{"thread":{"id":"52494","subject":"Cygwin git with schannel (\"native Windows Secure Channel library\")","startedAt":"2019-12-20T01:52:19Z","lastAt":"2019-12-21T23:14:01Z","messageCount":4,"participants":["Keith Thompson","brian m. carlson","Beat Bolli"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"388605","messageId":"CAAHpriOh=9Mh7_moxWCzXBHYTtNi9TOQQPBxa4CX=uLgOnpNtw@mail.gmail.com","threadId":"52494","inReplyTo":null,"subject":"Cygwin git with schannel (\"native Windows Secure Channel library\")","fromName":"Keith Thompson","fromEmail":"keith.s.thompson@gmail.com","sentAt":"2019-12-20T01:52:04Z","receivedAt":"2019-12-20T01:52:19Z","isPatch":false,"sender":{"key":"keith.s.thompson@gmail.com","avatar":"https://gravatar.com/avatar/2cd597778c4fcea958f6ff673882f768bd9506a95bc509925cb7eff718601cd5?d=mp&s=160"},"body":"I've posted this on Stack Overflow\nhttps://stackoverflow.com/q/59381061/827263\nbut I haven't gotten any responses yet.\n\nWhen I install \"Git for Windows\" on Windows 10, the installation\nwizard offers the choice of using either the OpenSSL library or the\n\"native Windows Secure Channel library\".  (Whether that's offered\nseems to depend on what's available on the Windows 10 system.)\nI believe this is referred to in the git sources as \"schannel\".\n\nIs there a way to configure git under Cygwin to use the native\nWindows Secure Channel library?  An ideal solution would be a\nmodification to my .gitconfig, but something that lets me build git\n(and possibly curl) from source would also be good.  See my Stack\nOverflow question for more details, including some things that I\ntried that didn't work.\n\nThe problem I'm trying to solve: In my work environment, I can\nuse Cygwin git for local operations, but I have to use Windows git\nfor anything that talks to a remote (push, pull).I'd prefer to use\nCygwin git exclusively.\n"},{"id":"388697","messageId":"20191220231840.GD163225@camp.crustytoothpaste.net","threadId":"52494","inReplyTo":"CAAHpriOh=9Mh7_moxWCzXBHYTtNi9TOQQPBxa4CX=uLgOnpNtw@mail.gmail.com","subject":"Re: Cygwin git with schannel (\"native Windows Secure Channel library\")","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2019-12-20T23:18:40Z","receivedAt":"2019-12-20T23:18:48Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2019-12-20 at 01:52:04, Keith Thompson wrote:\n> I've posted this on Stack Overflow\n> https://stackoverflow.com/q/59381061/827263\n> but I haven't gotten any responses yet.\n> \n> When I install \"Git for Windows\" on Windows 10, the installation\n> wizard offers the choice of using either the OpenSSL library or the\n> \"native Windows Secure Channel library\".  (Whether that's offered\n> seems to depend on what's available on the Windows 10 system.)\n> I believe this is referred to in the git sources as \"schannel\".\n> \n> Is there a way to configure git under Cygwin to use the native\n> Windows Secure Channel library?  An ideal solution would be a\n> modification to my .gitconfig, but something that lets me build git\n> (and possibly curl) from source would also be good.  See my Stack\n> Overflow question for more details, including some things that I\n> tried that didn't work.\n> \n> The problem I'm trying to solve: In my work environment, I can\n> use Cygwin git for local operations, but I have to use Windows git\n> for anything that talks to a remote (push, pull).I'd prefer to use\n> Cygwin git exclusively.\n\nI'm not 100% certain here, but I believe the answer is no.  In order to\nuse SChannel, you'll need to link against MSVCRT or a compatible\nruntime, but it's not possible to link against both that and Cygwin at\nthe same time (probably because they both provide the same symbols).\n\nIf your constraint is that you need to interact with the Windows\ncertificate store or such, you could see if there's an OpenSSL or GnuTLS\nplugin that will do that for you and then build against that library or\nplugin.\n-- \nbrian m. carlson: Houston, Texas, US\nOpenPGP: https://keybase.io/bk2204\n"},{"id":"388709","messageId":"236e2b6b-d1ce-b0f2-ff56-4ca5e0dfb8e8@drbeat.li","threadId":"52494","inReplyTo":"20191220231840.GD163225@camp.crustytoothpaste.net","subject":"Re: Cygwin git with schannel (\"native Windows Secure Channel library\")","fromName":"Beat Bolli","fromEmail":"dev+git@drbeat.li","sentAt":"2019-12-21T11:50:59Z","receivedAt":"2019-12-21T11:51:11Z","isPatch":false,"sender":{"key":"dev+git@drbeat.li","avatar":"https://avatars.githubusercontent.com/u/21444?v=4"},"body":"On 21.12.19 00:18, brian m. carlson wrote:\n> On 2019-12-20 at 01:52:04, Keith Thompson wrote:\n>> I've posted this on Stack Overflow\n>> https://stackoverflow.com/q/59381061/827263\n>> but I haven't gotten any responses yet.\n>>\n>> When I install \"Git for Windows\" on Windows 10, the installation\n>> wizard offers the choice of using either the OpenSSL library or the\n>> \"native Windows Secure Channel library\".  (Whether that's offered\n>> seems to depend on what's available on the Windows 10 system.)\n>> I believe this is referred to in the git sources as \"schannel\".\n>>\n>> Is there a way to configure git under Cygwin to use the native\n>> Windows Secure Channel library?  An ideal solution would be a\n>> modification to my .gitconfig, but something that lets me build git\n>> (and possibly curl) from source would also be good.  See my Stack\n>> Overflow question for more details, including some things that I\n>> tried that didn't work.\n>>\n>> The problem I'm trying to solve: In my work environment, I can\n>> use Cygwin git for local operations, but I have to use Windows git\n>> for anything that talks to a remote (push, pull).I'd prefer to use\n>> Cygwin git exclusively.\n> \n> I'm not 100% certain here, but I believe the answer is no.  In order to\n> use SChannel, you'll need to link against MSVCRT or a compatible\n> runtime, but it's not possible to link against both that and Cygwin at\n> the same time (probably because they both provide the same symbols).\n> \n> If your constraint is that you need to interact with the Windows\n> certificate store or such, you could see if there's an OpenSSL or GnuTLS\n> plugin that will do that for you and then build against that library or\n> plugin.\n\nThere is the OpenSSL \"CAPI\" engine which interfaces with the Windows\nCryptoAPI. However, I don't know if the Cygwin OpenSSL build includes\nthis engine.\n\nCheers, Beat\n\n"},{"id":"388766","messageId":"CAAHpriN4qyCymvuW=o5NO63TixqwCQZxrC26e8WyDQH1+=D7SA@mail.gmail.com","threadId":"52494","inReplyTo":"236e2b6b-d1ce-b0f2-ff56-4ca5e0dfb8e8@drbeat.li","subject":"Re: Cygwin git with schannel (\"native Windows Secure Channel library\")","fromName":"Keith Thompson","fromEmail":"keith.s.thompson@gmail.com","sentAt":"2019-12-21T23:13:45Z","receivedAt":"2019-12-21T23:14:01Z","isPatch":false,"sender":{"key":"keith.s.thompson@gmail.com","avatar":"https://gravatar.com/avatar/2cd597778c4fcea958f6ff673882f768bd9506a95bc509925cb7eff718601cd5?d=mp&s=160"},"body":"On Sat, Dec 21, 2019 at 3:51 AM Beat Bolli <dev+git@drbeat.li> wrote:\n> On 21.12.19 00:18, brian m. carlson wrote:\n> > On 2019-12-20 at 01:52:04, Keith Thompson wrote:\n> >> I've posted this on Stack Overflow\n> >> https://stackoverflow.com/q/59381061/827263\n> >> but I haven't gotten any responses yet.\n> >>\n> >> When I install \"Git for Windows\" on Windows 10, the installation\n> >> wizard offers the choice of using either the OpenSSL library or the\n> >> \"native Windows Secure Channel library\".  (Whether that's offered\n> >> seems to depend on what's available on the Windows 10 system.)\n> >> I believe this is referred to in the git sources as \"schannel\".\n> >>\n> >> Is there a way to configure git under Cygwin to use the native\n> >> Windows Secure Channel library?  An ideal solution would be a\n> >> modification to my .gitconfig, but something that lets me build git\n> >> (and possibly curl) from source would also be good.  See my Stack\n> >> Overflow question for more details, including some things that I\n> >> tried that didn't work.\n> >>\n> >> The problem I'm trying to solve: In my work environment, I can\n> >> use Cygwin git for local operations, but I have to use Windows git\n> >> for anything that talks to a remote (push, pull).I'd prefer to use\n> >> Cygwin git exclusively.\n> >\n> > I'm not 100% certain here, but I believe the answer is no.  In order to\n> > use SChannel, you'll need to link against MSVCRT or a compatible\n> > runtime, but it's not possible to link against both that and Cygwin at\n> > the same time (probably because they both provide the same symbols).\n> >\n> > If your constraint is that you need to interact with the Windows\n> > certificate store or such, you could see if there's an OpenSSL or GnuTLS\n> > plugin that will do that for you and then build against that library or\n> > plugin.\n>\n> There is the OpenSSL \"CAPI\" engine which interfaces with the Windows\n> CryptoAPI. However, I don't know if the Cygwin OpenSSL build includes\n> this engine.\n\nThat's interesting.  I just tried building OpenSSL from source on\nCygwin (openssl-1.1.1d.tar.gz).  It installed lib/engines-1.1/capi.dll\nunder the installation directory, and I see references to capi in the\noutput of \"make\".  The Cygwin-installed OpenSSL (currently 1.1.1d)\ndoesn't provide that file.  I don't know whether or not that means\nthe Cygwin-installed OpenSSL doesn't support CAPI.\n\nIs there an openssl command I can run to tell whether it supports CAPI?\n(Disclaimer: I had never heard of CAPI before.)  With both the Cygwin-installed\nOpenSSL and the one I built from source, I get:\n\n$ openssl engine capi\n25769803792:error:260B606D:engine routines:dynamic_load:init\nfailed:crypto/engine/eng_dyn.c:485:\n25769803792:error:2606A074:engine routines:ENGINE_by_id:no such\nengine:crypto/engine/eng_list.c:334:id=capi\n\n*Maybe* if I compile OpenSSL from source, then compile curl\nfrom source using my compiled OpenSSL, then compile Windows Git\nfrom source using my compiled OpenSSL and curl, it *might* work?\nIt's worth a shot.\n\nAnd if the Cygwin-installed OpenSSL doesn't support CAPI, I wonder\nwhy it doesn't.\n"}]}