{"thread":{"id":"41199","subject":"SChannel support in Git for Windows","startedAt":"2016-01-15T15:04:17Z","lastAt":"2016-01-15T16:47:46Z","messageCount":6,"participants":["Robert Labrie","Daniel Stenberg","Johannes Schindelin","Konstantin Khomoutov"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"276160","messageId":"CA+1xWaokgVthDv-up76RP+s+r4pSv5ntmePtDVND+rsKuo+-YA@mail.gmail.com","threadId":"41199","inReplyTo":null,"subject":"SChannel support in Git for Windows","fromName":"Robert Labrie","fromEmail":"robert.labrie@gmail.com","sentAt":"2016-01-15T15:04:17Z","receivedAt":"2016-01-15T15:04:17Z","isPatch":false,"sender":{"key":"robert.labrie@gmail.com","avatar":null},"body":"I googled for this and couldn't find anything, as best as I can tell,\nit's not a thing.\n\nIncreasingly, network admins (including mine) think it's appropriate\nto intercept TLS handshakes on the firewall, and present the calling\napplication with a self-signed cert for the requested domain (ie\ngithub.com). On Linux, this can be sorted out by putting the internal\nissuing CAs root cert in /etc/certs (or somesuch) and on windows, by\nimporting it into the \"Trusted Publishers\" certificate store. The\nchallenge comes from apps using OpenSSL on Windows, which doesn't have\n/etc and doesn't support the windows certificate store.\n\nPresently, I'm using this procedure:\nhttp://stackoverflow.com/questions/9072376/configure-git-to-accept-a-particular-self-signed-server-certificate-for-a-partic\n\nBut it would be more awesome if git just supported schannel on\nWindows. I think cURL does already.\n\nSorry in advance if I didn't Google hard enough for this.\n\nThanks,\nRob\n"},{"id":"276161","messageId":"alpine.DEB.2.20.1601151606050.13999@tvnag.unkk.fr","threadId":"41199","inReplyTo":"CA+1xWaokgVthDv-up76RP+s+r4pSv5ntmePtDVND+rsKuo+-YA@mail.gmail.com","subject":"Re: SChannel support in Git for Windows","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2016-01-15T15:06:25Z","receivedAt":"2016-01-15T15:06:25Z","isPatch":false,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Fri, 15 Jan 2016, Robert Labrie wrote:\n\n> But it would be more awesome if git just supported schannel on Windows. I \n> think cURL does already.\n\ncurl does indeed support schannel.\n\n-- \n\n / daniel.haxx.se\n"},{"id":"276162","messageId":"alpine.DEB.2.20.1601151650481.2964@virtualbox","threadId":"41199","inReplyTo":"CA+1xWaokgVthDv-up76RP+s+r4pSv5ntmePtDVND+rsKuo+-YA@mail.gmail.com","subject":"Re: SChannel support in Git for Windows","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2016-01-15T15:53:50Z","receivedAt":"2016-01-15T15:53:50Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Robert,\n\nOn Fri, 15 Jan 2016, Robert Labrie wrote:\n\n> Increasingly, network admins (including mine) think it's appropriate\n> to intercept TLS handshakes on the firewall, and present the calling\n> application with a self-signed cert for the requested domain (ie\n> github.com). On Linux, this can be sorted out by putting the internal\n> issuing CAs root cert in /etc/certs (or somesuch) and on windows, by\n> importing it into the \"Trusted Publishers\" certificate store. The\n> challenge comes from apps using OpenSSL on Windows, which doesn't have\n> /etc and doesn't support the windows certificate store.\n\nOpenSSL on Windows has no `/etc`, but Git does offer a way to provide your\nown certificates, via the http.sslCAInfo setting.\n\nFurthermore, you can rebuild cURL with support for WinHTTP (which accesses\nthe Windows Certificate Store). Since this is a compile time switch, we do\nnot support that with Git for Windows (until the day when cURL can be\nbuilt with WinHTTP *and* OpenSSL support and configured via a switch to\nuse one or the other).\n\n> Presently, I'm using this procedure:\n> http://stackoverflow.com/questions/9072376/configure-git-to-accept-a-particular-self-signed-server-certificate-for-a-partic\n\nIt may be a good idea to summarize it here (I would consider that good\nform).\n\nCiao,\nJohannes\n"},{"id":"276163","messageId":"20160115185923.1e9fe5220b623625fdbc8041@domain007.com","threadId":"41199","inReplyTo":"CA+1xWaokgVthDv-up76RP+s+r4pSv5ntmePtDVND+rsKuo+-YA@mail.gmail.com","subject":"Re: SChannel support in Git for Windows","fromName":"Konstantin Khomoutov","fromEmail":"kostix+git@007spb.ru","sentAt":"2016-01-15T15:59:23Z","receivedAt":"2016-01-15T15:59:23Z","isPatch":false,"sender":{"key":"kostix+git@007spb.ru","avatar":null},"body":"On Fri, 15 Jan 2016 10:04:17 -0500\nRobert Labrie wrote:\n\n[...]\n> But it would be more awesome if git just supported schannel on\n> Windows. I think cURL does already.\n\nOn the one hand, yes -- that would mean tighter integration into the\nsystem which is a good thing from the administrative standpoint.\n\nOn the other hand, IIUC, this artifically limits the capabilities of\nGit to whatever set of features the schannel implementation in a\nparticular version of Windows supports. As a glaring example, support\nfor TLS 1.1 and TLS 1.2 had never made it into Windows XP (and\nsupposedly Windows Server 2003, though I may be wrong) despite its\nserious entrenchment. Among other things, that included IE (6, then 7,\nthen 8). I do understand the reasons MS validly has for its push on its\ncustomers for upgrades, but ubiquitous OSes nearing their EOL become\nprone to lacking of certain features in their stacks. This well might\nbe true for Windows 7 some 5 years down the road or so: from where I\nsit, it looks like corporate users have zero reasons to upgrade to 10.\n\nHence ideally there would be some switch which would make libCURL pick\nthe implementation at runtime. But I'm afraid it's hardly doable.\n"},{"id":"276164","messageId":"CA+1xWarcXz4RdgXd8p-43sQ5UeRAwXmrsU_JVqwewmro7rz2Gw@mail.gmail.com","threadId":"41199","inReplyTo":"20160115185923.1e9fe5220b623625fdbc8041@domain007.com","subject":"Re: SChannel support in Git for Windows","fromName":"Robert Labrie","fromEmail":"robert.labrie@gmail.com","sentAt":"2016-01-15T16:11:58Z","receivedAt":"2016-01-15T16:11:58Z","isPatch":false,"sender":{"key":"robert.labrie@gmail.com","avatar":null},"body":"You are correct, SChannel in NT 5.x is limited, but all those versions\nare officially out of support.\n\nWhen you're part of a Windows ecosystem, those root certs get pushed\ninto the local store by a GPO (usually), and you don't have to think\nabout it. That's the only reason I'm pushing.\n\nSounds like libcurl can't make it a run time consideration, and git\n(understandably) doesn't want to worry about SChannel limitations in\nvery old versions of Windows.\n\nDoes git use libcurl for everything? I wonder if I could just drop my\nown libraries with WinHTTP support?\n\nOn Fri, Jan 15, 2016 at 10:59 AM, Konstantin Khomoutov\n wrote:\n> On Fri, 15 Jan 2016 10:04:17 -0500\n> Robert Labrie wrote:\n>\n> [...]\n>> But it would be more awesome if git just supported schannel on\n>> Windows. I think cURL does already.\n>\n> On the one hand, yes -- that would mean tighter integration into the\n> system which is a good thing from the administrative standpoint.\n>\n> On the other hand, IIUC, this artifically limits the capabilities of\n> Git to whatever set of features the schannel implementation in a\n> particular version of Windows supports. As a glaring example, support\n> for TLS 1.1 and TLS 1.2 had never made it into Windows XP (and\n> supposedly Windows Server 2003, though I may be wrong) despite its\n> serious entrenchment. Among other things, that included IE (6, then 7,\n> then 8). I do understand the reasons MS validly has for its push on its\n> customers for upgrades, but ubiquitous OSes nearing their EOL become\n> prone to lacking of certain features in their stacks. This well might\n> be true for Windows 7 some 5 years down the road or so: from where I\n> sit, it looks like corporate users have zero reasons to upgrade to 10.\n>\n> Hence ideally there would be some switch which would make libCURL pick\n> the implementation at runtime. But I'm afraid it's hardly doable.\n"},{"id":"276166","messageId":"20160115194746.abcb4b7dab4653d222e0362c@domain007.com","threadId":"41199","inReplyTo":"CA+1xWarcXz4RdgXd8p-43sQ5UeRAwXmrsU_JVqwewmro7rz2Gw@mail.gmail.com","subject":"Re: SChannel support in Git for Windows","fromName":"Konstantin Khomoutov","fromEmail":"kostix+git@007spb.ru","sentAt":"2016-01-15T16:47:46Z","receivedAt":"2016-01-15T16:47:46Z","isPatch":false,"sender":{"key":"kostix+git@007spb.ru","avatar":null},"body":"On Fri, 15 Jan 2016 11:11:58 -0500\nRobert Labrie wrote:\n\n> You are correct, SChannel in NT 5.x is limited, but all those versions\n> are officially out of support.\n> \n> When you're part of a Windows ecosystem, those root certs get pushed\n> into the local store by a GPO (usually), and you don't have to think\n> about it. That's the only reason I'm pushing.\n> \n> Sounds like libcurl can't make it a run time consideration, and git\n> (understandably) doesn't want to worry about SChannel limitations in\n> very old versions of Windows.\n> \n> Does git use libcurl for everything? I wonder if I could just drop my\n> own libraries with WinHTTP support?\n\nI'd say you could fork the Git for Windows's SDK [1], hack it to build\ncurl with the configuration you need and then create your own\ninstaller. You'll need to rebase your patch each time a new GfW\nrelease will come out, but the patch should be small enough IMO.\n\n1. https://github.com/git-for-windows/build-extra/releases/latest\n"}]}