output warning for debug-enabled version

[bagder]

A debug-enabled version of curl is not intended for production

[jay]

Ref: https://curl.se/mail/lib-2023-01/0039.html

I think it's too much but it looks like the list disagrees. Do you have a reference to the issue that was reported with the unintentional use of debugbuild? What about put it in curl_version, all caps, DEBUGBUILD. That way it is also visible from libcurl. Nevermind that DEBUGBUILD can override the version string if CURL_VERSION env is set...

curl 7.87.1-DEV (i386-pc-win32) libcurl/7.87.1-DEV DEBUGBUILD OpenSSL/1.1.1s nghttp2/1.50.0
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS Debug HSTS HTTP2 HTTPS-proxy IPv6 Largefile NTLM SSL Unicode UnixSockets

diff --git a/lib/version.c b/lib/version.c
index a69e2ca..dae8335 100644
--- a/lib/version.c
+++ b/lib/version.c
@@ -109,7 +109,7 @@ static void zstd_version(char *buf, size_t bufsz)
  * zeros in the data.
  */
 
-#define VERSION_PARTS 16 /* number of substrings we can concatenate */
+#define VERSION_PARTS 17 /* number of substrings we can concatenate */
 
 char *curl_version(void)
 {
@@ -173,6 +173,9 @@ char *curl_version(void)
 #endif
 
   src[i++] = LIBCURL_NAME "/" LIBCURL_VERSION;
+#ifdef DEBUGBUILD
+  src[i++] = "DEBUGBUILD";
+#endif
 #ifdef USE_SSL
   Curl_ssl_version(ssl_version, sizeof(ssl_version));
   src[i++] = ssl_version;

[bagder]

The debug-by-mistake was in here #10269

I don't think putting DEBUGBUILD in there is much different to what we do already do today. It doesn't stress or emphasize how unwise it is to use such build in production.

[jay]

It looks as though that reporter is using libcurl but not the curl tool. What about in multi,

> curld  -v https://curl.se -o NUL
* !!! WARNING !!!
* This is a debug build of libcurl, do not use in production.
* STATE: INIT => CONNECT handle 0x1d37ae8; line 1917 (connection #-5000)
* Added connection 0. The cache now contains 1 members

diff --git a/lib/multi.c b/lib/multi.c
index b6187cd..4032748 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1861,6 +1861,15 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
     multistate(data, MSTATE_COMPLETED);
   }
 
+#ifdef DEBUGBUILD
+  if(!multi->warned) {
+    infof(data, "!!! WARNING !!!");
+    infof(data, "This is a debug build of libcurl, "
+          "do not use in production.");
+    multi->warned = true;
+  }
+#endif
+
   do {
     /* A "stream" here is a logical stream if the protocol can handle that
        (HTTP/2), or the full connection for older protocols */
diff --git a/lib/multihandle.h b/lib/multihandle.h
index 7dd6a0a..6cda65d 100644
--- a/lib/multihandle.h
+++ b/lib/multihandle.h
@@ -170,6 +170,9 @@ struct Curl_multi {
 #endif
   BIT(dead); /* a callback returned error, everything needs to crash and
                 burn */
+#ifdef DEBUGBUILD
+  BIT(warned);                 /* true after user warned of DEBUGBUILD */
+#endif
 };
 
 #endif /* HEADER_CURL_MULTIHANDLE_H */

[bagder]

Right, maybe doing both would make sense. (as proposed by @dfandrich on the list)

[bagder]

I'll merge this, but let's keep our ears and eyes open to see if this causes too much problems.