[ Reason ]
Two changes:
1) The patch for CVE-2026-3784, added in 8.14.1-2+deb13u4, has a line
with trailing whitespace. This makes "make checksrc" fail, which in
turn makes the upstream-event-based-tests-* autopkgtests fail.
2) OpenSSL engine support is broken in trixie (#1137539): the engine is
loaded successfully but curl still bails out with "engine not found",
because the result code is never set to CURLE_OK on the success path.
Broken upstream since f2ce6c46 (predates 8.14.0), so this is a
regression from bookworm.
[ Impact ]
The curl autopkgtests keep failing in trixie, and users of OpenSSL
engines (pkcs11, HSMs, smartcards) have no way of using them.
[ Tests ]
The autopkgtests (which run upstream's test suite, including "make
checksrc") pass again with this upload.
The engine fix is an upstream commit, first released in curl 8.15.0,
and has been in unstable/testing since 8.15.0-1 (August 2025) with no
known fallout.
[ Risks ]
Low. The first change does not alter the resulting source at all apart
from dropping a trailing space, so the built binaries are unaffected.
The second change is 3 lines and only sets the return code on the
success path of engine loading. It can only affect users of OpenSSL
engines, for whom things are already broken today.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
* d/p/CVE-2026-3784.patch: Reworked the hunk so it no longer introduces
a line with trailing whitespace. Purely cosmetic, the patched source
is otherwise identical; this only unbreaks "make checksrc" and thus
the autopkgtests.
* d/p/openssl_fix_openssl_engines.patch: New patch cherry-picked from
upstream (17f2a220, curl/curl#17618), returning CURLE_OK when an
OpenSSL engine has been loaded successfully. Closes: #1137539.
[ Other info ]
More CVE fixes are coming in a future trixie upload, but I'm sending
this one now in case I don't get them ready in time for the next point
release, and so that the reporters of #1137539 can test the fix from
p-u in the meantime.