Vendor courier stack and add inflate/SHA-1 foundations

.ci-scripts/release/arm64-apple-darwin-nightly.bash

@@ -88,7 +88,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${CPU} \
-  version="${APPLICATION_VERSION}"
+  version="${APPLICATION_VERSION}" ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/arm64-apple-darwin-release.bash

@@ -86,7 +86,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${CPU} \
-  version="${APPLICATION_VERSION}"
+  version="${APPLICATION_VERSION}" ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/arm64-unknown-linux-nightly.bash

@@ -88,7 +88,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${CPU} \
-  version="${APPLICATION_VERSION}" static=true linker=bfd
+  version="${APPLICATION_VERSION}" static=true linker=bfd ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/arm64-unknown-linux-release.bash

@@ -86,7 +86,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${CPU} \
-  version="${APPLICATION_VERSION}" static=true linker=bfd
+  version="${APPLICATION_VERSION}" static=true linker=bfd ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/x86-64-apple-darwin-nightly.bash

@@ -85,7 +85,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${ARCH} \
-  version="${APPLICATION_VERSION}"
+  version="${APPLICATION_VERSION}" ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/x86-64-apple-darwin-release.bash

@@ -83,7 +83,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${ARCH} \
-  version="${APPLICATION_VERSION}"
+  version="${APPLICATION_VERSION}" ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/x86-64-unknown-linux-nightly.bash

@@ -87,7 +87,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${ARCH} \
-  version="${APPLICATION_VERSION}" static=true linker=bfd
+  version="${APPLICATION_VERSION}" static=true linker=bfd ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/release/x86-64-unknown-linux-release.bash

@@ -85,7 +85,7 @@ ASSET_DESCRIPTION="https://github.com/${GITHUB_REPOSITORY}"
 # Build application installation
 echo -e "\e[34mBuilding ${APPLICATION_NAME}...\e[0m"
 make install prefix="${BUILD_DIR}" arch=${ARCH} \
-  version="${APPLICATION_VERSION}" static=true linker=bfd
+  version="${APPLICATION_VERSION}" static=true linker=bfd ssl=libressl
 
 # Package it all up
 echo -e "\e[34mCreating .tar.gz of ${APPLICATION_NAME}...\e[0m"

.ci-scripts/windows-install-libressl.ps1

@@ -0,0 +1,19 @@
+$version = "3.9.1"
+$arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+if ($arch -ieq "X64") { $zipArch = "x64" }
+elseif ($arch -ieq "Arm64") { $zipArch = "ARM64" }
+else { throw "Unsupported architecture: $arch" }
+
+$zipName = "libressl_v${version}_windows_${zipArch}.zip"
+$url = "https://github.com/libressl/portable/releases/download/v${version}/${zipName}"
+
+$tempDir = Join-Path $env:TEMP "libressl"
+if (-not (Test-Path $tempDir)) { New-Item -ItemType Directory -Path $tempDir | Out-Null }
+
+Invoke-WebRequest $url -OutFile "$tempDir\$zipName"
+Expand-Archive -Force -Path "$tempDir\$zipName" -DestinationPath "$tempDir\libressl"
+
+$repoRoot = Split-Path $PSScriptRoot
+Copy-Item -Force "$tempDir\libressl\lib\ssl.lib" "$repoRoot\ssl.lib"
+Copy-Item -Force "$tempDir\libressl\lib\crypto.lib" "$repoRoot\crypto.lib"
+Copy-Item -Force "$tempDir\libressl\lib\tls.lib" "$repoRoot\tls.lib"

.github/workflows/breakage-against-linux-ponyc-latest.yml

@@ -13,11 +13,11 @@ jobs:
     name: Verify main against the latest ponyc on Linux
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/ponylang/shared-docker-ci-standard-builder:nightly
+      image: ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:nightly
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Test
-        run: make unit-tests config=debug
+        run: make unit-tests config=debug ssl=libressl
       - name: Send alert on failure
         if: ${{ failure() }}
         uses: zulip/github-actions-zulip/send-message@e4c8f27c732ba9bd98ac6be0583096dea82feea5

.github/workflows/breakage-against-macos-arm64-ponyc-latest.yml

@@ -17,10 +17,13 @@ jobs:
         run: bash .ci-scripts/macos-arm64-install-pony-tools.bash nightly
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: Test with most recent ponyc release
         run: |
           export PATH="/tmp/ponyc/bin/:$PATH"
-          make unit-tests config=debug
+          make unit-tests config=debug ssl=libressl
       - name: Send alert on failure
         if: ${{ failure() }}
         uses: zulip/github-actions-zulip/send-message@e4c8f27c732ba9bd98ac6be0583096dea82feea5

.github/workflows/breakage-against-macos-x86-ponyc-latest.yml

@@ -17,10 +17,13 @@ jobs:
         run: bash .ci-scripts/macos-x86-install-pony-tools.bash nightly
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: Test with most recent ponyc release
         run: |
           export PATH="/tmp/ponyc/bin/:$PATH"
-          make unit-tests config=debug
+          make unit-tests config=debug ssl=libressl
       - name: Send alert on failure
         if: ${{ failure() }}
         uses: zulip/github-actions-zulip/send-message@e4c8f27c732ba9bd98ac6be0583096dea82feea5

.github/workflows/breakage-against-windows-ponyc-latest.yml

@@ -15,6 +15,8 @@ jobs:
       - name: Disable Windows Defender
         run: Set-MpPreference -DisableRealtimeMonitoring $true
       - uses: actions/checkout@v6.0.2
+      - name: Install LibreSSL
+        run: .ci-scripts\windows-install-libressl.ps1
       - name: Test with most recent ponyc nightly
         run: |
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/nightlies/raw/versions/latest/ponyc-x86-64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;

.github/workflows/nightlies.yml

@@ -24,15 +24,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6.0.2
       - name: Pull Docker image
-        run: docker pull ghcr.io/ponylang/shared-docker-ci-standard-builder:release
+        run: docker pull ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release
       - name: Build and upload
         run: |
           docker run --rm \
             -v ${{ github.workspace }}:/root/project \
             -w /root/project \
             -e CLOUDSMITH_API_KEY=${{ secrets.CLOUDSMITH_API_KEY }} \
             -e GITHUB_REPOSITORY=${{ github.repository }} \
-            ghcr.io/ponylang/shared-docker-ci-standard-builder:release \
+            ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release \
             bash .ci-scripts/release/arm64-unknown-linux-nightly.bash
       - name: Send alert on failure
         if: ${{ failure() }}
@@ -50,7 +50,7 @@ jobs:
     name: Build and upload x86-64-unknown-linux-nightly to Cloudsmith
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/ponylang/shared-docker-ci-standard-builder:release
+      image: ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Build and upload
@@ -82,6 +82,7 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/ponyc-x86-64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;
           Expand-Archive -Path C:\ponyc.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+          .ci-scripts\windows-install-libressl.ps1;
           .\make.ps1 -Command build;
           .\make.ps1 -Command test;
           .\make.ps1 -Command install;
@@ -114,6 +115,7 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/ponyc-arm64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;
           Expand-Archive -Path C:\ponyc.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+          .ci-scripts\windows-install-libressl.ps1;
           .\make.ps1 -Command build;
           .\make.ps1 -Command test;
           .\make.ps1 -Command install;
@@ -142,6 +144,9 @@ jobs:
         run: bash .ci-scripts/macos-x86-install-pony-tools.bash release
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: pip install dependencies
         run: pip3 install --break-system-packages --upgrade cloudsmith-cli
       - name: Build and upload
@@ -171,6 +176,9 @@ jobs:
         run: bash .ci-scripts/macos-arm64-install-pony-tools.bash release
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: pip install dependencies
         run: pip3 install --upgrade --break-system-packages cloudsmith-cli
       - name: Build and upload

.github/workflows/pr.yml

@@ -21,11 +21,11 @@ jobs:
     name: x86_64 Linux
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/ponylang/shared-docker-ci-standard-builder:release
+      image: ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Test with most recent ponyc release
-        run: make test
+        run: make test ssl=libressl
 
   # Currently, GitHub actions supplied by GH like checkout and cache do not work
   # in musl libc environments on arm64. We can work around this by running
@@ -43,14 +43,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6.0.2
       - name: Pull Docker image
-        run: docker pull ghcr.io/ponylang/shared-docker-ci-standard-builder:release
+        run: docker pull ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release
       - name: Test with most recent ponyc release
         run: |
           docker run --rm \
             -v ${{ github.workspace }}:/root/project \
             -w /root/project \
-            ghcr.io/ponylang/shared-docker-ci-standard-builder:release \
-            make test
+            ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release \
+            make test ssl=libressl
 
   x86_windows:
     name: x86_64 Windows
@@ -64,6 +64,7 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/ponyc-x86-64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;
           Expand-Archive -Path C:\ponyc.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+          .ci-scripts\windows-install-libressl.ps1;
           .\make.ps1 -Command test 2>&1
 
   arm64_windows:
@@ -78,6 +79,7 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/ponyc-arm64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;
           Expand-Archive -Path C:\ponyc.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+          .ci-scripts\windows-install-libressl.ps1;
           .\make.ps1 -Command test 2>&1
 
   x86_macos:
@@ -89,10 +91,13 @@ jobs:
         run: bash .ci-scripts/macos-x86-install-pony-tools.bash release
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: Test with most recent ponyc release
         run: |
           export PATH="/tmp/ponyc/bin/:$PATH"
-          make test
+          make test ssl=libressl
 
   arm64_macos:
     name: arm64 MacOS
@@ -103,7 +108,10 @@ jobs:
         run: bash .ci-scripts/macos-arm64-install-pony-tools.bash release
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: Test with most recent ponyc release
         run: |
           export PATH="/tmp/ponyc/bin/:$PATH"
-          make test
+          make test ssl=libressl

.github/workflows/release.yml

@@ -47,15 +47,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6.0.2
       - name: Pull Docker image
-        run: docker pull ghcr.io/ponylang/shared-docker-ci-standard-builder:release
+        run: docker pull ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release
       - name: Build and upload
         run: |
           docker run --rm \
             -v ${{ github.workspace }}:/root/project \
             -w /root/project \
             -e CLOUDSMITH_API_KEY=${{ secrets.CLOUDSMITH_API_KEY }} \
             -e GITHUB_REPOSITORY=${{ github.repository }} \
-            ghcr.io/ponylang/shared-docker-ci-standard-builder:release \
+            ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release \
             bash .ci-scripts/release/arm64-unknown-linux-release.bash
 
   x86-64-unknown-linux-release:
@@ -64,7 +64,7 @@ jobs:
     needs:
       - pre-artefact-creation
     container:
-      image: ghcr.io/ponylang/shared-docker-ci-standard-builder:release
+      image: ghcr.io/ponylang/shared-docker-ci-standard-builder-with-libressl-4.2.0:release
     steps:
       - uses: actions/checkout@v6.0.2
       - name: Build and upload
@@ -83,6 +83,9 @@ jobs:
         run: bash .ci-scripts/macos-x86-install-pony-tools.bash release
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: pip install dependencies
         run: pip3 install --break-system-packages --upgrade cloudsmith-cli
       - name: Build and upload
@@ -103,6 +106,9 @@ jobs:
         run: bash .ci-scripts/macos-arm64-install-pony-tools.bash release
       - name: brew install dependencies
         run: brew install coreutils
+      - name: Install LibreSSL
+        continue-on-error: true
+        run: brew install libressl
       - name: pip install dependencies
         run: pip3 install --upgrade --break-system-packages cloudsmith-cli
       - name: Build and upload
@@ -127,6 +133,7 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/ponyc-x86-64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;
           Expand-Archive -Path C:\ponyc.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+          .ci-scripts\windows-install-libressl.ps1;
           .\make.ps1 -Command build;
           .\make.ps1 -Command install;
           .\make.ps1 -Command package;
@@ -149,6 +156,7 @@ jobs:
           Invoke-WebRequest https://dl.cloudsmith.io/public/ponylang/releases/raw/versions/latest/ponyc-arm64-pc-windows-msvc.zip -OutFile C:\ponyc.zip;
           Expand-Archive -Path C:\ponyc.zip -DestinationPath C:\ponyc;
           $env:PATH = 'C:\ponyc\bin;' + $env:PATH;
+          .ci-scripts\windows-install-libressl.ps1;
           .\make.ps1 -Command build;
           .\make.ps1 -Command install;
           .\make.ps1 -Command package;

.gitignore

@@ -4,5 +4,6 @@ corral/version.pony
 **/_corral
 .vscode
 *.code-workspace
+*.lib
 .claude
 CLAUDE.md