2.41+ update from 2.39.1 breaks curl OpenSSL standalone functionality

[ivanxpetrov]

• I was not able to find an open or closed issue matching what I'm seeing

Setup

• Which version of Git for Windows are you using? Is it 32-bit or 64-bit?
  64bit

$ git --version --build-options

cpu: x86_64
built from commit: 4b968f3ea3b32a7bc50846bab49f3f381841d297
sizeof-long: 4
sizeof-size_t: 8
shell-path: /bin/sh
feature: fsmonitor--daemon

• Which version of Windows are you running? Vista, 7, 8, 10? Is it 32-bit or 64-bit?
  Windows 7

$ cmd.exe /c ver

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

• What options did you set as part of the installation? Or did you choose the
  defaults?
  Defaults while upgrading

# One of the following:
> type "C:\Program Files\Git\etc\install-options.txt"
> type "C:\Program Files (x86)\Git\etc\install-options.txt"
> type "%USERPROFILE%\AppData\Local\Programs\Git\etc\install-options.txt"
> type "$env:USERPROFILE\AppData\Local\Programs\Git\etc\install-options.txt"
$ cat /etc/install-options.txt

Editor Option: VIM
Custom Editor Path:
Default Branch Option:
Path Option: Cmd
SSH Option: OpenSSH
Tortoise Option: false
CURL Option: OpenSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Git Pull Behavior Option: Merge
Use Credential Manager: Enabled
Performance Tweaks FSCache: Enabled
Enable Symlinks: Enabled
Enable Pseudo Console Support: Disabled
Enable FSMonitor: Disabled

• Any other interesting things about your environment that might be related
  to the issue you're seeing?

** insert your response here **

Details

• Which terminal/shell are you running Git from? e.g Bash/CMD/PowerShell/other

Bash

• What commands did you run to trigger this issue? If you can provide a
  Minimal, Complete, and Verifiable example
  this will help us understand the issue.

curl https://somesite.com

• What did you expect to occur after running these commands?

get the response

• What actually happened instead?

Schannel erors

• If the problem was occurring with a specific repository, can you provide the
  URL to that repository to help us with testing?

** insert URL here **

I would expect when upgrading to not have curl be broken by relying completely on Schanel even though the previous installation specified the CURLOption to be OpenSSL.

Is there a way to have the curl binary to be compiled like this:

curl 8.4.0 (x86_64-w64-mingw32) libcurl/8.4.0 OpenSSL/3.1.2 (Schannel) (https://curl.se/windows/dl-8.4.0_1/)

and not like this
curl 8.2.1 (x86_64-w64-mingw32) libcurl/8.2.1 Schannel

I am personally using Git bash not just for Git activities, and having curl not work with OpenSSL in any way (after several hours I couldn't find a way - please let me know if there is one) is breaking the functionality I came to expect. With no warning.

The only workaround I found is to replace the curl.exe with the one from link above -> (https://curl.se/windows/dl-8.4.0_1/). Not sure if that's gonna break something for git.

[dscho]

The purpose of Git for Windows is really to bring Git to Windows.

While that implies that we have to ship quite a few Unix-like tools, it does not mean that we will include such tools unless they are needed for Git's own operations, or at least for historical reasons (needs of active contributors are sometimes a factor in deciding whether to include a tool or not).

One of those Unix-like tools is curl.exe, and while it was historically the case that the curl.exe we distributed was linked to OpenSSL, it no longer does that, for a good reason: Linking it to OpenSSL prevented Git for Windows' internal mechanics from upgrading to OpenSSL v3.x.

It seems that you argue that this constitutes a regression in Git for Windows, but I consider curl.exe a by-product of Git for Windows that is essentially only included because Git's own commands need it (for example git update-git-for-windows).

Now, if you want to work on a PR to let the curl.exe that is distributed along with Git for Windows follow the same dynamic linking strategy as git-remote-https.exe, I will most likely be glad to merge it. But it is not exactly a trivial project, and I cannot justify working on it, seeing as it is so vastly outside Git for Windows' supported functionality.

Having said that, you might want to look at MSYS2. Git for Windows leverages MSYS2 and ships with a subset of its files. MSYS2 even sports a package management system called "pacman" to install more tools (including Git...), so why don't you give it a whirl?

[ivanxpetrov]

Thanks for the suggestion. I have installed MSYS2 a while back.

Would something bad happen to git's internal operations if I modify the PATH variable for GitBash to hit the MSYS2 version of curl before the built-in Schannel one?

[dscho]

Would something bad happen to git's internal operations if I modify the PATH variable for GitBash to hit the MSYS2 version of curl before the built-in Schannel one?

I wouldn't expect anything bad to happen because the .dll files in the same directory as git.exe would be preferred over the ones earlier in the PATH, otherwise you would potentially run into issues with incompatible dependencies.

[cassassi]

Hello,

I indeed see that my issue #4829 was already discussed; I apologize for not being able to find the link.

While installing the software, we still have the possibility to choose between using ca-bundle.crt or the Windows certificate store, which is not the case because ultimately Windows Secure Channel is selected even if we choose OpenSSL.

Referring to dscho's response, which suggests that this is not a regression, you may consider removing the option to choose OpenSSL and defaulting to using Windows Secure Channel.

[dscho]

I have a lot of sympathy for the desire to let the Git installer option control the behavior of curl.exe.

It won't be trivial to implement, and due to a reorg at my dayjob, the time I can spend on Git for Windows is substantially reduced. With all that in mind, I'd be happy to provide pointers, assistance, and moral support to anyone who takes the initiative to implement this.

Any takers?