What version of Git supports TLS 1.2?

Question

Bitbacket shutdown TLS v1.0 & v1.1. Our Jenkins fails because of old Git:

git --version
git version 1.8.2.3
+ GIT_CURL_VERBOSE=1
+ git ls-remote https://bitbucket.org/
* Couldn't find host bitbucket.org in the .netrc file, using defaults
* About to connect() to bitbucket.org port 443
*   Trying 18.205.93.1... * connected
* Connected to bitbucket.org (18.205.93.1) port 443
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Unknown SSL protocol error in connection to bitbucket.org:443

I checked out Git release notes:

git clone --depth=1 https://github.com/git/git

and found nothing about TLS v1.2 support:

cd git/Documentation/RelNotes
grep TLS

What should I tell sysadmin which version of Git is minimum that supports TLS v1.2?

NOTE We are not on the hot in our infrastructure, please don't say anything about updating to yesterday release...

NOTE 2 I can miss Git internals and other OS libraries can affect TLS v1.2 support.

Answer 1

In order to perform HTTP and HTTPS, Git uses a library called libcurl. This library in turn is linked against some library that provides TLS, which is usually OpenSSL, GnuTLS, or NSS, depending on your operating system. The easiest way on Linux to find out which one of these your Git is linked against is to run ldd $(which "$(git --exec-path)"/git-http-push).

If the output contains something that says "libgnutls", then you're using GnuTLS, and you'll need GnuTLS 2.12.24 or newer for proper TLS 1.2 support.

If the output contains something that says "libnss", then you're using NSS, and you'll need NSS 3.15.1.

If the output contains something that says "libssl" and none of the others, then you're using OpenSSL, and you'll need OpenSSL 1.0.1.

Note that some vendors backport patches or will need to upgrade their versions of libcurl in order to enable TLS 1.2 properly, so this may not be exactly right, depending on your vendor.

As a note, it looks like you might be using the EPEL version of Git for RHEL and CentOS 5. If so, be aware that those operating systems have no TLS 1.2 support at all and will not be getting any.

Answer 2

I found promising information on Github migration guilde:

Git on Red Hat 5, < 6.8, and < 7.2

Red Hat 5, 6, and 7 shipped with Git clients that did not support TLSv1.2. This can be addressed by updating to versions 6.8 and 7.2 (or greater) respectively. Unfortunately, Red Hat 5 does not have a point release that supports TLSv1.2. We advise that users of Red Hat 5 upgrade to a newer version of the operating system.

That doesn't answer my question: what is necessary from Git to be able to work with TLS v1.2. Which version, libc, other libraries version...