Windows 2.56.1.vfs.0.1: bundled OpenSSH requires absent msys-crypto-3.dll, breaking SSH commit signing #1023

Summary

The x64 Windows release 2.56.1.vfs.0.1 bundles an usr/bin/ssh.exe that imports msys-crypto-3.dll, but supplies usr/bin/msys-crypto-4.dll instead. msys-crypto-3.dll is absent. Signed commits fail with a missing-DLL error; the bundled ssh-keygen.exe also references msys-crypto-3.dll.

Environment

• Windows, x64 Microsoft.Git installation managed through winget
• winget package: Microsoft.Git, version 2.56.1.0.1
• git --version: git version 2.56.1.vfs.0.1
• Installation directory: C:\Program Files\Git
• VS Code uses C:\Program Files\Git\cmd\git.exe

I initially isolated a reproducible failure to signed commits: committing with --no-gpg-sign works. Reinstalling Microsoft.Git did not resolve it. My VS Code logs also showed fetch failures, and I subsequently confirmed that my workflow needs both the transport and signing overrides below.

Independent release-artifact verification

I investigated the official release assets with Codex:
https://github.com/microsoft/git/releases/tag/v2.56.1.vfs.0.1

The installer Git-2.56.1.vfs.0.1-64-bit.exe has SHA-256:
1c9a21568c0b9ae30a892def89de9cf880ffb70b43189074a97dc23e665e5505
This matches the hash reported by winget. The available innoextract version could not extract this installer format, so the portable artifact was inspected independently instead.

Extracting the official PortableGit-2.56.1.vfs.0.1-64-bit.7z.exe into a fresh temporary directory shows:

• usr/bin/ssh.exe contains a DLL import reference to msys-crypto-3.dll.
• The archive contains usr/bin/msys-crypto-4.dll, but no msys-crypto-3.dll.
• The extracted ssh.exe and msys-crypto-4.dll are byte-for-byte identical (SHA-256) to the installed files:

This establishes that the inconsistent files are present in the published portable release, independently of the existing installation or upgrade history.

Expected behavior

Bundled OpenSSH and its bundled OpenSSL runtime dependencies should be compatible, allowing SSH-based Git operations without an external SSH override.

Signing-specific diagnosis and workaround

My configuration initially had gpg.format=ssh, commit.gpgsign=true, and no gpg.ssh.program override. SSH signing defaults to ssh-keygen, independently of the transport setting core.sshCommand.

Inspection of the installed usr/bin/ssh-keygen.exe also finds a reference to the absent msys-crypto-3.dll.

Setting only core.sshCommand=C:/Windows/System32/OpenSSH/ssh.exe did not fix my signed commits; it only changes SSH transport. Signing still failed with that override, while --no-gpg-sign succeeded.

I confirmed that both overrides below are required to temporarily restore my workflow:

git config --system core.sshCommand C:/Windows/System32/OpenSSH/ssh.exe
git config --system gpg.ssh.program C:/Windows/System32/OpenSSH/ssh-keygen.exe

Windows' built-in ssh-keygen.exe was independently tested with a newly generated temporary Ed25519 key and ssh-keygen -Y sign -n git; signing succeeded with exit code 0. I applied both system-scoped overrides and confirmed that together they temporarily fix my workflow.