From 60b8cb425299af07b1723c367dfeb20ea293fe6c Mon Sep 17 00:00:00 2001
From: ns-ylambert <ylambert@netskope.com>
Date: Wed, 30 Sep 2026 19:16:25 +0200
Subject: [PATCH] curl-rust: feature-gate schannel and windows-sys deps behind
 windows-cert-store

The `schannel` and `windows-sys` crates are used only by `src/easy/windows.rs`
to bridge Windows' ROOT cert store into OpenSSL's SSL_CTX trust store. That
bridge is only meaningful when curl is built against OpenSSL on Windows via
the `windows-static-ssl` feature:

- Under `ssl` on Windows, libcurl uses Schannel, which reads the Windows trust
  store natively. No OpenSSL SSL_CTX bridge is needed.
- Under `rustls`, there is no OpenSSL SSL_CTX at all.
- Under bare (no TLS) builds, same: no OpenSSL, no bridge needed.

Introduce a `windows-cert-store` intermediate feature that opts in both crates
via `dep:` and have `windows-static-ssl` enable it. Tighten the `#[cfg]` guards
on `windows.rs` to require the feature so the entire schannel-crate-based code
path compiles out for `ssl`, `rustls`, and bare builds.
---
 Cargo.toml          | 16 ++++++++++++----
 src/easy/windows.rs |  6 +++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 1dda47c5a..a41051152 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,9 +22,9 @@ socket2 = "0.6.0"
 openssl-sys = { workspace = true, optional = true }
 openssl-probe = { version = "0.1.2", optional = true }
 
-[target.'cfg(target_env = "msvc")'.dependencies]
-schannel = "0.1.13"
-windows-sys = { workspace = true, features = ["Win32_Foundation", "Win32_System_LibraryLoader", "Win32_Security_Cryptography"] }
+[target.'cfg(windows)'.dependencies]
+schannel = { version = "0.1.13", optional = true }
+windows-sys = { workspace = true, optional = true, features = ["Win32_Foundation", "Win32_System_LibraryLoader", "Win32_Security_Cryptography"] }
 
 [dev-dependencies]
 mio = "0.6"
@@ -48,7 +48,15 @@ spnego = ["curl-sys/spnego"]
 rustls = ["curl-sys/rustls"]
 static-curl = ["curl-sys/static-curl"]
 static-ssl = ["curl-sys/static-ssl"]
-windows-static-ssl = ["static-curl", "curl-sys/windows-static-ssl"]
+windows-cert-store = [
+    "dep:schannel",
+    "dep:windows-sys",
+]
+windows-static-ssl = [
+    "static-curl",
+    "curl-sys/windows-static-ssl",
+    "windows-cert-store",
+]
 force-system-lib-on-osx = ['curl-sys/force-system-lib-on-osx']
 protocol-ftp = ["curl-sys/protocol-ftp"]
 zlib-ng-compat = ["curl-sys/zlib-ng-compat", "static-curl"]
diff --git a/src/easy/windows.rs b/src/easy/windows.rs
index b56d44651..f8ab5ad27 100644
--- a/src/easy/windows.rs
+++ b/src/easy/windows.rs
@@ -2,7 +2,7 @@
 
 use libc::c_void;
 
-#[cfg(target_env = "msvc")]
+#[cfg(all(windows, feature = "windows-cert-store"))]
 mod win {
     use schannel::cert_context::ValidUses;
     use schannel::cert_store::CertStore;
@@ -116,12 +116,12 @@ mod win {
     }
 }
 
-#[cfg(target_env = "msvc")]
+#[cfg(all(windows, feature = "windows-cert-store"))]
 pub fn add_certs_to_context(ssl_ctx: *mut c_void) {
     unsafe {
         win::add_certs_to_context(ssl_ctx as *mut _);
     }
 }
 
-#[cfg(not(target_env = "msvc"))]
+#[cfg(not(all(windows, feature = "windows-cert-store")))]
 pub fn add_certs_to_context(_: *mut c_void) {}