Windows命令提示符联网机制及HTTPS(SSL)访问流程，含Linux pip install疑问

Alright, let's unpack this question—both Windows Command Prompt (CMD) and Linux's pip install rely on standard networking protocols under the hood, but let's break down each scenario clearly:

First off, CMD itself isn't a network tool—it's just a shell that runs other programs. Any networking you do via CMD (like using curl, wget, telnet, or even built-in tools like bitsadmin) is handled by the specific executable you're running, which uses Windows' native networking APIs (WinINet or WinHTTP) under the hood. Here's the step-by-step flow for an HTTPS request, say running curl https://example.com:

• Domain Resolution: The tool (curl) first sends a DNS query to your system's configured DNS server to translate example.com into an IP address.
• TCP Connection Setup: It initiates a TCP three-way handshake with the server's IP on port 443 (the default HTTPS port) to establish a reliable connection.
• SSL/TLS Handshake: This is what makes HTTPS secure:
  • The client (curl) sends a message with supported SSL/TLS versions, encryption suites, and a random number.
  • The server responds with its digital certificate (issued by a trusted Certificate Authority, CA), selects an encryption suite, and sends its own random number.
  • The client verifies the certificate: checks if it's expired, if the CA is trusted by Windows' root certificate store, and if the certificate's domain matches example.com.
  • Both sides generate a shared session key using the random numbers and certificate details—all future data is encrypted with this key.
• Send & Receive Encrypted Data: The client sends an encrypted HTTP request (e.g., GET /), the server processes it, encrypts the response, and sends it back. The client decrypts the response and outputs it to your CMD window.

pip is a Python package manager, so it relies on Python's built-in networking libraries (like ssl, socket, or higher-level ones like urllib3/requests) and the system's OpenSSL library for SSL/TLS handling. Here's how it works when you run pip install some-package:

• Target Resolution: First, pip resolves the default PyPI repository URL (https://pypi.org) to an IP via the system's DNS resolver.
• TCP & SSL/TLS Handshake: Just like the Windows scenario, it establishes a TCP connection on port 443, then completes an SSL/TLS handshake—verifying the PyPI server's certificate against the system's trusted CA store, negotiating encryption keys.
• Fetch Package Metadata: Pip sends an encrypted HTTP request to PyPI's API to get metadata about some-package: its latest version, download URLs, dependencies, etc.
• Download the Package: Using the download URL (often pointing to a CDN for faster access), pip initiates another HTTPS connection to download the package's archive (like .whl or .tar.gz).
• Install the Package: Once downloaded, pip extracts the archive, runs any necessary compilation (for packages with C extensions), and installs the files into Python's site-packages directory.

Note: If you're behind a proxy, both CMD tools and pip will respect system proxy settings (or custom configs like pip.conf for pip) and route requests through the proxy server, adding an extra step of connecting to the proxy first before reaching the target server.

内容的提问来源于stack exchange，提问作者Raj