A minimal, secure HTTPS client for Zig.

Single static binary that fetches URLs over HTTPS with strict security defaults. Replaces curl in restricted environments where you need a small, auditable tool with no runtime dependencies.

Also usable as a Zig library for embedding HTTP(S) fetches in your own programs.

• Single static binary, no runtime dependencies
• HTTP(S) only -- small attack surface by design
• Strict security defaults: TLS verification on, redirect limits enforced, body size capped
• Streaming I/O -- responses written directly to a sink, never buffered in memory
• Deterministic exit codes for scripting
• Embeddable Zig library with allocator-explicit API

• Zig 0.15.2+
• CMake
• Ninja (for building vendored BoringSSL)

git clone https://github.com/nichochar/zfetch.git
cd zfetch
zig build -Doptimize=ReleaseSmall

The binary is at zig-out/bin/zfetch.

# Simple GET request
zfetch https://example.com

# POST with JSON body
zfetch -d '{"key":"val"}' -H 'Content-Type: application/json' https://api.example.com

# PUT with body from stdin
zfetch -X PUT -d @- https://api.example.com/resource < data.json

# Write response to file
zfetch -o output.html https://example.com

# Fail on HTTP errors (exit 22 on 4xx/5xx)
zfetch --fail https://api.example.com/resource

Add zfetch as a dependency in your build.zig.zon:

.dependencies = .{
    .zfetch = .{
        .url = "https://github.com/nichochar/zfetch/archive/<commit>.tar.gz",
        .hash = "...",
    },
},

Wire it into your build.zig:

const zfetch_dep = b.dependency("zfetch", .{
    .target = target,
    .optimize = optimize,
});
exe.root_module.addImport("zfetch", zfetch_dep.module("zfetch"));

Then use it in your code:

const std = @import("std");
const zfetch = @import("zfetch");

pub fn main() !void {
    var gpa = std.heap.GeneralPurposeAllocator(.{}){};
    defer _ = gpa.deinit();
    const allocator = gpa.allocator();

    var client = zfetch.Client.init(allocator, .{});
    defer client.deinit();

    var response = client.fetch("https://example.com", std.fs.File.stdout()) catch |err| {
        std.debug.print("error: {s}\n", .{zfetch.errorMessage(err)});
        return;
    };
    defer response.deinit(allocator);
}

BoringSSL is vendored and links transparently through the zfetch module -- consumers do not need to configure TLS separately.

Build with a specific profile:

zig build -Doptimize=ReleaseSmall    # Smallest binary
zig build -Doptimize=ReleaseSafe     # Safety checks enabled

Apache-2.0