curl

Bilingual

What the Bliss Taught Us
2 months ago
- Curl took a month-long break from vulnerability reporting (Summer of Bliss 2026) with zero reports received.
- Maintainers felt immediate relief, re-energization, and were able to focus on feature requests and code improvements.
- CNA rules were managed without incidents, and paying customers were unaffected.
- The open source community responded positively, with several projects following the example.
- Post-break, the team is handling a backlog of issues and pull requests, and no major security incidents have occurred.
- The maintainers plan to repeat the break in the future.
HTTP Message Signatures with curl
2 months ago
- RFC 9421 describes HTTP Message Signatures for creating, encoding, and verifying digital signatures over HTTP message components.
- Message Signatures ensure selected parts of HTTP requests arrive unmodified, even through proxies, load balancers, or CDNs.
- curl now experimentally supports HTTP Message Signatures with four new command-line options: --httpsig-algo, --httpsig-key, --httpsig-keyid, and --httpsig-headers.
- The default signing algorithm is ed25519, with hmac-sha256 also supported.
- Corresponding libcurl options (e.g., CURLOPT_HTTPSIG_ALGORITHM) are available for developers.
- This feature is marked experimental and requires explicit build enabling; backward compatibility is not guaranteed.
- The feature will ship in curl 8.22.0, contributed by Sameeh Jubran.
1,500 Curl Authors
2 months ago
- Curl development relies on a large community, not just a single maintainer.
- The maintainer no longer handles the majority of commits.
- The curl git repository now includes contributions from 1,500 people.
- It took 4.5 years to go from 1,000 to 1,500 contributors.
- The 1,500th contributor is Sameeh Jubran.

What the Bliss Taught Us

HTTP Message Signatures with curl

1,500 Curl Authors