jmcguirl/harbour-deps

Reproducible curl (and openssl) binaries for Windows

    

Automated, reproducible, transparent, Windows builds for curl, nghttp2, libssh2 and OpenSSL 1.1

• Packaging aims to follow popular binary releases found on the internet.
• Both x86 and x64 packages are built using the same process.
• Standalone curl.exe (only msvcrt.dll is required).
• curl/libcurl are built with HTTP/2 support enabled.
• curl/libcurl features enabled by default:
  dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
AsynchDNS IDN IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz TLS-SRP HTTP2 HTTPS-proxy
• The build process is fully transparent by using publicly available open source code, C compiler, build scripts and running the build in public, with open, auditable build logs.
• C compiler toolchain is MinGW-w64 (non-multilib, x86 and x64) via MSYS2.
• Binaries are built with supported hardening options enabled.
• Binaries are using DWARF in x86 and SEH in x64 builds.
• Components are verified using SHA-256 hashes and also GPG signatures where available.
• Generated binaries are reproducible, meaning they will have the same hash given the same input sources and C compiler.
• Because MSYS2 is updated before each build, subsequent builds may use different versions/builds of the compiler toolchain. This may result in different generated binaries given otherwise unchanged source code and configuration, sometimes thus breaking reproducibility. This trade-off was decided to be tolerable for more ideal binaries and allowing this project to automatically benefit from continuous C compiler updates.
• Generated binaries are GPG signed with Bintray's key pair: 8756 C4F7 65C9 AC3C B6B8 5D62 379C E192 D401 AB61
• Patching policy: No locally maintained patches. Patches are only applied locally if already merged upstream or — in case it's necessary for a successful build — had them submitted upstream with fair confidence of getting accepted.
• Optional support for C-ares, librtmp and for WinSSL as a fall-back back end.
• Generated binaries are uploaded to VirusTotal.
• If you need a download with a stable checksum, link to the penultimate version. Only the current latest versions are kept updated with newer dependencies.
• To verify the correct checksum for the latest build, you can look up the correct ones in the build log as they are generated. Watch for the lines starting with SHA256(: https://ci.appveyor.com/project/vsz/harbour-deps/branch/master
• The build process is multi-platform and able to cross-build Windows executables from *nix hosts (Linux and macOS tested.)
• Packages created across different host platforms won't currently have identical hashes. The reason for this is the slightly different build options and versions of the mingw-w64 and binutils tools.
• Code signing is implemented but not enabled yet for reasons below:
  • There doesn't seem to exist a way to get free code signing certificates, so only a self-signed certificate could be used, which is not very useful.
  • The portable tool osslsigncode used for signing will always embed the current timestamp (Signing Time – OID 1.2.840.113549.1.9.5) in the signature, which breaks reproducibility. More precisely, this is added by OpenSSL's PKCS #7 module unconditionally.
  • Trusted timestamp included in the signature breaks reproducibility. This is an optional feature, though it appears to be good practice to include it.

Please donate to support maintaining these builds

Binary package downloads

• curl: https://bintray.com/vszakats/generic/curl
• OpenSSL: https://bintray.com/vszakats/generic/openssl
• libssh2: https://bintray.com/vszakats/generic/libssh2
• nghttp2: https://bintray.com/vszakats/generic/nghttp2
• zlib: https://bintray.com/vszakats/generic/zlib

Live build logs

• https://ci.appveyor.com/project/vsz/harbour-deps/branch/master (for published binaries)
• https://travis-ci.org/vszakats/harbour-deps

Guarantees and Liability

THIS SOFTWARE (INCLUDING RESULTING BINARIES) IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Information in this document is subject to change without notice and does not represent or imply any future commitment by the participants of the project.

---

This document © 2014–present Viktor Szakats https://vszakats.net/