Reproducible, static, curl binaries for Linux, macOS and Windows

• Download our .zip or .tar.xz packages,
  PGP signed with: BDCF 067D 3908 B272 7A4A 9487 67C1 0037 40BF 8DC2
  Also in sigstore with cosign, with public key:

  -----BEGIN PUBLIC KEY-----
  MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOhipUjZMIlG0slqjGgJugAyA3E0v
  6zvAK0vpHlwFsNRjOWnx/a2SSTN05EXwcKG86R6bCnQMglqmzYo3Jfe3VQ==
  -----END PUBLIC KEY-----
  

  Verify using:

  cosign verify-blob --key cosign.pub.asc --bundle curl-8.16.0-win64-mingw.zip.sigstore curl-8.16.0-win64-mingw.zip
  

• Standalone curl tool and libcurl DLL. Static libraries included.
• Required: Windows Vista with Universal CRT (64-bit ARM or Intel), macOS 10.9 Mavericks (ARM or Intel), Linux kernel 2.6.39+ (amd64, arm64, RISC-V 64) with MUSL builds.
• HTTP/3, HTTP/2 support, and more.
• Windows 64-bit builds are Control Flow Guard enabled. Intel builds have CET enabled. All builds have frame pointers enabled.
• Transparent builds, using open source code, run in public, with auditable logs.
• LLVM/Clang build environment with mingw-w64 via Debian, Homebrew, MSYS2. llvm-mingw for ARM64.
• Windows cross-built and published via AppVeyor CI. Linux built via GHA. Using reproducible container image debian:testing-slim via rootless podman. macOS built via GHA.
• Linux and macOS builds are not official curl builds.
• We verify components using SHA-256, and PGP where provided.
• We build reproducible binaries, producing the same hash given the same input sources and C compiler.
• Patching policy: No local patches. We may apply patches if already merged upstream or — for showstoppers — had them submitted with fair confidence of getting merged.
• You can look up our package hashes in lines starting with SHA in the build log.
• Packages built across host platforms do not have identical hashes due to slightly different build options and toolchain builds/versions. Except llvm-mingw builds used for ARM64, which are reproducible across platforms.
• We code-sign with a self-signed certificate on Windows, and avoid trusted timestamps for reproducibility.

Features

Uses LibreSSL TLS backend.

feature	Windows	Linux	macOS	noh3	mini	micro	nano	pico
alt-svc	✓	✓	✓	✓	✓	✓
AppleSecTrust	-	-	✓	✓¹	✓¹	✓¹	✓¹	✓¹
asyn-rr
AsynchDNS	✓	✓	✓	✓	✓	✓	✓	✓
brotli	✓	✓	✓	✓
CAcert	✓	✓		✓¹	✓¹	✓¹	✓¹	✓¹
HSTS	✓	✓	✓	✓	✓	✓	✓	✓
HTTP2	✓	✓	✓	✓	✓	✓
HTTP3	✓	✓	✓
HTTPS-proxy	✓	✓	✓	✓	✓	✓	✓	✓
HTTPSRR
IDN	✓		✓	✓¹	✓¹	✓¹	✓¹
IPv6	✓	✓	✓	✓	✓	✓	✓	✓
Kerberos	✓			✓¹	✓¹	✓¹	✓¹
Largefile	✓	✓	✓	✓	✓	✓	✓	✓
libz	✓	✓	✓	✓	✓	✓	✓	✓
NTLM	✓	✓	✓	✓	✓	✓	✓
PSL	✓	✓	✓	✓	✓	✓	✓	✓
SPNEGO	✓			✓¹	✓¹	✓¹	✓¹
SSL	✓	✓	✓	✓	✓	✓	✓	✓
SSPI	✓	-	-	✓¹	✓¹	✓¹	✓¹
SSLS-EXPORT	✓	✓	✓	✓
threadsafe	✓	✓	✓	✓	✓	✓	✓	✓
Unicode		-	-
UnixSockets	✓	✓	✓	✓	✓	✓	✓
zstd	✓	✓	✓	✓

protocol	Windows	Linux	macOS	noh3	mini	micro	nano	pico
dict	✓	✓	✓	✓	✓	✓	✓
file	✓	✓	✓	✓	✓	✓	✓
ftp/ftps	✓	✓	✓	✓	✓	✓	✓
gopher/gophers	✓	✓	✓	✓	✓	✓	✓
http/https	✓	✓	✓	✓	✓	✓	✓	✓
imap/imaps	✓	✓	✓	✓	✓	✓	✓
ipfs/ipns	✓	✓	✓	✓	✓	✓	✓
ldap/ldaps	✓		✓	✓	✓	✓	✓
mqtt	✓	✓	✓	✓	✓	✓	✓
pop3/pop3s	✓	✓	✓	✓	✓	✓	✓
rtsp	✓	✓	✓	✓	✓	✓	✓
scp/sftp	✓	✓	✓	✓	✓
smb/smbs	✓	✓	✓	✓	✓	✓	✓
smtp/smtps	✓	✓	✓	✓	✓	✓	✓
telnet	✓	✓	✓	✓	✓	✓	✓
tftp	✓	✓	✓	✓	✓	✓	✓
ws/wss	✓	✓	✓	✓	✓	✓	✓

• ¹: platform-dependent
• noh3: HTTP/2
• mini: without brotli and zstd, with OS TLS backend (Schannel) if available
• micro: without libssh2
• nano: HTTP/1.1
• pico: HTTP/1.1-only

Downloads

• Latest version for Windows:
  https://curl.se/windows/
• Specific versions for Windows, back to 8.2.0:
  https://curl.se/windows/dl-<curl-version>_<build-1-to-N>/curl-<curl-version>_<build-1-to-N>-{win64,win64a}-mingw.zip
  Example:
  https://curl.se/windows/dl-8.2.0_1/curl-8.2.0_1-win64-mingw.zip

Build logs

https://ci.appveyor.com/project/curlorg/curl-for-win/history?branch=main

Unstable/development daily builds

https://github.com/curl/curl-for-win/actions/workflows/daily.yml

Guarantees and Liability

See LICENSE.

Information in this document is subject to change without notice and does not represent or imply any future commitment by the participants of the project.

---

This document © Viktor Szakats, CC BY-SA 4.0