OK claudio@

If the cookie doesn't match, we bail with a continue and totally forget to free the imsg. OK claudio@

patch from Christoph Liebender OK: rsadowski@

The things that need quoting are not necessarily "argument names", and not even necessarily "names" at all, so just talk about "arguments". "I guess?" florian@ and no objection from otto@, both back in July 2025. Actually, the quoting rules are more complicated than the text makes believe, but i do not know how to better describe them. It may not be easy because some suspect the implementation may be somewhat adhoc rather than based on cleary defined lexical rules.

OK stsp

It is possible that "request_method" is checked without having been initialised in line 439. OK kirill@ stsp@

Found by scan-build: carp.c:64:7: warning: Although the value stored to 'c' is used in the enclosing expression, the value is never actually read from 'c' [deadcode.DeadSt ores] 64 | if ((c = carp_group_find(group)) == NULL) Feedback from Crystal Kolipe and tb@, OK tb@

The HTTP standard RFC 9110 requires GMT, in HTTP-date. We used to do this until a recent modification to localtime.c changed GMT to UTC. sync from httpd

As a result IF the other side of the privsep was succesfully exploited, it could then send such a flawed message and cause a cause an array bounds violation over the privsep boundary. Reported by S. Ai, H. Lefeuvre, Systopia team ok claudio