* src/http.c (http_loop): Fix memory leak

* src/url.c (url_skip_credentials): Properly re-implement userinfo parsing (rfc2396)

The reason why the implementation is based on RFC 2396, an outdated standard,
is that the whole file is based on that RFC, and mixing standard here might be
dangerous.

.gitlab-ci.yml

@@ -41,6 +41,17 @@ variables:
   CONFIGURE_BASE_FLAGS: --enable-assert --cache-file cache/config.cache
   CFLAGS_DEFAULT: -O0 -g -ggdb3
 
+CommitCheck:
+  stage: test-from-git
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+  script:
+    - ./contrib/commit-check
+  allow_failure: true
+  cache:
+      paths:
+      policy: push
+
+
 # Create the tarball in a separate build directory (VPATH).
 Build-Tarball:
     stage: test-from-git

.prev-version

@@ -1 +1 @@
-1.21.3
+1.24.5

.travis.yml

@@ -1,51 +0,0 @@
-sudo: no
-dist: trusty
-
-language: c
-
-compiler:
-    - gcc
-
-notifications:
-    email:
-        recipients:
-            - darnir@gmail.com
-            - wget-dev@gnu.org
-        on_success: change
-        on_failure: always
-
-env:
-    global:
-        - PERLLIB=$PERLLIB:../../tests
-        - PERL5LIB=$PERL5LIB:../../tests
-    matrix:
-        - SSL=""
-        - SSL="openssl"
-        - SSL="gnutls"
-
-addons:
-    apt:
-        packages:
-            - automake
-            - autoconf
-            - autopoint
-            - flex
-            - texinfo
-            - pkg-config
-            - libgnutls-dev
-            - libssl-dev
-            - make
-            - libhttp-daemon-perl
-            - libio-socket-ssl-perl
-            - libidn2-dev
-            - gettext
-            - texlive
-            - python3
-            - valgrind
-            - language-pack-tr
-            - language-pack-ru
-
-script:
-    - make distclean || true
-    - ./bootstrap
-    - ./contrib/travis-ci $SSL

AUTHORS

@@ -1,62 +1,366 @@
 Authors of GNU Wget.
+Thank you very much for spending your time !
 
-[ Note that this file does not attempt to list all the contributors to
-  Wget; look at the ChangeLogs for that.  This is a list of people who
-  contributed sizeable amounts of code and assigned the copyright to
-  the FSF. ]
 
-Hrvoje Niksic.  Designed and implemented Wget.
+This list of contributors is maintained in
+(more or less) the order of date of first commit.
+Those with the "ASSGN" tag have assigned the copyrights
+of their patches to the FSF.
 
-Gordon Matzigkeit.  Wrote netrc.c and netrc.h.
+The list was generated on 14.05.23 by parsing the ChangeLog
+file until 2014 and the git commit history after that.
 
-Darko Budor.  Wrote initial support for Windows, wrote wsstartup.c,
-wsstartup.h and windecl.h.  (The files were later renamed, but his
-code and ideas remained present.)
+Current Maintainers:
 
-Junio Hamano.  Added support for FTP Opie and HTTP digest
-authentication.
+[ASSGN] Darshit Shah *darnir [at] gnu.org*
+[ASSGN] Tim Rühsen *tim.ruehsen [at] gmx.de*
 
-Dan Harkless.  Added --backup-converted, --follow-tags, --html-extension,
---ignore-tags, and --page-requisites; improved documentation; etc. Was
-the principle maintainer of GNU Wget for some time.
+Contributors:
 
-Christian Fraenkel.  Initially implemented SSL support.
 
-Thomas Lussnig.  Initially implemented IPv6 support.
-
-Ian Abbott.  Contributed bugfixes, Windows-related fixes, provided a
-prototype implementation of the new recursive code, and more.
-Co-maintained Wget during the 1.8 release cycle.
-
-Gisle Vanem.  Contributed Windows and MS-DOS improvements, including a
-port of run_with_timeout to Windows, additions to Makefiles, and many
-bug reports and fixes.
-
-Mauro Tortonesi.  Improved IPv6 support, adding support for dual
-family systems.  Refactored and enhanced FTP IPv6 code. Maintained GNU
-Wget from 2004-2007.
-
-Nicolas Schodet.  Contributed to cookie code and documentation.
-
-Daniel Stenberg.  NTLM authentication in http-ntlm.c and http-ntlm.h
-originally written for curl donated for use in GNU Wget.
-
-Micah Cowan.  Maintained Wget from mid-2007 to mid-2010.
-
-Ralf Wildenhues.  Contributed patches to convert Wget to use Automake as
-part of its build process, and various bugfixes.
-
-Steven Schubiger.  Many helpful patches, bugfixes and improvements.
-Notably, conversion of Wget to use the Gnulib quotes and quoteargs
-modules, and the addition of password prompts at the console, via the
-Gnulib getpasswd-gnu module.
-
-Ted Mielczarek.  Support for parsing links from CSS.
-
-Saint Xavier.  Support for IRIs (RFC 3987).
-
-Giuseppe Scrivano.  Added support for HTTP/1.1.  Active Wget Maintainer from 2010-2015.
-
-Tim Ruehsen.  Active Wget Maintainer / Developer from 2012-2020.
-
-Darshit Shah.  Active Wget Maintainer / Developer from 2013-2020.
+[ASSGN] Hrvoje Niksic *hniksic [at] srce.hr*
+        Designed and implemented Wget.
+[     ] Hrvoje Lacko *hlacko [at] fly.cc.fer.hr*
+[     ] Antonio Rosella *antonio.rosella [at] agip.it*
+[     ] Drazen Kacar *dave [at] fly.cc.fer.hr*
+[     ] Tage Stabell-Kulo *tage [at] acm.org*
+[     ] Shawn McHorse *riffraff [at] txdirect.net*
+[     ] Mark Boyns *boyns [at] sdsu.edu*
+[     ] Dieter Baron *dillo [at] danbala.tuwien.ac.at*
+[     ] Gregor Hoffleit *flight [at] mathi.uni-heidelberg.DE*
+[     ] Kaveh R. Ghazi *ghazi [at] caip.rutgers.edu*
+[ASSGN] Gordon Matzigkeit *gord [at] gnu.ai.mit.edu*
+        Wrote netrc.c and netrc.h.
+[ASSGN] Darko Budor *dbudor [at] zems.fer.hr*
+        Wrote initial support for Windows, wrote wsstartup.c,
+        wsstartup.h and windecl.h.(The files were later renamed,
+        but his code and ideas remained present.)
+[     ] Roger Beeman *beeman [at] cisco.com*
+[     ] Marin Purgar *pmc [at] asgard.hr*
+[     ] gilles Cedoc *gilles [at] cedocar.fr*
+[     ] Karl Eichwalder *ke [at] ke.Central.DE*
+[     ] Fila Kolodny *fila [at] ibi.com*
+[     ] Andreas Schwab *schwab [at] issan.informatik.uni-dortmund.de*
+[     ] Mike Thomas *mthomas [at] reality.ctron.com*
+[     ] Francois Pinard *pinard [at] iro.umontreal.ca*
+[     ] Jordan Mendelson *jordy [at] wserv.com*
+[     ] Karl Heuer *kwzh [at] gnu.org*
+[     ] Andy Eskilsson *andy.eskilsson [at] telelogic.se*
+[     ] Karl Eichwalder *ke [at] suse.de*
+[     ] Simon Josefsson *jas [at] pdc.kth.se*
+[     ] Karl Eichwalder *karl [at] suse.de*
+[ASSGN] Junio Hamano *junio [at] twinsun.com*
+        Added support for FTP Opie and HTTP digest authentication.
+[     ] Tim Adam *tma [at] osa.com.au*
+[     ] Wanderlei Cavassin *cavassin [at] conectiva.com.br*
+[ASSGN] Jan Prikryl *prikryl [at] cg.tuwien.ac.at*
+[     ] John *john [at] futuresguide.com*
+[     ] Tim Charron *tcharron [at] interlog.com*
+[     ] Robert Schmidt *rsc [at] vingmed.no*
+[     ] Stefan Hornburg *racke [at] gundel.han.de*
+[     ] Giovanni Bortolozzo *borto [at] dei.unipd.it*
+[     ] Gregor Hoffleit *flight [at] mathi.uni-heidelberg.de*
+[     ] Douglas E. Wegscheid *wegscd [at] whirlpool.com*
+[     ] Toomas Soome *tsoome [at] ut.ee*
+[     ] Simos KSenitellis *simos [at] teiath.gr*
+[     ] Juan Jose Rodriguez *jcnsoft [at] jal1.telmex.net.mx*
+[     ] Dominique Delamarre *dominique.delamarre [at] hol.fr*
+[     ] Martin Kraemer *Martin.Kraemer [at] mch.sni.de*
+[     ] Mathieu Guillaume *mat [at] cythere.com*
+[     ] Alexander Kourakos *awk [at] bnt.com*
+[     ] Dave Love *d.love [at] dl.ac.uk*
+[     ] Heinz Salzmann *heinz.salzmann [at] intermetall.de*
+[     ] Adam D. Moss *adam [at] foxbox.org*
+[     ] Howard Gayle *howard [at] fjst.com*
+[     ] Hans Grobler *grobh [at] conde.ee.sun.ac.za*
+[     ] Szakacsits Szabolcs *szaka [at] sienet.hu*
+[     ] Simon Munton *simonm [at] m4data.co.uk*
+[     ] Edward J. Sabol *sabol [at] alderaan.gsfc.nasa.gov*
+[     ] "R. K. Owen" *rkowen [at] Nersc.GOV*
+[     ] Alexander V. Lukyanov *lav [at] yars.free.net*
+[     ] andrew deryabin *djsf [at] softhome.net*
+[     ] Heiko Herold *Heiko.Herold [at] previnet.it*
+[     ] Dan Berger *dberger [at] ix.netcom.com*
+[     ] Charles G Waldman *cgw [at] fnal.gov*
+[     ] Damir Dzeko *ddzeko [at] zesoi.fer.hr*
+[ASSGN] Dan Harkless *wget [at] harkless.org*
+        Added --backup-converted, --follow-tags, --html-extension,
+        --ignore-tags, and --page-requisites;
+        improved documentation; etc. Was the principle maintainer
+        of GNU Wget for some time.
+[     ] Daniel S. Lewart *d-lewart [at] uiuc.edu*
+[     ] HIROSE Masaaki *hirose31 [at] t3.rim.or.jp*
+[     ] Const Kaplinsky *const [at] ce.cctpu.edu.ru*
+[     ] John Daily *jdaily [at] cyberdude.com*
+[     ] Adrian Aichner *adrian [at] xemacs.org*
+[     ] Matthew Seaman *m.seaman [at] inpharmatica.co.uk*
+[     ] Tyler Riddle *triddle [at] liquidmarket.com*
+[     ] John Summerfield *summer [at] OS2.ami.com.au*
+[     ] Csaba Raduly *csaba.raduly [at] sophos.com*
+[     ] Igor Khristophorov *igor [at] atdot.org*
+[     ] Adrian Aichner *Adrian.Aichner [at] t-online.de*
+[     ] Jonas Jensen *bones [at] huleboer.dk*
+[     ] Tim Mooney *mooney [at] dogbert.cc.ndsu.NoDak.edu*
+[     ] Hack Kampbjørn *hack [at] hackdata.com*
+[     ] Philipp Thomas *pthomas [at] suse.de*
+[     ] Nicolas Lichtmaier *nick [at] debian.org*
+[     ] KOJIMA Hajime *kjm [at] rins.ryukoku.ac.jp*
+[     ] Paul Bludov *paul [at] ozero.net*
+[     ] Trond Eivind Glomsrod *teg [at] redhat.com*
+[ASSGN] Ian Abbott *abbotti [at] mev.co.uk*
+        Contributed bugfixes, Windows-related fixes, provided a
+        prototype implementation of the new recursive code, and more.
+        Co-maintained Wget during the 1.8 release cycle.
+[ASSGN] Maciej W. Rozycki *macro [at] ds2.pg.gda.pl*
+[     ] R.I.P. Deaddog *maddog [at] linuxhall.org*
+[     ] Adam J. Richter *adam [at] yggdrasil.com*
+[     ] Dave Turner *dct25 [at] hermes.cam.ac.uk*
+[ASSGN] Christian Fraenkel *c.fraenkel [at] gmx.net*
+        Initially implemented SSL support.
+[     ] Daniel BODEA *dali [at] dali-designs.com*
+[     ] Alan Eldridge *alane [at] geeksrus.net*
+[     ] Chris Seawood *cls [at] seawood.org*
+[     ] Peter Farmer *peter.farmer [at] zveno.com*
+[     ] Jochen Hein *jochen [at] jochen.org*
+[     ] Lemble Gregory *gregory.lemble [at] st.com*
+[     ] Ingo T. Storm *tux-sparc [at] computerbild.de*
+[     ] T. Bharath *TBharath [at] responsenetworks.com*
+[     ] Andre Majorel *amajorel [at] teaser.fr*
+[     ] Christian Lackas *delta [at] lackas.net*
+[     ] Andreas Damm *andreas-sourceforge [at] radab.org*
+[     ] Chin-yuan Kuo *sr1111111 [at] yahoo.com.tw*
+[ASSGN] Thomas Lussnig *thomas.lussnig [at] bewegungsmelder.de*
+        Initially implemented IPv6 support.
+[     ] Bill Richardson *bill [at] riverstonenet.com*
+[ASSGN] Nicolas Schodet *contact [at] ni.fr.eu.org*
+        Contributed to cookie code and documentation.
+[     ] Ahmon Dancy *dancy [at] dancysoft.com*
+[     ] Noel Kothe *noel [at] debian.org*
+[     ] Aurelien Marchand *artaxerxes [at] users.sf.net*
+[     ] Aaron S. Hawley *Aaron.Hawley [at] uvm.edu*
+[     ] Bertrand Demiddelaer *bert [at] b3rt.org*
+[     ] Matthew J. Mellon *mellon [at] tymenet.com*
+[ASSGN] Gisle Vanem *giva [at] bgnett.no*
+        Contributed Windows and MS-DOS improvements, including a
+        port of run_with_timeout to Windows, additions to Makefiles,
+        and many bug reports and fixes.
+[     ] Philip Stadermann *philip.stadermann [at] credativ.de*
+[     ] Dennis Smit *ds [at] nerds-incorporated.org*
+[     ] Christian Biere *christianbiere [at] gmx.de*
+[     ] David Fritz *zeroxdf [at] att.net*
+[     ] Jens Roesner *jens.roesner [at] gmx.de*
+[     ] Nico R. *n-roeser [at] gmx.net*
+[     ] Larry Jones *lawrence.jones [at] ugsplm.com*
+[     ] YAMAZAKI Makoto *Yamazaki.Makoto [at] fujixerox.co.jp*
+[     ] Hans-Andreas Engel *engel [at] node.ch*
+[     ] Leonid Petrov *nouser [at] lpetrov.net*
+[     ] Ulf Harnhammar *ulf.harnhammar.9485 [at] student.uu.se*
+[ASSGN] Mauro Tortonesi *mauro [at] ferrara.linux.it*
+        Improved IPv6 support, adding support for dual
+        family systems.  Refactored and enhanced FTP IPv6 code.
+        Maintained GNU Wget from 2004-2007.
+[     ] Marco Colombo *m.colombo [at] ed.ac.uk*
+[     ] Joseph Caretto *jcaretto [at] pitt.edu*
+[     ] FUJISHIMA Satsuki *sf [at] FreeBSD.org*
+[     ] Charles C.Fu *ccwf [at] bacchus.com*
+[     ] Andreas Beckmann *debian [at] abeckmann.de*
+[     ] Keith Moore *keithmo [at] exmsft.com*
+[     ] Benno Schulenberg *benno [at] nietvergeten.nl*
+[     ] Giuseppe Bonacci *g.bonacci [at] libero.it*
+[     ] Vasil Dimov *vd [at] datamax.bg*
+[     ] Albert Chin *wget [at] mlists.thewrittenword.com*
+[     ] Jeremy Shapiro *jnshapiro [at] gmail.com*
+[     ] Stepan Kasal *kasal [at] ucw.cz*
+[     ] Russ Allbery *rra [at] stanford.edu*
+[ASSGN] Daniel Stenberg *daniel [at] haxx.se*
+        NTLM authentication in http-ntlm.c and http-ntlm.h
+        originally written for curl donated for use in GNU Wget.
+[     ] Lawrence Jones *lawrence.jones [at] ugs.com*
+[     ] CHEN Peng *chenpeng [at] alumni.nus.edu.sg*
+[ASSGN] Tony Lewis *tlewis [at] exelana.com*
+[     ] KJKHyperion *hackbunny [at] reactos.com*
+[     ] Daniel Richard G. *skunk [at] iSKUNK.ORG*
+[     ] Mike Grant *mggr [at] pml.ac.uk*
+[ASSGN] Micah Cowan *micah [at] cowan.name*
+        Maintained Wget from mid-2007 to mid-2010.
+[ASSGN] Joshua David Williams *yurimxpxman [at] gmail.com*
+[ASSGN] Ralf Wildenhues *Ralf.Wildenhues [at] gmx.de*
+        Contributed patches to convert Wget to use Automake as
+        part of its build process, and various bugfixes.
+[     ] Jochen Roderburg *roderburg [at] uni-koeln.de*
+[     ] Stephen Gildea *stepheng+wget [at] gildea.com*
+[     ] Benno Schulenberg *bensberg [at] justemail.net*
+[     ] Alexander Dergachev *cy6erbr4in [at] gmail.com*
+[ASSGN] Rabin Vincent *rabin [at] rab.in*
+[ASSGN] Steven Schubiger *schubiger [at] gmail.com*
+        Many helpful patches, bugfixes and improvements.
+        Notably, conversion of Wget to use the Gnulib quotes and
+        quoteargs modules, and the addition of password prompts
+        at the console, via the Gnulib getpasswd-gnu module.
+[     ] Alain Guibert *alguibert+bts [at] free.fr*
+[     ] Jim Paris *jim [at] jtan.com*
+[ASSGN] Mike Frysinger *vapier [at] gentoo.org*
+[     ] Pranab Shenoy *pranab.loosinit.shenoy [at] gmail.com*
+[ASSGN] Ted Mielczarek *ted.mielczarek [at] gmail.com*
+        Support for parsing links from CSS.
+[ASSGN] Joao Ferreira *joao [at] joaoff.com*
+[     ] Kenny Parnell *k.parnell [at] gmail.com*
+[     ] Henri Häkkinen *henux [at] users.sourceforge.net*
+[ASSGN] Madhusudan Hosaagrahara *com.gmail.hrmadhu*
+[ASSGN] Xavier Saint *wget [at] sxav.eu*
+        Support for IRIs (RFC 3987).
+[     ] Michael Kessler *kessler.michael [at] aon.at*
+[     ] Alexander Drozdov *dzal_mail [at] mtu-net.ru*
+[     ] Alexander Belopolsky *alexander.belopolsky [at] gmail.com*
+[ASSGN] Gerardo E. Gidoni *gerel [at] gnu.org*
+[     ] Benjamin Wolsey *bwy [at] benjaminwolsey.de*
+[     ] Xin Zou *zouxin2008 [at] gmail.com*
+[     ] Julien Pichon *julienpichon7 [at] gmail.com*
+[     ] Phil Pennock *mutt-dev [at] spodhuis.org*
+[     ] Jay Krell *jay.krell [at] cornell.edu*
+[ASSGN] Steven Schweda *sms [at] antinode.info*
+[ASSGN] Petr Pisar *petr.pisar [at] atlas.cz*
+[     ] Marcel Telka *marcel [at] telka.sk*
+[     ] Michael Baeuerle *michael.baeuerle [at] gmx.net*
+[ASSGN] Arvind Jamuna Dixit *ardsrk [at] gmail.com*
+[     ] Peter Rosin *peda [at] lysator.liu.se*
+[     ] David Holman *holman.david [at] gmail.com*
+[     ] Jeremy Olexa *darkside [at] gentoo.org*
+[     ] Paul Townsend *aab [at] purdue.edu*
+[ASSGN] Giuseppe Scrivano *gscrivano [at] gnu.org*
+        Added support for HTTP/1.1.
+        Active Wget Maintainer from 2010-2015.
+[     ] Muthu Subramanian K *muthusuba [at] gmail.com*
+[     ] Alan Jenkins *alan-jenkins [at] tuffmail.co.uk*
+[     ] John Trengrove *jtrengrove [at] gmail.com*
+[     ] Alon Bar-Lev *alon.barlev [at] gmail.com*
+[ASSGN] Reza Snowdon *vivi [at] mage.me.uk*
+[ASSGN] Dennis, CHENG Renquan *crquan [at] fedoraproject.org*
+[ASSGN] Merinov Nikolay *kim.roader [at] gmail.com*
+[     ] Ivanov Anton *x86mail [at] gmail.com*
+[     ] Manfred Koizar *mkoi-pg [at] aon.at*
+[ASSGN] Jessica McKellar *jesstess [at] mit.edu*
+[     ] Filipe Brandenburger *filbranden [at] gmail.com*
+[     ] Evgeniy Philippov *egphilippov [at] googlemail.com*
+[     ] Adrien Nader *adrien [at] notk.org*
+[     ] Gilles Carry *gilles.carry [at] st.com*
+[     ] Tomasz Buchert *tomek.buchert [at] gmail.com*
+[ASSGN] Ray Satiro *raysatiro [at] yahoo.com*
+[     ] Cristian Rodríguez *crrodriguez [at] opensuse.org*
+[ASSGN] Daniel Manrique *roadmr [at] tomechangosubanana.com*
+[     ] Carlos Martín Nieto *carlos [at] cmartin.tk*
+[     ] Jochen Roderburg *Roderburg [at] Uni-Koeln.DE*
+[     ] Mojca Miklavec *mojca.miklavec.lists [at] gmail.com*
+[     ] Alan Hourihane *alanh [at] fairlite.co.uk*
+[     ] Christian Jullien *eligis [at] orange.fr*
+[     ] Jakob Matthes *jakob.matthes [at] gmail.com*
+[     ] Karl Berry *karl [at] freefriends.org*
+[     ] Henrik Holst *henrik.holst [at] millistream.com*
+[ASSGN] Gijs van Tulder *gvtulder [at] gmail.com*
+[ASSGN] Sasikantha Babu *sasikanth.v19 [at] gmail.com*
+[     ] Ángel González *keisial [at] gmail.com*
+[     ] Daniel Kahn Gillmor *dkg [at] fifthhorseman.net*
+[     ] illusionoflife *illusion.of.life92 [at] gmail.com*
+[     ] mancha *mancha [at] mac.hush.com*
+[     ]  *y-iida [at] secom.co.jp*
+[     ] Rohit Mathulla *rohit_mathulla [at] yahoo.com*
+[     ] Nguyễn Thái Ngọc Duy *pclouds [at] gmail.com*
+[     ] Stefano Lattarini *stefano.lattarini [at] gmail.com*
+[     ] Michael Stapelberg *michael [at] stapelberg.de*
+[     ] Pavel Mateja *pavel [at] netsafe.cz*
+[ASSGN] Darshit Shah *darnir [at] gnu.org*
+[     ] Tomas Hozza *thozza [at] redhat.com*
+[     ] mancha *mancha1 [at] hush.com*
+[ASSGN] Bykov Aleksey *gnfalex [at] rambler.ru*
+[     ] Dave Reisner *dreisner [at] archlinux.org*
+[     ] Ciprian Vieru *devel.php [at] gmail.com*
+[     ] Karsten Hopp *karsten [at] redhat.com*
+[     ] Will Dietz *w [at] wdtz.org*
+[     ] Andrea Urbani *matfanjol [at] mail.com*
+[     ] Håkon Vågsether *hauk142 [at] gmail.com*
+[     ] Lars Wendler *polynomial-c [at] gentoo.org*
+[ASSGN] Yousong Zhou *yszhou4tech [at] gmail.com*
+[     ] Vladimír Pýcha *vpycha [at] gmail.com*
+[ASSGN] Zihang Chen *chsc4698 [at] gmail.com*
+[     ] Benjamin Goose *gans+wget [at] tngtech.com*
+[     ] Nikita Vetrov *admin [at] kanaria.ru*
+[     ] Nikolay Morozov *n.morozov [at] securitycode.ru*
+[     ] Matthew Atkinson *mutley456 [at] ntlworld.com*
+[     ] Peter Meiser *meiser [at] gmx-topmail.de*
+[     ] Pär Karlsson *feinorgh [at] gmail.com*
+[     ] Jakub Čajka *jcajka [at] redhat.com*
+[     ] Witchakorn Kamolpornwijit *witchakk [at] mit.edu*
+[     ] Tom Li *biergaizi2009 [at] gmail.com*
+[     ] Jérémie Courrèges-Anglas *jca [at] wxcvbn.org*
+[     ] Cong Ma *cma [at] pmo.ac.cn*
+[     ] Yuriy M. Kaminskiy *yumkam [at] gmail.com*
+[ASSGN] Eli Zaretskii *eliz [at] gnu.org*
+[     ] Mathieu Parent *math.parent [at] gmail.com*
+[     ] Dagobert Michelsen *dam [at] opencsw.org*
+[     ] Gisle Vanem *gvanem [at] yahoo.no*
+[     ] Anderson Goulart *global [at] kokre.com*
+[ASSGN] Ander Juaristi Alamos *ajuaristi [at] gmx.es*
+[     ] Rohan Prinja *rohan.prinja [at] gmail.com*
+[ASSGN] Hubert Tarasiuk *hubert.tarasiuk [at] gmail.com*
+[ASSGN] Miquel Llobet *mllobet.cm [at] gmail.com*
+[     ] Romain Bentz *romain.bentz [at] dataiku.com*
+[     ] Alex Henrie *alexhenrie24 [at] gmail.com*
+[ASSGN] Jookia *166291 [at] gmail.com*
+[     ] Daniele Calore *daniele.calore [at] tin.it*
+[     ] Christian Neukirchen *chneukirchen [at] gmail.com*
+[     ] christian fafard *cfaf [at] hotmail.com*
+[     ] Ikey Doherty *michael.i.doherty [at] intel.com*
+[     ] Ygal Blum *ygal.blum [at] technicolor.com*
+[     ] Jernej Simončič *jernej|s-wget [at] eternallybored.org*
+[     ] Maks Orlovich *morlovich [at] google.com*
+[ASSGN] moparisthebest *admin [at] moparisthebest.com*
+[     ] Sergio Gelato *sergio.gelato [at] astro.su.se*
+[     ] Sean Burford *sburford [at] google.com*
+[ASSGN] Matthew White *mehw.is.me [at] inventati.org*
+[     ] Jeffery To *jeffery.to [at] gmail.com*
+[     ] Tobias Stoeckmann *tobias [at] stoeckmann.org*
+[ASSGN] Dale R. Worley *worley [at] ariadne.com*
+[     ] Liam R. Howlett *Liam.Howlett [at] WindRiver.com*
+[     ] losgrandes *pwajda [at] gmail.net.pl*
+[     ] Rahul Bedarkar *rahul.bedarkar [at] imgtec.com*
+[     ] Nikos Mavrogiannopoulos *nmav [at] gnutls.org*
+[ASSGN] vijeth-aradhya *vijthaaa [at] gmail.com*
+[ASSGN] Tom Szilagyi *tomszilagyi [at] gmail.com*
+[ASSGN] YX Hao *lifenjoiner [at] 163.com*
+[     ] Benjamin Esham *benjamin [at] esham.io*
+[     ] Christof Horschitz *christof [at] nimbusec.com*
+[ASSGN] Vijo Cherian *codervijo [at] gmail.com*
+[     ] klemens *ka7 [at] github.com*
+[     ] Anton Yuzhaninov *citrin+github [at] citrin.ru*
+[ASSGN] Tim Schlueter *schlueter.tim [at] linux.com*
+[ASSGN] Josef Moellers *jmoellers [at] suse.de*
+[     ] Peter Wu *peter [at] lekensteyn.nl*
+[     ] Reiji *gey3dr [at] gmail.com*
+[     ] Loganaden Velvindron *logan [at] hackers.mu*
+[     ] ethus3h *kolubat [at] gmail.com*
+[     ] Tomas Korbar *tkorbar [at] redhat.com*
+[     ] Nikos Mavrogiannopoulos *nmav [at] redhat.com*
+[     ] Luiz Angelo Daros de Luca *luizluca [at] gmail.com*
+[     ] Kapus, Timotej *timotej.kapus13 [at] imperial.ac.uk*
+[     ] Rosen Penev *rosenp [at] gmail.com*
+[     ] André Wolski *andre [at] dena-design.de*
+[     ] Leon Klingele *git [at] leonklingele.de*
+[ASSGN] Jeffrey Walton *noloader [at] gmail.com*
+[     ] raminfp *ramin.blackhat [at] gmail.com*
+[     ] Leif Ryge *leif [at] synthesize.us*
+[     ] Eneas U de Queiroz *cote2004-github [at] yahoo.com*
+[     ] AviSoomirtee *avi [at] cyberstorm.mu*
+[ASSGN] sulfastor *torresmoisesa [at] gmail.com*
+[     ] Lauri Nurmi *lanurmi [at] iki.fi*
+[ASSGN] Вячеслав Петрищев *vyachemail [at] gmail.com*
+[     ] Matt Whitlock *gentoo [at] mattwhitlock.name*
+[     ] Shamil Gumirov *shamil [at] gumirov.com*
+[     ] Nils *nils [at] nilsand.re*
+[     ] Nekun *nekokun [at] firemail.cc*
+[     ] jmoellers *josef.moellers [at] suse.com*
+[     ] WB *3572564-wadersgeek [at] users.noreply.gitlab.com*
+[     ] Thomas Niederberger *thomas [at] niederb.ch*
+[     ] Nik Soggia *wget [at] niksoggia.it*
+[     ] Aarni Koskela *akx [at] iki.fi*
+[     ] jinfuchiang *jinfuchiang [at] outlook.com*
+[     ] Jan-Michael Brummer *jan-michael.brummer1 [at] volkswagen.de*

Makefile.am

@@ -1,5 +1,5 @@
 # Makefile for `Wget' utility
-# Copyright (C) 1995-1997, 2006-2023 Free Software Foundation, Inc.
+# Copyright (C) 1995-1997, 2006-2024 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -92,8 +92,8 @@ check-coverage: clean clean-lcov
 	lcov --capture --initial --directory src/ --output-file $(LCOV_INFO)
 	$(MAKE) CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage" VALGRIND_TESTS=0 check
 	lcov --capture --directory src/ --output-file $(LCOV_INFO)
-	lcov --remove $(LCOV_INFO) '/usr/include/*' '*/lib/*' -o $(LCOV_INFO)
-	genhtml --prefix . --ignore-errors source $(LCOV_INFO) --legend --title "Wget" --output-directory=lcov
+	lcov --remove $(LCOV_INFO) --ignore-errors unused '/usr/include/*' '*/lib/*' -o $(LCOV_INFO)
+	genhtml --prefix . --ignore-errors source --ignore-errors unmapped $(LCOV_INFO) --legend --title "Wget" --output-directory=lcov
 	@echo
 	@echo "You can now view the coverage report with 'xdg-open lcov/index.html'"
 

NEWS

@@ -3,6 +3,25 @@ GNU Wget NEWS -- history of user-visible changes.
 * Noteworthy changes in release ?.? (????-??-??) [?]
 
 
+* Noteworthy changes in release 1.24.5 (2024-03-10) [stable]
+
+** Fix how subdomain matches are checked for HSTS.
+   Fixes a minor issue where cookies may be leaked to the wrong domain
+
+** Wget will now also parse the srcset attribute in <source> HTML tags
+
+** Support reading fetchmail style "user" and "passwd" fields from netrc
+
+** In some cases, prevent the confusing "Cannot write to... (success)" error messages
+
+** Support extremely fast download speeds (TB/s).
+   Previously this would cause Wget to crash when printing the speed
+
+** Improve portability on OpenBSD to run the test suite
+
+** Ensure that CSS URLs are corectly quoted (Bug: 64082)
+
+
 * Noteworthy changes in release 1.21.4 (2023-05-11)
 
 ** Document --retry-on-host-error in help text
@@ -1199,7 +1218,7 @@ geturl -vo log http://fly.cc.fer.hr/
 ----------------------------------------------------------------------
 Copyright information:
 
-Copyright (C) 1997-2023 Free Software Foundation, Inc.
+Copyright (C) 1997-2024 Free Software Foundation, Inc.
 
    Permission is granted to anyone to make or distribute verbatim
    copies of this document as received, in any medium, provided that

README

@@ -55,12 +55,15 @@ Wget's home page is at <https://www.gnu.org/software/wget/>.
 If you would like to contribute code for Wget, please read
 CONTRIBUTING.md.
 
+Wget is offered under the terms of the GNU GPLv3 license. Please see the
+COPYING file for a full text of the license terms.
+
 Wget was originally written and mainained by Hrvoje Niksic.  Please see
 the file AUTHORS for a list of major contributors, and the ChangeLogs
 for a detailed listing of all contributions.
 
 
-Copyright (C) 1995-2023 Free Software Foundation, Inc.
+Copyright (C) 1995-2024 Free Software Foundation, Inc.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

README.checkout

@@ -161,7 +161,7 @@ Testing and development
  that bug, which might be tedious. Tests should only be run through GDB for that purpose.
 
 
- Copyright (C) 2008, 2010, 2014-2015, 2018-2023 Free Software
+ Copyright (C) 2008, 2010, 2014-2015, 2018-2024 Free Software
  Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later
  <https://www.gnu.org/licenses/gpl.html>.

SECURITY.md

@@ -0,0 +1,84 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+At GNU Wget, we take security seriously and appreciate the efforts of security
+researchers in identifying and disclosing vulnerabilities responsibly. If you
+believe you've discovered a security vulnerability in GNU Wget, we encourage you
+to disclose it to us privately and work with us to ensure it is addressed
+promptly and appropriately.
+
+To report a vulnerability, please contact the maintainers directly via email.
+The names and contact details of the current maintainers is always available via
+the AUTHORS file in this repository. In order to send an encrypted email,
+please use the keyring available at the following URL:
+https://savannah.gnu.org/project/release-gpgkeys.php?group=wget
+
+
+Please include the following information in your report:
+
+- A detailed description of the vulnerability
+- The version(s) of GNU Wget that are affected.
+- Steps to reproduce the vulnerability.
+- Any proof-of-concept or exploit code, if applicable.
+- Your contact information for coordination and follow-up.
+
+Once we receive your report, we will acknowledge receipt and work with you to
+investigate the issue. We work on GNU Wget on a volunteer basis and as such may
+face delays in responding immediately. We aim to respond to initial reports
+within 5 working days and will keep you informed of our progress throughout the
+resolution process.
+
+Please refrain from disclosing the vulnerability publicly until we have had an
+opportunity to investigate and address it. We appreciate your cooperation in
+helping to keep GNU Wget and its users secure.
+
+## Vulnerability Disclosure Policy
+
+Once a security vulnerability has been identified and confirmed, we will take
+the following steps:
+
+1. **Investigation**: We will promptly investigate the reported vulnerability to
+   verify its authenticity and determine its scope and impact.
+
+2. **Resolution**: Once validated, we will develop and test a fix for the
+   vulnerability. We will strive to address the issue as quickly as possible and
+   prepare a patch for release.
+
+3. **Coordination**: We will work with the reporter to ensure that the
+   vulnerability is disclosed responsibly and coordinated with the release of
+   the fix.
+
+4. **Release**: Upon completion of the fix and any necessary testing, we will
+   release a new version of GNU Wget that addresses the vulnerability. We will
+   provide appropriate credit to the reporter in the release notes, unless
+   otherwise requested.
+
+5. **Public Disclosure**: We will coordinate the public disclosure of the
+   vulnerability with the reporter and other relevant stakeholders. Once the fix
+   is widely available, we will publish an advisory detailing the vulnerability
+   and its resolution.
+
+We strive to follow these steps in a timely and transparent manner, while
+prioritizing the security and stability of GNU Wget and its users.
+
+## Responsible Disclosure Guidelines
+
+In order to protect our users and systems, we ask that security researchers
+adhere to the following guidelines when reporting vulnerabilities to GNU Wget:
+
+- **Responsible Disclosure**: Please disclose vulnerabilities to us privately
+  and allow us a reasonable amount of time to investigate and address them
+  before disclosing them publicly.
+
+- **Cooperation**: We appreciate your cooperation and collaboration throughout
+  the disclosure process. We will do our best to keep you informed of our
+  progress and coordinate the release of information with you.
+
+- **Respect**: Please respect our users' privacy and refrain from any actions
+  that could cause harm or disrupt our systems. We ask that you do not exploit
+  or disclose vulnerabilities before they have been resolved.
+
+By following these guidelines, you can help us maintain the security and
+integrity of GNU Wget for the benefit of all users. We thank you for your
+contributions to our project and for helping to make the internet a safer place.

bootstrap

@@ -3,9 +3,9 @@
 
 # Bootstrap this package from checked-out sources.
 
-scriptversion=2022-12-27.07; # UTC
+scriptversion=2023-12-10.18; # UTC
 
-# Copyright (C) 2003-2023 Free Software Foundation, Inc.
+# Copyright (C) 2003-2024 Free Software Foundation, Inc.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -37,9 +37,9 @@ medir=`dirname "$me"`
 
 # A library of shell functions for autopull.sh, autogen.sh, and bootstrap.
 
-scriptlibversion=2023-03-09.17; # UTC
+scriptlibversion=2023-12-10.18; # UTC
 
-# Copyright (C) 2003-2023 Free Software Foundation, Inc.
+# Copyright (C) 2003-2024 Free Software Foundation, Inc.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -340,7 +340,7 @@ check_versions() {
     # Handle the still-experimental Automake-NG programs specially.
     # They remain named as the mainstream Automake programs ("automake",
     # and "aclocal") to avoid gratuitous incompatibilities with
-    # preexisting uses (by, say, autoreconf, or custom autogen.sh
+    # preexisting usages (by, say, autoreconf, or custom autogen.sh
     # scripts), but correctly identify themselves (as being part of
     # "GNU automake-ng") when asked their version.
     case $app in
@@ -497,7 +497,8 @@ prepare_GNULIB_SRCDIR ()
     # We already checked that $GNULIB_SRCDIR references a directory.
     # Verify that it contains a gnulib checkout.
     test -f "$GNULIB_SRCDIR/gnulib-tool" \
-      || die "Error: --gnulib-srcdir or \$GNULIB_SRCDIR is specified, but does not contain gnulib-tool"
+      || die "Error: --gnulib-srcdir or \$GNULIB_SRCDIR is specified," \
+             "but does not contain gnulib-tool"
   elif $use_git; then
     gnulib_path=$(git_modules_config submodule.gnulib.path)
     test -z "$gnulib_path" && gnulib_path=gnulib
@@ -558,7 +559,8 @@ prepare_GNULIB_SRCDIR ()
           # be processed, which can drastically reduce download and processing
           # time for checkout. If the fetch by commit fails, a shallow fetch can
           # not be performed because we do not know what the depth of the commit
-          # is without fetching all commits. So fallback to fetching all commits.
+          # is without fetching all commits. So fall back to fetching all
+          # commits.
           git -C "$gnulib_path" init
           git -C "$gnulib_path" remote add origin \
               ${GNULIB_URL:-$default_gnulib_url}
@@ -574,7 +576,8 @@ prepare_GNULIB_SRCDIR ()
     GNULIB_SRCDIR=$gnulib_path
     # Verify that the submodule contains a gnulib checkout.
     test -f "$gnulib_path/gnulib-tool" \
-      || die "Error: $gnulib_path is supposed to contain a gnulib checkout, but does not contain gnulib-tool"
+      || die "Error: $gnulib_path is supposed to contain a gnulib checkout," \
+             "but does not contain gnulib-tool"
   fi
 
   # XXX Should this be done if $use_git is false?
@@ -594,7 +597,8 @@ upgrade_bootstrap ()
   if test -f "$medir"/bootstrap-funclib.sh; then
     update_lib=true
     { cmp -s "$medir"/bootstrap "$GNULIB_SRCDIR/top/bootstrap" \
-      && cmp -s "$medir"/bootstrap-funclib.sh "$GNULIB_SRCDIR/top/bootstrap-funclib.sh" \
+      && cmp -s "$medir"/bootstrap-funclib.sh \
+                "$GNULIB_SRCDIR/top/bootstrap-funclib.sh" \
       && cmp -s "$medir"/autopull.sh "$GNULIB_SRCDIR/top/autopull.sh" \
       && cmp -s "$medir"/autogen.sh "$GNULIB_SRCDIR/top/autogen.sh"; \
     }
@@ -611,10 +615,18 @@ upgrade_bootstrap ()
       a) ignored=--;;
       *) ignored=ignored;;
     esac
+    u=$update_lib
     exec sh -c \
-      '{ if '$update_lib' && test -f "$1"; then cp "$1" "$3"; else cp "$2" "$3"; fi; } && { if '$update_lib' && test -f "$4"; then cp "$4" "$5"; else rm -f "$5"; fi; } && { if '$update_lib' && test -f "$6"; then cp "$6" "$7"; else rm -f "$7"; fi; } && { if '$update_lib' && test -f "$8"; then cp "$8" "$9"; else rm -f "$9"; fi; } && shift && shift && shift && shift && shift && shift && shift && shift && shift && exec "${CONFIG_SHELL-/bin/sh}" "$@"' \
+      '{ if '$u' && test -f "$1"; then cp "$1" "$3"; else cp "$2" "$3"; fi; } &&
+       { if '$u' && test -f "$4"; then cp "$4" "$5"; else rm -f "$5"; fi; } &&
+       { if '$u' && test -f "$6"; then cp "$6" "$7"; else rm -f "$7"; fi; } &&
+       { if '$u' && test -f "$8"; then cp "$8" "$9"; else rm -f "$9"; fi; } &&
+       shift && shift && shift && shift && shift &&
+       shift && shift && shift && shift &&
+       exec "${CONFIG_SHELL-/bin/sh}" "$@"' \
       $ignored \
-      "$GNULIB_SRCDIR/top/bootstrap" "$GNULIB_SRCDIR/build-aux/bootstrap" "$medir/bootstrap" \
+      "$GNULIB_SRCDIR/top/bootstrap" "$GNULIB_SRCDIR/build-aux/bootstrap" \
+      "$medir/bootstrap" \
       "$GNULIB_SRCDIR/top/bootstrap-funclib.sh" "$medir/bootstrap-funclib.sh" \
       "$GNULIB_SRCDIR/top/autopull.sh" "$medir/autopull.sh" \
       "$GNULIB_SRCDIR/top/autogen.sh" "$medir/autogen.sh" \
@@ -647,7 +659,9 @@ Optional environment variables:
                            Use this if you already have gnulib sources
                            and history on your machine, and do not want
                            to waste your bandwidth downloading them again.
-  GNULIB_URL               Cloneable URL of the gnulib repository.
+  GNULIB_URL               URL of the gnulib repository.  The default is
+                           $default_gnulib_url,
+                           which is Gnulib's upstream repository.
 
 Options:
   --bootstrap-sync         if this bootstrap script is not identical to
@@ -747,9 +761,12 @@ autopull()
   done
 
   $use_git || test -n "$GNULIB_SRCDIR" \
-    || die "Error: --no-git requires \$GNULIB_SRCDIR environment variable or --gnulib-srcdir option"
+    || die "Error: --no-git requires \$GNULIB_SRCDIR environment variable" \
+           "or --gnulib-srcdir option"
   test -z "$GNULIB_SRCDIR" || test -d "$GNULIB_SRCDIR" \
-    || die "Error: \$GNULIB_SRCDIR environment variable or --gnulib-srcdir option is specified, but does not denote a directory"
+    || die "Error: \$GNULIB_SRCDIR environment variable" \
+           "or --gnulib-srcdir option is specified," \
+           "but does not denote a directory"
 
   if test -n "$checkout_only_file" && test ! -r "$checkout_only_file"; then
     die "Running this script from a non-checked-out distribution is risky."
@@ -760,7 +777,7 @@ autopull()
   if $use_gnulib || $bootstrap_sync; then
     prepare_GNULIB_SRCDIR
     if $bootstrap_sync; then
-      upgrade_bootstrap
+      upgrade_bootstrap "$@"
     fi
   fi
 
@@ -811,7 +828,10 @@ autopull()
       uninitialized=`echo "$uninitialized" | grep -v '^gnulib$'`
     fi
     if test -n "$uninitialized"; then
-      die "Some git submodules are not initialized: "`echo "$uninitialized" | tr '\n' ',' | sed -e 's|,$|.|'`" Either use option '--no-git', or run 'git submodule update --init' and bootstrap again."
+      uninit_comma=`echo "$uninitialized" | tr '\n' ',' | sed -e 's|,$|.|'`
+      die "Some git submodules are not initialized: "$uninit_comma \
+          "Either use option '--no-git'," \
+          "or run 'git submodule update --init' and bootstrap again."
     fi
   fi
 
@@ -978,7 +998,7 @@ symlink_to_dir()
       for dot_ig in x $vc_ignore; do
         test $dot_ig = x && continue
         ig=$parent/$dot_ig
-        insert_vc_ignore $ig "${dst_dir##*/}"
+        insert_vc_ignore $ig "${dst_dir##*/}/"
       done
     fi
 
@@ -1075,7 +1095,8 @@ autogen()
   done
 
   test -z "$GNULIB_SRCDIR" || test -d "$GNULIB_SRCDIR" \
-    || die "Error: \$GNULIB_SRCDIR environment variable or --gnulib-srcdir option is specified, but does not denote a directory"
+    || die "Error: \$GNULIB_SRCDIR environment variable or --gnulib-srcdir" \
+           "option is specified, but does not denote a directory"
 
   if test -n "$checkout_only_file" && test ! -r "$checkout_only_file"; then
     die "Running this script from a non-checked-out distribution is risky."
@@ -1083,7 +1104,8 @@ autogen()
 
   if $use_gnulib; then
     if test -z "$GNULIB_SRCDIR"; then
-      gnulib_path=$(test -f .gitmodules && git config --file .gitmodules submodule.gnulib.path)
+      gnulib_path=$(test -f .gitmodules &&
+                    git config --file .gitmodules submodule.gnulib.path)
       test -z "$gnulib_path" && gnulib_path=gnulib
       GNULIB_SRCDIR=$gnulib_path
     fi
@@ -1104,7 +1126,7 @@ autogen()
     mkdir $build_aux
     for dot_ig in x $vc_ignore; do
       test $dot_ig = x && continue
-      insert_vc_ignore $dot_ig $build_aux
+      insert_vc_ignore $dot_ig $build_aux/
     done
   fi
 
@@ -1327,7 +1349,9 @@ Optional environment variables:
                            have gnulib sources on your machine, and
                            do not want to waste your bandwidth downloading
                            them again.
-  GNULIB_URL               Cloneable URL of the gnulib repository.
+  GNULIB_URL               URL of the gnulib repository.  The default is
+                           $default_gnulib_url,
+                           which is Gnulib's upstream repository.
 
 Options:
 
@@ -1458,9 +1482,11 @@ done
 $pull || $gen || pull=true gen=true
 
 $use_git || test -n "$GNULIB_SRCDIR" \
-  || die "Error: --no-git requires \$GNULIB_SRCDIR environment variable or --gnulib-srcdir option"
+  || die "Error: --no-git requires \$GNULIB_SRCDIR environment variable" \
+         "or --gnulib-srcdir option"
 test -z "$GNULIB_SRCDIR" || test -d "$GNULIB_SRCDIR" \
-  || die "Error: \$GNULIB_SRCDIR environment variable or --gnulib-srcdir option is specified, but does not denote a directory"
+  || die "Error: \$GNULIB_SRCDIR environment variable or --gnulib-srcdir" \
+         "option is specified, but does not denote a directory"
 
 if test -n "$checkout_only_file" && test ! -r "$checkout_only_file"; then
   die "Bootstrapping from a non-checked-out distribution is risky."
@@ -1470,7 +1496,7 @@ check_build_prerequisites $use_git
 
 if $bootstrap_sync; then
   prepare_GNULIB_SRCDIR
-  upgrade_bootstrap
+  upgrade_bootstrap "$@"
   # Since we have now upgraded if needed, no need to try it a second time below.
   bootstrap_sync=false
 fi
@@ -1483,7 +1509,11 @@ export GNULIB_REFDIR
 
 if $pull && { $use_git || test -z "$SKIP_PO"; }; then
   autopull \
-      `if $bootstrap_sync; then echo ' --bootstrap-sync'; else echo ' --no-bootstrap-sync'; fi` \
+      `if $bootstrap_sync; then
+         echo ' --bootstrap-sync'
+       else
+         echo ' --no-bootstrap-sync'
+       fi` \
       `if test -z "$checkout_only_file"; then echo ' --force'; fi` \
       `if ! $use_git; then echo ' --no-git'; fi` \
       `if test -n "$SKIP_PO"; then echo ' --skip-po'; fi` \

bootstrap.conf

@@ -1,5 +1,5 @@
 # bootstrap.conf - Bootstrap configuration.
-# Copyright (C) 2007-2012, 2018-2023 Free Software Foundation, Inc.
+# Copyright (C) 2007-2012, 2018-2024 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #
@@ -36,13 +36,20 @@ c-strcasestr
 clock-time
 close
 connect
+crypto/md2
+crypto/md4
+crypto/md5
+crypto/sha1
+crypto/sha256
+crypto/sha512
 dirname
+do-release-commit-and-tag
 fcntl
 flock
 fnmatch-gnu
 fopen
-futimens
 ftello
+futimens
 gendocs
 getaddrinfo
 getline
@@ -51,19 +58,20 @@ getpass-gnu
 getpeername
 getsockname
 gettext-h
-gitlog-to-changelog
 git-version-gen
-gnupload
+gitlog-to-changelog
 gnu-web-doc-update
+gnupload
 group-member
 hostent
-ioctl
 iconv
 iconv-h
 inet_ntop
 intprops
 inttypes
+ioctl
 langinfo
+libunistring-optional
 limits-h
 link
 listen
@@ -72,15 +80,9 @@ mbiter
 mbtowc
 memrchr
 mkdir
-mkstemp
 mkostemp
+mkstemp
 nanosleep
-crypto/md2
-crypto/md4
-crypto/md5
-crypto/sha1
-crypto/sha256
-crypto/sha512
 open
 pipe-posix
 posix_spawn
@@ -93,8 +95,8 @@ select
 send
 setsockopt
 signal-h
-sigprocmask
 sigpipe
+sigprocmask
 snprintf
 socket
 spawn-pipe
@@ -112,12 +114,11 @@ symlink
 sys_types
 timegm
 tmpdir
+unicase/u8-tolower
+unistr/u8-strlen
 unlink
 unlocked-io
 update-copyright
-libunistring-optional
-unistr/u8-strlen
-unicase/u8-tolower
 utime
 utimens
 vasprintf

build-aux/build_info.pl

@@ -2,7 +2,7 @@
 
 # Generate build_info.c.
 
-# Copyright (C) 2009-2011, 2018-2023 Free Software Foundation, Inc.
+# Copyright (C) 2009-2011, 2018-2024 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

cfg.mk

@@ -33,5 +33,5 @@ VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|
 update-copyright-env = UPDATE_COPYRIGHT_USE_INTERVALS=1
 generated_files =
 
-old_NEWS_hash = 39db0b0f2cce0f250b4f5b8891990f17
+old_NEWS_hash = b80dbf02602654e200d7cbce7aeda8d2
 manual_title = $(VERSION)

configure.ac

@@ -1,5 +1,5 @@
 dnl Template file for GNU Autoconf
-dnl Copyright (C) 1995-1997, 2001, 2007-2014, 2018-2023 Free Software
+dnl Copyright (C) 1995-1997, 2001, 2007-2014, 2018-2024 Free Software
 dnl Foundation, Inc.
 
 dnl This program is free software; you can redistribute it and/or modify
@@ -951,6 +951,21 @@ AS_IF([test x"$with_metalink" != xno], [
   ])
 ])
 
+dnl
+dnl libproxy support
+dnl
+with_libproxy=no
+AC_ARG_ENABLE(libproxy,
+  [  --enable-libproxy       libproxy support for system wide proxy configuration])
+AS_IF([test "${enable_libproxy}" = "yes"], [
+  with_libproxy=yes
+  PKG_CHECK_MODULES([LIBPROXY], [libproxy-1.0], [
+    LIBS="$LIBPROXY_LIBS $LIBS"
+    CFLAGS="$LIBPROXY_CFLAGS $CFLAGS"
+    AC_DEFINE([HAVE_LIBPROXY], [1], [Define if using libproxy.])
+  ])
+])
+
 dnl
 dnl Extended Attribute support
 dnl
@@ -1022,4 +1037,5 @@ AC_MSG_NOTICE([Summary of build options:
   GPGME:             $have_gpg
   IRI:               $iri
   Fuzzing build:     $enable_fuzzing, $LIB_FUZZING_ENGINE
+  libproxy:          $with_libproxy
 ])

contrib/commit-check

@@ -0,0 +1,48 @@
+#!/usr/bin/env sh
+
+# Copyright (c) 2018-2022, 2024 Free Software Foundation, Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+set -e
+set -u
+
+AUTHOR=$(git log -n1 --format='%aN')
+EMAIL=$(git log -n1 --format='%aE')
+DOMAIN=$(echo "$EMAIL" | cut -d'@' -f2)
+EMAIL_PARSE=$(echo "$EMAIL" | sed 's/@/ \\[at\\] /g')
+
+retval=0
+
+echo "The last commit is made by $AUTHOR: $EMAIL_PARSE"
+
+if git cat-file -p HEAD | grep "^Copyright-paperwork-exempt: Yes"; then
+	echo "This work is copyright paperwork exempt."
+elif ! grep -E -q "^\\[ASSGN\\] .* \\*($EMAIL_PARSE|$DOMAIN)\\*$" AUTHORS; then
+	if grep -E -q "^\\[ *\\] .* \\*($EMAIL_PARSE|$DOMAIN)\\*$" AUTHORS; then
+		echo "The author is known, but did not yet complete the FSF Copyright Assignment."
+	else
+		echo "The author was not found in the AUTHORS file."
+		echo "Has the author completed the FSF Copyright Assignment?"
+	fi
+	echo
+	echo "If the commit is minor, please add this to the commit message:"
+	echo "Copyright-paperwork-exempt: Yes"
+	retval=1
+else
+	echo "The author or company was found in the AUTHORS file."
+	echo "This work may be merged into master"
+fi
+
+exit $retval

contrib/make-release

@@ -24,18 +24,33 @@ ask_continue() {
 	set +x
 }
 
-REQUIRED_PROGRAMS="ncftpput sponge"
+REQUIRED_PROGRAMS="ncftpput sponge cvs ssh rsync rsh"
 for prog in $REQUIRED_PROGRAMS; do
-    if ! command -v "$prog" >/dev/null 2>&1; then
-        2>&1 echo "Required program $prog not found. Please install before proceeding"
-        exit 1
-    fi
+	if ! command -v "$prog" >/dev/null 2>&1; then
+		2>&1 echo "Required program $prog not found. Please install before proceeding"
+		exit 1
+	fi
 done
 
 if [ ! -d ".git" ]; then
-	echo "Please run this script from the root of the git repository"
+	2>&1 echo "Please run this script from the root of the git repository"
+	exit 1
 fi
 
+if [ $# -ne 2 ]; then
+	2>&1 echo "Usage: $0 [version] [release-type]"
+	exit 1
+fi
+
+readonly VERSION="$1" && shift
+readonly REL_TYPE_IN="$1" && shift
+REL_TYPE=
+case $REL_TYPE_IN in
+	a|A|alpha|Alpha) REL_TYPE=alpha;;
+	b|B|beta|Beta) REL_TYPE=beta;;
+	s|S|stable|Stable) REL_TYPE=stable;;
+esac
+
 echo "This script will make a new release and upload it to the GNU FTP Servers"
 echo "Will run git clean -dxf to get a clean dir"
 ask_continue
@@ -50,38 +65,22 @@ autoreconf -ivf
 echo "=> Configure"
 ./configure -q
 
-APP_NAME=$(grep "^PACKAGE_NAME='" configure | cut -d "'" -f2)
-APP_VER=$(grep "^PACKAGE_VERSION='" configure | cut -d "'" -f2)
-
-echo "Making release for $APP_NAME $APP_VER"
+echo "Building $APP_NAME v$VERSION $REL_TYPE"
 ask_continue
 
-NEWS_VERSION=$(grep -i "Noteworthy changes in release" NEWS | head -2 | tail -1 | awk '{print $6}')
-if [ "$NEWS_VERSION" != "$APP_VER" ]; then
-	echo "Latest version in NEWS file does not match latest tag"
-	exit 1
-fi
-PREV_VER=$(cat .prev-version)
-LNO_CVER=$(grep -in "Noteworthy changes in release" NEWS | head -2 | tail -1 | cut -f1 -d:)
-LNO_PVER=$(grep -in "Noteworthy changes in release" NEWS | head -3 | tail -1 | cut -f1 -d:)
+LNO_CVER=$(grep -in "Noteworthy changes in release" NEWS | head -1 | tail -1 | cut -f1 -d:)
+LNO_PVER=$(grep -in "Noteworthy changes in release" NEWS | head -2 | tail -1 | cut -f1 -d:)
 sed -n "${LNO_CVER},${LNO_PVER}p" NEWS
 echo "This is the current contents of your NEWS"
 ask_continue
 
-echo ""
-REL_TYPE=
-while [ -z $REL_TYPE ]; do
-	printf "Enter release type (alpha, beta, stable): "
-	read x
-	case $x in
-		a|A|alpha|Alpha) REL_TYPE=alpha;;
-		b|B|beta|Beta) REL_TYPE=beta;;
-		s|S|stable|Stable) REL_TYPE=stable;;
-	esac
-done
+export RELEASE="$VERSION $REL_TYPE"
+
+echo "=> Making release-commit"
+make -s release-commit
 
 echo "=> Make release"
-make -s release RELEASE_TYPE=$REL_TYPE
+make -s release
 
 GPG_KEY=
 while [ -z $GPG_KEY ]; do
@@ -95,7 +94,7 @@ done
 
 echo ""
 
-upload_command=$(make -s emit_upload_commands RELEASE_TYPE=stable \
+upload_command=$(make -s emit_upload_commands \
     | sponge \
     | head -n3 \
     | tail -1 \
@@ -108,22 +107,17 @@ echo "$upload_command"
 ask_continue
 $upload_command
 
+if [[ $REL_TYPE == "stable" ]]; then
+    export CVSROOT=:ext:${CVSUSER:-${USER}}@cvs.savannah.gnu.org:/web/wget
+    export CVS_RSH=/usr/bin/ssh
+    export gendocs_options_=-I ../build-aux
+    make web-manual-update
+fi
+
 echo ""
 echo "Remaining Release Checklist:
   1. Send a mail to coordinator@translationproject.org with the subject
-	 \"Requesting Translations for $APP_NAME-$APP_VER.POT\"
-  2. Announce email template placed at ~/announce-$APP_NAME-$APP_VER
+	 \"Requesting Translations for $APP_NAME-$VERSION.POT\"
+  2. Announce email template placed at ~/announce-$APP_NAME-$VERSION
      Send an announce mail to info-gnu@gnu.org
-  3. Run \`make web-manual\` and \`make web-manual-update\` to update manual online
-  (Only Stable)
 "
-
-echo ""
-
-prev_tag=$(git tag | tail -2 | head -1)
-echo ""
-echo "Don't forget to mention the following contributors in the announcement:"
-(
-  git log "${prev_tag}.." --format="%aN" --reverse
-  git log "${prev_tag}.." --reverse | grep -i reported | cut -d':' -f2 | cut -d'<' -f1 | cut -d' ' -f2- | tr -d '"'
-) | sort -u

contrib/travis-ci

@@ -1,60 +0,0 @@
-#!/bin/bash
-
-# Set a stricter bash mode
-set -e
-set -u
-
-# Set up the subset of tests this Matrix instance will run.
-
-# One instance is forked for each of the SSL library possibilities
-SSL=${1:-""}
-case $SSL in
-    "") SSL_LIB="--without-ssl";;
-    "openssl") SSL_LIB="--with-ssl=openssl";;
-    "gnutls") SSL_LIB="--with-ssl=gnutls";;
-esac
-
-# For some reason. /proc/cpuinfo reports 16 cores on Travis, while the docs
-# claim that each instance has only 2 cores. We believe the docs and force a
-# value of n+1 here.
-CORES=3
-
-# Define a large number of Warning flags for the compiler. Hopefully, someone
-# will sit and analyze the output to clean the warnings from the codebase.
-CFLAGS="-std=c89 -pedantic -O0 -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
-
-# A cachefile for ./configure. Saves significant time when reconfiguring
-CACHEFILE=$PWD/config_check.cache
-
-# measure time consumed and print it at the end of the script
-START=$(date +%s)
-
-# Test different Permutations of Wget. Always under Valgrind
-#
-# Options:
-#   - All Features Enabled
-#     - C       [Default Locale]
-#     - Russian [Multibyte / Multicolumn Locale]
-#     - Turkish [Special Test due to issues with language]
-#   - IPv6 Disabled
-#     - C
-for options in "" "--disable-ipv6"; do
-  export DISTCHECK_CONFIGURE_FLAGS="-C --cache-file=$CACHEFILE --enable-assert --enable-valgrind-tests $SSL_LIB $options"
-  echo "  ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS=\"$CFLAGS\""
-  ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS="$CFLAGS"
-
-  if [[ -z $options ]]; then
-      LANG_ARR=("ru_RU.UTF-8" "tr_TR.UTF-8" "C")
-  else
-      LANG_ARR=("C")
-  fi
-
-  for xLCALL in "${LANG_ARR[@]}"; do
-    export TESTS_ENVIRONMENT="LC_ALL=$xLCALL VALGRIND_TESTS=1"
-    echo "    TESTS_ENVIRONMENT=\"$TESTS_ENVIRONMENT\" make distcheck CFLAGS=$CFLAGS -j$CORES"
-    make distcheck CFLAGS="$CFLAGS" -j$CORES
-  done
-done
-
-END=$(date +%s)
-echo "Duration: $((END-START))"

doc/Makefile.am

@@ -1,5 +1,5 @@
 # Makefile for `wget' utility
-# Copyright (C) 1995-1997, 2007-2011, 2015, 2018-2023 Free Software
+# Copyright (C) 1995-1997, 2007-2011, 2015, 2018-2024 Free Software
 # Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify

doc/fdl.texi

@@ -5,7 +5,7 @@
 @c hence no sectioning command or @node.
 
 @display
-Copyright @copyright{} 2000--2002, 2007--2008, 2015, 2018--2023 Free
+Copyright @copyright{} 2000--2002, 2007--2008, 2015, 2018--2024 Free
 Software Foundation, Inc.
 @uref{http://fsf.org/}
 

doc/texi2pod.pl

@@ -1,6 +1,6 @@
 #! /usr/bin/env perl
 
-#   Copyright (C) 1999-2001, 2003, 2007, 2009-2011, 2015, 2018-2023 Free
+#   Copyright (C) 1999-2001, 2003, 2007, 2009-2011, 2015, 2018-2024 Free
 #   Software Foundation, Inc.
 
 # This file is part of GCC.

doc/wget.texi

@@ -31,7 +31,7 @@ This file documents the GNU Wget utility for downloading network
 data.
 
 @c man begin COPYRIGHT
-Copyright @copyright{} 1996--2011, 2015, 2018--2023 Free Software
+Copyright @copyright{} 1996--2011, 2015, 2018--2024 Free Software
 Foundation, Inc.
 
 @iftex

fuzz/Makefile.am

@@ -3,10 +3,26 @@ AM_CPPFLAGS = -I$(top_srcdir)/src -I$(srcdir) -I$(top_builddir)/lib -I$(top_srcd
  $(CODE_COVERAGE_CPPFLAGS) \
  -DSRCDIR=\"$(abs_srcdir)\"
 LDADD = ../lib/libgnu.a \
- $(GETADDRINFO_LIB) $(HOSTENT_LIB) $(INET_NTOP_LIB) $(INET_PTON_LIB) \
- $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO) $(LIB_GETLOGIN) $(LIB_NANOSLEEP) $(LIB_POLL) \
- $(LIB_POSIX_SPAWN) $(LIB_PTHREAD_SIGMASK) $(LIB_SELECT) $(LIBICONV) $(LIBINTL) \
- $(LIBMULTITHREAD) $(LIBTHREAD) $(SERVENT_LIB) @INTL_MACOSX_LIBS@ \
+ $(CLOCK_TIME_LIB) \
+ $(GETADDRINFO_LIB) \
+ $(GETRANDOM_LIB) \
+ $(HARD_LOCALE_LIB) \
+ $(HOSTENT_LIB) \
+ $(INET_NTOP_LIB) \
+ $(LIBSOCKET) \
+ $(LIBTHREAD) \
+ $(LIB_CRYPTO) \
+ $(LIBC32CONV) \
+ $(LIBICONV) \
+ $(LIBINTL) \
+ $(LIBUNISTRING) \
+ $(MBRTOWC_LIB) \
+ $(NANOSLEEP_LIB) \
+ $(POSIX_SPAWN_LIB) \
+ $(PTHREAD_SIGMASK_LIB) \
+ $(SELECT_LIB) \
+ $(SERVENT_LIB) \
+ $(SETLOCALE_NULL_LIB) \
  $(FUZZ_LIBS) $(CODE_COVERAGE_LIBS)
 
 WGET_TESTS = \
@@ -93,7 +109,7 @@ clean-local:
 
 oss-fuzz:
 	if test "$$OUT" != ""; then \
-	XLIBS="-lpsl -lgnutls -lhogweed -lnettle -lidn2 -lunistring -lz"; \
+	XLIBS="-lpsl -lgnutls -lhogweed -lnettle -lgmp -lidn2 -lunistring -lz"; \
 	for ccfile in wget*_fuzzer.c; do \
 	fuzzer=$$(basename $$ccfile .c); \
 	$$CC $$CFLAGS -I$(top_srcdir)/src -I$(top_srcdir) -I$(top_srcdir)/lib \

fuzz/fuzzer.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/glob_crash.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/main.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/run-afl.sh

@@ -1,6 +1,6 @@
 #!/bin/sh -eu
 
-# Copyright (c) 2017, 2019-2023 Free Software Foundation, Inc.
+# Copyright (c) 2017, 2019-2024 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #

fuzz/run-clang.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 #
-# Copyright (c) 2017, 2019-2023 Free Software Foundation, Inc.
+# Copyright (c) 2017, 2019-2024 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #

fuzz/wget_cookie_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_css_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_ftpls_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_html_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_netrc_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_ntlm_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2019, 2021-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2019, 2021-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_options_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *
@@ -120,7 +120,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	if (setjmp(jmpbuf)) {
 		cleanup();
 		goto done;
-          }
+	}
 
 	main_wget(sizeof(argv)/sizeof(argv[0]), argv);
 

fuzz/wget_progress_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2019, 2021-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2019, 2021-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_read_hunk_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2019-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_robots_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

fuzz/wget_url_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2023 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2024 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *

m4/wget.m4

@@ -1,5 +1,5 @@
 dnl Wget-specific Autoconf macros.
-dnl Copyright (C) 1995-2011, 2018-2023 Free Software Foundation, Inc.
+dnl Copyright (C) 1995-2011, 2018-2024 Free Software Foundation, Inc.
 
 dnl This program is free software; you can redistribute it and/or modify
 dnl it under the terms of the GNU General Public License as published by

m4/wget_manywarnings.m4

@@ -1,5 +1,5 @@
 # wget_manywarnings.m4 serial 1
-dnl Copyright (C) 2016-2023 Free Software Foundation, Inc.
+dnl Copyright (C) 2016-2024 Free Software Foundation, Inc.
 dnl This file is free software; the Free Software Foundation
 dnl gives unlimited permission to copy and/or distribute it,
 dnl with or without modifications, as long as this notice is preserved.

po/POTFILES.in

@@ -1,5 +1,5 @@
 # List of files which containing translatable strings.
-# Copyright (C) 1995-2011, 2018-2023 Free Software Foundation, Inc.
+# Copyright (C) 1995-2011, 2018-2024 Free Software Foundation, Inc.
 
 # Package source files
 src/connect.c

src/Makefile.am

@@ -1,5 +1,5 @@
 # Makefile for `wget' utility
-# Copyright (C) 1995-2011, 2015, 2018-2023 Free Software Foundation,
+# Copyright (C) 1995-2011, 2015, 2018-2024 Free Software Foundation,
 # Inc.
 
 # This program is free software; you can redistribute it and/or modify
@@ -84,10 +84,28 @@ endif
 
 nodist_wget_SOURCES = version.c
 EXTRA_wget_SOURCES = iri.c metalink.c xattr.c
-LDADD = $(CODE_COVERAGE_LIBS) $(LIBOBJS) ../lib/libgnu.a $(GETADDRINFO_LIB) $(HOSTENT_LIB)\
- $(INET_NTOP_LIB) $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO)\
- $(LIB_NANOSLEEP) $(LIB_POSIX_SPAWN) $(LIB_SELECT) $(LIBICONV) $(LIBINTL)\
- $(LIBTHREAD) $(LIBUNISTRING) $(SERVENT_LIB)
+LDADD = $(CODE_COVERAGE_LIBS) $(LIBOBJS) ../lib/libgnu.a \
+ $(CLOCK_TIME_LIB) \
+ $(GETADDRINFO_LIB) \
+ $(GETRANDOM_LIB) \
+ $(HARD_LOCALE_LIB) \
+ $(HOSTENT_LIB) \
+ $(INET_NTOP_LIB) \
+ $(LIBSOCKET) \
+ $(LIBTHREAD) \
+ $(LIB_CRYPTO) \
+ $(LIBC32CONV) \
+ $(LIBICONV) \
+ $(LIBINTL) \
+ $(LIBUNISTRING) \
+ $(MBRTOWC_LIB) \
+ $(NANOSLEEP_LIB) \
+ $(POSIX_SPAWN_LIB) \
+ $(PTHREAD_SIGMASK_LIB) \
+ $(SELECT_LIB) \
+ $(SERVENT_LIB) \
+ $(SETLOCALE_NULL_LIB)
+
 AM_CPPFLAGS = -I$(top_builddir)/lib -I$(top_srcdir)/lib $(CODE_COVERAGE_CPPFLAGS)
 AM_CFLAGS = $(WERROR_CFLAGS) $(WARN_CFLAGS) $(CODE_COVERAGE_CFLAGS)
 

src/connect.c

@@ -1,5 +1,5 @@
 /* Establishing and handling network connections.
-   Copyright (C) 1995-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1995-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/connect.h

@@ -1,5 +1,5 @@
 /* Declarations for connect.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/convert.c

@@ -1,5 +1,5 @@
 /* Conversion of links to local files.
-   Copyright (C) 2003-2011, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 2003-2011, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.
@@ -321,7 +321,7 @@ convert_links (const char *file, struct urlpos *links)
                                              link->refresh_timeout);
 
             DEBUGP (("TO_RELATIVE: %s to %s at position %d in %s.\n",
-                     link->url->url, newname, link->pos, file));
+                     link->url->url, quoted_newname, link->pos, file));
 
             xfree (newname);
             xfree (quoted_newname);
@@ -342,7 +342,7 @@ convert_links (const char *file, struct urlpos *links)
                                              link->refresh_timeout);
 
             DEBUGP (("Converted file part only: %s to %s at position %d in %s.\n",
-                     link->url->url, newname, link->pos, file));
+                     link->url->url, quoted_newname, link->pos, file));
 
             xfree (newname);
             xfree (quoted_newname);
@@ -365,7 +365,7 @@ convert_links (const char *file, struct urlpos *links)
                                              link->refresh_timeout);
 
             DEBUGP (("TO_COMPLETE: <something> to %s at position %d in %s.\n",
-                     newlink, link->pos, file));
+                     quoted_newlink, link->pos, file));
 
             xfree (quoted_newlink);
             ++to_url_count;
@@ -731,7 +731,11 @@ find_fragment (const char *beg, int size, const char **bp, const char **ep)
    safe for both local and HTTP-served browsing.
 
    We always quote "#" as "%23", "%" as "%25" and ";" as "%3B"
-   because those characters have special meanings in URLs.  */
+   because those characters have special meanings in URLs.
+
+   Additionally we always quote ' ' as "%20" since not quoting it
+   is illegal in CSS url()s and quoting it should not harm any
+   local browsing.  */
 
 static char *
 local_quote_string (const char *file, bool no_html_quote)
@@ -741,7 +745,7 @@ local_quote_string (const char *file, bool no_html_quote)
   char buf[1024];
   size_t tolen;
 
-  char *any = strpbrk (file, "?#%;");
+  char *any = strpbrk (file, "?#%; ");
   if (!any)
     return no_html_quote ? strdup (file) : html_quote_string (file);
 
@@ -771,6 +775,11 @@ local_quote_string (const char *file, bool no_html_quote)
         *to++ = '3';
         *to++ = 'B';
         break;
+      case ' ':
+        *to++ = '%';
+        *to++ = '2';
+        *to++ = '0';
+        break;
       case '?':
         if (opt.adjust_extension)
           {

src/convert.h

@@ -1,5 +1,5 @@
 /* Declarations for convert.c
-   Copyright (C) 2003-2006, 2009-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2003-2006, 2009-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/cookies.c

@@ -1,5 +1,5 @@
 /* Support for cookies.
-   Copyright (C) 2001-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2001-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/cookies.h

@@ -1,5 +1,5 @@
 /* Support for cookies.
-   Copyright (C) 2001-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2001-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/css-tokens.h

@@ -1,5 +1,5 @@
 /* Declarations for css.lex
-   Copyright (C) 2006, 2009-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2006, 2009-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/css-url.c

@@ -1,5 +1,5 @@
 /* Collect URLs from CSS source.
-   Copyright (C) 1998, 2000-2003, 2009-2011, 2014-2015, 2018-2023 Free
+   Copyright (C) 1998, 2000-2003, 2009-2011, 2014-2015, 2018-2024 Free
    Software Foundation, Inc.
 
 This file is part of GNU Wget.

src/css-url.h

@@ -1,5 +1,5 @@
 /* Declarations for css-url.c.
-   Copyright (C) 2006, 2009-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2006, 2009-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/css.l

@@ -12,7 +12,7 @@
 %{
 /* Lex source for CSS tokenizing.
    Taken from http://www.w3.org/TR/CSS21/grammar.html#q2
-   Copyright (C) 2006, 2009-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2006, 2009-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/exits.c

@@ -1,5 +1,5 @@
 /* Exit status handling.
-   Copyright (C) 2009-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2009-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
    This file is part of GNU Wget.

src/exits.h

@@ -1,5 +1,5 @@
 /* Exit status related declarations.
-   Copyright (C) 2009-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2009-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/ftp-basic.c

@@ -1,5 +1,5 @@
 /* Basic FTP routines.
-   Copyright (C) 1996-2011, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 1996-2011, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/ftp-ls.c

@@ -1,5 +1,5 @@
 /* Parsing FTP `ls' output.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/ftp-opie.c

@@ -1,5 +1,5 @@
 /* Opie (s/key) support for FTP.
-   Copyright (C) 1998-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1998-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/ftp.c

@@ -1,5 +1,5 @@
 /* File Transfer Protocol support.
-   Copyright (C) 1996-2011, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 1996-2011, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/ftp.h

@@ -1,5 +1,5 @@
 /* Declarations for FTP support.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/gnutls.c

@@ -1,5 +1,5 @@
 /* SSL support via GnuTLS library.
-   Copyright (C) 2005-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2005-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/hash.c

@@ -1,5 +1,5 @@
 /* Hash tables.
-   Copyright (C) 2000-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2000-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/hash.h

@@ -1,5 +1,5 @@
 /* Hash table declarations.
-   Copyright (C) 2000, 2007-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2000, 2007-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/host.c

@@ -1,5 +1,5 @@
 /* Host name resolution and matching.
-   Copyright (C) 1996-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/host.h

@@ -1,5 +1,5 @@
 /* Declarations for host.c
-   Copyright (C) 1996-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/hsts.c

@@ -1,5 +1,5 @@
 /* HTTP Strict Transport Security (HSTS) support.
-   Copyright (C) 1996-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.
@@ -120,7 +120,6 @@ hsts_find_entry (hsts_store_t store,
   struct hsts_kh *k = NULL;
   struct hsts_kh_info *khi = NULL;
   enum hsts_kh_match match = NO_MATCH;
-  char *pos = NULL;
   char *org_ptr = NULL;
 
   k = (struct hsts_kh *) xnew (struct hsts_kh);
@@ -137,14 +136,15 @@ hsts_find_entry (hsts_store_t store,
       goto end;
     }
 
-  while (match == NO_MATCH &&
-      (pos = strchr (k->host, '.')) && pos - k->host > 0 &&
-      strchr (pos + 1, '.'))
+  for (char *p = k->host; (p = strchr(p, '.')); )
     {
-      k->host += (pos - k->host + 1);
+      k->host = ++p;
       khi = (struct hsts_kh_info *) hash_table_get (store->table, k);
-      if (khi)
-        match = SUPERDOMAIN_MATCH;
+      if (khi && khi->include_subdomains)
+        {
+          match = SUPERDOMAIN_MATCH;
+          break;
+        }
     }
 
 end:
@@ -735,7 +735,7 @@ test_hsts_new_entry (void)
   mu_assert("Should've been no match", match == NO_MATCH);
 
   khi = hsts_find_entry (s, ".www.foo.com", MAKE_EXPLICIT_PORT (SCHEME_HTTPS, 443), &match, NULL);
-  mu_assert("Should've been no match", match == NO_MATCH);
+  mu_assert("Should've been no match", match == SUPERDOMAIN_MATCH);
 
   hsts_store_close (s);
   close_hsts_test_store (s);
@@ -752,11 +752,15 @@ test_hsts_url_rewrite_superdomain (void)
   s = open_hsts_test_store ();
   mu_assert("Could not open the HSTS store", s != NULL);
 
-  created = hsts_store_entry (s, SCHEME_HTTPS, "www.foo.com", 443, 1234, true);
+  created = hsts_store_entry (s, SCHEME_HTTPS, "example.com", 443, 1234, true);
   mu_assert("A new entry should've been created", created == true);
 
-  TEST_URL_RW (s, "www.foo.com", 80);
-  TEST_URL_RW (s, "bar.www.foo.com", 80);
+  created = hsts_store_entry (s, SCHEME_HTTPS, "rep.example.com", 443, 1234, false);
+  mu_assert("A new entry should've been created", created == true);
+
+  TEST_URL_RW (s, "example.com", 80);
+  TEST_URL_RW (s, "rep.example.com", 80);
+  TEST_URL_RW (s, "rep.rep.example.com", 80);
 
   hsts_store_close (s);
   close_hsts_test_store (s);

src/hsts.h

@@ -1,5 +1,5 @@
 /* Declarations for hsts.c
-   Copyright (C) 1996-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/html-parse.c

@@ -1,5 +1,5 @@
 /* HTML parser for Wget.
-   Copyright (C) 1998-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1998-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/html-parse.h

@@ -1,5 +1,5 @@
 /* Declarations for html-parse.c.
-   Copyright (C) 1998-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1998-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/html-url.c

@@ -1,5 +1,5 @@
 /* Collect URLs from HTML source.
-   Copyright (C) 1998-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1998-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.
@@ -105,7 +105,7 @@ static struct known_tag {
   { TAG_FORM,    "form",        tag_handle_form },
   { TAG_FRAME,   "frame",       tag_find_urls },
   { TAG_IFRAME,  "iframe",      tag_find_urls },
-  { TAG_IMG,     "img",         tag_handle_img },
+  { TAG_IMG,     "img",         tag_handle_img }, // tag_find_urls() plus handling "srcset"
   { TAG_INPUT,   "input",       tag_find_urls },
   { TAG_LAYER,   "layer",       tag_find_urls },
   { TAG_LINK,    "link",        tag_handle_link },
@@ -118,7 +118,7 @@ static struct known_tag {
   { TAG_TH,      "th",          tag_find_urls },
   { TAG_VIDEO,   "video",       tag_find_urls },
   { TAG_AUDIO,   "audio",       tag_find_urls },
-  { TAG_SOURCE,  "source",      tag_find_urls }
+  { TAG_SOURCE,  "source",      tag_handle_img } // tag_find_urls() plus handling "srcset"
 };
 
 /* tag_url_attributes documents which attributes of which tags contain
@@ -170,7 +170,7 @@ static struct {
   { TAG_VIDEO,          "poster",       ATTR_INLINE },
   { TAG_AUDIO,          "src",          ATTR_INLINE },
   { TAG_AUDIO,          "poster",       ATTR_INLINE },
-  { TAG_SOURCE,         "src",          ATTR_INLINE }
+  { TAG_SOURCE,         "src",          ATTR_INLINE },
 };
 
 /* The lists of interesting tags and attributes are built dynamically,
@@ -874,20 +874,21 @@ get_urls_html (const char *file, const char *url, bool *meta_disallow_follow,
    to get_urls_html, so we put it here.  */
 
 struct urlpos *
-get_urls_file (const char *file)
+get_urls_file (const char *file, bool *read_again)
 {
   struct file_memory *fm;
   struct urlpos *head, *tail;
   const char *text, *text_end;
 
   /* Load the file.  */
-  fm = wget_read_file (file);
+  fm = wget_read_from_file (file, read_again);
   if (!fm)
     {
       logprintf (LOG_NOTQUIET, "%s: %s\n", file, strerror (errno));
       return NULL;
     }
-  DEBUGP (("Loaded %s (size %s).\n", file, number_to_static_string (fm->length)));
+  if (fm->length)
+    DEBUGP (("Loaded %s (size %s).\n", file, number_to_static_string (fm->length)));
 
   head = tail = NULL;
   text = fm->content;

src/html-url.h

@@ -1,5 +1,5 @@
 /* Declarations for html-url.c.
-   Copyright (C) 1995-1997, 2009-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 1995-1997, 2009-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.
@@ -48,7 +48,7 @@ struct map_context {
   struct urlpos *head;          /* List of URLs that is being built. */
 };
 
-struct urlpos *get_urls_file (const char *);
+struct urlpos *get_urls_file (const char *, bool *);
 struct urlpos *get_urls_html (const char *, const char *, bool *, struct iri *);
 struct urlpos *get_urls_html_fm (const char *, const struct file_memory *, const char *, bool *, struct iri *);
 struct urlpos *append_url (const char *, int, int, struct map_context *);

src/http-ntlm.c

@@ -1,5 +1,5 @@
 /* NTLM code.
-   Copyright (C) 2005-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2005-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
    Contributed by Daniel Stenberg.
 

src/http-ntlm.h

@@ -1,7 +1,7 @@
 #ifndef __HTTP_NTLM_H
 #define __HTTP_NTLM_H
 /* Declarations for http_ntlm.c
-   Copyright (C) 1995-1997, 2000, 2007-2011, 2015, 2018-2023 Free
+   Copyright (C) 1995-1997, 2000, 2007-2011, 2015, 2018-2024 Free
    Software Foundation, Inc.
    Contributed by Daniel Stenberg.
 

src/http.c

@@ -1,5 +1,5 @@
 /* HTTP support.
-   Copyright (C) 1996-2012, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 1996-2012, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.
@@ -4164,7 +4164,11 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
   err = open_output_stream (hs, count, &fp);
   if (err != RETROK)
     {
+      /* Make sure that errno doesn't get clobbered.
+       * This is the case for OpenSSL's SSL_shutdown(). */
+      int tmp_errno = errno;
       CLOSE_INVALIDATE (sock);
+      errno = tmp_errno;
       retval = err;
       goto cleanup;
     }
@@ -4240,19 +4244,19 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
   struct stat st;
   bool send_head_first = true;
   bool force_full_retrieve = false;
-
+  bool return_local_file;
 
   /* If we are writing to a WARC file: always retrieve the whole file. */
   if (opt.warc_filename != NULL)
     force_full_retrieve = true;
 
-
   /* Assert that no value for *LOCAL_FILE was passed. */
   assert (local_file == NULL || *local_file == NULL);
 
   /* Set LOCAL_FILE parameter. */
-  if (local_file && opt.output_document)
-    *local_file = HYPHENP (opt.output_document) ? NULL : xstrdup (opt.output_document);
+  return_local_file = local_file && opt.output_document && !HYPHENP (opt.output_document);
+
+//    return_local_file = (local_file && opt.output_document && !HYPHENP (opt.output_document));
 
   /* Reset NEWLOC parameter. */
   *newloc = NULL;
@@ -4323,11 +4327,12 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
       if (opt.if_modified_since && !send_head_first && got_name && file_exists_p (hstat.local_file, NULL))
         {
           *dt |= IF_MODIFIED_SINCE;
-          {
-            uerr_t timestamp_err = set_file_timestamp (&hstat);
-            if (timestamp_err != RETROK)
-              return timestamp_err;
-          }
+          uerr_t timestamp_err = set_file_timestamp (&hstat);
+          if (timestamp_err != RETROK)
+            {
+              ret = timestamp_err;
+              goto exit;
+            }
         }
         /* Send preliminary HEAD request if -N is given and we have existing
          * destination file or content disposition is enabled.  */
@@ -4866,7 +4871,6 @@ Remote file exists.\n\n"));
 exit:
   if ((ret == RETROK || opt.content_on_error) && local_file)
     {
-      xfree (*local_file);
       /* Bugfix: Prevent SIGSEGV when hstat.local_file was left NULL
          (i.e. due to opt.content_disposition).  */
       if (hstat.local_file)

src/http.h

@@ -1,5 +1,5 @@
 /* Declarations for HTTP.
-   Copyright (C) 2005-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2005-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/init.c

@@ -1,5 +1,5 @@
 /* Reading/parsing the initialization file.
-   Copyright (C) 1996-2012, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 1996-2012, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.
@@ -1938,7 +1938,7 @@ cleanup (void)
 
   log_close ();
 
-  if (output_stream && output_stream != stderr)
+  if (output_stream && output_stream != stderr && output_stream != stdout)
     {
       FILE *fp = output_stream;
       output_stream = NULL;

src/init.h

@@ -1,5 +1,5 @@
 /* Declarations for init.c.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/iri.c

@@ -1,5 +1,5 @@
 /* IRI related functions.
-   Copyright (C) 2008-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2008-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.
@@ -191,7 +191,13 @@ do_conversion (const char *tocode, const char *fromcode, char const *in_org, siz
           tooshort++;
           done = len;
           len = done + inlen * 2;
-          s = xrealloc (s, len + 1);
+          char *s_new = xrealloc (s, len + 1);
+          if (s_new != s)
+            {
+              /* Help valgrind by initializing additional memory. */
+              s = s_new;
+              memset(s + done, 0, inlen * 2 + 1);
+            }
           *out = s + done - outlen;
           outlen += inlen * 2;
         }

src/iri.h

@@ -1,5 +1,5 @@
 /* Internationalization related declarations.
-   Copyright (C) 2008-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2008-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/log.c

@@ -1,5 +1,5 @@
 /* Messages logging.
-   Copyright (C) 1998-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1998-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/log.h

@@ -1,5 +1,5 @@
 /* Declarations for log.c.
-   Copyright (C) 1998-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1998-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/main.c

@@ -1,5 +1,5 @@
 /* Command line parsing.
-   Copyright (C) 1996-2015, 2018-2023 Free Software Foundation, Inc.
+   Copyright (C) 1996-2015, 2018-2024 Free Software Foundation, Inc.
 
 This file is part of GNU Wget.
 

src/metalink.c

@@ -1,5 +1,5 @@
 /* Metalink module.
-   Copyright (C) 2015, 2018-2023 Free Software Foundation, Inc.
+   Copyright (C) 2015, 2018-2024 Free Software Foundation, Inc.
 
 This file is part of GNU Wget.
 

src/metalink.h

@@ -1,5 +1,5 @@
 /* Declarations for metalink.c.
-   Copyright (C) 2015, 2018-2023 Free Software Foundation, Inc.
+   Copyright (C) 2015, 2018-2024 Free Software Foundation, Inc.
 
 This file is part of GNU Wget.
 

src/mswindows.c

@@ -1,5 +1,5 @@
 /* mswindows.c -- Windows-specific support
-   Copyright (C) 1996-2011, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 1996-2011, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.

src/mswindows.h

@@ -1,5 +1,5 @@
 /* Declarations for windows
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/netrc.c

@@ -1,5 +1,5 @@
 /* Read and parse the .netrc file to get hosts, accounts, and passwords.
-   Copyright (C) 1996, 2007-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 1996, 2007-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.
@@ -388,7 +388,8 @@ parse_netrc_fp (const char *path, FILE *fp)
               else if (!strcmp (tok, "default"))
                   maybe_add_to_list (&current, &retval);
 
-              else if (!strcmp (tok, "login"))
+              /* fetchmail compatibility, "user" is an alias for "login" */
+              else if (!strcmp (tok, "login") || !strcmp (tok, "user"))
                 last_token = tok_login;
 
               else if (!strcmp (tok, "macdef"))
@@ -397,7 +398,8 @@ parse_netrc_fp (const char *path, FILE *fp)
               else if (!strcmp (tok, "machine"))
                 last_token = tok_machine;
 
-              else if (!strcmp (tok, "password"))
+              /* fetchmail compatibility, "passwd" is an alias for "password" */
+              else if (!strcmp (tok, "password") || !strcmp (tok, "passwd"))
                 last_token = tok_password;
 
 				  /* GNU extensions 'port' and 'force', not operational

src/netrc.h

@@ -1,5 +1,5 @@
 /* Declarations for netrc.c
-   Copyright (C) 1996, 1996-1997, 2007-2011, 2015, 2018-2023 Free
+   Copyright (C) 1996, 1996-1997, 2007-2011, 2015, 2018-2024 Free
    Software Foundation, Inc.
 
 This file is part of GNU Wget.

src/openssl.c

@@ -1,5 +1,5 @@
 /* SSL support via OpenSSL library.
-   Copyright (C) 2000-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2000-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
    Originally contributed by Christian Fraenkel.
 

src/options.h

@@ -1,5 +1,5 @@
 /* struct options.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/progress.c

@@ -1,5 +1,5 @@
 /* Download progress.
-   Copyright (C) 2001-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2001-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/progress.h

@@ -1,5 +1,5 @@
 /* Download progress.
-   Copyright (C) 2001-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2001-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/ptimer.c

@@ -1,5 +1,5 @@
 /* Portable timers.
-   Copyright (C) 2005-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2005-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/ptimer.h

@@ -1,5 +1,5 @@
 /* Declarations for ptimer.c.
-   Copyright (C) 2005-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 2005-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/recur.c

@@ -1,5 +1,5 @@
 /* Handling of recursive HTTP retrieving.
-   Copyright (C) 1996-2012, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2012, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/recur.h

@@ -1,5 +1,5 @@
 /* Declarations for recur.c.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.

src/res.c

@@ -1,5 +1,5 @@
 /* Support for Robot Exclusion Standard (RES).
-   Copyright (C) 2001, 2006-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2001, 2006-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of Wget.

src/res.h

@@ -1,5 +1,5 @@
 /* Declarations for res.c.
-   Copyright (C) 2001, 2007-2011, 2015, 2018-2023 Free Software
+   Copyright (C) 2001, 2007-2011, 2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of Wget.

src/retr.c

@@ -1,5 +1,5 @@
 /* File retrieval.
-   Copyright (C) 1996-2011, 2014-2015, 2018-2023 Free Software
+   Copyright (C) 1996-2011, 2014-2015, 2018-2024 Free Software
    Foundation, Inc.
 
 This file is part of GNU Wget.
@@ -44,6 +44,10 @@ as that of the covered work.  */
 # include <zlib.h>
 #endif
 
+#ifdef HAVE_LIBPROXY
+# include "proxy.h"
+#endif
+
 #include "exits.h"
 #include "utils.h"
 #include "retr.h"
@@ -776,8 +780,8 @@ const char *
 retr_rate (wgint bytes, double secs)
 {
   static char res[20];
-  static const char *rate_names[] = {"B/s", "KB/s", "MB/s", "GB/s" };
-  static const char *rate_names_bits[] = {"b/s", "Kb/s", "Mb/s", "Gb/s" };
+  static const char *rate_names[] = {"B/s", "KB/s", "MB/s", "GB/s", "TB/s" };
+  static const char *rate_names_bits[] = {"b/s", "Kb/s", "Mb/s", "Gb/s", "Tb/s" };
   int units;
 
   double dlrate = calc_rate (bytes, secs, &units);
@@ -1173,80 +1177,17 @@ bail:
   return result;
 }
 
-/* Find the URLs in the file and call retrieve_url() for each of them.
-   If HTML is true, treat the file as HTML, and construct the URLs
-   accordingly.
-
-   If opt.recursive is set, call retrieve_tree() for each file.  */
-
-uerr_t
-retrieve_from_file (const char *file, bool html, int *count)
+static uerr_t retrieve_from_url_list(struct urlpos *url_list, int *count, struct iri *iri)
 {
+  struct urlpos *cur_url;
   uerr_t status;
-  struct urlpos *url_list, *cur_url;
-  struct iri *iri = iri_new();
-
-  char *input_file, *url_file = NULL;
-  const char *url = file;
-
-  status = RETROK;             /* Suppose everything is OK.  */
-  *count = 0;                  /* Reset the URL count.  */
-
-  /* sXXXav : Assume filename and links in the file are in the locale */
-  set_uri_encoding (iri, opt.locale, true);
-  set_content_encoding (iri, opt.locale);
-
-  if (url_valid_scheme (url))
-    {
-      int dt,url_err;
-      struct url *url_parsed = url_parse (url, &url_err, iri, true);
-      if (!url_parsed)
-        {
-          logprintf (LOG_NOTQUIET, "%s: %s.\n", url, url_error (url_err));
-          iri_free (iri);
-          return URLERROR;
-        }
-
-      if (!opt.base_href)
-        opt.base_href = xstrdup (url);
-
-      status = retrieve_url (url_parsed, url, &url_file, NULL, NULL, &dt,
-                             false, iri, true);
-      url_free (url_parsed);
-
-      if (!url_file || (status != RETROK))
-        return status;
-
-      if (dt & TEXTHTML)
-        html = true;
-
-#ifdef ENABLE_IRI
-      /* If we have a found a content encoding, use it.
-       * ( == is okay, because we're checking for identical object) */
-      if (iri->content_encoding != opt.locale)
-          set_uri_encoding (iri, iri->content_encoding, false);
-#endif
-
-      /* Reset UTF-8 encode status */
-      iri->utf8_encode = opt.enable_iri;
-      xfree (iri->orig_url);
-
-      input_file = url_file;
-    }
-  else
-    input_file = (char *) file;
-
-  url_list = (html ? get_urls_html (input_file, NULL, NULL, iri)
-              : get_urls_file (input_file));
-
-  xfree (url_file);
 
   for (cur_url = url_list; cur_url; cur_url = cur_url->next, ++*count)
     {
       char *filename = NULL, *new_file = NULL, *proxy;
       int dt = 0;
-      struct iri *tmpiri = iri_dup (iri);
-      struct url *parsed_url = NULL;
+      struct iri *tmpiri;
+      struct url *parsed_url;
 
       if (cur_url->ignore_when_downloading)
         continue;
@@ -1257,6 +1198,7 @@ retrieve_from_file (const char *file, bool html, int *count)
           break;
         }
 
+      tmpiri = iri_dup (iri);
       parsed_url = url_parse (cur_url->url->url, NULL, tmpiri, true);
 
       proxy = getproxy (cur_url->url);
@@ -1306,6 +1248,84 @@ Removing file due to --delete-after in retrieve_from_file():\n"));
       xfree (filename);
       iri_free (tmpiri);
     }
+  return status;
+}
+
+/* Find the URLs in the file and call retrieve_url() for each of them.
+   If HTML is true, treat the file as HTML, and construct the URLs
+   accordingly.
+
+   If opt.recursive is set, call retrieve_tree() for each file.  */
+
+uerr_t
+retrieve_from_file (const char *file, bool html, int *count)
+{
+  uerr_t status;
+  struct urlpos *url_list, *cur_url;
+  struct iri *iri = iri_new();
+
+  char *input_file, *url_file = NULL;
+  const char *url = file;
+
+  status = RETROK;             /* Suppose everything is OK.  */
+  *count = 0;                  /* Reset the URL count.  */
+
+  /* sXXXav : Assume filename and links in the file are in the locale */
+  set_uri_encoding (iri, opt.locale, true);
+  set_content_encoding (iri, opt.locale);
+
+  if (url_valid_scheme (url))
+    {
+      int dt,url_err;
+      struct url *url_parsed = url_parse (url, &url_err, iri, true);
+      if (!url_parsed)
+        {
+          logprintf (LOG_NOTQUIET, "%s: %s.\n", url, url_error (url_err));
+          iri_free (iri);
+          return URLERROR;
+        }
+
+      if (!opt.base_href)
+        opt.base_href = xstrdup (url);
+
+      status = retrieve_url (url_parsed, url, &url_file, NULL, NULL, &dt,
+                             false, iri, true);
+      url_free (url_parsed);
+
+      if (!url_file || (status != RETROK))
+        {
+          iri_free (iri);
+          return status;
+        }
+
+      if (dt & TEXTHTML)
+        html = true;
+
+#ifdef ENABLE_IRI
+      /* If we have a found a content encoding, use it.
+       * ( == is okay, because we're checking for identical object) */
+      if (iri->content_encoding != opt.locale)
+          set_uri_encoding (iri, iri->content_encoding, false);
+#endif
+
+      /* Reset UTF-8 encode status */
+      iri->utf8_encode = opt.enable_iri;
+      xfree (iri->orig_url);
+
+      input_file = url_file;
+    }
+  else
+    input_file = (char *) file;
+
+  bool read_again = false;
+  do {
+    url_list = (html ? get_urls_html (input_file, NULL, NULL, iri)
+                : get_urls_file (input_file, &read_again));
+
+    status = retrieve_from_url_list(url_list, count, iri);
+  } while (read_again);
+
+  xfree (url_file);
 
   /* Free the linked list of URL-s.  */
   free_urlpos (url_list);
@@ -1489,7 +1509,39 @@ getproxy (struct url *u)
       break;
     }
   if (!proxy || !*proxy)
+#ifdef HAVE_LIBPROXY
+    {
+      pxProxyFactory *pf = px_proxy_factory_new ();
+      if (!pf)
+        {
+          DEBUGP (("Allocating memory for libproxy failed"));
+         return NULL;
+        }
+
+      DEBUGP (("asking libproxy about url '%s'\n", u->url));
+      char **proxies = px_proxy_factory_get_proxies (pf, u->url);
+      if (proxies)
+        {
+          if (proxies[0])
+            {
+              DEBUGP (("libproxy suggest to use '%s'\n", proxies[0]));
+              if (strcmp (proxies[0], "direct://") != 0)
+                {
+                  proxy = xstrdup (proxies[0]);
+                  DEBUGP (("libproxy setting to use '%s'\n", proxy));
+                }
+            }
+
+           px_proxy_factory_free_proxies (proxies);
+        }
+        px_proxy_factory_free (pf);
+
+      if (!proxy || !*proxy)
+        return NULL;
+    }
+#else
     return NULL;
+#endif
 
   /* Handle shorthands.  `rewritten_storage' is a kludge to allow
      getproxy() to return static storage. */
@@ -1555,3 +1607,33 @@ input_file_url (const char *input_file)
   else
     return false;
 }
+
+#ifdef TESTING
+
+#include <stdint.h>
+#include "../tests/unit-tests.h"
+
+const char *
+test_retr_rate(void)
+{
+  static const struct test {
+    wgint bytes;
+    double secs;
+    const char *expected;
+  } tests[] = {
+    { 0, 1, "0.00 B/s" },
+    { INT64_MAX, 1, "100 TB/s" },
+  };
+
+  for (struct test *t = tests; t < tests+countof(tests); t++)
+    {
+      const char *result = retr_rate (t->bytes, t->secs);
+
+      if (strcmp(result,t->expected))
+        return aprintf("%s: Expected '%s', got '%s'", __func__, t->expected, result);
+    }
+
+  return NULL;
+}
+
+#endif /* TESTING */

src/retr.h

@@ -1,5 +1,5 @@
 /* Declarations for retr.c.
-   Copyright (C) 1996-2011, 2015, 2018-2023 Free Software Foundation,
+   Copyright (C) 1996-2011, 2015, 2018-2024 Free Software Foundation,
    Inc.
 
 This file is part of GNU Wget.