mingw-w64-curl: update to 8.20.0

Drop the 70bb0db76720c152f6a55bbe12cf162b55cb105b.patch backport
(curl/curl@70bb0db):
the schannel renegotiation timeout fix it carried is now part of
curl 8.20.0 itself, so the backport is no longer needed.

Re-export the remaining four patches against curl-8.20.0 with stable
commit OIDs while we are touching the series. Per AGENTS.md, that is
done by importing the 8.19.0 and 8.20.0 tarballs into a throw-away
git repository via `contrib/fast-import/import-tars.perl`,
`git am`-ing the patches, running

    git rebase --empty=drop --onto curl-8.20.0 curl-8.19.0

(which drops the schannel-timeout commit automatically once its diff
turns empty against 8.20.0), forcing committer = author with

    git fast-export --no-data refs/tags/curl-8.20.0 HEAD |
      awk '/^author /{a=$0} /^committer /{$0="committer " substr(a,8)} 1' |
      git fast-import --force --quiet

and finally `git format-patch --no-signature curl-8.20.0..HEAD` back
into the package directory.

The single manual conflict, in `lib/curl_config.h.in`, is resolved by
placing `CURL_BINDIR` before `CURL_CA_BUNDLE` instead of after
`CURL_CA_SEARCH_SAFE`: the file is otherwise alphabetical, and
upstream's recently-added `CURL_DEBUG_GLOBAL_MEM` was placed in
alphabetical order, so anchoring our addition the same way avoids
re-encountering the conflict on future curl bumps.

Assisted-by: Claude Opus 4.7 (1M context)(Internal only)
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

mingw-w64-curl/0001-Make-cURL-relocatable.patch

@@ -1,4 +1,4 @@
-From b0761795838b6645cf1bc7d0c290decc1f57b4ca Mon Sep 17 00:00:00 2001
+From ca0338db9469d32ff4d522e5cb7779888c46d83f Mon Sep 17 00:00:00 2001
 From: Ray Donnelly <mingw.android@gmail.com>
 Date: Wed, 22 Feb 2017 11:03:04 +0100
 Subject: [PATCH 1/4] Make cURL relocatable
@@ -29,10 +29,10 @@ Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  4 files changed, 55 insertions(+)
 
 diff --git a/configure.ac b/configure.ac
-index 6d2cb5583b..cefba6bb1b 100644
+index d06024b..ea85a68 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -4035,6 +4035,8 @@ dnl default includes
+@@ -3977,6 +3977,8 @@ AC_CHECK_HEADERS(
  ]
  )
 
@@ -42,7 +42,7 @@ index 6d2cb5583b..cefba6bb1b 100644
  AC_C_CONST
  AC_TYPE_SIZE_T
 diff --git a/lib/Makefile.inc b/lib/Makefile.inc
-index 84b4e5425b..8c9010e51a 100644
+index d762f72..2203577 100644
 --- a/lib/Makefile.inc
 +++ b/lib/Makefile.inc
 @@ -233,6 +233,7 @@ LIB_CFILES =         \
@@ -53,7 +53,7 @@ index 84b4e5425b..8c9010e51a 100644
    pingpong.c         \
    pop3.c             \
    progress.c         \
-@@ -359,6 +360,7 @@ LIB_HFILES =         \
+@@ -364,6 +365,7 @@ LIB_HFILES =         \
    netrc.h            \
    noproxy.h          \
    parsedate.h        \
@@ -62,24 +62,24 @@ index 84b4e5425b..8c9010e51a 100644
    pop3.h             \
    progress.h         \
 diff --git a/lib/curl_config.h.in b/lib/curl_config.h.in
-index 7108da0790..9dbbfb3666 100644
+index ec9b71f..ac0bc93 100644
 --- a/lib/curl_config.h.in
 +++ b/lib/curl_config.h.in
-@@ -17,6 +17,9 @@
- /* If safe CA bundle search is enabled */
- #undef CURL_CA_SEARCH_SAFE
+@@ -2,6 +2,9 @@
+ 
+ /* !checksrc! disable COPYRIGHT all */
 
 +/* Location of executable */
 +#undef CURL_BINDIR
 +
- /* Default SSL backend */
- #undef CURL_DEFAULT_SSL_BACKEND
+ /* Location of default ca bundle */
+ #undef CURL_CA_BUNDLE
 
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index f7201d18d6..b4a0547a8c 100644
+index 891facf..ba43dc5 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
-@@ -77,6 +77,9 @@
+@@ -78,6 +78,9 @@
  #include <Security/Security.h>
  #endif
 
@@ -89,7 +89,7 @@ index f7201d18d6..b4a0547a8c 100644
 
  #define CLONE_STRING(var)                    \
    do {                                       \
-@@ -297,6 +300,15 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+@@ -298,6 +301,15 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
  #if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
    struct UserDefined *set = &data->set;
    CURLcode result;
@@ -105,7 +105,7 @@ index f7201d18d6..b4a0547a8c 100644
  #endif
 
    if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
-@@ -305,15 +317,41 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+@@ -306,15 +318,41 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
        sslc->native_ca_store = TRUE;
  #endif
  #ifdef CURL_CA_PATH
@@ -147,7 +147,7 @@ index f7201d18d6..b4a0547a8c 100644
        if(result)
          return result;
      }
-@@ -352,16 +390,26 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+@@ -353,16 +391,26 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
  #endif
  #ifdef CURL_CA_PATH
      if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) {

mingw-w64-curl/0002-Hack-make-relocation-work-inside-libexec-git-core-an.patch

@@ -1,4 +1,4 @@
-From 0d1cc065356bcb23642563c3046b0b0e860fa9bb Mon Sep 17 00:00:00 2001
+From b44b86a3cce1b8a9395868cc107c27f6f8f3591d Mon Sep 17 00:00:00 2001
 From: Johannes Schindelin <johannes.schindelin@gmx.de>
 Date: Wed, 31 Oct 2018 10:52:59 +0100
 Subject: [PATCH 2/4] Hack: make relocation work inside libexec/git-core/ and
@@ -30,10 +30,10 @@ Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  1 file changed, 20 insertions(+), 1 deletion(-)
 
 diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index b4a0547a8c..ce4f4af5e7 100644
+index ba43dc5..8f1fbe5 100644
 --- a/lib/vtls/vtls.c
 +++ b/lib/vtls/vtls.c
-@@ -341,10 +341,29 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+@@ -342,10 +342,29 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
      get_dll_path(relocated_bundle, path_max);
      strip_n_suffix_folders(relocated_bundle, 1);
      strncat(relocated_bundle, "/", path_max - 1);

mingw-w64-curl/0003-auth-upgrade-SSPI-identity-to-SEC_WINNT_AUTH_IDENTIT.patch

@@ -1,4 +1,4 @@
-From 0aa2cd8539608511e34a58473f2974ae0ae50444 Mon Sep 17 00:00:00 2001
+From ba5dc04aa3908cf34c01f7112c59b3f7e077a97b Mon Sep 17 00:00:00 2001
 From: Matthew John Cheetham <mjcheetham@outlook.com>
 Date: Tue, 24 Mar 2026 11:53:02 +0000
 Subject: [PATCH 3/4] auth: upgrade SSPI identity to SEC_WINNT_AUTH_IDENTITY_EX
@@ -22,7 +22,7 @@ Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  5 files changed, 19 insertions(+), 17 deletions(-)
 
 diff --git a/lib/curl_sspi.c b/lib/curl_sspi.c
-index 1d4cf925d6..018bfff28e 100644
+index 3ea1762..4180643 100644
 --- a/lib/curl_sspi.c
 +++ b/lib/curl_sspi.c
 @@ -93,7 +93,7 @@ void Curl_sspi_global_cleanup(void)
@@ -51,9 +51,9 @@ index 1d4cf925d6..018bfff28e 100644
 +void Curl_sspi_free_identity(SEC_WINNT_AUTH_IDENTITY_EX *identity)
  {
    if(identity) {
-     Curl_safefree(identity->User);
+     curlx_safefree(identity->User);
 diff --git a/lib/curl_sspi.h b/lib/curl_sspi.h
-index 3779d51753..ea405f53a7 100644
+index 3779d51..ea405f5 100644
 --- a/lib/curl_sspi.h
 +++ b/lib/curl_sspi.h
 @@ -34,14 +34,14 @@ void Curl_sspi_global_cleanup(void);
@@ -75,7 +75,7 @@ index 3779d51753..ea405f53a7 100644
  /* Forward-declaration of global variables defined in curl_sspi.c */
  extern PSecurityFunctionTable Curl_pSecFn;
 diff --git a/lib/ldap.c b/lib/ldap.c
-index e223078b03..59369a556d 100644
+index 16c93ee..9346123 100644
 --- a/lib/ldap.c
 +++ b/lib/ldap.c
 @@ -157,7 +157,7 @@ static ULONG ldap_win_bind_auth(LDAP *server, const char *user,
@@ -88,7 +88,7 @@ index e223078b03..59369a556d 100644
 
    memset(&cred, 0, sizeof(cred));
 diff --git a/lib/vauth/digest_sspi.c b/lib/vauth/digest_sspi.c
-index f29e569cd1..5f4b5e2735 100644
+index f0b6780..b7703b8 100644
 --- a/lib/vauth/digest_sspi.c
 +++ b/lib/vauth/digest_sspi.c
 @@ -95,8 +95,8 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
@@ -123,10 +123,10 @@ index f29e569cd1..5f4b5e2735 100644
      SecBufferDesc resp_desc;
      unsigned long attrs;
 diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
-index 3e66c89cb5..10a02321e3 100644
+index 279da60..b8898f2 100644
 --- a/lib/vauth/vauth.h
 +++ b/lib/vauth/vauth.h
-@@ -170,8 +170,8 @@ struct ntlmdata {
+@@ -171,8 +171,8 @@ struct ntlmdata {
  #endif
    CredHandle *credentials;
    CtxtHandle *context;
@@ -137,7 +137,7 @@ index 3e66c89cb5..10a02321e3 100644
    size_t token_max;
    BYTE *output_token;
    BYTE *input_token;
-@@ -241,8 +241,8 @@ struct kerberos5data {
+@@ -242,8 +242,8 @@ struct kerberos5data {
    CredHandle *credentials;
    CtxtHandle *context;
    TCHAR *spn;
@@ -148,7 +148,7 @@ index 3e66c89cb5..10a02321e3 100644
    size_t token_max;
    BYTE *output_token;
  #else
-@@ -309,8 +309,8 @@ struct negotiatedata {
+@@ -310,8 +310,8 @@ struct negotiatedata {
    SECURITY_STATUS status;
    CredHandle *credentials;
    CtxtHandle *context;

mingw-w64-curl/0004-spnego-windows-disallow-NTLM-via-SPNEGO.patch

@@ -1,4 +1,4 @@
-From cab1cced8a4c48054183192a80d09112d788e868 Mon Sep 17 00:00:00 2001
+From ff7b85749240b289615394f83c7d91cfe129dece Mon Sep 17 00:00:00 2001
 From: Matthew John Cheetham <mjcheetham@outlook.com>
 Date: Mon, 23 Mar 2026 13:34:27 +0000
 Subject: [PATCH 4/4] spnego(windows): disallow NTLM via SPNEGO
@@ -37,7 +37,7 @@ Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  1 file changed, 27 insertions(+)
 
 diff --git a/lib/vauth/spnego_sspi.c b/lib/vauth/spnego_sspi.c
-index 1f73123a0d..57d7599361 100644
+index 1baf593..d5eccc0 100644
 --- a/lib/vauth/spnego_sspi.c
 +++ b/lib/vauth/spnego_sspi.c
 @@ -146,6 +146,33 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,

mingw-w64-curl/70bb0db76720c152f6a55bbe12cf162b55cb105b.patch

@@ -5,8 +5,8 @@ pkgbase=mingw-w64-${_realname}
 pkgname=("${MINGW_PACKAGE_PREFIX}-${_realname}"
          "${MINGW_PACKAGE_PREFIX}-${_realname}-gnutls"
          "${MINGW_PACKAGE_PREFIX}-${_realname}-winssl")
-pkgver=8.19.0
-pkgrel=3
+pkgver=8.20.0
+pkgrel=1
 pkgdesc="Command line tool and library for transferring data with URLs (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
@@ -37,17 +37,15 @@ source=("https://github.com/curl/curl/releases/download/${_realname}-${pkgver//.
         "0001-Make-cURL-relocatable.patch"
         "0002-Hack-make-relocation-work-inside-libexec-git-core-an.patch"
         "0003-auth-upgrade-SSPI-identity-to-SEC_WINNT_AUTH_IDENTIT.patch"
-        "0004-spnego-windows-disallow-NTLM-via-SPNEGO.patch"
-        "70bb0db76720c152f6a55bbe12cf162b55cb105b.patch")
-sha256sums=('eba3230c1b659211a7afa0fbf475978cbf99c412e4d72d9aa92d020c460742d4'
+        "0004-spnego-windows-disallow-NTLM-via-SPNEGO.patch")
+sha256sums=('4be48e69cf467246cb97d369b85d78a08528f2b37cffef2418ee16e6a4eb596e'
             'SKIP'
             '08209cbf1633fa92eae7e5d28f95f8df9d6184cc20fa878c99aec4709bb257fd'
             '965d3921ec4fdeec94a2718bc2c85ce5e1a00ea0e499330a554074a7ae15dfc6'
-            '8567c3601664836e12e142f4c51c4f023aaa3477e9985ea4168301af22a1141f'
-            'b9a7ca284f881c2e5e15daf109d8c42d7e92ef32949031b3da42ef9b7bf924bd'
-            'e834995b7adcb573c8441ea17a54e71a359c4ec5049d31093ff25f898a48abf9'
-            'f597923ca8ec8757bc7600a420cc5f6f5acd6ab85e005054273bc63805af6d48'
-            'ffaadb16a5f1aaa4e0a33473b905a6650e6291afecb39f56805eaffc26a20932')
+            'b2edcb0ea116ab7ebb77a3a390823e2ff7b1dce0af8cd92cd36efca7814dfc2e'
+            '0bd487dd2e835caac6bd2f3aaef98423712c20e5c0c3330501d048681f0b950a'
+            'e1afa8b88959782c562fa3ca635d4ebe2bc84c0c490da82caffedb876b743be9'
+            '17fbbee114c957e976a2e2100cd250820b645ecdcea00f27c1083dd5d97c96ee')
 validpgpkeys=('27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2')  # Daniel Stenberg
 
 if test -z "$WITHOUT_ALTERNATES"
@@ -99,8 +97,7 @@ prepare() {
     0001-Make-cURL-relocatable.patch \
     0002-Hack-make-relocation-work-inside-libexec-git-core-an.patch \
     0003-auth-upgrade-SSPI-identity-to-SEC_WINNT_AUTH_IDENTIT.patch \
-    0004-spnego-windows-disallow-NTLM-via-SPNEGO.patch \
-    70bb0db76720c152f6a55bbe12cf162b55cb105b.patch
+    0004-spnego-windows-disallow-NTLM-via-SPNEGO.patch
 
   autoreconf -vfi
 }