Upgrading curl on a Win 8.1 system

[Jeremy Nicoll via curl-users]

Happy Old Year!

For years I've been using curl v7.25.0 (Win32). When I originally
installed that the download I got from the curl download webpage
was described as

Win32 2000/XP 7.25.0 binary SSL SSH Gunter Knauf 1.52 MB

and when I unpacked that zip I copied four files into the folder where
I wanted to keep curl. Those were

curl.exe libcurl.dll libeay32.dll libssl32.dll


Today (for a Win8.1 64bit system) I downloaded a zip described as

Win64 x86_64 zip 7.57.0 binary SSL SSH Marc Hörsken 2.01 MB

and although there's clearly a curl.exe in that too, there's no sign of
any related DLLs. However I do notice that the curl.exe here is much
larger than the 7.25.0 one was (3911 KB instead of 659 KB).

That makes me think that the newer curl.exe has had the DLL stuff
linked into it. Is that right?

[Daniel Stenberg]

Post by Jeremy Nicoll via curl-users
However I do notice that the curl.exe here is much
larger than the 7.25.0 one was (3911 KB instead of 659 KB).
That makes me think that the newer curl.exe has had the DLL stuff
linked into it. Is that right?

When it comes to answers about specific binary builds you are generally
better off asking the one making the package. In this case however, it
seems you can just invoke "curl -V" and see that it works and shows a
reasonable version.

/ Daniel


-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/mai

[Ray Satiro via curl-users]

Post by Daniel Stenberg

Post by Jeremy Nicoll via curl-users
However I do notice that the curl.exe here is much
larger than the 7.25.0 one was (3911 KB instead of 659 KB).
That makes me think that the newer  curl.exe  has had the DLL stuff
linked into it.   Is that right?

When it comes to answers about specific binary builds you are
generally better off asking the one making the package. In this case
however, it seems you can just invoke "curl -V" and see that it works
and shows a reasonable version.

Yes, Marc Hörsken's build of curl includes libcurl in the executable
instead of in a dll. In other words it was built with a static library
of libcurl. This can be assumed since it does not include a DLL, and can
be confirmed by using a program like Dependency Walker which shows no
3rd party DLLs are required.

curl -V
curl 7.57.0 (i686-w64-mingw32) libcurl/7.57.0 OpenSSL/1.0.2h (WinSSL)
zlib/1.2.8 WinIDN libssh2/1.7.0_DEV
Release-Date: 2017-11-30
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps
pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL
libz TLS-SRP HTTPS-proxy MultiSSL

In the version information you can see it is built to use multiple SSL
libraries, OpenSSL and WinSSL (aka schannel). Notice (WinSSL) is in
parentheses and OpenSSL is not, which means it is set to use OpenSSL. It
can be switched to use WinSSL if CURL_SSL_BACKEND is set to schannel.

set CURL_SSL_BACKEND=schannel
curl -V
curl 7.57.0 (i686-w64-mingw32) libcurl/7.57.0 (OpenSSL/1.0.2h) WinSSL
zlib/1.2.8 WinIDN libssh2/1.7.0_DEV
Release-Date: 2017-11-30
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps
pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL
libz TLS-SRP MultiSSL

OpenSSL needs a CA certificate bundle file to verify the SSL
connections. You can download it from
https://curl.haxx.se/docs/caextract.html (click the cacert.pem) and then
put it in the same directory as curl.exe and name it curl-ca-bundle.crt,
and curl will auto detect it.

WinSSL does not need a CA certificate bundle since it uses the Windows
OS certificate store.

Granted I realize we could probably explain this better, somewhere. Marc
can you update your readme to explain multi-ssl and that
curl-ca-bundle.crt is needed by default?

[Jeremy Nicoll via curl-users]

Post by Daniel Stenberg

Post by Jeremy Nicoll via curl-users
However I do notice that the curl.exe here is much
larger than the 7.25.0 one was (3911 KB instead of 659 KB).
That makes me think that the newer  curl.exe  has had the DLL stuff
linked into it.   Is that right?

When it comes to answers about specific binary builds you are
generally better off asking the one making the package. In this case
however, it seems you can just invoke "curl -V" and see that it works
and shows a reasonable version.

Thanks to both of you for replying. Sorry for not replying to you
earlier.

Daniel, it does do that, thank-you. I wasn't sure though whether that
proved it had the support previously provided by the separate DLLs...
I'd guessed that would depends on whether curl.exe loaded all the
DLLs it might need at the start of its execution (in which case maybe a
-V call would fail if they couldn't be found) or only when one/all of them
were actually needed.

Yes, Marc Hörsken's build of curl includes libcurl in the executable
instead of in a dll. In other words it was built with a static library
of libcurl. This can be assumed since it does not include a DLL, and can
be confirmed by using a program like Dependency Walker which shows no
3rd party DLLs are required.

That Dependency Walker thing has cropped up in quite a few threads
I've read in various places recently... I must install it and play with it...

curl -V

[snippity]

In the version information you can see it is built to use multiple SSL
libraries, OpenSSL and WinSSL (aka schannel). Notice (WinSSL) is in
parentheses and OpenSSL is not, which means it is set to use OpenSSL. It
can be switched to use WinSSL if CURL_SSL_BACKEND is set to schannel.
set CURL_SSL_BACKEND=schannel
curl -V ...

I've tried this with the same results. Thank-you for your detailed
and clear explanation.

Granted I realize we could probably explain this better, somewhere.
Marc can you update your readme to explain multi-ssl and that
curl-ca-bundle.crt is needed by default?

Oops, I thought when I read that... I hadn't looked at 'the' readme in the
download. But I have done since then. But, the 'binary' download (as
is mentioned in various Stack Overflow threads - I'm glad I'd read those
first) isn't at all what a normal Windows user would expect.

Mine has 40 files in 21 folders. Twelve or so of those files have 'README'
in their names, and that doesn't include the MANPAGE and INSTALL files.
Almost none of these files (all of which I looked at before writing this)
have any relevance to a Windows user.

Quite a lot of them have no extension in their filenames, making them a
pain to open and read on Windows... every one needing a right-click and
a choice of editor. Those that do have extensions are ".MD" which is also
not associated with anything on a typical Windows system.

The curl.exe file is found inside a folder named "src" which is probably
the last place anyone 'knowledgeable' would ever look...

The first time I downloaded this and unzipped it I was sure I'd somehow
got a source download with makefiles etc... and immediately deleted it
and looked again at the choice of downloads. But lots were like that;
that's when I went off to Google and hence Stack Overflow...

It'd be a lot less intimidating if one merely downloaded a zip containing
curl.exe, a licence file & the CHANGES file (but both with a .txt extension)
and a short relevant-to-Windows help .txt file.

[Ray Satiro via curl-users]

Post by Jeremy Nicoll via curl-users

Post by Ray Satiro via curl-users
Granted I realize we could probably explain this better, somewhere.
Marc can you update your readme to explain multi-ssl and that
curl-ca-bundle.crt is needed by default?

Oops, I thought when I read that... I hadn't looked at 'the' readme in the
download. But I have done since then. But, the 'binary' download (as
is mentioned in various Stack Overflow threads - I'm glad I'd read those
first) isn't at all what a normal Windows user would expect.
Mine has 40 files in 21 folders. Twelve or so of those files have 'README'
in their names, and that doesn't include the MANPAGE and INSTALL files.
Almost none of these files (all of which I looked at before writing this)
have any relevance to a Windows user.
Quite a lot of them have no extension in their filenames, making them a
pain to open and read on Windows... every one needing a right-click and
a choice of editor. Those that do have extensions are ".MD" which is also
not associated with anything on a typical Windows system.
The curl.exe file is found inside a folder named "src" which is probably
the last place anyone 'knowledgeable' would ever look...
The first time I downloaded this and unzipped it I was sure I'd somehow
got a source download with makefiles etc... and immediately deleted it
and looked again at the choice of downloads. But lots were like that;
that's when I went off to Google and hence Stack Overflow...
It'd be a lot less intimidating if one merely downloaded a zip containing
curl.exe, a licence file & the CHANGES file (but both with a .txt extension)
and a short relevant-to-Windows help .txt file.

Fair point. I tried CCing Marc Hörsken the last e-mail but it bounced, I
have a different address this time so hopefully it is right and he sees
this.