RubyGems - winhttp - Versions diffs - 0.1.0 - Mend

winhttp 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

data/lib/winhttp/version.rb ADDED Viewed

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+module Winhttp
+  VERSION = "0.1.0"
+end

data/lib/winhttp.rb ADDED Viewed

@@ -0,0 +1,562 @@
+# frozen_string_literal: true
+require "winhttp/version"
+require "winhttp/winhttp" # native ext: Session/Request classes, errors, EV_*/ACCESS_*/REDIRECT_* constants
+require "monitor"
+# winhttp — HTTP for Ruby on the stack Windows already ships: WinHTTP in async
+# mode (system TLS via Schannel, the OS certificate store, the user's
+# proxy/PAC settings, HTTP/2, and transparent gzip), behind a thin client that
+# parks fibers under winloop and blocks plainly without it.
+#
+#   require "winhttp"
+#
+#   r = Winhttp.get("https://example.com/")
+#   r.status                    # => 200
+#   r.headers["content-type"]   # => "text/html; charset=UTF-8"
+#   r.text[0, 15]               # => "<!doctype html>"
+#
+# A Session pools connections; reuse one for many requests. The same code path
+# blocks a plain thread and parks a fiber under a Fiber::Scheduler (winloop) —
+# there are no scheduler branches anywhere in winhttp.
+module Winhttp
+  # ---- HTTP token grammar (RFC 7230) for method + header names --------------
+  TOKEN_RE = /\A[!#$%&'*+\-.^_`|~0-9A-Za-z]+\z/.freeze
+  # Header names WinHTTP manages itself; supplying them is an error.
+  MANAGED_HEADERS = %w[host content-length connection].freeze
+  # Revocation policy symbol <-> the C integer the session probe understands.
+  REVOCATION_INT = { none: 0, best_effort: 1, strict: 2 }.freeze
+  REVOCATION_SYM = { 0 => :none, 1 => :best_effort, 2 => :strict }.freeze
+  # A WinHTTP/Win32 failure carries the originating error code (Integer, or nil
+  # for a Ruby-side `timeout:` deadline), set on the exception in C / by the
+  # state machine.
+  class OSError
+    def code
+      @code
+    end
+  end
+  # Certificate/TLS failures decode the SECURE_FAILURE flag bits captured in the
+  # status callback immediately before the failing REQUEST_ERROR.
+  class TlsError
+    # Array[Symbol] (possibly empty): :cert_rev_failed, :invalid_cert,
+    # :cert_revoked, :invalid_ca, :cert_cn_invalid, :cert_date_invalid,
+    # :security_channel_error.
+    def details
+      @details || []
+    end
+  end
+  # A plain, immutable HTTP response. Built in Ruby from the values the state
+  # machine queried out of WinHTTP.
+  class Response
+    attr_reader :status, :reason, :headers, :raw_headers, :body, :final_url
+    # status: Integer; raw: the WINHTTP_QUERY_RAW_HEADERS_CRLF blob (status line
+    # + header lines, CRLF-separated); final_url: String; http2: bool;
+    # body: String (ASCII-8BIT) or nil when streamed.
+    def initialize(status, raw, final_url, http2, body)
+      @status = status
+      @http2 = http2
+      @final_url = final_url
+      @body = body
+      reason, pairs = Winhttp.send(:parse_raw_headers, raw)
+      @reason = reason
+      @raw_headers = pairs.map { |k, v| [k.dup.freeze, v.dup.freeze].freeze }.freeze
+      merged = {}
+      pairs.each do |k, v|
+        lk = k.downcase
+        merged[lk] = merged.key?(lk) ? "#{merged[lk]}, #{v}" : v
+      end
+      merged.each_value(&:freeze)
+      @headers = merged.freeze
+      freeze
+    end
+    # Case-insensitive single-header lookup (merged value), or nil.
+    def [](name)
+      @headers[name.to_s.downcase]
+    end
+    def http2?
+      @http2
+    end
+    def success?
+      (200..299).cover?(@status)
+    end
+    # A copy of the body tagged with `encoding` (else charset= from
+    # Content-Type, else UTF-8). Tags only (force_encoding) — never transcodes;
+    # unknown charset names fall back to UTF-8. Raises if the body was streamed.
+    def text(encoding = nil)
+      raise Error, "winhttp: body was streamed (use the chunk block)" if @body.nil?
+      enc = encoding || charset_encoding || Encoding::UTF_8
+      @body.dup.force_encoding(enc)
+    rescue ArgumentError
+      @body.dup.force_encoding(Encoding::UTF_8)
+    end
+    private
+    def charset_encoding
+      ct = @headers["content-type"]
+      return nil unless ct && ct =~ /charset=\s*"?([\w\-]+)"?/i
+      Encoding.find(Regexp.last_match(1))
+    rescue ArgumentError
+      nil
+    end
+  end
+  class << self
+    # The lazily-created, process-lifetime default Session (all-default options).
+    # Creation is mutex-guarded. It is never closed; the OS reclaims it at exit.
+    def default_session
+      @default_session || @default_mutex.synchronize { @default_session ||= Session.new }
+    end
+    # Thin delegations to the default session (signatures/defaults identical to
+    # the Session instance methods).
+    def get(url, headers: nil, timeout: nil, &chunk)
+      default_session.get(url, headers: headers, timeout: timeout, &chunk)
+    end
+    def post(url, body: "", headers: nil, timeout: nil, &chunk)
+      default_session.post(url, body: body, headers: headers, timeout: timeout, &chunk)
+    end
+    def request(method, url, body: nil, headers: nil, timeout: nil, &chunk)
+      default_session.request(method, url, body: body, headers: headers, timeout: timeout, &chunk)
+    end
+    private
+    # ---- pump thread (one per process) -------------------------------------
+    def ensure_pump!
+      @pump_mutex.synchronize do
+        return if @pump&.alive?
+        @pump = Thread.new { pump_loop }
+        @pump.report_on_exception = false
+      end
+    end
+    def pump_loop
+      loop do
+        Winhttp._pump_wait
+        Winhttp._pump_drain.each do |id, kind, a, b|
+          if kind == EV_LOST
+            # callback-side OOM: fan out to every registered mailbox
+            @mb_lock.synchronize { @mailboxes.values }.each { |q| q.push([EV_LOST, 0, 0]) }
+          else
+            q = @mb_lock.synchronize { @mailboxes[id] }
+            q&.push([kind, a, b])
+          end
+        end
+      rescue StandardError => e
+        warn "winhttp: pump error: #{e.class}: #{e.message}" if $VERBOSE
+      end
+    end
+    def register_mailbox(id, queue)
+      ensure_pump!
+      @mb_lock.synchronize { @mailboxes[id] = queue }
+    end
+    def unregister_mailbox(id)
+      @mb_lock.synchronize { @mailboxes.delete(id) }
+    end
+    # ---- shared validation / assembly --------------------------------------
+    MONO = Process::CLOCK_MONOTONIC
+    def monotonic
+      Process.clock_gettime(MONO)
+    end
+    # Validate a positive Numeric timeout (seconds) -> Float, or raise.
+    def check_timeout(timeout)
+      return nil if timeout.nil?
+      t = Float(timeout)
+      raise ArgumentError, "winhttp: timeout must be positive, got #{timeout.inspect}" unless t.positive?
+      t
+    end
+    # Upcase + token-validate an HTTP method.
+    def normalize_method(method)
+      m = method.to_s.upcase
+      raise ArgumentError, "winhttp: invalid HTTP method #{method.inspect}" unless m.match?(TOKEN_RE)
+      m
+    end
+    # Assemble a CRLF-joined header blob (or nil) with injection + token guards.
+    def build_header_blob(headers)
+      return nil if headers.nil?
+      raise TypeError, "winhttp: headers must be a Hash or nil" unless headers.is_a?(Hash)
+      lines = []
+      headers.each do |name, value|
+        n = name.to_s
+        raise ArgumentError, "winhttp: invalid header name #{name.inspect}" unless n.match?(TOKEN_RE)
+        if MANAGED_HEADERS.include?(n.downcase)
+          raise ArgumentError, "winhttp: #{n} is managed by WinHTTP and cannot be set"
+        end
+        Array(value).each do |v|
+          sv = v.is_a?(Integer) ? v.to_s : v.to_s
+          check_header_value!(n, sv)
+          lines << "#{n}: #{sv}"
+        end
+      end
+      return nil if lines.empty?
+      lines.join("\r\n")
+    end
+    # Header values must be printable ASCII + TAB (header-injection guard: any
+    # CR/LF, or a byte outside 0x20..0x7E plus TAB, raises).
+    def check_header_value!(name, value)
+      value.each_byte do |b|
+        next if b == 0x09 || (b >= 0x20 && b <= 0x7E)
+        raise ArgumentError, "winhttp: illegal byte in header #{name.inspect} value"
+      end
+    end
+    # Validate a request body -> String (raw bytes) <= 4 GiB - 1, or nil.
+    def check_body(body)
+      return nil if body.nil?
+      s = String.try_convert(body)
+      raise TypeError, "winhttp: body must be a String" unless s
+      if s.bytesize > 0xFFFF_FFFE
+        raise ArgumentError, "winhttp: body too large (> 4 GiB - 1)"
+      end
+      s
+    end
+    # Split the RAW_HEADERS_CRLF blob into [reason, [[name, value], ...]].
+    # First line is the status line ("HTTP/1.1 200 OK"); the rest are headers.
+    def parse_raw_headers(raw)
+      lines = raw.to_s.split("\r\n")
+      status_line = lines.shift || ""
+      reason = ""
+      if status_line =~ %r{\AHTTP/\S+\s+\d+\s+(.*)\z}
+        reason = Regexp.last_match(1)
+      elsif status_line =~ %r{\AHTTP/\S+\s+\d+\s*\z}
+        reason = ""
+      end
+      pairs = []
+      lines.each do |line|
+        next if line.empty?
+        k, v = line.split(":", 2)
+        next if k.nil?
+        pairs << [k.strip, (v || "").strip]
+      end
+      [reason, pairs]
+    end
+  end
+  # One async WinHTTP session handle plus its configuration. Thread-safe and
+  # fiber-safe: any number of threads/fibers may issue requests concurrently.
+  class Session
+    # The effective revocation policy, settled at construction.
+    attr_reader :revocation
+    # Open a Session. See the gem README for the full option contract.
+    def self.new(user_agent: "winhttp-ruby/#{Winhttp::VERSION}",
+                 proxy: :system, proxy_bypass: nil, http2: true, decompress: true,
+                 revocation: :best_effort, redirects: 10,
+                 connect_timeout: nil, send_timeout: nil, receive_timeout: nil)
+      access, proxy_str = resolve_proxy(proxy, proxy_bypass)
+      rev_int = REVOCATION_INT[revocation]
+      raise ArgumentError, "winhttp: revocation must be :best_effort/:strict/:none" unless rev_int
+      unless redirects.is_a?(Integer) && (0..65_535).cover?(redirects)
+        raise ArgumentError, "winhttp: redirects must be an Integer in 0..65535"
+      end
+      redirect_policy = redirects.zero? ? REDIRECT_NEVER : REDIRECT_DISALLOW_HTTPS_TO_HTTP
+      ct = ms_or_unset(connect_timeout, "connect_timeout")
+      st = ms_or_unset(send_timeout, "send_timeout")
+      rt = ms_or_unset(receive_timeout, "receive_timeout")
+      session, eff = _open(user_agent.to_s, access, proxy_str, proxy_bypass,
+                           ct, st, rt, http2 ? true : false, decompress ? true : false,
+                           redirect_policy, redirects, rev_int)
+      session.send(:finish_init, REVOCATION_SYM[eff], rev_int)
+      session
+    end
+    # Resolve a proxy: kwarg -> [access_type, named_proxy_string_or_nil].
+    def self.resolve_proxy(proxy, proxy_bypass)
+      case proxy
+      when :system
+        raise ArgumentError, "winhttp: proxy_bypass requires a String proxy" if proxy_bypass
+        [ACCESS_AUTOMATIC, nil]
+      when :none
+        raise ArgumentError, "winhttp: proxy_bypass requires a String proxy" if proxy_bypass
+        [ACCESS_NO_PROXY, nil]
+      when String
+        validate_proxy_string!(proxy)
+        validate_proxy_string!(proxy_bypass) if proxy_bypass
+        [ACCESS_NAMED, proxy]
+      else
+        raise ArgumentError, "winhttp: proxy must be :system, :none, or a String"
+      end
+    end
+    private_class_method :resolve_proxy
+    # Proxy strings must not carry whitespace/CR/LF or userinfo (credentials).
+    def self.validate_proxy_string!(str)
+      if str =~ /[\s]/ || str.include?("\r") || str.include?("\n")
+        raise ArgumentError, "winhttp: proxy string must not contain whitespace or CR/LF"
+      end
+      if str.include?("@")
+        raise ArgumentError, "winhttp: proxy string must not contain credentials (user:pass@)"
+      end
+    end
+    private_class_method :validate_proxy_string!
+    # nil -> -1 (leave WinHTTP default); positive Numeric seconds -> ms Integer.
+    def self.ms_or_unset(timeout, name)
+      return -1 if timeout.nil?
+      t = Float(timeout)
+      raise ArgumentError, "winhttp: #{name} must be non-negative, got #{timeout.inspect}" if t.negative?
+      ms = (t * 1000).round
+      ms.zero? && t.positive? ? 1 : ms
+    end
+    private_class_method :ms_or_unset
+    # Open a session and ensure-close it around the block (block form).
+    def self.open(**opts)
+      s = new(**opts)
+      return s unless block_given?
+      begin
+        yield s
+      ensure
+        s.close
+      end
+    end
+    def get(url, headers: nil, timeout: nil, &chunk)
+      perform("GET", url, nil, headers, timeout, &chunk)
+    end
+    def head(url, headers: nil, timeout: nil)
+      perform("HEAD", url, nil, headers, timeout)
+    end
+    def post(url, body: "", headers: nil, timeout: nil, &chunk)
+      perform("POST", url, body, headers, timeout, &chunk)
+    end
+    def put(url, body:, headers: nil, timeout: nil, &chunk)
+      perform("PUT", url, body, headers, timeout, &chunk)
+    end
+    def patch(url, body:, headers: nil, timeout: nil, &chunk)
+      perform("PATCH", url, body, headers, timeout, &chunk)
+    end
+    def delete(url, headers: nil, timeout: nil, &chunk)
+      perform("DELETE", url, nil, headers, timeout, &chunk)
+    end
+    def request(method, url, body: nil, headers: nil, timeout: nil, &chunk)
+      perform(Winhttp.send(:normalize_method, method), url, body, headers, timeout, &chunk)
+    end
+    # Close the session: mark closed FIRST (new requests raise Closed), abort
+    # every in-flight request (those raise Canceled), wait — bounded, <= 5 s —
+    # for the OS to finish teardown, then close the session handle. Idempotent.
+    def close
+      @lock.synchronize do
+        return nil if @closed_flag
+        @closed_flag = true
+        _mark_closed
+        inflight = @inflight.values
+      end
+      abort_inflight
+      bounded_close_handle
+      nil
+    end
+    private
+    # Called by Session.new after the C handle is created.
+    def finish_init(effective_revocation, _rev_int)
+      @revocation = effective_revocation
+      @lock = Monitor.new
+      @inflight = {}
+      @closed_flag = false
+      self
+    end
+    def abort_inflight
+      reqs = @lock.synchronize { @inflight.values.dup }
+      reqs.each do |entry|
+        mutex, req = entry
+        mutex.synchronize { req._abort }
+      end
+    end
+    def bounded_close_handle
+      deadline = Winhttp.send(:monotonic) + 5.0
+      loop do
+        return if _try_close_handle
+        if Winhttp.send(:monotonic) >= deadline
+          warn "winhttp: session handle leaked (teardown did not settle in 5s)" if $VERBOSE
+          return
+        end
+        sleep 0.01
+      end
+    end
+    # The per-request state machine. Strictly sequential, so exactly one
+    # outstanding WinHTTP operation per request handle by construction.
+    def perform(verb, url, body, headers, timeout, &chunk)
+      raise Closed, "winhttp: session is closed" if @closed_flag
+      secure, host, port, path = Winhttp._crack(url)
+      blob = Winhttp.send(:build_header_blob, headers)
+      bytes = Winhttp.send(:check_body, body)
+      seconds = Winhttp.send(:check_timeout, timeout)
+      deadline = seconds && (Winhttp.send(:monotonic) + seconds)
+      req = Winhttp::Request.allocate
+      mutex = Thread::Mutex.new
+      mb = Thread::Queue.new
+      id = nil
+      secure_flags = []
+      begin
+        id_num = _start(req, verb, host, port, secure, path, blob, bytes,
+                        Winhttp::REVOCATION_INT.fetch(@revocation, 0))
+        id = id_num
+        Winhttp.send(:register_mailbox, id, mb)
+        @lock.synchronize do
+          raise Closed, "winhttp: session is closed" if @closed_flag
+          @inflight[id] = [mutex, req]
+        end
+        mutex.synchronize { req._send }
+        wait!(mb, deadline, mutex, req, EV_SEND, secure_flags)
+        mutex.synchronize { req._receive }
+        wait!(mb, deadline, mutex, req, EV_HEADERS, secure_flags)
+        status, raw, final_url, proto = mutex.synchronize { req._headers }
+        chunks = chunk ? nil : []
+        loop do
+          mutex.synchronize { req._read_start }
+          n = wait!(mb, deadline, mutex, req, EV_READ, secure_flags)
+          break if n.zero?
+          data = mutex.synchronize { req._read_take(n) }
+          chunk ? chunk.call(data) : (chunks << data)
+        end
+        mutex.synchronize { req._finish }
+        Response.new(status, raw, final_url, proto,
+                     chunks && chunks.join.force_encoding(Encoding::BINARY))
+      ensure
+        mutex.synchronize { req._abort } rescue nil
+        Winhttp.send(:unregister_mailbox, id) if id
+        @lock.synchronize { @inflight.delete(id) } if id
+      end
+    end
+    # Pop the mailbox until the expected kind arrives. Honors the wall-clock
+    # deadline, routes EV_ERROR/EV_SECURE/EV_LOST, returns the payload.
+    def wait!(mailbox, deadline, mutex, req, expected, secure_flags)
+      loop do
+        msg =
+          if deadline
+            remaining = deadline - Winhttp.send(:monotonic)
+            if remaining <= 0
+              mutex.synchronize { req._abort }
+              raise_timeout
+            end
+            mailbox.pop(timeout: remaining)
+          else
+            mailbox.pop
+          end
+        if msg.nil?
+          mutex.synchronize { req._abort }
+          raise_timeout
+        end
+        kind, a, b = msg
+        case kind
+        when expected
+          return a
+        when EV_SECURE
+          secure_flags << a
+          next
+        when EV_ERROR
+          mutex.synchronize { req._abort }
+          Winhttp._raise_os(api_name_for(a), b, secure_flags.last)
+        when EV_LOST
+          mutex.synchronize { req._abort }
+          raise Error, "winhttp: completion notification lost (out of memory)"
+        else
+          warn "winhttp: unexpected event #{kind} (expected #{expected})" if $VERBOSE
+          next
+        end
+      end
+    end
+    def raise_timeout
+      exc = TimeoutError.new("winhttp: request exceeded the timeout deadline")
+      exc.instance_variable_set(:@code, nil)
+      raise exc
+    end
+    # Map WINHTTP_ASYNC_RESULT.dwResult (which API failed) to a label.
+    def api_name_for(which)
+      {
+        1 => "WinHttpReceiveResponse",
+        2 => "WinHttpQueryDataAvailable",
+        3 => "WinHttpReadData",
+        4 => "WinHttpWriteData",
+        5 => "WinHttpSendRequest"
+      }.fetch(which, "WinHttp")
+    end
+  end
+  # Eagerly initialize the cross-thread routing state at module load — under the
+  # GVL, single-threaded, before any request thread can race. Lazy `x ||= alloc`
+  # is NOT atomic in MRI (the allocation between ivar-read and ivar-write is a
+  # thread-switch/GC point), so two threads' first concurrent use of a shared or
+  # the default Session could each install a DIFFERENT @mailboxes Hash / @mb_lock
+  # Monitor: register_mailbox writes one, the pump reads the other, the lookup
+  # misses, the completion is dropped, and the request hangs to its deadline.
+  # Initializing here removes the check-then-act window. (@pump itself stays lazy,
+  # guarded by the now-always-present @pump_mutex.) These ivars live on the
+  # Winhttp module object, which is `self` for the `class << self` methods above.
+  @pump_mutex    = Mutex.new
+  @mb_lock       = Monitor.new
+  @mailboxes     = {}
+  @default_mutex = Mutex.new
+end

metadata ADDED Viewed

@@ -0,0 +1,121 @@
+--- !ruby/object:Gem::Specification
+name: winhttp
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- ned
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rake-compiler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: vcvars
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.1
+description: |
+  winhttp is a native extension that binds the asynchronous WinHTTP API into a
+  thin, hard-to-misuse Ruby HTTP client: system TLS via Schannel with the OS
+  certificate store and revocation policy, the user's proxy and PAC settings,
+  HTTP/2 negotiation, transparent gzip/deflate, safe redirect defaults, and
+  streaming downloads. Requests park the calling fiber under a Fiber scheduler
+  (e.g. winloop) and block plainly without one — one code path. Windows MSVC
+  (mswin) Ruby only.
+executables: []
+extensions:
+- ext/winhttp/extconf.rb
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- ext/winhttp/extconf.rb
+- ext/winhttp/winhttp.c
+- lib/winhttp.rb
+- lib/winhttp/version.rb
+homepage: https://github.com/main-path/winhttp
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/main-path/winhttp
+  source_code_uri: https://github.com/main-path/winhttp
+  changelog_uri: https://github.com/main-path/winhttp/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/main-path/winhttp/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: 'HTTP client for Ruby on the Windows OS stack: WinHTTP with system TLS, cert
+  store, and proxy.'
+test_files: []