* Fix optional OpenSSL duplex I/O on Unix
Release connection locks before readiness waits while serializing native SSL
attempts and preserving owned write retries. Wake waiters on native progress
and socket identity invalidation, and construct callback/native exceptions
after unlocking.
Add regression coverage to the existing SSL snippet and run the optional
OpenSSL backend in the existing Unix CI matrix. Windows and AIX retain the
legacy transport pending a separate compatibility-safe driver.
Assisted-by: OpenAI Codex:model version unavailable
* Consolidate OpenSSL runtime checks into the existing CI step
Keep the minimal system and vendored OpenSSL build checks, and run the
Unix SSL regressions in the existing system OpenSSL step. Preserve the
runtime feature set and enable its macOS dependency in that job.
Assisted-by: OpenAI Codex:model version unavailable
* ssl: accept ClientHello before selecting the SNI context
Replace the provisional server connection and replay flags with explicit handshake states. Retain fatal alerts across nonblocking retries and preserve fragmented input on timeout. Enable the three SNI alert regressions.
Assisted-by: Codex:GPT-5
* ssl: share socket and MemoryBIO transport progress
Queue drained TLS records before fallible output and use one handshake record loop for both transports.
Assisted-by: Codex:GPT-5
* ssl: unify shutdown and fatal alert lifecycle
Track close-notify progress in TlsState, preserve pending alerts across retries, and share record-boundary shutdown for sockets and MemoryBIO. Retain rustls errors until Python exception conversion.
Assisted-by: Codex:GPT-5
* ssl: emit the full peer certificate dict
Use the same certificate dict helper for getpeercert() and
Certificate.get_info() so OCSP, caIssuers, and CRL URLs are present.
Clear CHANNEL_BINDING_TYPES on the rustls backend, and add a MemoryBIO
leftover-plaintext snippet.
Assisted-by: Claude
youknowdot