neulab/tldr huggingface dataset:
By key Id. This format is deduced from the length of the string and its content or 0x prefix. The key Id of an X.509 certificate are the low 64 bits of its SHA-1 fingerprint.  The use of key Ids is just a shortcut, for all automated processing the fingerprint should be used.
When using gpg an exclamation mark (!) may be appended to force using the specified primary or secondary key and not to try and calculate which primary or secondary key to use.
The last four lines of the example give the key ID in their long form as internally used by the OpenPGP protocol. You can see the long key ID using the option --with-colons.
234567C4 0F34E556E 01347A56A 0xAB123456
234AABBCC34567C4 0F323456784E56EAB 01AB3FED1347A5612 0x234AABBCC34567C4
By fingerprint. This format is deduced from the length of the string and its content or the 0x prefix.  Note, that only the 20 byte version fingerprint is available with gpgsm (i.e. the SHA-1 hash of the certificate).
The best way to specify a key Id is by using the fingerprint. This avoids any ambiguities in case that there are duplicated key IDs.
1234343434343434C434343434343434 123434343434343C3434343434343734349A3434 0E12343434343434343434EAB3484343434343434 0xE12343434343434343434EAB3484343434343434
gpgsm also accepts colons between each pair of hexadecimal digits because this is the de-facto standard on how to present X.509 fingerprints.  gpg also allows the use of the space separated SHA-1 fingerprint as printed by the key listing commands.
By exact match on OpenPGP user ID. This is denoted by a leading equal sign. It does not make sense for X.509 certificates.
=Heinrich Heine <heinrichh@uni-duesseldorf.de>
By exact match on an email address. This is indicated by enclosing the email address in the usual way with left and right angles.
<heinrichh@uni-duesseldorf.de>
By partial match on an email address. This is indicated by prefixing the search string with an @.  This uses a substring search but considers only the mail address (i.e. inside the angle brackets).
@heinrichh
By exact match on the subject's DN. This is indicated by a leading slash, directly followed by the RFC-2253 encoded DN of the subject.  Note that you can't use the string printed by gpgsm --list-keys because that one has been reordered and modified for better readability; use --with-colons to print the raw (but standard escaped) RFC-2253 string.
/CN=Heinrich Heine,O=Poets,L=Paris,C=FR
By exact match on the issuer's DN. This is indicated by a leading hash mark, directly followed by a slash and then directly followed by the RFC-2253 encoded DN of the issuer.  This should return the Root cert of the issuer.  See note above.
#/CN=Root Cert,O=Poets,L=Paris,C=FR
By exact match on serial number and issuer's DN. This is indicated by a hash mark, followed by the hexadecimal representation of the serial number, then followed by a slash and the RFC-2253 encoded DN of the issuer. See note above.
#4F03/CN=Root Cert,O=Poets,L=Paris,C=FR
By keygrip. This is indicated by an ampersand followed by the 40 hex digits of a keygrip.  gpgsm prints the keygrip when using the command --dump-cert.
&D75F22C3F86E355877348498CDC92BD21010A480
By substring match. This is the default mode but applications may want to explicitly indicate this by putting the asterisk in front.  Match is not case sensitive.
Heine *Heine
. and + prefixes These prefixes are reserved for looking up mails anchored at the end and for a word search mode.  They are not yet implemented and using them is undefined.
Please note that we have reused the hash mark identifier which was used in old GnuPG versions to indicate the so called local-id.  It is not anymore used and there should be no conflict when used with X.509 stuff.
Using the RFC-2253 format of DNs has the drawback that it is not possible to map them back to the original encoding, however we don't have to do this because our key database stores this encoding as meta data.
The options --import-filter and --export-filter use expressions with this syntax (square brackets indicate an optional part and curly braces a repetition, white space between the elements are allowed):
[lc] {[{flag}] PROPNAME op VALUE [lc]}
The name of a property (PROPNAME) may only consist of letters, digits and underscores.  The description for the filter type describes which properties are defined.  If an undefined property is used it evaluates to the empty string.  Unless otherwise noted, the VALUE must always be given and may not be the empty string.  No quoting is defined for the value, thus the value may not contain the strings && or ||, which are used as logical connection operators.  The flag -- can be used to remove this restriction.
Numerical values are computed as long int; standard C notation applies. lc is the logical connection operator; either && for a conjunction or || for a disjunction.  A conjunction is assumed at the begin of an expression.  Conjunctions have higher precedence than disjunctions.  If VALUE starts with one of the characters used in any op a space after the op is required.
The supported operators (op) are:
=~     Substring must match.
!~     Substring must not match.
=      The full string must match.
<>     The full string must not match.
==     The numerical value must match.
!=     The numerical value must not match.
<=     The numerical value of the field must be LE than the value.
<      The numerical value of the field must be LT than the value.
>      The numerical value of the field must be GT than the value.
>=     The numerical value of the field must be GE than the value.
-le    The string value of the field must be less or equal than the value.
-lt    The string value of the field must be less than the value.
-gt    The string value of the field must be greater than the value.
-ge    The string value of the field must be greater or equal than the value.
-n     True if value is not empty (no value allowed).
-z     True if value is empty (no value allowed).
-t     Alias for "PROPNAME != 0" (no value allowed).
-f     Alias for "PROPNAME == 0" (no value allowed).
Values for flag must be space separated.  The supported flags are:
--     VALUE spans to the end of the expression.
-c     The string match in this part is done case-sensitive.
-t     Leading and trailing spaces are not removed from VALUE.  The optional single space after op is here required.
The filter options concatenate several specifications for a filter of the same type.  For example the four options in this example:
--import-filter keep-uid="uid =~ Alfa" --import-filter keep-uid="&& uid !~ Test" --import-filter keep-uid="|| uid =~ Alpha" --import-filter keep-uid="uid !~ Test"
--import-filter \ keep-uid="uid =~ Alfa" && uid !~ Test" || uid =~ Alpha" && "uid !~ Test"
imports only the user ids of a key containing the strings "Alfa" or "Alpha" but not the string "test".
Trust values are used to indicate ownertrust and validity of keys and user IDs.  They are displayed with letters or strings:
- unknown No ownertrust assigned / not yet calculated.
e expired
Trust calculation has failed; probably due to an expired key.
q undefined, undef Not enough information for calculation.
n never  Never trust this key.
m marginal Marginally trusted.
f full   Fully trusted.
u ultimate Ultimately trusted.
r revoked For validity only: the key or the user ID has been revoked.
? err    The program encountered an unknown trust value.
There are a few configuration files to control certain aspects of gpg's operation. Unless noted, they are expected in the current home directory (see: [option --homedir]).
gpg.conf This is the standard configuration file read by gpg on startup. It may contain any valid long option; the leading two dashes may not be entered and the option may not be abbreviated.  This default name may be changed on the command line (see: [gpg-option --options]).  You should backup this file.
Note that on larger installations, it is useful to put predefined files into the directory ‘/etc/skel/.gnupg’ so that newly created users start up with a working configuration.  For existing users a small helper script is provided to create these files (see: [addgnupghome]).
For internal purposes gpg creates and maintains a few other files; They all live in the current home directory (see: [option --homedir]).  Only the gpg program may modify these files.
~/.gnupg This is the default home directory which is used if neither the environment variable GNUPGHOME nor the option --homedir is given.
~/.gnupg/pubring.gpg The public keyring using a legacy format.  You should backup this file.
If this file is not available, gpg defaults to the new keybox format and creates a file ‘pubring.kbx’ unless that file already exists in which case that file will also be used for OpenPGP keys.
Note that in the case that both files, ‘pubring.gpg’ and ‘pubring.kbx’ exists but the latter has no OpenPGP keys, the legacy file ‘pubring.gpg’ will be used.  Take care: GnuPG versions before 2.1 will always use the file ‘pubring.gpg’ because they do not know about the new keybox format. In the case that you have to use GnuPG 1.4 to decrypt archived data you should keep this file.
~/.gnupg/pubring.gpg.lock The lock file for the public keyring.
~/.gnupg/pubring.kbx The public keyring using the new keybox format.  This file is shared with gpgsm.  You should backup this file.  See above for the relation between this file and it predecessor.
To convert an existing ‘pubring.gpg’ file to the keybox format, you first backup the ownertrust values, then rename ‘pubring.gpg’ to ‘publickeys.backup’, so it won’t be recognized by any GnuPG version, run import, and finally restore the ownertrust values:
$ cd ~/.gnupg $ gpg --export-ownertrust >otrust.lst $ mv pubring.gpg publickeys.backup $ gpg --import-options restore --import publickeys.backups $ gpg --import-ownertrust otrust.lst
~/.gnupg/pubring.kbx.lock The lock file for ‘pubring.kbx’.
~/.gnupg/secring.gpg The legacy secret keyring as used by GnuPG versions before 2.1. It is not used by GnuPG 2.1 and later.  You may want to keep it in case you have to use GnuPG 1.4 to decrypt archived data.
~/.gnupg/secring.gpg.lock The lock file for the legacy secret keyring.
~/.gnupg/.gpg-v21-migrated File indicating that a migration to GnuPG 2.1 has been done.
~/.gnupg/trustdb.gpg The trust database.  There is no need to backup this file; it is better to backup the ownertrust values (see: [option --export- ownertrust]).
~/.gnupg/trustdb.gpg.lock The lock file for the trust database.
~/.gnupg/random_seed A file used to preserve the state of the internal random pool.
~/.gnupg/openpgp-revocs.d/ This is the directory where gpg stores pre-generated revocation certificates.  The file name corresponds to the OpenPGP fingerprint of the respective key.  It is suggested to backup those certificates and if the primary private key is not stored on the disk to move them to an external storage device.  Anyone who can access theses files is able to revoke the corresponding key. You may want to print them out.  You should backup all files in this directory and take care to keep this backup closed away.
Operation is further controlled by a few environment variables:
HOME   Used to locate the default home directory.
GNUPGHOME If set directory used instead of "~/.gnupg".
GPG_AGENT_INFO This variable is obsolete; it was used by GnuPG versions before 2.1.
PINENTRY_USER_DATA This value is passed via gpg-agent to pinentry.  It is useful to convey extra information to a custom pinentry.
COLUMNS LINES  Used to size some displays to the full size of the screen.
LANGUAGE Apart from its use by GNU, it is used in the W32 version to override the language selection done through the Registry.  If used and set to a valid and available language name (langid), the file with the translation is loaded from gpgdir/gnupg.nls/langid.mo.  Here gpgdir is the directory out of which the gpg binary has been loaded.  If it can't be loaded the Registry is tried and as last resort the native Windows locale system is used.
When calling the gpg-agent component gpg sends a set of environment variables to gpg-agent.  The names of these variables can be listed using the command:
gpg-connect-agent 'getinfo std_env_names' /bye | awk '$1=="D" {print $2}'
On older systems this program should be installed as setuid(root). This is necessary to lock memory pages. Locking memory pages prevents the operating system from writing memory pages (which may contain passphrases or other sensitive material) to disk. If you get no warning message about insecure memory your operating system supports locking without being root. The program drops root privileges as soon as locked memory is allocated.
Note also that some systems (especially laptops) have the ability to ``suspend to disk'' (also known as ``safe sleep'' or ``hibernate''). This writes all memory to disk before going into a low power or even powered off mode.  Unless measures are taken in the operating system to protect the saved memory, passphrases or other sensitive material may be recoverable from it later.
Before you report a bug you should first search the mailing list archives for similar problems and second check whether such a bug has already been reported to our bug tracker at https://bugs.gnupg.org.
gpgv(1), gpgsm(1), gpg-agent(1)
The full documentation for this tool is maintained as a Texinfo manual. If GnuPG and the info program are properly installed at your site, the command
info gnupg
should give you access to the complete manual including a menu structure and an index.
namcap(1)                         User Commands                        namcap(1)
namcap - package analysis utility
namcap [options] <package|PKGBUILD> [package|PKGBUILD] ...
namcap is a package analysis utility that looks for problems with Arch Linux packages or their PKGBUILD files.  It can apply rules to the file list, the files themselves, or individual PKGBUILD files.
Rules return lists of messages.  Each message can be one of three types: error, warning, or information (think of them as notes or comments). Errors (designated by 'E:') are things that namcap is very sure are wrong and need to be fixed.  Warnings (designated by 'W:') are things that namcap thinks should be changed but if you know what you're doing then you can leave them.  Information (designated 'I:') are only shown when you use the info argument.  Information messages give information that might be helpful but isn't anything that needs changing.
-e RULELIST, --exclude=RULELIST Do not run RULELIST rules on the package
-i, --info display information messages
-L, --list return a list of valid rules and their descriptions
-m, --machine-readable displays easily parseable namcap tags instead of the normal human readable description; for example using non-fhs-man-page instead of "Non-FHS man page (%s) found. Use /usr/share/man instead". A full list of namcap tags along with their human readable descriptions can be found at /usr/share/namcap/tags.
-r RULELIST, --rules=RULELIST only apply RULELIST rules to the package
RULELIST is a comma-separated list of rule names
arrays Verifies that array variables are actually arrays and not strings
badbackups Verifies that backup entries don't begin with /
carch  Looks for references to i686 and i586 and tells you to use $CARCH instead
capsnames Checks a PKGBUILD to verify that the package name has no upper case characters
capsnamespkg Checks a package to verify that the package name has no upper case characters
checksums Makes sure that a PKGBUILD includes valid checksums
depends This module runs ldd on all executables, gets the link-level dependencies, finds the smallest subset of dependencies that cover the link-level dependencies, and compares that list to the depends of the package.  It returns messages in three cases: dependency detected and not included, dependency included but already satisfied, and dependency included and not needed.  These suggestions are just guidelines and all package builders should take this into account (i.e. you're smarter than namcap is)
Some cases where namcap fails are dlopen() and obscure links. dlopen()'d libraries don't show up because they are loaded at run time: in the case of a program that loads plugins.  Obscure links are the cases where only a small portion of the package needs something to run; usually, the small portion won't be accessed unless that thing is installed (i.e. a java plugin for mozilla included in the java package).
directoryname Checks the directory names in the package file list for standard directories (i.e. /etc, /usr/bin, /usr/lib).  All files in directories that are non-standard are returned
elffiles Gives an error if it finds ELF (binary) files outside the standard paths (/bin, /usr/bin, etc.)
emptydir Looks for directories in a package that don't contain any files
extravars Verifies that extra variables start with an underscore
fhsinfopages Verifies correct installation of info pages
fhsmanpages Verifies correct installation of man pages
fileownership Verifies that all files are owned by root:root and not some other user or group
gnomemime Checks for generated GNOME mime files
hicoloricons Checks whether the hicolor icon cache is updated when a package installs files in /usr/share/icons/hicolor
infodirectory Verifies that a package does not contain the info directory file (/usr/share/info/dir)
invalidstartdir Any PKGBUILDs that refer to files in $startdir are incorrect
libtool Warns if libtool (*.la) files are present
license Verifies that the licenses variable has been filled in in a PKGBUILD.
licensepkg Verifies that the licenses variable has been filled in in a package. For packages with a custom license it checks whether the license file has been installed in /usr/share/licenses/$pkgname/
perllocal Searches for perllocal.pod.  perllocal.pod is a nasty file that's included during most perl module installations
permissions Checks basic file and and directory permissions.  It returns warnings about world readable bits not being set, world writable bits being set, and world executable bit not being set for directories
rpath  Gives an error if a binary has RPATH set to something other than /usr/lib
scrollkeeper Verifies that there aren't any scrollkeeper directories
sfurl  Warns if a PKGBUILD is downloading from a specific sourceforge mirror instead of the generic downloads.sourceforge.net
symlink Finds out symbolic and hard links which do not point to a valid path in the package
tags   For package maintainers, this module verifies that we have remembered to add a Maintainer and Contributor comment.
url    Verifies that we have the url variable set in the PKGBUILD
urlpkg Verifies that we have the url variable set in the package file
namcap foo.pkg.tar.gz apply all rules to foo.pkg.tar.gz
namcap -r depends,symlink foo.pkg.tar.gz apply the depends and symlink rules to foo.pkg.tar.gz
namcap PKGBUILD apply all PKGBUILD based rules to the file PKGBUILD
namcap --list list all of the available rules
Copyright Â© 2003-2009 Jason Chu This is free software; see the source for copying conditions.  There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Jason Chu <jason@archlinux.org> Abhishek Dasgupta <abhidg@gmail.com> Hugo Doria <hugo@archlinux.org> Dan McGee <dan@archlinux.org> Allan McRae <allan@archlinux.org> Jesse Young <jesseyoung@gmail.com> JJDaNiMoTh <jjdanimoth@gmail.com> Kyle Keen <keenerd@gmail.com>
RSSTAIL(1)                        User Commands                       RSSTAIL(1)
rsstail - a Console Based RSS news reader
rsstail [OPTIONS]... -u URL
This manual page was written for the Debian distribution because the original program does not have a manual page.
Parse a RSS feed and read it, in an output similar to the tail command.
This is a Few Description on the main options for rsstail
-t        Show timestamp.
-N        Do not show headings
-Z X      Add heading 'x'
-l        Show link
-d        Show Description
-p        Show Publication date
-a        Show author
-c        Show comments
-b X      Where X is the limit in bytes for description/comments
-z        Continue even if there are XML parser errors in the RSS feed.
-n X      Initially show X items
-H        Strip HTML tags
-o X      only show items newer than X[s/M/h/d/m/y]
-u URL    URL of RSS feed to tai
-i Seconds check interval in seconds (default is 15 minutes)
-r        Print in reverse order
-x Proxy  proxy server to use (host[:port])
-y ProxyAuth proxy authorization (user:password)
-P        do not exit when an error occurs
-v        be verbose (add more to be more verbose)
-h        Help output
-V        Show version of program.
This manual page was written by Rene Mayorga <rmayorga@debian.org.sv> for the Debian system (but may be used by others).  Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 any later version published by the Free Software Foundation.
SA(8)                        System Manager's Manual                       SA(8)
sa -  summarizes accounting information
sa     [ -a | --list-all-names ] [ -b | --sort-sys-user-div-calls ] [ -c | --percentages ] [ -d | --sort-avio ] [ -D | --sort-tio ] [ -f | --not-interactive ] [ -i | --dont-read-summary-files ] [ -j | --print-seconds ] [ -k | --sort-cpu-avmem ] [ -K | --sort-ksec ] [ -l | --separate-times ] [ -m | --user-summary ] [ -n | --sort-num-calls ] [ -p | --show-paging ] [ -P | --show-paging-avg ] [ -r | --reverse-sort ] [ -s | --merge ] [ -t | --print-ratio ] [ -u | --print-users ] [ -v num | --threshold num ] [ --sort-real-time ] [ --debug ] [ -V | --version ] [ -h | --help ] [ --other-usracct-file filename ] [ --ahz hz ] [ --other-savacct-file filename ] [ [ --other-acct-file ] filename ]
sa summarizes information about previously executed commands as recorded in the acct file.  In addition, it condenses this data into a summary file named savacct which contains the number of times the command was called and the system resources used.  The information can also be summarized on a per-user basis; sa will save this information into a file named usracct.
If no arguments are specified, sa will print information about all of the commands in the acct file.
If called with a file name as the last argument, sa will use that file instead of the system's default acct file.
By default, sa will sort the output by sum of user and system time.  If command names have unprintable characters, or are only called once, sa will sort them into a group called `***other'.  If more than one sorting option is specified, the list will be sorted by the one specified last on the command line.
The output fields are labeled as follows:
cpu sum of system and user time in cpu minutes
re "elapsed time" in minutes
k cpu-time averaged core usage, in 1k units
avio average number of I/O operations per execution
tio total number of I/O operations
k*sec cpu storage integral (kilo-core seconds)
u user cpu time in cpu seconds
s system time in cpu seconds
Note that these column titles do not appear in the first row of the table, but after each numeric entry (as units of measurement) in every row.  For example, you might see `79.29re', meaning 79.29 cpu seconds of "real time".
An asterisk will appear after the name of commands that forked but didn't call exec.
GNU sa takes care to implement a number of features not found in other versions.  For example, most versions of sa don't pay attention to flags like `--print-seconds' and `--sort-num-calls' when printing out commands when combined with the `--user-summary' or `--print-users' flags.  GNU sa pays attention to these flags if they are applicable.  Also, MIPS' sa stores the average memory use as a short rather than a double, resulting in some round-off errors.  GNU sa uses double the whole way through.
The availability of these program options depends on your operating system.  In specific, the members that appear in the struct acct of your system's process accounting header file (usually acct.h ) determine which flags will be present.  For example, if your system's struct acct doesn't have the `ac_mem' field, the installed version of sa will not support the `--sort-cpu-avmem', `--sort-ksec', `-k', or `-K' options.
In short, all of these flags may not be available on your machine.
acct(5), ac(1)
curl(1)                            curl Manual                           curl(1)
curl - transfer a URL
curl [options / URLs]
curl is a tool for transferring data from or to a server. It supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET or TFTP. The command is designed to work without user interaction.
curl offers a busload of useful tricks like proxy support, user authentication, FTP upload, HTTP post, SSL connections, cookies, file transfer resume and more. As you will see below, the number of features will make your head spin!
curl is powered by libcurl for all transfer-related features. See libcurl(3) for details.
The URL syntax is protocol-dependent. You find a detailed description in RFC 3986.
You can specify multiple URLs or parts of URLs by writing part sets within braces and quoting the URL as in:
"http://site.{one,two,three}.com"
or you can get sequences of alphanumeric series by using [] as in:
"ftp://ftp.example.com/file[1-100].txt"
"ftp://ftp.example.com/file[001-100].txt"    (with leading zeros)
"ftp://ftp.example.com/file[a-z].txt"
Nested sequences are not supported, but you can use several ones next to each other:
"http://example.com/archive[1996-1999]/vol[1-4]/part{a,b,c}.html"
You can specify any amount of URLs on the command line. They will be fetched in a sequential manner in the specified order. You can specify command line options and URLs mixed and in any order on the command line.
You can specify a step counter for the ranges to get every Nth number or letter:
"http://example.com/file[1-100:10].txt"
"http://example.com/file[a-z:2].txt"
When using [] or {} sequences when invoked from a command line prompt, you probably have to put the full URL within double quotes to avoid the shell from interfering with it. This also goes for other characters treated special, like for example '&', '?' and '*'.
Provide the IPv6 zone index in the URL with an escaped percentage sign and the interface name. Like in
"http://[fe80::3%25eth0]/"
If you specify URL without protocol:// prefix, curl will attempt to guess what protocol you might want. It will then default to HTTP but try other protocols based on often-used host name prefixes. For example, for host names starting with "ftp." curl will assume you want to speak FTP.
curl will do its best to use what you pass to it as a URL. It is not trying to validate it as a syntactically correct URL by any means but is instead very liberal with what it accepts.
curl will attempt to re-use connections for multiple file transfers, so that getting many files from the same server will not do multiple connects / handshakes. This improves speed. Of course this is only done on files specified on a single command line and cannot be used between separate curl invocations.
If not told otherwise, curl writes the received data to stdout. It can be instructed to instead save that data into a local file, using the -o, --output or -O, --remote-name options. If curl is given multiple URLs to transfer on the command line, it similarly needs multiple options for where to save them.
curl does not parse or otherwise "understand" the content it gets or writes as output. It does no encoding or decoding, unless explicitly asked to with dedicated command line options.
curl supports numerous protocols, or put in URL terms: schemes. Your particular build may not support them all.
DICT   Lets you lookup words using online dictionaries.
FILE   Read or write local files. curl does not support accessing file:// URL remotely, but when running on Microsoft Windows using the native UNC approach will work.
FTP(S) curl supports the File Transfer Protocol with a lot of tweaks and levers. With or without using TLS.
GOPHER(S) Retrieve files.
HTTP(S) curl supports HTTP with numerous options and variations. It can speak HTTP version 0.9, 1.0, 1.1, 2 and 3 depending on build options and the correct command line options.
IMAP(S) Using the mail reading protocol, curl can "download" emails for you. With or without using TLS.
LDAP(S) curl can do directory lookups for you, with or without TLS.
MQTT   curl supports MQTT version 3. Downloading over MQTT equals "subscribe" to a topic while uploading/posting equals "publish" on a topic. MQTT over TLS is not supported (yet).
POP3(S) Downloading from a pop3 server means getting a mail. With or without using TLS.
RTMP(S) The Realtime Messaging Protocol is primarily used to server streaming media and curl can download it.
RTSP   curl supports RTSP 1.0 downloads.
SCP    curl supports SSH version 2 scp transfers.
SFTP   curl supports SFTP (draft 5) done over SSH version 2.
SMB(S) curl supports SMB version 1 for upload and download.
SMTP(S) Uploading contents to an SMTP server means sending an email. With or without TLS.
TELNET Telling curl to fetch a telnet URL starts an interactive session where it sends what it reads on stdin and outputs what the server sends it.
TFTP   curl can do TFTP downloads and uploads.
curl normally displays a progress meter during operations, indicating the amount of transferred data, transfer speeds and estimated time left, etc. The progress meter displays number of bytes and the speeds are in bytes per second. The suffixes (k, M, G, T, P) are 1024 based. For example 1k is 1024 bytes. 1M is 1048576 bytes.
curl displays this data to the terminal by default, so if you invoke curl to do an operation and it is about to write data to the terminal, it disables the progress meter as otherwise it would mess up the output mixing progress meter and response data.
If you want a progress meter for HTTP POST or PUT requests, you need to redirect the response output to a file, using shell redirect (>), -o, --output or similar.
This does not apply to FTP upload as that operation does not spit out any response data to the terminal.
If you prefer a progress "bar" instead of the regular meter, -#, --progress-bar is your friend. You can also disable the progress meter completely with the -s, --silent option.
Options start with one or two dashes. Many of the options require an additional value next to them.
The short "single-dash" form of the options, -d for example, may be used with or without a space between it and its value, although a space is a recommended separator. The long "double-dash" form, -d, --data for example, requires a space between it and its value.
Short version options that do not need any additional values can be used immediately next to each other, like for example you can specify all the options -O, -L and -v at once as -OLv.
In general, all boolean options are enabled with --option and yet again disabled with --no-option. That is, you use the exact same option name but prefix it with "no-". However, in this list we mostly only list and show the --option version of them.
--abstract-unix-socket <path> (HTTP) Connect through an abstract Unix domain socket, instead of using the network.  Note: netstat shows the path of an abstract socket prefixed with '@', however the <path> argument should not have this leading character.
Example: curl --abstract-unix-socket socketpath https://example.com
Added in 7.53.0.
--alt-svc <file name> (HTTPS) This option enables the alt-svc parser in curl. If the file name points to an existing alt-svc cache file, that will be used. After a completed transfer, the cache will be saved to the file name again if it has been modified.
Specify a "" file name (zero length) to avoid loading/saving and make curl just handle the cache in memory.
If this option is used several times, curl will load contents from all the files but the last one will be used for saving.
Example: curl --alt-svc svc.txt https://example.com
Added in 7.64.1.
--anyauth (HTTP) Tells curl to figure out authentication method by itself, and use the most secure one the remote site claims to support. This is done by first doing a request and checking the response- headers, thus possibly inducing an extra network round-trip. This is used instead of setting a specific authentication method, which you can do with --basic, --digest, --ntlm, and --negotiate.
Using --anyauth is not recommended if you do uploads from stdin, since it may require data to be sent twice and then the client must be able to rewind. If the need should arise when uploading from stdin, the upload operation will fail.
Used together with -u, --user.
Example: curl --anyauth --user me:pwd https://example.com
See also --proxy-anyauth, --basic and --digest.
-a, --append (FTP SFTP) When used in an upload, this makes curl append to the target file instead of overwriting it. If the remote file does not exist, it will be created.  Note that this flag is ignored by some SFTP servers (including OpenSSH).
Example: curl --upload-file local --append ftp://example.com/
--aws-sigv4 <provider1[:provider2[:region[:service]]]> Use AWS V4 signature authentication in the transfer.
The provider argument is a string that is used by the algorithm when creating outgoing authentication headers.
The region argument is a string that points to a geographic area of a resources collection (region-code) when the region name is omitted from the endpoint.
The service argument is a string that points to a function provided by a cloud (service-code) when the service name is omitted from the endpoint.
Example: curl --aws-sigv4 "aws:amz:east-2:es" --user "key:secret" https://example.com
Added in 7.75.0.
--basic (HTTP) Tells curl to use HTTP Basic authentication with the remote host. This is the default and this option is usually pointless, unless you use it to override a previously set option that sets a different authentication method (such as --ntlm, --digest, or --negotiate).
Example: curl -u name:password --basic https://example.com
See also --proxy-basic.
--cacert <file> (TLS) Tells curl to use the specified certificate file to verify the peer. The file may contain multiple CA certificates. The certificate(s) must be in PEM format. Normally curl is built to use a default file for this, so this option is typically used to alter that default file.
curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is set, and uses the given path as a path to a CA cert bundle. This option overrides that variable.
The windows version of curl will automatically look for a CA certs file named 'curl-ca-bundle.crt', either in the same directory as curl.exe, or in the Current Working Directory, or in any folder along your PATH.
If curl is built against the NSS SSL library, the NSS PEM PKCS#11 module (libnsspem.so) needs to be available for this option to work properly.
(iOS and macOS only) If curl is built against Secure Transport, then this option is supported for backward compatibility with other SSL engines, but it should not be set. If the option is not set, then curl will use the certificates in the system and user Keychain to verify the peer, which is the preferred method of verifying the peer's certificate chain.
(Schannel only) This option is supported for Schannel in Windows 7 or later with libcurl 7.60 or later. This option is supported for backward compatibility with other SSL engines; instead it is recommended to use Windows' store of root certificates (the default for Schannel).
If this option is used several times, the last one will be used.
Example: curl --cacert CA-file.txt https://example.com
--capath <dir> (TLS) Tells curl to use the specified certificate directory to verify the peer. Multiple paths can be provided by separating them with ":" (e.g.  "path1:path2:path3"). The certificates must be in PEM format, and if curl is built against OpenSSL, the directory must have been processed using the c_rehash utility supplied with OpenSSL. Using --capath can allow OpenSSL-powered curl to make SSL-connections much more efficiently than using --cacert if the --cacert file contains many CA certificates.
If this option is set, the default capath value will be ignored, and if it is used several times, the last one will be used.
Example: curl --capath /local/directory https://example.com
--cert-status (TLS) Tells curl to verify the status of the server certificate by using the Certificate Status Request (aka. OCSP stapling) TLS extension.
If this option is enabled and the server sends an invalid (e.g. expired) response, if the response suggests that the server certificate has been revoked, or no response at all is received, the verification fails.
This is currently only implemented in the OpenSSL, GnuTLS and NSS backends.
Example: curl --cert-status https://example.com
Added in 7.41.0.
--cert-type <type> (TLS) Tells curl what type the provided client certificate is using. PEM, DER, ENG and P12 are recognized types.  If not specified, PEM is assumed.
Example: curl --cert-type PEM --cert file https://example.com
See also -E, --cert, --key and --key-type.
-E, --cert <certificate[:password]> (TLS) Tells curl to use the specified client certificate file when getting a file with HTTPS, FTPS or another SSL-based protocol. The certificate must be in PKCS#12 format if using Secure Transport, or PEM format if using any other engine.  If the optional password is not specified, it will be queried for on the terminal. Note that this option assumes a "certificate" file that is the private key and the client certificate concatenated! See -E, --cert and --key to specify them independently.
If curl is built against the NSS SSL library then this option can tell curl the nickname of the certificate to use within the NSS database defined by the environment variable SSL_DIR (or by default /etc/pki/nssdb). If the NSS PEM PKCS#11 module (libnsspem.so) is available then PEM files may be loaded. If you want to use a file from the current directory, please precede it with "./" prefix, in order to avoid confusion with a nickname.  If the nickname contains ":", it needs to be preceded by "\" so that it is not recognized as password delimiter.  If the nickname contains "\", it needs to be escaped as "\\" so that it is not recognized as an escape character.
If curl is built against OpenSSL library, and the engine pkcs11 is available, then a PKCS#11 URI (RFC 7512) can be used to specify a certificate located in a PKCS#11 device. A string beginning with "pkcs11:" will be interpreted as a PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine option will be set as "pkcs11" if none was provided and the --cert-type option will be set as "ENG" if none was provided.
(iOS and macOS only) If curl is built against Secure Transport, then the certificate string can either be the name of a certificate/private key in the system or user keychain, or the path to a PKCS#12-encoded certificate and private key. If you want to use a file from the current directory, please precede it with "./" prefix, in order to avoid confusion with a nickname.
(Schannel only) Client certificates must be specified by a path expression to a certificate store. (Loading PFX is not supported; you can import it to a store first). You can use "<store location>\<store name>\<thumbprint>" to refer to a certificate in the system certificates store, for example, "CurrentUser\MY\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a". Thumbprint is usually a SHA-1 hex string which you can see in certificate details. Following store locations are supported: CurrentUser, LocalMachine, CurrentService, Services, CurrentUserGroupPolicy, LocalMachineGroupPolicy, LocalMachineEnterprise.
Example: curl --cert certfile --key keyfile https://example.com
See also --cert-type, --key and --key-type.
--ciphers <list of ciphers> (TLS) Specifies which ciphers to use in the connection. The list of ciphers must specify valid ciphers. Read up on SSL cipher list details on this URL:
https://curl.se/docs/ssl-ciphers.html
Example: curl --ciphers ECDHE-ECDSA-AES256-CCM8 https://example.com
--compressed-ssh (SCP SFTP) Enables built-in SSH compression.  This is a request, not an order; the server may or may not do it.
Example: curl --compressed-ssh sftp://example.com/
Added in 7.56.0.
--compressed (HTTP) Request a compressed response using one of the algorithms curl supports, and automatically decompress the content. Headers are not modified.
If this option is used and the server sends an unsupported encoding, curl will report an error. This is a request, not an order; the server may or may not deliver data compressed.
Example: curl --compressed https://example.com
-K, --config <file> Specify a text file to read curl arguments from. The command line arguments found in the text file will be used as if they were provided on the command line.
Options and their parameters must be specified on the same line in the file, separated by whitespace, colon, or the equals sign. Long option names can optionally be given in the config file without the initial double dashes and if so, the colon or equals characters can be used as separators. If the option is specified with one or two dashes, there can be no colon or equals character between the option and its parameter.
If the parameter contains whitespace (or starts with : or =), the parameter must be enclosed within quotes. Within double quotes, the following escape sequences are available: \\, \", \t, \n, \r and \v. A backslash preceding any other letter is ignored.
If the first column of a config line is a '#' character, the rest of the line will be treated as a comment.
Only write one option per physical line in the config file.
Specify the filename to -K, --config as '-' to make curl read the file from stdin.
Note that to be able to specify a URL in the config file, you need to specify it using the --url option, and not by simply writing the URL on its own line. So, it could look similar to this:
url = "https://curl.se/docs/"
When curl is invoked, it (unless -q, --disable is used) checks for a default config file and uses it if found, even when this option is used. The default config file is checked for in the following places in this order:
1) Use the CURL_HOME environment variable if set
2) Use the XDG_CONFIG_HOME environment variable if set (Added in 7.73.0)
3) Use the HOME environment variable if set
4) Non-windows: use getpwuid to find the home directory
5) Windows: use APPDATA if set
6) Windows: use "USERPROFILE\Application Data" if set
7) On windows, if there is no .curlrc file in the home dir, it checks for one in the same dir the curl executable is placed. On Unix-like systems, it will simply try to load .curlrc from the determined home dir.
# --- Example file --- # this is a comment url = "example.com" output = "curlhere.html" user-agent = "superagent/1.0"
# and fetch another URL too url = "example.com/docs/manpage.html" -O referer = "http://nowhereatall.example.com/" # --- End of example file ---
This option can be used multiple times to load multiple config files.
Example: curl --config file.txt https://example.com
--connect-timeout <fractional seconds> Maximum time in seconds that you allow curl's connection to take. This only limits the connection phase, so if curl connects within the given period it will continue - if not it will exit.  Since version 7.32.0, this option accepts decimal values.
Examples: curl --connect-timeout 20 https://example.com curl --connect-timeout 3.14 https://example.com
See also -m, --max-time.
--connect-to <HOST1:PORT1:HOST2:PORT2>
For a request to the given HOST1:PORT1 pair, connect to HOST2:PORT2 instead.  This option is suitable to direct requests at a specific server, e.g. at a specific cluster node in a cluster of servers. This option is only used to establish the network connection. It does NOT affect the hostname/port that is used for TLS/SSL (e.g. SNI, certificate verification) or for the application protocols. "HOST1" and "PORT1" may be the empty string, meaning "any host/port". "HOST2" and "PORT2" may also be the empty string, meaning "use the request's original host/port".
A "host" specified to this option is compared as a string, so it needs to match the name used in request URL. It can be either numerical such as "127.0.0.1" or the full host name such as "example.org".
This option can be used many times to add many connect rules.
Example: curl --connect-to example.com:443:example.net:8443 https://example.com
See also --resolve and -H, --header. Added in 7.49.0.
-C, --continue-at <offset> Continue/Resume a previous file transfer at the given offset. The given offset is the exact number of bytes that will be skipped, counting from the beginning of the source file before it is transferred to the destination.  If used with uploads, the FTP server command SIZE will not be used by curl.
Use "-C -" to tell curl to automatically find out where/how to resume the transfer. It then uses the given output/input files to figure that out.
Examples: curl -C - https://example.com curl -C 400 https://example.com
See also -r, --range.
-c, --cookie-jar <filename> (HTTP) Specify to which file you want curl to write all cookies after a completed operation. Curl writes all cookies from its in- memory cookie storage to the given file at the end of operations. If no cookies are known, no data will be written. The file will be written using the Netscape cookie file format. If you set the file name to a single dash, "-", the cookies will be written to stdout.
This command line option will activate the cookie engine that makes curl record and use cookies. Another way to activate it is to use the -b, --cookie option.
If the cookie jar cannot be created or written to, the whole curl operation will not fail or even report an error clearly. Using -v, --verbose will get a warning displayed, but that is the only visible feedback you get about this possibly lethal situation.
If this option is used several times, the last specified file name will be used.
Examples: curl -c store-here.txt https://example.com curl -c store-here.txt -b read-these https://example.com
-b, --cookie <data|filename> (HTTP) Pass the data to the HTTP server in the Cookie header. It is supposedly the data previously received from the server in a "Set-Cookie:" line.  The data should be in the format "NAME1=VALUE1; NAME2=VALUE2".
If no '=' symbol is used in the argument, it is instead treated as a filename to read previously stored cookie from. This option also activates the cookie engine which will make curl record incoming cookies, which may be handy if you are using this in combination with the -L, --location option or do multiple URL transfers on the same invoke. If the file name is exactly a minus ("-"), curl will instead read the contents from stdin.
The file format of the file to read cookies from should be plain HTTP headers (Set-Cookie style) or the Netscape/Mozilla cookie file format.
The file specified with -b, --cookie is only used as input. No cookies will be written to the file. To store cookies, use the -c, --cookie-jar option.
If you use the Set-Cookie file format and do not specify a domain then the cookie is not sent since the domain will never match. To address this, set a domain in Set-Cookie line (doing that will include sub-domains) or preferably: use the Netscape format.
This option can be used multiple times.
Users often want to both read cookies from a file and write updated cookies back to a file, so using both -b, --cookie and -c, --cookie-jar in the same command line is common.
Examples: curl -b cookiefile https://example.com curl -b cookiefile -c cookiefile https://example.com
--create-dirs When used in conjunction with the -o, --output option, curl will create the necessary local directory hierarchy as needed. This option creates the directories mentioned with the -o, --output option, nothing else. If the --output file name uses no directory, or if the directories it mentions already exist, no directories will be created.
Created dirs are made with mode 0750 on unix style file systems.
To create remote directories when using FTP or SFTP, try --ftp- create-dirs.
Example: curl --create-dirs --output local/dir/file https://example.com
--create-file-mode <mode> (SFTP SCP FILE) When curl is used to create files remotely using one of the supported protocols, this option allows the user to set which 'mode' to set on the file at creation time, instead of the default 0644.
This option takes an octal number as argument.
Example: curl --create-file-mode 0777 -T localfile sftp://example.com/new
See also --ftp-create-dirs. Added in 7.75.0.
--crlf (FTP SMTP) Convert LF to CRLF in upload. Useful for MVS (OS/390).
(SMTP added in 7.40.0)
Example: curl --crlf -T file ftp://example.com/