Agent-Sicherheit

Antwort zur Agent-Sicherheit

curl can fetch remote scripts, call APIs, and exfiltrate data from files an agent can read.

Credential-Zugriff

Reads netrc files, headers, cookies, tokens, and files used as request bodies.

Änderungen an Remote-Zustand

Can call arbitrary HTTP APIs that mutate remote systems.

Publish-/Artefakt-Risiko

Can upload artifacts or run installer pipelines when paired with a shell.

Empfohlene Kontrolle

Gate credentialed requests, file uploads, and pipe-to-shell installer patterns.

Hinweise für Agent-Nutzung

Allow simple public fetches; require approval for authenticated requests, uploads, and shell execution.

Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%

brew install curl

local Homebrew formula metadata

MacPortsverifiziert · 94%

sudo port install curl

MacPorts ports tree · net/curl/Portfile · Quelle: api.github.com

Linux

Alpine Linux apkverifiziert · 92%

sudo apk add curl

Alpine Linux edge package indexes · curl · Quelle: dl-cdn.alpinelinux.org

Debian aptverifiziert · 92%

sudo apt install curl

Debian stable package indexes · curl · Quelle: deb.debian.org

Fedora dnfverifiziert · 92%

sudo dnf install curl

Fedora Rawhide package metadata · curl · Quelle: dl.fedoraproject.org

Nixverifiziert · 92%

nix profile install nixpkgs#curl

nixpkgs package indexes · curl · Quelle: raw.githubusercontent.com

Arch Linux pacmanverifiziert · 92%

sudo pacman -S curl

Arch Linux sync databases · curl · Quelle: geo.mirror.pkgbuild.com

openSUSE zypperverifiziert · 92%

sudo zypper install curl

openSUSE Tumbleweed package metadata · curl · Quelle: download.opensuse.org

Windows

Chocolateyverifiziert · 92%

choco install curl

Chocolatey community package catalog · curl · Quelle: community.chocolatey.org

Scoopverifiziert · 92%

scoop install main/curl

Scoop official bucket manifest trees · bucket/curl.json · Quelle: api.github.com

Windows Package Managerverifiziert · 92%

winget install --id cURL.cURL -e

Windows Package Manager source index · cURL.cURL · Quelle: cdn.winget.microsoft.com

Überblick

Paketzusammenfassung

Get a file from an HTTP, HTTPS or FTP server

Projektlinks

Befehle und Aliase

curl
curl-config
wcurl

Verlauf

Projektgeschichte und Nutzung

curl is a command-line transfer tool and libcurl is its underlying URL transfer library. Together they became one of the default pieces of Internet plumbing in Unix-like systems, Windows, language runtimes, build systems, containers, and scripts.

Projektgeschichte

curl traces back to late 1996, when Daniel Stenberg extended Rafael Sagula's HttpGet utility while building an IRC bot feature for currency exchange lookups. The project moved from HttpGet to urlget as protocols beyond HTTP were added, then became curl in March 1998 after upload support made the older name misleading.

Adoptionsgeschichte

The project history records early Linux RPM packaging in 1998, the first Debian package in 1999, a non-beta libcurl interface in 2000, PHP adopting libcurl the same year, and Mac OS X bundling curl in 2001. By 2018, curl's history page described it as shipped in Windows 10 and estimated curl and libcurl at five billion installed instances; by 2020 that estimate reached ten billion instances.

Wie es verwendet wird

curl is used interactively and in scripts to transfer data over URL-addressed protocols, especially HTTP(S), FTP(S), SMTP, IMAP, SFTP, WebSocket, and related network protocols. libcurl is embedded by applications that need the same transfer features through a stable C API.

Warum Paket-Nerds sich dafür interessieren

curl matters to package managers because it is often both a package and a bootstrap tool: build scripts fetch with it, test suites depend on it, and other packages link against libcurl. Packaging has to track TLS backends, protocol feature flags, CA certificate behavior, ABI stability, and the split between the curl executable, libcurl, headers, and curl-config.

Zeitleiste

1996: HttpGet 0.1 released; Daniel Stenberg soon becomes maintainer.
1998: curl 4 released under the curl name.
1999: First Debian package recorded in upstream history.
2000: libcurl non-beta interface arrives and PHP adopts libcurl.
2001: curl bundled in Mac OS X 10.1.
2010: Project switches from CVS to git hosted by GitHub.
2018: Windows 10 starts shipping curl.
2020: Upstream estimates 10 billion curl and libcurl installations worldwide.
2024: wcurl adopted into the curl organization.

Related projects

libcurl, wcurl, trurl, HTTPie, Curlie, and cURLpp are adjacent projects in the curl ecosystem.

Quellen

Sicherheitslage

Risikostufe: blue

doc example: network transfer tool.

Risikoklassifikator

blue Risiko · hoch Konfidenz · tool

Warum

doc example: network transfer tool

Signale

override:curl

Installationsverhalten

In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
Installiert mit 8 Laufzeitabhängigkeiten.
Build-Metadaten listen 1 Build-Abhängigkeiten.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: ~/.curlrc

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix: ~/.netrc~/.curlrc

Executables

Installierte Executables

Befehl	Art	Sichtbarkeit
`curl`	cli	globales Executable
`curl-config`	cli	globales Executable
`wcurl`	cli	globales Executable

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-07-10

Manager-Version8.21.0

Manager aktualisiert2026-06-27

lokale DatenOK

Upstreamnot checked

neueste erkannte Versionnicht erkannt

https://curl.se

InfoRelease/tag comparison is only available for GitHub repositories.https://curl.senone Konfidenz

Installationsmetadaten

Paketmetadaten

Paketschlüssel	brew:curl
Version	8.21.0
Paketmanager	Homebrew
Paketmanager-Seite	https://formulae.brew.sh/formula/curl
Homepage	https://curl.se
Repository	https://github.com/curl/curl
Upstream-Dokumentation	https://curl.se/docs
Lizenz	curl
Quellarchiv	https://curl.se/download/curl-8.21.0.tar.bz2
Zuletzt aktualisiert	2026-06-27T15:50:29Z
Pulse	updated
Abhängigkeiten	brotli, libnghttp2, libnghttp3, libngtcp2, libpsl, libssh2, openssl@3, zstd
Build-Abhängigkeiten	pkgconf
Von macOS bereitgestellte Bibliotheken	krb5, openldap
Bottle	verfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	nicht definiert
Dienst	keiner deklariert

Registry-Fakten

Details aus der Quelldatenbank

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	curl
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	yes
URL Keys	head stable

Source-Datenbank-Treffer

Andere Paketmanager-Einträge

Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.

Debian apt95%

curl 8.14.1-2+deb13u3

command line tool for transferring data with URL syntax

curl mit Homebrew, apk, chocolatey, apt, dnf, MacPorts, Nix, pacman, zypper, scoop, winget installieren