2017-02-03  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/utils.c: Move macro FMT_MAX_LENGTH into scope

	* src/utils.c: Fix -Wformat= warnings

	* src/gnutls.c: Fix -Wformat= warnings

	* src/iri.c: Remove unused macro IDNA_FLAGS

	* src/iri.c: Remove use of __func__ macros

	* src/http.c: Fix -Wformat= warnings

	* src/progress.c: Remove unused macro move_to_end

	* src/html-parse.c: Remove unused macro SKIP_NON_WS

	* src/hsts.c: Remove unused macro CHECK_EXPLICIT_PORT

	* src/hsts.c: Fix -Wformat= warnings

	* src/hash.c: Explicitly convert float to int

	* src/ftp-ls.c: Fix -Wformat= warnings

	* src/ftp.c (ftp_retrieve_list): Add default to switch

	* src/css-url.h: Remove redundant declaration

	* src/ftp.c: Fix -Wformat= warning

	* src/http.c (test_parse_range_header): Fix constants

2017-02-02  Dale R. Worley  <worley@ariadne.com>

	Improve documentation of --trust-server-names.

2017-02-02  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/url.c (mkalldirs): Add newline to log message

	* src/cookies.c (check_domain_match): Add newline to DEBUG lines

2017-01-17  Tim Rühsen  <tim.ruehsen@gmx.de>

	* NEWS: update

	* README.checkout: Link HTTPS where possible, update flex homepage

	* README.checkout: Fix libidn to libidn2

2017-01-13  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/iri.c: Use TR46 non-transitional for toASCII conversion

	* src/main.c: Fix _Noreturn compiler warnings

	* src/utils.c: Fix _Noreturn compiler warning

	* src/init.c (setval_internal): Fix sign compare warning

2017-01-13  Tim Rühsen  <tim.ruehsen@gmx.de>

	Replace home-grown portability code by gnulib modules
	* bootstrap.conf: Add intprops, inttypes, limits-h, signal-h,
	  stat, sys_types
	* src/ftp.c: Replace 'struct_stat' by 'struct stat'
	* src/hsts.c: Likewise
	* src/http.c: Likewise
	* src/main.c: Likewise
	* src/netrc.c: Likewise
	* src/retr.c: Likewise
	* src/url.c: Likewise
	* src/utils.c: Likewise
	* src/sysdep.h: Remove old portability code

	Further portability issues should be addressed by gnulib.

2017-01-13  Tim Rühsen  <tim.ruehsen@gmx.de>

	Replace WGET_* m4 macros by gnulib modules
	* bootstrap.conf: Add hostent, inet_ntop, nanosleep, utimens
	* configure.ac: Remove WGET_STRUCT_UTIMBUF, WGET_FNMATCH,
	  WGET_NANOSLEEP, WGET_POSIX_CLOCK, WGET_NSL_SOCKET
	* m4/wget.m4: Likewise
	* src/Makefile.am: Add $(LIB_NANOSLEEP) $(LIB_POSIX_SPAWN) to LDADD
	* tests/Makefile.am: Likewise
	* src/host.c (print_address): Use inet_ntop also for IPV4

2017-01-13  Tim Rühsen  <tim.ruehsen@gmx.de>

	Remove libidn vulnerability work-around
	* src/iri.c (_utf8_is_valid): Removed

	Since we are using libidn2 for IDNs, we no longer need
	this work-around.

2017-01-13  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/iri.c (idn_encode): Use TR46 transitional if available

	* gnulibx: Update

2017-01-07  Tim Rühsen  <tim.ruehsen@gmx.de>

	Fix previous commit 2427ca4ac090dc6cc0c527f4ac4fc5a4bd468eb1

2017-01-06  vijeth-aradhya  <vijthaaa@gmail.com>

	Fix http.c and ftp.c passwd logic error
	* src/ftp.c (getftp): Fix password/user selection
	* src/http.c (initialize_request): Likewise

	Before, netrc password won over interactive
	--ask-password but now --ask-password wins
	after change of program logic

	Fixes Issue #48811

2016-12-31  Giuseppe Scrivano  <gscrivan@redhat.com>

	* src/main.c (main): Add missing \n in error message

2016-12-28  Giuseppe Scrivano  <gscrivan@redhat.com>

	Check that fd_set has not fds bigger than FD_SETSIZE
	* src/connect.c: check that the fd is not bigger than FD_SETSIZE
	  before using FD_SET.  An fd_set cannot hold fds bigger than
	  FD_SETSIZE, causing out-of-bounds write to a buffer on the stack.

	Reported by: Jann Horn <jannh@google.com>

2016-12-20  Nikos Mavrogiannopoulos  <nmav@gnutls.org>

	Avoid calling the gnutls priority functions multiple times
	* src/gnutls.c (ssl_connect_wget): Call gnutls_set_default_priority()
	  for --secure-protocol=auto (default).

	The patch fixes a behavior that may have unintended side-effects in
	certain gnutls versions. Instead use the default priorities when no
	options are given.

2016-12-19  Tim Rühsen  <tim.ruehsen@gmx.de>

	Print debug message when skipping certain recursive downloads
	* src/recur.c (retrieve_tree): Print debug message instead silently
	  skipping recursive downloads.

2016-12-14  Rahul Bedarkar  <rahul.bedarkar@imgtec.com>

	Rename base64_{encode,decode} (trivial patch)
	* src/http-ntlm.c: Rename base64_{encode,decode}
	* src/http.c: Likewise
	* src/utils.c: Likewise
	* src/utils.h: Likewise

	When statically linking with gnutls, we get definition clash error for
	base64_encode which is also defined by gnutls.

	To prevent definition clash, rename base64_{encode,decode}

2016-12-11  Tim Rühsen  <tim.ruehsen@gmx.de>

	Add support for psl_latest()
	* configure.ac: Add check for psl_latest(),
	  remove --with-psl-file
	* src/cookies.c (check_domain_match): Use psl_latest() if available

2016-11-09  Piotr Wajda  <pwajda@gmail.net.pl>

	Respect -o parameter again
	 * log.c: don't choose log output dynamically when opt.lfilename is set

	 Regression introduced by dd5c549f6af8e1143e1a6ef66725eea4bcd9ad50
	 Reported-by: Dale R. Worley

2016-11-07  Tim Rühsen  <tim.ruehsen@gmx.de>

	Move Wget from IDN2003 (libidn) to IDN2008 (libidn2)
	* .travis.yml: Install libidn2-dev instead libidn11-dev.
	* bootstrap.conf: Add modules libunistring-optional, unistr/base,
	  unicase/tolower.
	* configure.ac: Check for libidn2.
	* src/Makefile.am: Add $(LTLIBUNISTRING) to LDADD.
	* tests/Makefile.am: Set LDADD similar to LDADD in src/Makefile.am
	* src/connect.c: Use libidn2 code instead of libidn.
	* src/host.c: Likewise.
	* src/iri.c: Likewise.
	* src/iri.h: Likewise.
	* src/options.h: Likewise.
	* src/url.c: Likewise.
	* src/url.h: Likewise.
	* src/log.c: Fix C99 comment.

	IDN2003 should not be used any more due to security concerns.
	We use libunistring (resp. the unicode code from gnulib) for
	lowercasing UTF-8 before we give data to libidn2.
	TR#46 is missing, no support in libidn2 nor in libunistring.

2016-11-03  Tim Rühsen  <tim.ruehsen@gmx.de>

	Use -O0 in contrib scripts
	* contrib/check-hard: Use -O0 instead of -O2 to speed up script.
	* contrib/travis-ci: Likewise.

	Update gnulib

2016-10-22  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/metalink.c: Fix typo 'suceeded' -> 'succeeded'
	Reported-by: Göran Uddeborg <goeran@uddeborg.se>,
	             Anders Jonsson <anders.jonsson@norsjovallen.se>

2016-10-21  losgrandes  <pwajda@gmail.net.pl>

	Fixes #45790: wget prints it's progress even when background
	* src/log.c: Use tcgetpgrp(STDIN_FILENO) != getpgrp() to determine when to print to STD* or logfile.
	  Deprecate log_request_redirect_output function.
	  Use different file handles for STD* and logfile, to easily switch between them when changing fg/bg.
	* src/log.h: Make redirect_output function externally linked.
	* src/main.c: Don't use deprecated log_request_redirect_output function. Use redirect_output instead.
	* src/mswindows.c: Don't use deprecated log_request_redirect_output function. Use redirect_output instead.

	Fixes #46584: wget --spider always returns zero exit status
	* src/ftp.c: Return error as exit value if even one file doesn't exist

2016-10-12  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/http.c (gethttp): Accept 206 for request w/o Range header
	Fixes: #49319

2016-10-07  Tim Rühsen  <tim.ruehsen@gmx.de>

	* tests/Makefile.am: Let WGETRC work on *nix and Windows

	Properly include iconv.h
	* src/iri.c: Check HAVE_ICONV to include iconv.h
	* src/url.c: Same

	* bootstrap.conf: Add pipe-posix for pipe()

2016-10-07  Tim Rühsen  <tim.ruehsen@gmx.de>

	Amend redirection behavior
	* src/recur.c (descend_redirect): Ignore WG_RR_LIST and WG_RR_REGEX
	  for redirections.
	* testenv/Makefile.am: Add Test-recursive-redirect.py
	* testenv/Test-recursive-redirect.py: New test

	Test-recursive-redirect.py written by Dale R. Worley.

	Reported-by: "Dale R. Worley" <worley@ariadne.com>

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New: Metalink/XML v3 python class, update tests to use this class
	* testenv/misc/metalinkv3_xml.py: New Metalink/XML v3 python class
	* testenv/Test-metalink-xml-abspath-trust.py: Update test to use the
	  new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-abspath.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-absprefix-trust.py: Update test to use the
	  new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-absprefix.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-continue.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-emptyprefix-trust.py: Update test to use
	  the new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-homepath-trust.py: Update test to use the
	  new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-homepath.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-homeprefix-trust.py: Update test to use
	  the new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-homeprefix.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-nohash.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-nourls.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-prefix-trust.py: Update test to use the
	  new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-prefix.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-relpath-trust.py: Update test to use the
	  new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-relpath.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-relprefix-trust.py: Update test to use the
	  new Metalink/XML v3 python class
	* testenv/Test-metalink-xml-relprefix.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-size.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml-trust.py: Update test to use the new
	  Metalink/XML v3 python class
	* testenv/Test-metalink-xml.py: Update test to use the new
	  Metalink/XML v3 python class

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New: --metalink-over-http Content-Type/Disposition Metalink/XML processing
	* src/http.c (metalink_from_http): Process the Content-Type header.
	  Add an application/metalink4+xml URL as metalink metaurl.  If the
	  option opt.content_disposition is true, the Content-Disposition's
	  filename is the metaurl's name
	* doc/wget.texi: Update --content-disposition and --metalink-over-http
	* doc/metalink-standard.txt: Update doc. Content-Type/Disposition
	  processing through --metalink-over-http. Update download naming
	  system about --trust-server-names and --content-disposition
	* testenv/Makefile.am: Add new files
	* testenv/Test-metalink-http-xml-type.py: New file. Metalink/HTTP
	  Content-Type/Disposition header automated Metalink/XML tests
	* testenv/Test-metalink-http-xml-type-trust.py: New file. Metalink/HTTP
	  Content-Type/Disposition header with --trust-server-names automated
	  Metalink/XML tests
	* testenv/Test-metalink-http-xml-type-content.py: New file. Metalink/HTTP
	  Content-Type/Disposition header with --content-disposition automated
	  Metalink/XML tests
	* testenv/Test-metalink-http-xml-type-trust-content.py: New file.
	  Metalink/HTTP Content-Type/Disposition header with --trust-server-names
	  and --content-disposition automated Metalink/XML tests

	Process the Content-Type header, identify an application/metalink4+xml
	file.  The Content-Disposition could provide an alternate name through
	the "filename" field for the metalink xml file.  Respectively, the cli
	options --metalink-over-http and --content-disposition are required.

	When Metalink/XML auto-processing, to use the Content-Disposition's
	filename, the cli option --trust-server-names is also required.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Set NULL variable due to --content-disposition to Metalink origin
	* src/http.c (http_loop): Prevent SIGSEGV when hstat.local_file is
	  NULL, opt.content_disposition has a role in leaving the value unset
	* src/http.c (gethttp): If hs->local_file is NULL (aka http_loop()'s
	  hstat.local_file), set it to the value of hs->metalink->origin

	New: --trust-server-names saves Metalink/HTTP xml files using the "name" field
	* src/metalink.c (retrieve_from_metalink): If opt.trustservernames is
	  true, use the basename of the metaurl's name to save the xml file
	* doc/metalink-standard.txt: Update doc. With --trust-server-names any
	  Metalink/HTTP Link application/metalink4+xml file is saved using the
	  basename of the "name" field, if any. Update Metalink/HTTP examples
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-http-xml-trust-name.py: New file. Metalink/HTTP
	  automated Metalink/XML, save xml files using the "name" field tests

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Detect when a metalink:file doesn't have any hash
	* src/metalink.c (retrieve_from_metalink): Reject any metalink:file
	  without hashes. Prompt the error and switch to the next file
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-xml-nohash.py: New file. Metalink/XML with no
	  hashes tests

	Prevent SIGSEGV.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Detect malformed base64 Metalink/HTTP Digest header
	* src/http.c (metalink_from_http): Fix hash_bin_len type. Use ssize_t
	  instead than size_t. Reject -1 as base64_decode() return value
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-http-baddigest.py: New file. Metalink/HTTP
	  malformed base64 Digest header tests

	On malformed base64 input, ssize_t base64_decode() returns -1. Such
	value is too big for a size_t variable, and used as xmalloc() value
	will exaust all the memory.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New option --metalink-index to process Metalink application/metalink4+xml
	* NEWS: Mention the effect of --metalink-index over Metalink
	* src/init.c: Add new option metalinkindex (opt.metalink_index),
	  initialize to -1
	* src/main.c: Add new option metalink-index (--metalink-index=NUMBER)
	* src/options.h: Add new option metalink_index (int)
	* src/metalink.h: Add declaration of functions fetch_metalink_file(),
	  replace_metalink_basename()
	* src/metalink.c: Add functions fetch_metalink_file() simple file
	  fetch, replace_metalink_basename() replace file basename
	* src/metalink.c (retrieve_from_metalink): New. Process Metalink
	  application/metalink4+xml of opt.metalink_index ordinal number
	* doc/wget.texi: Add new option metalink-index (--metalink-index)
	  documentation
	* doc/metalink-standard.txt: Updated doc. Add documentation about
	  Metalink application/metalink4+xml metaurls download naming system
	* doc/metalink-standard.txt: Update Metalink/XML and HTTP examples
	* testenv/Makefile.am: Add new files
	* testenv/Test-metalink-http-xml.py: New file. Metalink/HTTP automated
	  Metalink/XML "application/metalink4+xml" --metalink-index tests
	* testenv/Test-metalink-http-xml-trust.py: New file. Metalink/HTTP
	  automated Metalink/XML "application/metalink4+xml" --metalink-index
	  retrieval with --trust-server-names tests

	WARNING: Do not use lib/dirname.c (dir_name) to get the directory
	name, it may append a dot '.' character to the directory name.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Prevent sorting when there are less than two elements
	* src/utils.c (stable_sort): Add condition nmemb > 1, sort only when
	  there is more than one element

	Prevent SIGSEGV.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New: Parse Metalink/HTTP header for application/metalink4+xml
	* src/http.c (metalink_from_http): Parse Metalink/HTTP header for
	  metaurls application/metalink4+xml media types
	* src/metalink.h: Add function declaration metalink_meta_cmp()
	* src/metalink.c: Add function metalink_meta_cmp() compare metalink
	  metaurls priorities

	Add Metalink/HTTP application/metalink4+xml media types as metaurls to
	the metalink variable that will be used to download the files.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New test: Metalink shall not concatenate '/' to an empty directory prefix
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-xml-emptyprefix-trust.py: New file.
	  Metalink/XML empty directory prefix (--directory-prefix '') tests

	Detect a '/' character wrongfully concatenated to an empty directory
	prefix '' (not NULL), resulting in an absolute path as '/dir/file',
	instead than 'dir/file'.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Remove surrounding quotes from Metalink/HTTP key's value
	* src/metalink.h: Add declaration of function dequote_metalink_string()
	* src/metalink.c: Add function dequote_metalink_string() remove
	  surrounding quotes from string, \' or \"
	* src/metalink.c (find_key_value, find_key_values): Call dequote_metalink_string()
	  to remove the surrounding quotes from the parsed value
	* src/metalink.c (test_find_key_value, test_find_key_values): Add
	  quoted key's values for unit-tests
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-http-quoted.py: New file. Metalink/HTTP quoted
	  values tests

	Some Metalink/HTTP keys, like "type" [2], may have a quoted value [1]:
	Link: <http://example.com/example.ext.meta4>; rel=describedby;
	type="application/metalink4+xml"

	Wget was expecting a dequoted value from the Metalink module. This
	patch addresses this problem.

	References:
	 [1] Metalink/HTTP: Mirrors and Hashes
	     1.1. Example Metalink Server Response
	     https://tools.ietf.org/html/rfc6249#section-1.1

	 [2] Additional Link Relations
	     6. "type"
	     https://tools.ietf.org/html/rfc6903#section-6

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Process Metalink/XML url strings containing white spaces and CRLF
	* src/metalink.h: Add declaration of function clean_metalink_string()
	* src/metalink.c: Add directive #include "xmemdup0.h"
	* src/metalink.c: Add function clean_metalink_string() remove leading
	  and trailing white spaces and CRLF from string
	* src/metalink.c (retrieve_from_metalink): Remove leading and trailing
	  white spaces and CRLF from url resource mres->url
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-xml-urlbreak.py: New test. Metalink/XML white
	  spaces and CRLF in url resources tests

	White spaces and CRLF are not automatically removed by libmetalink
	from url strings. The Wget's Metalink module was unable to process
	such url strings. This patch implements the processing of such url
	strings cleaning off leading and trailing white spaces and CRLF.

	If a parsed Metalink/XML url string contains strings separated by
	CRLF, only the first of the series is accepted.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New test: Detect when there are no good Metalink url resources
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-xml-nourls.py: New file. Metalink/XML unknown
	  urls tests

	Test if when there are no good Metalink url resources there is any
	segmentation fault.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New: Metalink file size mismatch returns error code METALINK_SIZE_ERROR
	* src/wget.h (uerr_t): Add error code METALINK_SIZE_ERROR to enum
	* src/metalink.c (retrieve_from_metalink): Use boolean variable
	  size_ok, when false set retr_err to METALINK_SIZE_ERROR
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-xml-size.py: New file. Metalink/XML file size
	  tests (<size></size>)

	Before this patch, no appropriate error code was returned to inform a
	file size mismatch.

	This patch introduces the error code METALINK_SIZE_ERROR to inform a
	file size mismatch.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New: Metalink/XML and Metalink/HTTP file naming safety rules
	* NEWS: Mention the effect of --trust-server-names over Metalink
	* src/metalink.h: Add declaration of function append_suffix_number()
	* src/metalink.c: Add function append_suffix_number() append number to
	  string
	* src/metalink.c (retrieve_from_metalink): Safer Metalink/XML and
	  Metalink/HTTP download naming system, opt.trustservernames based
	* doc/metalink-standard.txt: Update doc. Explain new Metalink/XML and
	  Metalin/HTTP download naming system and --trust-server-names role
	* testenv/Makefile.am: Add new files
	* testenv/Test-metalink-xml-continue.py: Update test. Metalink/XML
	  continue/keep existing files (HTTP 416) with --continue tests
	* testenv/Test-metalink-xml.py: Update test. Metalink/XML naming tests
	* testenv/Test-metalink-xml-trust.py: New file. Metalink/XML naming
	  tests with --trust-server-names
	* testenv/Test-metalink-xml-abspath.py: Update test. Metalink/XML
	  absolute path tests
	* testenv/Test-metalink-xml-abspath-trust.py: New file. Metalink/XML
	  absolute path tests with --trust-server-names
	* testenv/Test-metalink-xml-relpath.py: Update test. Metalink/XML
	  relative path tests
	* testenv/Test-metalink-xml-relpath-trust.py: New file. Metalink/XML
	  relative path tests with --trust-server-names
	* testenv/Test-metalink-xml-homepath.py: Update test. Metalink/XML
	  home path and ~ (tilde) tests
	* testenv/Test-metalink-xml-homepath-trust.py: New file. Metalink/XML
	  home path and ~ (tilde) tests with --trust-server-names
	* testenv/Test-metalink-xml-prefix.py: New file. Metalink/XML naming
	  tests with --directory-prefix
	* testenv/Test-metalink-xml-prefix-trust.py: New file. Metalink/XML
	  naming tests with --directory-prefix and --trust-server-names
	* testenv/Test-metalink-xml-absprefix.py: New file. Metalink/XML
	  absolute --directory-prefix tests
	* testenv/Test-metalink-xml-absprefix-trust.py: New file. Metalink/XML
	  absolute --directory-prefix tests with --trust-server-names
	* testenv/Test-metalink-xml-relprefix.py: New file. Metalink/XML
	  relative --directory-prefix tests
	* testenv/Test-metalink-xml-relprefix-trust.py: New file. Metalink/XML
	  relative --directory-prefix tests with --trust-server-names
	* testenv/Test-metalink-xml-homeprefix.py: New file. Metalink/XML home
	  --directory-prefix tests
	* testenv/Test-metalink-xml-homeprefix-trust.py: New file. Metalink/XML
	  home --directory-prefix tests with --trust-server-names

	The option --trust-server-names allows to use the file names parsed
	from a Metalink/XML file.  Without --trust-server-names, the safety
	mechanism provides secure and predictable file names.

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	New document: Metalink/XML and Metalink/HTTP standard reference
	* doc/metalink-standard.txt: New doc. Implemented and recommended
	  Metalink/XML and Metalink/HTTP standard features

2016-09-30  Matthew White  <mehw.is.me@inventati.org>

	Enforce Metalink file name verification, strip directory if necessary
	* NEWS: Mention the use of a safe Metalink destination path
	* src/metalink.h: Add declaration of functions get_metalink_basename(),
	  last_component(), metalink_check_safe_path()
	* src/metalink.c: Add directive #include "dosname.h"
	* src/metalink.c: Add function get_metalink_basename() to return the
	  basename of a file name, strip w32's drive letter prefixes
	* src/metalink.c (retrieve_from_metalink): Enforce Metalink file name
	  verification, if the file name is unsafe try its basename
	* doc/metalink.txt: Update document. Explain --directory-prefix

	The function get_metalink_basename() uses FILE_SYSTEM_PREFIX_LEN to
	catch any 'C:D:file' (w32 environment), then it removes each drive
	letter prefix, i.e. 'C:' and 'D:'.

	Unsafe file names contain an absolute, relative, or home path.  Safe
	paths can be verified by libmetalink's metalink_check_safe_path().

2016-09-27  Matthew White  <mehw.is.me@inventati.org>

	Implement Metalink/XML --directory-prefix option in Metalink module
	* NEWS: Mention the effect of --directory-prefix over Metalink
	* src/metalink.c (retrieve_from_metalink): Add opt.dir_prefix as
	  prefix to the metalink:file name mfile->name
	* doc/metalink.txt: Update document. Explain --directory-prefix

	When --directory-prefix=<prefix> is used, set the top of the retrieval
	tree to prefix. The default is . (the current directory). Metalink/XML
	and Metalink/HTTP files will be downloaded under prefix.

2016-09-27  Matthew White  <mehw.is.me@inventati.org>

	Change mfile->name to filename in Metalink module's messages
	* src/metalink.c (retrieve_from_metalink): Change mfile->name to
	  filename when referring to the downloaded file

	The file name could have been changed by unique_create() (or by any
	other mean) before downloading. Use the name of the downloaded file
	(filename) when printing output which refer to it.

2016-09-27  Matthew White  <mehw.is.me@inventati.org>

	Add file size computation in Metalink module
	* NEWS: Mention Metalink's file size verification
	* src/metalink.c (retrieve_from_metalink): Add file size computation
	* doc/metalink.txt: Update document. Remove resolved bugs

	Reject downloaded files when they do not agree with their Metalink/XML
	metalink:size: https://tools.ietf.org/html/rfc5854#section-4.2.14

	At the moment of writing, Metalink/HTTP headers do not provide a file
	size field. This information could be obtained from the Content-Length
	header field: https://tools.ietf.org/html/rfc6249#section-7

2016-09-27  Matthew White  <mehw.is.me@inventati.org>

	Update Metalink/XML tests and add a new test for home paths
	* testenv/Test-metalink-xml-relpath.py: Update test
	* testenv/Test-metalink-xml-homepath.py: New file. Reject home paths
	* testenv/Makefile.am: Add new file

	When --input-metalink=<file> is used, each metalink:file name is
	verified by libmetalink's metalink_check_safe_path(). By design,
	absolute, relative and home paths are rejected.

	At the moment of writing, when --metalink-over-http is used, absolute,
	relative, and home paths aren't a concern. The destination file name
	is a combination of URL's file name and cli's "Directory Options"
	handled by src/url.c (url_file_name).

2016-09-27  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Keep the download progress when alternating metalink:url
	* NEWS: Mention the effects of --continue over Metalink
	* src/metalink.c (retrieve_from_metalink): On download error, resume
	  output_stream with the next mres->url. Keep fully downloaded files
	  started with --continue, otherwise rename/remove the file
	* testenv/Makefile.am: Add new file
	* testenv/Test-metalink-xml-continue.py: New file. Metalink/XML
	  continue/keep existing files (HTTP 416) with --continue tests

	Before this patch, with --continue, existing and/or fully retrieved
	files which fail the sanity tests were renamed (--keep-badhash), or
	removed.

	This patch ensures that --continue doesn't rename/remove existing
	and/or fully retrieved files (HTTP 416) which fail the sanity tests.

2016-09-27  Matthew White  <mehw.is.me@inventati.org>

	Bugfix: Fix NULL filename and output_stream in Metalink module
	* NEWS: Mention the Metalink "path/file" name format handling
	* src/metalink.c (retrieve_from_metalink): Fix NULL filename, set
	  filename to the right "path/file" value
	* src/metalink.c (retrieve_from_metalink): Fix NULL output_stream, set
	  output_stream to filename when it is created by retrieve_url()
	* src/metalink.c (retrieve_from_metalink): Add RFC5854 comments about
	  proper metalink:file "path/file" name format handling
	* doc/metalink.txt: Update document. Remove resolved bugs

	If unique_create() cannot create/open the destination file, filename
	and output_stream remain NULL. If fopen() is used instead, filename
	always remains NULL. Both functions cannot create "path/file" trees.

	Setting filename to the right value is sufficient to prevent SIGSEGV
	generating from testing a NULL value. This also allows retrieve_url()
	to create a "path/file" tree through opt.output_document.

	Reading NULL as output_stream, when it shall not be, leads to wrong
	results. For instance, a non-NULL output_stream tells when a stream
	was interrupted, reading NULL instead means to assume the contrary.

	This patch conforms to the RFC5854 specification:
	  The Metalink Download Description Format
	  4.1.2.1.  The "name" Attribute
	  https://tools.ietf.org/html/rfc5854#section-4.1.2.1

2016-09-19  Matthew White  <mehw.is.me@inventati.org>

	Add metalink description
	* doc/metalink.txt

	Evaluation of "Directory Options" on the command line interacting with
	the option '--input-metalink=file':

	$ wget --input-metalink=file <directory options>

2016-09-19  Matthew White  <mehw.is.me@inventati.org>

	Use python .replace instead than re.sub in Metalink tests
	* testenv/Test-metalink-http.py: Use python .replace
	* testenv/Test-metalink-xml.py: Use python .replace
	* testenv/Test-metalink-xml-abspath.py: Use python .replace
	* testenv/Test-metalink-xml-relpath.py: Use python .replace

	Use python .replace instead than re.sub, remove 'import re'.

2016-09-19  Matthew White  <mehw.is.me@inventati.org>

	Fix: Change Metalink/XML v3 file name into test.metalink
	* testenv/Test-metalink-xml-abspath.py: Change Metalink/XML v3 file
	  name from test.meta4 into test.metalink
	* testenv/Test-metalink-xml-relpath.py: Change Metalink/XML v3 file
	  name from test.meta4 into test.metalink
	* testenv/Test-metalink-xml.py: Change Metalink/XML v3 file name from
	  test.meta4 into test.metalink

2016-09-13  Tim Rühsen  <tim.ruehsen@gmx.de>

	Add two Metalink/XML tests
	* testenv/Test-metalink-xml-abspath.py: Reject absolute paths
	* testenv/Test-metalink-xml-relpath.py: Reject relative paths
	* testenv/Makefile.am: Add both new files to metalink tests

2016-09-09  Tim Rühsen  <tim.ruehsen@gmx.de>

	Fix crash on 'srcset' inline URIs
	* src/html-url.c (tag_handle_img): Check append_url() for NULL
	  return value before dereference.

	Crashed reproducable with parsing srcset="data:..." inline data.
	Reported-by: Coverity

2016-09-09  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/hsts.c (hsts_store_open): NULL check param for fclose().
	Reported-by: Coverity

	* src/ftp-ls.c (ftp_parse_winnt_ls): Fix memset params

	* src/utils.c (stable_sort): Use xmalloc instead of malloc

2016-09-08  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/ftp-ls.c (ftp_parse_winnt_ls): Initialize struct fileinfo cur
	Reported-by: Coverity

	Add const to url param of some functions
	* src/http.c: Add const to first param of initialize_request(),
	  initialize_proxy_configuration(), establish_connection(),
	  check_file_output(), check_auth(), gethttp(), http_loop().
	* src/http.h: Add const to first param of http_loop().

	* Makefile.am: Remove trailing empty line

	* src/recur.c (retrieve_tree): Fix possible NULL dereference
	Reported-by: Coverity

	* src/http.c (initialize_request): Fix check for user
	Reported-by: Coverity

	* src/retr.c (retrieve_url): NULL check mynewloc
	Reported-by: Coverity

	* src/utils.c (stable_sort): Reduce tmp allocation size
	Reported-by: Coverity

	* Makefile.am: Add target 'check-valgrind'

	Fix some issues detected by Coverity
	* src/connect.c (connect_to_ip): Check return value of setsockopt.
	* src/ftp.c (ftp_retrieve_list): Check return value of chmod.
	* src/http.c (digest_authentication_encode): Cleanup code.
	* src/init.c (setval_internal): Explicitely check comind range.
	* src/main.c (main): Explicitely check optarg.
	* src/retr.c (retr_rate): Use snprintf instead sprintf,
	  (retrieve_from_file): More verbose error message,
	  (rotate_backups): Use snprintf instead sprintf, check return
	  value of rename().
	* src/url.c (mkalldirs): Check return value of unlink().
	* src/utils.c (strdupdelim): Explicitely check beg and end for NULL,
	  (merge_vecs): Fix sizeof argument to char *,
	  (stable_sort): Use malloc instead of alloca.

	Code cleanup for --use-askpass
	* bootstrap.conf: Add xmemdup0 and strpbrk.
	* src/init.c (cmd_use_askpass): Add 'const' to char *,
	  remove check for file existence.
	* src/main.c (run_use_askpass): C89 compat init of argv,
	  added \n to error messages,
	  fixed stripping of \n and \r from input,
	  make run_use_askpass and use_askpass static.

2016-09-07  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/http.c (check_file_output): Replace asprintf by aprint

2016-09-04  Tim Rühsen  <tim.ruehsen@gmx.de>

	* testenv/README: Remove obsolete references to TEST_NAME

2016-09-03  Liam R. Howlett  <Liam.Howlett@WindRiver.com>

	Add --use-askpass=COMMAND support
	* doc/wget.texi: Add --use-askpass to documentation.
	* src/init.c: Add cmd_use_askpasss to set opt.use_askpass based on
	argument, WGET_ASKPASS, and SSH_ASKPASS environment variables.
	opt.wget-askpass is freed in cleanup ()
	* src/main.c: Update options & add spawn process of opt.use_askpass
	command.
	* src/options.h: Addition of string use_askpass.
	* src/url.c: Function scheme_leading_string to access the leading
	string of a parsed url.
	* src/url.h: Prototype for scheme_leading_string for returning the
	leading string.
	* bootstrap.conf: Add posix_spawn to gnulib_modules

	This adds the --use-askpass option which is disabled by default.

	--use-askpass=COMMAND will request the username and password for a given
	URL by executing the external program COMMAND.  If COMMAND is left
	blank, then the external program in the environment variable
	WGET_ASKPASS will be used.  If WGET_ASKPASS is not set then the
	environment variable SSH_ASKPASS is used.  If there is no value set, an
	error is returned.  If an error occurs requesting the username or
	password, wget will exit.

2016-09-02  Dale R. Worley  <worley@ariadne.com>

	Add tests for recursion and redirection.
	    * testenv/Test-recursive-basic.py: New file. Test basic recursion
	    * testenv/Test-recursive-include.py: New File. Recursion test with
	    include directories
	    * testenv/Test-redirect.py: New File. Basic redirection tests
	    * testenv/Makefile.am: Add new tests to makefile

	Sort test names into order.
	    * testenv/Makefile.am: Sort all the python tests in alphabetical
	    order

	Corrections and amplifications to test documentation
	    * testenv/README: Update documentation to meet current project
	    status
	    * testenv/Test-Proto.py: Same

2016-08-24  Giuseppe Scrivano  <gscrivan@redhat.com>

	Append .tmp to temporary files
	* src/http.c (struct http_stat): Add `temporary` flag.
	(check_file_output): Append .tmp to temporary files.
	(open_output_stream): Refactor condition to use hs->temporary instead.

	Reported-by: "Misra, Deapesh" <dmisra@verisign.com>
	Discovered by: Dawid Golunski (http://legalhackers.com)

2016-08-24  Tim Rühsen  <tim.ruehsen@gmx.de>

	Limit file mode to u=rw on temp. downloaded files
	* bootstrap.conf: Add gnulib modules fopen, open.
	* src/http.c (open_output_stream): Limit file mode to u=rw
	on temporary downloaded files.

	Reported-by: "Misra, Deapesh" <dmisra@verisign.com>
	Discovered by: Dawid Golunski (http://legalhackers.com)

2016-08-21  Giuseppe Scrivano  <gscrivan@redhat.com>

	Fix some make syntax-check issues
	cfg.mk: Skip .der files.
	testenv/certs/server-template.cfg: Remove empty final line.
	testenv/certs/ca-template.cfg: Likewise.

2016-08-17  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/css-url.c (get_urls_css): Fix memory leak

	* src/html-url.c (get_urls_html): Fix memory leak

2016-08-17  Tim Rühsen  <tim.ruehsen@gmx.de>

	Improve PSL cookie checking
	* configure.ac: Add --with-psl-file to set a PSL file
	* src/cookies.c (check_domain_match): Load PSL_FILE with
	  fallback to built-in data.

	This change allows package maintainers to make Wget use the latest
	PSL (DAFSA or plain text), without updating libpsl itself.

	E.g. Debian now comes with a DAFSA binary within the 'publicsuffix'
	package which allows very fast loading (no parsing or processing needed).

2016-08-10  Tobias Stoeckmann  <tobias@stoeckmann.org>

	Fix stack overflow with way too many cookies
	* src/cookies.c (cookie_header): Use heap instead of stack.
	* src/http.c (request_send): Likewise.

	If wget has to handle an insanely large amount of cookies (~700,000 on
	32 bit systems or ~530,000 on 64 bit systems), the stack is not large
	enough to hold these pointers, leading to undefined behaviour according
	to POSIX; expect a segmentation fault in real life. ;)

2016-08-09  Tobias Stoeckmann  <tobias@stoeckmann.org>

	Fix signal race condition
	The signal handler for SIGALRM calls longjmp, but the handler is
	installed before the jump target has been initialized. If another
	process sends SIGALRM right between handler installation and target
	initialization, the jump leads to undefined behavior.

	This can easily be fixed by moving the signal handler installation
	into the "SETJMP == 0" conditional block, which means that the target
	has just been initialized.

	* src/utils.c: call signal after SETJMP.

2016-08-05  Jeffery To  <jeffery.to@gmail.com>

	Remove hyphens from command names
	* src/init.c: Remove hyphens from command names
	* src/main.c: Likewise

	Options with hyphens (or underscores) in their command name cannot be
	set in a wgetrc file.

2016-08-04  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/metalink.c (badhash_suffix): Fix quoting

2016-08-04  Matthew White  <mehw.is.me@inventati.org>

	Add new option --keep-badhash to keep Metalink's files with a bad hash
	* src/init.c: Add keepbadhash
	* src/main.c: Add keep-badhash
	* src/options.h: Add keep_badhash
	* doc/wget.texi: Add docs for --keep-badhash
	* src/metalink.h: Add prototypes badhash_suffix(), badhash_or_remove()
	* src/metalink.c: New functions badhash_suffix(), badhash_or_remove().
	  (retrieve_from_metalink): Call badhash_or_remove() on download error

	With --keep-badhash, append .badhash to Metalink's files with checksum
	mismatch. (retrieve_from_metalink): unique_create() may append another
	suffix to avoid overwriting existing files.

	Without --keep-badhash, remove downloaded files with checksum mismatch
	(this conforms to the old behaviour).

2016-08-03  Tim Rühsen  <tim.ruehsen@gmx.de>

	* src/metalink.c: Remove C++ style comments

2016-08-03  Matthew White  <mehw.is.me@inventati.org>

	Add gnulib modules 'link', 'unlink' and 'symlink'
	* bootstrap.conf: Add 'link', 'unlink' and 'symlink'

2016-08-03  Matthew White  <mehw.is.me@inventati.org>

	New: --continue continues partially downloaded Metalink's files
	* src/metalink.c (retrieve_from_metalink): Continue file download if
	  opt.always_rest is true

	Without --continue, download as a new file with an unique name (this
	conforms to the old behaviour).

2016-08-03  Matthew White  <mehw.is.me@inventati.org>

	Add support for Metalink's md2, and md4 hashes
	* bootstrap.conf: Add crypto/md2, and crypto/md4
	* src/metalink.c (retrieve_from_metalink): Add md2, and md4 support

	This patch adds support for the deprecated (insecure) md2, and md4
	Message-Digest algorithms to the Metalink module.

2016-08-03  Matthew White  <mehw.is.me@inventati.org>

	Add support for Metalink's md5, sha1, sha224, sha384, and sha512 hashes
	* bootstrap.conf: Add crypto/sha512
	* src/metalink.c (retrieve_from_metalink): Add md5, sha1, sha224,
	  sha384, and sha512 support

	Metalink's checksum verification was limited to sha256. This patch
	adds support for md5, sha1, sha224, sha384, and sha512.

2016-07-27  Sean Burford  <sburford@google.com>

	Style fixes and DEBUG on setxattr failure.
	* src/ftp.c: Fix style.
	* src/http.c: Likewise.
	* src/xattr.h: Likewise.
	* src/xattr.c: Likewise,
	  (write_xattr_metadata): Print debug msg on error.

2016-07-22  Sean Burford  <sburford@google.com>

	Keep fetched URLs in POSIX extended attributes
	* configure.ac: Check for xattr availability
	* src/Makefile.am: Add xattr.c
	* src/ftp.c: Include xattr.h.
	  (getftp): Set attributes if enabled.
