# curl 8.22.0

A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features

Snapshot of gominimal/pkgs commit `c930e3121426c055f690867bf78f5bbd9c2c9826` (pushed 2026-10-11T00:34:22.000Z).

## Install

```sh
min add curl
```

## Direct advisories

None at this commit.

## Transitive advisories

None at this commit.

## Dependencies

- Build (5): base, make, perl, pkgconf, toolchain
- Runtime (3): libpsl, openssl, zlib

## OpenSSF Scorecard

Aggregate score: 8.7 / 10. Scored by OpenSSF Scorecard. Repository scored: curl/curl. Scanned 2026-08-24.

Result on OpenSSF's viewer: https://scorecard.dev/viewer/?uri=github.com/curl/curl

Checks, scored 0-10 as the Scorecard tool reports them (N/A: not applicable or inconclusive):

| Check | Score | Reason |
| --- | --- | --- |
| [Binary-Artifacts](https://minimal.dev/docs/reference/scorecard#check-binary-artifacts) | 10 | No binaries found in the repo |
| [Branch-Protection](https://minimal.dev/docs/reference/scorecard#check-branch-protection) | N/A | Could not be evaluated |
| [CII-Best-Practices](https://minimal.dev/docs/reference/scorecard#check-cii-best-practices) | 10 | Badge detected: Gold |
| [Code-Review](https://minimal.dev/docs/reference/scorecard#check-code-review) | 0 | Found 0/30 approved changesets -- score normalized to 0 |
| [Dangerous-Workflow](https://minimal.dev/docs/reference/scorecard#check-dangerous-workflow) | 10 | No dangerous workflow patterns detected |
| [Fuzzing](https://minimal.dev/docs/reference/scorecard#check-fuzzing) | 10 | Project is fuzzed |
| [License](https://minimal.dev/docs/reference/scorecard#check-license) | 9 | License file detected |
| [Maintained](https://minimal.dev/docs/reference/scorecard#check-maintained) | 10 | 30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10 |
| [Packaging](https://minimal.dev/docs/reference/scorecard#check-packaging) | N/A | Packaging workflow not detected |
| [Pinned-Dependencies](https://minimal.dev/docs/reference/scorecard#check-pinned-dependencies) | 9 | Dependency not pinned by hash detected -- score normalized to 9 |
| [SAST](https://minimal.dev/docs/reference/scorecard#check-sast) | 10 | SAST tool detected: CodeQL |
| [Security-Policy](https://minimal.dev/docs/reference/scorecard#check-security-policy) | 10 | Security policy file detected |
| [Signed-Releases](https://minimal.dev/docs/reference/scorecard#check-signed-releases) | 8 | 5 out of the last 5 releases have a total of 5 signed artifacts. |
| [Token-Permissions](https://minimal.dev/docs/reference/scorecard#check-token-permissions) | 10 | GitHub workflow tokens follow principle of least privilege |

## Links

- Homepage: https://curl.se/
- Package page (HTML): https://minimal.dev/pkgs/curl
- JSON API (floats latest): https://minimal.dev/api/pkgs/curl.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/curl/sbom.json
- Build attestations (JSON): https://minimal.dev/api/pkgs/curl/attestation.json