curl: 8.2.1 -> 8.3.0

[yayayayaka]

PR for staging-23.05 in #254962

Description of changes

• https://curl.se/changes.html#8_3_0
• Fixes CVE-2023-38039
• Fixes the github src url

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[mweinelt]

Trying to build curl.tests for all supported platforms I get the following:

aarch64-darwin / x86_64-darwin

Both show this discrepancy:

curl-aarch64-darwin> checking run-time libs availability... failed
curl-aarch64-darwin> configure: error: one or more libs available at link-time are not available run-time. Libs used at link-time: -lnghttp2 -lidn2 -lssh2 -lssh2 -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lresolv -lzstd -lzstd -lbrotlidec -lbrotlidec -lz 

x86_64-linux

curl.tests.withCheck fails a new test.

TESTFAIL: These test cases failed: 1474

aarch64-linux

OK

[mweinelt]

I think we need darwin people to iterate on this issue, if you @yayayayaka can't.

[reckenrode]

I’m pretty sure the Darwin patches can be dropped, and curl can link against configd now. The Darwin stdenv no longer depends on libcurl as of ebc1bcf. It still needs curl during the bootstrap (because many dependencies use fetchpatch and fetchFromGithub), but the dependency cycle due to configd is gone. However, I can’t get past the configure error.

I ran it interactively, and this is what I see in the build log.

dyld[88282]: Library not loaded: /nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-brotli-1.1.0/lib/libbro
tlidec.1.dylib
  Referenced from: <no uuid> /private/tmp/nix-shell.UgB7oF/curl-8.3.0/conftest
  Reason: tried: '/nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-brotli-1.1.0/lib/libbrotlidec.1.dylib'
 (no such file), '/System/Volumes/Preboot/Cryptexes/OS/nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-br
otli-1.1.0/lib/libbrotlidec.1.dylib' (no such file), '/nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-br
otli-1.1.0/lib/libbrotlidec.1.dylib' (no such file), '/usr/local/lib/libbrotlidec.1.dylib' (no such
file), '/usr/lib/libbrotlidec.1.dylib' (no such file, not in dyld cache)
./configure: line 2520: 88282 Abort trap: 6           ./conftest$ac_exeext

The correct brotli lib path on my system is /nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-brotli-1.1.0/lib/. Running otool on libbrotlidec.1.dylib at that path gives the following. It appears something is going wrong after the brotli update in 405e6ee.

$ otool -L /nix/store/yz0mp6k77m78k9bbg3hy4nflb90386ix-brotli-1.1.0-lib/lib/libbrotlidec.dylib
/nix/store/yz0mp6k77m78k9bbg3hy4nflb90386ix-brotli-1.1.0-lib/lib/libbrotlidec.dylib:
	/nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-brotli-1.1.0/lib/libbrotlidec.1.dylib (compatibility version 1.0.0, current version 1.1.0)
	/nix/store/ggybmc8bcwxsnc9byildn8az9p8lmh2k-brotli-1.1.0/lib/libbrotlicommon.1.dylib (compatibility version 1.0.0, current version 1.1.0)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.60.1)

[mweinelt]

I'm also seeing python3.pkgs.brotlicffi fail on python-updates, which blocks python3.pkgs.requests.

brotlicffi-aarch64-darwin> pythonImportsCheckPhase
brotlicffi-aarch64-darwin> Executing pythonImportsCheckPhase
brotlicffi-aarch64-darwin> Check whether the following modules can be imported: brotlicffi
brotlicffi-aarch64-darwin> Traceback (most recent call last):
brotlicffi-aarch64-darwin>   File "<string>", line 1, in <module>
brotlicffi-aarch64-darwin>   File "<string>", line 1, in <lambda>
brotlicffi-aarch64-darwin>   File "/nix/store/hch43i8m9faf0xzl66rkqjvqd4kss2ag-python3-3.11.5/lib/python3.11/importlib/__init__.py", line 126, in import_module
brotlicffi-aarch64-darwin>     return _bootstrap._gcd_import(name[level:], package, level)
brotlicffi-aarch64-darwin>            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
brotlicffi-aarch64-darwin>   File "<frozen importlib._bootstrap>", line 1204, in _gcd_import
brotlicffi-aarch64-darwin>   File "<frozen importlib._bootstrap>", line 1176, in _find_and_load
brotlicffi-aarch64-darwin>   File "<frozen importlib._bootstrap>", line 1147, in _find_and_load_unlocked
brotlicffi-aarch64-darwin>   File "<frozen importlib._bootstrap>", line 690, in _load_unlocked
brotlicffi-aarch64-darwin>   File "<frozen importlib._bootstrap_external>", line 940, in exec_module
brotlicffi-aarch64-darwin>   File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
brotlicffi-aarch64-darwin>   File "/nix/store/w3cynm10q7zrjg8pmf19d83mkkrvki93-python3.11-brotlicffi-1.1.0.0/lib/python3.11/site-packages/brotlicffi/__init__.py", line 3, in <module>
brotlicffi-aarch64-darwin>     from ._api import (
brotlicffi-aarch64-darwin>   File "/nix/store/w3cynm10q7zrjg8pmf19d83mkkrvki93-python3.11-brotlicffi-1.1.0.0/lib/python3.11/site-packages/brotlicffi/_api.py", line 5, in <module>
brotlicffi-aarch64-darwin>     from ._brotlicffi import ffi, lib
brotlicffi-aarch64-darwin> ImportError: dlopen(/nix/store/w3cynm10q7zrjg8pmf19d83mkkrvki93-python3.11-brotlicffi-1.1.0.0/lib/python3.11/site-packages/brotlicffi/_brotlicffi.abi3.so, 0x0002): Library not loaded: /nix/store/ykb4jj03p0vpac2dxqaylcyplxgq20cx-brotli-1.1.0/lib/libbrotlienc.1.dylib
brotlicffi-aarch64-darwin>   Referenced from: <no uuid> /nix/store/w3cynm10q7zrjg8pmf19d83mkkrvki93-python3.11-brotlicffi-1.1.0.0/lib/python3.11/site-packages/brotlicffi/_brotlicffi.abi3.so
brotlicffi-aarch64-darwin>   Reason: tried: '/nix/store/ykb4jj03p0vpac2dxqaylcyplxgq20cx-brotli-1.1.0/lib/libbrotlienc.1.dylib' (no such file), '/usr/local/lib/libbrotlienc.1.dylib' (no such file), '/usr/lib/libbrotlienc.1.dylib' (no such file, not in dyld cache)