Try schannel on MSYS2

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

Author: jviotti

.github/workflows/ci.yml

@@ -77,7 +77,7 @@ jobs:
         uses: msys2/setup-msys2@v2
         if: matrix.platform.shell == 'msys2 {0}'
         with:
-          install: cmake make gcc ca-certificates
+          install: cmake make gcc
 
       - uses: actions/checkout@v4
       - name: Install dependencies (macOS)

CMakeLists.txt

@@ -39,8 +39,8 @@ if(CMAKE_SYSTEM_NAME STREQUAL "MSYS")
 endif()
 
 find_package(ZLIB REQUIRED)
-# mbedTLS is only used on non-Windows platforms (Windows uses Schannel for SSL)
-if(NOT WIN32)
+# mbedTLS is only used on Unix platforms (Windows/MSYS2 use Schannel for SSL)
+if(NOT WIN32 AND NOT CMAKE_SYSTEM_NAME STREQUAL "MSYS")
   find_package(MbedTLS REQUIRED)
 endif()
 find_package(Nghttp2 REQUIRED)

cmake/FindCURL.cmake

@@ -434,10 +434,11 @@ if(NOT CURL_FOUND)
   target_compile_definitions(curl PRIVATE _UNICODE)
   target_compile_definitions(curl PRIVATE HTTP_ONLY)
   target_compile_definitions(curl PRIVATE ENABLE_IPV6)
-  # SSL/TLS backend: Use Schannel (native) on Windows, mbedTLS on other platforms
-  # Schannel automatically uses the Windows Certificate Store for certificate validation
+  # SSL/TLS backend: Use Schannel (native) on all Windows platforms (MSVC and MSYS2),
+  # mbedTLS on Unix platforms. Schannel automatically uses the Windows Certificate Store
+  # for certificate validation, eliminating the need for manual certificate management.
   # Note: Secure Transport was deprecated by Apple and removed from CURL 8.0+
-  if(WIN32)
+  if(WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "MSYS")
     target_compile_definitions(curl PRIVATE USE_SCHANNEL)
     target_compile_definitions(curl PRIVATE USE_WINDOWS_SSPI)
   else()
@@ -489,8 +490,7 @@ if(NOT CURL_FOUND)
     target_compile_definitions(curl PRIVATE _POSIX_C_SOURCE=200809L)
   elseif(CMAKE_SYSTEM_NAME STREQUAL "MSYS")
     target_compile_definitions(curl PRIVATE CURL_OS="MSYS")
-    target_compile_definitions(curl PRIVATE CURL_CA_BUNDLE="/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem")
-    target_compile_definitions(curl PRIVATE CURL_CA_PATH="/etc/ssl/certs")
+    # Note: MSYS2 uses Schannel which automatically uses Windows Certificate Store
     target_compile_definitions(curl PRIVATE HAVE_SYS_TIME_H)
     target_compile_definitions(curl PRIVATE HAVE_LONGLONG)
     target_compile_definitions(curl PRIVATE HAVE_RECV)
@@ -537,8 +537,8 @@ if(NOT CURL_FOUND)
   target_include_directories(curl PRIVATE "${CURL_DIR}/lib")
 
   target_link_libraries(curl PRIVATE ZLIB::ZLIB)
-  # Only link mbedTLS on non-Windows platforms (Windows uses Schannel)
-  if(NOT WIN32)
+  # Only link mbedTLS on Unix platforms (Windows/MSYS2 use Schannel)
+  if(NOT WIN32 AND NOT CMAKE_SYSTEM_NAME STREQUAL "MSYS")
     target_link_libraries(curl PRIVATE MbedTLS::mbedtls)
   endif()
   target_link_libraries(curl PRIVATE Nghttp2::nghttp2)
@@ -550,10 +550,10 @@ if(NOT CURL_FOUND)
   if(APPLE)
     target_link_libraries(curl PRIVATE "-framework Foundation")
     target_link_libraries(curl PRIVATE "-framework SystemConfiguration")
-  elseif(WIN32)
+  elseif(WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "MSYS")
     target_link_libraries(curl PRIVATE ws2_32)
-    target_link_libraries(curl PRIVATE Crypt32.lib)
-    target_link_libraries(curl PRIVATE Secur32.lib)  # For SSPI/Schannel
+    target_link_libraries(curl PRIVATE Crypt32)
+    target_link_libraries(curl PRIVATE Secur32)  # For SSPI/Schannel
   endif()
 
   target_include_directories(curl PUBLIC