fix(classic): build curl with a pure c-ares resolver

[zoeyrose]

Summary

Build Linux curl 8.18.0 and MXE curl 8.21.0 with a pure c-ares 1.34.6 resolver and OpenSSL 3.5.5. Preserve HTTP/HTTPS/WebSocket, HTTP/2, compression, PSL and IDN features; explicitly exclude LDAP/LDAPS/RTMP and validate generated resolver configuration plus runtime provider closure.

Implementation

Pin immutable dependency inputs, expose the Linux curl/c-ares payload contract, and correct the pinned MXE OpenSSL source from 4.0.1 to 3.5.5. Both consumer manifests select Classic 9136e13, with its reviewed dated CA bundle and client/server c-ares notice packaging.

Windows smoke follows the pinned consumer's shader preparation and separate client test build, preserves the production package with tests disabled, and stages current fixture arguments. Production ZIP verification requires exact single CA and full c-ares MIT notice hashes alongside recursive private DLL closure. Native bundles retain GPL sources and CA attribution/provenance, and verify the dependency notice before execution.

Validation

Validate build images and Measure Classic Check image both passed on exact source 435fbf78d83d1f22d48e0e78f647bd9b948e406e. All Linux and Windows image jobs, full package/bundle staging, eight native Windows tests and both required native lanes succeeded.

Actual Windows runtime reports curl 8.21.0, c-ares 1.34.6 and OpenSSL 3.5.5. The real Classic helper passed witnessed stalled DNS/HTTP cancellation through cleanup and joins in 39 ms / 14 ms against a 1-second limit. Real QUIC handshakes succeeded; verified HTTPS to curl.se returned HTTP 200, verification result zero, in 120 ms.

Independent Astra review covered the integrated source and retained native artifact: all 35 file hashes, all 23 PE dependency lists, complete private DLL closure, no OpenSSL 4 imports, all eight executable bindings, exact CA and full c-ares notice. The strict production ZIP verifier passed in CI; the retained artifact independently inspected was the native bundle. All 25 focused tool tests and manifest/syntax checks passed. Earlier failed staging runs and skipped native jobs remain recorded as failures; no CI job was manually retried.

Qualification limits

The native probe links the real Core build from immutable consumer source; it does not establish installed-package acceptance. These results qualify the reviewed source and hosted candidates. Published OCI images and the final standalone consumer/runtime still require qualification through the normal release and consumer workflows. Image publication remains with the normal release pipeline.

[github-actions]

🎉 This PR is included in version 1.16.0 🎉

The release is available on:

• v1.16.0
• GitHub release

Your semantic-release bot 📦🚀