top | item 35228516

Curl 8.0.0

192 points| TangerineDream | 3 years ago |daniel.haxx.se | reply

70 comments

order
[+] azov|3 years ago|reply
How many applications will delay getting those security patches because they assume that 8.x is a breaking change?

There's probably a fair number of setups that more-or-less automatically upgrade to the next minor version, but not the next major.

[+] nusaru|3 years ago|reply
> There is no API nor ABI break in this version.

I don’t know why, but this really, really bothers me. Why even use semver then?

[+] fwlr|3 years ago|reply
Semver 2.0 on major version:

“Major version X (X.y.z | X > 0) MUST be incremented if any backwards incompatible changes are introduced to the public API. It MAY also include minor and patch level changes. Patch and minor versions MUST be reset to 0 when major version is incremented.”

Curl on changes in 8.0.0:

“There is only one actual “change” in this release. This is the first curl release to drop support for building on a systems that lack a working 64 bit data type. curl now requires that ‘long long‘ or an equivalent exists.”

This is a backwards-incompatible breaking change, though not to the public API (but I believe semver as used is understood to include ABI, supported environments, etc), and it’s likely only “theoretically” breaking (are there any existing platforms that don’t have 64-bit support that did build curl, and now can’t? Looks like Daniel posed this question back in Sep 22 and found there were not https://curl.se/mail/lib-2022-09/0099.html).

So semver is not respected to the letter (semver specifies that only public API matters), but it is respected in spirit (the breaking change is in supported build environments, which people do care about when picking versions), but it is also the smallest possible unit of change that still counts as a breaking change, so it’s a bit of a technicality as well.

Personally I’m quite satisfied with it, it takes a decent understanding of semver to produce a case this finely balanced on the edge of two technicalities, which gives me the impression of being playful with semver rather than disrespecting, or being unaware of, semver. YMMV

[+] groestl|3 years ago|reply
First: You should never trust semver anyways, not where it matters. Second: even in semver, you can bump all the way you want, especially the major version. Just don't skip bumping when you break stuff.
[+] Slartie|3 years ago|reply
AFAIK, semantic versioning does not prohibit you from voluntarily increasing a version number at a more "important" place than the one you need to increase considering the changes you did. It just requires that you increase it if you do "hard" API/ABI changes that mandate an increase.
[+] eesmith|3 years ago|reply
The line before the one you quoted gives their explanation: "We decided it was about time to reset the minor number down to more a manageable level and doing it exactly on curl’s 25th birthday made it extra fun."
[+] HeavyFeather|3 years ago|reply
Major instead of patch is far better than patch instead of major. Nothing breaks due to this new version.
[+] Semaphor|3 years ago|reply
> Why even use semver then?

They don’t?

[+] Svip|3 years ago|reply
Still no IRC support. Which - considering the project that became curl started out as an IRC bot - is slightly ironic.
[+] rakoo|3 years ago|reply
How would that work ? cURL is built for request-reply usecases, with potentially long-lived connections, but once connected the handling happens outside of curl. irc is an interactive protocol, meaning that requests and replies would be handled inside cURL.
[+] Faaak|3 years ago|reply
You're welcome to make a PR :-)
[+] low_tech_love|3 years ago|reply
No big deal. I could write it in a 3 day weekend.
[+] mctt|3 years ago|reply
What is this a reference to?
[+] coolgoose|3 years ago|reply
In before somebody is going to say they can rewrite curl in a weekend hackaton.
[+] scottlamb|3 years ago|reply
The most charitable view I can take of such comments is to mentally paraphrase them to: "I can rewrite the small subset of the curl CLI that I personally use, in a modern language, on top of an existing HTTP library, in a weekend hackathon". That doesn't seem so crazy.
[+] return_to_monke|3 years ago|reply
of course I can ! just pull in libcurl and then it is just parsing cli arguments
[+] intelVISA|3 years ago|reply
A whole weekend?! With GPT4 and C++23 on the horizon that's more of an afternoon delight.
[+] aew4ytasghe5|3 years ago|reply
25 years of CVE:s, why not.
[+] charcircuit|3 years ago|reply
What's stopping you from making a basic version? Just about everything supports HTTP 1.0 still so you can make a quick program that sends:

    GET / HTTP/1.0
    Host: example.com
    
    
over a socket and that's already mostly working. Figure out TLS. Then you just have to do command line parsing and add the stuff you parsed into your request.