contrib/make-release: Update regexes to match the NEWS file

* doc/wget.texi: Update option '--html-extension' to '--adjust-extension'.
  Renamed in Wget 1.12 to better reflect its behavior.

Copyright-paperwork-exempt: Yes

.gitignore

@@ -1,7 +1,8 @@
+/ABOUT-NLS~
 # Project Root
-/.sc-start-sc_bindtextdomain
-/.sc-start-sc_prohibit_HAVE_MBRTOWC
+/.sc-start-*
 /.version
+/ABOUT-NLS
 /GNUmakefile
 /INSTALL
 /Makefile
@@ -13,16 +14,27 @@
 /config.status
 /configure
 /lib/
+!/lib/Makefile.am
 /maint.mk
+/gnulib_po/
+/aminclude_static.am
 # Wildcard Ignores
 *~
 po/*.gmo*
 po/*.po*
 src/*.o
+tests/*.log
+tests/*.trs
 testenv/*.log
 testenv/*.trs
+fuzz/*
+!fuzz/*.*
+fuzz/*.o
+fuzz/*.log
+fuzz/*.trs
 # build-aux/
 build-aux/.gitignore
+build-aux/ar-lib
 build-aux/compile
 build-aux/config.guess
 build-aux/config.sub
@@ -42,6 +54,7 @@ doc/version.texi
 doc/wget.1
 doc/wget.info
 doc/wget.pod
+doc/.gitignore
 # m4/
 m4/.gitignore
 m4/gnulib-cache.m4
@@ -54,6 +67,8 @@ po/Makefile.in
 po/Makevars
 po/POTFILES
 po/wget.pot
+po/stamp-po
+po/remove-potcdate.sed
 # src/
 src/.deps/
 src/Makefile
@@ -81,11 +96,17 @@ testenv/Makefile.in
 # tests/
 tests/Makefile
 tests/Makefile.in
-tests/WgetTest.pm
 tests/unit-tests
+tests/unit-tests.o
+tests/.deps/
+tests/certs/interca.conf
+tests/certs/rootca.conf
 # util/
 util/Makefile
 util/Makefile.in
+# fuzz/
+fuzz/.deps/
+fuzz/Makefile.in
 # others
 /tags
 /cscope.out

.gitlab-ci.yml

@@ -0,0 +1,496 @@
+# we utilize the images generated by the build-images project, to
+# speed up CI runs. We also use ccache and store config.cache
+# to speed up compilation.
+
+stages:
+    - test-from-git
+    - test-from-tarball
+    - deploy
+
+cache:
+  key: "$CI_JOB_NAME"
+  paths:
+    - cache/
+
+before_script:
+  # CCache Config
+  - mkdir -p cache
+  - export CCACHE_BASEDIR=${PWD}
+  - export CCACHE_DIR=${PWD}/cache
+  - echo $CCACHE_DIR
+  - export CC="ccache gcc"
+
+after_script:
+  # somehow after_script loses environment
+  - export CCACHE_BASEDIR=${PWD}
+  - export CCACHE_DIR=${PWD}/cache
+  - if type -p ccache >/dev/null; then ccache -s; fi
+
+variables:
+  BUILD_IMAGES_PROJECT: gnuwget/build-images
+  CI_BASE_PATH: $CI_REGISTRY/$BUILD_IMAGES_PROJECT/wget
+  DEBIAN_OLDSTABLE_BUILD: buildenv-debian-oldstable
+  DEBIAN_TESTING_BUILD: buildenv-debian-testing
+  DEBIAN_STABLE_BUILD: buildenv-debian-stable
+  CENTOS_OLDLTS_BUILD: buildenv-centos7
+  FEDORA_BUILD: buildenv-fedora
+  MINGW_BUILD: buildenv-mingw
+  ARCH_BUILD: buildenv-arch
+  GET_SOURCES_ATTEMPTS: "3"
+  GIT_DEPTH: "5"
+  CONFIGURE_BASE_FLAGS: --enable-assert --cache-file cache/config.cache
+  CFLAGS_DEFAULT: -O0 -g -ggdb3
+
+# Create the tarball in a separate build directory (VPATH).
+Build-Tarball:
+    stage: test-from-git
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - ./bootstrap
+        - autoreconf -fi
+        - mkdir vpath && cd vpath
+        - ../configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --without-ssl --enable-ipv6 --without-zlib --without-libiconv-prefix
+          --disable-iri --disable-ntlm --disable-pcre --without-libpsl --without-libuuid
+          --without-libintl-prefix
+        - make -j$(nproc)
+        - make -j$(nproc) syntax-check
+        - make -j$(nproc) dist
+        - mv wget-*.gz ..
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - ./*.log
+            - vpath/*.log
+            - vpath/fuzz/*.log
+            - vpath/tests/*.log
+            - vpath/testenv/*.log
+    artifacts:
+        expire_in: 2 weeks
+        when: on_success
+        paths:
+            - wget-*.gz
+
+Valgrind:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+        - make check-valgrind
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+Minimal:
+    stage: test-from-tarball
+    image: $CI_BASE_PATH/debian:testing-minimal
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --disable-nls --without-ssl --enable-ipv6 --without-zlib --without-libiconv-prefix
+          --disable-iri --disable-ntlm --disable-pcre --without-libpsl --without-libuuid
+          --without-libintl-prefix
+        - make -j$(nproc) check-valgrind
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+Debian-OldStable:
+    stage: test-from-tarball
+    image: $CI_BASE_PATH/debian:oldstable
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+        - make
+        - make -j$(nproc) check
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+Debian-Stable:
+    stage: test-from-tarball
+    image: $CI_BASE_PATH/debian:stable
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+        - make -j$(nproc) check
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+CentOS-OldLTS:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS_OLDLTS_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+        - make -j$(nproc)
+        - make -j$(nproc) check
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+    # The test suite is currently broken, so a temporary allowance
+    allow_failure: true
+
+TLS/OpenSSL:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
+        - cat /etc/hosts
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache --with-ssl=openssl
+        - make -j$(nproc)
+        - make -j$(nproc) check-valgrind
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+TLS/GnuTLS:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
+        - cat /etc/hosts
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache --with-ssl=gnutls
+        - make -j$(nproc)
+        - make -j$(nproc) check-valgrind
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+Sanitizers:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+#       - export CFLAGS="$CFLAGS_DEFAULT -Werror"
+        - export CFLAGS="$CFLAGS_DEFAULT"
+        - export CC="ccache clang"
+        - export UBSAN_OPTIONS=print_stacktrace=1
+        - export ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer
+#       - export LSAN_OPTIONS=suppressions="$PWD/tests/clang-asan-suppressions"
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+            --enable-fsanitize-asan --enable-fsanitize-ubsan
+        - make -j$(nproc) check
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+
+Scan-Build:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - scan-build ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+        - make -C lib -j$(nproc)
+        - make -C src css_.o
+        - scan-build -v -enable-checker nullability --keep-empty --status-bugs -o ../scan-build make -j$(nproc)
+    tags:
+        - shared
+        - linux
+    except:
+        - tags
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - scan-build/
+    # scan-build reports two false positives that we can't suppress
+    allow_failure: true
+
+CoverageReports:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+        - make -j$(nproc) check-coverage
+        - mv lcov ../test-coverage
+        - make -C doc html
+        - make -j$(nproc) fuzz-coverage
+        - mv lcov ../fuzz-coverage
+        - make dist
+    tags:
+        - shared
+        - linux
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        when: on_success
+        paths:
+            - test-coverage/
+            - fuzz-coverage/
+    only:
+        - master
+
+MinGW64:
+    stage: test-from-tarball
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$MINGW_BUILD
+    variables:
+        GIT_STRATEGY: none
+    script:
+        - export CFLAGS=$CFLAGS_DEFAULT
+        - tar xvf wget-*.gz
+        - cd wget-*/
+        - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc
+        - echo ':DOSWin:M::MZ::/usr/bin/wine:' > /proc/sys/fs/binfmt_misc/register
+        - export CC="ccache $PREFIX-gcc"
+        - export GCCLIB=$(dirname $(find /usr/lib/gcc/$PREFIX -name libgcc_s_seh-1.dll|grep posix))
+        - export WINEPATH="$WINEPATH;/usr/$PREFIX/bin;/usr/$PREFIX/lib;$PWD/libwget/.libs;$GCCLIB"
+        - echo "WINEPATH=$WINEPATH"
+        - LIBS="-ldl -lpsapi" ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+            --build=x86_64-pc-linux-gnu --host=$PREFIX --enable-shared
+        - make -j$(nproc)
+        - cp -p src/wget.exe src/wget
+        - make check -j$(nproc) LOG_COMPILER=wine
+    tags:
+        - shared
+        - linux
+    except:
+        - tags
+        - coverity-scan@gnuwget/wget
+    dependencies:
+        - Build-Tarball
+    needs: ["Build-Tarball"]
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - wget-*/./config.h
+            - wget-*/./*.log
+            - wget-*/fuzz/*.log
+            - wget-*/tests/*.log
+            - wget-*/testenv/*.log
+    # The MinGW64 build breaks quite often, mostly due to dependencies.
+    allow_failure: true
+
+# Build from git should work on Arch.
+ArchLinux:
+    stage: test-from-git
+    image: $CI_BASE_PATH/archlinux
+    script:
+        - export CFLAGS="$CFLAGS_DEFAULT"
+        - ./bootstrap
+        - autoreconf -fi
+        - touch .manywarnings
+        - ./configure $CONFIGURE_BASE_FLAGS
+        - make -j$(nproc)
+        - make check -j$(nproc)
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    needs: []
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - ./*.log
+            - fuzz/*.log
+            - tests/*.log
+            - testenv/*.log
+
+# Build from git should work on Fedora.
+Fedora:
+    stage: test-from-git
+    image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+    script:
+        - export CFLAGS="$CFLAGS_DEFAULT"
+        - ./bootstrap
+        - autoreconf -fi
+        - touch .manywarnings
+        - ./configure $CONFIGURE_BASE_FLAGS
+        - make -j$(nproc) check
+    tags:
+        - shared
+        - linux
+    except:
+        - coverity-scan@gnuwget/wget
+    needs: []
+    artifacts:
+        expire_in: 2 weeks
+        when: on_failure
+        paths:
+            - ./*.log
+            - fuzz/*.log
+            - tests/*.log
+            - testenv/*.log
+
+
+pages:
+    stage: deploy
+    script:
+        - mkdir -p public
+        - rm -rf public/reference public/coverage public/fuzz-coverage
+        - mv wget-*.gz public/wget-latest.tar.gz
+        - mv test-coverage public/coverage
+        - mv fuzz-coverage public/fuzz-coverage
+    dependencies:
+        - CoverageReports
+        - Build-Tarball
+    artifacts:
+        when: on_success
+        paths:
+            - public
+    only:
+        - master

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "gnulib"]
 	path = gnulib
-	url = git://git.sv.gnu.org/gnulib.git
+	url = https://git.savannah.gnu.org/git/gnulib.git

.lgtm.yml

@@ -0,0 +1,8 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+        - libgpgme11-dev
+        - autoconf-archive
+    configure:
+      command: ./bootstrap && autoreconf -ivf && ./configure

.mailmap

@@ -0,0 +1,13 @@
+Tim Rühsen <tim.ruehsen@gmx.de> Tim Ruehsen <tim.ruehsen@gmx.de>
+Tim Rühsen <tim.ruehsen@gmx.de> rockdaboot <tim.ruehsen@gmx.de>
+Darshit Shah <darnir@gnu.org> <darnir@gmail.com>
+Darshit Shah <darnir@gnu.org> <darnir@reniac.com>
+Ander Juaristi <ajuaristi@gmx.es> <a@juaristi.eus>
+Ander Juaristi <ajuaristi@gmx.es> Ander Juaristi Alamos <ajuaristi@gmx.es>
+Micah Cowan <micah@cowan.name> micah <devnull@localhost>
+Steven Schubiger <stsc@members.fsf.org> Steven Schubiger <stsc@member.fsf.org>
+Steven Schubiger <stsc@members.fsf.org> <schubiger@gmail.com>
+Giuseppe Scrivano <gscrivano@gnu.org> <gscrivan@redhat.com>
+Gisle Vanem <gisle.vanem@gmail.com> <gvanem@yahoo.no>
+Gisle Vanem <gisle.vanem@gmail.com> <gvanem@broadpark.no>
+Gisle Vanem <gisle.vanem@gmail.com> <giva@bgnett.no>

.prev-version

@@ -0,0 +1 @@
+1.21.3

.travis.yml

@@ -0,0 +1,51 @@
+sudo: no
+dist: trusty
+
+language: c
+
+compiler:
+    - gcc
+
+notifications:
+    email:
+        recipients:
+            - darnir@gmail.com
+            - wget-dev@gnu.org
+        on_success: change
+        on_failure: always
+
+env:
+    global:
+        - PERLLIB=$PERLLIB:../../tests
+        - PERL5LIB=$PERL5LIB:../../tests
+    matrix:
+        - SSL=""
+        - SSL="openssl"
+        - SSL="gnutls"
+
+addons:
+    apt:
+        packages:
+            - automake
+            - autoconf
+            - autopoint
+            - flex
+            - texinfo
+            - pkg-config
+            - libgnutls-dev
+            - libssl-dev
+            - make
+            - libhttp-daemon-perl
+            - libio-socket-ssl-perl
+            - libidn2-dev
+            - gettext
+            - texlive
+            - python3
+            - valgrind
+            - language-pack-tr
+            - language-pack-ru
+
+script:
+    - make distclean || true
+    - ./bootstrap
+    - ./contrib/travis-ci $SSL

AUTHORS

@@ -55,4 +55,8 @@ Ted Mielczarek.  Support for parsing links from CSS.
 
 Saint Xavier.  Support for IRIs (RFC 3987).
 
-Giuseppe Scrivano.  Added support for HTTP/1.1.  Current Wget maintainer.
+Giuseppe Scrivano.  Added support for HTTP/1.1.  Active Wget Maintainer from 2010-2015.
+
+Tim Ruehsen.  Active Wget Maintainer / Developer from 2012-2020.
+
+Darshit Shah.  Active Wget Maintainer / Developer from 2013-2020.

CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Wget Contribution Guidelines
+
+1.  [Guidelines For Patch
+    Submissions](#Guidelines_For_Patch_Submissions)
+    1.  [What is a patch ?](#What_is_a_patch.3F)
+    2.  [Where to send the patches](#Where_to_send_the_patches)
+    3.  [Standards and coding style](#Standards_and_coding_style)
+
+
+Guidelines For Patch Submissions {#Guidelines_For_Patch_Submissions}
+================================
+
+What is a patch ? {#What_is_a_patch.3F}
+-----------------
+
+A patch file, also known as a \"diff\", is a textual representation of
+changes to source code. Patches are readable enough
+to be reviewed by []{#line-9 .anchor}humans and at the same time regular
+enough to be processed by programs. The `patch`
+utility is used to change the source code in the
+manner that the patch describes, this being called \"applying\" the
+patch. Patches work even on files that have been
+modified independently of the modifications in the
+patch, as long as those other changes do not
+conflict with the patch.
+
+Because of these properties, patches are the preferred means of
+distributing the changes to a free software project.
+If you have made a change to Wget and would like to
+contribute it, you will need to create a patch and
+send it to the developers; please read on.
+
+Where to send the patches {#Where_to_send_the_patches}
+-------------------------
+
+Patches intended to be applied to Wget should be mailed to
+bug-wget@gnu.org. Each patch will be reviewed by the
+developers, and will be acked and added to the
+distribution, or rejected with an explanation.
+Unfortunately, the developers are often busy with
+their day jobs, so the review process can take a while.
+
+*Every* patch should be accompanied by an explanation of what the patch
+changes, and why the change is desirable or
+necessary. The explanation need not be long, but
+please don\'t just send a patch without any
+accompanying text.
+
+Please send your patches as email attachments. It is important that the
+patch survives the travel unchanged so that we can feed it to
+the `patch` utility or `git am/apply` after or while reviewing it.
+
+
+Standards and coding style {#Standards_and_coding_style}
+--------------------------
+
+Wget abides by the GNU coding standards, available at:
+
+-   https://www.gnu.org/prep/standards.html
+
+But maybe even better is to stay with the surrounding coding style.
+
+When working with git: The commit messages needs a certain GNU style
+format. Please check `git log` for examples. The maintainers might
+correct small issues here before pushing / applying without asking.

COPYING

@@ -1,7 +1,7 @@
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007, 2023 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -645,7 +645,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
@@ -664,11 +664,11 @@ might be different; for a GUI interface, you would use an "about box".
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.
 
   The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+<https://www.gnu.org/philosophy/why-not-lgpl.html>.

ChangeLog.README

@@ -1,16 +0,0 @@
-Please note that Wget has more than one ChangeLog file:
-
-    ./ChangeLog: documents changes to files in the top-level directory
-                 and to files in subdirectories like po/ that don't have
-                 their own ChangeLogs
-
-    src/ChangeLog: documents only changes to files in the src directory
-
-    doc/ChangeLog: documents only changes to files in the doc directory
-
-    windows/ChangeLog: documents only changes to files in the windows directory
-
-    msdos/ChangeLog: documents only changes to files in the msdos directory
-
-When checking to see if a patch you sent in has been applied, please
-look in the appropriate ChangeLog(s).

MAILING-LIST

@@ -7,30 +7,14 @@ Primary List
 The primary mailinglist for discussion, bug-reports, or questions about
 GNU Wget is at <bug-wget@gnu.org>. To subscribe, send an email to
 <bug-wget-join@gnu.org>, or visit
-`http://lists.gnu.org/mailman/listinfo/bug-wget'.
+`https://lists.gnu.org/mailman/listinfo/bug-wget'.
 
    You do not need to subscribe to send a message to the list; however,
 please note that unsubscribed messages are moderated, and may take a
 while before they hit the list--*usually around a day*.  If you want
 your message to show up immediately, please subscribe to the list
 before posting. Archives for the list may be found at
-`http://lists.gnu.org/pipermail/bug-wget/'.
-
-   An NNTP/Usenettish gateway is also available via Gmane
-(http://gmane.org/about.php). You can see the Gmane archives at
-`http://news.gmane.org/gmane.comp.web.wget.general'. Note that the
-Gmane archives conveniently include messages from both the current
-list, and the previous one. Messages also show up in the Gmane archives
-sooner than they do at `lists.gnu.org'.
-
-Bug Notices List
-----------------
-
-Additionally, there is the <wget-notify@addictivecode.org> mailing
-list. This is a non-discussion list that receives bug report
-notifications from the bug-tracker. To subscribe to this list, send an
-email to <wget-notify-join@addictivecode.org>, or visit
-`http://addictivecode.org/mailman/listinfo/wget-notify'.
+`https://lists.gnu.org/pipermail/bug-wget/'.
 
 Obsolete Lists
 --------------
@@ -40,10 +24,7 @@ discussion list, and another list, <wget-patches@sunsite.dk> was used
 for submitting and discussing patches to GNU Wget.
 
    Messages from <wget@sunsite.dk> are archived at
-     `http://www.mail-archive.com/wget%40sunsite.dk/' and at
-
-     `http://news.gmane.org/gmane.comp.web.wget.general' (which also
-     continues to archive the current list, <bug-wget@gnu.org>).
+     `https://www.mail-archive.com/wget%40sunsite.dk/' and at
 
    Messages from <wget-patches@sunsite.dk> are archived at
-     `http://news.gmane.org/gmane.comp.web.wget.patches'.
+     `https://news.gmane.org/gmane.comp.web.wget.patches'.

Makefile.am

@@ -1,6 +1,5 @@
 # Makefile for `Wget' utility
-# Copyright (C) 1995, 1996, 1997, 2006, 2007, 2008, 2009, 2010, 2011
-# Free Software Foundation, Inc.
+# Copyright (C) 1995-1997, 2006-2023 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -13,7 +12,7 @@
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # Additional permission under GNU GPL version 3 section 7
 
@@ -27,7 +26,7 @@
 # as that of the covered work.
 
 #
-# Version: $(VERSION)
+# Version: @VERSION@
 #
 
 
@@ -41,14 +40,15 @@ distuninstallcheck_listfiles = find . -type f | \
 ACLOCAL_AMFLAGS = -I m4
 
 # subdirectories in the distribution
-SUBDIRS = lib src doc po tests util testenv
+SUBDIRS = lib src doc po gnulib_po util fuzz tests testenv
 
-EXTRA_DIST = ChangeLog.README MAILING-LIST \
-             msdos/ChangeLog msdos/config.h msdos/Makefile.DJ \
+EXTRA_DIST = MAILING-LIST \
+             msdos/config.h msdos/Makefile.DJ \
              msdos/Makefile.WC ABOUT-NLS \
              build-aux/build_info.pl build-aux/git-version-gen .version
 
 CLEANFILES = *~ *.bak $(DISTNAME).tar.gz
+DISTCLEANFILES = po/stamp-po gnulib_po/stamp-po
 
 BUILT_SOURCES = .version
 
@@ -60,5 +60,50 @@ clean-generic:
 
 # Arrange so that .tarball-version appears only in the distribution
 # tarball, and never in a checked-out repository.
-dist-hook:
+dist-hook: gen-ChangeLog
 	$(AM_V_GEN)echo $(VERSION) > $(distdir)/.tarball-version
+
+gen_start_date = 2014-12-10
+.PHONY: gen-ChangeLog
+gen-ChangeLog:
+	$(AM_V_GEN)if test -d .git; then				\
+	  log_fix="$(srcdir)/build-aux/git-log-fix";			\
+	  test -e "$$log_fix"						\
+	    || amend_git_log=;						\
+	  $(top_srcdir)/build-aux/gitlog-to-changelog			\
+	    $$amend_git_log --since=$(gen_start_date) > $(distdir)/cl-t && \
+            echo >>  $(distdir)/cl-t &&                                 \
+            cat ChangeLog-2014-12-10 >>  $(distdir)/cl-t &&             \
+	    { rm -f $(distdir)/ChangeLog &&				\
+	      mv $(distdir)/cl-t $(distdir)/ChangeLog; }		\
+	fi
+
+check-valgrind:
+	TESTS_ENVIRONMENT="VALGRIND_TESTS=1" $(MAKE) check
+
+LCOV_INFO=wget.info
+
+clean-lcov:
+	rm -rf $(LCOV_INFO) */*.gc?? */.libs/*.gc?? lcov/
+	lcov --zerocounters --directory src/
+
+check-coverage: clean clean-lcov
+	$(MAKE) CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+	lcov --capture --initial --directory src/ --output-file $(LCOV_INFO)
+	$(MAKE) CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage" VALGRIND_TESTS=0 check
+	lcov --capture --directory src/ --output-file $(LCOV_INFO)
+	lcov --remove $(LCOV_INFO) '/usr/include/*' '*/lib/*' -o $(LCOV_INFO)
+	genhtml --prefix . --ignore-errors source $(LCOV_INFO) --legend --title "Wget" --output-directory=lcov
+	@echo
+	@echo "You can now view the coverage report with 'xdg-open lcov/index.html'"
+
+fuzz-coverage: clean clean-lcov
+	$(MAKE) -C lib
+	$(MAKE) -C src CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+	$(MAKE) -C fuzz check CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+	lcov --capture --initial --directory fuzz --directory src --output-file $(LCOV_INFO)
+	lcov --capture --directory fuzz --directory src --output-file $(LCOV_INFO)
+	lcov --remove $(LCOV_INFO) '/usr/include/*' '*/lib/*' -o $(LCOV_INFO)
+	genhtml --prefix . --ignore-errors source $(LCOV_INFO) --legend --title "Wget-fuzz" --output-directory=lcov
+	@echo
+	@echo "You can now view the coverage report with 'xdg-open lcov/index.html'"

NEWS

@@ -1,25 +1,358 @@
 GNU Wget NEWS -- history of user-visible changes.
 
-Copyright (C) 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
-2006, 2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation, Inc.
-See the end for copying conditions.
+* Noteworthy changes in release ?.? (????-??-??) [?]
 
-Please send GNU Wget bug reports to <bug-wget@gnu.org>.
-
-* Changes in Wget X.Y.Z
 
-** Use libpsl for verifying cookie domains
+* Noteworthy changes in release 1.21.4 (2023-05-11)
 
-** Default progress bar output changed
+** Document --retry-on-host-error in help text
 
-** Introduce --show-progress to force display the progress bar
+** Increase read buffer size to 64k. This should speed up downloads on gigabit and faster connections
 
-** Introduce --no-config.
+** Update deprecated option '--html-extension' to '--adjust-extension' in documentation
+
+** Update gnulib compatibility layer.
+   Fixes HSTS test failures on i686. (Thanks to Andreas Enge for ponting it out)
+
+
+* Noteworthy changes in release 1.21.3 (2022-02-26)
+
+** Fix computation of total bytes downloaded during FTP trasnfers (#61277)
+
+** Add option to select TLS 1.3 on the command line
+
+** Fix HSTS build issues on some 64-bit big-endian systems
+
+** Hide password during status report in --no-verbose
+
+** Remove a sprurious print statement that showed up even during --quiet
+
+** Some more cleanups and bug-fixes
+
+
+* Noteworthy changes in release 1.21.2 (2021-09-07)
+
+** Support for autoconf 2.71
+
+** Fix a double free in FTP when using an absolute path
+
+** Release tarballs no longer have a dependency on Python.
+
+** --page-requisites will now also download links marked as "alternate
+   stylesheet" or "icon"
+
+
+* Noteworthy changes in release 1.21.1 (2021-01-09)
+
+** Fix compilation on MacOS and Solaris 9
+
+** Resove bashism from configure.ac
+
+** Fix a compilation warning on 32-bit systems
+
+
+* Changes in Wget 1.21
+
+** Improve the number of translated strings
+
+** Remove all uses of alloca
+   In some places the length of untrusted strings has been used, e.g.
+   strings from the command line or from remote.
+
+** Fix buffer overflows in progress bar code in some locales
+
+** Fix two null pointer accesses
+
+** Amend cookie file header to be recognized by the 'file' command
+
+** Post Handshake Authentication for OpenSSL
+
+** Require gettext version 0.19.3+
+
+** Add configure flags --enable-fsanitize-ubsan, --enable-fsanitize-asan
+   and --enable-fsanitize-msan for gcc and clang
+
+** Make several smaller fixes, enhance fuzzing, enhance building
+
+
+* Changes in Wget 1.20.3
+
+** Fixed a buffer overflow vulnerability
+
+
+* Changes in Wget 1.20.2
+
+** NTLM authentication will retry under certain cases
+
+
+* Changes in Wget 1.20.1
+
+** --xattr is no longer default since it introduces privacy issues.
+
+** --xattr saves the Referer as scheme/host/port, user/pw/path/query/fragment
+   are no longer saved to prevent privacy issues.
+
+** --xattr saves the Original URL without user/password to prevent
+   privacy issues.
+
+
+* Changes in Wget 1.20
+
+** Add new option `--retry-on-host-error` to treat local errors as transient
+and hence Wget will retry to download the file after a brief waiting period.
+
+** Fixed multiple potential resource leaks as found by static analysis
+
+** Wget will now not create an empty wget-log file when running with -q and -b
+switches together
+
+** When compiled using the GnuTLS >= 3.6.3, Wget now has support for TLSv1.3
+
+** Now there is support for using libpcre2 for regex pattern matching
+
+** When downloading over FTP recursively, one can now use the
+--{accept,reject}-regex switches to fine-tune the downloaded files
+
+** Building Wget from the git sources now requires autoconf 2.63 or above.
+Building from the Tarballs works as it used to.
+
+
+* Changes in Wget 1.19.5
+
+* Fix cookie injection (CVE-2018-0494)
+
+* Enable TLS1.3 with recent OpenSSL environment
+
+* New option --ciphers to set GnuTLS / OpenSSL ciphers directly
+
+* Updated CSS grammar to CSS 2.2
+
+* Fixed several memleaks found by OSS-Fuzz
+
+* Fixed several buffer overflows found by OSS-Fuzz
+
+* Fixed several integer overflows found by OSS-Fuzz
+
+* Several minor bug fixes
+
+
+* Changes in Wget 1.19.4
+
+* A major bug that caused GZip'ed pages to never be decompressed has been fixed
+
+* Support for Content-Encoding and Transfer-Encoding have been marked as
+  experimental and disabled by default
+
+
+* Changes in Wget 1.19.3
+
+* Prevent erroneous decompression of .gz and .tgz files with broken servers
+
+* Added support for HTTP 308 Permanent Redirect response
+
+* Fix a segfault in some cases where the Content-Type header is not sent
+
+* Support OpenSSL 1.1 builds without using deprecated features
+
+* Fix netrc file detection on Windows
+
+* Several minor bug fixes
+
+
+* Changes in Wget 1.19.2
+
+* Fix CVE-2017-13089 (Stack overflow in HTTP protocol handling)
+
+* Fix CVE-2017-13090 (Heap overflow in HTTP protocol handling)
+
+* New option --compression for gzip Content-Encoding
+
+* New option --[no]-netrc to control .netrc parsing
+
+* Added GNU extensions to .netrc parsing
+
+* Improved IDNA 2003 compatibility
+
+* Fix VPATH issues
+
+* Improved and extended the test suite
+
+* Support Wayback Machine's X-Archive-Orig-last-modified
+
+* Several bug fixes
+
+
+* Changes in Wget 1.19.1
+
+* Fix bugs, a regression, portability/build issues
+
+* Add new option --retry-on-http-error
+
+
+* Changes in Wget 1.19
+
+* New option --use-askpass=COMMAND. Fetch user/password by calling
+  an external program.
+
+* Use IDNA2008 (+ TR46 if available) through libidn2
+
+* When processing a Metalink header, --metalink-index=<number> allows
+  to process the header's application/metalink4+xml files.
+
+* When processing a Metalink file, --trust-server-names enables the
+  use of the destination file names specified in the Metalink file,
+  otherwise a safe destination file name is computed.
+
+* When processing a Metalink file, enforce a safe destination path.
+  Remove any drive letter prefix under w32, i.e. 'C:D:file'.  Call
+  libmetalink's metalink_check_safe_path() to prevent absolute,
+  relative, or home paths:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* When processing a Metalink file, --directory-prefix=<prefix> sets
+  the top of the retrieval tree to prefix for Metalink downloads.
+
+* When processing a Metalink file, reject downloaded files which don't
+  agree with their own metalink:size value:
+  https://tools.ietf.org/html/rfc5854#section-4.2.16
+
+* When processing a Metalink file, with --continue resume partially
+  downloaded files and keep fully downloaded files even if they fail
+  the verification.
+
+* When processing a Metalink file, create the parent directories of a
+  "path/file" destination file name:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* On a recursive download, append a .tmp suffix to temporary files
+  that will be deleted after being parsed, and create them
+  readable/writable only by the owner.
+
+* New make target 'check-valgrind'
+
+* Fix several bugs
+
+* Fix compatibility issues
+
+* Changes in Wget 1.18
+
+* By default, on server redirects to a FTP resource, use the original
+  URL to get the local file name. Close CVE-2016-4971.  This
+  introduces a backward-incompatibility for HTTP->FTP redirects and
+  any script that relies on the old  behaviour must use
+  --trust-server-names.
+
+* Check the HSTS file is not world-writable before using it.
+
+* Parse <img srcset> attributes on a recursive download.
+
+* Fix problem with SNI server names having trailing dot(s)
+
+* New options --bind-dns-address and --dns-servers.
+
+* When Wget is built with libiconv, it now converts non-ASCII URIs to
+  the locale's codeset when it creates files.  The encoding of the
+  remote files and URIs is taken from --remote-encoding, defaulting to
+  UTF-8.  The result is that non-ASCII URIs and files downloaded via
+  HTTP/HTTPS and FTP will have names on the local filesystem that
+  correspond to their remote names.
+
+* Changes in Wget 1.17.1
+
+* Fix compile error when IPv6 is disabled or SSL is not present.
+
+* Fix HSTS memory leak.
+
+* Fix progress output in non-C locales.
+
+* Fix SIGSEGV when -N and --content-disposition are used together.
+
+* Add --check-certificate=quiet to tell wget to not print any warning about
+  invalid certificates.
+
+* Changes in Wget 1.17
+
+** Remove FTP passive to active fallback due to privacy concerns.
+
+** Add support for --if-modified-since.
+
+** Add support for metalink through --input-metalink and --metalink-over-http.
+
+** Add support for HSTS through --hsts and --hsts-file.
+
+** Add option to restrict filenames under VMS.
+
+** Add support for --rejected-log which logs to a separate file the reasons why
+   URLs are being rejected and some context around it.
+
+** Add support for FTPS.
+
+** Do not download/save file on error when --spider enabled
+
+** Add --convert-file-only option. This option converts only the
+   filename part of the URLs, leaving the rest of the URLs untouched.
+
+* Changes in Wget 1.16.3
+
+** Fix a regression introduced by wget 1.16.2 that --quiet is not
+   really quiet anymore.
+
+* Changes in Wget 1.16.2
+
+** Native uuid generation on Windows
+
+** Fix build on Solaris
+
+** Allow progress bar on stderr when -o is used
+
+** Accept 5-digit port numbers in FTP EPSV responses.
+
+** Support older versions of flex.
+
+** Updated translations.
+
+* Changes in Wget 1.16.1
+
+** Add --enable-assert configure option.
+
+** Use pkg-config to check for libraries presence.
+
+** Do not limit --secure-protocol=auto|pfs to TLSv1.0.
+
+** Add --secure-protocol=TLSv1_1|TLSv1_2 .
+
+** Full C89 source code compliance.
+
+** Select and use the most secure authentication scheme with HTTP connections.
+
+** Fix issues with turkish locales.
+
+** Handle 504 Gateway Timeout.
+
+** New option --crl-file to load Certificate Revocation Lists.
+
+** Add valgrind support to tests suite.
+
+** Fix an off-by-one problem in the progress bar (introduced in 1.16).
+
+* Changes in Wget 1.16
+
+** No longer create local symbolic links by default.  Closes CVE-2014-4877.
+
+** Use libpsl for verifying cookie domains.
+
+** Default progress bar output changed.
+
+** Introduce --show-progress to force display the progress bar.
+
+** Introduce --no-config.  The wgetrc files will not be read.
 
 ** Introduce --start-pos to allow starting downloads from a specified position.
 
 ** Fix a problem with ISA Server Proxy and keep-alive connections.
-
+
 * Changes in Wget 1.15
 
 ** Add support for --method.
@@ -51,7 +384,7 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 ** Specify Host with the HTTP CONNECT method.
 
 ** Use the correct HTTP method on a redirection.
-
+
 * Changes in Wget 1.14
 
 ** Add support for content-on-error.  It allows to store the HTTP
@@ -73,12 +406,12 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
 ** Add support for TLS Server Name Indication.
 
-** Accept the arguments --accept-reject and --reject-regex.
+** Accept the arguments --accept-regex and --reject-regex.
 
 ** The GNU TLS backend honors correctly the timeout value.
 
 ** Add support for RFC 2617 Digest Access Authentication.
-
+
 * Changes in Wget 1.13.4
 
 ** Now --version and --help work again.
@@ -91,7 +424,7 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
    is specified.
 
 ** Fix a segfault on an incomplete STYLE tag.
-
+
 * Changes in Wget 1.13.3
 
 ** Support HTTP/1.1
@@ -128,7 +461,7 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
    backward-incompatibility; any script that relies on the old
    behaviour must use --trust-server-names.
 
-** Fix a problem when -k is used and some URLs are specified trough
+** Fix a problem when -k is used and some URLs are specified through
    CSS.
 
 ** Convert correctly URLs that need to be encoded to local files when following
@@ -138,7 +471,7 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
 ** Print the total download time as part of the summary for recursive downloads.
 
-** Now it is possible to specify a different startup configuration file trough
+** Now it is possible to specify a different startup configuration file through
    the --config option.
 
 ** Fix an infinite loop with the error '<filename> has sprung into existence'
@@ -157,7 +490,7 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
 ** Introduce `show_all_dns_entries' to print all IP addresses corresponding to
    a DNS name when it is resolved.
-
+
 * Changes in Wget 1.12
 
 ** Mailing list MOVED to bug-wget@gnu.org
@@ -211,7 +544,7 @@ forces the percent-encoding of all non-ASCII bytes
 now documented: save_headers, spider, and user_agent,
 auth_no_challenge, and keep_session_cookies. Also added documentation
 for the "lowercase" and "uppercase" values for --restrict-file-names, which had been present since Wget 1.11.
-
+
 * Changes in Wget 1.11.4
 
 ** Fixed an issue (apparently a regression) where -O would refuse to
@@ -225,13 +558,13 @@ locally with content.
 to a pointer-to-time_t.
 
 ** Translation updates for Catalan.
-
+
 * Changes in Wget 1.11.3
 
 ** Downgraded -N with -O to a warning, rather than an error.
 
 ** Translation updates
-
+
 * Changes in Wget 1.11.2
 
 ** Fixed a problem in authenticating over HTTPS through a proxy.
@@ -253,7 +586,7 @@ multiple times. This has been fixed in 1.11.2.
 for improved conformance with RFC 3986. However, this behavior presents
 problems for some FTP setups, and so they are now preserved again, for
 FTP URLs only.
-
+
 * Changes in Wget 1.11.1.
 
 ** Interrupted downloads no longer result in renaming the file
@@ -275,7 +608,7 @@ be surprising, and notes that they may change in the future.
 
 ** Documentation of --no-parents now explains how a trailing slash, or
 lack thereof, in the specified URL, will affect behavior.
-
+
 * Changes in Wget 1.11.
 
 ** Timestamping now uses the value from the most recent HTTP response,
@@ -321,7 +654,7 @@ available at http://hg.addictivecode.org/. Prior to this, the source
 code was hosted on Subversion (migrated from the original CVS); you can
 still get access to older tags and branches for Wget in the Subversion
 repository at http://addictivecode.org/svn/wget/.
-
+
 * Changes in Wget 1.10.
 
 ** Downloading files larger than 2GB, sometimes referred to as "large
@@ -432,9 +765,9 @@ http_password and proxy_password respectively.  The login and passwd
 .wgetrc commands have been deprecated.
 
 * `wget -b' now works correctly under Windows.
-
+
 * Wget 1.9.1 is a bugfix release with no user-visible changes.
-
+
 * Changes in Wget 1.9.
 
 ** It is now possible to specify that POST method be used for HTTP
@@ -486,11 +819,11 @@ values "yes" and "no" along with the traditional "on" and "off".
 ** It is now possible to specify decimal values for timeouts, waiting
 periods, and download rate.  For instance, `--wait=0.5' now works as
 expected, as does `--dns-timeout=0.5' and even `--limit-rate=2.5k'.
-
+
 * Wget 1.8.2 is a bugfix release with no user-visible changes.
-
+
 * Wget 1.8.1 is a bugfix release with no user-visible changes.
-
+
 * Changes in Wget 1.8.
 
 ** A new progress indicator is now available and used by default.
@@ -542,7 +875,7 @@ addresses when accessing the first one fails.
 non-standard port.
 
 ** Wget now supports the robots.txt directives specified in
-<http://www.robotstxt.org/wc/norobots-rfc.txt>.
+<http://www.robotstxt.org/norobots-rfc.txt>.
 
 ** URL parser has been fixed, especially the infamous overzealous
 quoting.  Wget no longer dequotes reserved characters, e.g. `%3F' is
@@ -550,9 +883,9 @@ no longer translated to `?', nor `%2B' to `+'.  Unsafe characters
 which are not reserved are still escaped, of course.
 
 ** No more than 20 successive redirections are allowed.
-
+
 * Wget 1.7.1 is a bugfix release with no user-visible changes.
-
+
 * Changes in Wget 1.7.
 
 ** SSL (`https') pages now work if you compile Wget with SSL support;
@@ -594,7 +927,7 @@ large sites (thousands of documents).
 documentation.  (The last version that shipped with a man page was
 1.4.5).  To get this, you need to have pod2man from the Perl
 distribution installed on your system.
-
+
 * Changes in Wget 1.6
 
 ** Administrative changes.
@@ -645,13 +978,13 @@ passive_ftp is the only .wgetrc command which takes a lockable Boolean.
 bound to multiple IP addresses.
 
 ** wget now accepts (illegal per HTTP spec) relative URLs in HTTP redirects.
-
+
 * Wget 1.5.3 is a bugfix release with no user-visible changes.
-
+
 * Wget 1.5.2 is a bugfix release with no user-visible changes.
-
+
 * Wget 1.5.1 is a bugfix release with no user-visible changes.
-
+
 * Changes in Wget 1.5.0
 
 ** Wget speaks many languages!
@@ -697,11 +1030,11 @@ download.
 
 ** The manual page, now hopelessly out of date, is no longer
 distributed with Wget.
-
+
 * Wget 1.4.5 is a bugfix release with no user-visible changes.
-
+
 * Wget 1.4.4 is a bugfix release with no user-visible changes.
-
+
 * Changes in Wget 1.4.3
 
 ** Wget is now a GNU utility.
@@ -717,7 +1050,7 @@ distributed with Wget.
 ** Global wgetrc now goes to /usr/local/etc (i.e. $sysconfdir).
 
 ** Lots of bugfixes.
-
+
 * Changes in Wget 1.4.2
 
 ** New mirror site at ftp://sunsite.auc.dk/pub/infosystems/wget/,
@@ -735,7 +1068,7 @@ files.
 ** --convert-links should work now.
 
 ** Minor bugfixes.
-
+
 * Changes in Wget 1.4.1
 
 ** Minor bugfixes.
@@ -743,7 +1076,7 @@ files.
 ** Added -I (the opposite of -X).
 
 ** Dot tracing is now customizable; try wget --dot-style=binary
-
+
 * Changes in Wget 1.4.0
 
 ** Wget 1.4.0 [formerly known as Geturl] is an extensive rewrite of
@@ -824,7 +1157,7 @@ turn on mirroring options).
 ** Lots of small features I can't remember. :-)
 
 ** A host of bugfixes.
-
+
 * Changes in Geturl 1.3
 
 ** Added FTP globbing support (ftp://fly.cc.fer.hr/*)
@@ -842,9 +1175,9 @@ turn on mirroring options).
 ** Added support for robots.txt
 
 ** Fixed some minor bugs
-
+
 * Geturl 1.2 is a bugfix release with no user-visible changes.
-
+
 * Changes in Geturl 1.1
 
 ** REST supported in FTP
@@ -862,11 +1195,11 @@ geturl -vo log http://fly.cc.fer.hr/
 ** <base href="xxx"> supported
 
 ** autoconf supported
-
+
 ----------------------------------------------------------------------
 Copyright information:
 
-Copyright (C) 1997-2005 Free Software Foundation, Inc.
+Copyright (C) 1997-2023 Free Software Foundation, Inc.
 
    Permission is granted to anyone to make or distribute verbatim
    copies of this document as received, in any medium, provided that

README

@@ -1,7 +1,7 @@
                                                           -*- text -*-
 GNU Wget
 ========
-                  Current Web home: http://www.gnu.org/software/wget/
+                  Current Web home: https://www.gnu.org/software/wget/
 
 GNU Wget is a free utility for non-interactive download of files from
 the Web.  It supports HTTP, HTTPS, and FTP protocols, as well as
@@ -14,7 +14,7 @@ While doing that, Wget respects the Robot Exclusion Standard
 (/robots.txt).  Wget can be instructed to convert the links in
 downloaded HTML files to the local files for offline viewing.
 
-Recursive downloading also works with FTP, where Wget can retrieves a
+Recursive downloading also works with FTP, where Wget can retrieve a
 hierarchy of directories and files.
 
 With both HTTP and FTP, Wget can check whether a remote file has
@@ -50,18 +50,17 @@ resides at <ftp://ftp.gnu.org/pub/gnu/wget/>.
 Please report bugs in Wget to <bug-wget@gnu.org>.
 
 See the file `MAILING-LIST' for information about Wget mailing lists.
-Wget's home page is at <http://www.gnu.org/software/wget/>.
+Wget's home page is at <https://www.gnu.org/software/wget/>.
 
 If you would like to contribute code for Wget, please read
-http://wget.addictivecode.org/PatchGuidelines.
+CONTRIBUTING.md.
 
 Wget was originally written and mainained by Hrvoje Niksic.  Please see
 the file AUTHORS for a list of major contributors, and the ChangeLogs
 for a detailed listing of all contributions.
 
 
-Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
-2005, 2006, 2007, 2008, 2009 Free Software Foundation, Inc.
+Copyright (C) 1995-2023 Free Software Foundation, Inc.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

README.checkout

@@ -4,10 +4,11 @@ Compiling From Repository Sources
    does not contain automatically-generated files, even when these are
    normally present in the distribution tarballs. Therefore, to build GNU
    Wget from the sources in the repository, you'll need to have one or
-   more of the following (note that gettext, OpenSSL, libidn, libiconv
-   and libpsl are not absolutely required):
+   more of the following (note that gettext, OpenSSL, GnuTLS, libidn2,
+   libiconv, libpsl, libpcre, pkg-config, libmetalink and GnuPG are not
+   absolutely required):
 
-     * [20]autoconf (currently, GNU Wget requires version 2.61). This is
+     * [20]autoconf (currently, GNU Wget requires version 2.64). This is
        needed to generate the configure script from configure.in. This is
        not required when building from a tarball distribution; only when
        building from repository sources.
@@ -23,12 +24,18 @@ Compiling From Repository Sources
      * [23]Perl, if you wish to generate the wget(1) manpage, or run the
        tests in the tests/ sub directory. Tarball distributions include an
        already-generated wget.1 manual. The command "make check" runs the
-       test suite written in perl. To execute all the tests you need
-       [24]libwww-perl perl library. If "perl -MCPAN -e 'install
-       Bundle::LWP'" fails then you most likely don't have cpan module
-       installed. First download [25]CPAN and [26]install it. Then execute
-       "perl -MCPAN -e 'install Bundle::LWP'". Now "make check" should
-       pass most of the tests in the test suite.
+       test suite written in perl and python (see below). To execute all the tests
+       you need libwww-perl and libio-socket-ssl-perl perl library.
+       GNU/Linux distros likely have these two libraries packaged.
+       If not, install them directly with "perl -MCPAN -e 'install Bundle::LWP'"[24].
+       If that fails then you most likely don't have the CPAN module installed.
+       First download [25]CPAN and [26]install it, then try again the above command.
+       Now "make check" should pass most of the tests in the test suite.
+
+     * [45]Python3, if you want to run the tests in the testenv/ subdirectory.
+       Keep in mind that "make check" will try to run all the Perl and Python3
+       tests. More information about the test suite below in the section
+       "Testing and development".
 
      * [27]texinfo in order to generate Info, PostScript and/or HTML
        documentation. You don't need texinfo in order to generate the
@@ -46,35 +53,65 @@ Compiling From Repository Sources
        to export M4=<new m4 path>, to be sure that autoconf/automake use
        it instead of the old one.
 
-     * [29]OpenSSL to handle encrypted web sessions. You almost certainly
-       want this. It is not enough to have the library installed; you need
-       to have the header files available to compile against as well. For
-       GNU/Linux systems, this usually means installing a "developer"
-       package for openssl (for example, [30]Debian systems require
-       installation of the libssl-dev package). Alternatively, you can
-       compile GNU Wget against the [31]GNUTLS library instead, by
-       specifying --with-ssl=gnutls to the ./configure script; however,
-       building against GNUTLS is currently experimental, and not
-       officially supported. If you have OpenSSL and its development
-       headers installed, but don't want to build Wget with it, specify
-       --without-ssl to the ./configure script.
+     * [29]GnuTLS to allow encrypted data transfer (HTTPS).
+       You need the header files and the library installed.
+       As an alternative, you can use [30]OpenSSL by specifying
+       --with-ssl=openssl to the ./configure script.
+       If you do not want HTTPS support, specify --without-ssl to the
+       ./configure script.
+       If you want to compile+link a non-system library version use
+       --with-libgnutls-prefix (or if having pkg-config: see description
+       below).
 
-     * [32]libidn is required for IDN/IRI support (non-ASCII characters
+     * [30]OpenSSL to allow encrypted data transfer (HTTPS) an
+       alternative to [31]GnuTLS.
+       You need the header files and the library installed.
+       If you want to compile+link a non-system library version use
+       --with-libssl-prefix (or if having pkg-config: see description below).
+
+     * [31]libidn2 is required for IDN/IRI support (non-ASCII characters
        within what would otherwise be URLs).
 
-     * [33]libiconv is required on non-GNU systems, for IDN/IRI support.
+     * [32]libiconv is required on non-GNU systems, for IDN/IRI support.
        On GNU systems, the functionality provided by libiconv is already
        present in the system libraries.
 
-     * [34]git is used to fetch gnulib files trough the bootstrap.sh script.
+     * [33]git is used to fetch gnulib files through the bootstrap.sh script.
+
+     * [34]libpsl is required for using a public suffix list to check for valid
+       cookie domains. You need the header files and the library installed.
+
+     * [35]libpcre is required for using Perl-compatible regular expressions
+       with --accept-regex and --reject-regex. You need the header files and
+       the library installed to compile and link Wget with PCRE support.
+
+     * [36]pkg-config helps the ./configure script to find installed libraries.
+       Most libraries provide a pkg-config file (.pc extension) with
+       information about dependencies, header file and library locations.
+       Distributions deliver their specific .pc file to each library.
+       If you want to compile+link against your own library version, make a
+       copy of the appropriate .pc file and amend it to your needs (e.g. edit
+       the line starting with prefix=). Before you execute the ./configure
+       script, set (and export) PKG_CONFIG_PATH to the directory where you
+       saved the .pc file. Example:
+       $ PKG_CONFIG_PATH="." ./configure
+
+     * [46]libmetalink is needed to enable Metalink files support.
+
+     * [47]GnuPG with GPGME is used to verify GPG-signed Metalink resources.
+
+     * [48]libcares is needed to bind DNS resolving to a given IP address.
+       The command line options --dns-servers and --bind-dns-address are
+       only available when configured with --with-cares.
+
+     * [49]gperf is required by some gnulib modules, most notably "unicase". You
+       need the application installed on the machine to compile Wget from git.
 
-     * [35]libpsl is required for using a public suffix list to check for valid
-       cookie domains.
 
    For those who might be confused as to what to do once they check out
    the source code, considering configure and Makefile do not yet exist at
-   that point, a shell script called bootstrap.sh has been provided. After
-   calling ./bootstrap.sh you're ready to build GNU Wget in the normal
+   that point, a shell script called bootstrap has been provided. After
+   calling ./bootstrap you're ready to build GNU Wget in the normal
    fashion, with ./configure and make.
 
    So, to sum up, after checking out the source code as described above,
@@ -83,17 +120,51 @@ Compiling From Repository Sources
  $  cd wget        # assumes you've cloned a repository to "./wget"
     2. Generate all the automatically-generated files required prior to
        configuring the package:
- $  ./bootstrap.sh
+ $  ./bootstrap (or: bash ./bootstrap)
     3. Configure the package and compile it:
- $  ./configure [some_parameters]
+ $  ./configure --enable-assert [some_parameters]
  $  make
     4. Hack, compile, test, hack, compile, test...
  $  src/wget --version
  GNU Wget 1.12-devel (9cb2563197bc)
 
- Copyright © 2008,2010 Free Software Foundation, Inc.
+Testing and development
+
+ All developers are requested to enable the assertions on their development
+ builds to ensure a stable codebase. Assertions are added to state certain
+ assumptions about the code and its data which all developers should be mindful
+ of. To enable assertions, run the configure command with the --enable-assert
+ option, like this:
+
+ $ ./configure --enable-assert [other configure options]
+
+ Both the Perl and Python test suites (test/ and testenv/) include support for GDB and Valgrind.
+ The environment variables GDB_TESTS and VALGRIND_TESTS are available to
+ enable such wrappers. If specified, Wget would be run through either of them
+ during the test. For example:
+
+ $ cd testenv
+ $ VALGRIND_TESTS=1 ./Test-O.py
+
+ That would execute Test-O.py test case, but running Wget through Valgrind.
+
+ GDB has preference over Valgrind. If both variables have been asserted,
+ Wget would be run through GDB.
+
+ If you run a test case through GDB, please bear in mind that it could give
+ a false negative. This is because some tests that expect Wget to fail
+ rely on Wget's return code. However, when run through GDB, its return code
+ will always be zero, causing the test to claim failure. This wrapper for
+ GDB is, however, very useful to tackle bugs, allowing one to write a test case
+ for some specific bug and then using GDB to fix it more easily. Otherwise,
+ a dedicated server would have to be set up and write a custom CGI just to reproduce
+ that bug, which might be tedious. Tests should only be run through GDB for that purpose.
+
+
+ Copyright (C) 2008, 2010, 2014-2015, 2018-2023 Free Software
+ Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later
- <http://www.gnu.org/licenses/gpl.html>.
+ <https://www.gnu.org/licenses/gpl.html>.
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.
 
@@ -112,33 +183,38 @@ Compiling From Repository Sources
      * [43]Valid HTML 4.01
      __________________________________________________________________
 
-   All content © 2007 Free Software Foundation. For terms of use,
-   redistribution, and modification, please see the [44]WikiLicense page.
+   All content (C) 2007 Free Software Foundation. For terms of use,
+   redistribution, and modification, please see the [45]WikiLicense page.
 
 References
 
-  20. http://www.gnu.org/software/autoconf/
-  21. http://www.gnu.org/software/automake/
-  22. http://flex.sourceforge.net/
-  23. http://www.perl.org/
+  20. https://www.gnu.org/software/autoconf/
+  21. https://www.gnu.org/software/automake/
+  22. https://github.com/westes/flex
+  23. https://www.perl.org/
   24. http://search.cpan.org/dist/libwww-perl/lib/Bundle/LWP.pm
   25. http://search.cpan.org/CPAN/authors/id/A/AN/ANDK/CPAN-1.9402.tar.gz
   26. http://apthorpe.cynistar.net/code/configuring_cpan.html
-  27. http://www.gnu.org/software/texinfo/
-  28. http://www.gnu.org/software/gettext/
-  29. http://www.openssl.org/
-  30. http://www.debian.org/
-  31. http://www.gnu.org/software/gnutls/
-  32. http://www.gnu.org/software/libidn/
-  33. http://www.gnu.org/software/libiconv/
-  34. http://git-scm.com/
-  35. https://github.com/rockdaboot/libpsl
+  27. https://www.gnu.org/software/texinfo/
+  28. https://www.gnu.org/software/gettext/
+  29. https://www.gnu.org/software/gnutls/
+  30. https://www.openssl.org/
+  31. https://www.gnu.org/software/libidn/#libidn2
+  32. https://www.gnu.org/software/libiconv/
+  33. https://git-scm.com/
+  34. https://github.com/rockdaboot/libpsl
+  35. https://www.pcre.org
   36. http://wget.addictivecode.org/CompilingRepoSources?action=edit&editor=text
   37. http://wget.addictivecode.org/CompilingRepoSources
   38. http://wget.addictivecode.org/CompilingRepoSources?action=info
   39. http://wget.addictivecode.org/CompilingRepoSources?action=AttachFile
-  40. http://moinmo.in/
-  41. http://moinmo.in/Python
-  42. http://moinmo.in/GPL
-  43. http://validator.w3.org/check?uri=referer
+  40. https://moinmo.in/
+  41. https://moinmo.in/Python
+  42. https://moinmo.in/GPL
+  43. https://validator.w3.org/check?uri=referer
   44. http://wget.addictivecode.org/WikiLicense
+  45. https://www.python.org/
+  46. https://launchpad.net/libmetalink
+  47. https://www.gnupg.org
+  48. https://c-ares.haxx.se/
+  49. https://www.gnu.org/software/gperf/

bootstrap.conf

@@ -1,6 +1,5 @@
 # bootstrap.conf - Bootstrap configuration.
-# Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation,
-# Inc.
+# Copyright (C) 2007-2012, 2018-2023 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #
@@ -9,97 +8,160 @@
 # the Free Software Foundation, either version 3 of the License, or (at
 # your option) any later version.
 #
-# GNU Wgt is distributed in the hope that it will be useful, but
+# GNU Wget is distributed in the hope that it will be useful, but
 # WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see `http://www.gnu.org/licenses/'.
+# along with this program.  If not, see `https://www.gnu.org/licenses/'.
 
 # gnulib library name
+source_base=lib
+tests_base=lib/tests
 gnulib_name=libgnu
-gnulib_tool_option_extras=
+gnulib_tool_option_extras="--makefile-name=gnulib.mk --po-base=gnulib_po --po-domain=wget"
 use_libtool=0
 checkout_only_file=
 
 # gnulib modules used by this package.
 gnulib_modules="
 accept
-alloca
 announce-gen
 base32
 bind
 c-ctype
+c-strcase
+c-strcasestr
 clock-time
 close
 connect
+dirname
 fcntl
+flock
+fnmatch-gnu
+fopen
 futimens
 ftello
+gendocs
 getaddrinfo
+getline
 getopt-gnu
 getpass-gnu
 getpeername
 getsockname
+gettext-h
+gitlog-to-changelog
 git-version-gen
 gnupload
+gnu-web-doc-update
+group-member
+hostent
 ioctl
 iconv
 iconv-h
+inet_ntop
+intprops
+inttypes
+langinfo
+limits-h
+link
 listen
 maintainer-makefile
+mbiter
 mbtowc
+memrchr
 mkdir
 mkstemp
 mkostemp
+nanosleep
+crypto/md2
+crypto/md4
 crypto/md5
 crypto/sha1
-pipe
+crypto/sha256
+crypto/sha512
+open
+pipe-posix
+posix_spawn
 quote
 quotearg
 recv
 regex
+rename
 select
 send
 setsockopt
+signal-h
 sigprocmask
 sigpipe
 snprintf
 socket
+spawn-pipe
+stat
 stdbool
-strcasestr
+stdint
+strcase
 strerror_r-posix
+strpbrk
+strptime
 strtok_r
+strtol
+strtoll
+symlink
+sys_types
+timegm
 tmpdir
+unlink
 unlocked-io
 update-copyright
+libunistring-optional
+unistr/u8-strlen
+unicase/u8-tolower
+utime
+utimens
 vasprintf
 vsnprintf
+warnings
+wcwidth
 write
-"
-
-gnulib_extra_files="
-	$build_aux/install-sh
-	$build_aux/mdate-sh
-	$build_aux/texinfo.tex
-	$build_aux/depcomp
-	$build_aux/config.guess
-	$build_aux/config.sub
-	$build_aux/config.rpath
-	doc/INSTALL
+xmemdup0
+xstrndup
 "
 
 # Build prerequisites
 buildreq="\
-autoconf   2.62
+autoconf   2.64
 automake   1.11.1
 autopoint  -
-gettext    0.17
+gettext    -
 git        1.4.4
 makeinfo   -
 perl       5.5
-rsync      -
 tar        -
-xz         -
+gzip       -
+flex       -
+gperf      -
 "
+
+bootstrap_post_import_hook ()
+{
+  # We need to patch unicase/special-casing-table.h for gperf < 3.1
+  GPERF_VER=$(gperf --version | {
+    IFS=' .' read x y major minor bugfix _
+    printf "%d%02d%02d" $major $minor $bugfix
+  })
+
+  if [ $GPERF_VER -lt 30100 ]; then
+    echo "Creating lib/unicase/special-casing-table.h for gperf < 3.1"
+     gperf -m 10 lib/unicase/special-casing-table.gperf | \
+       sed -e "s/gl_unicase_special_lookup.*/gl_unicase_special_lookup\ \(const char \*str, size_t len\)/g" \
+         > lib/unicase/special-casing-table.h
+  fi
+
+  # ./bootstrap calls 'autopoint --force' which will overwrite
+  #   po/Makevars.template. So here we add what we need for a VPATH
+  #   build. ./bootstrap will create po/Makevars from po/Makevars.template
+  #   after our change.
+  echo 'PACKAGE_GNU = yes' >> po/Makevars.template
+}

build-aux/build_info.pl

@@ -2,7 +2,7 @@
 
 # Generate build_info.c.
 
-# Copyright (C) 2009, 2010, 2011 Free Software Foundation, Inc.
+# Copyright (C) 2009-2011, 2018-2023 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -137,3 +137,4 @@ __DATA__
 
 #include "wget.h"
 #include <stdio.h>
+#include "version.h"

cfg.mk

@@ -1,28 +1,37 @@
-export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog)$$
+# Explicit syntax-check exceptions.
+exclude_file_name_regexp--sc_trailing_blank = ^doc/annou.*$$
+exclude_file_name_regexp--sc_bindtextdomain = ^fuzz/.*.c$$
+exclude_file_name_regexp--sc_require_config_h = (fuzz/.*.c|src/decc_ver.c|util/trunc.c)$$
+exclude_file_name_regexp--sc_require_config_h_first = (fuzz/.*.c|src/decc_ver.c|src/vms.c|util/trunc.c)$$
+exclude_file_name_regexp--sc_file_system = ^(NEWS|testenv/server/ftp/ftp_server.py)$$
+
+
+export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog|tests/certs/.*)$$
+config_h_header = "wget\.h"
 
 local-checks-to-skip = \
     sc_const_long_option \
     sc_error_message_uppercase \
-    sc_file_system \
-    sc_immutable_NEWS \
-    sc_copyright_check \
-    sc_makefile_path_separator_check \
-    sc_require_config_h \
-    sc_require_config_h_first \
     sc_two_space_separator_in_usage \
     sc_useless_cpp_parens \
     \
     sc_prohibit_atoi_atof \
     sc_prohibit_strcmp \
-    sc_cast_of_alloca_return_value \
-    sc_cast_of_x_alloc_return_value \
-    sc_prohibit_S_IS_definition \
     \
-    sc_program_name \
-
+    sc_makefile_at_at_check \
+    sc_cast_of_argument_to_free \
+    sc_prohibit_gnu_make_extensions \
+	\
+	sc_indent
 
 #SHELL=bash -x
 show-vc-list-except:
 	@$(VC_LIST_EXCEPT)
 
-VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)$$
+VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|/.*\.der|^tests/certs/.*|^fuzz/.*\.(in|repro)/.*$$
+
+update-copyright-env = UPDATE_COPYRIGHT_USE_INTERVALS=1
+generated_files =
+
+old_NEWS_hash = 39db0b0f2cce0f250b4f5b8891990f17
+manual_title = $(VERSION)

contrib/check-hard

@@ -0,0 +1,55 @@
+#!/bin/sh
+#
+# Do some checking before 'git push'.
+
+# Set a stricter bash mode
+set -e
+set -u
+
+CORES=$(grep -c ^processor /proc/cpuinfo 2> /dev/null || echo 0)
+if [ $CORES -lt 1 ]; then CORES=1; fi
+
+echo "Running: make distclean"
+make distclean > /dev/null || true
+
+#CFLAGS="-std=c89 -pedantic -O0 -g -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
+CFLAGS="-Wall -Wextra -O2 -g"
+
+CACHEFILE=$PWD/config_check.cache
+
+# measure time consumed and print it at the end of the script
+START=$(date +%s.%N)
+
+echo "Running: ./bootstrap"
+./bootstrap > /dev/null
+echo
+
+for CC in gcc clang; do
+  export CC
+  echo "*** Testing with CC=$CC"
+
+  # the compiler changed, so we have to remove the cache file here
+  rm -f $CACHEFILE
+
+  for options in "" "--with-ssl=openssl" "--disable-iri"; do
+    export DISTCHECK_CONFIGURE_FLAGS="-C --cache-file=$CACHEFILE $options"
+    echo "  ./configure $DISTCHECK_CONFIGURE_FLAGS"
+    ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS="$CFLAGS" > /dev/null
+
+    for xVALGRIND in 0 1; do
+      for xLCALL in C tr_TR.utf8; do
+        export TESTS_ENVIRONMENT="LC_ALL=$xLCALL VALGRIND_TESTS=$xVALGRIND"
+        echo "    TESTS_ENVIRONMENT=\"$TESTS_ENVIRONMENT\"" make check -j$CORES
+        make check -j$CORES > /dev/null
+      done
+    done
+
+    unset TESTS_ENVIRONMENT
+    export TESTS_ENVIRONMENT
+    echo "  make distcheck CFLAGS=$CFLAGS -j$CORES"
+    make distcheck CFLAGS="$CFLAGS" -j$CORES > /dev/null
+  done
+done
+
+END=$(date +%s.%N)
+echo "Duration: "$(echo "$END - $START" | bc)

contrib/make-release

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+
+# GNU Wget: Make a new release
+#
+# This is a helper script to make a new release of GNU Wget
+#
+# Author: Darshit Shah <darnir@gnu.org>
+
+set -e
+set -o pipefail
+set -u
+
+export CFLAGS="-g -O2 -Wall"
+export LC_ALL=C
+
+EXTENSIONS="gzip lzip"
+
+ask_continue() {
+	printf "Continue? [y/N]: "
+	read -r inp
+	[ "$inp" != "y" ] && [ "$inp" != "Y" ] && exit 1
+	# For some completely weird reason, this set +x is required. Else, the test
+	# *ALWAYS* fails
+	set +x
+}
+
+REQUIRED_PROGRAMS="ncftpput sponge"
+for prog in $REQUIRED_PROGRAMS; do
+    if ! command -v "$prog" >/dev/null 2>&1; then
+        2>&1 echo "Required program $prog not found. Please install before proceeding"
+        exit 1
+    fi
+done
+
+if [ ! -d ".git" ]; then
+	echo "Please run this script from the root of the git repository"
+fi
+
+echo "This script will make a new release and upload it to the GNU FTP Servers"
+echo "Will run git clean -dxf to get a clean dir"
+ask_continue
+
+# Make sure we have a clean working directory
+git clean -dxfq
+
+echo "=> Bootstrap"
+./bootstrap > /dev/null 2>&1
+autoreconf -ivf
+
+echo "=> Configure"
+./configure -q
+
+APP_NAME=$(grep "^PACKAGE_NAME='" configure | cut -d "'" -f2)
+APP_VER=$(grep "^PACKAGE_VERSION='" configure | cut -d "'" -f2)
+
+echo "Making release for $APP_NAME $APP_VER"
+ask_continue
+
+NEWS_VERSION=$(grep -i "Noteworthy changes in release" NEWS | head -2 | tail -1 | awk '{print $6}')
+if [ "$NEWS_VERSION" != "$APP_VER" ]; then
+	echo "Latest version in NEWS file does not match latest tag"
+	exit 1
+fi
+PREV_VER=$(cat .prev-version)
+LNO_CVER=$(grep -in "Noteworthy changes in release" NEWS | head -2 | tail -1 | cut -f1 -d:)
+LNO_PVER=$(grep -in "Noteworthy changes in release" NEWS | head -3 | tail -1 | cut -f1 -d:)
+sed -n "${LNO_CVER},${LNO_PVER}p" NEWS
+echo "This is the current contents of your NEWS"
+ask_continue
+
+echo ""
+REL_TYPE=
+while [ -z $REL_TYPE ]; do
+	printf "Enter release type (alpha, beta, stable): "
+	read x
+	case $x in
+		a|A|alpha|Alpha) REL_TYPE=alpha;;
+		b|B|beta|Beta) REL_TYPE=beta;;
+		s|S|stable|Stable) REL_TYPE=stable;;
+	esac
+done
+
+echo "=> Make release"
+make -s release RELEASE_TYPE=$REL_TYPE
+
+GPG_KEY=
+while [ -z $GPG_KEY ]; do
+	printf "Enter GPG Key ID for Signing: "
+	read key
+	gpg --list-keys "$key" || continue
+	printf "Will use this key to sign releases. Continue? [y/N]: "
+	read x
+	[ "$x" = "y" ] || [ "$x" = "Y" ] && GPG_KEY="$key"
+done
+
+echo ""
+
+upload_command=$(make -s emit_upload_commands RELEASE_TYPE=stable \
+    | sponge \
+    | head -n3 \
+    | tail -1 \
+    | sed "s/--to/--user $GPG_KEY --symlink-regex --to/g"
+)
+
+echo "=> Uploading"
+echo "Upload tarballs?"
+echo "$upload_command"
+ask_continue
+$upload_command
+
+echo ""
+echo "Remaining Release Checklist:
+  1. Send a mail to coordinator@translationproject.org with the subject
+	 \"Requesting Translations for $APP_NAME-$APP_VER.POT\"
+  2. Announce email template placed at ~/announce-$APP_NAME-$APP_VER
+     Send an announce mail to info-gnu@gnu.org
+  3. Run \`make web-manual\` and \`make web-manual-update\` to update manual online
+  (Only Stable)
+"
+
+echo ""
+
+prev_tag=$(git tag | tail -2 | head -1)
+echo ""
+echo "Don't forget to mention the following contributors in the announcement:"
+(
+  git log "${prev_tag}.." --format="%aN" --reverse
+  git log "${prev_tag}.." --reverse | grep -i reported | cut -d':' -f2 | cut -d'<' -f1 | cut -d' ' -f2- | tr -d '"'
+) | sort -u

contrib/mk_authors

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+prev_tag=`git tag --sort=taggerdate|tail -1`
+
+echo -e "The authors list is autogenerated from the git history; sorted by number of commits\n"
+
+(
+if [ -z $prev_tag ]; then
+  git shortlog -sen
+else
+  git shortlog -sen ${prev_tag}..
+fi
+) | cut -f 2 | sed 's/@/ at /g'
+
+#(
+#if [ -z $prev_tag ]; then
+#  git log --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+#else
+#  git log ${prev_tag}.. --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+#fi
+#) | sort -u
+
+echo -e "\n\nThe translators list is autogenerated from po file history\n"
+
+sed -n 's/.*Last-Translator: *\(.*\) *<.*/\1/p' po/*.po | sort -u

contrib/release

@@ -0,0 +1,123 @@
+#!/bin/bash -e
+#
+# Written 2016 by Tim Ruehsen
+#
+# To get the version number right: add a signed tag and
+#   make sure the working dir is clean (git diff).
+# If that fails, put the version into '.tarball-version'.
+
+export CFLAGS="-g -O2 -Wall"
+
+echo
+echo "* Bootstrap"
+#./bootstrap >/dev/null
+
+echo
+echo "* Configure"
+#./configure -q
+
+extensions="gz lz"
+app_name=$(grep "^PACKAGE_NAME='" configure|cut -d "'" -f2)
+app_ver=$(grep "^PACKAGE_VERSION='" configure|cut -d "'" -f2)
+
+echo "Current version of $app_name is $app_ver"
+echo
+echo -n "Is that OK ? [y/N] "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+echo
+grep -i "Changes in $app_name" NEWS|head -1
+echo -n "Did you edit the NEWS file ? [y/N] "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+echo
+echo "* Make"
+#make -s clean
+#make -s
+
+echo
+echo "* Make distcheck"
+#make -s distcheck >/dev/null
+
+echo
+echo "* Make dist"
+for ext in $extensions; do
+  [[ $ext = 'gz' ]] && ext="gzip"
+  [[ $ext = 'lz' ]] && ext="lzip"
+  make -s dist-$ext >/dev/null
+done
+
+while true; do
+  echo "Alpha or Regular release ? [R/A] "
+  read x
+  if test "$x" = "r" || test "$x" = "R"; then
+    directory="/incoming/ftp"
+    break
+  elif test "$x" = "a" || test "$x" = "A"; then
+    directory="/incoming/alpha"
+    break
+  fi
+done
+
+x=$(gpg --list-secret-keys 2>/dev/null|grep ^sec|awk '{ print $2 }')
+echo $x
+if [ "$x" = "" ]; then
+  echo No signing key found - please check with 'gpg --list-secret-keys'
+  exit 1
+fi
+
+# arrays just work in Bash
+keys=($x)
+if [ ${#keys[@]} -eq 1 ]; then
+  IFS='/' arr=($x)
+  signing_key=${arr[1]}
+else
+  for ((i=0; i < ${#keys[@]}; i++)); do
+    echo "$((i+1))) ${keys[i]}"
+  done
+  while true; do
+    echo -n "Enter 1-${#keys[@]}: "
+    read x
+
+    # check for digits only
+    if [ -n "${i//[0-9]/}" ]; then continue; fi
+
+    if test $x -ge 1 || test $x -le ${#keys[@]}; then
+      IFS='/' arr=(${keys[$((x-1))]})
+      signing_key=${arr[1]}
+      break
+    fi
+  done
+fi
+unset IFS
+
+echo
+echo -n "Really upload to ftp-upload.gnu.org/$directory ? "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+for ext in $extensions; do
+  app_tarball="${app_name}-${app_ver}.tar.$ext"
+  gpg --default-key $signing_key --yes -b $app_tarball
+
+  echo -e "version: 1.2\nfilename: ${app_tarball}\ndirectory: ${app_name}\n" >${app_tarball}.directive
+  gpg --default-key $signing_key --yes --clearsign ${app_tarball}.directive
+
+ftp -v -n -i -p ftp-upload.gnu.org <<EOF
+user anonymous
+cd $directory
+put ${app_tarball}
+put ${app_tarball}.sig
+put ${app_tarball}.directive.asc
+EOF
+
+done
+
+prev_tag=`git tag|tail -2|head -1`
+echo "Don't forget to mention the following contributors in the announcement:"
+(
+  git log ${prev_tag}.. --format="%aN" --reverse
+  git log ${prev_tag}.. --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+) | sort -u

contrib/spell-checker

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+#
+# see https://github.com/codespell-project/codespell
+#
+# in short:
+#  - pip install codespell
+#  - add ~/.local/bin to PATH
+
+set -e
+
+codespell $* -L "tim,gonna,cas,referer,fpr,vas,msdos,ifset,ba,tage,tolen,files',hist,lightening,wither,parm" `git ls-files|\
+  egrep -v '_fuzzer.in|_fuzzer.repro|\.der$|\.pem$|gnulib|ChangeLog|tests/gpg|\.png$|\.dat$|contrib/spell-checker|tests/certs/.*\.crt'`
+
+#codespell $* -L "tim,gonna,cas,te,referer,ist,fpr,vas" src/wget.c contrib/spell-checker

contrib/travis-ci

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# Set a stricter bash mode
+set -e
+set -u
+
+# Set up the subset of tests this Matrix instance will run.
+
+# One instance is forked for each of the SSL library possibilities
+SSL=${1:-""}
+case $SSL in
+    "") SSL_LIB="--without-ssl";;
+    "openssl") SSL_LIB="--with-ssl=openssl";;
+    "gnutls") SSL_LIB="--with-ssl=gnutls";;
+esac
+
+# For some reason. /proc/cpuinfo reports 16 cores on Travis, while the docs
+# claim that each instance has only 2 cores. We believe the docs and force a
+# value of n+1 here.
+CORES=3
+
+# Define a large number of Warning flags for the compiler. Hopefully, someone
+# will sit and analyze the output to clean the warnings from the codebase.
+CFLAGS="-std=c89 -pedantic -O0 -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
+
+# A cachefile for ./configure. Saves significant time when reconfiguring
+CACHEFILE=$PWD/config_check.cache
+
+# measure time consumed and print it at the end of the script
+START=$(date +%s)
+
+# Test different Permutations of Wget. Always under Valgrind
+#
+# Options:
+#   - All Features Enabled
+#     - C       [Default Locale]
+#     - Russian [Multibyte / Multicolumn Locale]
+#     - Turkish [Special Test due to issues with language]
+#   - IPv6 Disabled
+#     - C
+for options in "" "--disable-ipv6"; do
+  export DISTCHECK_CONFIGURE_FLAGS="-C --cache-file=$CACHEFILE --enable-assert --enable-valgrind-tests $SSL_LIB $options"
+  echo "  ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS=\"$CFLAGS\""
+  ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS="$CFLAGS"
+
+  if [[ -z $options ]]; then
+      LANG_ARR=("ru_RU.UTF-8" "tr_TR.UTF-8" "C")
+  else
+      LANG_ARR=("C")
+  fi
+
+  for xLCALL in "${LANG_ARR[@]}"; do
+    export TESTS_ENVIRONMENT="LC_ALL=$xLCALL VALGRIND_TESTS=1"
+    echo "    TESTS_ENVIRONMENT=\"$TESTS_ENVIRONMENT\" make distcheck CFLAGS=$CFLAGS -j$CORES"
+    make distcheck CFLAGS="$CFLAGS" -j$CORES
+  done
+done
+
+END=$(date +%s)
+echo "Duration: $((END-START))"

contrib/tsocked-wget

@@ -0,0 +1,90 @@
+#!/bin/bash
+
+# Script that executes wget using a socks proxy if the environment variable
+# socks_proxy is set.
+#
+# The socks_proxy variable shall have one of the forms:
+#   socks://username:password@host:port
+#   socks4://username:password@host:port
+#   socks5://username:password@host:port
+# with username, password and port fields being optional
+#
+# As socksification applies to the whole process, domains defined in the
+# no_proxy setting are *not* excluded.
+#
+
+# Requisites: bash (version 3.2.3 or later), tsocks and wget
+
+####################################
+#  Copyright (C) 2014 Ángel González
+#  Permission is hereby granted, free of charge, to any person obtaining a copy
+#  of this software and associated documentation files (the "Software"), to deal
+#  in the Software without restriction, including without limitation the rights
+#  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+#  copies of the Software, and to permit persons to whom the Software is
+#  furnished to do so, subject to the following conditions:
+#
+#  The above copyright notice and this permission notice shall be included in
+#  all copies or substantial portions of the Software.
+#
+#  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+#  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+#  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+#  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+#  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+#  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+#  THE SOFTWARE.
+#
+
+set -eu
+
+# Binary to be executed. Use an absolute path if installing this script as 'wget'
+WGET=wget
+
+if [ -z "${socks_proxy:-}" ]; then
+exec "$WGET" "$@"
+fi
+
+CONFIG=""
+
+if [[ "${socks_proxy}" =~ ^socks[45]?:// ]]; then
+ if [[ "${socks_proxy:5:1}" != ":" ]]; then
+  CONFIG+="server_type = ${socks_proxy:5:1}"
+  socks_proxy="${socks_proxy:9}"
+ else
+  socks_proxy="${socks_proxy:8}"
+ fi
+elif [[ "${socks_proxy}" =~ ^[[:alnum:]]*:// ]]; then
+ echo "Bad value specified for socks_proxy: $socks_proxy" >&2
+ exit 2
+fi
+
+if [[ "${socks_proxy}" =~ ^([^@:]*)(:([^@]*))?@ ]]; then
+ unset TSOCKS_USERNAME
+ CONFIG+="
+   default_user = ${BASH_REMATCH[1]}"
+
+ if [ ! -z "${BASH_REMATCH[3]}" ]; then
+  unset TSOCKS_PASSWORD
+  CONFIG+="
+   default_pass = ${BASH_REMATCH[3]}"
+ fi
+ socks_proxy="${socks_proxy:${#BASH_REMATCH[0]}}"
+fi
+
+
+# Get rid of trailing slashes
+if [[ "${socks_proxy}" =~ ^([^/]*)/ ]]; then
+ socks_proxy="${socks_proxy:0:${#BASH_REMATCH[1]}}"
+fi
+
+if [[ "${socks_proxy}" =~ :([0-9]+)$ ]]; then
+  CONFIG+="
+   server_port = ${BASH_REMATCH[1]}"
+  socks_proxy=${socks_proxy:0:${#socks_proxy} - ${#BASH_REMATCH[0]}}
+fi
+
+CONFIG+="
+   server = ${socks_proxy}"
+
+TSOCKS_CONF_FILE=<(echo "$CONFIG") exec tsocks "$WGET" --no-proxy "$@"

doc/Makefile.am

@@ -1,6 +1,6 @@
 # Makefile for `wget' utility
-# Copyright (C) 1995, 1996, 1997, 2007, 2008, 2009, 2010, 2011 Free
-# Software Foundation, Inc.
+# Copyright (C) 1995-1997, 2007-2011, 2015, 2018-2023 Free Software
+# Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 #
-# Version: $(VERSION)
+# Version: @VERSION@
 #
 
 # Program to convert DVI files to PostScript
@@ -28,6 +28,7 @@ manext     = 1
 RM = rm -f
 
 TEXI2POD     = $(srcdir)/texi2pod.pl
+POD2MAN      = @POD2MAN@
 MAN          = wget.$(manext)
 WGETRC       = $(sysconfdir)/wgetrc
 SAMPLERCTEXI = sample.wgetrc.munged_for_texi_inclusion
@@ -38,7 +39,7 @@ SAMPLERCTEXI = sample.wgetrc.munged_for_texi_inclusion
 
 man_MANS = $(MAN)
 
-all: wget.info $(COMMENT_IF_NO_POD2MAN)$(MAN)
+all: wget.info @COMMENT_IF_NO_POD2MAN@$(MAN)
 
 everything: all wget_us.ps wget_a4.ps wget_toc.html
 
@@ -56,7 +57,8 @@ wget.pod: $(srcdir)/wget.texi version.texi
 	$(TEXI2POD) -D VERSION="$(VERSION)" $(srcdir)/wget.texi $@
 
 $(MAN): wget.pod
-	$(POD2MAN) --center="GNU Wget" --release="GNU Wget $(VERSION)" $? > $@
+	$(POD2MAN) --center="GNU Wget" --release="GNU Wget @VERSION@" --utf8 $? > $@ || \
+	$(POD2MAN) --center="GNU Wget" --release="GNU Wget @VERSION@" $? > $@
 
 #wget.cat: $(MAN)
 #	nroff -man $? > $@
@@ -75,10 +77,10 @@ wget_toc.html: $(srcdir)/wget.texi
 #
 
 # install all the documentation
-install-data-local: install.wgetrc $(COMMENT_IF_NO_POD2MAN)install.man
+install-data-local: install.wgetrc @COMMENT_IF_NO_POD2MAN@install.man
 
 # uninstall all the documentation
-uninstall-local: $(COMMENT_IF_NO_POD2MAN)uninstall.man
+uninstall-local: @COMMENT_IF_NO_POD2MAN@uninstall.man
 
 
 # install man page, creating install directory if necessary

doc/announcement_1.19.txt

@@ -0,0 +1,104 @@
+Hello,
+
+we are pleased to announce the new version of GNU wget 1.19.
+
+It comes with major improvements for Metalink, IDNA2008 for
+international domain names, an option to call external tools
+for fetching user/password, several bugfixes and improvements.
+
+Many thanks go to all the contributors and list activists !
+
+Contributors (from the git log):
+Ander Juaristi
+Dale R. Worley 
+Eli Zaretskii 
+Gisle Vanem 
+Giuseppe Scrivano
+Göran Uddeborg 
+Jann Horn 
+Jeffery To
+Jérémie Courrèges-Anglas 
+Liam R. Howlett
+losgrandes
+Matthew White
+Misra, Deapesh 
+Nikos Mavrogiannopoulos
+Noël Köthe
+Piotr Wajda
+Rahul Bedarkar
+Sean Burford
+Tim Rühsen
+Tobias Stoeckmann
+vijeth-aradhya
+
+
+The new version is available for download here:
+
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.gz
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.xz
+
+and the GPG detached signatures using the key 0x08302DB6A2670428:
+
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.gz.sig
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.xz.sig
+
+To reduce load on the main server, you can use this redirector service
+which automatically redirects you to a mirror:
+
+http://ftpmirror.gnu.org/wget/wget-1.19.tar.gz
+http://ftpmirror.gnu.org/wget/wget-1.19.tar.xz
+
+
+Noteworthy changes:
+
+* New option --use-askpass=COMMAND. Fetch user/password by calling
+  an external program.
+
+* Use IDNA2008 (+ TR46 if available) through libidn2
+
+* When processing a Metalink header, --metalink-index=<number> allows
+  to process the header's application/metalink4+xml files.
+
+* When processing a Metalink file, --trust-server-names enables the
+  use of the destination file names specified in the Metalink file,
+  otherwise a safe destination file name is computed.
+
+* When processing a Metalink file, enforce a safe destination path.
+  Remove any drive letter prefix under w32, i.e. 'C:D:file'.  Call
+  libmetalink's metalink_check_safe_path() to prevent absolute,
+  relative, or home paths:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* When processing a Metalink file, --directory-prefix=<prefix> sets
+  the top of the retrieval tree to prefix for Metalink downloads.
+
+* When processing a Metalink file, reject downloaded files which don't
+  agree with their own metalink:size value:
+  https://tools.ietf.org/html/rfc5854#section-4.2.16
+
+* When processing a Metalink file, with --continue resume partially
+  downloaded files and keep fully downloaded files even if they fail
+  the verification.
+
+* When processing a Metalink file, create the parent directories of a
+  "path/file" destination file name:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* On a recursive download, append a .tmp suffix to temporary files
+  that will be deleted after being parsed, and create them
+  readable/writable only by the owner.
+
+* New make target 'check-valgrind'
+
+* Fix several bugs
+
+* Fix compatibility issues
+
+
+Please report any problem you may experience to the bug-wget@gnu.org
+mailing list.
+
+For the maintainers of Wget,
+Tim

doc/fdl.texi

@@ -5,7 +5,8 @@
 @c hence no sectioning command or @node.
 
 @display
-Copyright @copyright{} 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc.
+Copyright @copyright{} 2000--2002, 2007--2008, 2015, 2018--2023 Free
+Software Foundation, Inc.
 @uref{http://fsf.org/}
 
 Everyone is permitted to copy and distribute verbatim copies

doc/metalink-standard.txt

@@ -0,0 +1,233 @@
+GNU Wget Metalink recommended behaviour
+
+  Metalink/XML and Metalink/HTTP standard reference
+
+
+1. Security features
+********************
+
+Only metalink:file elements with safe "name" fields shall be accepted
+[1 #section-4.1.2.1]. If unsafe metalink:file elements are saved, any
+related test shall fail (see '2. Tests').
+
+By design, libmetalink rejects unsafe metalink:file elements [3]:
+* lib/metalink_helper.c (metalink_check_safe_path): Verify path
+
+1.1 Exceptions
+==============
+
+The option --directory-prefix could allow to use an absolute, relative
+or home path.
+
+2. Tests
+********
+
+Saving a file to an unexpected path poses a security problem. We must
+ensure that Wget's automated tests never modify the root and the home
+paths or descend/escalate to a relative path unexpectedly.
+
+2.1 Metalink/XML implemented tests
+==================================
+
+See testenv/Makefile.am (METALINK_TESTS).
+
+2.2 Metalink/HTTP implemented tests
+===================================
+
+See testenv/Makefile.am (METALINK_TESTS).
+
+3. Download file name
+*********************
+
+The download file name shall be decided by precise rules which prevent
+any naming uncertainty and security issues.
+
+3.1 Naming rules
+================
+
+The final name of downloaded files is computed starting from a trusted
+name, which is then combined with the "Directory Options".  The result
+is verified and eventually made safer following security rules. If the
+final name isn't found safe enough, then the file isn't downloaded.
+
+Depending on the options used, a suffix could be appended to the final
+name to not overwrite existing files.
+
+3.1.1 The trusted name
+======================
+
+The option --trust-server-names decides what is the trusted name.
+
+Any Metalink/XML element with an unsafe metalink:file "name" field is
+ignored, see '1. Security features'.
+
+3.1.1.1 Without --trust-server-names
+====================================
+
+When --trust-server-names is off, the basename of the --input-metalink
+file, if available, or of the mother URL is trusted. This trusted name
+is the radix of any subsequent file name.
+
+When a Metalink/HTTP in encountered, any fetched Metalink/XML file has
+its own ordinal number appended as suffix to the trusted name. In this
+case scenario, an unique Metalink/XML file is saved each time applying
+an additional suffix to the currently computed name when necessary.
+
+The files described by a Metalink/XML file will be named sequentially
+applying an additional suffix to the currently trusted/computed name.
+
+3.1.1.2 With --trust-server-names
+=================================
+
+When --trust-server-names is on, the metalink:file "name" field parsed
+from Metalink/XML files is trusted. When no Metalink/XML is available,
+the mother URL is trusted.
+
+Any Metalink/HTTP application/metalink4+xml file is saved using the
+basename of its own Link header "name" field, if available.
+
+In conjunction with the option --content-disposition, a 'Content-Type:
+application/metalink4+xml' file is saved using the basename of its own
+Content-Disposition header "filename" field, if available.
+
+3.1.2 The final name
+====================
+
+The "Directory Options" are combined with the trusted name. The result
+is evaluated again by the '1. Security features'. If the path is found
+unsafe, only the basename of the final name is considered.  If this is
+found unsafe too, the file is not downloaded.
+
+4. Metalink/XML
+***************
+
+4.1 Example files
+=================
+
+See [1 #section-1.1].
+
+cat > bogus.meta4 << EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<metalink xmlns="urn:ietf:params:xml:ns:metalink">
+  <file name="/dir/A/File1">
+    <size>1617</size>
+    <hash type="sha256">ecb3dff2648667513e31554b3ad054ccd89fce38e33367c9459ac3a285153742</hash>
+    <url>http://another.url/common_name</url>
+    <url>http://ftpmirror.gnu.org/bash/bash-4.3-patches/bash43-001</url>
+  </file>
+  <file name="dir/B/File2">
+    <size>1594</size>
+    <hash type="sha256">eee7cd7062ab29a9e4f02924d9c367264dcb8b162703f74ff6eb8f175a91502b</hash>
+    <url>http://another.url/again/common_name</url>
+    <url>http://ftpmirror.gnu.org/bash/bash-4.3-patches/bash43-002</url>
+  </file>
+</metalink>
+EOF
+
+4.2 Command line example
+========================
+
+$ wget --input-metalink=bogus.meta4
+
+4.3 Metalink/XML file parsing
+=============================
+
+The metalink xml file is parsed by one of the following libmetalink's
+functions [3], depending upon the library configured to use:
+* lib/libexpat_metalink_parser.c (metalink_parse_file): Expat [4]
+* lib/libxml2_metalink_parser.c (metalink_parse_file): Libxml2 [5]
+
+The result returned doesn't include unsafe metalink:file elements, as
+stated at point '1. Security features'.
+
+An empty result shall not be considered an error.  Parsing errors will
+be informed to the caller of libmetalink's metalink_parse_file().
+
+4.4 Saving files
+================
+
+Fetched metalink:file elements shall be wrote using the unique "name"
+field as file name [1 #section-4.1.2.1].
+
+A metalink:file url's file name shall not substitute the "name" field.
+
+Security exceptions are explained in '3. Download file name'.
+
+4.5 Multi-Source download
+=========================
+
+Parallel range requests are allowed [1 #section-1].
+
+5. Metalink/HTTP
+****************
+
+5.1 HTTP server
+===============
+
+The local server http://127.0.0.1 is used as reference in the course
+of this chapter. Any server service capable of sending Metalink/HTTP
+header answers may be used.
+
+5.2 Command line example
+========================
+
+$ wget --metalink-over-http http://127.0.0.1/dir/file.ext
+
+5.3 Metalink/HTTP header answer
+===============================
+
+See [2 #section-1.1].
+
+Etag: "thvDyvhfIqlvFe+A9MYgxAfm1q5="
+Link: <http://www2.example.com/example.ext>; rel=duplicate
+Link: <ftp://ftp.example.com/example.ext>; rel=duplicate
+Link: <http://example.com/example.ext.torrent>; rel=describedby;
+type="application/x-bittorrent"
+Link: <http://example.com/example.ext.meta4>; rel=describedby;
+type="application/metalink4+xml"
+Link: <http://example.com/example.ext.asc>; rel=describedby;
+type="application/pgp-signature"
+Digest: SHA-256=MWVkMWQxYTRiMzk5MDQ0MzI3NGU5NDEyZTk5OWY1ZGFmNzgyZTJlO
+DYzYjRjYzFhOTlmNTQwYzI2M2QwM2U2MQ==
+
+See [2 #section-4].
+
+Link: <http://example.com/example.ext.torrent>; rel=describedby;
+type="application/x-bittorrent"; name="differentname.ext"
+Link: <http://example.com/example.ext.meta4>; rel=describedby;
+type="application/metalink4+xml"
+
+5.4 Saving files
+================
+
+When none of --output-document and/or --content-disposition is used,
+the file name to wrote is computed from the cli's url hierarchy. The
+purpose of the "Directory Options" is as usual, and the file name is
+the cli's url file name, see wget(1).
+
+The url followed to download the file shall not substitute the cli's
+url to compute the file name to wrote, except when it redirects to a
+Metalink/XML file, following the rules in '3. Download file name'.
+
+5.5 Multi-Source download
+=========================
+
+Parallel range requests are allowed [2 #section-7].
+
+4. References
+*************
+
+[1] The Metalink Download Description Format
+https://tools.ietf.org/html/rfc5854
+
+[2] Metalink/HTTP: Mirrors and Hashes
+https://tools.ietf.org/html/rfc6249
+
+[3] Libmetalink
+https://github.com/metalink-dev/libmetalink
+
+[4] Expat
+http://www.libexpat.org
+
+[5] Libxml2
+http://xmlsoft.org

doc/metalink.txt

@@ -0,0 +1,165 @@
+GNU Wget Metalink module
+
+  Evaluation of the Metalink/XML and Metalink/HTTP implementations
+
+
+1. Introduction
+***************
+
+This document, and the results contained in it, is focused over the
+evaluation of the Metalink/XML and Metalink/HTTP implementations.
+
+The "Directory Options" mentioned here are used on the command line in
+conjunction with the option '--input-metalink=file' for Metalink/XML,
+and '--metalink-over-http' for Metalink/HTTP.
+
+$ wget --input-metalink=<file> [directory options]
+$ wget --metalink-over-http [directory options] <url>
+
+2. Notes
+********
+
+Tests for metalink:file names beginning with '/', '~/', './', or '../'
+(e.g. "/path/file") shall be run manually due to security concerns.
+
+3. Metalink files used as reference
+***********************************
+
+3.1 Test: metalink:file with "path/file" name format
+====================================================
+
+cat > test.meta4 << EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<metalink xmlns="urn:ietf:params:xml:ns:metalink">
+  <file name="path/file">
+    <size>543</size>
+    <hash type="sha256">d37d3965f8e1a7b16504b4273b09c392776b7e4dd17e601256c7b2fd9ce5f56e</hash>
+    <hash type="md5">0f6ff5cdc15603f1b81227b5a296f001</hash>
+    <url>http://wrongurl.really/gnu/wget/wget-1.18.tar.xz.sig</url>
+    <url>http://ftpmirror.gnu.org/wget/wget-1.18.tar.xz.sig</url>
+    <url>http://ftp.gnu.org/gnu/wget/wget-1.18.tar.xz.sig</url>
+    <url>http://nl.mirror.babylon.network/gnu/wget/wget-1.18.tar.xz.sig</url>
+  </file>
+</metalink>
+EOF
+
+4. `wget --input-metalink=test.meta4`
+*************************************
+
+4.1 Implemented safety features
+===============================
+
+Any metalink:file name containing an absolute, relative, or home path
+(see '2. Notes') parsed from Metalink/XML files is rejected.
+
+This is a libmetalink's design decision implemented in the function
+metalink_check_safe_path().  This feature shall not be modified.
+
+All the above conform to the RFC5854 standard.
+
+References:
+ https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+ https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+4.2 File download behaviour
+===========================
+
+When a Metalink/XML file is parsed:
+1. create the metalink:file "path/file" tree;
+2. download the metalink:url file as "path/file";
+3. verify the "path/file" size, if declared;
+4. verify the "path/file" checksum.
+
+All the above conform to the RFC5854 standard.
+
+References:
+ https://tools.ietf.org/html/rfc5854
+
+4.3 Questionable behaviours
+===========================
+
+If more metalink:file elements are the same, wget downloads them all.
+
+5. `wget --metalink-over-http`
+******************************
+
+5.1 Implemented safety features
+===============================
+
+The function url_file_name() is responsible of parsing the url's file
+name and mixing in the "Directory Options" wrote on the command line.
+
+The use of libmetalink's metalink_check_safe_path() shouldn't be
+necessary (see '4.1 Implemented safety features').
+
+All the above comform to the usual Wget's download behaviour.
+
+References:
+ wget(1)
+
+5.2 File download behaviour
+===========================
+
+When a Metalink/HTTP header is parsed:
+1. extract metalink metadata from the header;
+2. download the file from the mirror with the highest priority;
+3. verify the file's size, if declared;
+4. verify the file's checksum.
+
+All the above comform to the usual Wget's download behaviour and to
+the RFC6249 standard.
+
+References:
+ wget(1)
+ https://tools.ietf.org/html/rfc6249
+
+6. Directory Options
+********************
+
+'-nd'
+'--no-directories'
+
+    Do not apply to Metalink/XML files (aka --input-metalink=<file>).
+
+    Apply to Metalink/HTTP urls as described in the Wget's manual, see
+    wget(1).  The target url is the url wrote on the command line.
+
+'-x'
+'--force-directories'
+
+    Do not apply to Metalink/XML files (aka --input-metalink=<file>).
+
+    Apply to Metalink/HTTP urls as described in the Wget's manual, see
+    wget(1).  The target url is the url wrote on the command line.
+
+'-nH'
+'--no-host-directories'
+
+    Do not apply to Metalink/XML files (aka --input-metalink=<file>).
+
+    Apply to Metalink/HTTP urls as described in the Wget's manual, see
+    wget(1).  The target url is the url wrote on the command line.
+
+'--protocol-directories'
+
+    Do not apply to Metalink/XML files (aka --input-metalink=<file>).
+
+    Apply to Metalink/HTTP urls as described in the Wget's manual, see
+    wget(1).  The target url is the url wrote on the command line.
+
+'--cut-dirs=number'
+
+    Do not apply to Metalink/XML files (aka --input-metalink=<file>).
+
+    Apply to Metalink/HTTP urls as described in the Wget's manual, see
+    wget(1).  The target url is the url wrote on the command line.
+
+'-P prefix'
+'--directory-prefix=prefix'
+
+    Set the top of the retrieval tree to prefix for both Metalink/XML
+    and Metalink/HTTP downloads, see wget(1).
+
+    If combining the prefix with the file name results in an absolute,
+    relative, or home path, the directory components are stripped and
+    only the basename is used. See '4.1 Implemented safety features'.

doc/sample.wgetrc

@@ -16,6 +16,9 @@
 ## To use the settings in this file, you will have to uncomment them,
 ## as well as change them, in most cases, as the values on the
 ## commented-out lines are the default values (e.g. "off").
+##
+## Command are case-, underscore- and minus-insensitive.
+## For example ftp_proxy, ftp-proxy and ftpproxy are the same.
 
 
 ##
@@ -122,7 +125,7 @@
 #iri = off
 
 # Force the default system encoding
-#locale = UTF-8
+#localencoding = UTF-8
 
 # Force the default remote server encoding
 #remoteencoding = UTF-8

doc/texi2pod.pl

@@ -1,6 +1,6 @@
 #! /usr/bin/env perl
 
-#   Copyright (C) 1999, 2000, 2001, 2003, 2007, 2009, 2010, 2011 Free
+#   Copyright (C) 1999-2001, 2003, 2007, 2009-2011, 2015, 2018-2023 Free
 #   Software Foundation, Inc.
 
 # This file is part of GCC.
@@ -315,6 +315,8 @@ die "No filename or title\n" unless defined $fn && defined $tl;
 $sects{NAME} = "$fn \- $tl\n";
 $sects{FOOTNOTES} .= "=back\n" if exists $sects{FOOTNOTES};
 
+print "=encoding utf-8\n\n";
+
 for $sect (qw(NAME SYNOPSIS DESCRIPTION OPTIONS ENVIRONMENT EXITSTATUS
            FILES BUGS NOTES FOOTNOTES SEEALSO AUTHOR COPYRIGHT)) {
     if(exists $sects{$sect}) {

fuzz/Makefile.am

@@ -0,0 +1,106 @@
+AM_CFLAGS = $(WERROR_CFLAGS) $(WARN_CFLAGS) $(CODE_COVERAGE_CFLAGS)
+AM_CPPFLAGS = -I$(top_srcdir)/src -I$(srcdir) -I$(top_builddir)/lib -I$(top_srcdir)/lib \
+ $(CODE_COVERAGE_CPPFLAGS) \
+ -DSRCDIR=\"$(abs_srcdir)\"
+LDADD = ../lib/libgnu.a \
+ $(GETADDRINFO_LIB) $(HOSTENT_LIB) $(INET_NTOP_LIB) $(INET_PTON_LIB) \
+ $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO) $(LIB_GETLOGIN) $(LIB_NANOSLEEP) $(LIB_POLL) \
+ $(LIB_POSIX_SPAWN) $(LIB_PTHREAD_SIGMASK) $(LIB_SELECT) $(LIBICONV) $(LIBINTL) \
+ $(LIBMULTITHREAD) $(LIBTHREAD) $(SERVENT_LIB) @INTL_MACOSX_LIBS@ \
+ $(FUZZ_LIBS) $(CODE_COVERAGE_LIBS)
+
+WGET_TESTS = \
+ wget_cookie_fuzzer$(EXEEXT) \
+ wget_css_fuzzer$(EXEEXT) \
+ wget_ftpls_fuzzer$(EXEEXT) \
+ wget_html_fuzzer$(EXEEXT) \
+ wget_netrc_fuzzer$(EXEEXT) \
+ wget_options_fuzzer$(EXEEXT) \
+ wget_progress_fuzzer$(EXEEXT) \
+ wget_read_hunk_fuzzer$(EXEEXT) \
+ wget_robots_fuzzer$(EXEEXT) \
+ wget_url_fuzzer$(EXEEXT)
+
+EXTRA_DIST = test-runner.sh
+
+if WITH_NTLM
+  WGET_TESTS += wget_ntlm_fuzzer$(EXEEXT)
+endif
+
+if FUZZING
+  bin_PROGRAMS = $(WGET_TESTS)
+  LDADD += $(LIB_FUZZING_ENGINE)
+  MAIN = fuzzer.h
+#  AM_LDFLAGS = -no-install -all-static
+else
+  AM_CPPFLAGS += -DTEST_RUN
+  AM_TESTS_ENVIRONMENT = export VALGRIND_TESTS"=@VALGRIND_TESTS@";
+  LOG_COMPILER = $(top_srcdir)/fuzz/test-runner.sh
+  TESTS = $(WGET_TESTS)
+  check_PROGRAMS = $(WGET_TESTS)
+  MAIN = main.c fuzzer.h
+endif
+
+# Make libunittest "PHONY" so we're always sure we're up-to-date.
+.PHONY: ../src/libunittest.a
+../src/libunittest.a:
+	$(MAKE) $(AM_MAKEFLAGS) -C ../src libunittest.a
+
+wget_cookie_fuzzer_SOURCES = wget_cookie_fuzzer.c $(MAIN)
+wget_cookie_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_css_fuzzer_SOURCES = wget_css_fuzzer.c $(MAIN)
+wget_css_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_ftpls_fuzzer_SOURCES = wget_ftpls_fuzzer.c $(MAIN)
+wget_ftpls_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_html_fuzzer_SOURCES = wget_html_fuzzer.c $(MAIN)
+wget_html_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_netrc_fuzzer_SOURCES = wget_netrc_fuzzer.c $(MAIN)
+wget_netrc_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_ntlm_fuzzer_SOURCES = wget_ntlm_fuzzer.c $(MAIN)
+wget_ntlm_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_options_fuzzer_SOURCES = wget_options_fuzzer.c $(MAIN)
+wget_options_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_progress_fuzzer_SOURCES = wget_progress_fuzzer.c $(MAIN)
+wget_progress_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_read_hunk_fuzzer_SOURCES = wget_read_hunk_fuzzer.c $(MAIN)
+wget_read_hunk_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_robots_fuzzer_SOURCES = wget_robots_fuzzer.c $(MAIN)
+wget_robots_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_url_fuzzer_SOURCES = wget_url_fuzzer.c $(MAIN)
+wget_url_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+#EXTRA_DIST = $(wildcard *.options) $(wildcard *.dict) \
+# $(wildcard *.in) $(wildcard *.repro)
+
+dist-hook:
+	find $(srcdir) -name '*.options' -exec cp -v '{}' $(distdir) ';'
+	find $(srcdir) -name '*.dict' -exec cp -v '{}' $(distdir) ';'
+#	find $(srcdir) -name '*.in' -exec cp -vr '{}' $(distdir) ';'
+	find $(srcdir) -name '*.repro' -exec cp -vr '{}' $(distdir) ';'
+
+clean-local:
+	rm -rf *.gc?? *.log lcov
+
+oss-fuzz:
+	if test "$$OUT" != ""; then \
+	XLIBS="-lpsl -lgnutls -lhogweed -lnettle -lidn2 -lunistring -lz"; \
+	for ccfile in wget*_fuzzer.c; do \
+	fuzzer=$$(basename $$ccfile .c); \
+	$$CC $$CFLAGS -I$(top_srcdir)/src -I$(top_srcdir) -I$(top_srcdir)/lib \
+	"$${fuzzer}.c" -o "$${fuzzer}" \
+	../src/libunittest.a ../lib/libgnu.a $${LIB_FUZZING_ENGINE} \
+	-Wl,-Bstatic $${XLIBS} -Wl,-Bdynamic; \
+	done; \
+	fi
+
+.PHONY: oss-fuzz

fuzz/README.md

@@ -0,0 +1,83 @@
+# Fuzzers
+
+These are fuzzers designed for use with `libFuzzer` or `afl`. They can
+be used to run on Google's OSS-Fuzz (https://github.com/google/oss-fuzz/).
+
+The convention used here is that the initial values for each parser fuzzer
+are taken from the $NAME.in directory.
+
+Crash reproducers from OSS-Fuzz are put into $NAME.repro directory for
+regression testing with top dir 'make check' or 'make check-valgrind'.
+
+
+# Running a fuzzer using clang
+
+Use the following commands on top dir:
+```
+export CC=clang
+# address sanitizer:
+#export CFLAGS="-O1 -g -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined,integer,nullability -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-coverage=trace-pc-guard,trace-cmp"
+export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link"
+# undefined sanitizer;
+export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fno-sanitize-recover=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fsanitize=fuzzer-no-link"
+export LIB_FUZZING_ENGINE="-lFuzzer  -lstdc++"
+./configure --enable-fuzzing --without-metalink --without-zlib --disable-pcre --without-libuuid --enable-assert
+make clean
+make -j$(nproc)
+cd fuzz
+
+# run wget_options_fuzzer
+UBSAN_OPTIONS=print_stacktrace=1 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \
+  ./run-clang.sh wget_options_fuzzer
+```
+
+If you see a crash, then a crash corpora is written that can be used for further
+investigation. E.g.
+```
+==2410==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000004e90 at pc 0x00000049cf9c bp 0x7fffb5543f70 sp 0x7fffb5543720
+...
+Test unit written to ./crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+```
+
+To reproduce the crash:
+```
+./wget_options_fuzzer < ./crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+```
+
+You can also copy/move that file into wget_options_fuzzer.repro/
+and re-build the project without fuzzing for a valgrind run, if you like that better.
+Just a `./configure` and a `make check-valgrind` should reproduce it.
+
+
+# Running a fuzzer using AFL
+
+Use the following commands on top dir:
+
+```
+$ export LIB_FUZZING_ENGINE=""
+$ CC=afl-clang-fast ./configure --enable-fuzzing
+$ make -j$(nproc) clean all
+$ cd fuzz
+$ ./run-afl.sh wget_options_fuzzer
+```
+
+# Fuzz code coverage using the corpus directories *.in/
+
+Code coverage reports currently work best with gcc+lcov+genhtml.
+
+In the top directory:
+```
+CC=gcc CFLAGS="-O0 -g" ./configure
+make fuzz-coverage
+xdg-open lcov/index.html
+```
+
+To work on corpora for better coverage, `cd fuzz` and use e.g.
+`./view-coverage.sh wget_options_fuzzer`.
+
+
+# Creating wget_options_fuzzer.dict
+
+```
+for i in `../src/wget --help|tr ' ' '\n'|grep ^--|cut -c 3-|sort`;do echo \"$i\"; done >wget_options_fuzzer.dict
+```

fuzz/fuzzer.h

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <stddef.h> // size_t
+#include <stdint.h> // uint8_t
+
+#if defined __clang__ || __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
+	#pragma GCC diagnostic ignored "-Wunused"
+	#pragma GCC diagnostic ignored "-Wunused-parameter"
+	#pragma GCC diagnostic ignored "-Wpedantic"
+#endif
+
+#define CLOSE_STDERR \
+	int bak = dup(STDERR_FILENO); \
+	int fd = open("/dev/null", O_WRONLY); \
+	dup2(fd, STDERR_FILENO); \
+	close(fd);
+
+#define RESTORE_STDERR \
+	dup2(bak, STDERR_FILENO); \
+	close(bak);
+
+#ifdef __cplusplus
+extern "C"
+#endif
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

fuzz/get_all_corpora

@@ -0,0 +1,11 @@
+#!/bin/sh -eu
+
+if ! grep FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Makefile >/dev/null; then
+  echo "The fuzzers haven't been built for fuzzing (maybe for regression testing !?)"
+  echo "Please built regarding README.md and try again."
+  exit 1
+fi
+
+for fuzzer in *_fuzzer.c; do
+  ./get_ossfuzz_corpora $(basename $fuzzer .c)
+done

fuzz/get_ossfuzz_corpora

@@ -0,0 +1,46 @@
+#!/bin/sh -eu
+
+# As a first step see README.md and follow the steps under "Running a fuzzer using clang".
+
+# You might need 'gsutil' to download new corpora from the Google cloud:
+# Read the docs at https://github.com/google/oss-fuzz/blob/master/docs/corpora.md
+# then install 'google-cloud-sdk' and execute 'gcloud init'.
+# Now 'gsutil' should be ready to use.
+
+if test -z "$1"; then
+  echo "Usage: $0 <fuzzer target>"
+  echo "Example: $0 wget_options_fuzzer"
+  exit 1
+fi
+
+if ! grep FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Makefile >/dev/null; then
+  echo "The fuzzers haven't been built for fuzzing (maybe for regression testing !?)"
+  echo "Please built regarding README.md and try again."
+  exit 1
+fi
+
+fuzzer=$1
+project=wget
+
+# sync/copy the OSS-Fuzz corpora into the .new directory
+mkdir -p ${fuzzer}.in ${fuzzer}.new
+cp -fp ${fuzzer}.in/* ${fuzzer}.new 2>/dev/null || true
+gsutil cp $(gsutil ls gs://${project}-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/${fuzzer}|tail -n 1) ${fuzzer}.new/
+(cd ${fuzzer}.new && unzip -q -o *.zip && rm *.zip)
+
+# create fuzzer target
+BUILD_ONLY=1 ./run-clang.sh ${fuzzer}
+
+# merge the corpora into the .in directory
+./${fuzzer} -merge=1 ${fuzzer}.in ${fuzzer}.new
+
+# now clear .new dir and put all corpora there
+rm -rf ${fuzzer}.new
+mv ${fuzzer}.in ${fuzzer}.new
+mkdir ${fuzzer}.in
+
+# now merge again (optimizes number of corpora)
+./${fuzzer} -merge=1 ${fuzzer}.in ${fuzzer}.new
+
+echo
+echo "If new files have been added, 'git add' and 'git commit' them."

fuzz/glob_crash.c

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+
+
+ * Created 19.10.2017 by Tim Rühsen
+ *
+ * Call glob() using data from fuzzer crash file
+ *
+ * Build and execute with instrumented gnulib (amend -I paths as needed):
+ *
+ * clang build (spills out WRITE heap buffer overflow)
+ * export CC=clang-6.0
+ * export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope"
+ * $CC $CFLAGS -I.. -I../lib glob_crash.c -o glob_crash ../lib/.libs/libgnu.a
+ * ./glob_crash
+ *
+ * gcc build (spills out READ heap buffer overflow):
+ * export CC=gcc
+ * export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope"
+ * $CC $CFLAGS -I.. -I../lib glob_crash.c -o glob_crash ../lib/.libs/libgnu.a
+ * ./glob_crash
+ */
+
+#include <glob.h>
+
+int main(int argc, char **argv)
+{
+static unsigned char data[] = "1e";
+
+	glob_t pglob;
+	if (glob(data, GLOB_TILDE|GLOB_ONLYDIR|GLOB_NOCHECK, NULL, &pglob) == 0)
+		globfree(&pglob);
+
+	return 0;
+}

fuzz/main.c

@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <fcntl.h>
+
+#include "fuzzer.h"
+#include "utils.h"
+
+#ifdef TEST_RUN
+
+#include <dirent.h>
+
+#ifdef _WIN32
+#  define SLASH '\\'
+#else
+#  define SLASH '/'
+#endif
+
+static int test_all_from(const char *dirname)
+{
+	DIR *dirp;
+
+	if ((dirp = opendir(dirname))) {
+		struct dirent *dp;
+
+		while ((dp = readdir(dirp))) {
+			if (*dp->d_name == '.') continue;
+
+			char fname[strlen(dirname) + strlen(dp->d_name) + 2];
+			snprintf(fname, sizeof(fname), "%s/%s", dirname, dp->d_name);
+
+			struct file_memory *fmem;
+			if ((fmem = wget_read_file(fname))) {
+				printf("testing %ld bytes from '%s'\n", fmem->length, fname);
+				fflush(stdout);
+				LLVMFuzzerTestOneInput((uint8_t *)fmem->content, fmem->length);
+				wget_read_file_free(fmem);
+			}
+		}
+		closedir(dirp);
+		return 0;
+	}
+
+	return 1;
+}
+
+int main(int argc, char **argv)
+{
+	const char *target;
+	size_t target_len;
+
+	if ((target = strrchr(argv[0], SLASH))) {
+		if (strrchr(target, '/'))
+			target = strrchr(target, '/');
+	} else
+		target = strrchr(argv[0], '/');
+
+	target = target ? target + 1 : argv[0];
+
+	if (strncmp(target, "lt-", 3) == 0)
+		target += 3;
+
+	target_len = strlen(target);
+
+#ifdef _WIN32
+	target_len -= 4; // ignore .exe
+#endif
+
+	{
+		int rc;
+		char corporadir[sizeof(SRCDIR) + 1 + target_len + 8];
+		snprintf(corporadir, sizeof(corporadir), SRCDIR "/%.*s.in", (int) target_len, target);
+
+		rc = test_all_from(corporadir);
+		if (rc)
+			fprintf(stderr, "Failed to find %s\n", corporadir);
+
+		snprintf(corporadir, sizeof(corporadir), SRCDIR "/%.*s.repro", (int) target_len, target);
+		if (test_all_from(corporadir) && rc)
+			return 77; // SKIP
+	}
+
+	return 0;
+}
+
+#else
+
+#ifndef __AFL_LOOP
+static int __AFL_LOOP(int n)
+{
+	static int first = 1;
+
+	if (first) {
+		first = 0;
+		return n && --n > 0;
+	}
+
+	return 0;
+}
+#endif
+
+int main(int argc, char **argv)
+{
+	int ret;
+	unsigned char buf[64 * 1024];
+
+	while (__AFL_LOOP(10000)) { // only works with clang - we have to use 1 because static/global vars in wget
+		ret = fread(buf, 1, sizeof(buf), stdin);
+		if (ret < 0)
+			return 0;
+
+		LLVMFuzzerTestOneInput(buf, ret);
+	}
+
+	return 0;
+}
+
+#endif /* #ifdef TEST_RUN */

fuzz/run-afl.sh

@@ -0,0 +1,59 @@
+#!/bin/sh -eu
+
+# Copyright (c) 2017, 2019-2023 Free Software Foundation, Inc.
+#
+# This file is part of GNU Wget.
+#
+# GNU Wget is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GNU Wget is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with GNU Wget.  If not, see <https://www.gnu.org/licenses/>.
+
+if ! grep '^CC=.afl-clang-fast' ../config.log >/dev/null; then
+	echo "compile first library as:"
+	echo "CC=afl-clang-fast ./configure"
+	exit 1
+fi
+
+if test -z "$1"; then
+	echo "Usage: $0 test-case"
+	echo "Example: $0 wget_options_fuzzer"
+	exit 1
+fi
+
+fuzzer=$1
+#rm -f $fuzzer
+#afl-clang-fast -O2 -g -I.. main.c "${fuzzer}.c" -o "${fuzzer}"
+
+### minimize test corpora
+if test -d ${fuzzer}.in; then
+  mkdir -p ${fuzzer}.min
+  for i in `ls ${fuzzer}.in`; do
+    fin="${fuzzer}.in/$i"
+    fmin="${fuzzer}.min/$i"
+    if ! test -e $fmin || test $fin -nt $fmin; then
+      afl-tmin -m 500 -i $fin -o $fmin -- ./${fuzzer}
+    fi
+  done
+fi
+
+TMPOUT=${fuzzer}.out
+mkdir -p ${TMPOUT}
+
+if test -f ${fuzzer}.dict; then
+  afl-fuzz -m 500 -i ${fuzzer}.min -o ${TMPOUT} -x ${fuzzer}.dict -- ./${fuzzer}
+else
+  afl-fuzz -m 500 -i ${fuzzer}.min -o ${TMPOUT} -- ./${fuzzer}
+fi
+
+echo "output was stored in $TMPOUT"
+
+exit 0

fuzz/run-clang.sh

@@ -0,0 +1,57 @@
+#!/bin/bash -e
+#
+# Copyright (c) 2017, 2019-2023 Free Software Foundation, Inc.
+#
+# This file is part of GNU Wget.
+#
+# GNU Wget is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GNU Wget is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with GNU Wget.  If not, see <https://www.gnu.org/licenses/>.
+
+trap ctrl_c INT
+
+ctrl_c() {
+  ./${fuzzer} -merge=1 ${fuzzer}.in ${fuzzer}.new
+  rm -rf ${fuzzer}.new
+}
+
+if test -z "$1"; then
+	echo "Usage: $0 <fuzzer target>"
+	echo "Example: $0 wget_options_fuzzer"
+	exit 1
+fi
+
+if ! grep FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Makefile >/dev/null; then
+  echo "The fuzzers haven't been built for fuzzing (maybe for regression testing !?)"
+  echo "Please built regarding README.md and try again."
+  exit 1
+fi
+
+# you'll need ~2GB free memory per worker !
+fuzzer=$1
+workers=$(($(nproc) - 0))
+jobs=$workers
+
+if test -n "$BUILD_ONLY"; then
+  exit 0
+fi
+
+# create directory for NEW test corpora (covering new areas of code)
+mkdir -p ${fuzzer}.new
+
+if test -f ${fuzzer}.dict; then
+  ./${fuzzer} -dict=${fuzzer}.dict ${fuzzer}.new ${fuzzer}.in -jobs=$jobs -workers=$workers
+else
+  ./${fuzzer} ${fuzzer}.new ${fuzzer}.in -jobs=$jobs -workers=$workers
+fi
+
+exit 0

fuzz/test-runner.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+
+WRAPPER=""
+
+if [ -n "$VALGRIND_TESTS" ]; then
+    WRAPPER="valgrind --error-exitcode=301 --leak-check=yes --show-reachable=yes --track-origins=yes"
+fi
+
+exec $WRAPPER "$@"

fuzz/view-coverage.sh

@@ -0,0 +1,37 @@
+#!/bin/bash -eu
+#
+# (C)2017 Tim Ruehsen tim.ruehsen@gmx.de
+#
+# View the coverage report for one or more fuzzers.
+
+# 1. execute 'make fuzz-coverage' in the top directory
+# 2. execute './view-coverage.sh <fuzz target(s)>
+
+# Example with single fuzzer:
+#   ./view-coverage.sh wget_options_fuzzer
+
+# Example with two fuzzers:
+#   ./view-coverage.sh wget_options_fuzzer wget_html_parse_fuzzer
+
+if test -z "$1"; then
+  echo "Usage: $0 <fuzz target(s)>"
+  echo "Example: $0 wget_options_fuzzer"
+  exit 1
+fi
+
+#fuzzer="./"$1
+LCOV_INFO=coverage.info
+#./coverage.sh $fuzzer
+#lcov --capture --initial --directory ../src/.libs --directory . --output-file $LCOV_INFO
+#lcov --capture --directory ../src/.libs --output-file $LCOV_INFO
+#lcov --remove $LCOV_INFO '*/test_linking.c' '*/css_tokenizer.lex' '*/<stdout>' '*/*.h' -o $LCOV_INFO
+#genhtml --prefix . --ignore-errors source $LCOV_INFO --legend --title "$1" --output-directory=lcov
+
+lcov --zerocounters --directory ../src/
+lcov --capture --initial --directory ../src/.libs --directory . --output-file $LCOV_INFO
+make check TESTS="$*" CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+lcov --capture --directory ../src/.libs --output-file $LCOV_INFO
+lcov --remove $LCOV_INFO '*/css_tokenizer.lex' '*/*.h' -o $LCOV_INFO
+genhtml --prefix . --ignore-errors source $LCOV_INFO --legend --title "$*" --output-directory=lcov
+
+xdg-open lcov/index.html

fuzz/wget_cookie_fuzzer.c

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+
+#include <sys/types.h>
+#include <dirent.h> // opendir, readdir
+#include <stdint.h> // uint8_t
+#include <stdio.h>  // fmemopen
+#include <string.h>  // strncmp
+#include <stdlib.h>  // free
+#include <fcntl.h>  // open flags
+#include <unistd.h>  // close
+
+#include "wget.h"
+#undef fopen_wgetrc
+
+#ifdef __cplusplus
+  extern "C" {
+#endif
+  #include "cookies.h"
+
+  // declarations for wget internal functions
+  int main_wget(int argc, const char **argv);
+  void cleanup(void);
+  FILE *fopen_wget(const char *pathname, const char *mode);
+  FILE *fopen_wgetrc(const char *pathname, const char *mode);
+  void exit_wget(int status);
+#ifdef __cplusplus
+  }
+#endif
+
+#include "fuzzer.h"
+
+FILE *fopen_wget(const char *pathname, const char *mode)
+{
+	return fopen("/dev/null", mode);
+}
+
+FILE *fopen_wgetrc(const char *pathname, const char *mode)
+{
+	return NULL;
+}
+
+#ifdef FUZZING
+void exit_wget(int status)
+{
+}
+#endif
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+	struct cookie_jar *cookie_jar;
+	char *set_cookie;
+
+	if (size > 1024) // same as max_len = ... in .options file
+		return 0;
+
+	set_cookie = (char *) malloc(size + 1);
+	memcpy(set_cookie, data, size);
+	set_cookie[size] = 0;
+
+	CLOSE_STDERR
+
+	cookie_jar = cookie_jar_new();
+	cookie_handle_set_cookie(cookie_jar, "x", 81, "p", set_cookie);
+	cookie_handle_set_cookie(cookie_jar, "x", 81, "p", set_cookie);
+	cookie_handle_set_cookie(cookie_jar, "x", 80, "p/d/", set_cookie);
+	cookie_jar_delete(cookie_jar);
+
+	RESTORE_STDERR
+
+	free(set_cookie);
+
+	return 0;
+}

fuzz/wget_cookie_fuzzer.dict

@@ -0,0 +1,6 @@
+tag1="expires="
+tag2="path="
+tag3="domain="
+tag4="httponly"
+tag5="secure"
+tag6="max-age"

fuzz/wget_cookie_fuzzer.in/00026b85ea15a4c308623a853ece6a5211a2f731

@@ -0,0 +1 @@
+??????

fuzz/wget_cookie_fuzzer.in/004537f3b1fd67347489185a1c4b55da58f6edca

@@ -0,0 +1 @@
+AAAAAAAAAAA

fuzz/wget_cookie_fuzzer.in/00b3bdd8fd5720714adc4522840c12d3a7fcc189

@@ -0,0 +1 @@
+]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

fuzz/wget_cookie_fuzzer.in/00e41b1326bbfab11b96affe7aba03085f444dd9

@@ -0,0 +1 @@
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

fuzz/wget_cookie_fuzzer.in/00e7c21c288cf850c7e4587c063c206d0a79933b

@@ -0,0 +1 @@
+¦=;e;x;Õ;e;e;r;s;„;A;r;y

fuzz/wget_cookie_fuzzer.in/011f7cd59ed6793e828f6ed8683bba1dab177049

@@ -0,0 +1 @@
+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

fuzz/wget_cookie_fuzzer.in/01574bf1ccc14de2346f11653cbd9512f75adbaa

@@ -0,0 +1 @@
+]=;max-age=3;max-age=4;max-age=8;max-age=3;max-age=4;max-age=8

fuzz/wget_cookie_fuzzer.in/018f4d7f06cb8626e1756452581373e05ae41c56

@@ -0,0 +1 @@
+xxxxxx

fuzz/wget_cookie_fuzzer.in/01b626290786f7603b771ab34697a4efdc0756bf

@@ -0,0 +1 @@
+```````````````````````````````````````````

fuzz/wget_cookie_fuzzer.in/01cc44f3312eafab893506b616dee3c0d8431e1f

@@ -0,0 +1 @@
+***************************************************************************************************************************************************************************

fuzz/wget_cookie_fuzzer.in/01d94a6f21b47b294553d412889a784d3553cf6f

@@ -0,0 +1 @@
+

fuzz/wget_cookie_fuzzer.in/026c61993a82946f6cdbd27e366a02f826519f32

@@ -0,0 +1 @@
+OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

fuzz/wget_cookie_fuzzer.in/029aa48342e903da8be6b70a5e75ac30a5835645

@@ -0,0 +1 @@
+*
=;*
=;*!=;*#=;*_=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*ﾋ=;*ｪ=;*_=;*!=;*#=;*#=;*_=;*
=;*ﾋ=;*_=;*!=;*#=;*_=;*@=;*W=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*ﾚ=;*@=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*ﾚ=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*_=;*ﾋ=;*_=;*p=;*_=;*_=;*ﾋ=;*_=;*ﾋ=;*_=;*!=;*_=;*ﾋ=;*_=;*!=;*#=;*_=;*ﾚ=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*_=;*#=;*ｽ=

fuzz/wget_cookie_fuzzer.in/02a0fe821c4e2772c50ce233c36a4506a0e4cbb3

@@ -0,0 +1 @@
+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

fuzz/wget_cookie_fuzzer.in/02aa629c8b16cd17a44f3a0efec2feed43937642

@@ -0,0 +1 @@
+S

fuzz/wget_cookie_fuzzer.in/02d4d85c3221e9ec21b09090ed4076ffa41e7f40

@@ -0,0 +1 @@
+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

fuzz/wget_cookie_fuzzer.in/0343bb07c98f8a943e8eb80c0ba3d9758d372d22

@@ -0,0 +1 @@
+oo

fuzz/wget_cookie_fuzzer.in/0400588615116f3510881ba1afbb6aa19cf669a4

@@ -0,0 +1 @@
+(=;expires==;expires=i;expires=M;expires=*;expires=*;expires==;expires=M;expires=M;expires=3;expires==;expires=M;expires=*;expires=*;expires==;expires=M;expires=M;expires=MonFeB1 7:4:83¹;expires==;expires=M;expires=*;expires=*;expires=x;expires=M;expires=ª;expires=*;expires==;expires=M;expires=M;expires=3;expires==;expires=M;expires=*;expires=*;expires==;expires=*;expires=M;expires=M;expires=4;expires=<;expires=M;expires=M;expires=E;expires=e

fuzz/wget_cookie_fuzzer.in/042dc4512fa3d391c5170cf3aa61e6a638f84342

@@ -0,0 +1 @@
+i

fuzz/wget_cookie_fuzzer.in/045240b6e36beb506efe8d0149db18e7cfca8953

@@ -0,0 +1 @@
+PPP

fuzz/wget_cookie_fuzzer.in/04905ec7b4e10e22a940d4b104dc87865dea61ac

@@ -0,0 +1 @@
+4444444444444444444444444444444444444444444

fuzz/wget_cookie_fuzzer.in/0499a0a3f2f4da8697632d5b7af66ec607b06d99

@@ -0,0 +1 @@
+^^

fuzz/wget_cookie_fuzzer.in/04a4c03a45442dad60d0b6dcfd6ed2c2dc0051ff

@@ -0,0 +1 @@
+22222222222222222222222222222222222222222222222222222222222222222222222222222222222222

fuzz/wget_cookie_fuzzer.in/05570ae54e2d055e6f5299b6c537c017c7d6a48d

@@ -0,0 +1 @@
+:=;domain=';path=/p/

fuzz/wget_cookie_fuzzer.in/056cd73f9a0d3c579caa3dd1563e7585cc3e8da8

@@ -0,0 +1 @@
+RRRRRRRRRRR

fuzz/wget_cookie_fuzzer.in/05a79f06cf3f67f726dae68d18a2290f6c9a50c9

@@ -0,0 +1 @@
+:

fuzz/wget_cookie_fuzzer.in/06576556d1ad802f247cad11ae748be47b70cd9c

@@ -0,0 +1 @@
+R

fuzz/wget_cookie_fuzzer.in/067d5096f219c64b53bb1c7d5e3754285b565a47

@@ -0,0 +1 @@
+

fuzz/wget_cookie_fuzzer.in/06b2a5c5b0c6dd151756d8fa2d67f179606f95a1

@@ -0,0 +1 @@
+IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII

fuzz/wget_cookie_fuzzer.in/071b51ccbf42ba50dfa9f6a1cbaaccdfddf5ca59

@@ -0,0 +1 @@
+.=;max-age=˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙=-˛

fuzz/wget_cookie_fuzzer.in/071b6a8b895bad8b47b531d14c5f9d9b1eba44a0

@@ -0,0 +1,24 @@
+J="/	path=pires=
+
+
+
+
+
+
+
+
+Jpath=
+
+
+
+
+
+
+
+
+
+
+
+™
+
+

fuzz/wget_cookie_fuzzer.in/0730ab2238e96a8cbec2b1b7efd6c0d49106c136

@@ -0,0 +1 @@
+wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww

fuzz/wget_cookie_fuzzer.in/07962e32beac4da179b30c06f1c1e71bd220f782

@@ -0,0 +1 @@
+nn

fuzz/wget_cookie_fuzzer.in/07991db1702d2aaa50c7c2ffb4c4d630d2906bf5

@@ -0,0 +1 @@
+kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk

fuzz/wget_cookie_fuzzer.in/07c342be6e560e7f43842e2e21b774e61d85f047

@@ -0,0 +1 @@
+l

fuzz/wget_cookie_fuzzer.in/07dcd371560bc43c48f56a2f55739ac66741d59d

@@ -0,0 +1 @@
+ggg

fuzz/wget_cookie_fuzzer.in/08534f33c201a45017b502e90a800f1b708ebcb3

@@ -0,0 +1 @@
+\

fuzz/wget_cookie_fuzzer.in/08740c067691007b065abbfea868fffe188a743a

@@ -0,0 +1 @@
+&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

fuzz/wget_cookie_fuzzer.in/088fb1a4ab057f4fcf7d487006499060c7fe5773

@@ -0,0 +1 @@
+   

fuzz/wget_cookie_fuzzer.in/0899500d67e2311f01b9bdedc81a0ec79c5b6a03

@@ -0,0 +1 @@
+

fuzz/wget_cookie_fuzzer.in/08a914cde05039694ef0194d9ee79ff9a79dde33

@@ -0,0 +1 @@
+O

fuzz/wget_cookie_fuzzer.in/08e02d827446f7fe647672cbc95dab2c71f3d0ee

@@ -0,0 +1 @@
+      

fuzz/wget_cookie_fuzzer.in/091385be99b45f459a231582d583ec9f3fa3d194

@@ -0,0 +1 @@
+>

fuzz/wget_cookie_fuzzer.in/092715632b51a2d40b4e255621f19d0940b2a91f

@@ -0,0 +1 @@
+@=;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-5 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-5 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-;expireS=Mon,2-FeB-0 7:4:9-

fuzz/wget_cookie_fuzzer.in/09343c85545555efc31e6e70b7ea7dcadf854930

@@ -0,0 +1 @@
+{{

fuzz/wget_cookie_fuzzer.in/099600a10a944114aac406d136b625fb416dd779

@@ -0,0 +1 @@
+  

fuzz/wget_cookie_fuzzer.in/0a32a7ce87f2ece5c52122c96a3a1d2c34e3b19c

@@ -0,0 +1 @@
+ggggggggggg