gnu: curl: Update to 8.21.0 [security fixes].

This update contains fixes for CVE-2026-8286, CVE-2026-8924,
CVE-2026-8925, CVE-2026-8926, CVE-2026-8927, CVE-2026-8932,
CVE-2026-9079, CVE-2026-9080, CVE-2026-9545, CVE-2026-9546,
CVE-2026-9547. CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856 and CVE-2026-12064,

* gnu/packages/curl.scm (curl): Update to 8.21.0.
* gnu/packages/patches/curl-use-ssl-cert-env.patch:
  Adapt for upstream changes.

Merges: https://codeberg.org/guix/guix/pulls/10375
Signed-off-by: Nguyễn Gia Phong <cnx@loang.net>

2 files changed, 18 insertions, 19 deletions

diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 6b8c9ee1f25..926b0ce429c 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -69,14 +69,14 @@
 (define-public curl
   (package
     (name "curl")
-    (version "8.20.0")
+    (version "8.21.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://curl.se/download/curl-"
                                   version ".tar.xz"))
               (sha256
                (base32
-                "15mqw8y9vdxlz9cpr2z7q9r6552wgs7q7vr2k7lfl35s930jvzk3"))
+                "1rkjzj3sr4zvvwx41aqjwlfmdbh8dij4b1sh4k33vs5c1sknc6xa"))
               (patches (search-patches "curl-use-ssl-cert-env.patch"))))
     (outputs '("out"
                "doc"))                  ;1.2 MiB of man3 pages
diff --git a/gnu/packages/patches/curl-use-ssl-cert-env.patch b/gnu/packages/patches/curl-use-ssl-cert-env.patch
index 445e52c430f..6639a4d0df5 100644
--- a/gnu/packages/patches/curl-use-ssl-cert-env.patch
+++ b/gnu/packages/patches/curl-use-ssl-cert-env.patch
@@ -4,12 +4,11 @@ must be called when no other threads exist).
 
 This fixes network functionality in rust:cargo, and probably removes the need
 for other future workarounds.
-===================================================================
-Index: curl-8.19.0/lib/easy.c
-===================================================================
---- curl-8.19.0.orig/lib/easy.c
-+++ curl-8.19.0/lib/easy.c
-@@ -117,6 +117,9 @@ curl_calloc_callback Curl_ccalloc = (cur
+diff --git a/lib/easy.c b/lib/easy.c
+index d60bdae..d25d670 100644
+--- a/lib/easy.c
++++ b/lib/easy.c
+@@ -117,6 +117,9 @@ curl_calloc_callback Curl_ccalloc = (curl_calloc_callback)calloc;
  static char *leakpointer;
  #endif
  
@@ -19,7 +18,7 @@ Index: curl-8.19.0/lib/easy.c
  /**
   * curl_global_init() globally initializes curl given a bitwise set of the
   * different features of what to initialize.
-@@ -140,6 +143,9 @@ static CURLcode global_init(long flags,
+@@ -140,6 +143,9 @@ static CURLcode global_init(long flags, bool memoryfuncs)
      goto fail;
    }
  
@@ -39,12 +38,12 @@ Index: curl-8.19.0/lib/easy.c
  #ifdef _WIN32
    Curl_win32_cleanup(easy_init_flags);
  #endif
-Index: curl-8.19.0/lib/vtls/vtls.c
-===================================================================
---- curl-8.19.0.orig/lib/vtls/vtls.c
-+++ curl-8.19.0/lib/vtls/vtls.c
-@@ -294,10 +294,8 @@ static void free_primary_ssl_config(stru
- CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+diff --git a/lib/vtls/vtls_config.c b/lib/vtls/vtls_config.c
+index 4a9b696..3e780f3 100644
+--- a/lib/vtls/vtls_config.c
++++ b/lib/vtls/vtls_config.c
+@@ -257,10 +257,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
+                                        struct Curl_peer *origin)
  {
    struct ssl_config_data *sslc = &data->set.ssl;
 -#if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
@@ -52,9 +51,9 @@ Index: curl-8.19.0/lib/vtls/vtls.c
    CURLcode result;
 -#endif
  
-   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
- #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
-@@ -318,6 +316,21 @@ CURLcode Curl_ssl_easy_config_complete(s
+   ssl_easy_config_compl_options(origin, data->state.initial_origin, sslc);
+ 
+@@ -283,6 +281,21 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
          return result;
      }
  #endif
@@ -75,4 +74,4 @@ Index: curl-8.19.0/lib/vtls/vtls.c
 +    }
    }
    sslc->primary.CAfile = data->set.str[STRING_SSL_CAFILE];
-   sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
+   sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
\ No newline at end of file