Re: SChannel support in Git for Windows

[Robert Labrie <robert.labrie@gmail.com>]

You are correct, SChannel in NT 5.x is limited, but all those versions
are officially out of support.

When you're part of a Windows ecosystem, those root certs get pushed
into the local store by a GPO (usually), and you don't have to think
about it. That's the only reason I'm pushing.

Sounds like libcurl can't make it a run time consideration, and git
(understandably) doesn't want to worry about SChannel limitations in
very old versions of Windows.

Does git use libcurl for everything? I wonder if I could just drop my
own libraries with WinHTTP support?

On Fri, Jan 15, 2016 at 10:59 AM, Konstantin Khomoutov
<kostix+git@007spb.ru> wrote:
> On Fri, 15 Jan 2016 10:04:17 -0500
> Robert Labrie <robert.labrie@gmail.com> wrote:
>
> [...]
>> But it would be more awesome if git just supported schannel on
>> Windows. I think cURL does already.
>
> On the one hand, yes -- that would mean tighter integration into the
> system which is a good thing from the administrative standpoint.
>
> On the other hand, IIUC, this artifically limits the capabilities of
> Git to whatever set of features the schannel implementation in a
> particular version of Windows supports.  As a glaring example, support
> for TLS 1.1 and TLS 1.2 had never made it into Windows XP (and
> supposedly Windows Server 2003, though I may be wrong) despite its
> serious entrenchment.  Among other things, that included IE (6, then 7,
> then 8).  I do understand the reasons MS validly has for its push on its
> customers for upgrades, but ubiquitous OSes nearing their EOL become
> prone to lacking of certain features in their stacks.  This well might
> be true for Windows 7 some 5 years down the road or so: from where I
> sit, it looks like corporate users have zero reasons to upgrade to 10.
>
> Hence ideally there would be some switch which would make libCURL pick
> the implementation at runtime.  But I'm afraid it's hardly doable.