# Install curl with Homebrew, apk, chocolatey, apt, dnf, MacPorts, Nix, pacman, scoop, winget, zypper Get a file from an HTTP, HTTPS or FTP server. Version 8.21.0 via Homebrew; verified 2026-06-27. ## Install ```sh sudo av install brew:curl ``` ## Agent safety answer curl can fetch remote scripts, call APIs, and exfiltrate data from files an agent can read. - **Credential access:** Reads netrc files, headers, cookies, tokens, and files used as request bodies. - **Remote mutation:** Can call arbitrary HTTP APIs that mutate remote systems. - **Publish/artifact risk:** Can upload artifacts or run installer pipelines when paired with a shell. - **Recommended control:** Gate credentialed requests, file uploads, and pipe-to-shell installer patterns. - **Agent-use guidance:** Allow simple public fetches; require approval for authenticated requests, uploads, and shell execution. Additional install commands: ### macOS - Homebrew (100%): ```sh brew install curl ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install curl ``` Evidence: MacPorts ports tree: net/curl/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add curl ``` Evidence: Alpine Linux edge package indexes: curl from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install curl ``` Evidence: Debian stable package indexes: curl from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install curl ``` Evidence: Fedora Rawhide package metadata: curl from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#curl ``` Evidence: nixpkgs package indexes: curl from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - pacman (92%): ```sh sudo pacman -S curl ``` Evidence: Arch Linux sync databases: curl from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz - zypper (92%): ```sh sudo zypper install curl ``` Evidence: openSUSE Tumbleweed package metadata: curl from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install curl ``` Evidence: Chocolatey community package catalog: curl from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','crystalreports2008runtime' - Scoop (92%): ```sh scoop install main/curl ``` Evidence: Scoop official bucket manifest trees: bucket/curl.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id cURL.cURL -e ``` Evidence: Windows Package Manager source index: cURL.cURL from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:curl - **Package manager:** Homebrew - **Package manager page:** - **Version:** 8.21.0 - **Source summary:** Get a file from an HTTP, HTTPS or FTP server - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** curl - **Source archive:** - **Last updated:** 2026-06-27T15:50:29Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - curl (cli) - curl-config (cli) - wcurl (cli) - curl (alias) - curl-config (alias) - wcurl (alias) ## Dependencies - brotli - libnghttp2 - libnghttp3 - libngtcp2 - libpsl - libssh2 - openssl@3 - zstd ## Build dependencies - pkgconf ## Uses from macOS - krb5 - openldap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 8.21.0 - Package-manager updated: 2026-06-27 - Local data: ok - Upstream repository: https://curl.se - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage curl is a command-line transfer tool and libcurl is its underlying URL transfer library. Together they became one of the default pieces of Internet plumbing in Unix-like systems, Windows, language runtimes, build systems, containers, and scripts. ### Project history curl traces back to late 1996, when Daniel Stenberg extended Rafael Sagula's HttpGet utility while building an IRC bot feature for currency exchange lookups. The project moved from HttpGet to urlget as protocols beyond HTTP were added, then became curl in March 1998 after upload support made the older name misleading. ### Adoption history The project history records early Linux RPM packaging in 1998, the first Debian package in 1999, a non-beta libcurl interface in 2000, PHP adopting libcurl the same year, and Mac OS X bundling curl in 2001. By 2018, curl's history page described it as shipped in Windows 10 and estimated curl and libcurl at five billion installed instances; by 2020 that estimate reached ten billion instances. ### How it is used curl is used interactively and in scripts to transfer data over URL-addressed protocols, especially HTTP(S), FTP(S), SMTP, IMAP, SFTP, WebSocket, and related network protocols. libcurl is embedded by applications that need the same transfer features through a stable C API. ### Why package nerds care curl matters to package managers because it is often both a package and a bootstrap tool: build scripts fetch with it, test suites depend on it, and other packages link against libcurl. Packaging has to track TLS backends, protocol feature flags, CA certificate behavior, ABI stability, and the split between the curl executable, libcurl, headers, and curl-config. ### Timeline - 1996: HttpGet 0.1 released; Daniel Stenberg soon becomes maintainer. - 1998: curl 4 released under the curl name. - 1999: First Debian package recorded in upstream history. - 2000: libcurl non-beta interface arrives and PHP adopts libcurl. - 2001: curl bundled in Mac OS X 10.1. - 2010: Project switches from CVS to git hosted by GitHub. - 2018: Windows 10 starts shipping curl. - 2020: Upstream estimates 10 billion curl and libcurl installations worldwide. - 2024: wcurl adopted into the curl organization. ### Related projects - libcurl, wcurl, trurl, HTTPie, Curlie, and cURLpp are adjacent projects in the curl ecosystem. ### Sources - - - - ## Security Notes doc example: network transfer tool. - **Geiger risk:** blue / high - doc example: network transfer tool ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.curlrc ## Credential files - Unix: ~/.netrc, ~/.curlrc ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** curl - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** yes - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - curl - 8.14.1-2+deb13u3: normalized package name match | Debian stable package indexes: curl from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | command line tool for transferring data with URL syntax | https://curl.se/ - Debian apt - libcurl3t64-gnutls - 8.14.1-2+deb13u3: normalized package name match | Debian stable package indexes: libcurl3t64-gnutls from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | easy-to-use client-side URL transfer library (GnuTLS flavour) | https://curl.se/ - Debian apt - libcurl4-doc - 8.14.1-2+deb13u3: normalized package name match | Debian stable package indexes: libcurl4-doc from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | documentation for libcurl | https://curl.se/ - Debian apt - libcurl4-gnutls-dev - 8.14.1-2+deb13u3: normalized package name match | Debian stable package indexes: libcurl4-gnutls-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | development files and documentation for libcurl (GnuTLS flavour) | https://curl.se/ - Debian apt - libcurl4-openssl-dev - 8.14.1-2+deb13u3: normalized package name match | Debian stable package indexes: libcurl4-openssl-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | development files and documentation for libcurl (OpenSSL flavour) | https://curl.se/ - Debian apt - libcurl4t64 - 8.14.1-2+deb13u3: normalized package name match | Debian stable package indexes: libcurl4t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | easy-to-use client-side URL transfer library (OpenSSL flavour) | https://curl.se/ - Nix - curl: normalized package name match | nixpkgs package indexes: curl from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - Ubuntu apt - curl - 8.5.0-2ubuntu10: normalized package name match | Ubuntu 24.04 LTS package indexes: curl from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | command line tool for transferring data with URL syntax | https://curl.se/ - Ubuntu apt - libcurl3t64-gnutls - 8.5.0-2ubuntu10: normalized package name match | Ubuntu 24.04 LTS package indexes: libcurl3t64-gnutls from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | easy-to-use client-side URL transfer library (GnuTLS flavour) | https://curl.se/ - Ubuntu apt - libcurl4-doc - 8.5.0-2ubuntu10: normalized package name match | Ubuntu 24.04 LTS package indexes: libcurl4-doc from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | documentation for libcurl | https://curl.se/ - Ubuntu apt - libcurl4-gnutls-dev - 8.5.0-2ubuntu10: normalized package name match | Ubuntu 24.04 LTS package indexes: libcurl4-gnutls-dev from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | development files and documentation for libcurl (GnuTLS flavour) | https://curl.se/ - Ubuntu apt - libcurl4-openssl-dev - 8.5.0-2ubuntu10: normalized package name match | Ubuntu 24.04 LTS package indexes: libcurl4-openssl-dev from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | development files and documentation for libcurl (OpenSSL flavour) | https://curl.se/ - Ubuntu apt - libcurl4t64 - 8.5.0-2ubuntu10: normalized package name match | Ubuntu 24.04 LTS package indexes: libcurl4t64 from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | easy-to-use client-side URL transfer library (OpenSSL flavour) | https://curl.se/ - apk - curl - 8.20.0-r1: normalized package name match | Alpine Linux edge package indexes: curl from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | URL retrieval utility and library | https://curl.se/ - apk - curl-dbg - 8.20.0-r1: normalized package name match | Alpine Linux edge package indexes: curl-dbg from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | URL retrieval utility and library (debug symbols) | https://curl.se/ - apk - curl-dev - 8.20.0-r1: normalized package name match | Alpine Linux edge package indexes: curl-dev from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | URL retrieval utility and library (development files) | https://curl.se/ ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Database and data packages](https://www.automicvault.com/pkg/database-data-tools/) - Matched database, SQL, migration, or data-store metadata. - [brotli](https://www.automicvault.com/pkg/brew/brotli/) - Runtime dependency declared by Homebrew. - [libpsl](https://www.automicvault.com/pkg/brew/libpsl/) - Runtime dependency declared by Homebrew. - [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew. - [zstd](https://www.automicvault.com/pkg/brew/zstd/) - Runtime dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [btfs](https://www.automicvault.com/pkg/brew/btfs/) - Popular package that depends on this formula. - [curlftpfs](https://www.automicvault.com/pkg/brew/curlftpfs/) - Popular package that depends on this formula. - [edbrowse](https://www.automicvault.com/pkg/brew/edbrowse/) - Popular package that depends on this formula. - [fb-client](https://www.automicvault.com/pkg/brew/fb-client/) - Popular package that depends on this formula. - [forbidden](https://www.automicvault.com/pkg/brew/forbidden/) - Popular package that depends on this formula. - [git-ftp](https://www.automicvault.com/pkg/brew/git-ftp/) - Popular package that depends on this formula. - [julia](https://www.automicvault.com/pkg/brew/julia/) - Popular package that depends on this formula. - [lastpass-cli](https://www.automicvault.com/pkg/brew/lastpass-cli/) - Popular package that depends on this formula. - [adns](https://www.automicvault.com/pkg/brew/adns/) - Shares av.db curated category or tags: cli, library, networking. - [c-ares](https://www.automicvault.com/pkg/brew/c-ares/) - Shares av.db curated category or tags: cli, library, networking. - [cadaver](https://www.automicvault.com/pkg/brew/cadaver/) - Shares av.db curated category or tags: cli, http-client, networking. - [czmq](https://www.automicvault.com/pkg/brew/czmq/) - Shares av.db curated category or tags: cli, library, networking. - [freerdp](https://www.automicvault.com/pkg/brew/freerdp/) - Shares av.db curated category or tags: cli, library, networking. - [gupnp](https://www.automicvault.com/pkg/brew/gupnp/) - Shares av.db curated category or tags: cli, library, networking. - [hesiod](https://www.automicvault.com/pkg/brew/hesiod/) - Shares av.db curated category or tags: cli, library, networking. - [lftp](https://www.automicvault.com/pkg/brew/lftp/) - Shares av.db curated category or tags: cli, http-client, networking. - [proxygen](https://www.automicvault.com/pkg/brew/proxygen/) - Local metadata places this package in an adjacent workflow. Shared terms: cli, client, curl, http, library. ## Combined YAML source View the package source record on GitHub. [combined/curl.yml](https://github.com/automic-vault/db/blob/main/combined/curl.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph - curated agent safety answer