[taplin]

Patch release for NIOMTASTSHTTPFetcher, the default MTA-STS policy fetcher, plus a Linux crash fix in LocalMTATransport. No API changes.

Fixes

• A capped, timed-out or refused fetch stops reading at once. Closing a NIOSSL channel starts a clean TLS shutdown, which keeps reading and discarding until the peer's close_notify arrives or shutdownTimeout expires (5 s by default). A policy host that streams an endless body and ignores close_notify therefore kept every capped fetch's connection busy for 5 s. The fetcher now turns autoRead off before closing and uses a 1 ms TLS shutdownTimeout. This is the same fix as Perfect-Authentication's NIOTransport.

• A partial body is still never accepted. A response counts as complete only by its Content-Length, by the chunked terminator, or, for a body that ends at the close, by the server's TLS close_notify. New tests cover a short Content-Length body and an unterminated chunked body (ended by close_notify or by a bare TCP close), plus a close-delimited body without close_notify. The response collector also fails an incomplete response on any close that passes through it.

• The deadline and cancellation end every stage of a fetch. These bugs were already in 6.0.0.

  • A server that accepted the connection and never finished the TLS handshake held the fetch until the server hung up.
  • Cancelling the caller made the fetch hang.
  • A resolver error left a promise uncompleted, which crashes debug builds with "leaking promise".

  The deadline now runs on the event loop and cancellation has a handler. Either one aborts resolution, every connect attempt, the handshake and the response, and closes the channel, including a connect still in flight. A cancelled fetch throws CancellationError.

• The request target is the URL's percent-encoded path and query. It used to come from url.path, which Foundation percent-decodes, so /api/ went out as /api, /%3F/? as /??, and %20 or non-ASCII paths failed. A target holding a space, a control character or a non-ASCII byte is now refused. This doesn't affect MTASTSPolicyManager, whose path is fixed; only code calling the fetcher directly was affected.

• LocalMTATransport no longer crashes on an interrupted pipe read (Linux). Corelibs FileHandle.availableData turns EINTR into a fatalError. The drains now use a read(2) loop that retries EINTR. The new test reproduces the crash against the old code on native linux/arm64.

Measurements

50 back-to-back capped HTTPS fetches against a local endless-body server that ignores close_notify. Linux runs used the container CLI with --memory 6g, release builds.

Platform	6.0.0	6.0.1
macOS, Swift 6.4	15.7–21.4 s, 40–56 GB	0.06–0.08 s, 33–46 MB
Linux 6.2 arm64	28.5–30.5 s, 68–77 GB	0.06–0.07 s, 193–201 MB
Linux 6.4 arm64	33.8–40.1 s, 81–104 GB	0.07–0.09 s, 181–201 MB
Linux 6.2 amd64 (emulated)	68.2–88.3 s, 144–189 GB	0.16–0.17 s, 145–182 MB
Linux 6.4 amd64 (emulated)	87.2–91.7 s, 148–178 GB	0.15–0.16 s, 168–187 MB

Times cover all 50 fetches; bytes are what the server wrote to loopback. On 6.0.0, every connection stayed open 5.0 s after its fetch returned; on 6.0.1, each closes within 0.01 s. Peak RSS stayed under 60 MB and fds returned to baseline in every run.

Verification

• macOS: Xcode 27.0 (Swift 6.4) and Xcode 26.3 (Swift 6.2.4), debug and release, -warnings-as-errors. Full suite passes (498 tests).
• Linux: swift:6.2-noble and swift:6.4-noble, arm64 and amd64, -warnings-as-errors. Full suite passes. On emulated 6.2 amd64, DirectMXRetryQueueTests timed out once in 7 runs: a 3 s wait starved by emulation, an existing timing margin.
• On 6.0.0, every new test fails, hangs or traps.
• Review: four adversarial review rounds; the final verdict was push.

Known issues and follow-ups

• SMTP connections themselves still close TLS with NIOSSL's default 5 s shutdownTimeout.
• An aborted fetch doesn't cancel its DNS lookup, which runs until DNSResolver's own query timeouts.

🤖 Generated with Claude Code