curl/docs/libcurl/opts, branch gemini-meta

setopt: support certificate options in memory with struct curl_blob

2020-05-15T11:03:59+00:00

This change introduces a generic way to provide binary data in setopt
options, called BLOBs.

This change introduces these new setopts:

CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB,
CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB.

Reviewed-by: Daniel Stenberg
Closes #5357

OpenSSL: have CURLOPT_CRLFILE imply CURLSSLOPT_NO_PARTIALCHAIN

2020-05-13T14:39:36+00:00

... to avoid an OpenSSL bug that otherwise makes the CRL check to fail.

Reported-by: Michael Kaufmann
Fixes #5374
Closes #5376

CURLOPT_SSL_OPTIONS: add *_NATIVE_CA to use Windows CA store (with openssl)

2020-05-08T13:55:04+00:00

Closes #4346

doc: add missing closing parenthesis in CURLINFO_SSL_VERIFYRESULT.3

2020-05-02T10:03:20+00:00

Closes #5320

GnuTLS: Backend support for CURLINFO_SSL_VERIFYRESULT

2020-04-30T12:40:54+00:00

Closes #5287

mqtt: add new experimental protocol

2020-04-14T11:03:40+00:00

Closes #5173

CURLOPT_WRITEFUNCTION.3: add inline example and new see-also

2020-04-06T22:07:49+00:00

Closes #5192

CURLINFO_CONDITION_UNMET: return true for 304 http status code

2020-04-05T09:13:49+00:00

In libcurl, CURLINFO_CONDITION_UNMET is used to avoid writing to the
output file if the server did not transfered a file based on time
condition. In the same manner, getting a 304 HTTP response back from the
server, for example after passing a custom If-Match-* header, also
fulfill this condition.

Fixes #5181
Closes #5183

copyright: fix out-of-date copyright ranges and missing headers

2020-03-24T14:05:59+00:00

Reported by the new script 'scripts/copyright.pl'. The script has a
regex whitelist for the files that don't need copyright headers.

Removed three (mostly usesless) README files from docs/

Closes #5141

schannel: add "best effort" revocation check option

2020-03-18T07:23:39+00:00

- Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and
  --ssl-revoke-best-effort to allow a "best effort" revocation check.

A best effort revocation check ignores errors that the revocation check
was unable to take place. The reasoning is described in detail below and
discussed further in the PR.

---

When running e.g. with Fiddler, the schannel backend fails with an
unhelpful error message:

	Unknown error (0x80092012) - The revocation function was unable
	to check revocation for the certificate.

Sadly, many enterprise users who are stuck behind MITM proxies suffer
the very same problem.

This has been discussed in plenty of issues:
https://github.com/curl/curl/issues/3727,
https://github.com/curl/curl/issues/264, for example.

In the latter, a Microsoft Edge developer even made the case that the
common behavior is to ignore issues when a certificate has no recorded
distribution point for revocation lists, or when the server is offline.
This is also known as "best effort" strategy and addresses the Fiddler
issue.

Unfortunately, this strategy was not chosen as the default for schannel
(and is therefore a backend-specific behavior: OpenSSL seems to happily
ignore the offline servers and missing distribution points).

To maintain backward-compatibility, we therefore add a new flag
(`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option
(`--ssl-revoke-best-effort`) to select the new behavior.

Due to the many related issues Git for Windows and GitHub Desktop, the
plan is to make this behavior the default in these software packages.

The test 2070 was added to verify this behavior, adapted from 310.

Based-on-work-by: georgeok 
Co-authored-by: Markus Olsson 
Signed-off-by: Johannes Schindelin 

Closes https://github.com/curl/curl/pull/4981