SSL/TLS implementation

[inoperable]

Is the SSL/TLS part of Winget connection handling or - implementation of that, part of its OSS label or that is actually the OS part? I tried to have a SSLKEYLOGFILE and winget seems not to do what every other OSS labelled software does - compared. For example, git.exe - so, is there a OSS vs not OSS dependency list?

[denelon]

@inoperable, I've converted the issue to a discussion. I'll ask our engineering team to respond.

[JohnMcPMS]

winget relies on the OS APIs for TLS.

[denelon]

I ran a query against CoPilot:

1. Main Directories in src/
   The src folder contains several major subsystems:

AppInstallerCLI - Main CLI application entry point
AppInstallerCLICore - Core CLI functionality (commands, workflows, portable installer)
AppInstallerCommonCore - Shared utilities (downloading, networking, manifest handling)
AppInstallerRepositoryCore - Repository/source management
AppInstallerSharedLib - Shared library code (certificates, group policy)
CertificateResources - Certificate files and resources
Microsoft.Management.Deployment - COM/SDK management APIs
Microsoft.Management.Configuration - Configuration management
2. Code Related to Downloading Installers
Key files in /src/AppInstallerCommonCore/:

Downloader.cpp/h - Main download implementation using WinINet
DODownloader.cpp/h - Delivery Optimization downloader as a fallback mechanism
HttpStream/ - HTTP streaming components:
HttpClientWrapper.cpp/h - Windows.Web.Http client wrapper
HttpRandomAccessStream.cpp/h - Random access streaming for downloads
HttpLocalCache.cpp/h - Local caching for HTTP downloads
Command layer: /src/AppInstallerCLICore/Commands/

DownloadCommand.cpp/h - CLI download command
3. Code Related to Secure Connections (HTTPS/TLS/Certificates)
Certificate Management:

/src/AppInstallerSharedLib/Public/winget/Certificates.h - Certificate pinning validation with support for:
Public key pinning
Subject/Issuer validation
Certificate chain validation
Partial chain support
Certificate Resources:

/src/CertificateResources/ - Contains actual certificate files:
Microsoft_TLS_ECC_Root_G2.crt
Microsoft_TLS_RSA_Root_G2.crt
Store intermediate and root certificates
Network Settings:

HttpClientHelper.cpp/h - HTTP client configuration
NetworkSettings.cpp/h - Network configuration (proxy, etc.)
Authentication/ - Web account manager authentication
The architecture uses WinINet for basic HTTP downloads with Delivery Optimization (DO) as a fallback for efficiency, combined with Windows' built-in TLS/certificate validation systems and custom certificate pinning for security.

[denelon]

🔑 Key Findings - Where is the Secure Connection Code?
Primary Installer Download:

File: src/AppInstallerCommonCore/Downloader.cpp
Lines 146-151, 155-160: InternetOpen() - Initializes WinINet with HTTPS/TLS
Lines 178-184: InternetOpenUrl() - Opens secure HTTPS connection
Line 247: InternetReadFile() - Reads encrypted data
Certificate Pinning (Enhanced Security):

Implementation: src/AppInstallerSharedLib/Certificates.cpp
Header: src/AppInstallerSharedLib/Public/winget/Certificates.h
Usage: src/AppInstallerCommonCore/HttpClientHelper.cpp
Lines 28-44: Certificate validation function
Lines 188-194: Pinning configuration
Certificate Resources:

Directory: src/CertificateResources/
Contains Microsoft root certificates for pinning validation

[inoperable]

So you need copilot to search a "well documented" api? well, thanks for the tip, i guess

[inoperable]

IN short, this means standard oss debugging tools like, SSLKEYLOGFILE dump - will never work here, correct?
If I need to inspect the traffic for debugging, I am forced to use some kind of proxy to do so

[denelon]

So you need copilot to search a "well documented" api? well, thanks for the tip, i guess

I'm not a software engineer. I was searching for where in the WinGet code, the Operating System related calls were being made.

[florelis]

Out of curiosity, what are you trying to do that requires inspecting the traffic?

winget doesn't care about the implementation of TLS/SSL and just uses what the OS provides natively. AFAICT from the docs, that is Schannel, which, as you say, does not support SSLKEYLOGFILE. If we know what you are trying to do, we may be able to suggest alternatives.