Gracefully fallback to WinNET proxy settings when HTTPS_PROXY/NO_PROXY are malformed (#2137)

Addresses #2130.

Preserves the bootstrap helper's existing HTTPS_PROXY and NO_PROXY
handling. If WinHttpOpen rejects the configuration with
ERROR_INVALID_PARAMETER (87), the helper warns and retries using the
current user's explicit WinNET proxy settings, or a direct connection if
none is configured.

Validated debug and release builds, focused error-handling regressions,
actual proxy routing and redirects, and 11 container scenarios covering
10 successful signed downloads and one expected connection failure.

---------

Co-authored-by: Camille Bruckmann <cbruckmann@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

docs/testing.md

@@ -64,6 +64,26 @@ $ # i.e., ./out/vcpkg-test [arguments]
 If you make any modifications to `vcpkg`, you'll have to do the
 `cmake --build .` step again.
 
+## Windows bootstrap proxy configuration
+
+The Windows bootstrap helper (`tls12-download.exe`) first passes `HTTPS_PROXY`
+and `NO_PROXY` to WinHTTP. If `WinHttpOpen` rejects the configuration with
+`ERROR_INVALID_PARAMETER` (87), the helper warns and retries without the
+environment configuration, then applies the current user's explicit Windows/IE
+proxy address and bypass list. The entire environment configuration is ignored
+for this retry; entries are not parsed or filtered. Without an explicit Windows
+proxy, the retry connects directly.
+
+Accepted environment configurations keep their existing behavior. Empty or
+unset `HTTPS_PROXY` also selects the Windows/IE settings, as before. Other
+initialization errors and a failed retry are fatal. Connection and TLS failures
+do not trigger this fallback.
+For example, bare IPv6 (`::1`) and CIDR bypass entries can trigger error 87.
+An accepted but nonmatching bypass entry does not trigger fallback:
+`.example.com` does not bypass subdomains in WinHTTP; `*.example.com` does.
+PAC scripts and automatic proxy discovery are not evaluated. This applies only
+to the bootstrap helper, not the main vcpkg executable.
+
 ## Writing Tests
 
 In your journey to write new tests, and to modify existing tests, reading the

src/tls12-download.c

@@ -275,7 +275,23 @@ int __stdcall entry()
     // Setting delete on close before we do anything means the file will get deleted for us if we crash
     set_delete_on_close_flag(std_out, out_file, TRUE);
 
-    const HINTERNET session = WinHttpOpen(L"tls12-download/1.0", access_type, proxy_setting, proxy_bypass_setting, 0);
+    HINTERNET session = WinHttpOpen(L"tls12-download/1.0", access_type, proxy_setting, proxy_bypass_setting, 0);
+    if (!session)
+    {
+        last_error = GetLastError();
+        if (last_error != ERROR_INVALID_PARAMETER)
+        {
+            abort_api_failure_with_last_error(std_out, L"WinHttpOpen", last_error);
+        }
+
+        write_message(std_out,
+                      L"\r\nwarning: WinHttpOpen rejected HTTPS_PROXY/NO_PROXY (error 87). "
+                      L"Falling back to Windows/IE proxy settings, or a direct connection if no explicit proxy is "
+                      L"configured.\r\n");
+        access_type = WINHTTP_ACCESS_TYPE_NO_PROXY;
+        session = WinHttpOpen(L"tls12-download/1.0", access_type, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
+    }
+
     if (!session)
     {
         abort_api_failure(std_out, L"WinHttpOpen");