0.3.5

A handshake that never completes no longer holds a request for good, and a
private CA can be trusted alongside the default store. It is a patch release, so
a dependency written as a caret range, tinyhttps = "^0.3.1", resolves to it;
the one change in behaviour, a handshake slower than connectTimeoutMs now
failing, is the end of a hang rather than a new failure mode, and is described
below.

TLS handshake time limit

#25. The TLS handshake is
bounded by connectTimeoutMs. It had no limit: after the
TCP connection was up, a server (or an https:// proxy) that accepted it and never
sent its ServerHello held send, send_stream and download_to_file for good
unless the caller passed a stop token.

• The handshake gives up once connectTimeoutMs has passed since it began, and
  statusText is TLS handshake timed out. This covers the handshake with the
  target, with an https:// proxy, and with the target inside an https:// proxy's
  tunnel. The limit is on the handshake as a whole, so a peer that sends a byte
  at a time does not hold it open.
• Behaviour change: a handshake slower than connectTimeoutMs (10 s by default)
  now fails where it used to complete. Each step of setting up a connection (the
  TCP connect, a proxy's reply, a handshake) has connectTimeoutMs to itself, so
  the whole can take several times that.
• TlsSocket::connect bounds the handshake with the timeoutMs it already
  took for the TCP connect, so a caller of it directly sees the change too.
• TlsSocket::connect_over takes a trailing handshakeTimeoutMs, -1 (the
  default) for no limit; a call by name compiles unchanged, a pointer to it needs
  the new parameter in its type. Socket gains set_deadline, deadline_hit
  and wait_before_recv.

Extra CA certificates

#24. HttpClientConfig::extraCaFile is a path to a PEM file whose certificates are
trusted in addition to the default store, which SSL_CERT_FILE can only replace.
It is for a private CA or a proxy that re-signs TLS.

• It applies wherever a trust store is built: the target, and the connection to
  an https:// proxy.
• A file that cannot be read or holds no certificate fails the connection, and
  statusText names the file.
• proxy_tunnel takes the path as a trailing default argument, and TlsSocket
  gains set_extra_ca_file. Nothing changes while the field is empty.

CI

• The openkal job on Windows asks Git for Windows where its CA bundle is; 2.56
  moved it from mingw64/ to ucrt64/, and the job failed before it ran.
• The Windows job runs test_handshake_timeout and test_extra_ca with the
  other hermetic tests.