Subject: [bug#78337] [PATCH v2 2/6] gnu: curl: Update to 8.13.0 and ungraft [fixes CVE-2025-0725].

From: Efraim Flashner <[email-masked]>
Date: Wed, 21 May 2025 12:15:24 +0300

On Wed, May 21, 2025 at 06:11:44PM +0900, Maxim Cournoyer wrote:
> Hi,
> 
> Efraim Flashner <[email-masked]> writes:
> 
> > On Tue, May 20, 2025 at 12:26:30PM +0900, Maxim Cournoyer wrote:
> >> Hi,
> >> 
> >> Maxim Cournoyer <[email-masked]> writes:
> >> 
> >> > * gnu/packages/curl.scm (curl): Update to 8.13.0.
> >> 
> >> A note: this breaks rust-1.82, which fails to detect curl.  Apparently
> >> that happens via one of its bundled crates (curl-sys), so I suppose we'd
> >> need to patch it with a fresher one.  I'm not sure what is the right
> >> approach or how to do that, so I'm adding the rust team in CC for input.
> >> 
> >
> > I'm currently unable to build cmake-bootstrap-3.24.2 with this patch
> > applied.  Am I missing some patches?
> 
> I've taken this from a branch that had a couple other commits, but I don't see what would
> impact cmake.  What does the build error say?

This is with just this patch and the curl+zstd:lib patch on
core-packages-team.

[ 25%] Building CXX object Source/CMakeFiles/CMakeLib.dir/cmDocumentation.cxx.o
cd /tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source && /gnu/store/1an62gxdvfx7sg8wh5hhvp0j1pg0k0w5-gcc-14.2.0/bin/g++  -I/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source -I/tmp/guix-build-cmake-bootstrap-3.2
4.2.drv-0/cmake-3.24.2/Source/LexerParser -I/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/CTest -I/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/CPack -isystem /tmp/guix-build-cmake-bootstrap-3.24.2.drv
-0/cmake-3.24.2/Utilities/std -isystem /tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Utilities -O3 -DNDEBUG -Wno-deprecated-declarations -std=c++17 -MD -MT Source/CMakeFiles/CMakeLib.dir/cmDocumentation.cxx.o -MF CMakeFiles/CMa
keLib.dir/cmDocumentation.cxx.o.d -o CMakeFiles/CMakeLib.dir/cmDocumentation.cxx.o -c /tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmDocumentation.cxx
In file included from /tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Utilities/cm3p/curl/curl.h:8,
                 from /tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmCurl.h:9,
                 from /tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmCurl.cxx:3:
/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmCurl.cxx: In function ‘std::string cmCurlSetNETRCOption(CURL*, const std::string&, const std::string&)’:
/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmCurl.cxx:86:26: error: invalid conversion from ‘long int’ to ‘CURL_NETRC_OPTION’ [-fpermissive]
   86 |       curl_netrc_level = CURL_NETRC_OPTIONAL;
      |                          ^~~~~~~~~~~~~~~~~~~
      |                          |
      |                          long int
/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmCurl.cxx:88:26: error: invalid conversion from ‘long int’ to ‘CURL_NETRC_OPTION’ [-fpermissive]
   88 |       curl_netrc_level = CURL_NETRC_REQUIRED;
      |                          ^~~~~~~~~~~~~~~~~~~
      |                          |
      |                          long int
/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2/Source/cmCurl.cxx:90:26: error: invalid conversion from ‘long int’ to ‘CURL_NETRC_OPTION’ [-fpermissive]
   90 |       curl_netrc_level = CURL_NETRC_IGNORED;
      |                          ^~~~~~~~~~~~~~~~~~
      |                          |
      |                          long int
make[2]: Leaving directory '/tmp/guix-build-cmake-bootstrap-3.24.2.drv-0/cmake-3.24.2'

-- 
Efraim Flashner   <[email-masked]>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted