Commits on Mar 4, 2020

1. http: use new "best effort" strategy for Secure Channel revoke checking …

   The native Windows HTTPS backend is based on Secure Channel which lets
   the caller decide how to handle revocation checking problems caused by
   missing information in the certificate or offline CRL distribution
   points.
   
   Unfortunately, cURL chose to handle these problems differently than
   OpenSSL by default: while OpenSSL happily ignores those problems
   (essentially saying "¯\_(ツ)_/¯"), the Secure Channel backend will error
   out instead.
   
   As a remedy, the "no revoke" mode was introduced, which turns off
   revocation checking altogether. This is a bit heavy-handed. We support
   this via the `http.schannelCheckRevoke` setting.
   
   In curl/curl#4981, we contributed an opt-in
   "best effort" strategy that emulates what OpenSSL seems to do.
   
   In Git for Windows, we actually want this to be the default. This patch
   makes it so, introducing it as a new value for the
   `http.schannelCheckRevoke" setting, which now becmes a tristate: it
   accepts the values "false", "true" or "best-effort" (defaulting to the
   last one).
   
   Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

   

   dscho committed Mar 4, 2020
   Copy the full SHA

   19d37fd View commit details

   Browse the repository at this point in the history