
+ mingw build: allow to pass custom CFLAGS
+
+ Allow to pass custom `CFLAGS` options via environment variable
+ `LIBSSH2_CFLAG_EXTRAS`. Default and automatically added options of
+ `GNUmakefile` have preference over custom ones. This addition is useful
+ for passing f.e. custom CPU tuning or LTO optimization (`-flto
+ -ffat-lto-objects`) options. The only current way to do this is to edit
+ `GNUmakefile`. This patch makes it unnecessary.
+
+ This is a mirror of similar libcurl patch:
+ https://github.com/bagder/curl/pull/136
+
+- [Will Cosgrove brought this change]
+
+ userauth: Fixed prompt text no longer being copied to the prompts struct
+
+ Regression from 031566f9c
+
+- README: update the git repo locations
+
+- wait_socket: wrong use of difftime()
+
+ With reversed arguments it would always return a negative value...
+
+ Bug: https://github.com/bagder/libssh2/issues/1
+
+- bump: start working toward 1.5.1 now
+
+Version 1.5.0 (11 Mar 2015)
+
+Daniel Stenberg (11 Mar 2015)
+- RELEASE-NOTES: 1.5.0 release
+
+- [Mariusz Ziulek brought this change]
+
+ kex: bail out on rubbish in the incoming packet
+
+ CVE-2015-1782
+
+ Bug: http://www.libssh2.org/adv_20150311.html
+
+- docs: move INSTALL, AUTHORS, HACKING and TODO to docs/
+
+ And with this, cleanup README to be shorter and mention the new source
+ code home.
+
+- .gitignore: don't ignore INSTALL
+
+Dan Fandrich (4 Mar 2015)
+- examples/x11.c: include sys/select.h for improved portability
+
+Daniel Stenberg (4 Mar 2015)
+- RELEASE-NOTES: synced with a8473c819bc068
+
+ In preparation for the upcoming 1.5.0 release.
+
+Guenter Knauf (8 Jan 2015)
+- NetWare build: added some missing exports.
+
+Marc Hoersken (29 Dec 2014)
+- knownhost.c: fix use of uninitialized argument variable wrote
+
+ Detected by clang scan in line 1195, column 18.
+
+- examples/x11.c: fix result of operation is garbage or undefined
+
+ Fix use of uninitialized structure w_size_bck.
+ Detected by clang scan in line 386, column 28.
+
+- examples/x11.c: remove dead assigments of some return values
+
+ Detected by clang scan in line 212, column 9.
+ Detected by clang scan in line 222, column 13.
+ Detected by clang scan in line 410, column 13.
+
+- examples/x11.c: fix possible memory leak if read fails
+
+ Detected by clang scan in line 224, column 21.
+
+- examples/x11.c: fix invalid removal of first list element
+
+ Fix use of memory after it was being freed.
+ Detected by clang scan in line 56, column 12.
+
+- userauth.c: make sure that sp_len is positive and avoid overflows
+
+ ... if the pointer subtraction of sp1 - pubkey - 1 resulted in a
+ negative or larger value than pubkey_len, memchr would fail.
+
+ Reported by Coverity CID 89846.
+
+- channel.c: remove logically dead code, host cannot be NULL here
+
+ ... host cannot be NULL in line 525, because it is always
+ valid (e.g. at least set to "0.0.0.0") after lines 430 and 431.
+
+ Reported by Coverity CID 89807.
+
+- session.c: check return value of session_nonblock during startup
+
+ Reported by Coverity CID 89803.
+
+- session.c: check return value of session_nonblock in debug mode
+
+ Reported by Coverity CID 89805.
+
+- pem.c: fix mixed line-endings introduced with 8670f5da24
+
+- pem.c: make sure there's a trailing zero and b64data is not NULL
+
+ ... if there is no base64 data between PEM header and footer.
+ Reported by Coverity CID 89823.
+
+- kex.c: make sure mlist is not set to NULL
+
+ ... if the currently unsupported LANG methods are called.
+ Reported by Coverity CID 89834.
+
+- packet.c: i < 256 was always true and i would overflow to 0
+
+ Visualize that the 0-termination is intentional, because the array
+ is later passed to strlen within _libssh2_packet_askv.
+
+- silence multiple data conversion warnings
+
+Daniel Stenberg (23 Dec 2014)
+- agent_connect_unix: make sure there's a trailing zero
+
+ ... if the path name was too long. Reported by Coverity CID 89801.
+
+Marc Hoersken (22 Dec 2014)
+- examples on Windows: use native SOCKET-type instead of int
+
+ And check return values accordingly.
+
+- userauth.c: improve readability and clarity of for-loops
+
+Daniel Stenberg (22 Dec 2014)
+- calloc: introduce LIBSSH2_CALLOC()
+
+ A simple function using LIBSSH2_ALLOC + memset, since this pattern was
+ used in multiple places and this simplies code in general.
+
+Marc Hoersken (15 Dec 2014)
+- libssh2_priv.h: Ignore session, context and format parameters
+
+- x11 example: check return value of socket function
+
+- examples: fixed mixed line-endings introduced with aedfba25b8
+
+- wincng.c: explicitly ignore BCrypt*AlgorithmProvider return codes
+
+ Fixes VS2012 code analysis warning C6031:
+ return value ignored: could return unexpected value
+
+- wincng.c: fix possible invalid memory write access
+
+ Fixes VS2012 code analysis warning C6386:
+ buffer overrun: accessing 'pbOutput', the writable size is
+ 'cbOutput' bytes, but '3' bytes may be written: libssh2 wincng.c 610
+
+- tests on Windows: check for WSAStartup return code
+
+ Fixes VS2012 code analysis warning C6031:
+ return value ignored: could return unexpected value
+
+- wincng.c: fix possible NULL pointer de-reference of bignum
+
+ Fixes VS2012 code analysis warning C6011:
+ dereferencing NULL pointer 'bignum'. libssh2 wincng.c 1567
+
+- wincng.c: fix possible use of uninitialized memory
+
+ Fixes VS2012 code analysis warning C6001:
+ using uninitialized memory 'cbDecoded'. libssh2 wincng.c 553
+
+- packet.c: fix possible NULL pointer de-reference within listen_state
+
+ Fixes VS2012 code analysis warning C6011:
+ dereferencing NULL pointer 'listen_state->channel'. libssh2 packet.c 221
+
+- kex.c: fix possible NULL pointer de-reference with session->kex
+
+ Fixes VS2012 code analysis warning C6011:
+ dereferencing NULL pointer 'session->kex'. libssh2 kex.c 1761
+
+- agent.c: check return code of MapViewOfFile
+
+ Fixes VS2012 code analysis warning C6387: 'p+4' may be '0':
+ this does not adhere to the specification for the function
+ 'memcpy': libssh2 agent.c 330
+
+ Fixes VS2012 code analysis warning C6387: 'p' may be '0':
+ this does not adhere to the specification for the function
+ 'UnmapViewOfFile': libssh2 agent.c 333
+
+- examples on Windows: check for socket return code
+
+ Fixes VS2012 code analysis warning C28193:
+ The variable holds a value that must be examined
+
+- examples on Windows: check for WSAStartup return code
+
+ Fixes VS2012 code analysis warning C6031:
+ return value ignored: could return unexpected value
+
+Guenter Knauf (11 Dec 2014)
+- wincng.c: silent some more gcc compiler warnings.
+
+- wincng.c: silent gcc compiler warnings.
+
+- Watcom build: added support for WinCNG build.
+
+- build: updated dependencies in makefiles.
+
+Daniel Stenberg (4 Dec 2014)
+- configure: change LIBS not LDFLAGS when checking for libs
+
+ Closes #289
+
+ Patch-by: maurerpe
+
+Guenter Knauf (3 Dec 2014)
+- MinGW build: some more GNUMakefile tweaks.
+
+ test/GNUmakefile: added architecture autodetection; added switches to
+ CFLAGS and RCFLAGS to make sure that the right architecture is used.
+ Added support to build with WinCNG.
+
+- sftpdir.c: added authentication method detection.
+
+ Stuff copied over from ssh2.c to make testing a bit easier.
+
+- NMake build: fixed LIBS settings.
+
+- NMake build: added support for WinCNG build.
+
+- MinGW build: some GNUMakefile tweaks.
+
+ Added architecture autodetection; added switches to CFLAGS and
+ RCFLAGS to make sure that the right architecture is used.
+ Added support to build with WinCNG.
+
+- MinGW build: Fixed redefine warnings.
+
+- Updated copyright year.
+
+Daniel Stenberg (31 Aug 2014)
+- COPYING: bump the copyright year
+
+Dan Fandrich (28 Jul 2014)
+- docs: fixed a bunch of typos
+
+- docs: added missing libssh2_session_handshake.3 file
+
+Marc Hoersken (19 May 2014)
+- wincng.c: specify the required libraries for dependencies using MSVC
+
+ Initially reported by Bob Kast as "for MS VS builds, specify the
+ libraries that are required so they don't need to go into all
+ project files that may use this library". Thanks a lot.
+
+- [Bob Kast brought this change]
+
+ windows build: do not export externals from static library
+
+ If you are building a DLL, then you need to explicitly export each
+ entry point. When building a static library, you should not.
+
+ libssh2 was exporting the entry points whether it was building a DLL or a
+ static library. To elaborate further, if libssh2 was used as a static
+ library, which was being linked into a DLL, the libssh2 API would be
+ exported from that separate DLL.
+
+Daniel Stenberg (19 May 2014)
+- [Mikhail Gusarov brought this change]
+
+ Fix typos in manpages
+
+Marc Hoersken (18 May 2014)
+- wincng.c: Fixed memory leak in case of an error during ASN.1 decoding
+
+- configure: Display individual crypto backends on separate lines
+
+ This avoids line-wrapping in between parameters and makes the
+ error message look like the following:
+
+ configure: error: No crypto library found!
+ Try --with-libssl-prefix=PATH
+ or --with-libgcrypt-prefix=PATH
+ or --with-wincng on Windows
+
+- [Bob Kast brought this change]
+
+ libssh2_priv.h: a 1 bit bit-field should be unsigned
+
+ some compilers may not like this
+
+- knownhost.c: Fixed warning that pointer targets differ in signedness
+
+- wincng.c: Fixed warning about pointer targets differing in signedness
+
+- tcpip-forward.c: Fixed warning that pointer targets differ in signedness
+
+ libssh2_channel_forward_listen_ex uses ints instead of unsigned ints.
+
+- misc.c: Fixed warning about mixed declarations and code
+
+- libgcrypt.h: Fixed warning about pointer targets differing in signedness
+
+- wincng.h: Fixed warning about pointer targets differing in signedness
+
+- misc.c: Fixed warning about unused parameter abstract
+
+- tcpip-forward.c: Removed unused variables shost, sport and sockopt
+
+- wincng.h: Added forward declarations for all WinCNG functions
+
+ Initially reported by Bob Kast as "Wincng - define function
+ prototypes for wincng routines". Thanks a lot.
+
+ Also replaced structure definitions with type definitions.
+
+- [Bob Kast brought this change]
+
+ libssh2.h: on Windows, a socket is of type SOCKET, not int
+
+- win32: Added WinCNG targets to generated Visual Studio project
+
+ Inspired by Bob Kast's reports, this commit enables the compilation
+ of libssh2 with WinCNG using the generated Visual Studio project files.
+ This commit adds WinCNG support to parts of the existing Win32 build
+ infrastructure, until new build systems, like pre-defined VS project
+ files or CMake files may be added.
+
+ This commit and b20bfeb3e519119a48509a1099c06d65aa7da1d7 raise one
+ question: How to handle build systems, like VS project files, that
+ need to include all source files regardless of the desired target,
+ including all supported crypto backends? For now the mentioned commit
+ added a check for LIBSSH2_OPENSSL to openssl.c and with this commit
+ the supported crypto backends are hardcoded within Makefile.am.
+
+- libssh2_priv msvc: Removed redundant definition of inline keyword
+
+ Initially reported by Bob Kast as "Remove redundant 'inline' define".
+ Thanks a lot.
+
+- wincng: Made data parameter to hash update function constant
+
+ Initially reported by Bob Kast as "formal parameter must be const
+ since it is used in contexts where the actual parameter may be const".
+ Thanks a lot.
+
+- wincng: fix cross-compilation against the w64 mingw-runtime package
+
+- openssl: Check for LIBSSH2_OPENSSL in order to compile with openssl
+
+- wincng: Fixed use of possible uninitialized variable pPaddingInfo
+
+ Reported by Bob Kast, thanks a lot.
+
+- wincng: Added cast for double to unsigned long conversion
+
+- wincng: Cleaned up includes and check NTSTATUS using macro
+
+ Removed header file combination that is not supported on a real
+ Windows platform and can only be compiled using MinGW. Replaced
+ custom NTSTATUS return code checks with BCRYPT_SUCCESS macro.
+
+Daniel Stenberg (16 Mar 2014)
+- userauth_hostbased_fromfile: zero assign to avoid uninitialized use
+
+ Detected by clang-analyze
+
+- channel_receive_window_adjust: store windows size always
+
+ Avoid it sometimes returning without storing it, leaving calling
+ functions with unknown content!
+
+ Detected by clang-analyzer
+
+- publickey_packet_receive: avoid junk in returned pointers
+
+ clang-analyzer found this risk it would return a non-initialized pointer
+ in a success case
+
+Peter Stuge (16 Mar 2014)
+- [Marc Hoersken brought this change]
+
+ Added Windows Cryptography API: Next Generation based backend
+
+- [Marc Hoersken brought this change]
+
+ knownhost.c: fixed that 'key_type_len' may be used uninitialized
+
+ ../src/knownhost.c: In function 'libssh2_knownhost_readline':
+ ../src/knownhost.c:651:16: warning: 'key_type_len' may be used
+ uninitialized in this function [-Wmaybe-uninitialized]
+ rc = knownhost_add(hosts, hostbuf, NULL,
+ ^
+ ../src/knownhost.c:745:12: note: 'key_type_len' was declared here
+ size_t key_type_len;
+ ^
+
+- [Marc Hoersken brought this change]
+
+ pem.c: always compile pem.c independently of crypto backend
+
+- Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
+
+ Commit d512b25f69a1b6778881f6b4b5ff9cfc6023be42 introduced a crypto
+ library abstraction in the autotools build system, to allow us to more
+ easily support new crypto libraries. In that process it was found that
+ all other build system which we support are hard-coded to build with
+ OpenSSL. Commit f5c1a0d98bd51aeb24aca3d49c7c81dcf8bd858d fixes automake
+ introduced into non-autotools build systems but still overlooked the
+ CPP macro saying that we are using OpenSSL.
+
+ Thanks to Marc Hörsken for identifying this issue and proposing a fix
+ for win32/{GNUmakefile,config.mk}. This commit uses a slightly different
+ approach but the end result is the same.
+
+Dan Fandrich (15 Mar 2014)
+- channel_close: Close the channel even in the case of errors
+
+- sftp_close_handle: ensure the handle is always closed
+
+ Errors are reported on return, but otherwise the close path is
+ completed as much as possible and the handle is freed on exit.
+
+Alexander Lamaison (6 Mar 2014)
+- knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer.
+
+ Commit 85c6627c changed the behaviour of `libssh2_knownhost_writeline` so that it stopped returning the number of bytes needed when the given buffer was too small. Also, the function changed such that is might write to part of the buffer before realising it is too small.
+
+ This commit restores the original behaviour, whilst keeping the unknown-key-type functionality that 85c6627c. Instead of writing to the buffer piecemeal, the length of the various parts is calculated up front and the buffer written only if there is enough space. The calculated necessary size is output in `outlen` regardless of whether the buffer was written to.
+
+ The main use-case for the original behaviour that this commit restores is to allow passing in a NULL buffer to get the actual buffer size needed, before calling the function again with the buffer allocated to the exact size required.
+
+- knownhost: Fix DSS keys being detected as unknown.
+
+ I missing `else` meant ssh-dss format keys were being re-detected as unknown format.
+
+Dan Fandrich (6 Mar 2014)
+- knownhosts: Abort if the hosts buffer is too small
+
+ This could otherwise cause a match on the wrong host
+
+- agent_list_identities: Fixed memory leak on OOM
+
+- Fixed a few typos
+
+- userauth: Fixed an attempt to free from stack on error
+
+- Fixed a few memory leaks in error paths
+
+- Fixed two potential use-after-frees of the payload buffer
+
+ The first might occur if _libssh2_packet_add returns an error, as
+ fullpacket_state wasn't reset to idle so if it were possible for
+ fullpacket to be called again, it would return to the same state
+ handler and re-use the freed p->packet buffer.
+
+ The second could occur if decrypt returned an error, as it freed the
+ packet buffer but did not clear total_num, meaning that freed buffer
+ could be written into again later.
+
+Alexander Lamaison (28 Nov 2013)
+- Fix missing `_libssh2_error` in `_libssh2_channel_write`.
+
+ In one case, the error code from `_libssh2_transport_read` was being returned from `_libssh2_channel_write` without setting it as the last error by calling `_libssh2_error`. This commit fixes that.
+
+ Found when using a session whose socket had been inadvertently destroyed. The calling code got confused because via `libssh2_session_last_error` it appeared no error had occurred, despite one being returned from the previous function.
+
+Kamil Dudka (21 Nov 2013)
+- [Mark McPherson brought this change]
+
+ openssl: initialise the digest context before calling EVP_DigestInit()
+
+ When using the OpenSSL libraries in FIPS mode, the function call
+ EVP_DigestInit() is actually #defined to FIPS_digestinit().
+ Unfortunately wheres EVP_DigestInit() initialises the context and then
+ calls EVP_DigestInit_ex(), this function assumes that the context has
+ been pre-initialised and crashes when it isn't.
+
+ Bug: https://trac.libssh2.org/ticket/279
+
+ Fixes #279
+
+- [Marc Hörsken brought this change]
+
+ .gitignore: Ignore files like src/libssh2_config.h.in~
+
+Peter Stuge (13 Nov 2013)
+- Move automake conditionals added by commit d512b25f out of Makefile.inc
+
+ Commit d512b25f69a1b6778881f6b4b5ff9cfc6023be42 added automake
+ conditionals to Makefile.inc but since Makefile.inc is included
+ from Makefile for all other build systems that does not work.
+
+ This commit instead adds Makefile.OpenSSL.inc and Makefile.libgcrypt.inc
+ and moves the automake conditional to its proper place, src/Makefile.am.
+
+ The automake conditional includes the correct Makefile.$name.inc per
+ the crypto library selection/detection done by configure.
+
+ All non-autotools build system files in libssh2 are hardcoded to use
+ OpenSSL and do not get a conditional but at least there is some reuse
+ because they can all include the new Makefile.OpenSSL.inc.
+
+Daniel Stenberg (27 Oct 2013)
+- [Salvador Fandino brought this change]
+
+ Set default window size to 2MB
+
+ The default channel window size used until now was 256KB. This value is
+ too small and results on a bottleneck on real-life networks where
+ round-trip delays can easily reach 300ms.
+
+ The issue was not visible because the configured channel window size
+ was being ignored and a hard-coded value of ~22MB being used instead,
+ but that was fixed on a previous commit.
+
+ This patch just changes the default window size
+ (LIBSSH2_CHANNEL_WINDOW_DEFAULT) to 2MB. It is the same value used by
+ OpenSSH and in our opinion represents a good compromise between memory
+ used and transfer speed.
+
+ Performance tests were run to determine the optimum value. The details
+ and related discussion are available from the following thread on the
+ libssh2 mailing-list:
+
+ http://www.libssh2.org/mail/libssh2-devel-archive-2013-10/0018.shtml
+ http://article.gmane.org/gmane.network.ssh.libssh2.devel/6543
+
+ An excerpt follows:
+
+ "I have been running some transfer test and measuring their speed.
+
+ My setup was composed of a quad-core Linux machine running Ubuntu 13.10
+ x86_64 with a LXC container inside. The data transfers were performed
+ from the container to the host (never crossing through a physical
+ network device).
+
+ Network delays were simulated using the tc tool. And ping was used to
+ verify that they worked as intended during the tests.
+
+ The operation performed was the equivalent to the following ssh command:
+
+ $ ssh container "dd bs=16K count=8K if=/dev/zero" >/dev/null
+
+ Though, establishment and closing of the SSH connection was excluded
+ from the timings.
+
+ I run the tests several times transferring files of sizes up to 128MB
+ and the results were consistent between runs.
+
+ The results corresponding to the 128MB transfer are available here:
+
+ https://docs.google.com/spreadsheet/ccc?key=0Ao1yRmX6PQQzdG5wSFlrZl9HRWNET3ZyN0hnaGo5ZFE&usp=sharing
+
+ It clearly shows that 256KB is too small as the default window size.
+ Moving to a 512MB generates a great improvement and after the 1MB mark
+ the returns rapidly diminish. Other factors (TCP window size, probably)
+ become more limiting than the channel window size
+
+ For comparison I also performed the same transfers using OpenSSH. Its
+ speed is usually on par with that of libssh2 using a window size of 1MB
+ (even if it uses a 2MB window, maybe it is less aggressive sending the
+ window adjust msgs)."
+
+ Signed-off-by: Salvador Fandino
+
+- [Salvador brought this change]
+
+ _libssh2_channel_read: Honour window_size_initial
+
+ _libssh2_channel_read was using an arbitrary hard-coded limit to trigger
+ the window adjusting code. The adjustment used was also hard-coded and
+ arbitrary, 15MB actually, which would limit the usability of libssh2 on
+ systems with little RAM.
+
+ This patch, uses the window_size parameter passed to
+ libssh2_channel_open_ex (stored as remote.window_size_initial) plus the
+ buflen as the base for the trigger and the adjustment calculation.
+
+ The memory usage when using the default window size is reduced from 22MB
+ to 256KB per channel (actually, if compression is used, these numbers
+ should be incremented by ~50% to account for the errors between the
+ decompressed packet sizes and the predicted sizes).
+
+ My tests indicate that this change does not impact the performance of
+ transfers across localhost or a LAN, being it on par with that of
+ OpenSSH. On the other hand, it will probably slow down transfers on
+ networks with high bandwidth*delay when the default window size
+ (LIBSSH2_CHANNEL_WINDOW_DEFAULT=256KB) is used.
+
+ Signed-off-by: Salvador Fandino
+
+- [Salvador Fandino brought this change]
+
+ knownhosts: handle unknown key types
+
+ Store but don't use keys of unsupported types on the known_hosts file.
+
+ Currently, when libssh2 parses a known_host file containing keys of some
+ type it doesn't natively support, it stops reading the file and returns
+ an error.
+
+ That means, that the known_host file can not be safely shared with other
+ software supporting other key types (i.e. OpenSSH).
+
+ This patch adds support for handling keys of unknown type. It can read
+ and write them, even if they are never going to be matched.
+
+ At the source level the patch does the following things:
+
+ - add a new unknown key type LIBSSH2_KNOWNHOST_KEY_UNKNOWN
+
+ - add a new slot (key_type_name) on the known_host struct that is
+ used to store the key type in ascii form when it is not supported
+
+ - parse correctly known_hosts entries with unknown key types and
+ populate the key_type_name slot
+
+ - print correctly known_hosts entries of unknown type
+
+ - when checking a host key ignore keys that do not match the key
+
+ Fixes #276
+
+- windows build: fix build errors
+
+ Fixes various link errors with VS2010
+
+ Reported-by: "kdekker"
+ Fixes #272
+
+- man page: add missing function argument
+
+ for libssh2_userauth_publickey_fromfile_ex()
+
+ Reported-by: "pastey"
+
+ Fixes #262
+
+- [Salvador brought this change]
+
+ Fix zlib deflate usage
+
+ Deflate may return Z_OK even when not all data has been compressed
+ if the output buffer becomes full.
+
+ In practice this is very unlikely to happen because the output buffer
+ size is always some KBs larger than the size of the data passed for
+ compression from the upper layers and I think that zlib never expands
+ the data so much, even on the worst cases.
+
+ Anyway, this patch plays on the safe side checking that the output
+ buffer is not exhausted.
+
+ Signed-off-by: Salvador
+
+- [Salvador brought this change]
+
+ comp_method_zlib_decomp: Improve buffer growing algorithm
+
+ The old algorithm was O(N^2), causing lots and lots of reallocations
+ when highly compressed data was transferred.
+
+ This patch implements a simpler one that just doubles the buffer size
+ everytime it is exhausted. It results in O(N) complexity.
+
+ Also a smaller inflate ratio is used to calculate the initial size (x4).
+
+ Signed-off-by: Salvador
+
+- [Salvador brought this change]
+
+ Fix zlib usage
+
+ Data may remain in zlib internal buffers when inflate() returns Z_OK
+ and avail_out == 0. In that case, inflate has to be called again.
+
+ Also, once all the data has been inflated, it returns Z_BUF_ERROR to
+ signal that the input buffer has been exhausted.
+
+ Until now, the way to detect that a packet payload had been completely
+ decompressed was to check that no data remained on the input buffer
+ but that didn't account for the case where data remained on the internal
+ zlib buffers.
+
+ That resulted in packets not being completely decompressed and the
+ missing data reappearing on the next packet, though the bug was masked
+ by the buffer allocation algorithm most of the time and only manifested
+ when transferring highly compressible data.
+
+ This patch fixes the zlib usage.
+
+ Signed-off-by: Salvador
+
+- [Salvador brought this change]
+
+ _libssh2_channel_read: fix data drop when out of window
+
+ After filling the read buffer with data from the read queue, when the
+ window size was too small, "libssh2_channel_receive_window_adjust" was
+ called to increase it. In non-blocking mode that function could return
+ EAGAIN and, in that case, the EAGAIN was propagated upwards and the data
+ already read on the buffer lost.
+
+ The function was also moving between the two read states
+ "libssh2_NB_state_idle" and "libssh2_NB_state_created" both of which
+ behave in the same way (excepting a debug statment).
+
+ This commit modifies "_libssh2_channel_read" so that the
+ "libssh2_channel_receive_window_adjust" call is performed first (when
+ required) and if everything goes well, then it reads the data from the
+ queued packets into the read buffer.
+
+ It also removes the useless "libssh2_NB_state_created" read state.
+
+ Some rotted comments have also been updated.
+
+ Signed-off-by: Salvador
+
+- [Salvador Fandino brought this change]
+
+ window_size: redid window handling for flow control reasons
+
+ Until now, the window size (channel->remote.window_size) was being
+ updated just after receiving the packet from the transport layer.
+
+ That behaviour is wrong because the channel queue may grow uncontrolled
+ when data arrives from the network faster that the upper layer consumes
+ it.
+
+ This patch adds a new counter, read_avail, which keeps a count of the
+ bytes available from the packet queue for reading. Also, now the window
+ size is adjusted when the data is actually read by an upper layer.
+
+ That way, if the upper layer stops reading data, the window will
+ eventually fill and the remote host will stop sending data. When the
+ upper layers reads enough data, a window adjust packet is delivered and
+ the transfer resumes.
+
+ The read_avail counter is used to detect the situation when the remote
+ server tries to send data surpassing the window size. In that case, the
+ extra data is discarded.
+
+ Signed-off-by: Salvador
+
+Peter Stuge (15 Sep 2013)
+- configure.ac: Call zlib zlib and not libz in text but keep option names
+
+- configure.ac: Reorder --with-* options in --help output
+
+- configure.ac: Rework crypto library detection
+
+ This further simplifies adding new crypto libraries.
+
+- Clean up crypto library abstraction in build system and source code
+
+ libssh2 used to explicitly check for libgcrypt and default to OpenSSL.
+
+ Now all possible crypto libraries are checked for explicitly, making
+ the addition of further crypto libraries both simpler and cleaner.
+
+- configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
+
+- Revert "Added Windows Cryptography API: Next Generation based backend"
+
+ This reverts commit d385230e15715e67796f16f3e65fd899f21a638b.
+
+Daniel Stenberg (7 Sep 2013)
+- [Leif Salomonsson brought this change]
+
+ sftp_statvfs: fix for servers not supporting statfvs extension
+
+ Fixes issue arising when server does not support statfvs and or fstatvfs
+ extensions. sftp_statvfs() and sftp_fstatvfs() after this patch will
+ handle the case when SSH_FXP_STATUS is returned from server.
+
+- [Marc Hoersken brought this change]
+
+ Added Windows Cryptography API: Next Generation based backend
+
+- [Kamil Dudka brought this change]
+
+ partially revert "window_size: explicit adjustments only"
+
+ This partially reverts commit 03ca9020756a4e16f0294e5b35e9826ee6af2364
+ in order to fix extreme slowdown when uploading to localhost via SFTP.
+
+ I was able to repeat the issue on RHEL-7 on localhost only. It did not
+ occur when uploading via network and it did not occur on a RHEL-6 box
+ with the same version of libssh2.
+
+ The problem was that sftp_read() used a read-ahead logic to figure out
+ the window_size, but sftp_packet_read() called indirectly from
+ sftp_write() did not use any read-ahead logic.
+
+- _libssh2_channel_write: client spins on write when window full
+
+ When there's no window to "write to", there's no point in waiting for
+ the socket to become writable since it most likely just will continue to
+ be.
+
+ Patch-by: ncm
+ Fixes #258
+
+- _libssh2_channel_forward_cancel: avoid memory leaks on error
+
+ Fixes #257
+
+- _libssh2_packet_add: avoid using uninitialized memory
+
+ In _libssh2_packet_add, called by _libssh2_packet_read, a call to
+ _libssh2_packet_send that is supposed to send a one-byte message
+ SSH_MSG_REQUEST_FAILURE would send an uninitialized byte upon re-entry
+ if its call to _send returns _EAGAIN.
+
+ Fixes #259
+
+- _libssh2_channel_forward_cancel: accessed struct after free
+
+ ... and the assignment was pointless anyway since the struct was about
+ to be freed. Bug introduced in dde2b094.
+
+ Fixes #268
+
+Peter Stuge (2 Jun 2013)
+- [Marc Hoersken brought this change]
+
+ Fixed compilation using mingw-w64
+
+- [Marc Hoersken brought this change]
+
+ knownhost.c: use LIBSSH2_FREE macro instead of free
+
+ Use LIBSSH2_FREE instead of free since
+ _libssh2_base64_encode uses LIBSSH2_ALLOC
+
+Daniel Stenberg (18 May 2013)
+- [Matthias Kerestesch brought this change]
+
+ libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET
+
+ ... previously it was left at 0 which is a valid file descriptor!
+
+ Bug: https://trac.libssh2.org/ticket/265
+
+ Fixes #265
+
+- userauth_password: pass on the underlying error code
+
+ _libssh2_packet_requirev() may return different errors and we pass that
+ to the parent instead of rewriting it.
+
+ Bug: http://libssh2.org/mail/libssh2-devel-archive-2013-04/0029.shtml
+ Reported by: Cosmin
+
+Peter Stuge (9 May 2013)
+- [Marc Hoersken brought this change]
+
+ libcrypt.c: Fix typo in _libssh2_rsa_sha1_sign() parameter type
+
+Kamil Dudka (4 May 2013)
+- configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
+
+ Reported by: Quintus
+ Bug: https://trac.libssh2.org/ticket/261
+
+Guenter Knauf (12 Apr 2013)
+- Fixed copyright string for NetWare build.
+
+Daniel Stenberg (9 Apr 2013)
+- [Richard W.M. Jones brought this change]
+
+ sftp: Add support for fsync (OpenSSH extension).
+
+ The new libssh2_sftp_fsync API causes data and metadata in the
+ currently open file to be committed to disk at the server.
+
+ This is an OpenSSH extension to the SFTP protocol. See:
+
+ https://bugzilla.mindrot.org/show_bug.cgi?id=1798
+
+- [Richard W.M. Jones brought this change]
+
+ sftp: statvfs: Along error path, reset the correct 'state' variable.
+
+- [Richard W.M. Jones brought this change]
+
+ sftp: seek: Don't flush buffers on same offset
+
+ Signed-off-by: Richard W.M. Jones
+
+Guenter Knauf (9 Feb 2013)
+- Updated dependency libs.
+
+- Fixed tool macro names.
+
+Daniel Stenberg (29 Nov 2012)
+- [Seth Willits brought this change]
+
+ compiler warnings: typecast strlen in macros
+
+ ... in macro parameters to avoid compiler warnings about lost precision.
+
+ Several macros in libssh2.h call strlen and pass the result directly to
+ unsigned int parameters of other functions, which warns about precision
+ loss because strlen returns size_t which is unsigned long on at least
+ some platforms (such as OS X). The fix is to simply typecast the
+ strlen() result to unsigned int.
+
+- libssh2.h: bump version to 1.4.4-DEV
+
+Version 1.4.3 (27 Nov 2012)
+
+Daniel Stenberg (27 Nov 2012)
+- RELEASE-NOTES: fixed for 1.4.3
+
+- sftp_read: return error if a too large package arrives
+
+Peter Stuge (13 Nov 2012)
+- Only define _libssh2_dsa_*() functions when building with DSA support
+
+Guenter Knauf (8 Nov 2012)
+- Added .def file to output.
+
+Kamil Dudka (1 Nov 2012)
+- libssh2_hostkey_hash.3: update the description of return value
+
+ The function returns NULL also if the hash algorithm is not available.
+
+Guenter Knauf (24 Oct 2012)
+- Fixed mode acciedently committed.
+
+- Ignore generated file.
+
+- Added hack to make use of Makefile.inc.
+
+ This should avoid further maintainance of the objects list.
+
+- Fixed MSVC NMakefile.
+
+ Added missing source files; added resource for DLL.
+
+Kamil Dudka (22 Oct 2012)
+- examples: use stderr for messages, stdout for data
+
+ Reported by: Karel Srot
+ Bug: https://bugzilla.redhat.com/867462
+
+- openssl: do not leak memory when handling errors
+
+ ,.. in aes_ctr_init(). Detected by Coverity.
+
+- channel: fix possible NULL dereference
+
+ ... in libssh2_channel_get_exit_signal(). Detected by Coverity.
+
+- Revert "aes: the init function fails when OpenSSL has AES support"
+
+ This partially reverts commit f4f2298ef3635acd031cc2ee0e71026cdcda5864.
+
+ We need to use the EVP_aes_???_ctr() functions in FIPS mode.
+
+- crypt: use hard-wired cipher block sizes consistently
+
+- openssl: do not ignore failure of EVP_CipherInit()
+
+- kex: do not ignore failure of libssh2_md5_init()
+
+ The MD5 algorithm is disabled when running in FIPS mode.
+
+Daniel Stenberg (21 Aug 2012)
+- [Peter Krempa brought this change]
+
+ known_hosts: Fail when parsing unknown keys in known_hosts file.
+
+ libssh2_knownhost_readfile() silently ignored problems when reading keys
+ in unsupported formats from the known hosts file. When the file is
+ written again from the internal structures of libssh2 it gets truntcated
+ to the point where the first unknown key was located.
+
+ * src/knownhost.c:libssh2_knownhost_readfile() - return error if key
+ parsing fails
+
+- AUTHORS: synced with 42fec44c8a4
+
+ 31 recent authors added
+
+- [Dave Hayden brought this change]
+
+ compression: add support for zlib@openssh.com
+
+ Add a "use_in_auth" flag to the LIBSSH2_COMP_METHOD struct and a
+ separate "zlib@openssh.com" method, along with checking session->state
+ for LIBSSH2_STATE_AUTHENTICATED. Appears to work on the OpenSSH servers
+ I've tried against, and it should work as before with normal zlib
+ compression.
+
+- [Dmitry Smirnov brought this change]
+
+ configure: gcrypt doesn't come with pkg-config support
+
+ ... so use plain old -lgcrypt to the linker to link with it.
+
+ Fixes #225
+
+- sftp_read: Value stored to 'next' is never read
+
+ Detected by clang-analyzer
+
+- publickey_init: errors are negative, fix check
+
+ Detected by clang-analyzer.
+
+- [Maxime Larocque brought this change]
+
+ session_free: wrong variable used for keeping state
+
+ If libssh2_session_free is called without the channel being freed
+ previously by libssh2_channel_free a memory leak could occur.
+
+ A mismatch of states variables in session_free() prevent the call to
+ libssh2_channel_free function. session->state member is used instead of
+ session->free_state.
+
+ It causes a leak of around 600 bytes on every connection on my systems
+ (Linux, x64 and PPC).
+
+ (Debugging done under contract for Accedian Networks)
+
+ Fixes #246
+
+Guenter Knauf (29 Jun 2012)
+- Small NetWare makefile tweak.
+
+- Some small Win32 makefile fixes.
+
+Daniel Stenberg (19 Jun 2012)
+- libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL
+
+- comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating
+
+ When using libssh2 to perform an SFTP file transfer from the "JSCAPE MFT
+ Server" (http://www.jscape.com) the transfer failed. The default JSCAPE
+ configuration is to enforce zlib compression on SSH2 sessions so the
+ session was compressed. The relevant part of the debug trace contained:
+
+ [libssh2] 1.052750 Transport: unhandled zlib error -5
+ [libssh2] 1.052750 Failure Event: -29 - decompression failure
+
+ The trace comes from comp_method_zlib_decomp() in comp.c. The "unhandled
+ zlib error -5" is the status returned from the zlib function
+ inflate(). The -5 status corresponds to "Z_BUF_ERROR".
+
+ The inflate() function takes a pointer to a z_stream structure and
+ "inflates" (decompresses) as much as it can. The relevant fields of the
+ z_stream structure are:
+
+ next_in - pointer to the input buffer containing compressed data
+ avail_in - the number of bytes available at next_in
+ next_out - pointer to the output buffer to be filled with uncompressed
+ data
+ avail_out - how much space available at next_out
+
+ To decompress data you set up a z_stream struct with the relevant fields
+ filled in and pass it to inflate(). On return the fields will have been
+ updated so next_in and avail_in show how much compressed data is yet to
+ be processed and next_out and avail_out show how much space is left in
+ the output buffer.
+
+ If the supplied output buffer is too small then on return there will be
+ compressed data yet to be processed (avail_in != 0) and inflate() will
+ return Z_OK. In this case the output buffer must be grown, avail_out
+ updated and inflate() called again.
+
+ If the supplied output buffer was big enough then on return the
+ compressed data will have been exhausted (avail_in == 0) and inflate()
+ will return Z_OK, so the data has all been uncompressed.
+
+ There is a corner case where inflate() makes no progress. That is, there
+ may be unprocessed compressed data and space available in the output
+ buffer and yet the function does nothing. In this case inflate() will
+ return Z_BUF_ERROR. From the zlib documentation and the source code it
+ is not clear under what circumstances this happens. It could be that it
+ needs to write multiple bytes (all in one go) from its internal state to
+ the output buffer before processing the next chunk of input but but
+ can't because there is not enough space (though my guesses as to the
+ cause are not really relevant). Recovery from Z_BUF_ERROR is pretty
+ simple - just grow the output buffer, update avail_out and call
+ inflate() again.
+
+ The comp_method_zlib_decomp() function does not handle the case when
+ inflate() returns Z_BUF_ERROR. It treats it as a non-recoverable error
+ and basically aborts the session.
+
+ Fixes #240
+
+Guenter Knauf (12 Jun 2012)
+- MinGW makefile tweaks.
+
+ Use GNU tools when compiling on Linux.
+ Fixed dist and dev targets.
+
+- NetWare makefile tweaks.
+
+ Changed to use Windows commandline tools instead of
+ GNU tools when compiling on Windows. Fixed dist and
+ dev targets. Enabled nlmconv error for unresolved
+ symbols.
+
+Daniel Stenberg (11 Jun 2012)
+- Revert "config.rpath: generated file, no need to keep in git"
+
+ This reverts commit 1ac7bd09cc685755577fb2c8829adcd081e7ab3c.
+
+ This file still used by lib/*m4 functions so we need to keep the file
+ around.
+
+- BINDINGS: added PySsh2, a Python-ctypes binding
+
+Guenter Knauf (8 Jun 2012)
+- Fixed MinGW debug build.
+
+Daniel Stenberg (5 Jun 2012)
+- BINDINGS: Added the Cocoa/Objective-C one
+
+ ... and sorted the bindings after the languages, alphabetically
+
+ Reported by: Mike Abdullah
+
+- BINDINGS: document the bindings we know of
+
+Guenter Knauf (4 Jun 2012)
+- Fixed LIBSSH2_INT64_T_FORMAT macro.
+
+ Usually a format macro should hold the whole format, otherwise
+ it should be named a prefix. Also fixed usage of this macro in
+ scp.c for a signed var where it was used as prefix for unsigned.
+
+- Removed obsolete define from makefiles.
+
+- Renamed NetWare makefiles.
+
+- Renamed NetWare makefiles.
+
+- Synced MinGW makefiles with 56c64a6..39e438f.
+
+ Also synced MinGW test makefile with b092696..f8cb874.
+
+Peter Stuge (30 May 2012)
+- Revert "sftp: Don't send attrs.permissions on read-only SSH_FXP_OPEN"
+
+ This reverts commit 04e79e0c798674a0796be8a55f63dd92e6877790.
+
+- sftp: Don't send attrs.permissions on read-only SSH_FXP_OPEN
+
+ This works around a protocol violation in the ProFTPD 1.3.4 mod_sftp
+ server, as reported by Will Cosgrove in:
+
+ http://libssh2.org/mail/libssh2-devel-archive-2012-05/0079.shtml
+
+ Based on a suggested fix by TJ Saunders in:
+
+ http://libssh2.org/mail/libssh2-devel-archive-2012-05/0104.shtml
+
+Guenter Knauf (28 May 2012)
+- Try to detect OpenSSL build type automatically.
+
+ Also fixed recently added libgdi32 linkage which is only
+ required when OpenSSL libs are linked statically.
+
+Daniel Stenberg (25 May 2012)
+- config.rpath: generated file, no need to keep in git
+
+Guenter Knauf (22 May 2012)
+- Updated dependency libary versions.
+
+Daniel Stenberg (18 May 2012)
+- 1.4.3: towards the future
+
+Version 1.4.2 (18 May 2012)
+
+Daniel Stenberg (18 May 2012)
+- RELEASE-NOTES: synced with 92a9f952794
+
+Alexander Lamaison (15 May 2012)
+- win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB.
+
+ Rationale: Everything else in this file states a fact about the win32
+ platform that is unconditional for that platform. There is nothing
+ unconditional about the presence of zlib. It is neither included with
+ Windows nor with the platform SDK. Therefore, this is not an appropriate
+ place to assert its presence. Especially as, once asserted, it cannot be
+ overridden using a compiler flag.
+
+ In contrast, if it is omitted, then it can easily be reasserted by adding
+ a compiler flag defining LIBSSH2_HAVE_ZLIB.
+
+Daniel Stenberg (14 May 2012)
+- RELEASE-NOTES: synced with 69a3354467c
+
+- _libssh2_packet_add: SSH_MSG_CHANNEL_REQUEST default to want_reply
+
+ RFC4254 says the default 'want_reply' is TRUE but the code defaulted to
+ FALSE. Now changed.
+
+ Fixes #233
+
+- gettimeofday: no need for a replacement under cygwin
+
+ Fixes #224
+
+Alexander Lamaison (13 May 2012)
+- Prevent sftp_packet_read accessing freed memory.
+
+ sftp_packet_add takes ownership of the packet passed to it and (now that we
+ handle zombies) might free the packet. sftp_packet_read uses the packet type
+ byte as its return code but by this point sftp_packet_add might have freed
+ it. This change fixes the problem by caching the packet type before calling
+ sftp_packet_add.
+
+ I don't understand why sftp_packet_read uses the packet type as its return
+ code. A future change might get rid of this entirely.
+
+Daniel Stenberg (12 May 2012)
+- sftp_packet_flush: flush zombies too
+
+ As this function is called when the SFTP session is closed, it needs to
+ also kill all zombies left in the SFTP session to avoid leaking memory
+ just in case some zombie would still be in there.
+
+- sftp_packetlist_flush: zombies must not have responses already
+
+ When flushing the packetlist, we must only add the request as a zombie
+ if no response has already been received. Otherwise we could wrongly
+ make it a zombie even though the response was already received and then
+ we'd get a zombie stuck there "forever"...
+
+- sftp_read: on EOF remove packet before flush
+
+ Since the sftp_packetlist_flush() function will move all the existing
+ FXP_READ requests in this handle to the zombie list we must first remove
+ this just received packet as it is clearly not a zombie.
+
+- sftp_packet_require: sftp_packet_read() returning 0 is not an error
+
+ Exactly as the comment in the code said, checking the return code from
+ sftp_packet_read() with <= was wrong and it should be < 0. With the new
+ filtering on incoming packets that are "zombies" we can now see this
+ getting zero returned.
+
+- sftp_packetlist_flush: only make it zombie if it was sent
+
+ The list of outgoing packets may also contain packets that never were
+ sent off and we better not make them zombies too.
+
+- [Alexander Lamaison brought this change]
+
+ Mark outstanding read requests after EOF as zombies.
+
+ In order to be fast, sftp_read sends many read requests at once. With a small
+ file, this can mean that when EOF is received back, many of these requests are
+ still outstanding. Responses arriving after we close the file and abandon the
+ file handle are queued in the SFTP packet queue and never collected. This
+ causes transfer speed to drop as a progressively longer queue must be searched
+ for every packet.
+
+ This change introduces a zombie request-ID list in the SFTP session that is
+ used to recognise these outstanding requests and prevent them being added to
+ the queue.
+
+Peter Stuge (23 Apr 2012)
+- [Rafael Kitover brought this change]
+
+ Update win32/GNUmakefile to use OpenSSL 1.0.1a
+
+ libcrypto on win32 now depends on gdi32.dll, so move the OpenSSL LDLIBS
+ block to before the compiler definitions, so that libcrypto gets added
+ first, and then add -lgdi32 into the following common LDLIBS for gcc.
+
+Guenter Knauf (23 Apr 2012)
+- Changed 'Requires' to 'Requires.private'.
+
+ Only static builds need to link against the crypto libs.
+
+- Fixed 'Requires:' names.
+
+ The 'Requires:' line lists the names of the .pc files.
+
+- Added 'Requires:' line to libssh2.pc.
+
+ This is necessary so that other libs which lookup libssh2 info
+ via pkg-config can add the right crypto lib dependencies.
+
+- Updated dependency lib versions.
+
+Peter Stuge (18 Apr 2012)
+- configure.ac: Add option to disable build of the example applications
+
+ Examples are built by default. Any of the following options on the
+ configure command line will skip building them:
+
+ --disable-examples-build
+ --enable-examples-build=no
+ --enable-examples-build=false
+
+- userauth.c: fread() from public key file to correctly detect any errors
+
+ If the filename parameter for file_read_publickey() was the name of a
+ directory instead of a file then libssh2 would spin trying to fgetc()
+ from the FILE * for the opened directory when trying to determine the
+ length of the encoded public key, since fgetc() can't report errors.
+
+ Use fread() instead to correctly detect this error condition along
+ with many others.
+
+ This fixes the problem reported in
+ http://www.libssh2.org/mail/libssh2-devel-archive-2012-04/0021.shtml
+
+ Reported-by: Oleksiy Zagorskyi
+
+- Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner
+
+Guenter Knauf (17 Apr 2012)
+- Fixed copyright year.
+
+- Updated dependency lib versions in static makefiles.
+
+Daniel Stenberg (6 Apr 2012)
+- version: bump to 1.4.2
+
+ We're on the 1.4.2 track now (at least)
+
+Version 1.4.1 (4 Apr 2012)
+
+Daniel Stenberg (4 Apr 2012)
+- RELEASE-NOTES: updated for 1.4.1 release
+
+- always do "forced" window updates
+
+ When calling _libssh2_channel_receive_window_adjust() internally, we now
+ always use the 'force' option to prevent libssh2 to avoid sending the
+ update if the update isn't big enough.
+
+ It isn't fully analyzed but we have seen corner cases which made a
+ necessary window update not get send due to this and then the other side
+ doesn't send data our side then sits waiting for forever.
+
+- channel_read: force window adjusts!
+
+ if there's not enough room to receive the data that's being requested,
+ the window adjustment needs to be sent to the remote and thus the force
+ option has to be used. _libssh2_channel_receive_window_adjust() would
+ otherwise "queue" small window adjustments for a later packet but that
+ is really terribly for the small buffer read that for example is the
+ final little piece of a very large file as then there is no logical next
+ packet!
+
+ Reported by: Armen Babakhanian
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0130.shtml
+
+- [Paul Howarth brought this change]
+
+ aes: the init function fails when OpenSSL has AES support
+
+ The internal init function only worked fine when the configure script
+ didn't detect the OpenSSL AES_CTR function!
+
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0111.shtml
+ Reported by: Paul Howarth
+
+- [Matthew Booth brought this change]
+
+ transport_send: Finish in-progress key exchange before sending data
+
+ _libssh2_channel_write() first reads outstanding packets before writing
+ new data. If it reads a key exchange request, it will immediately start
+ key re-exchange, which will require sending a response. If the output
+ socket is full, this will result in a return from
+ _libssh2_transport_read() of LIBSSH2_ERROR_EAGAIN. In order not to block
+ a write because there is no data to read, this error is explicitly
+ ignored and the code continues marshalling a packet for sending. When it
+ is sent, the remote end immediately drops the connection because it was
+ expecting a continuation of the key exchange, but got a data packet.
+
+ This change adds the same check for key exchange to
+ _libssh2_transport_send() that is in _libssh2_transport_read(). This
+ ensures that key exchange is completed before any data packet is sent.
+
+- channel_write: acknowledge transport errors
+
+ When draining data off the socket with _libssh2_transport_read() (which
+ in turn has to be done so that we can be sure to have read any possible
+ window-increasing packets), this code previously ignored errors which
+ could lead to nasty loops. Now all error codes except EAGAIN will cause
+ the error to be returned at once.
+
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0068.shtml
+ Reported by: Matthew Booth
+
+- [Steven Dake brought this change]
+
+ In examples/x11.c, Make sure sizeof passed to read operation is correct
+
+ sizeof(buf) expands to 8 or 4 (since its a pointer). This variable may
+ have been static in the past, leading to this error.
+
+ Signed-off-by: Steven Dake
+
+- [Steven Dake brought this change]
+
+ Fix suspicious sizeof usage in examples/x11.c
+
+ In the x11 example, sizeof(buf) = 8UL (on x86_64), when this should
+ probably represent the buffer size available. I am not sure how to
+ test that this change is actually correct, however.
+
+ Signed-off-by: Steven Dake
+
+- sftp_packet_read: follow-up fix for EAGAIN/window adjust
+
+ The commit in 7194a9bd7ba45 wasn't complete. This change makes sure
+ variables are initialized properly before used in the EAGAIN and window
+ adjust cases.
+
+- sftp_packet_add: use named error code instead of number
+
+- sftp_packet_add: verify the packet before accepting it
+
+ In order to bail out as quickly as possible when things are wrong and
+ out of sync, make sure the SFTP message is one we understand.
+
+- SFTP: preserve the original error code more
+
+ Lots of places in the code translated the original error into the more
+ generic LIBSSH2_ERROR_SOCKET_TIMEOUT but this turns out to distort the
+ original error reason a lot and makes tracking down the real origin of a
+ problem really hard. This change makes the original error code be
+ preserved to a larger extent when return up to the parent function.
+
+- sftp_packet_read: adjust window size as necessary
+
+ Commit 03ca9020756 tried to simplify the window sizing logic but broke
+ SFTP readdir as there was no window sizing code left there so large
+ directory listings no longer worked.
+
+ This change introduces window sizing logic to the sftp_packet_read()
+ function so that it now tells the remote about the local size having a
+ window size that suffice when it is about to ask for directory data.
+
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2012-03/0069.shtml
+ Reported by: Eric
+
+- [Steven Dake brought this change]
+
+ Tell C compiler we don't care about return code of libssh2_init
+
+ The call of libssh2_init returns a return code, but nothing could be done
+ within the _libssh2_init_if_needed execution path.
+
+ Signed-off-by: Steven Dake
+
+- [Steven Dake brought this change]
+
+ Add comment indicating a resource leak is not really a resource leak
+
+ While possibly obvious to those investigating the code, coverity complains
+ about this out of scope leak.
+
+ Signed-off-by: Steven Dake
+
+- [Steven Dake brought this change]
+
+ Use safer snprintf rather then sprintf in scp_send()
+
+ Signed-off-by: Steven Dake
+
+- [Steven Dake brought this change]
+
+ Use safer snprintf rather then sprintf in scp_recv()
+
+ While the buffer is indeed allocated to a safe length, better safe then sorry.
+
+ Signed-off-by: Steven Dake
+
+- [Steven Dake brought this change]
+
+ use snprintf in knownhost_writeline() rather then sprintf
+
+ Although the function checks the length, if the code was in error, there
+ could potentially be a buffer overrun with the use of sprintf. Instead replace
+ with snprintf.
+
+ Signed-off-by: Steven Dake
+
+- [Steven Dake brought this change]
+
+ Add tracing to print packets left on session at libssh2_session_free
+
+ Signed-off-by: Steven Dake
+
+Peter Stuge (2 Mar 2012)
+- Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET
+
+ INVALID_SOCKET is a special value in Windows representing a
+ non-valid socket identifier. We were #defining this to -1 on
+ non-Windows platforms, causing unneccessary namespace pollution.
+ Let's have our own identifier instead.
+
+ Thanks to Matt Lawson for pointing this out.
+
+- nw/Makefile.netware: Fix project name typo to avoid needless confusion
+
+- example/x11: Set raw terminal mode manually instead of with cfmakeraw()
+
+ OpenSolaris has no cfmakeraw() so to make the example more portable
+ we simply do the equivalent operations on struct termios ourselves.
+
+ Thanks to Tom Weber for reporting this problem, and finding a solution.
+
+Daniel Stenberg (17 Feb 2012)
+- sftp_write: cannot return acked data *and* EAGAIN
+
+ Whenever we have acked data and is about to call a function that *MAY*
+ return EAGAIN we must return the number now and wait to get called
+ again. Our API only allows data *or* EAGAIN and we must never try to get
+ both.
+
+Peter Stuge (13 Feb 2012)
+- example/x11: Build only when sys/un.h is found by configure
+
+ The example can't be built on systems without AF_UNIX sockets.
+
+Daniel Stenberg (10 Feb 2012)
+- [Alexander Lamaison brought this change]
+
+ Simplified sftp_read.
+
+ Removed the total_read variable that originally must have tracked how
+ much data had been written to the buffer. With non-blocking reads, we
+ must return straight away once we have read data into the buffer so this
+ variable served not purpose.
+
+ I think it was still hanging around in case the initial processing of
+ 'leftover' data meant we wrote to the buffer but this case, like the
+ others, must return immediately. Now that it does, the last remaining
+ need for the variable is gone.
+
+- [Alexander Lamaison brought this change]
+
+ Cleaned up sftp_read and added more explanation.
+
+ Replaced the gotos which were implementing the state machine with
+ a switch statement which makes the states more explicit.
+
+- sftp_read: avoid data *and* EAGAIN
+
+ Whenever we have data and is about to call a function that *MAY* return
+ EAGAIN we must return the data now and wait to get called again. Our API
+ only allows data *or* EAGAIN and we must never try to get both.
+
+Peter Stuge (2 Feb 2012)
+- Add a tcpip-forward example which demonstrates remote port forwarding
+
+- libssh2.h: Add missing prototype for libssh2_session_banner_set()
+
+- example/subsystem_netconf.c: Return error when read buffer is too small
+
+ Also remove a little redundancy in the read loop condition.
+
+- example/subsystem_netconf.c: Add a missing newline in an error message
+
+- Fix undefined reference to _libssh_error in libgcrypt backend
+
+ Commit 209de22299b4b58e582891dfba70f57e1e0492db introduced a function
+ call to a non-existing function, and since then the libgcrypt backend
+ has not been buildable.
+
+Version 1.4.0 (31 Jan 2012)
+
+Daniel Stenberg (31 Jan 2012)
+- RELEASE-NOTES: synced with 6bd584d29 for 1.4.0
+
+- s/1.3.1/1.4.0
+
+ We're bumping the minor number
+
+- [Jernej Kovacic brought this change]
+
+ libssh2_session_supported_algs: fix compiler warning
+
+- [Jernej Kovacic brought this change]
+
+ session_supported_algs docs: added an example
+
+- [Gellule Xg brought this change]
+
+ sftp-seek: clear EOF flag
+
+ Set the EOF flag to False when calling seek64 to be able to get some
+ data back on a following read
+
+- [Peter Krempa brought this change]
+
+ userauth: Provide more informations if ssh pub key extraction fails
+
+ If the function that extracts/computes the public key from a private key
+ fails the errors it reports were masked by the function calling it. This
+ patch modifies the key extraction function to return errors using
+ _libssh_error() function. The error messages are tweaked to contain
+ reference to the failed operaton in addition to the reason.
+
+ * AUTHORS: - add my name
+ * libgcrypt.c: _libssh2_pub_priv_keyfile(): - return a more verbose
+ error using
+ _libssh2_error() func.
+ * openssl.c: - modify call graph of _libssh2_pub_priv_keyfile() to use
+ _libssh2_error for error reporting();
+ * userauth.c: - tweak functions calling _libssh2_pub_priv_keyfile() not
+ to shadow error messages
+
+- TODO: remove issues we (sort of) did already
+
+- ssh2_exec: skip error outputs for EAGAIN
+
+ Since the example uses non-blocking mode, it will just flood the output
+ with this "nonsense" error.
+
+Guenter Knauf (30 Nov 2011)
+- Some NetWare makefile tweaks.
+
+Daniel Stenberg (18 Nov 2011)
+- LIBSSH2_SFTP_PACKET_MAXLEN: increase to 80000
+
+ Some SFTP servers send SFTP packets larger than 40000. Since the limit
+ is only present to avoid insane sizes anyway, we can easily bump it.
+
+ The define was formerly in the public header libssh2_sftp.h but served
+ no external purpose and was moved into the source dir.
+
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-11/0004.shtml
+ Reported by: Michael Harris
+
+Alexander Lamaison (18 Nov 2011)
+- [Peter Krempa brought this change]
+
+ knownhost_check(): Don't dereference ext if NULL is passed
+
+ Documentation for libssh2_knownhost_checkp() and related functions
+ states that the last argument is filled with data if non-NULL.
+
+ "knownhost if set to non-NULL, it must be a pointer to a 'struct
+ libssh2_knownhost' pointer that gets filled in to point to info about a
+ known host that matches or partially matches."
+
+ In this function ext is dereferenced even if set to NULL, causing
+ segfault in applications not needing the extra data.
+
+Daniel Stenberg (11 Nov 2011)
+- [Peter Krempa brought this change]
+
+ knownhost_add: Avoid dereferencing uninitialized memory on error path.
+
+ In function knownhost_add, memory is alocated for a new entry. If normal
+ alocation is used, memory is not initialized to 0 right after, but a
+ check is done to verify if correct key type is passed. This test is done
+ BEFORE setting the memory to null, and on the error path function
+ free_host() is called, that tries to dereference unititialized memory,
+ resulting into a glibc abort().
+
+ * knownhost.c - knownhost_add(): - move typemask check before alloc
+
+- windows build: add define to avoid compiler warning
+
+ A recent mingw compiler has started to complain on "#warning Please
+ include winsock2.h before windows.h" unless the magic define is set
+ first.
+
+ Reported by: Vincent Torri
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-10/0064.shtml
+
+Henrik Nordstrom (31 Oct 2011)
+- [Vincent Torri brought this change]
+
+ Correct Windows include file name case, simplifying cross-compilation
+
+ When cross compiling to Windows, libssh2.h include Windows header files
+ with upper case filenames : BaseTsd.h and WinSock2.h.
+
+ These files have lowercase names with mingw-w64 (iirc, it's the same with
+ mingw). And as on Windows, being lowercase or uppercase does not matter.
+
+Daniel Stenberg (25 Oct 2011)
+- [Jernej Kovacic brought this change]
+
+ libssh2_session_supported_algs: added
+
+- [Kamil Dudka brought this change]
+
+ example/sftp_RW_nonblock: do not ignore LIBSSH2_ERROR_EAGAIN
+
+ Bug: https://bugzilla.redhat.com/745420
+
+Peter Stuge (5 Oct 2011)
+- example/ssh2_agent: Print host key fingerprint before authentication
+
+ Also moves the comment about not being authenticated to before the
+ agent authentication takes place, so that it better matches the code.
+
+Daniel Stenberg (29 Sep 2011)
+- OpenSSL EVP: fix threaded use of structs
+
+ Make sure we don't clear or reset static structs after first init so
+ that they work fine even when used from multiple threads. Init the
+ structs in the global init.
+
+ Help and assistance by: John Engstrom
+
+ Fixes #229 (again)
+
+- openssl: don't init static structs differently
+
+ make_ctr_evp() is changed to take a struct pointer, and then each
+ _libssh2_EVP_aes_[keylen]_ctr function is made to pass in their own
+ static struct
+
+ Reported by: John Engstrom
+ Fixes #229
+
+Guenter Knauf (27 Sep 2011)
+- Removed obsolete include path.
+
+Daniel Stenberg (21 Sep 2011)
+- read_state: clear the state variable better
+
+ Set read_state back to idle before trying to send anything so that if
+ the state somehow is wrongly set.
+
+ Also, avoid such a case of confusion by resetting the read_state when an
+ sftp handle is closed.
+
+- sftp_read: remove leftover fprintf
+
+ Reported by: Alexander Lamaison
+
+- sftp.h: fix the #ifdef to prevent multiple inclusions
+
+- sftp_read: use a state variable to avoid bad writes
+
+ When a channel_write call has gotten an EAGAIN back, we try harder to
+ continue the same write in the subsequent invoke.
+
+- window_size: explicit adjustments only
+
+ Removed the automatic window_size adjustments from
+ _libssh2_channel_read() and instead all channel readers must now make
+ sure to enlarge the window sizes properly themselves.
+
+ libssh2_channel_read_ex() - the public function, now grows the window
+ size according to the requested buffer size. Applications can still opt
+ to grow the window more on demand. Larger windows tend to give higher
+ performance.
+
+ sftp_read() now uses the read-ahead logic to figure out a window_size.
+
+- libssh2.h: bump the default window size to 256K
+
+- libssh2_userauth_keyboard_interactive.3: fix man warning
+
+ It seemed to occur due to the excessive line length
+
+- [Mikhail Gusarov brought this change]
+
+ Add missing .gitignore entries
+
+- [Mikhail Gusarov brought this change]
+
+ Add manpage syntax checker to 'check' target
+
+ In virtually every libssh2 release Debian's lintian catches syntax errors in
+ manpages. Prevent it by checking manpages as a part of testsuite.
+
+- libssh2_banner_set.3: fix nroff syntax mistake
+
+Guenter Knauf (10 Sep 2011)
+- Use predefined resource compiler macro.
+
+- Added casts to silent compiler warnings.
+
+- Fixed uint64_t printf.
+
+- Fixed macro function signatures.
+
+- NetWare makefile tweaks.
+
+- Removed unused var.
+
+- Added 2 samples not mentioned.
+
+- Dont build x11 sample with MinGW.
+
+- Fixed executable file description.
+
+- Removed unused var.
+
+- Kill stupid gcc 3.x uninitialized warning.
+
+- Build all examples.
+
+- More MinGW makefile tweaks.
+
+ Renamed *.mingw makefiles to GNUmakefile since GNU make picks these
+ up automatically, and therefore win32/Makefile removed.
+
+- Removed forgotten WINSOCK_VERSION defines.
+
+Daniel Stenberg (9 Sep 2011)
+- libssh2_session_startup(3) => libssh2_session_handshake(3)
+
+ Propagate for the current function in docs and examples.
+ libssh2_session_startup() is deprecated.
+
+- libssh2_banner_set => libssh2_session_banner_get
+
+ Marked the old function as deprecated. Added the new name in the correct
+ name space with the same arguments and functionality.
+
+- new function: libssh2_session_banner_get
+
+ Returns the banner from the server handshake
+
+ Fixes #226
+
+- libssh2.h: bump version to 1.4.0 for new function(s)
+
+- remove embedded CVS/svn tags
+
+- [liuzl brought this change]
+
+ API add:libssh2_sftp_get_channel
+
+ Return the channel of sftp, then caller can
+ control the channel's behavior.
+
+ Signed-off-by: liuzl
+
+- _libssh2_channel_read: react on errors from receive_window_adjust
+
+ Previously the function would ignore all errors except for EAGAIN.
+
+- sftp_read: extend and clarify the documentation
+
+- sftp_read: cap the read ahead maximum amount
+
+ Now we only go up to LIBSSH2_CHANNEL_WINDOW_DEFAULT*30 bytes SFTP read
+ ahead, which currently equals 64K*30 == 1966080 bytes.
+
+- _libssh2_channel_read: fix non-blocking window adjusting
+
+ If EAGAIN is returned when adjusting the receive window, we must not
+ read from the transport directly until we've finished the adjusting.
+
+Guenter Knauf (8 Sep 2011)
+- Fix for systems which need sys/select.h.
+
+- The files were not gone but renamed ...
+
+Daniel Stenberg (6 Sep 2011)
+- sftp_read: added documenting comment
+
+ Taken from some recent email conversations I added some descriptions of
+ the logic in sftp_read() to aid readers.
+
+- 1.3.1: start the work
+
+Version 1.3.0 (6 Sep 2011)
+
+Daniel Stenberg (6 Sep 2011)
+- Makefile.am: the Makefile.win32 files are gone
+
+- RELEASE-NOTES: updated for 1.3.0
+
+- sftp_read: a short read is not end of file
+
+ A returned READ packet that is short will now only reduce the
+ offset.
+
+ This is a temporary fix as it is slightly better than the previous
+ approach but still not very good.
+
+- [liuzl brought this change]
+
+ _libssh2_packet_add: adjust window size when truncating
+
+ When receiving more data than what the window size allows on a
+ particular channel, make sure that the window size is adjusted in that
+ case too. Previously it would only adjust the window in the non-error
+ case.
+
+Guenter Knauf (29 Aug 2011)
+- Silent compiler warning with MinGW64.
+
+- Fixed link to native Win32 awk tool.
+
+- Renamed MinGW makefiles.
+
+- Some MinGW makefile tweaks.
+
+ Enable build without GNU tools and with MinGW64 compiler.
+
+- Fixed aes_ctr_do_cipher() signature.
+
+Daniel Stenberg (26 Aug 2011)
+- [liuzl brought this change]
+
+ libssh2_sftp_seek64: flush packetlist and buffered data
+
+ When seeking to a new position, flush the packetlist and buffered data
+ to prevent already received or pending data to wrongly get used when
+ sftp-reading from the new offset within the file.
+
+- sftp_read: advance offset correctly for buffered copies
+
+ In the case where a read packet has been received from the server, but
+ the entire contents couldn't be copied to the user-buffer, the data is
+ instead buffered and copied to the user's buffer in the next invocation
+ of sftp_read(). When that "extra" copy is made, the 'offset' pointer was
+ not advanced accordingly.
+
+ The biggest impact of this flaw was that the 'already' variable at the
+ top of the function that figures out how much data "ahead" that has
+ already been asked for would slowly go more and more out of sync, which
+ could lead to the file not being read all the way to the end.
+
+ This problem was most noticable in cases where the application would
+ only try to read the exact file size amount, like curl does. In the
+ examples libssh2 provides the sftp read function is most often called
+ with a fixed size large buffer and then the bug would not appear as
+ easily.
+
+ This bug was introduced in the SFTP rewrite in 1.2.8.
+
+ Bug: http://curl.haxx.se/mail/lib-2011-08/0305.html
+ http://www.libssh2.org/mail/libssh2-devel-archive-2011-08/0085.shtml
+
+- wrap some long lines < 80 columns
+
+- LIBSSH2_RECV: fix typo, use the RECV_FD macro
+
+- subsystem_netconf.c: fix compiler warnings
+
+- [Henrik Nordstrom brought this change]
+
+ Custom callbacks for performing low level socket I/O
+
+- version bump: start working towards 1.3.0
+
+Version 1.2.9 (16 Aug 2011)
+
+Daniel Stenberg (16 Aug 2011)
+- RELEASE-NOTES: synced with 95d69d3a81261
+
+- [Henrik Nordstrom brought this change]
+
+ Document prototypes for macro defined functions
+
+- [Henrik Nordstrom brought this change]
+
+ Avoid reuse after free when closing X11 channels
+
+- _libssh2_channel_write: handle window_size == 0 better
+
+ When about to send data on the channel and the window size is 0, we must
+ not just return 0 if the transport_read() function returned EAGAIN as it
+ then causes a busy-loop.
+
+ Bug: http://libssh2.org/mail/libssh2-devel-archive-2011-08/0011.shtml
+
+- gettimeofday: fix name space pollution
+
+ For systems without its own gettimeofday() implementation, we still must
+ not provide one outside our namespace.
+
+ Reported by: Bill Segall
+
+Dan Fandrich (5 Aug 2011)
+- libssh2.pc.in: Fixed spelling in pkgconfig file
+
+Peter Stuge (17 Jul 2011)
+- example/subsystem_netconf.c: Add missing #include
+
+- example/subsystem_netconf.c: Discard ]]>]]> and return only XML response
+
+- example/subsystem_netconf.c: Fix uninitialized variable bug
+
+- example: Add subsystem_netconf.c
+
+ This example demonstrates how to use libssh2 to send a request to
+ the NETCONF subsystem available e.g. in JunOS.
+
+ See also http://tools.ietf.org/html/draft-ietf-netconf-ssh-06
+
+Daniel Stenberg (16 Jul 2011)
+- man page cleanups: non-existing functions need no man pages
+
+- libssh2_new_host_entry.3: removed
+
+ This is just junk leftovers.
+
+- userauth_keyboard_interactive: fix buffer overflow
+
+ Partly reverse 566894494b4972ae12 which was simplifying the code far too
+ much and ended up overflowing a buffer within the LIBSSH2_SESSION
+ struct. Back to allocating the buffer properly like it used to do.
+
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-06/0032.shtml
+ Reported by: Alfred Gebert
+
+- keyboard-interactive man page: cleaned up
+
+- [Alfred Gebert brought this change]
+
+ _libssh2_recv(): handle ENOENT error as EAGAIN
+
+ A sftp session failed with error "failure establishing ssh session" on
+ Solaris and HP-UX. Sometimes the first recv() function call sets errno
+ to ENOENT. In the man pages for recv of Solaris and HP-UX the error
+ ENOENT is not documented.
+
+ I tested Solaris SPARC and x86, HP-UX i64, AIX, Windows and Linux.
+
+- agent_list_identities: fix out of scope access
+
+ An auto variable out of scope was being referenced and used.
+
+ fixes #220
+
+- _libssh2_wait_socket: fix timeouts for poll() uses
+
+- windows: inclusion fix
+
+ include winsock2.h for all windows compilers
+
+- keyb-interactive: add the fixed buffer
+
+ Belongs to commit 5668944
+
+- code cleanup: don't use C99/c++ comments
+
+ We aim for C89 compliance
+
+- keyb-interactive: allow zero length fields
+
+ Allow zero length fields so they don't cause malloc(0) calls
+
+ Avoid free()ing NULL pointers
+
+ Avoid a malloc of a fixed 5 byte buffer.
+
+- libssh2_channel_process_startup.3: clean up
+
+ Remove the references to the macro-fied shortcuts as they have their own
+ individual man pages.
+
+ Made the prototype different and more readable.
+
+- man page: fix .BR lines
+
+ We don't use \fI etc on .BR lines
+
+- userauth_keyboard_interactive: skip code on zero length auth
+
+- libssh2_channel_forward_accept.3: mention how to get error
+
+ Since this returns a pointer, libssh2_session_last_errno() must be used
+ to get the actual error code and it wasn't that clear before.
+
+- timeout docs: mention they're added in 1.2.9
+
+- sftp_write_sliding.c: indent fix
+
+ Use the standard indenting and removed CVS leftover comment
+
+- [zl liu brought this change]
+
+ sftp_write_sliding: send the complete file
+
+ When reaching the end of file there can still be data left not sent.
+
+- [Douglas Masterson brought this change]
+
+ session_startup: init state properly
+
+ libssh2_session_startup() didn't set the state correctly so it could get
+ confused.
+
+ Fixes #218
+
+- timeout: added man pages
+
+- BLOCK_ADJUST_ERRNO: move rc to right level
+
+ We can't declare the variable within the block and use it in the final
+ do-while() expression to be properly portable C89.
+
+- [Matt Lilley brought this change]
+
+ adds a timeout to blocking calls
+
+ Fixes bug #160 as per Daniel's suggestion
+
+ Adds libssh2_session_set_timeout() and libssh2_session_get_timeout()
+
+- SCP: fix incorrect error code
+
+ After an error occurs in libssh2_scp_recv() or libssh2_scp_send(), the
+ function libssh2_session_last_error() would return
+ LIBSSH2_ERROR_SOCKET_NONE on error.
+
+ Bug: http://trac.libssh2.org/ticket/216
+ Patch by: "littlesavage"
+
+ Fixes #216
+
+Guenter Knauf (19 Apr 2011)
+- Updated default (recommended) dependency versions.
+
+Daniel Stenberg (17 Apr 2011)
+- libssh2_session_block_directions: fix mistake
+
+ The last LIBSSH2_SESSION_BLOCK_INBOUND should be
+ LIBSSH2_SESSION_BLOCK_OUTBOUND
+
+ And I shortened the short description
+
+ Reported by: "drswinghead"
+
+- msvcproj: added libs and debug stuff
+
+ Added libraries needed to link whether using openssl dynamically or
+ statically
+
+ Added LIBSSH2DEBUG define to debug versions to enable tracing
+
+ URL: http://trac.libssh2.org/ticket/215
+ Patch by: Mark Smith
+
+- sftp_write: clean offsets on error
+
+ When an error has occurred on FXP_WRITE, we must make sure that the
+ offset, sent offset and acked counter are reset properly.
+
+- example/.gitignore: ignore built binaries
+
+- sftp_write: flush the packetlist on error
+
+ When an error occurs during write, flush the entire list of pending
+ outgoing SFTP packets.
+
+- keepalive: add first basic man pages
+
+ Someone on IRC pointed out that we don't have these documented so I
+ wrote up a first set based on the information in the wiki:
+ http://trac.libssh2.org/wiki/KeepAlive
+
+- scp_write_nonblock.c: remove pointless check
+
+ libssh2_channel_write() cannot return a value that is larger than the
+ input length value
+
+Mikhail Gusarov (9 Apr 2011)
+- s/\.NF/.nf/ to fix wrong macro name caught by man --warnings
+
+Daniel Stenberg (6 Apr 2011)
+- version: bump to 1.2.9_dev
+
+ Also update the copyright year range to include 2011
+
+- configure: fix $VERSION
+
+ Stop using the $VERSION variable as it seems to be magically used by
+ autoconfig itself and thus gets set to the value set in AC_INIT()
+ without us wanting that. $LIBSSH2VER is now the libssh2 version as
+ detected.
+
+ Reported by: Paul Howarth
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2011-04/0008.shtml
+
+- maketgz: use git2news.pl by the correct name
+
+Version 1.2.8 (4 Apr 2011)
+
+Daniel Stenberg (4 Apr 2011)
+- RELEASE-NOTES: synced with fabf1a45ee
+
+- NEWS: auto-generated from git
+
+ Starting now, the NEWS file is generated from git using the git2news.pl
+ script. This makes it always accurate and up-to-date, even for daily
+ snapshots etc.
+
+- sftp_write: handle FXP_WRITE errors
+
+ When an sftp server returns an error back on write, make sure the
+ function bails out and returns the proper error.
+
+- configure: stop using the deprecated AM_INIT_AUTOMAKE syntax
+
+Alexander Lamaison (13 Mar 2011)
+- Support unlimited number of host names in a single line of the known_hosts file.
+
+ Previously the code assumed either a single host name or a hostname,ip-address pair. However, according to the spec [1], there can be any number of comma separated host names or IP addresses.
+
+ [1] http://www.openbsd.org/cgi-bin/man.cgi?query=sshd&sektion=8
+
+Daniel Stenberg (26 Feb 2011)
+- libssh2_knownhost_readfile.3: clarify return value
+
+ This function returns the number of parsed hosts on success, not just
+ zero as previously documented.
+
+Peter Stuge (26 Feb 2011)
+- Don't save allocated packet size until it has actually been allocated
+
+ The allocated packet size is internal state which needs to match reality
+ in order to avoid problems. This commit fixes #211.
+
+Daniel Stenberg (21 Feb 2011)
+- [Alfred Gebert brought this change]
+
+ session_startup: manage server data before server identification
+
+ Fix the bug that libssh2 could not connect if the sftp server
+ sends data before sending the version string.
+
+ http://tools.ietf.org/html/rfc4253#section-4.2
+
+ "The server MAY send other lines of data before sending the version
+ string. Each line SHOULD be terminated by a Carriage Return and Line
+ Feed. Such lines MUST NOT begin with "SSH-", and SHOULD be encoded
+ in ISO-10646 UTF-8 [RFC3629] (language is not specified). Clients
+ MUST be able to process such lines."
+
+- [Alfred Gebert brought this change]
+
+ fullpacket: decompression only after init
+
+ The buffer for the decompression (remote.comp_abstract) is initialised
+ in time when it is needed. With this fix decompression is disabled when
+ the buffer (remote.comp_abstract) is not initialised.
+
+ Bug: http://trac.libssh2.org/ticket/200
+
+- _libssh2_channel_read: store last error
+
+ When the transport layer returns EAGAIN this function didn't call
+ _libssh2_error() which made the last_error not get set.
+
+- sftp_write: clarified the comment header
+
+- sftp_read: avoid wrapping counter to insanity
+
+ As pointed out in bug #206, if a second invoke of libssh2_sftp_read()
+ would shrink the buffer size, libssh2 would go nuts and send out read
+ requests like crazy. This was due to an unsigned variable turning
+ "negative" by some wrong math, and that value would be the amount of
+ data attempt to pre-buffer!
+
+ Bug: http://trac.libssh2.org/ticket/206
+
+- sftp_packet_read: use 32bit variables for 32bit data
+
+- libssh2_sftp_stat_ex.3: cleaned up, extended
+
+ Removed the macros from it as they have their own man pages.
+
+ Added the LIBSSH2_SFTP_ATTRIBUTES struct in here for easier reference.
+
+- sftp_readdir: return error if buffer is too small
+
+ If asked to read data into a buffer and the buffer is too small to hold
+ the data, this function now returns an error instead of as previously
+ just copy as much as fits.
+
+- sftp_symlink: return error if receive buffer too small
+
+ and clean up some variable type mismatches
+
+ Discussion: http://www.libssh2.org/mail/libssh2-devel-archive-2011-01/0001.shtml
+
+- docs: clarify what happens with a too small buffer
+
+ This flaw is subject to change, but I figured it might be valuable to
+ users of existing code to know how it works.
+
+- channel_request_pty_size: fix reqPTY_state
+
+ The state variable isn't properly set so every other call to the
+ function fails!
+
+ Bug: http://libssh2.org/mail/libssh2-devel-archive-2010-12/0096.shtml
+ Reported by: Steve Legg
+
+- data size: cleanup
+
+ Fix 64bit warnings by using (s)size_t and dedicated uint32_t types more.
+
+- [Pierre Joye brought this change]
+
+ ssize_t: proper typedef with MSVC compilers
+
+ As discussed on the mailing list, it was wrong for win64 and using the
+ VC-provided type is the safest approach instead of second- guessing
+ which one it should be.
+
+Guenter Knauf (22 Dec 2010)
+- Updated OpenSSL version.
+
+- Expanded tabs to spaces.
+
+Peter Stuge (21 Dec 2010)
+- [Joey Degges brought this change]
+
+ _libssh2_ntohu64: fix conversion from network bytes to uint64
+
+ Cast individual bytes to uint64 to avoid overflow in arithmetic.
+
+Daniel Stenberg (20 Dec 2010)
+- libssh2_userauth_list: language fix
+
+ "faily" is not a good English word, and I also cleaned up some other minor
+ mistakes
+
+- crypto: unify the generic functions
+
+ Added crypto.h that is the unified header to include when using crypto
+ functionality. It should be the only header that needs to adapt to the
+ underlying crypto library in use. It provides the set of prototypes that
+ are library agnostic.
+
+- [Mark Smith brought this change]
+
+ userauth: derive publickey from private
+
+ Pass a NULL pointer for the publickey parameter of
+ libssh2_userauth_publickey_fromfile and
+ libssh2_userauth_hostbased_fromfile functions. In this case, the
+ functions recompute the public key from the private key file data.
+
+ This is work done by Jean-Louis CHARTON
+ , then adapted by Mark Smith and
+ slightly edited further by me Daniel.
+
+ WARNING: this does leave the feature NOT WORKING when libssh2 is built
+ to use libgcrypt instead of OpenSSL simply due to lack of
+ implementation.
+
+- ssh2_echo: Value stored to 'exitcode' is never read
+
+- _libssh2_packet_add: fix SSH_MSG_DEBUG weirdness
+
+ I believe I may have caused this weird typo style error when I cleaned
+ up this function a while ago. Corrected now.
+
+- uint32: more longs converted to proper types
+
+ I also moved the MAC struct over to the mac.h header file and made sure
+ that the users of that struct include that file.
+
+- SFTP: more types to uint32_t
+
+ The 'num_names' field in the SSH_FXP_NAME response is an unsigned 32bit
+ value so we make sure to treat it like that.
+
+- SFTP: request_ids are uint32_t
+
+ I went over the code and made sure we use uint32_t all over for the
+ request_id data. It is an unsigned 32bit value on the wire.
+
+- SFTP: store request_id separately in packets
+
+ By using a new separate struct for incoming SFTP packets and not sharing
+ the generic packet struct, we can get rid of an unused field and add a
+ new one dedicated for holding the request_id for the incoming
+ package. As sftp_packet_ask() is called fairly often, a "mere" integer
+ comparison is MUCH faster than the previous memcmp() of (typically) 5
+ bytes.
+
+- libssh2_sftp_open_ex: man page extended and cleaned up
+
+ I added the missing documentation for the 'flags' argument.
+
+- SFTP: unify the READ/WRITE chunk structs
+
+- SFTP: fix memory leaks
+
+ Make sure that we cleanup remainders when the handle is closed and when
+ the subsystem is shutdown.
+
+ Existing flaw: if a single handle sends packets that haven't been
+ replied to yet at the time when the handle is closed, those packets will
+ arrive later and end up in the generic packet brigade queue and they
+ will remain in there until flushed. They will use unnecessary memory,
+ make things slower and they will ruin the SFTP handling if the
+ request_id counter ever wraps (highly unlikely to every happen).
+
+- sftp_close_handle: packet list is generic
+
+ Fix comment, simplify the loop logic
+
+- sftp_read: pipeline reads
+
+ The SFTP read function now does transfers the same way the SFTP write
+ function was made to recently: it creates a list of many outgoing
+ FXP_READ packets that each asks for a small data chunk. The code then
+ tries to keep sending read request while collecting the acks for the
+ previous requests and returns the received data.
+
+- sftp_write: removed unused variable
+
+- _libssh2_channel_close: don't call transport read if disconnected
+
+ The loop that waits for remote.close to get set may end up looping
+ forever since session->socket_state gets set to
+ LIBSSH2_SOCKET_DISCONNECTED by the packet_add() function called from the
+ transport_read() function and after having been set to
+ LIBSSH2_SOCKET_DISCONNECTED, the transport_read() function will only
+ return 0.
+
+ Bug: http://trac.libssh2.org/ticket/198
+
+- libssh2_sftp_seek64: new man page
+
+ Split off libssh2_sftp_seek64 from the libssh2_sftp_seek man page, and
+ mentioned that we consider the latter deprecated. Also added a mention
+ about the dangers of doing seek during writing or reading.
+
+- sftp_seek: fix
+
+ The new SFTP write code caused a regression as the seek function no
+ longer worked as it didn't set the write position properly.
+
+ It should be noted that seeking is STRONGLY PROHIBITED during upload, as
+ the upload magic uses two different offset positions and the multiple
+ outstanding packets etc make them sensitive to change in the midst of
+ operations.
+
+ This functionality was just verified with the new example code
+ sftp_append. This bug was filed as bug #202:
+
+ Bug: http://trac.libssh2.org/ticket/202
+
+- sftp_append: new example doing SFTP append
+
+- MAX_SFTP_OUTGOING_SIZE: 30000
+
+ I ran SFTP upload tests against localhost. It showed that to make the
+ app reach really good speeds, I needed to do a little code tweak and
+ change MAX_SFTP_OUTGOING_SIZE from 4000 to 30000. The tests I did before
+ with the high latency tests didn't show any real difference whatever I
+ had that size set to.
+
+ This number is the size in bytes that libssh2 cuts off the large input
+ buffer and sends off as an individual sftp packet.
+
+- sftp_write_sliding.c: new example
+
+ This is an example that is very similar to sftp_write_nonblock.c, with
+ the exception that this uses
+
+ 1 - a larger upload buffer
+
+ 2 - a sliding buffer mechnism to allow the app to keep sending lots of
+ data to libssh2 without having to first drain the buffer.
+
+ These are two key issues to make libssh2 SFTP uploads really perform
+ well at this point in time.
+
+- cpp: s/#elsif/#elif
+
+ This looks like a typo as #elsif is not really C...
+
+- _libssh2_channel_write: revert channel_write() use
+
+ The attempts made to have _libssh2_channel_write() accept larger pieces
+ of data and split up the data by itself into 32700 byte chunks and pass
+ them on to channel_write() in a loop as a way to do faster operations on
+ larger data blocks was a failed attempt.
+
+ The reason why it is difficult:
+
+ The API only allows EAGAIN or a length to be returned. When looping over
+ multiple blocks to get sent, one block can get sent and the next might
+ not. And yet: when transport_send() has returned EAGAIN we must not call
+ it again with new data until it has returned OK on the existing data it
+ is still working on. This makes it a mess and we do get a much easier
+ job by simply returning the bytes or EAGAIN at once, as in the EAGAIN
+ case we can assume that we will be called with the same arguments again
+ and transport_send() will be happy.
+
+ Unfortunately, I think we take a small performance hit by not being able
+ to do this.
+
+- ssh2_echo: new example
+
+ This is a new example snippet. The code is largely based on ssh2_exec,
+ and is written by Tommy Lindgren. I edited it into C90 compliance and to
+ conform to libssh2 indent style and some more.
+
+- send_existing: return after send_existing
+
+ When a piece of data is sent from the send_existing() function we must
+ make the parent function return afterwards. Otherwise we risk that the
+ parent function tries to send more data and ends up getting an EGAIN for
+ that more data and since it can only return one return code it doesn't
+ return info for the successfully sent data.
+
+ As this change is a regression I now added a larger comment explaining
+ why it has to work like this.
+
+- _libssh2_channel_write: count resent data as written
+
+ In the logic that resends data that was kept for that purpose due to a
+ previous EAGAIN, the data was not counted as sent causing badness.
+
+Peter Stuge (13 Nov 2010)
+- Use fprintf(stderr, ) instead of write(2, ) for debugging
+
+- session/transport: Correctly handle when _libssh2_send() returns -EAGAIN
+
+- src/agent.c: Simplify _libssh2_send() error checking ever so slightly
+
+Daniel Stenberg (12 Nov 2010)
+- send/recv: use _libssh2_recv and _libssh2_send now
+
+ Starting now, we unconditionally use the internal replacement functions
+ for send() and recv() - creatively named _libssh2_recv() and
+ _libssh2_send().
+
+ On errors, these functions return the negative 'errno' value instead of
+ the traditional -1. This design allows systems that have no "natural"
+ errno support to not have to invent it. It also means that no code
+ outside of these two transfer functions should use the errno variable.
+
+- channel_write: move some logic to _libssh2_channel_write
+
+ Some checks are better done in _libssh2_channel_write just once per
+ write instead of in channel_write() since the looping will call the
+ latter function multiple times per _libssh2_channel_write() invoke.
+
+- sftp_write: handle "left over" acked data
+
+ The SFTP handle struct now buffers number of acked bytes that haven't
+ yet been returned. The way this is used is as following:
+
+ 1. sftp_write() gets called with a buffer of let say size 32000. We
+ split 32000 into 8 smaller packets and send them off one by one. One of
+ them gets acked before the function returns so 4000 is returned.
+
+ 2. sftp_write() gets called again a short while after the previous one,
+ now with a much smaller size passed in to the function. Lets say 8000.
+ In the mean-time, all of the remaining packets from the previous call
+ have been acked (7*4000 = 28000). This function then returns 8000 as all
+ data passed in are already sent and it can't return any more than what
+ it got passed in. But we have 28000 bytes acked. We now store the
+ remaining 20000 in the handle->u.file.acked struct field to add up in
+ the next call.
+
+ 3. sftp_write() gets called again, and now there's a backlogged 20000
+ bytes to return as fine and that will get skipped from the beginning
+ of the buffer that is passed in.
+
+- sftp_write: polished and simplified
+
+ Removed unnecessary struct fields and state changes within the function.
+
+ Made the loop that checks for ACKs only check chunks that were fully
+ sent.
+
+- SCP: on failure, show the numerical error reason
+
+ By calling libssh2_session_last_errno()
+
+- SFTP: provide the numerical error reason on failure
+
+- SCP: clean up failure treatment
+
+ When SCP send or recv fails, it gets a special message from the server
+ with a warning or error message included. We have no current API to
+ expose that message but the foundation is there. Removed unnecessary use
+ of session struct fields.
+
+- sftp_write: enlarge buffer to perform better
+
+- packets: code cleanup
+
+ I added size checks in several places. I fixed the code flow to be easier
+ to read in some places.
+
+ I removed unnecessary zeroing of structs. I removed unused struct fields.
+
+- LIBSSH2_CALLBACK_MACERROR: clarify return code use
+
+- _libssh2_userauth_publickey: avoid shadowing
+
+- packet: avoid shadowing global symbols
+
+- sftp_readdir: avoid shadowing
+
+- shadowing: don't shadow the global compress
+
+- _libssh2_packet_add: turn ifs into a single switch
+
+- _libssh2_packet_add: check SSH_MSG_GLOBAL_REQUEST packet
+
+- _libssh2_packet_add: SSH_MSG_DEBUG length checks
+
+ Verify lengths before using them. Read always_display from the correct
+ index. Don't copy stuff around just to provide zero-termination of the
+ strings.
+
+- _libssh2_packet_add: SSH_MSG_IGNORE skip memmove
+
+ There's no promise of a zero termination of the data in the callback so
+ no longer perform ugly operation in order to provide it.
+
+- _libssh2_packet_add: SSH_MSG_DISCONNECT length checks
+
+ Verify lengths before trying to read data.
+
+- indent: break lines at 80 columns
+
+- SSH_MSG_CHANNEL_OPEN_FAILURE: used defined values
+
+ We don't like magic numbers in the code. Now the acceptable failure
+ codes sent in the SSH_MSG_CHANNEL_OPEN_FAILURE message are added as
+ defined values in the private header file.
+
+- sftp_write: don't return EAGAIN if no EAGAIN was received
+
+ This function now only returns EAGAIN if a lower layer actually returned
+ EAGAIN to it. If nothing was acked and no EAGAIN was received, it will
+ now instead return 0.
+
+- _libssh2_wait_socket: detect nothing-to-wait-for
+
+ If _libssh2_wait_socket() gets called but there's no direction set to
+ wait for, this causes a "hang". This code now detects this situation,
+ set a 1 second timeout instead and outputs a debug output about it.
+
+- decomp: remove the free_dest argument
+
+ Since the decompress function ALWAYS returns allocated memory we get a
+ lot simpler code by removing the ability to return data unallocated.
+
+- decomp: cleaned off old compression stuff
+
+ I cleared off legacy code from when the compression and decompression
+ functions were a single unified function. Makes the code easier to read
+ too.
+
+- [TJ Saunders brought this change]
+
+ decomp: increase decompression buffer sizes
+
+- [TJ Saunders brought this change]
+
+ zlib: Add debug tracing of zlib errors
+
+- sftp_packet_read: handle partial reads of the length field
+
+ SFTP packets come as [32 bit length][payload] and the code didn't
+ previously handle that the initial 32 bit field was read only partially
+ when it was read.
+
+- [Jasmeet Bagga brought this change]
+
+ kex_agree_hostkey: fix NULL pointer derefence
+
+ While setting up the session, ssh tries to determine the type of
+ encryption method it can use for the session. This requires looking at
+ the keys offered by the remote host and comparing these with the methods
+ supported by libssh2 (rsa & dss). To do this there is an iteration over
+ the array containing the methods supported by libssh2.
+
+ If there is no agreement on the type of encryption we come to the 3rd
+ entry of the hostkeyp array. Here hostkeyp is valid but *hostkep is
+ NULL. Thus when we dereference that in (*hostkeyp)->name there is a
+ crash
+
+- _libssh2_transport_send: remove dead assignment
+
+ 'data' isn't accessed beyond this point so there's no need to assign it.
+
+- scp_recv: remove dead assignment
+
+ Instead of assigning a variable we won't read, we now use the more
+ explicit (void) prefix.
+
+- sftp_write: removed superfluous assignment
+
+- bugfix: avoid use of uninitialized value
+
+- sftp_packet_require: propagate error codes better
+
+ There were some chances that they would cause -1 to get returned by
+ public functions and as we're hunting down all such occurances and since
+ the underlying functions do return valuable information the code now
+ passes back proper return codes better.
+
+- [Alfred Gebert brought this change]
+
+ fix memory leaks (two times cipher_data) for each sftp session
+
+- libssh2_userauth_authenticated: make it work as documented
+
+ The man page clearly says it returns 1 for "already authenticated" but
+ the code said non-zero. I changed the code to use 1 now, as that is also
+ non-zero but it gets the benefit that it now matches the documentation.
+
+ Using 1 instead of non-zero is better for two reasons:
+
+ 1. We have the opportunity to introduce other return codes in the future for
+ things like error and what not.
+ 2. We don't expose the internal bitmask variable value.
+
+- userauth_keyboard_interactive: fix indent
+
+- [Alfred Gebert brought this change]
+
+ fix memory leak in userauth_keyboard_interactive()
+
+ First I wanted to free the memory in session_free() but then
+ I had still memory leaks because in my test case the function
+ userauth_keyboard_interactive() is called twice. It is called
+ twice perhaps because the server has this authentication
+ methods available: publickey,gssapi-with-mic,keyboard-interactive
+ The keyboard-interactive method is successful.
+
+- dist: include sftp.h in dist archives
+
+Simon Josefsson (27 Oct 2010)
+- Update header to match new function prototype, see c48840ba88.
+
+Daniel Stenberg (26 Oct 2010)
+- bugfixes: the transport rearrange left some subtle flaws now gone
+
+- libssh2_userauth_publickey_fromfile_ex.3: cleaned up looks
+
+- libssh2_userauth_publickey: add man page
+
+ I found an undocumented public function and we can't have it like
+ that. The description here is incomplete, but should serve as a template
+ to allow filling in...
+
+- libssh2_sftp_write.3: added blurb about the "write ahead"
+
+ Documented the new SFTP write concept
+
+- sftp_close_handle: free any trailing write chunks
+
+- _libssh2_channel_write: fix warnings
+
+- SFTP: bufgix, move more sftp stuff to sftp.h
+
+ The sftp_write function shouldn't assume that the buffer pointer will be
+ the same in subsequent calls, even if it assumes that the data already
+ passed in before haven't changed.
+
+ The sftp structs are now moved to sftp.h (which I forgot to add before)
+
+- SFTP: use multiple outgoing packets when writing
+
+ sftp_write was rewritten to split up outgoing data into multiple packets
+ and deal with the acks in a more asynchronous manner. This is meant to
+ help overcome latency and round-trip problems with the SFTP protocol.
+
+- TODO: implemented a lot of the ideas now
+
+- _libssh2_channel_write: removed 32500 size limit
+
+ Neither _libssh2_channel_write nor sftp_write now have the 32500 size
+ limit anymore and instead the channel writing function now has its own
+ logic to send data in multiple calls until everything is sent.
+
+- send_existing: don't tell parent to return when drained
+
+ That will just cause unnecessary code execution.
+
+- _libssh2_channel_write: general code cleanup
+
+ simplified the function and removed some unused struct fields
+
+- _libssh2_transport_send: replaces _libssh2_transport_write
+
+ The new function takes two data areas, combines them and sends them as a
+ single SSH packet. This allows several functions to allocate and copy
+ less data.
+
+ I also found and fixed a mixed up use of the compression function
+ arguments that I introduced in my rewrite in a recent commit.
+
+- scp_write_nonblock: use select() instead of busyloop
+
+ Make this example nicer by not busylooping.
+
+- send_existing: clear olen when the data is sent off
+
+- _libssh2_transport_write: allow 256 extra bytes around the packet
+
+- _libssh2_transport_write: remade to send without malloc
+
+- compress: compression disabled by default
+
+ We now allow libssh2_session_flag() to enable compression with a new
+ flag and I added documentation for the previous LIBSSH2_FLAG_SIGPIPE
+ flag which I wasn't really aware of!
+
+- comp: split the compress function
+
+ It is now made into two separate compress and decompress functions. In
+ preparation for upcoming further modficications.
+
+Dan Fandrich (20 Oct 2010)
+- Added header file to allow compiling in older environments
+
+Daniel Stenberg (20 Oct 2010)
+- TODO: add a possible new API for SFTP transfers
+
+- TODO: "New Transport API" added
+
+- TODO: add buffering plans
+
+Simon Josefsson (13 Oct 2010)
+- Mention libssh2_channel_get_exit_signal and give kudos.
+
+- [Tommy Lindgren brought this change]
+
+ Add libssh2_channel_get_exit_signal man page.
+
+ Signed-off-by: Simon Josefsson
+
+- [Tommy Lindgren brought this change]
+
+ Add libssh2_channel_get_exit_signal.
+
+ Signed-off-by: Simon Josefsson
+
+- Add libssh2_free man page and fix typo.
+
+- Add libssh2_free.
+
+Daniel Stenberg (11 Oct 2010)
+- scp_recv: improved treatment of channel_read() returning zero
+
+ As a zero return code from channel_read() is not an error we must make
+ sure that the SCP functions deal with that properly. channel_read()
+ always returns 0 if the channel is EOFed already so we check for EOF
+ after 0-reads to be able to return error properly.
+
+- libssh2_session_methods.3: detail what can be asked for
+
+- compression: send zlib before none
+
+ As the list of algorithms in a preferred order we should send zlib
+ before none to increase the chances that the server will let us do
+ compression.
+
+- compress: faster check, better return codes
+
+ In the transport functions we avoid a strcmp() now and just check a
+ boolean instead.
+
+ The compress/decompress function's return code is now acknowledged and
+ used as actual return code in case of failures.
+
+- libssh2_session_handshake: replaces libssh2_session_startup()
+
+ The function libssh2_session_startup() is now considered deprecated due
+ to the portability issue with the socket argument.
+ libssh2_session_handshake() is the name of the replacement.
+
+- libssh2_socket_t: now externally visible
+
+ In preparation for upcominig changes, the libssh2_socket_t type is now
+ typedef'ed in the public header.
+
+- _libssh2_transport_drain: removed
+
+ This function proved not to be used nor useful.
+
+- _libssh2_channel_write: don't iterate over transport writes
+
+ When a call to _libssh2_transport_write() succeeds, we must return from
+ _libssh2_channel_write() to allow the caller to provide the next chunk
+ of data.
+
+ We cannot move on to send the next piece of data that may already have
+ been provided in this same function call, as we risk getting EAGAIN for
+ that and we can't return information both about sent data as well as
+ EAGAIN. So, by returning short now, the caller will call this function
+ again with new data to send.
+
+- _libssh2_transport_write: updated documentation blurb
+
+- _libssh2_transport_write: remove fprintf remainder
+
+ Mistake from previous debugging
+
+- session: improved errors
+
+ Replaced -1/SOCKET_NONE errors with appropriate error defines instead.
+
+ Made the verbose trace output during banner receiving less annoying for
+ non-blocking sessions.
+
+- crypt_init: use correct error define
+
+- _libssh2_error: hide EAGAIN for non-blocking sessions
+
+ In an attempt to make the trace output less cluttered for non-blocking
+ sessions the error function now avoids calling the debug function if the
+ error is the EAGAIN and the session is non-blocking.
+
+- agent: use better error defines
+
+- comp_method_zlib_init: use correct error defines
+
+- transport: better error codes
+
+ LIBSSH2_SOCKET_NONE (-1) should no longer be used as error code as it is
+ (too) generic and we should instead use specific and dedicated error
+ codes to better describe the error.
+
+- channel: return code and _libssh2_error cleanup
+
+ Made sure that all transport_write() call failures get _libssh2_error
+ called.
+
+- _libssh2_channel_write: limit to 32700 bytes
+
+ The well known and used ssh server Dropbear has a maximum SSH packet
+ length at 32768 by default. Since the libssh2 design current have a
+ fixed one-to-one mapping from channel_write() to the packet size created
+ by transport_write() the previous limit of 32768 in the channel layer
+ caused the transport layer to create larger packets than 32768 at times
+ which Dropbear rejected forcibly (by closing the connection).
+
+ The long term fix is of course to remove the hard relation between the
+ outgoing SSH packet size and what the input length argument is in the
+ transport_write() function call.
+
+- libssh.h: add more dedicated error codes
+
+- SCP: allow file names with bytes > 126
+
+ When parsing the SCP protocol and verifying that the data looks like a
+ valid file name, byte values over 126 must not be consider illegal since
+ UTF-8 file names will use such codes.
+
+ Reported by: Uli Zappe
+ Bug: http://www.libssh2.org/mail/libssh2-devel-archive-2010-08/0112.shtml
+
+Dan Fandrich (25 Aug 2010)
+- Document the three sftp stat constants
+
+Guenter Knauf (18 Aug 2010)
+- Fixed Win32 makefile which was now broken at resource build.
+
+- It is sufficient to pipe stderr to NUL to get rid of the nasty messages.
+
+- [Author: Guenter Knauf brought this change]
+
+ Removed Win32 ifdef completely for sys/uio.h.
+
+ No idea why we had this ifdef at all but MSVC, MingW32, Watcom
+ and Borland all have no sys/uio.h header; so if there's another
+ Win32 compiler which needs it then it should be added explicitely
+ instead of this negative list.
+
+- New files should also be added to Makefile.am.
+
+ Otherwise they will never be included with release and snapshot tarballs ...
+
+Daniel Stenberg (18 Aug 2010)
+- version: bump to 1.2.8_DEV
+
+Version 1.2.7 (17 Aug 2010)
+
+Daniel Stenberg (17 Aug 2010)
+- release: updated to hold 1.2.7 info
+
+Guenter Knauf (17 Aug 2010)
+- Use the new libssh2.rc file.
+
+- Added resource file for libssh2.dll (shamelessly stolen from libcurl).
+
+- Updated Win32 MSVC dependencies versions.
+
+- Added include for sys/select.h to get fd.set on some platforms.
+
+- Added Watcom makefile borrowed from libcurl.
+
+ This makefile compiles already all files fine for static lib, but needs
+ final touch when I have OpenSSL fully working with shared libs and Watcom.
+
+- Added copyright define to libssh2.h and use it for binary builds.
+
+- Moved version defines up in order to include from .rc file.
+
+ Blocked rest of header with ifndef so its possible to let
+ the rc compiler only use the version defines.
+
+- Some minor makefile tweaks.
+
+Daniel Stenberg (2 Aug 2010)
+- example: treat the libssh2_channel_read() return code properly
+
+ A short read is not an error. Only negative values are errors!
+
+- libssh2_wait_socket: reset error code to "leak" EAGAIN less
+
+ Since libssh2 often sets LIBSSH2_ERROR_EAGAIN internally before
+ _libssh2_wait_socket is called, we can decrease some amount of
+ confusion in user programs by resetting the error code in this function
+ to reduce the risk of EAGAIN being stored as error when a blocking
+ function returns.
+
+- _libssh2_wait_socket: poll needs milliseconds
+
+ As reported on the mailing list, the code path using poll() should
+ multiple seconds with 1000 to get milliseconds, not divide!
+
+ Reported by: Jan Van Boghout
+
+- typedef: make ssize_t get typedef without LIBSSH2_WIN32
+
+ The condition around the ssize_t typedef depended on both LIBSSH2_WIN32
+ *and* _MSC_VER being defined when it should be enough to depend on
+ _MSC_VER only. It also makes it nicer so libssh2-using code builds fine
+ without having custom defines.
+
+- [John Little brought this change]
+
+ session_free: free more data to avoid memory leaks
+
+- channel_free: ignore problems with channel_close()
+
+ As was pointed out in bug #182, we must not return failure from
+ _libssh2_channel_free() when _libssh2_channel_close() returns an error
+ that isn't EAGAIN. It can effectively cause the function to never go
+ through, like it did now in the case where the socket was actually
+ closed but socket_state still said LIBSSH2_SOCKET_CONNECTED.
+
+ I consider this fix the right thing as it now also survives other
+ errors, even if making sure socket_state isn't lying is also a good
+ idea.
+
+- publickey_list_free: no return value from a void function
+
+ Fixed a compiler warning I introduced previously when checking input
+ arguments more. I also added a check for the other pointer to avoid NULL
+ pointer dereferences.
+
+- [Lars Nordin brought this change]
+
+ openssl: make use of the EVP interface
+
+ Make use of the EVP interface for the AES-funktion. Using this method
+ supports the use of different ENGINES in OpenSSL for the AES function
+ (and the direct call to the AES_encrypt should not be used according to
+ openssl.org)
+
+Peter Stuge (23 Jun 2010)
+- [Tor Arntsen brought this change]
+
+ Don't overflow MD5 server hostkey
+
+ Use SHA_DIGEST_LENGTH and MD5_DIGEST_LENGTH in memcpy instead of hardcoded
+ values. An incorrect value was used for MD5.
+
+- Fix message length bugs in libssh2_debug()
+
+ There was a buffer overflow waiting to happen when a debug message was
+ longer than 1536 bytes.
+
+ Thanks to Daniel who spotted that there was a problem with the message
+ length passed to a trace handler also after commit
+ 0f0652a3093111fc7dac0205fdcf8d02bf16e89f.
+
+- Make libssh2_debug() create a correctly terminated string
+
+ Also use FILE *stderr rather than fd 2, which can very well be something
+ completely different.
+
+Daniel Stenberg (23 Jun 2010)
+- [TJ Saunders brought this change]
+
+ handshake: Compression enabled at the wrong time
+
+ In KEXINIT messages, the client and server agree on, among other
+ things, whether to use compression. This method agreement occurs
+ in src/kex.c's kex_agree_methods() function. However, if
+ compression is enabled (either client->server, server->client, or
+ both), then the compression layer is initialized in
+ kex_agree_methods() -- before NEWKEYS has been received.
+
+ Instead, the initialization of the compression layer should
+ happen after NEWKEYS has been received. This looks to occur
+ insrc/kex.c's diffie_hellman_sha1(), which even has the comment:
+
+ /* The first key exchange has been performed,
+
+ switch to active crypt/comp/mac mode */
+
+ There, after NEWKEYS is received, the cipher and mac algorithms
+ are initialized, and that is where the compression should be
+ initialized as well.
+
+ The current implementation fails if server->client compression is
+ enabled because most server implementations follow OpenSSH's
+ lead, where compression is initialized after NEWKEYS. Since the
+ server initializes compression after NEWKEYS, but libssh2
+ initializes compression after KEXINIT (i.e. before NEWKEYS), they
+ are out of sync.
+
+ Reported in bug report #180
+
+- [TJ Saunders brought this change]
+
+ userauth_hostbased_fromfile: packet length too short
+
+ The packet length calculated in src/userauth.c's
+ userauth_hostbased_fromfile() function is too short by 4 bytes;
+ it forgets to add four bytes for the length of the hostname.
+ This causes hostbased authentication to fail, since the server
+ will read junk data.
+
+ verified against proftpd's mod_sftp module
+
+- _libssh2_userauth_publickey: reject method names longer than the data
+
+ This functions get the method length by looking at the first 32
+ bit of data, and I now made it not accept method lengths that are
+ longer than the whole data set is, as given in the dedicated
+ function argument.
+
+ This was detected when the function was given bogus public key
+ data as an ascii string, which caused the first 32bits to create
+ a HUGE number.
+
+- NULL resistance: make more public functions survive NULL pointer input
+
+ Sending in NULL as the primary pointer is now dealt with by more
+ public functions. I also narrowed the userauth.c code somewhat to
+ stay within 80 columns better.
+
+- agent: make libssh2_agent_userauth() work blocking properly
+
+ previously it would always work in a non-blocking manner
+
+Peter Stuge (17 Jun 2010)
+- Fix underscore typo for 64-bit printf format specifiers on Windows
+
+ Commit 49ddf447ff4bd80285f926eac0115f4e595f9425 was missing underscores.
+
+Daniel Stenberg (16 Jun 2010)
+- libssh2_session_callback_set: extended the man page
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/README.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/README.txt
new file mode 100644
index 0000000..8a14856
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/README.txt
@@ -0,0 +1,19 @@
+libssh2 - SSH2 library
+======================
+
+libssh2 is a library implementing the SSH2 protocol, available under
+the revised BSD license.
+
+Web site: https://www.libssh2.org/
+
+Mailing list: https://cool.haxx.se/mailman/listinfo/libssh2-devel
+
+License: see COPYING
+
+Source code: https://github.com/libssh2/libssh2
+
+Web site source code: https://github.com/libssh2/www
+
+Installation instructions are in:
+ - docs/INSTALL_CMAKE for CMake
+ - docs/INSTALL_AUTOTOOLS for Autotools
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/RELEASE-NOTES.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/RELEASE-NOTES.txt
new file mode 100644
index 0000000..62064a9
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/RELEASE-NOTES.txt
@@ -0,0 +1,62 @@
+libssh2 1.10
+
+This release includes the following enhancements and bugfixes:
+
+ o adds agent forwarding support
+ o adds OpenSSH Agent support on Windows
+ o adds ECDSA key support using the Mbed TLS backend
+ o adds ECDSA cert authentication
+ o adds diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,
+ diffie-hellman-group18-sha512 key exchanges
+ o adds support for PKIX key reading when using ed25519 with OpenSSL
+ o adds support for EWOULDBLOCK on VMS systems
+ o adds support for building with OpenSSL 3
+ o adds support for using FIPS mode in OpenSSL
+ o adds debug symbols when building with MSVC
+ o adds support for building on the 3DS
+ o adds unicode build support on Windows
+ o restores os400 building
+ o increases min, max and opt Diffie Hellman group values
+ o improves portiablity of the make file
+ o improves timeout behavior with 2FA keyboard auth
+ o various improvements to the Wincng backend
+ o fixes reading parital packet replies when using an agent
+ o fixes Diffie Hellman key exchange on Windows 1903+ builds
+ o fixes building tests with older versions of OpenSSL
+ o fixes possible multiple definition warnings
+ o fixes potential cast issues _libssh2_ecdsa_key_get_curve_type()
+ o fixes potential use after free if libssh2_init() is called twice
+ o improved linking when using Mbed TLS
+ o fixes call to libssh2_crypto_exit() if crypto hasn't been initialized
+ o fixes crash when loading public keys with no id
+ o fixes possible out of bounds read when exchanging keys
+ o fixes possible out of bounds read when reading packets
+ o fixes possible out of bounds read when opening an X11 connection
+ o fixes possible out of bounds read when ecdh host keys
+ o fixes possible hang when trying to read a disconnected socket
+ o fixes a crash when using the delayed compression option
+ o fixes read error with large known host entries
+ o fixes various warnings
+ o fixes various small memory leaks
+ o improved error handling, various detailed errors will now be reported
+ o builds are now using OSS-Fuzz
+ o builds now use autoreconf instead of a custom build script
+ o cmake now respects install directory
+ o improved CI backend
+ o updated HACKING-CRYPTO documentation
+ o use markdown file extensions
+ o improved unit tests
+
+This release would not have looked like this without help, code, reports and
+advice from friends like these:
+
+ katzer, Orgad Shaneh, mark-i-m, Zenju, axjowa, Thilo Schulz,
+ Etienne Samson, hlefebvre, seba30, Panos, jethrogb, Fabrice Fontaine,
+ Will Cosgrove, Daniel Stenberg, Michael Buckley, Wallace Souza Silva,
+ Romain-Geissler-1A, meierha, Tseng Jun, Thomas Klausner, Brendan Shanks,
+ Harry Sintonen, monnerat, Koutheir Attouchi, Marc Hörsken, yann-morin-1998,
+ Wez Furlong, TDi-jonesds, David Benjamin, Max Dymond, Igor Klevanets,
+ Viktor Szakats, Laurent Stacul, Mstrodl, Gabriel Smith, MarcT512,
+ Paul Capron, teottin, Tor Erik Ottinsen, Brian Inglis
+
+ (40 contributors)
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/AUTHORS.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/AUTHORS.txt
new file mode 100644
index 0000000..5c7445b
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/AUTHORS.txt
@@ -0,0 +1,79 @@
+ libssh2 is the result of many friendly people. This list is an attempt to
+ mention all contributors. If we've missed anyone, tell us!
+
+ This list of names is a-z sorted.
+
+Adam Gobiowski
+Alexander Holyapin
+Alexander Lamaison
+Alfred Gebert
+Ben Kibbey
+Bjorn Stenborg
+Carlo Bramini
+Cristian Rodríguez
+Daiki Ueno
+Dan Casey
+Dan Fandrich
+Daniel Stenberg
+Dave Hayden
+Dave McCaldon
+David J Sullivan
+David Robins
+Dmitry Smirnov
+Douglas Masterson
+Edink Kadribasic
+Erik Brossler
+Francois Dupoux
+Gellule Xg
+Grubsky Grigory
+Guenter Knauf
+Heiner Steven
+Henrik Nordstrom
+James Housleys
+Jasmeet Bagga
+Jean-Louis Charton
+Jernej Kovacic
+Joey Degges
+John Little
+Jose Baars
+Jussi Mononen
+Kamil Dudka
+Lars Nordin
+Mark McPherson
+Mark Smith
+Markus Moeller
+Matt Lilley
+Matthew Booth
+Maxime Larocque
+Mike Protts
+Mikhail Gusarov
+Neil Gierman
+Olivier Hervieu
+Paul Howarth
+Paul Querna
+Paul Veldkamp
+Peter Krempa
+Peter O'Gorman
+Peter Stuge
+Pierre Joye
+Rafael Kitover
+Romain Bondue
+Sara Golemon
+Satish Mittal
+Sean Peterson
+Selcuk Gueney
+Simon Hart
+Simon Josefsson
+Sofian Brabez
+Steven Ayre
+Steven Dake
+Steven Van Ingelgem
+TJ Saunders
+Tommy Lindgren
+Tor Arntsen
+Vincent Jaulin
+Vincent Torri
+Vlad Grachov
+Wez Furlong
+Yang Tse
+Zl Liu
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/BINDINGS.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/BINDINGS.txt
new file mode 100644
index 0000000..471f9be
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/BINDINGS.txt
@@ -0,0 +1,29 @@
+
+Creative people have written bindings or interfaces for various environments
+and programming languages. Using one of these bindings allows you to take
+advantage of libssh2 directly from within your favourite language.
+
+The bindings listed below are not part of the libssh2 distribution archives,
+but must be downloaded and installed separately.
+
+Cocoa/Objective-C
+ https://github.com/karelia/libssh2_sftp-Cocoa-wrapper
+
+Haskell
+ FFI bindings - https://hackage.haskell.org/package/libssh2
+
+Perl
+ Net::SSH2 - https://metacpan.org/pod/Net::SSH2
+
+PHP
+ ssh2 - https://pecl.php.net/package/ssh2
+
+Python
+ pylibssh2 - https://pypi.python.org/pypi/pylibssh2
+
+Python-ctypes
+
+ PySsh2 - https://github.com/gellule/PySsh2
+
+Ruby
+ libssh2-ruby - https://github.com/mitchellh/libssh2-ruby
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/HACKING-CRYPTO.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/HACKING-CRYPTO.txt
new file mode 100644
index 0000000..ca94772
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/HACKING-CRYPTO.txt
@@ -0,0 +1,902 @@
+ Definitions needed to implement a specific crypto library
+
+This document offers some hints about implementing a new crypto library
+interface.
+
+A crypto library interface consists of at least a header file, defining
+entities referenced from the libssh2 core modules.
+Real code implementation (if needed), is left at the implementor's choice.
+
+This document lists the entities that must/may be defined in the header file.
+
+Procedures listed as "void" may indeed have a result type: the void indication
+indicates the libssh2 core modules never use the function result.
+
+
+0) Build system.
+
+Adding a crypto backend to the autotools build system (./configure) is easy:
+
+0.1) Add one new line in configure.ac
+
+m4_set_add([crypto_backends], [newname])
+
+This automatically creates a --with-crypto=newname option.
+
+0.2) Add an m4_case stanza to LIBSSH2_CRYPTO_CHECK in acinclude.m4
+
+This must check for all required libraries, and if found set and AC_SUBST a
+variable with the library linking flags. The recommended method is to use
+LIBSSH2_LIB_HAVE_LINKFLAGS from LIBSSH2_CRYPTO_CHECK, which automatically
+creates and handles a --with-$newname-prefix option and sets an
+LTLIBNEWNAME variable on success.
+
+0.3) Create Makefile.newname.inc in the top-level directory
+
+This must set CRYPTO_CSOURCES, CRYPTO_HHEADERS and CRYPTO_LTLIBS.
+Set CRYPTO_CSOURCES and CRYPTO_HHEADERS to the new backend source files
+and set CRYPTO_LTLIBS to the required library linking parameters, e.g.
+$(LTLIBNEWNAME) as generated by by LIBSSH2_LIB_HAVE_LINKFLAGS.
+
+0.4) Add a new block in src/Makefile.am
+
+if NEWNAME
+include ../Makefile.newname.inc
+endif
+
+
+1) Crypto library initialization/termination.
+
+void libssh2_crypto_init(void);
+Initializes the crypto library. May be an empty macro if not needed.
+
+void libssh2_crypto_exit(void);
+Terminates the crypto library use. May be an empty macro if not needed.
+
+
+2) HMAC
+
+libssh2_hmac_ctx
+Type of an HMAC computation context. Generally a struct.
+Used for all hash algorithms.
+
+void libssh2_hmac_ctx_init(libssh2_hmac_ctx ctx);
+Initializes the HMAC computation context ctx.
+Called before setting-up the hash algorithm.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_hmac_update(libssh2_hmac_ctx ctx,
+ const unsigned char *data,
+ int datalen);
+Continue computation of an HMAC on datalen bytes at data using context ctx.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_hmac_final(libssh2_hmac_ctx ctx,
+ unsigned char output[]);
+Get the computed HMAC from context ctx into the output buffer. The
+minimum data buffer size depends on the HMAC hash algorithm.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_hmac_cleanup(libssh2_hmac_ctx *ctx);
+Releases the HMAC computation context at ctx.
+
+
+3) Hash algorithms.
+
+3.1) SHA-1
+Must always be implemented.
+
+SHA_DIGEST_LENGTH
+#define to 20, the SHA-1 digest length.
+
+libssh2_sha1_ctx
+Type of an SHA-1 computation context. Generally a struct.
+
+int libssh2_sha1_init(libssh2_sha1_ctx *x);
+Initializes the SHA-1 computation context at x.
+Returns 1 for success and 0 for failure
+
+void libssh2_sha1_update(libssh2_sha1_ctx ctx,
+ const unsigned char *data,
+ size_t len);
+Continue computation of SHA-1 on len bytes at data using context ctx.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_sha1_final(libssh2_sha1_ctx ctx,
+ unsigned char output[SHA_DIGEST_LEN]);
+Get the computed SHA-1 signature from context ctx and store it into the
+output buffer.
+Release the context.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_hmac_sha1_init(libssh2_hmac_ctx *ctx,
+ const void *key,
+ int keylen);
+Setup the HMAC computation context ctx for an HMAC-SHA-1 computation using the
+keylen-byte key. Is invoked just after libssh2_hmac_ctx_init().
+
+3.2) SHA-256
+Must always be implemented.
+
+SHA256_DIGEST_LENGTH
+#define to 32, the SHA-256 digest length.
+
+libssh2_sha256_ctx
+Type of an SHA-256 computation context. Generally a struct.
+
+int libssh2_sha256_init(libssh2_sha256_ctx *x);
+Initializes the SHA-256 computation context at x.
+Returns 1 for success and 0 for failure
+
+void libssh2_sha256_update(libssh2_sha256_ctx ctx,
+ const unsigned char *data,
+ size_t len);
+Continue computation of SHA-256 on len bytes at data using context ctx.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_sha256_final(libssh2_sha256_ctx ctx,
+ unsigned char output[SHA256_DIGEST_LENGTH]);
+Gets the computed SHA-256 signature from context ctx into the output buffer.
+Release the context.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+int libssh2_sha256(const unsigned char *message,
+ unsigned long len,
+ unsigned char output[SHA256_DIGEST_LENGTH]);
+Computes the SHA-256 signature over the given message of length len and
+store the result into the output buffer.
+Return 1 if error, else 0.
+Note: Seems unused in current code, but defined in each crypto library backend.
+
+LIBSSH2_HMAC_SHA256
+#define as 1 if the crypto library supports HMAC-SHA-256, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+void libssh2_hmac_sha256_init(libssh2_hmac_ctx *ctx,
+ const void *key,
+ int keylen);
+Setup the HMAC computation context ctx for an HMAC-256 computation using the
+keylen-byte key. Is invoked just after libssh2_hmac_ctx_init().
+
+3.3) SHA-384
+Mandatory if ECDSA is implemented. Can be omitted otherwise.
+
+SHA384_DIGEST_LENGTH
+#define to 48, the SHA-384 digest length.
+
+libssh2_sha384_ctx
+Type of an SHA-384 computation context. Generally a struct.
+
+int libssh2_sha384_init(libssh2_sha384_ctx *x);
+Initializes the SHA-384 computation context at x.
+Returns 1 for success and 0 for failure
+
+void libssh2_sha384_update(libssh2_sha384_ctx ctx,
+ const unsigned char *data,
+ size_t len);
+Continue computation of SHA-384 on len bytes at data using context ctx.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_sha384_final(libssh2_sha384_ctx ctx,
+ unsigned char output[SHA384_DIGEST_LENGTH]);
+Gets the computed SHA-384 signature from context ctx into the output buffer.
+Release the context.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+int libssh2_sha384(const unsigned char *message,
+ unsigned long len,
+ unsigned char output[SHA384_DIGEST_LENGTH]);
+Computes the SHA-384 signature over the given message of length len and
+store the result into the output buffer.
+Return 1 if error, else 0.
+
+3.4) SHA-512
+Must always be implemented.
+
+SHA512_DIGEST_LENGTH
+#define to 64, the SHA-512 digest length.
+
+libssh2_sha512_ctx
+Type of an SHA-512 computation context. Generally a struct.
+
+int libssh2_sha512_init(libssh2_sha512_ctx *x);
+Initializes the SHA-512 computation context at x.
+Returns 1 for success and 0 for failure
+
+void libssh2_sha512_update(libssh2_sha512_ctx ctx,
+ const unsigned char *data,
+ size_t len);
+Continue computation of SHA-512 on len bytes at data using context ctx.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_sha512_final(libssh2_sha512_ctx ctx,
+ unsigned char output[SHA512_DIGEST_LENGTH]);
+Gets the computed SHA-512 signature from context ctx into the output buffer.
+Release the context.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+int libssh2_sha512(const unsigned char *message,
+ unsigned long len,
+ unsigned char output[SHA512_DIGEST_LENGTH]);
+Computes the SHA-512 signature over the given message of length len and
+store the result into the output buffer.
+Return 1 if error, else 0.
+Note: Seems unused in current code, but defined in each crypto library backend.
+
+LIBSSH2_HMAC_SHA512
+#define as 1 if the crypto library supports HMAC-SHA-512, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+void libssh2_hmac_sha512_init(libssh2_hmac_ctx *ctx,
+ const void *key,
+ int keylen);
+Setup the HMAC computation context ctx for an HMAC-512 computation using the
+keylen-byte key. Is invoked just after libssh2_hmac_ctx_init().
+
+3.5) MD5
+LIBSSH2_MD5
+#define to 1 if the crypto library supports MD5, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+MD5_DIGEST_LENGTH
+#define to 16, the MD5 digest length.
+
+libssh2_md5_ctx
+Type of an MD5 computation context. Generally a struct.
+
+int libssh2_md5_init(libssh2_md5_ctx *x);
+Initializes the MD5 computation context at x.
+Returns 1 for success and 0 for failure
+
+void libssh2_md5_update(libssh2_md5_ctx ctx,
+ const unsigned char *data,
+ size_t len);
+Continues computation of MD5 on len bytes at data using context ctx.
+Returns 1 for success and 0 for failure.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_md5_final(libssh2_md5_ctx ctx,
+ unsigned char output[MD5_DIGEST_LENGTH]);
+Gets the computed MD5 signature from context ctx into the output buffer.
+Release the context.
+Note: if the ctx parameter is modified by the underlying code,
+this procedure must be implemented as a macro to map ctx --> &ctx.
+
+void libssh2_hmac_md5_init(libssh2_hmac_ctx *ctx,
+ const void *key,
+ int keylen);
+Setup the HMAC computation context ctx for an HMAC-MD5 computation using the
+keylen-byte key. Is invoked just after libssh2_hmac_ctx_init().
+
+3.6) RIPEMD-160
+LIBSSH2_HMAC_RIPEMD
+#define as 1 if the crypto library supports HMAC-RIPEMD-160, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+void libssh2_hmac_ripemd160_init(libssh2_hmac_ctx *ctx,
+ const void *key,
+ int keylen);
+Setup the HMAC computation context ctx for an HMAC-RIPEMD-160 computation using
+the keylen-byte key. Is invoked just after libssh2_hmac_ctx_init().
+Returns 1 for success and 0 for failure.
+
+
+4) Bidirectional key ciphers.
+
+_libssh2_cipher_ctx
+Type of a cipher computation context.
+
+_libssh2_cipher_type(name);
+Macro defining name as storage identifying a cipher algorithm for
+the crypto library interface. No trailing semicolon.
+
+int _libssh2_cipher_init(_libssh2_cipher_ctx *h,
+ _libssh2_cipher_type(algo),
+ unsigned char *iv,
+ unsigned char *secret,
+ int encrypt);
+Creates a cipher context for the given algorithm with the initialization vector
+iv and the secret key secret. Prepare for encryption or decryption depending on
+encrypt.
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_cipher_crypt(_libssh2_cipher_ctx *ctx,
+ _libssh2_cipher_type(algo),
+ int encrypt,
+ unsigned char *block,
+ size_t blocksize);
+Encrypt or decrypt in-place data at (block, blocksize) using the given
+context and/or algorithm.
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+void _libssh2_cipher_dtor(_libssh2_cipher_ctx *ctx);
+Release cipher context at ctx.
+
+4.1) AES
+4.1.1) AES in CBC block mode.
+LIBSSH2_AES
+#define as 1 if the crypto library supports AES in CBC mode, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+_libssh2_cipher_aes128
+AES-128-CBC algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+_libssh2_cipher_aes192
+AES-192-CBC algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+_libssh2_cipher_aes256
+AES-256-CBC algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+4.1.2) AES in CTR block mode.
+LIBSSH2_AES_CTR
+#define as 1 if the crypto library supports AES in CTR mode, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+_libssh2_cipher_aes128ctr
+AES-128-CTR algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+_libssh2_cipher_aes192ctr
+AES-192-CTR algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+_libssh2_cipher_aes256ctr
+AES-256-CTR algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+4.2) Blowfish in CBC block mode.
+LIBSSH2_BLOWFISH
+#define as 1 if the crypto library supports blowfish in CBC mode, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+_libssh2_cipher_blowfish
+Blowfish-CBC algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+4.3) RC4.
+LIBSSH2_RC4
+#define as 1 if the crypto library supports RC4 (arcfour), else 0.
+If defined as 0, the rest of this section can be omitted.
+
+_libssh2_cipher_arcfour
+RC4 algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+4.4) CAST5 in CBC block mode.
+LIBSSH2_CAST
+#define 1 if the crypto library supports cast, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+_libssh2_cipher_cast5
+CAST5-CBC algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+4.5) Tripple DES in CBC block mode.
+LIBSSH2_3DES
+#define as 1 if the crypto library supports TripleDES in CBC mode, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+_libssh2_cipher_3des
+TripleDES-CBC algorithm identifier initializer.
+#define with constant value of type _libssh2_cipher_type().
+
+
+5) Diffie-Hellman support.
+
+5.1) Diffie-Hellman context.
+_libssh2_dh_ctx
+Type of a Diffie-Hellman computation context.
+Must always be defined.
+
+5.2) Diffie-Hellman computation procedures.
+void libssh2_dh_init(_libssh2_dh_ctx *dhctx);
+Initializes the Diffie-Hellman context at `dhctx'. No effective context
+creation needed here.
+
+int libssh2_dh_key_pair(_libssh2_dh_ctx *dhctx, _libssh2_bn *public,
+ _libssh2_bn *g, _libssh2_bn *p, int group_order,
+ _libssh2_bn_ctx *bnctx);
+Generates a Diffie-Hellman key pair using base `g', prime `p' and the given
+`group_order'. Can use the given big number context `bnctx' if needed.
+The private key is stored as opaque in the Diffie-Hellman context `*dhctx' and
+the public key is returned in `public'.
+0 is returned upon success, else -1.
+
+int libssh2_dh_secret(_libssh2_dh_ctx *dhctx, _libssh2_bn *secret,
+ _libssh2_bn *f, _libssh2_bn *p, _libssh2_bn_ctx * bnctx)
+Computes the Diffie-Hellman secret from the previously created context `*dhctx',
+the public key `f' from the other party and the same prime `p' used at
+context creation. The result is stored in `secret'.
+0 is returned upon success, else -1.
+
+void libssh2_dh_dtor(_libssh2_dh_ctx *dhctx)
+Destroys Diffie-Hellman context at `dhctx' and resets its storage.
+
+
+6) Big numbers.
+Positive multi-byte integers support is sufficient.
+
+6.1) Computation contexts.
+This has a real meaning if the big numbers computations need some context
+storage. If not, use a dummy type and functions (macros).
+
+_libssh2_bn_ctx
+Type of multiple precision computation context. May not be empty. if not used,
+#define as char, for example.
+
+_libssh2_bn_ctx _libssh2_bn_ctx_new(void);
+Returns a new multiple precision computation context.
+
+void _libssh2_bn_ctx_free(_libssh2_bn_ctx ctx);
+Releases a multiple precision computation context.
+
+6.2) Computation support.
+_libssh2_bn
+Type of multiple precision numbers (aka bignumbers or huge integers) for the
+crypto library.
+
+_libssh2_bn * _libssh2_bn_init(void);
+Creates a multiple precision number (preset to zero).
+
+_libssh2_bn * _libssh2_bn_init_from_bin(void);
+Create a multiple precision number intended to be set by the
+_libssh2_bn_from_bin() function (see below). Unlike _libssh2_bn_init(), this
+code may be a dummy initializer if the _libssh2_bn_from_bin() actually
+allocates the number. Returns a value of type _libssh2_bn *.
+
+void _libssh2_bn_free(_libssh2_bn *bn);
+Destroys the multiple precision number at bn.
+
+unsigned long _libssh2_bn_bytes(_libssh2_bn *bn);
+Get the number of bytes needed to store the bits of the multiple precision
+number at bn.
+
+unsigned long _libssh2_bn_bits(_libssh2_bn *bn);
+Returns the number of bits of multiple precision number at bn.
+
+int _libssh2_bn_set_word(_libssh2_bn *bn, unsigned long val);
+Sets the value of bn to val.
+Returns 1 on success, 0 otherwise.
+
+_libssh2_bn * _libssh2_bn_from_bin(_libssh2_bn *bn, int len,
+ const unsigned char *val);
+Converts the positive integer in big-endian form of length len at val
+into a _libssh2_bn and place it in bn. If bn is NULL, a new _libssh2_bn is
+created.
+Returns a pointer to target _libssh2_bn or NULL if error.
+
+int _libssh2_bn_to_bin(_libssh2_bn *bn, unsigned char *val);
+Converts the absolute value of bn into big-endian form and store it at
+val. val must point to _libssh2_bn_bytes(bn) bytes of memory.
+Returns the length of the big-endian number.
+
+
+7) Private key algorithms.
+Format of an RSA public key:
+a) "ssh-rsa".
+b) RSA exponent, MSB first, with high order bit = 0.
+c) RSA modulus, MSB first, with high order bit = 0.
+Each item is preceded by its 32-bit byte length, MSB first.
+
+Format of a DSA public key:
+a) "ssh-dss".
+b) p, MSB first, with high order bit = 0.
+c) q, MSB first, with high order bit = 0.
+d) g, MSB first, with high order bit = 0.
+e) pub_key, MSB first, with high order bit = 0.
+Each item is preceded by its 32-bit byte length, MSB first.
+
+Format of an ECDSA public key:
+a) "ecdsa-sha2-nistp256" or "ecdsa-sha2-nistp384" or "ecdsa-sha2-nistp521".
+b) domain: "nistp256", "nistp384" or "nistp521" matching a).
+c) raw public key ("octal").
+Each item is preceded by its 32-bit byte length, MSB first.
+
+Format of an ED25519 public key:
+a) "ssh-ed25519".
+b) raw key (32 bytes).
+Each item is preceded by its 32-bit byte length, MSB first.
+
+int _libssh2_pub_priv_keyfile(LIBSSH2_SESSION *session,
+ unsigned char **method,
+ size_t *method_len,
+ unsigned char **pubkeydata,
+ size_t *pubkeydata_len,
+ const char *privatekey,
+ const char *passphrase);
+Reads a private key from file privatekey and extract the public key -->
+(pubkeydata, pubkeydata_len). Store the associated method (ssh-rsa or ssh-dss)
+into (method, method_len).
+Both buffers have to be allocated using LIBSSH2_ALLOC().
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_pub_priv_keyfilememory(LIBSSH2_SESSION *session,
+ unsigned char **method,
+ size_t *method_len,
+ unsigned char **pubkeydata,
+ size_t *pubkeydata_len,
+ const char *privatekeydata,
+ size_t privatekeydata_len,
+ const char *passphrase);
+Gets a private key from bytes at (privatekeydata, privatekeydata_len) and
+extract the public key --> (pubkeydata, pubkeydata_len). Store the associated
+method (ssh-rsa or ssh-dss) into (method, method_len).
+Both buffers have to be allocated using LIBSSH2_ALLOC().
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+
+7.1) RSA
+LIBSSH2_RSA
+#define as 1 if the crypto library supports RSA, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+libssh2_rsa_ctx
+Type of an RSA computation context. Generally a struct.
+
+int _libssh2_rsa_new(libssh2_rsa_ctx **rsa,
+ const unsigned char *edata,
+ unsigned long elen,
+ const unsigned char *ndata,
+ unsigned long nlen,
+ const unsigned char *ddata,
+ unsigned long dlen,
+ const unsigned char *pdata,
+ unsigned long plen,
+ const unsigned char *qdata,
+ unsigned long qlen,
+ const unsigned char *e1data,
+ unsigned long e1len,
+ const unsigned char *e2data,
+ unsigned long e2len,
+ const unsigned char *coeffdata, unsigned long coefflen);
+Creates a new context for RSA computations from key source values:
+ pdata, plen Prime number p. Only used if private key known (ddata).
+ qdata, qlen Prime number q. Only used if private key known (ddata).
+ ndata, nlen Modulus n.
+ edata, elen Exponent e.
+ ddata, dlen e^-1 % phi(n) = private key. May be NULL if unknown.
+ e1data, e1len dp = d % (p-1). Only used if private key known (dtata).
+ e2data, e2len dq = d % (q-1). Only used if private key known (dtata).
+ coeffdata, coefflen q^-1 % p. Only used if private key known.
+Returns 0 if OK.
+This procedure is already prototyped in crypto.h.
+Note: the current generic code only calls this function with e and n (public
+key parameters): unless used internally by the backend, it is not needed to
+support the private key and the other parameters here.
+
+int _libssh2_rsa_new_private(libssh2_rsa_ctx **rsa,
+ LIBSSH2_SESSION *session,
+ const char *filename,
+ unsigned const char *passphrase);
+Reads an RSA private key from file filename into a new RSA context.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_rsa_new_private_frommemory(libssh2_rsa_ctx **rsa,
+ LIBSSH2_SESSION *session,
+ const char *data,
+ size_t data_len,
+ unsigned const char *passphrase);
+Gets an RSA private key from data into a new RSA context.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_rsa_sha1_verify(libssh2_rsa_ctx *rsa,
+ const unsigned char *sig,
+ unsigned long sig_len,
+ const unsigned char *m, unsigned long m_len);
+Verify (sig, sig_len) signature of (m, m_len) using an SHA-1 hash and the
+RSA context.
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_rsa_sha1_signv(LIBSSH2_SESSION *session,
+ unsigned char **sig, size_t *siglen,
+ int count, const struct iovec vector[],
+ libssh2_rsa_ctx *ctx);
+RSA signs the SHA-1 hash computed over the count data chunks in vector.
+Signature is stored at (sig, siglen).
+Signature buffer must be allocated from the given session.
+Returns 0 if OK, else -1.
+Note: this procedure is optional: if provided, it MUST be defined as a macro.
+
+int _libssh2_rsa_sha1_sign(LIBSSH2_SESSION *session,
+ libssh2_rsa_ctx *rsactx,
+ const unsigned char *hash,
+ size_t hash_len,
+ unsigned char **signature,
+ size_t *signature_len);
+RSA signs the (hash, hashlen) SHA-1 hash bytes and stores the allocated
+signature at (signature, signature_len).
+Signature buffer must be allocated from the given session.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+Note: this procedure is not used if macro _libssh2_rsa_sha1_signv() is defined.
+
+void _libssh2_rsa_free(libssh2_rsa_ctx *rsactx);
+Releases the RSA computation context at rsactx.
+
+
+7.2) DSA
+LIBSSH2_DSA
+#define as 1 if the crypto library supports DSA, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+
+libssh2_dsa_ctx
+Type of a DSA computation context. Generally a struct.
+
+int _libssh2_dsa_new(libssh2_dsa_ctx **dsa,
+ const unsigned char *pdata,
+ unsigned long plen,
+ const unsigned char *qdata,
+ unsigned long qlen,
+ const unsigned char *gdata,
+ unsigned long glen,
+ const unsigned char *ydata,
+ unsigned long ylen,
+ const unsigned char *x, unsigned long x_len);
+Creates a new context for DSA computations from source key values:
+ pdata, plen Prime number p. Only used if private key known (ddata).
+ qdata, qlen Prime number q. Only used if private key known (ddata).
+ gdata, glen G number.
+ ydata, ylen Public key.
+ xdata, xlen Private key. Only taken if xlen non-zero.
+Returns 0 if OK.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_dsa_new_private(libssh2_dsa_ctx **dsa,
+ LIBSSH2_SESSION *session,
+ const char *filename,
+ unsigned const char *passphrase);
+Gets a DSA private key from file filename into a new DSA context.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_dsa_new_private_frommemory(libssh2_dsa_ctx **dsa,
+ LIBSSH2_SESSION *session,
+ const char *data,
+ size_t data_len,
+ unsigned const char *passphrase);
+Gets a DSA private key from the data_len-bytes data into a new DSA context.
+Must call _libssh2_init_if_needed().
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_dsa_sha1_verify(libssh2_dsa_ctx *dsactx,
+ const unsigned char *sig,
+ const unsigned char *m, unsigned long m_len);
+Verify (sig, siglen) signature of (m, m_len) using an SHA-1 hash and the
+DSA context.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_dsa_sha1_sign(libssh2_dsa_ctx *dsactx,
+ const unsigned char *hash,
+ unsigned long hash_len, unsigned char *sig);
+DSA signs the (hash, hash_len) data using SHA-1 and store the signature at sig.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+void _libssh2_dsa_free(libssh2_dsa_ctx *dsactx);
+Releases the DSA computation context at dsactx.
+
+
+7.3) ECDSA
+LIBSSH2_ECDSA
+#define as 1 if the crypto library supports ECDSA, else 0.
+If defined as 0, _libssh2_ec_key should be defined as void and the rest of
+this section can be omitted.
+
+EC_MAX_POINT_LEN
+Maximum point length. Usually defined as ((528 * 2 / 8) + 1) (= 133).
+
+libssh2_ecdsa_ctx
+Type of an ECDSA computation context. Generally a struct.
+
+_libssh2_ec_key
+Type of an elliptic curve key.
+
+libssh2_curve_type
+An enum type defining curve types. Current supported identifiers are:
+ LIBSSH2_EC_CURVE_NISTP256
+ LIBSSH2_EC_CURVE_NISTP384
+ LIBSSH2_EC_CURVE_NISTP521
+
+int _libssh2_ecdsa_create_key(_libssh2_ec_key **out_private_key,
+ unsigned char **out_public_key_octal,
+ size_t *out_public_key_octal_len,
+ libssh2_curve_type curve_type);
+Create a new ECDSA private key of type curve_type and return it at
+out_private_key. If out_public_key_octal is not NULL, store an allocated
+pointer to the associated public key in "octal" form in it and its length
+at out_public_key_octal_len.
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_new_private(libssh2_ecdsa_ctx **ec_ctx,
+ LIBSSH2_SESSION * session,
+ const char *filename,
+ unsigned const char *passphrase);
+Reads an ECDSA private key from PEM file filename into a new ECDSA context.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_new_private_frommemory(libssh2_ecdsa_ctx ** ec_ctx,
+ LIBSSH2_SESSION * session,
+ const char *filedata,
+ size_t filedata_len,
+ unsigned const char *passphrase);
+Builds an ECDSA private key from PEM data at filedata of length filedata_len
+into a new ECDSA context stored at ec_ctx.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_curve_name_with_octal_new(libssh2_ecdsa_ctx **ecdsactx,
+ const unsigned char *k,
+ size_t k_len,
+ libssh2_curve_type type);
+Stores at ecdsactx a new ECDSA context associated with the given curve type
+and with "octal" form public key (k, k_len).
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_new_openssh_private(libssh2_ecdsa_ctx **ec_ctx,
+ LIBSSH2_SESSION * session,
+ const char *filename,
+ unsigned const char *passphrase);
+Reads a PEM-encoded ECDSA private key from file filename encrypted with
+passphrase and stores at ec_ctx a new ECDSA context for it.
+Return 0 if OK, else -1.
+Currently used only from openssl backend (ought to be private).
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_sign(LIBSSH2_SESSION *session, libssh2_ecdsa_ctx *ec_ctx,
+ const unsigned char *hash, unsigned long hash_len,
+ unsigned char **signature, size_t *signature_len);
+ECDSA signs the (hash, hashlen) hash bytes and stores the allocated
+signature at (signature, signature_len). Hash algorithm used should be
+SHA-256, SHA-384 or SHA-512 depending on type stored in ECDSA context at ec_ctx.
+Signature buffer must be allocated from the given session.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_verify(libssh2_ecdsa_ctx *ctx,
+ const unsigned char *r, size_t r_len,
+ const unsigned char *s, size_t s_len,
+ const unsigned char *m, size_t m_len);
+Verify the ECDSA signature made of (r, r_len) and (s, s_len) of (m, m_len)
+using the hash algorithm configured in the ECDSA context ctx.
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+libssh2_curve_type _libssh2_ecdsa_get_curve_type(libssh2_ecdsa_ctx *ecdsactx);
+Returns the curve type associated with given context.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ecdsa_curve_type_from_name(const char *name,
+ libssh2_curve_type *out_type);
+Stores in out_type the curve type matching string name of the form
+"ecdsa-sha2-nistpxxx".
+Return 0 if OK, else -1.
+Currently used only from openssl backend (ought to be private).
+This procedure is already prototyped in crypto.h.
+
+void _libssh2_ecdsa_free(libssh2_ecdsa_ctx *ecdsactx);
+Releases the ECDSA computation context at ecdsactx.
+
+
+7.4) ED25519
+LIBSSH2_ED25519
+#define as 1 if the crypto library supports ED25519, else 0.
+If defined as 0, the rest of this section can be omitted.
+
+
+libssh2_ed25519_ctx
+Type of an ED25519 computation context. Generally a struct.
+
+int _libssh2_curve25519_new(LIBSSH2_SESSION *session, libssh2_ed25519_ctx **ctx,
+ uint8_t **out_public_key,
+ uint8_t **out_private_key);
+Generates an ED25519 key pair, stores a pointer to them at out_private_key
+and out_public_key respectively and stores at ctx a new ED25519 context for
+this key.
+Argument ctx, out_private_key and out_public key may be NULL to disable storing
+the corresponding value.
+Length of each key is LIBSSH2_ED25519_KEY_LEN (32 bytes).
+Key buffers are allocated and should be released by caller after use.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ed25519_new_private(libssh2_ed25519_ctx **ed_ctx,
+ LIBSSH2_SESSION *session,
+ const char *filename,
+ const uint8_t *passphrase);
+Reads an ED25519 private key from PEM file filename into a new ED25519 context.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ed25519_new_public(libssh2_ed25519_ctx **ed_ctx,
+ LIBSSH2_SESSION *session,
+ const unsigned char *raw_pub_key,
+ const uint8_t key_len);
+Stores at ed_ctx a new ED25519 key context for raw public key (raw_pub_key,
+key_len).
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ed25519_new_private_frommemory(libssh2_ed25519_ctx **ed_ctx,
+ LIBSSH2_SESSION *session,
+ const char *filedata,
+ size_t filedata_len,
+ unsigned const char *passphrase);
+Builds an ED25519 private key from PEM data at filedata of length filedata_len
+into a new ED25519 context stored at ed_ctx.
+Must call _libssh2_init_if_needed().
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ed25519_sign(libssh2_ed25519_ctx *ctx, LIBSSH2_SESSION *session,
+ uint8_t **out_sig, size_t *out_sig_len,
+ const uint8_t *message, size_t message_len);
+ED25519 signs the (message, message_len) bytes and stores the allocated
+signature at (sig, sig_len).
+Signature buffer is allocated from the given session.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_ed25519_verify(libssh2_ed25519_ctx *ctx, const uint8_t *s,
+ size_t s_len, const uint8_t *m, size_t m_len);
+Verify (s, s_len) signature of (m, m_len) using the given ED25519 context.
+Return 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+int _libssh2_curve25519_gen_k(_libssh2_bn **k,
+ uint8_t private_key[LIBSSH2_ED25519_KEY_LEN],
+ uint8_t srvr_public_key[LIBSSH2_ED25519_KEY_LEN]);
+Computes a shared ED25519 secret key from the given raw server public key and
+raw client public key and stores it as a big number in *k. Big number should
+have been initialized before calling this function.
+Returns 0 if OK, else -1.
+This procedure is already prototyped in crypto.h.
+
+void _libssh2_ed25519_free(libssh2_ed25519_ctx *ed25519ctx);
+Releases the ED25519 computation context at ed25519ctx.
+
+
+8) Miscellaneous
+
+void libssh2_prepare_iovec(struct iovec *vector, unsigned int len);
+Prepare len consecutive iovec slots before using them.
+In example, this is needed to preset unused structure slacks on platforms
+requiring it.
+If this is not needed, it should be defined as an empty macro.
+
+int _libssh2_random(unsigned char *buf, int len);
+Store len random bytes at buf.
+Returns 0 if OK, else -1.
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/HACKING.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/HACKING.txt
new file mode 100644
index 0000000..5da8e66
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/HACKING.txt
@@ -0,0 +1,13 @@
+
+libssh2 source code style guide:
+
+ - 4 level indent
+ - spaces-only (no tabs)
+ - open braces on the if/for line:
+
+ if (banana) {
+ go_nuts();
+ }
+
+ - keep source lines shorter than 80 columns
+ - See libssh2-style.el for how to achieve this within Emacs
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt
new file mode 100644
index 0000000..a75b518
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/INSTALL_AUTOTOOLS.txt
@@ -0,0 +1,355 @@
+Installation Instructions
+*************************
+
+Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005 Free
+Software Foundation, Inc.
+
+This file is free documentation; the Free Software Foundation gives
+unlimited permission to copy, distribute and modify it.
+
+When Building directly from Master
+==================================
+
+If you want to build directly from the git repository, you must first
+generate the configure script and Makefile using autotools. There is
+a convenience script that calls all tools in the correct order. Make
+sure that autoconf, automake and libtool are installed on your system,
+then execute:
+
+ autoreconf -fi
+
+After executing this script, you can build the project as usual:
+
+ ./configure
+ make
+
+Basic Installation
+==================
+
+These are generic installation instructions.
+
+ The `configure' shell script attempts to guess correct values for
+various system-dependent variables used during compilation. It uses
+those values to create a `Makefile' in each directory of the package.
+It may also create one or more `.h' files containing system-dependent
+definitions. Finally, it creates a shell script `config.status' that
+you can run in the future to recreate the current configuration, and a
+file `config.log' containing compiler output (useful mainly for
+debugging `configure').
+
+ It can also use an optional file (typically called `config.cache'
+and enabled with `--cache-file=config.cache' or simply `-C') that saves
+the results of its tests to speed up reconfiguring. (Caching is
+disabled by default to prevent problems with accidental use of stale
+cache files.)
+
+ If you need to do unusual things to compile the package, please try
+to figure out how `configure' could check whether to do them, and mail
+diffs or instructions to the address given in the `README' so they can
+be considered for the next release. If you are using the cache, and at
+some point `config.cache' contains results you don't want to keep, you
+may remove or edit it.
+
+ The file `configure.ac' (or `configure.in') is used to create
+`configure' by a program called `autoconf'. You only need
+`configure.ac' if you want to change it or regenerate `configure' using
+a newer version of `autoconf'.
+
+The simplest way to compile this package is:
+
+ 1. `cd' to the directory containing the package's source code and type
+ `./configure' to configure the package for your system. If you're
+ using `csh' on an old version of System V, you might need to type
+ `sh ./configure' instead to prevent `csh' from trying to execute
+ `configure' itself.
+
+ Running `configure' takes awhile. While running, it prints some
+ messages telling which features it is checking for.
+
+ 2. Type `make' to compile the package.
+
+ 3. Optionally, type `make check' to run any self-tests that come with
+ the package.
+
+ 4. Type `make install' to install the programs and any data files and
+ documentation.
+
+ 5. You can remove the program binaries and object files from the
+ source code directory by typing `make clean'. To also remove the
+ files that `configure' created (so you can compile the package for
+ a different kind of computer), type `make distclean'. There is
+ also a `make maintainer-clean' target, but that is intended mainly
+ for the package's developers. If you use it, you may have to get
+ all sorts of other programs in order to regenerate files that came
+ with the distribution.
+
+Compilers and Options
+=====================
+
+Some systems require unusual options for compilation or linking that the
+`configure' script does not know about. Run `./configure --help' for
+details on some of the pertinent environment variables.
+
+ You can give `configure' initial values for configuration parameters
+by setting variables in the command line or in the environment. Here
+is an example:
+
+ ./configure CC=c89 CFLAGS=-O2 LIBS=-lposix
+
+ *Note Defining Variables::, for more details.
+
+Compiling For Multiple Architectures
+====================================
+
+You can compile the package for more than one kind of computer at the
+same time, by placing the object files for each architecture in their
+own directory. To do this, you must use a version of `make' that
+supports the `VPATH' variable, such as GNU `make'. `cd' to the
+directory where you want the object files and executables to go and run
+the `configure' script. `configure' automatically checks for the
+source code in the directory that `configure' is in and in `..'.
+
+ If you have to use a `make' that does not support the `VPATH'
+variable, you have to compile the package for one architecture at a
+time in the source code directory. After you have installed the
+package for one architecture, use `make distclean' before reconfiguring
+for another architecture.
+
+Installation Names
+==================
+
+By default, `make install' installs the package's commands under
+`/usr/local/bin', include files under `/usr/local/include', etc. You
+can specify an installation prefix other than `/usr/local' by giving
+`configure' the option `--prefix=PREFIX'.
+
+ You can specify separate installation prefixes for
+architecture-specific files and architecture-independent files. If you
+pass the option `--exec-prefix=PREFIX' to `configure', the package uses
+PREFIX as the prefix for installing programs and libraries.
+Documentation and other data files still use the regular prefix.
+
+ In addition, if you use an unusual directory layout you can give
+options like `--bindir=DIR' to specify different values for particular
+kinds of files. Run `configure --help' for a list of the directories
+you can set and what kinds of files go in them.
+
+ If the package supports it, you can cause programs to be installed
+with an extra prefix or suffix on their names by giving `configure' the
+option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
+
+Optional Features
+=================
+
+Some packages pay attention to `--enable-FEATURE' options to
+`configure', where FEATURE indicates an optional part of the package.
+They may also pay attention to `--with-PACKAGE' options, where PACKAGE
+is something like `gnu-as' or `x' (for the X Window System). The
+`README' should mention any `--enable-' and `--with-' options that the
+package recognizes.
+
+ For packages that use the X Window System, `configure' can usually
+find the X include and library files automatically, but if it doesn't,
+you can use the `configure' options `--x-includes=DIR' and
+`--x-libraries=DIR' to specify their locations.
+
+Specifying the System Type
+==========================
+
+There may be some features `configure' cannot figure out automatically,
+but needs to determine by the type of machine the package will run on.
+Usually, assuming the package is built to be run on the _same_
+architectures, `configure' can figure that out, but if it prints a
+message saying it cannot guess the machine type, give it the
+`--build=TYPE' option. TYPE can either be a short name for the system
+type, such as `sun4', or a canonical name which has the form:
+
+ CPU-COMPANY-SYSTEM
+
+where SYSTEM can have one of these forms:
+
+ OS KERNEL-OS
+
+ See the file `config.sub' for the possible values of each field. If
+`config.sub' isn't included in this package, then this package doesn't
+need to know the machine type.
+
+ If you are _building_ compiler tools for cross-compiling, you should
+use the option `--target=TYPE' to select the type of system they will
+produce code for.
+
+ If you want to _use_ a cross compiler, that generates code for a
+platform different from the build platform, you should specify the
+"host" platform (i.e., that on which the generated programs will
+eventually be run) with `--host=TYPE'.
+
+Sharing Defaults
+================
+
+If you want to set default values for `configure' scripts to share, you
+can create a site shell script called `config.site' that gives default
+values for variables like `CC', `cache_file', and `prefix'.
+`configure' looks for `PREFIX/share/config.site' if it exists, then
+`PREFIX/etc/config.site' if it exists. Or, you can set the
+`CONFIG_SITE' environment variable to the location of the site script.
+A warning: not all `configure' scripts look for a site script.
+
+Defining Variables
+==================
+
+Variables not defined in a site shell script can be set in the
+environment passed to `configure'. However, some packages may run
+configure again during the build, and the customized values of these
+variables may be lost. In order to avoid this problem, you should set
+them in the `configure' command line, using `VAR=value'. For example:
+
+ ./configure CC=/usr/local2/bin/gcc
+
+causes the specified `gcc' to be used as the C compiler (unless it is
+overridden in the site shell script). Here is a another example:
+
+ /bin/bash ./configure CONFIG_SHELL=/bin/bash
+
+Here the `CONFIG_SHELL=/bin/bash' operand causes subsequent
+configuration-related scripts to be executed by `/bin/bash'.
+
+`configure' Invocation
+======================
+
+`configure' recognizes the following options to control how it operates.
+
+`--help'
+`-h'
+ Print a summary of the options to `configure', and exit.
+
+`--version'
+`-V'
+ Print the version of Autoconf used to generate the `configure'
+ script, and exit.
+
+`--cache-file=FILE'
+ Enable the cache: use and save the results of the tests in FILE,
+ traditionally `config.cache'. FILE defaults to `/dev/null' to
+ disable caching.
+
+`--config-cache'
+`-C'
+ Alias for `--cache-file=config.cache'.
+
+`--quiet'
+`--silent'
+`-q'
+ Do not print messages saying which checks are being made. To
+ suppress all normal output, redirect it to `/dev/null' (any error
+ messages will still be shown).
+
+`--srcdir=DIR'
+ Look for the package's source code in directory DIR. Usually
+ `configure' can determine that directory automatically.
+
+`configure' also accepts some other, not widely useful, options. Run
+`configure --help' for more details.
+
+More configure options
+======================
+
+Some ./configure options deserve additional comments:
+
+ * --enable-crypt-none
+
+ The SSH2 Transport allows for unencrypted data
+ transmission using the "none" cipher. Because this is
+ such a huge security hole, it is typically disabled on
+ SSH2 implementations and is disabled in libssh2 by
+ default as well.
+
+ Enabling this option will allow for "none" as a
+ negotiable method, however it still requires that the
+ method be advertized by the remote end and that no
+ more-preferable methods are available.
+
+ * --enable-mac-none
+
+ The SSH2 Transport also allows implementations to
+ forego a message authentication code. While this is
+ less of a security risk than using a "none" cipher, it
+ is still not recommended as disabling MAC hashes
+ removes a layer of security.
+
+ Enabling this option will allow for "none" as a
+ negotiable method, however it still requires that the
+ method be advertized by the remote end and that no
+ more-preferable methods are available.
+
+ * --disable-gex-new
+
+ The diffie-hellman-group-exchange-sha1 (dh-gex) key
+ exchange method originally defined an exchange
+ negotiation using packet type 30 to request a
+ generation pair based on a single target value. Later
+ refinement of dh-gex provided for range and target
+ values. By default libssh2 will use the newer range
+ method.
+
+ If you experience trouble connecting to an old SSH
+ server using dh-gex, try this option to fallback on
+ the older more reliable method.
+
+ * --with-libgcrypt
+ * --without-libgcrypt
+ * --with-libgcrypt-prefix=DIR
+
+ libssh2 can use the Libgcrypt library
+ (https://www.gnupg.org/) for cryptographic operations.
+ One of the cryptographic libraries is required.
+
+ Configure will attempt to locate Libgcrypt
+ automatically.
+
+ If your installation of Libgcrypt is in another
+ location, specify it using --with-libgcrypt-prefix.
+
+ * --with-openssl
+ * --without-openssl
+ * --with-libssl-prefix=[DIR]
+
+ libssh2 can use the OpenSSL library
+ (https://www.openssl.org) for cryptographic operations.
+ One of the cryptographic libraries is required.
+
+ Configure will attempt to locate OpenSSL in the
+ default location.
+
+ If your installation of OpenSSL is in another
+ location, specify it using --with-libssl-prefix.
+
+ * --with-mbedtls
+ * --without-mbedtls
+ * --with-libmbedtls-prefix=[DIR]
+
+ libssh2 can use the mbedTLS library
+ (https://tls.mbed.org) for cryptographic operations.
+ One of the cryptographic libraries is required.
+
+ Configure will attempt to locate mbedTLS in the
+ default location.
+
+ If your installation of mbedTLS is in another
+ location, specify it using --with-libmbedtls-prefix.
+
+ * --with-libz
+ * --without-libz
+ * --with-libz-prefix=[DIR]
+
+ If present, libssh2 will attempt to use the zlib
+ (http://www.zlib.org) for payload compression, however
+ zlib is not required.
+
+ If your installation of Libz is in another location,
+ specify it using --with-libz-prefix.
+
+ * --enable-debug
+
+ Will make the build use more pedantic and strict compiler
+ options as well as enable the libssh2_trace() function (for
+ showing debug traces).
diff --git a/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/TODO.txt b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/TODO.txt
new file mode 100644
index 0000000..cae1afa
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/libssh2/docs/TODO.txt
@@ -0,0 +1,174 @@
+Things TODO
+===========
+
+* Fix the numerous malloc+copy operations for sending data, see "Buffering
+ Improvements" below for details
+
+* make sure the windowing code adapts better to slow situations so that it
+ doesn't then use as much memory as today. Possibly by an app-controllable
+ "Window mode"?
+
+* Decrease the number of mallocs. Everywhere. Will get easier once the
+ buffering improvements have been done.
+
+* Use SO_NOSIGPIPE for Mac OS/BSD systems where MSG_NOSIGNAL doesn't
+ exist/work
+
+* Extend the test suite to actually test lots of aspects of libssh2
+
+* Fix all compiler warnings (some can't be done without API changes)
+
+* Expose error messages sent by the server
+
+* select() is troublesome with libssh2 when using multiple channels over
+ the same session. See "New Transport API" below for more details.
+
+At next SONAME bump
+===================
+
+* stop using #defined macros as part of the official API. The macros should
+ either be turned into real functions or discarded from the API.
+
+* fix the parts of the API where object pointers and function pointers are
+ mixed like libssh2_session_callback_set()
+
+* remove the following functions from the API/ABI
+
+ libssh2_base64_decode()
+ libssh2_session_flag()
+ libssh2_channel_handle_extended_data()
+ libssh2_channel_receive_window_adjust()
+ libssh2_poll()
+ libssh2_poll_channel_read()
+ libssh2_session_startup() (libssh2_session_handshake() is the replacement)
+ libssh2_banner_set() (libssh2_session_banner_set() is the repacement)
+
+* Rename a few function:
+
+ libssh2_hostkey_hash => libssh2_session_hostkey_hash
+ libssh2_banner_set => libssh2_session_banner_set
+
+* change 'int' to 'libssh2_socket_t' in the public API for sockets.
+
+* Use 'size_t' for string lengths in all functions.
+
+* Add a comment field to struct libssh2_knownhost.
+
+* remove the existing libssh2_knownhost_add() function and rename
+ libssh2_knownhost_addc to become the new libssh2_knownhost_add instead
+
+* remove the existing libssh2_scp_send_ex() function and rename
+ libssh2_scp_send64 to become the new libssh2_scp_send instead.
+
+* remove the existing libssh2_knownhost_check() functin and rename
+ libssh2_knownhost_checkp() to become the new libssh2_knownhost_check instead
+
+Buffering Improvements
+======================
+
+transport_write
+
+ - If this function gets called with a total packet size that is larger than
+ 32K, it should create more than one SSH packet so that it keeps the largest
+ one below 32K
+
+sftp_write
+
+ - should not copy/allocate anything for the data, only create a header chunk
+ and pass on the payload data to channel_write "pointed to"
+
+New Transport API
+=================
+
+THE PROBLEM
+
+The problem in a nutshell is that when an application opens up multiple
+channels over a single session, those are all using the same socket. If the
+application is then using select() to wait for traffic (like any sensible app
+does) and wants to act on the data when select() tells there is something to
+for example read, what does an application do?
+
+With our current API, you have to loop over all the channels and read from
+them to see if they have data. This effectively makes blocking reads
+impossible. If the app has many channels in a setup like this, it even becomes
+slow. (The original API had the libssh2_poll_channel_read() and libssh2_poll()
+to somewhat overcome this hurdle, but they too have pretty much the same
+problems plus a few others.)
+
+Traffic in the other direction is similarly limited: the app has to try
+sending to all channels, even though some of them may very well not accept any
+data at that point.
+
+A SOLUTION
+
+I suggest we introduce two new helper functions:
+
+ libssh2_transport_read()
+
+ - Read "a bunch" of data from the given socket and returns information to the
+ app about what channels that are now readable (ie they will not block when
+ read from). The function can be called over and over and it will repeatedly
+ return info about what channels that are readable at that moment.
+
+ libssh2_transport_write()
+
+ - Returns information about what channels that are writable, in the sense
+ that they have windows set from the remote side that allows data to get
+ sent. Writing to one of those channels will not block. Of course, the
+ underlying socket may only accept a certain amount of data, so at the first
+ short return, nothing more should be attempted to get sent until select()
+ (or equivalent) has been used on the master socket again.
+
+I haven't yet figured out a sensible API for how these functions should return
+that info, but if we agree on the general principles I guess we can work that
+out.
+
+VOLUNTARY
+
+ I wanted to mention that these two helper functions would not be mandatory
+ in any way. They would just be there for those who want them, and existing
+ programs can remain using the old functions only if they prefer to.
+
+New SFTP API
+============
+
+PURPOSE
+
+ Provide API functions that explicitly tells at once that a (full) SFTP file
+ transfer is wanted, to allow libssh2 to leverage on that knowledge to speed
+ up things internally. It can for example do read ahead, buffer writes (merge
+ small writes into larger chunks), better tune the SSH window and more. This
+ sort of API is already provided for SCP transfers.
+
+API
+
+ New functions:
+
+ LIBSSH2_SFTP_HANDLE *libssh2_sftp_send(SFTP_SESSION *sftp,
+ uint64_t filesize,
+ char *remote_path,
+ size_t remote_path_len,
+ long mode);
+
+ Tell libssh2 that a local file with a given size is about to get sent to
+ the SFTP server.
+
+ LIBSSH2_SFTP_HANDLE *libssh2_sftp_recv();
+
+ Tell libssh2 that a remote file is requested to get downloaded from the SFTP
+ server.
+
+ Only the setup of the file transfer is different from an application's point
+ of view. Depending on direction of the transfer(s), the following already
+ existing functions should then be used until the transfer is complete:
+
+ libssh2_sftp_read()
+ libssh2_sftp_write()
+
+HOW TO USE
+
+ 1. Setup the transfer using one of the two new functions.
+
+ 2. Loop through the reading or writing of data.
+
+ 3. Cleanup the transfer
diff --git a/curl-8.0.1_9-win64-mingw/dep/nghttp2/AUTHORS.txt b/curl-8.0.1_9-win64-mingw/dep/nghttp2/AUTHORS.txt
new file mode 100644
index 0000000..8bcf579
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/nghttp2/AUTHORS.txt
@@ -0,0 +1,154 @@
+nghttp2 project was started as a fork of spdylay project [1]. Both
+projects were started by Tatsuhiro Tsujikawa, who is still the main
+author of these projects. Meanwhile, we have many contributions, and
+we are not here without them. We sincerely thank you to all who made
+a contribution. Here is the all individuals/organizations who
+contributed to nghttp2 and spdylay project at which we forked. These
+names are retrieved from git commit log. If you have made a
+contribution, but you are missing in the list, please let us know via
+github issues [2].
+
+[1] https://github.com/tatsuhiro-t/spdylay
+[2] https://github.com/nghttp2/nghttp2/issues
+
+--------
+
+187j3x1
+Adam Gołębiowski
+Alek Storm
+Alex Nalivko
+Alexandros Konstantinakis-Karmis
+Alexis La Goutte
+Amir Livneh
+Amir Pakdel
+Anders Bakken
+Andreas Pohl
+Andrew Penkrat
+Andy Davies
+Angus Gratton
+Anna Henningsen
+Ant Bryan
+Asra Ali
+Benedikt Christoph Wolters
+Benjamin Peterson
+Bernard Spil
+Brendan Heinonen
+Brian Card
+Brian Suh
+Daniel Bevenius
+Daniel Evers
+Daniel Stenberg
+Dave Reisner
+David Beitey
+David Korczynski
+David Weekly
+Dimitris Apostolou
+Dmitri Tikhonov
+Dmitriy Vetutnev
+Don
+Dylan Plecki
+Etienne Cimon
+Fabian Möller
+Fabian Wiesel
+Fred Sundvik
+Gabi Davar
+Gaël PORTAY
+Geoff Hill
+George Liu
+Gitai
+Google Inc.
+Hajime Fujita
+Jacky Tian
+Jacky_Yin
+Jacob Champion
+James M Snell
+Jan Kundrát
+Jan-E
+Janusz Dziemidowicz
+Jay Satiro
+Jeff 'Raid' Baitis
+Jianqing Wang
+Jim Morrison
+Josh Braegger
+José F. Calcerrada
+Kamil Dudka
+Kazuho Oku
+Kenny (kang-yen) Peng
+Kenny Peng
+Kit Chan
+Kyle Schomp
+LazyHamster
+Leo Neat
+Lorenz Nickel
+Lucas Pardue
+MATSUMOTO Ryosuke
+Marc Bachmann
+Marcelo Trylesinski
+Matt Rudary
+Matt Way
+Michael Kaufmann
+Mike Conlen
+Mike Frysinger
+Mike Lothian
+Nicholas Hurley
+Nora Shoemaker
+Paweł Wegner
+Pedro Santos
+Peeyush Aggarwal
+Peter Wu
+Piotr Sikora
+PufferOverflow
+Raul Gutierrez Segales
+Remo E
+Renaud
+Reza Tavakoli
+Richard Wolfert
+Rick Lei
+Ross Smith II
+Rudi Heitbaum
+Ryo Ota
+Scott Mitchell
+Sebastiaan Deckers
+Shelley Vohr
+Simon Frankenberger
+Simone Basso
+Soham Sinha
+Stefan Eissing
+Stephen Ludin
+Sunpoet Po-Chuan Hsieh
+Svante Signell
+Syohei YOSHIDA
+Tapanito
+Tatsuhiko Kubo
+Tatsuhiro Tsujikawa
+Tobias Geerinckx-Rice
+Tom Harwood
+Tomas Krizek
+Tomasz Buchert
+Tomasz Torcz
+Vernon Tang
+Viacheslav Biriukov
+Viktor Szakats
+Viktor Szépe
+Wenfeng Liu
+William A Rowe Jr
+Xiaoguang Sun
+Zhuoyun Wei
+acesso
+ayanamist
+bxshi
+clemahieu
+dalf
+dawg
+es
+fangdingjun
+jwchoi
+kumagi
+lhuang04
+lstefani
+makovich
+mod-h2-dev
+moparisthebest
+robaho
+snnn
+yuuki-kodama
diff --git a/curl-8.0.1_9-win64-mingw/dep/nghttp2/COPYING.txt b/curl-8.0.1_9-win64-mingw/dep/nghttp2/COPYING.txt
new file mode 100644
index 0000000..8020179
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/nghttp2/COPYING.txt
@@ -0,0 +1,23 @@
+The MIT License
+
+Copyright (c) 2012, 2014, 2015, 2016 Tatsuhiro Tsujikawa
+Copyright (c) 2012, 2014, 2015, 2016 nghttp2 contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/curl-8.0.1_9-win64-mingw/dep/nghttp2/ChangeLog.txt b/curl-8.0.1_9-win64-mingw/dep/nghttp2/ChangeLog.txt
new file mode 100644
index 0000000..1321021
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/nghttp2/ChangeLog.txt
@@ -0,0 +1,546 @@
+commit ed2ccce0e844a128891cfc334afd371371fae639 (HEAD, tag: v1.53.0, origin/master, origin/HEAD, master)
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-05-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-05-10
+
+ Generate .asc files
+
+commit 7a0e16510a72576cfd6cc3683367297e349e48e4
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-05-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-05-10
+
+ Update manual pages
+
+commit f62b2b23b1a9ad675ccffbe5f13929ba2f6005a8
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-05-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-05-10
+
+ Bump package and library versions
+
+commit 5e8904e327351ed5827f346f78b53aa909c721ec
+Merge: e392729d 26ab7c14
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-29
+Commit: GitHub
+CommitDate: 2023-04-29
+
+ Merge pull request #1902 from nghttp2/bump-neverbleed
+
+ Bump neverbleed
+
+commit 26ab7c147570c2ca08a22342db68693109efed77
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-29
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-29
+
+ Bump neverbleed
+
+commit e392729d9f65ab64c1302d0a5e4c564ef22d5952
+Merge: 88e03cda 0fbfc487
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-29
+Commit: GitHub
+CommitDate: 2023-04-29
+
+ Merge pull request #1901 from nghttp2/zerofill-z_stream
+
+ Initialize z_stream completely with zeros
+
+commit 0fbfc487168e09adc500f629eacbd17f602a4685
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-29
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-29
+
+ Initialize z_stream completely with zeros
+
+commit 88e03cdaf0e08edc838e0691a8354cbf096e06c4
+Merge: 4f27509e 7645ab89
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-26
+Commit: GitHub
+CommitDate: 2023-04-26
+
+ Merge pull request #1900 from nghttp2/nghttpx-send-new-token-on-path-change
+
+ nghttpx: Send NEW_TOKEN on path change
+
+commit 7645ab89bca97d8d915806481f007136cdd2145d
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-26
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-26
+
+ nghttpx: Send NEW_TOKEN on path change
+
+commit 4f27509e674b5c33441817952992df8d2d9bf0ad
+Merge: 757bc3cb 7a4e706b
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-26
+Commit: GitHub
+CommitDate: 2023-04-26
+
+ Merge pull request #1899 from nghttp2/bump-ngtcp2
+
+ Bump ngtcp2
+
+commit 7a4e706b4483af72f97d5ff387e1550df1ae728f
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-23
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-26
+
+ Bump ngtcp2
+
+commit 757bc3cbe931e22f19521a34e3b69e7b22a1b3ea
+Merge: cc1402bf 2ee33fe8
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-22
+Commit: GitHub
+CommitDate: 2023-04-22
+
+ Merge pull request #1898 from nghttp2/sfparse
+
+ Import ngtcp2/sfparse, Structured Field Values parser
+
+commit 2ee33fe8cdc034f0a711dabb7e11c6f857197688
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-22
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-22
+
+ Import ngtcp2/sfparse, Structured Field Values parser
+
+commit cc1402bf441cad6277a6e3282b74a4060f7733f9
+Merge: 56fcb73c 70690ce0
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-22
+Commit: GitHub
+CommitDate: 2023-04-22
+
+ Merge pull request #1897 from nghttp2/lazy-initialize-map-table
+
+ Initialize map table lazily
+
+commit 70690ce010391c02acdf7dba4a23d7701e768d04
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-22
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-22
+
+ Initialize map table lazily
+
+commit 56fcb73cc4cab6032c191d931f35bad55774624b
+Merge: 51b0288f 84eecc01
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-04-21
+Commit: GitHub
+CommitDate: 2023-04-21
+
+ Merge pull request #1896 from nghttp2/msvc-build-check
+
+ Msvc build check
+
+commit 84eecc015c0e1f876c7ce7b71255b4b2ca0b3c24
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-21
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-21
+
+ Fix implicit conversion warnings
+
+commit 4bb4ff06e37c03128792a575c5bc09d62a639827
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-21
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-21
+
+ Fix function signature
+
+commit 8610758e14ed66672c820e4acd432dee52863138
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-21
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-21
+
+ Include stdio.h to workaround error due to legacy CUnit snprintf macro
+
+commit caf9d3abd53772e796fde0926e793fb82fe71807
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-04-21
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-04-21
+
+ Run msvc build check
+
+commit 51b0288f5d18d72cf143ed5e3f7016cd77879ccd
+Merge: 251d3f87 7fb488be
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-25
+Commit: GitHub
+CommitDate: 2023-03-25
+
+ Merge pull request #1892 from nghttp2/nghttpx-h3-write-event
+
+ nghttpx: write watcher should only be started upon blocking write
+
+commit 7fb488be15e42ffffa6f90fe4158c28572029f7d
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-25
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-25
+
+ nghttpx: write watcher should only be started upon blocking write
+
+commit 251d3f8743518db8ef89da61bc3d4a8c35d71a6f
+Merge: edfc6a85 3676eb91
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-25
+Commit: GitHub
+CommitDate: 2023-03-25
+
+ Merge pull request #1891 from nghttp2/bump-ngtcp2
+
+ Bump ngtcp2 to v0.14.0
+
+commit 3676eb91e31b89d1c68d1125eff211bc7f9009fd
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-25
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-25
+
+ Bump ngtcp2 to v0.14.0
+
+commit edfc6a8530b40ad3bfc6db666528b2c89ae8a248
+Merge: 7efbcfec 448c68ef
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-16
+Commit: GitHub
+CommitDate: 2023-03-16
+
+ Merge pull request #1888 from nghttp2/fix-macos-setup
+
+ Add missing if condition to MacOS setup
+
+commit 448c68ef0182ee4f1342bdcbaa048a9274ee5e26
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-16
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-16
+
+ Add missing if condition to MacOS setup
+
+commit 7efbcfecff539fe114c969b25789c7b7ffb2127e
+Merge: c460afc2 de743aad
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-16
+Commit: GitHub
+CommitDate: 2023-03-16
+
+ Merge pull request #1887 from nghttp2/add-verify_hostname-tests
+
+ Add verify_hostname tests
+
+commit de743aad4af61f6ddb2eae59eb24ee4ceb9b7687
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-15
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-15
+
+ Add verify_hostname tests
+
+commit c460afc2d9fdefc39e2566f7fdb3e8f1c220ef26
+Merge: 83993b1d c03cd592
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-15
+Commit: GitHub
+CommitDate: 2023-03-15
+
+ Merge pull request #1886 from nghttp2/fix-compile-errors
+
+ Fix compile errors with clang-15
+
+commit c03cd59274e6cd7b2cad4e6e5b05e37eca84389c
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-15
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-15
+
+ Fix compile errors with clang-15
+
+commit 83993b1dbf499cc7b83ad8d6ba099906d52163a9
+Merge: ef7bb8ef cc144000
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-15
+Commit: GitHub
+CommitDate: 2023-03-15
+
+ Merge pull request #1885 from nghttp2/nghttpx-fix-numeric-hostname-verify
+
+ nghttpx: Fix numeric hostname verification
+
+commit cc144000965fef3e861a6effb517b90d2a42c63e
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-15
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-15
+
+ nghttpx: Fix numeric hostname verification
+
+commit ef7bb8ef9fd680bf9eecf2dd8ac710cedc195e6d
+Merge: b8cb6efb bc6814eb
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-11
+Commit: GitHub
+CommitDate: 2023-03-11
+
+ Merge pull request #1881 from nghttp2/nghttpx-fix-heap-use-after-free
+
+ nghttpx: Fix heap-use-after-free
+
+commit bc6814eb5b3ac76b0a8e02f6b2c3bffde4f63749
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-11
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-11
+
+ nghttpx: Fix heap-use-after-free
+
+ Fix heap-use-after-free introduced by
+ ddb667e8bff8fbdd1576f7637fc5d18bf5da9eb7.
+
+commit b8cb6efb375ac12cb4485cac49ec1556cb3e8210
+Merge: 7628879e 83af9b50
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-11
+Commit: GitHub
+CommitDate: 2023-03-11
+
+ Merge pull request #1880 from nghttp2/nghttpx-tweak-worker-process-handling
+
+ Nghttpx tweak worker process handling
+
+commit 83af9b504ba35ec4f7ee0991ff0affc546210674
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-10
+
+ nghttpx: Wait for new worker process to be ready
+
+ Wait for new worker process to be ready before sending graceful
+ shutdown event to the existing worker processes to avoid down time
+ during configuration reload.
+
+commit ddb667e8bff8fbdd1576f7637fc5d18bf5da9eb7
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-10
+
+ nghttpx: Signal watcher should be global, not per WorkerProcess
+
+commit 704153e4cba43846a66fe83f72d6df561d6b78df
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-10
+
+ nghttpx: Wait for all worker processes to stop before quit
+
+ When quitting, wait for all worker processes to stop. Previously, we
+ just exit the event loop when the last process exits. But the because
+ of the bug, it does not work as intended.
+
+commit 39f6c081870dcb2767aa6ef11eb5a4392b226440
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-10
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-10
+
+ nghttpx: Update LogConfig::pid on fork
+
+commit 7628879e7987efe250aaa31d7a9ad5c36d0c1c33
+Merge: 1e47a198 20173a59
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-08
+Commit: GitHub
+CommitDate: 2023-03-08
+
+ Merge pull request #1879 from nghttp2/workflow-permissions
+
+ Set workflow permissions
+
+commit 20173a59f02ca576323401fed5528713feacc1a2
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-08
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-08
+
+ Set workflow permissions
+
+commit 1e47a1984de6addcd23e319947a416b47bf5954e
+Merge: 14cc308d 14268ccb
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-03-06
+Commit: GitHub
+CommitDate: 2023-03-06
+
+ Merge pull request #1877 from nghttp2/sphinx-doc-enum
+
+ sphinx-doc understands :enum:
+
+commit 14268ccbaa1cf7cafe1be79f6d1e07c66e87f23a
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-03-06
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-03-06
+
+ sphinx-doc understands :enum:
+
+commit 14cc308d537ed21b1bfc857761af000b673c86e7
+Merge: 1c62a2a9 bb024e3d
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-26
+Commit: GitHub
+CommitDate: 2023-02-26
+
+ Merge pull request #1874 from nghttp2/nghttpx-llhttp-resume-after-upgrade
+
+ nghttpx: Fix bug that causes 400 response after upgrade failure
+
+commit bb024e3d82d68497493a0a54532aad7e1499df43
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-26
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-26
+
+ nghttpx: Fix bug that causes 400 response after upgrade failure
+
+commit 1c62a2a9238e0a4980a058d01e0866fcdbef6fcb
+Merge: dc74b50c 094c60db
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-26
+Commit: GitHub
+CommitDate: 2023-02-26
+
+ Merge pull request #1873 from nghttp2/bump-go-mod
+
+ Bump go modules
+
+commit 094c60db890625ac41275a5a35ab3e973f5ece74
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-23
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-26
+
+ Bump go modules
+
+commit dc74b50cc92651819e20761bc4e48a887642ee28
+Merge: a1c7e507 5cd87eae
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-26
+Commit: GitHub
+CommitDate: 2023-02-26
+
+ Merge pull request #1872 from nghttp2/bump-mruby
+
+ Bump mruby to 3.2.0
+
+commit 5cd87eae22d2a81d5e1ee21b6a28d645455fb506
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-24
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-26
+
+ Bump mruby to 3.2.0
+
+commit a1c7e507aa3a75b1f61f3d69901a127487cd923f
+Merge: b400bb5c 9526e2ff
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-25
+Commit: GitHub
+CommitDate: 2023-02-25
+
+ Merge pull request #1871 from nghttp2/nghttpx-h3-graceful-shutdown
+
+ nghttpx: Gracefully shutdown HTTP/3 connection
+
+commit 9526e2ff80455e0455a6636988dc1f2957012f72
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-23
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-24
+
+ nghttpx: Gracefully shutdown HTTP/3 connection
+
+commit b400bb5c15471435abb5ad3a9723b5bfac7d61c3
+Merge: 878de84f 89cb55a6
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-24
+Commit: GitHub
+CommitDate: 2023-02-24
+
+ Merge pull request #1870 from nghttp2/bump-nghttp3
+
+ Bump nghttp3 to v0.9.0
+
+commit 89cb55a62f369bb076d048f256dba0091dec0215
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-24
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-24
+
+ Bump nghttp3 to v0.9.0
+
+commit 878de84feb1b4944755972d5543ab64f00f8e12f
+Merge: 1eb91d2e 9862a86b
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-24
+Commit: GitHub
+CommitDate: 2023-02-24
+
+ Merge pull request #1869 from nghttp2/build-cache
+
+ Cache dependencies to speed up workflow builds
+
+commit 9862a86b3127e1f2216a0c2f39b866f23127dd32
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-24
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-24
+
+ Cache dependencies to speed up workflow builds
+
+commit 1eb91d2e50d98e30fde01f3d95786ec69ebc36b5
+Merge: 5cb908b6 50fbb764
+Author: Tatsuhiro Tsujikawa <404610+tatsuhiro-t@users.noreply.github.com>
+AuthorDate: 2023-02-23
+Commit: GitHub
+CommitDate: 2023-02-23
+
+ Merge pull request #1867 from nghttp2/bump-go-mod
+
+ Bump golang.org/x/net to v0.7.0
+
+commit 50fbb7645462e1dd77c596fec8f132bc8b0cb9ba
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-23
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-23
+
+ Bump golang.org/x/net to v0.7.0
+
+commit 5cb908b62583b52c0b905b41ef96aa3fd58f179c
+Author: Tatsuhiro Tsujikawa
+AuthorDate: 2023-02-13
+Commit: Tatsuhiro Tsujikawa
+CommitDate: 2023-02-13
+
+ Bump package version
diff --git a/curl-8.0.1_9-win64-mingw/dep/nghttp2/README.rst b/curl-8.0.1_9-win64-mingw/dep/nghttp2/README.rst
new file mode 100644
index 0000000..76291f0
--- /dev/null
+++ b/curl-8.0.1_9-win64-mingw/dep/nghttp2/README.rst
@@ -0,0 +1,1475 @@
+nghttp2 - HTTP/2 C Library
+==========================
+
+This is an implementation of the Hypertext Transfer Protocol version 2
+in C.
+
+The framing layer of HTTP/2 is implemented as a reusable C library.
+On top of that, we have implemented an HTTP/2 client, server and
+proxy. We have also developed load test and benchmarking tools for
+HTTP/2.
+
+An HPACK encoder and decoder are available as a public API.
+
+Development Status
+------------------
+
+nghttp2 was originally developed based on `RFC 7540
+`_ HTTP/2 and `RFC 7541
+`_ HPACK - Header Compression for
+HTTP/2. Now we are updating our code to implement `RFC 9113
+`_.
+
+The nghttp2 code base was forked from the spdylay
+(https://github.com/tatsuhiro-t/spdylay) project.
+
+Public Test Server
+------------------
+
+The following endpoints are available to try out our nghttp2
+implementation.
+
+* https://nghttp2.org/ (TLS + ALPN/NPN and HTTP/3)
+
+ This endpoint supports ``h2``, ``h2-16``, ``h2-14``, and
+ ``http/1.1`` via ALPN/NPN and requires TLSv1.2 for HTTP/2
+ connection.
+
+ It also supports HTTP/3.
+
+* http://nghttp2.org/ (HTTP Upgrade and HTTP/2 Direct)
+
+ ``h2c`` and ``http/1.1``.
+
+Requirements
+------------
+
+The following package is required to build the libnghttp2 library:
+
+* pkg-config >= 0.20
+
+To build and run the unit test programs, the following package is
+required:
+
+* cunit >= 2.1
+
+To build the documentation, you need to install:
+
+* sphinx (http://sphinx-doc.org/)
+
+If you need libnghttp2 (C library) only, then the above packages are
+all you need. Use ``--enable-lib-only`` to ensure that only
+libnghttp2 is built. This avoids potential build error related to
+building bundled applications.
+
+To build and run the application programs (``nghttp``, ``nghttpd``,
+``nghttpx`` and ``h2load``) in the ``src`` directory, the following packages
+are required:
+
+* OpenSSL >= 1.0.1
+* libev >= 4.11
+* zlib >= 1.2.3
+* libc-ares >= 1.7.5
+
+ALPN support requires OpenSSL >= 1.0.2 (released 22 January 2015).
+LibreSSL >= 2.2.0 can be used instead of OpenSSL, but OpenSSL has more
+features than LibreSSL at the time of this writing.
+
+To enable ``-a`` option (getting linked assets from the downloaded
+resource) in ``nghttp``, the following package is required:
+
+* libxml2 >= 2.6.26
+
+To enable systemd support in nghttpx, the following package is
+required:
+
+* libsystemd-dev >= 209
+
+The HPACK tools require the following package:
+
+* jansson >= 2.5
+
+To build sources under the examples directory, libevent is required:
+
+* libevent-openssl >= 2.0.8
+
+To mitigate heap fragmentation in long running server programs
+(``nghttpd`` and ``nghttpx``), jemalloc is recommended:
+
+* jemalloc
+
+ .. note::
+
+ Alpine Linux currently does not support malloc replacement
+ due to musl limitations. See details in issue `#762 `_.
+
+To enable mruby support for nghttpx, `mruby
+`_ is required. We need to build
+mruby with C++ ABI explicitly turned on, and probably need other
+mrgems, mruby is manged by git submodule under third-party/mruby
+directory. Currently, mruby support for nghttpx is disabled by
+default. To enable mruby support, use ``--with-mruby`` configure
+option. Note that at the time of this writing, libmruby-dev and mruby
+packages in Debian/Ubuntu are not usable for nghttp2, since they do
+not enable C++ ABI. To build mruby, the following packages are
+required:
+
+* ruby
+* bison
+
+nghttpx supports `neverbleed `_,
+privilege separation engine for OpenSSL / LibreSSL. In short, it
+minimizes the risk of private key leakage when serious bug like
+Heartbleed is exploited. The neverbleed is disabled by default. To
+enable it, use ``--with-neverbleed`` configure option.
+
+To enable the experimental HTTP/3 support for h2load and nghttpx, the
+following libraries are required:
+
+* `OpenSSL with QUIC support
+ `_; or
+ `BoringSSL `_ (commit
+ b0b1f9dfc583c96d5f91b7f8cdb7efabcf22793b)
+* `ngtcp2 `_ >= 0.15.0
+* `nghttp3 `_ >= 0.9.0
+
+Use ``--enable-http3`` configure option to enable HTTP/3 feature for
+h2load and nghttpx.
+
+In order to build optional eBPF program to direct an incoming QUIC UDP
+datagram to a correct socket for nghttpx, the following libraries are
+required:
+
+* libbpf-dev >= 0.7.0
+
+Use ``--with-libbpf`` configure option to build eBPF program.
+libelf-dev is needed to build libbpf.
+
+For Ubuntu 20.04, you can build libbpf from `the source code
+`_. nghttpx
+requires eBPF program for reloading its configuration and hot swapping
+its executable.
+
+Compiling libnghttp2 C source code requires a C99 compiler. gcc 4.8
+is known to be adequate. In order to compile the C++ source code, gcc
+>= 6.0 or clang >= 6.0 is required. C++ source code requires C++14
+language features.
+
+.. note::
+
+ To enable mruby support in nghttpx, and use ``--with-mruby``
+ configure option.
+
+.. note::
+
+ Mac OS X users may need the ``--disable-threads`` configure option to
+ disable multi-threading in nghttpd, nghttpx and h2load to prevent
+ them from crashing. A patch is welcome to make multi threading work
+ on Mac OS X platform.
+
+.. note::
+
+ To compile the associated applications (nghttp, nghttpd, nghttpx
+ and h2load), you must use the ``--enable-app`` configure option and
+ ensure that the specified requirements above are met. Normally,
+ configure script checks required dependencies to build these
+ applications, and enable ``--enable-app`` automatically, so you
+ don't have to use it explicitly. But if you found that
+ applications were not built, then using ``--enable-app`` may find
+ that cause, such as the missing dependency.
+
+.. note::
+
+ In order to detect third party libraries, pkg-config is used
+ (however we don't use pkg-config for some libraries (e.g., libev)).
+ By default, pkg-config searches ``*.pc`` file in the standard
+ locations (e.g., /usr/lib/pkgconfig). If it is necessary to use
+ ``*.pc`` file in the custom location, specify paths to
+ ``PKG_CONFIG_PATH`` environment variable, and pass it to configure
+ script, like so:
+
+ .. code-block:: text
+
+ $ ./configure PKG_CONFIG_PATH=/path/to/pkgconfig
+
+ For pkg-config managed libraries, ``*_CFLAG`` and ``*_LIBS``
+ environment variables are defined (e.g., ``OPENSSL_CFLAGS``,
+ ``OPENSSL_LIBS``). Specifying non-empty string to these variables
+ completely overrides pkg-config. In other words, if they are
+ specified, pkg-config is not used for detection, and user is
+ responsible to specify the correct values to these variables. For
+ complete list of these variables, run ``./configure -h``.
+
+If you are using Ubuntu 22.04 LTS, run the following to install the
+required packages:
+
+.. code-block:: text
+
+ sudo apt-get install g++ clang make binutils autoconf automake \
+ autotools-dev libtool pkg-config \
+ zlib1g-dev libcunit1-dev libssl-dev libxml2-dev libev-dev \
+ libevent-dev libjansson-dev \
+ libc-ares-dev libjemalloc-dev libsystemd-dev \
+ ruby-dev bison libelf-dev
+
+Building nghttp2 from release tar archive
+-----------------------------------------
+
+The nghttp2 project regularly releases tar archives which includes
+nghttp2 source code, and generated build files. They can be
+downloaded from `Releases
+`_ page.
+
+Building nghttp2 from git requires autotools development packages.
+Building from tar archives does not require them, and thus it is much
+easier. The usual build step is as follows:
+
+.. code-block:: text
+
+ $ tar xf nghttp2-X.Y.Z.tar.bz2
+ $ cd nghttp2-X.Y.Z
+ $ ./configure
+ $ make
+
+Building from git
+-----------------
+
+Building from git is easy, but please be sure that at least autoconf 2.68 is
+used:
+
+.. code-block:: text
+
+ $ git submodule update --init
+ $ autoreconf -i
+ $ automake
+ $ autoconf
+ $ ./configure
+ $ make
+
+Notes for building on Windows (MSVC)
+------------------------------------
+
+The easiest way to build native Windows nghttp2 dll is use `cmake
+`_. The free version of `Visual C++ Build Tools
+`_ works
+fine.
+
+1. Install cmake for windows
+2. Open "Visual C++ ... Native Build Tool Command Prompt", and inside
+ nghttp2 directly, run ``cmake``.
+3. Then run ``cmake --build`` to build library.
+4. nghttp2.dll, nghttp2.lib, nghttp2.exp are placed under lib directory.
+
+Note that the above steps most likely produce nghttp2 library only.
+No bundled applications are compiled.
+
+Notes for building on Windows (Mingw/Cygwin)
+--------------------------------------------
+
+Under Mingw environment, you can only compile the library, it's
+``libnghttp2-X.dll`` and ``libnghttp2.a``.
+
+If you want to compile the applications(``h2load``, ``nghttp``,
+``nghttpx``, ``nghttpd``), you need to use the Cygwin environment.
+
+Under Cygwin environment, to compile the applications you need to
+compile and install the libev first.
+
+Secondly, you need to undefine the macro ``__STRICT_ANSI__``, if you
+not, the functions ``fdopen``, ``fileno`` and ``strptime`` will not
+available.
+
+the sample command like this:
+
+.. code-block:: text
+
+ $ export CFLAGS="-U__STRICT_ANSI__ -I$libev_PREFIX/include -L$libev_PREFIX/lib"
+ $ export CXXFLAGS=$CFLAGS
+ $ ./configure
+ $ make
+
+If you want to compile the applications under ``examples/``, you need
+to remove or rename the ``event.h`` from libev's installation, because
+it conflicts with libevent's installation.
+
+Notes for installation on Linux systems
+--------------------------------------------
+After installing nghttp2 tool suite with ``make install`` one might experience a similar error:
+
+.. code-block:: text
+
+ nghttpx: error while loading shared libraries: libnghttp2.so.14: cannot open shared object file: No such file or directory
+
+This means that the tool is unable to locate the ``libnghttp2.so`` shared library.
+
+To update the shared library cache run ``sudo ldconfig``.
+
+Building the documentation
+--------------------------
+
+.. note::
+
+ Documentation is still incomplete.
+
+To build the documentation, run:
+
+.. code-block:: text
+
+ $ make html
+
+The documents will be generated under ``doc/manual/html/``.
+
+The generated documents will not be installed with ``make install``.
+
+The online documentation is available at
+https://nghttp2.org/documentation/
+
+Build HTTP/3 enabled h2load and nghttpx
+---------------------------------------
+
+To build h2load and nghttpx with HTTP/3 feature enabled, run the
+configure script with ``--enable-http3``.
+
+For nghttpx to reload configurations and swapping its executable while
+gracefully terminating old worker processes, eBPF is required. Run
+the configure script with ``--enable-http3 --with-libbpf`` to build
+eBPF program. The QUIC keying material must be set with
+``--frontend-quic-secret-file`` in order to keep the existing
+connections alive during reload.
+
+The detailed steps to build HTTP/3 enabled h2load and nghttpx follow.
+
+Build custom OpenSSL:
+
+.. code-block:: text
+
+ $ git clone --depth 1 -b OpenSSL_1_1_1t+quic https://github.com/quictls/openssl
+ $ cd openssl
+ $ ./config --prefix=$PWD/build --openssldir=/etc/ssl
+ $ make -j$(nproc)
+ $ make install_sw
+ $ cd ..
+
+Build nghttp3:
+
+.. code-block:: text
+
+ $ git clone --depth 1 -b v0.11.0 https://github.com/ngtcp2/nghttp3
+ $ cd nghttp3
+ $ autoreconf -i
+ $ ./configure --prefix=$PWD/build --enable-lib-only
+ $ make -j$(nproc)
+ $ make install
+ $ cd ..
+
+Build ngtcp2:
+
+.. code-block:: text
+
+ $ git clone --depth 1 -b v0.15.0 https://github.com/ngtcp2/ngtcp2
+ $ cd ngtcp2
+ $ autoreconf -i
+ $ ./configure --prefix=$PWD/build --enable-lib-only \
+ PKG_CONFIG_PATH="$PWD/../openssl/build/lib/pkgconfig"
+ $ make -j$(nproc)
+ $ make install
+ $ cd ..
+
+If your Linux distribution does not have libbpf-dev >= 0.7.0, build
+from source:
+
+.. code-block:: text
+
+ $ git clone --depth 1 -b v1.1.0 https://github.com/libbpf/libbpf
+ $ cd libbpf
+ $ PREFIX=$PWD/build make -C src install
+ $ cd ..
+
+Build nghttp2:
+
+.. code-block:: text
+
+ $ git clone https://github.com/nghttp2/nghttp2
+ $ cd nghttp2
+ $ git submodule update --init
+ $ autoreconf -i
+ $ ./configure --with-mruby --with-neverbleed --enable-http3 --with-libbpf \
+ CC=clang-14 CXX=clang++-14 \
+ PKG_CONFIG_PATH="$PWD/../openssl/build/lib/pkgconfig:$PWD/../nghttp3/build/lib/pkgconfig:$PWD/../ngtcp2/build/lib/pkgconfig:$PWD/../libbpf/build/lib64/pkgconfig" \
+ LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/../openssl/build/lib -Wl,-rpath,$PWD/../libbpf/build/lib64"
+ $ make -j$(nproc)
+
+The eBPF program ``reuseport_kern.o`` should be found under bpf
+directory. Pass ``--quic-bpf-program-file=bpf/reuseport_kern.o``
+option to nghttpx to load it. See also `HTTP/3 section in nghttpx -
+HTTP/2 proxy - HOW-TO
+`_.
+
+Unit tests
+----------
+
+Unit tests are done by simply running ``make check``.
+
+Integration tests
+-----------------
+
+We have the integration tests for the nghttpx proxy server. The tests are
+written in the `Go programming language `_ and uses
+its testing framework. We depend on the following libraries:
+
+* golang.org/x/net/http2
+* golang.org/x/net/websocket
+* https://github.com/tatsuhiro-t/go-nghttp2
+
+Go modules will download these dependencies automatically.
+
+To run the tests, run the following command under
+``integration-tests`` directory:
+
+.. code-block:: text
+
+ $ make it
+
+Inside the tests, we use port 3009 to run the test subject server.
+
+Migration from v0.7.15 or earlier
+---------------------------------
+
+nghttp2 v1.0.0 introduced several backward incompatible changes. In
+this section, we describe these changes and how to migrate to v1.0.0.
+
+ALPN protocol ID is now ``h2`` and ``h2c``
+++++++++++++++++++++++++++++++++++++++++++
+
+Previously we announced ``h2-14`` and ``h2c-14``. v1.0.0 implements
+final protocol version, and we changed ALPN ID to ``h2`` and ``h2c``.
+The macros ``NGHTTP2_PROTO_VERSION_ID``,
+``NGHTTP2_PROTO_VERSION_ID_LEN``,
+``NGHTTP2_CLEARTEXT_PROTO_VERSION_ID``, and
+``NGHTTP2_CLEARTEXT_PROTO_VERSION_ID_LEN`` have been updated to
+reflect this change.
+
+Basically, existing applications do not have to do anything, just
+recompiling is enough for this change.
+
+Use word "client magic" where we use "client connection preface"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+We use "client connection preface" to mean first 24 bytes of client
+connection preface. This is technically not correct, since client
+connection preface is composed of 24 bytes client magic byte string
+followed by SETTINGS frame. For clarification, we call "client magic"
+for this 24 bytes byte string and updated API.
+
+* ``NGHTTP2_CLIENT_CONNECTION_PREFACE`` was replaced with
+ ``NGHTTP2_CLIENT_MAGIC``.
+* ``NGHTTP2_CLIENT_CONNECTION_PREFACE_LEN`` was replaced with
+ ``NGHTTP2_CLIENT_MAGIC_LEN``.
+* ``NGHTTP2_BAD_PREFACE`` was renamed as ``NGHTTP2_BAD_CLIENT_MAGIC``
+
+The already deprecated ``NGHTTP2_CLIENT_CONNECTION_HEADER`` and
+``NGHTTP2_CLIENT_CONNECTION_HEADER_LEN`` were removed.
+
+If application uses these macros, just replace old ones with new ones.
+Since v1.0.0, client magic is sent by library (see next subsection),
+so client application may just remove these macro use.
+
+Client magic is sent by library
++++++++++++++++++++++++++++++++
+
+Previously nghttp2 library did not send client magic, which is first
+24 bytes byte string of client connection preface, and client
+applications have to send it by themselves. Since v1.0.0, client
+magic is sent by library via first call of ``nghttp2_session_send()``
+or ``nghttp2_session_mem_send()``.
+
+The client applications which send client magic must remove the
+relevant code.
+
+Remove HTTP Alternative Services (Alt-Svc) related code
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+Alt-Svc specification is not finalized yet. To make our API stable,
+we have decided to remove all Alt-Svc related API from nghttp2.
+
+* ``NGHTTP2_EXT_ALTSVC`` was removed.
+* ``nghttp2_ext_altsvc`` was removed.
+
+We have already removed the functionality of Alt-Svc in v0.7 series
+and they have been essentially noop. The application using these
+macro and struct, remove those lines.
+
+Use nghttp2_error in nghttp2_on_invalid_frame_recv_callback
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+Previously ``nghttp2_on_invalid_frame_recv_cb_called`` took the
+``error_code``, defined in ``nghttp2_error_code``, as parameter. But
+they are not detailed enough to debug. Therefore, we decided to use
+more detailed ``nghttp2_error`` values instead.
+
+The application using this callback should update the callback
+signature. If it treats ``error_code`` as HTTP/2 error code, update
+the code so that it is treated as ``nghttp2_error``.
+
+Receive client magic by default
++++++++++++++++++++++++++++++++
+
+Previously nghttp2 did not process client magic (24 bytes byte
+string). To make it deal with it, we had to use
+``nghttp2_option_set_recv_client_preface()``. Since v1.0.0, nghttp2
+processes client magic by default and
+``nghttp2_option_set_recv_client_preface()`` was removed.
+
+Some application may want to disable this behaviour, so we added
+``nghttp2_option_set_no_recv_client_magic()`` to achieve this.
+
+The application using ``nghttp2_option_set_recv_client_preface()``
+with nonzero value, just remove it.
+
+The application using ``nghttp2_option_set_recv_client_preface()``
+with zero value or not using it must use
+``nghttp2_option_set_no_recv_client_magic()`` with nonzero value.
+
+Client, Server and Proxy programs
+---------------------------------
+
+The ``src`` directory contains the HTTP/2 client, server and proxy programs.
+
+nghttp - client
++++++++++++++++
+
+``nghttp`` is a HTTP/2 client. It can connect to the HTTP/2 server
+with prior knowledge, HTTP Upgrade and NPN/ALPN TLS extension.
+
+It has verbose output mode for framing information. Here is sample
+output from ``nghttp`` client:
+
+.. code-block:: text
+
+ $ nghttp -nv https://nghttp2.org
+ [ 0.190] Connected
+ The negotiated protocol: h2
+ [ 0.212] recv SETTINGS frame
+ (niv=2)
+ [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100]
+ [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535]
+ [ 0.212] send SETTINGS frame
+ (niv=2)
+ [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100]
+ [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535]
+ [ 0.212] send SETTINGS frame
+ ; ACK
+ (niv=0)
+ [ 0.212] send PRIORITY frame
+ (dep_stream_id=0, weight=201, exclusive=0)
+ [ 0.212] send PRIORITY frame
+ (dep_stream_id=0, weight=101, exclusive=0)
+ [ 0.212] send PRIORITY frame
+ (dep_stream_id=0, weight=1, exclusive=0)
+ [ 0.212] send PRIORITY frame
+ (dep_stream_id=7, weight=1, exclusive=0)
+ [ 0.212] send PRIORITY frame
+ (dep_stream_id=3, weight=1, exclusive=0)
+ [ 0.212] send HEADERS frame
+ ; END_STREAM | END_HEADERS | PRIORITY
+ (padlen=0, dep_stream_id=11, weight=16, exclusive=0)
+ ; Open new stream
+ :method: GET
+ :path: /
+ :scheme: https
+ :authority: nghttp2.org
+ accept: */*
+ accept-encoding: gzip, deflate
+ user-agent: nghttp2/1.0.1-DEV
+ [ 0.221] recv SETTINGS frame
+ ; ACK
+ (niv=0)
+ [ 0.221] recv (stream_id=13) :method: GET
+ [ 0.221] recv (stream_id=13) :scheme: https
+ [ 0.221] recv (stream_id=13) :path: /stylesheets/screen.css
+ [ 0.221] recv (stream_id=13) :authority: nghttp2.org
+ [ 0.221] recv (stream_id=13) accept-encoding: gzip, deflate
+ [ 0.222] recv (stream_id=13) user-agent: nghttp2/1.0.1-DEV
+ [ 0.222] recv PUSH_PROMISE frame