Bug in curl 7.58 (shipped in 18.04) - workaround?

[djones6]

There's a bug in the version of curl (7.58) shipped with Ubuntu 18.04. Upon receiving a chunked response, curl will call back with each chunk of data twice, leading to data corruption (and a failure to parse the response). For more information, see Kitura/Kitura#1465. We're considering coding a workaround for this into Kitura-net, but it's far from straightforward.

We reported this to Ubuntu in June, in https://bugs.launchpad.net/ubuntu/+source/hdf5/+bug/1833198 - but no update is yet available for the 18.04 package.

In the meantime, is it possible to update the version of curl in the buildpack to 7.59 or later? This affects anyone trying to receive a chunked response, including users of Google OAuth or CouchDB / Cloudant, as both send chunked responses.

[christiancompton]

Upgrading the cflinuxfs3 stack itself on IBM Cloud is not an option. I am currently exploring having the buildpack get version 7.59 of libcurl, so that Kitura-net applications are unaffected.