The certificate callback should support pass-through

[carlosmn]

This callback wants a response from the callback; if we have none to give (we're wrapping the callbacks in some language, so we always end up setting the fields) we should be able to tell libgit2 not to take our answer into account.

Returning GIT_PASSTHROUGH should make the callers of the callback behave as though it was not there, like they do with the credentials callback.

[SantiagoTorres]

Hi, @carlosmn. I'd like to work on this ticket. What is a good place to start looking into it?
I'm already familiar with some of the codebase, but I don't seem to pinpoint:

• which is the credentials callback? I'm looking at this. Or is this the right one?
• which is the certificate callback?

Thanks!

[carlosmn]

The credentials callback is a field in the git_remote_callbacks structure, passed in their respective options to fetch and push. The transports are then passed in the callbacks via a setter function. For SSH, the call to it is done in line 426. The HTTP backends do something similar.

The certificate callback is another one of the remote callback fields, called by the transports (or their underlying IO streams). Each of the connection methods calls this certificate when they receive the server's certificate (or hostkey for SSH). E.g. in (line 558)[https://github.com/libgit2/libgit2/blob/a8d0b4de92b83745308b2d9af0f62828bfb550a1/src/transports/ssh.c#L558]. It currently returns an error for any error value returned by the callback. It should instead check if it's GIT_EPASSTHROUGH and then do what it would do if the callback weren't set.

The OpenSSL, SecureTransport and WinHTTP code also calls the certificate callback, so those need to be converted as well.