SSL/TLS implementation

[inoperable]

Is the SSL/TLS part of Winget connection handling or - implementation of that, part of its OSS label or that is actually the OS part? I tried to have a SSLKEYLOGFILE and winget seems not to do what every other OSS labelled software does - compared. For example, git.exe - so, is there a OSS vs not OSS dependency list?

[denelon]

@inoperable, I've converted the issue to a discussion. I'll ask our engineering team to respond.

[JohnMcPMS]

winget relies on the OS APIs for TLS.

[denelon]

I ran a query against CoPilot:

1. Main Directories in src/
   The src folder contains several major subsystems:

AppInstallerCLI - Main CLI application entry point
AppInstallerCLICore - Core CLI functionality (commands, workflows, portable installer)
AppInstallerCommonCore - Shared utilities (downloading, networking, manifest handling)
AppInstallerRepositoryCore - Repository/source management
AppInstallerSharedLib - Shared library code (certificates, group policy)
CertificateResources - Certificate files and resources
Microsoft.Management.Deployment - COM/SDK management APIs
Microsoft.Management.Configuration - Configuration management
2. Code Related to Downloading Installers
Key files in /src/AppInstallerCommonCore/:

Downloader.cpp/h - Main download implementation using WinINet
DODownloader.cpp/h - Delivery Optimization downloader as a fallback mechanism
HttpStream/ - HTTP streaming components:
HttpClientWrapper.cpp/h - Windows.Web.Http client wrapper
HttpRandomAccessStream.cpp/h - Random access streaming for downloads
HttpLocalCache.cpp/h - Local caching for HTTP downloads
Command layer: /src/AppInstallerCLICore/Commands/

DownloadCommand.cpp/h - CLI download command
3. Code Related to Secure Connections (HTTPS/TLS/Certificates)
Certificate Management:

/src/AppInstallerSharedLib/Public/winget/Certificates.h - Certificate pinning validation with support for:
Public key pinning
Subject/Issuer validation
Certificate chain validation
Partial chain support
Certificate Resources:

/src/CertificateResources/ - Contains actual certificate files:
Microsoft_TLS_ECC_Root_G2.crt
Microsoft_TLS_RSA_Root_G2.crt
Store intermediate and root certificates
Network Settings:

HttpClientHelper.cpp/h - HTTP client configuration
NetworkSettings.cpp/h - Network configuration (proxy, etc.)
Authentication/ - Web account manager authentication
The architecture uses WinINet for basic HTTP downloads with Delivery Optimization (DO) as a fallback for efficiency, combined with Windows' built-in TLS/certificate validation systems and custom certificate pinning for security.

[denelon]

🔑 Key Findings - Where is the Secure Connection Code?
Primary Installer Download:

File: src/AppInstallerCommonCore/Downloader.cpp
Lines 146-151, 155-160: InternetOpen() - Initializes WinINet with HTTPS/TLS
Lines 178-184: InternetOpenUrl() - Opens secure HTTPS connection
Line 247: InternetReadFile() - Reads encrypted data
Certificate Pinning (Enhanced Security):

Implementation: src/AppInstallerSharedLib/Certificates.cpp
Header: src/AppInstallerSharedLib/Public/winget/Certificates.h
Usage: src/AppInstallerCommonCore/HttpClientHelper.cpp
Lines 28-44: Certificate validation function
Lines 188-194: Pinning configuration
Certificate Resources:

Directory: src/CertificateResources/
Contains Microsoft root certificates for pinning validation

[inoperable]

So you need copilot to search a "well documented" api? well, thanks for the tip, i guess

[inoperable]

IN short, this means standard oss debugging tools like, SSLKEYLOGFILE dump - will never work here, correct?
If I need to inspect the traffic for debugging, I am forced to use some kind of proxy to do so

[denelon]

So you need copilot to search a "well documented" api? well, thanks for the tip, i guess

I'm not a software engineer. I was searching for where in the WinGet code, the Operating System related calls were being made.