Re: SChannel support in Git for Windows
You are correct, SChannel in NT 5.x is limited, but all those versions are officially out of support.
When you're part of a Windows ecosystem, those root certs get pushed into the local store by a GPO (usually), and you don't have to think about it. That's the only reason I'm pushing.
Sounds like libcurl can't make it a run time consideration, and git (understandably) doesn't want to worry about SChannel limitations in very old versions of Windows.
Does git use libcurl for everything? I wonder if I could just drop my own libraries with WinHTTP support?
On Fri, Jan 15, 2016 at 10:59 AM, Konstantin Khomoutov <kostix+git@007spb.ru> wrote:
Show 24 quoted lines
> On Fri, 15 Jan 2016 10:04:17 -0500
> Robert Labrie <robert.labrie@gmail.com> wrote:
>
> [...]
>> But it would be more awesome if git just supported schannel on
>> Windows. I think cURL does already.
>
> On the one hand, yes -- that would mean tighter integration into the
> system which is a good thing from the administrative standpoint.
>
> On the other hand, IIUC, this artifically limits the capabilities of
> Git to whatever set of features the schannel implementation in a
> particular version of Windows supports. As a glaring example, support
> for TLS 1.1 and TLS 1.2 had never made it into Windows XP (and
> supposedly Windows Server 2003, though I may be wrong) despite its
> serious entrenchment. Among other things, that included IE (6, then 7,
> then 8). I do understand the reasons MS validly has for its push on its
> customers for upgrades, but ubiquitous OSes nearing their EOL become
> prone to lacking of certain features in their stacks. This well might
> be true for Windows 7 some 5 years down the road or so: from where I
> sit, it looks like corporate users have zero reasons to upgrade to 10.
>
> Hence ideally there would be some switch which would make libCURL pick
> the implementation at runtime. But I'm afraid it's hardly doable.
