{"thread":{"id":"62972","subject":"[Bug] git-http-push authentication fails using netrc-file since v2.46","startedAt":"2025-02-18T21:43:15Z","lastAt":"2025-02-26T12:47:46Z","messageCount":7,"participants":["Peter Georg","brian m. carlson","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"512641","messageId":"2f9629f6-d742-4ee4-8441-8b70981a4629@physik.uni-regensburg.de","threadId":"62972","inReplyTo":null,"subject":"[Bug] git-http-push authentication fails using netrc-file since v2.46","fromName":"Peter Georg","fromEmail":"peter.georg@physik.uni-regensburg.de","sentAt":"2025-02-18T21:34:59Z","receivedAt":"2025-02-18T21:43:15Z","isPatch":false,"sender":{"key":"peter.georg@physik.uni-regensburg.de","avatar":null},"body":"When pushing to a https remote git used to use the credentials specified \nin netrc-file. I have not configured any other credential stores.\nSince Git 2.46, in particular since commit\n\n610cbc1dfb4ad947b82d7312c54c7987177f979f\nhttp: allow authenticating proactively\n\nthis is not the case anymore. With http.proactiveAuth not set or set to \nnone git uses the credentials provided in netrc-file at first correctly, \nbut at later connections uses empty credentials and fails with:\n\nerror: Cannot access URL https://<redacted>, return code 22 \n\nfatal: git-http-push failed\n\nWith http.proactiveAuth set to auto or basic Git asks for credentials on \nprompt. Should it use the credentials specified in netrc-file?\n\n\nWith http.proactiveAuth not set or set to none and no credential \nspecified in .netrc a git-push asks me twice for my credentials and then \nfails with the same error as with credentials specified in netrc-file.\n\n\nWhen reverting commit 610cbc1dfb4ad947b82d7312c54c7987177f979f all works \nas it used to in previous versions again.\n\nRunning with GIT_CURL_VERBOSE=1 I was able to obtain the attached log \n(personal information has been replaced by <redacted>).\n\nPlease note that I have also tested newer Git versions, but I \nspecifically looked at 2.46 as this is the first version affected by \nthis issue.\n\nPlease let me know in case further information is required. Also happy \nto test patches to fix this issue.\n\n[System Info]\ngit version:\ngit version 2.46.0\ncpu: x86_64\nno commit associated with this build\nsizeof-long: 8\nsizeof-size_t: 8\nshell-path: /bin/sh\nlibcurl: 7.76.1\nOpenSSL: OpenSSL 3.2.2 4 Jun 2024\nzlib: 1.2.11\nuname: Linux 6.13.2-1.el9.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Feb  8 \n21:10:29 UTC 2025 x86_64\ncompiler info: gnuc: 11.5\nlibc info: glibc: 2.34\n$SHELL (typically, interactive shell): /bin/bash\n\n22:03:25.056673 http.c:913              == Info:   Trying <redacted>:443...\n22:03:25.086207 http.c:913              == Info: Connected to <redacted> (<redacted>) port 443 (#0)\n22:03:25.088718 http.c:913              == Info: ALPN, offering h2\n22:03:25.088730 http.c:913              == Info: ALPN, offering http/1.1\n22:03:25.092587 http.c:913              == Info:  CAfile: /etc/pki/tls/certs/ca-bundle.crt\n22:03:25.092746 http.c:913              == Info: TLSv1.0 (OUT), TLS header, Certificate Status (22):\n22:03:25.092751 http.c:913              == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):\n22:03:25.127797 http.c:913              == Info: TLSv1.2 (IN), TLS header, Certificate Status (22):\n22:03:25.127886 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Server hello (2):\n22:03:25.128353 http.c:913              == Info: TLSv1.2 (IN), TLS header, Finished (20):\n22:03:25.128365 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.128398 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):\n22:03:25.128408 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.128457 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Certificate (11):\n22:03:25.129051 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.156387 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, CERT verify (15):\n22:03:25.156769 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.156807 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Finished (20):\n22:03:25.156890 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Finished (20):\n22:03:25.156897 http.c:913              == Info: TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):\n22:03:25.156946 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:25.156952 http.c:913              == Info: TLSv1.3 (OUT), TLS handshake, Finished (20):\n22:03:25.157124 http.c:913              == Info: SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384\n22:03:25.157129 http.c:913              == Info: ALPN, server did not agree to a protocol\n22:03:25.157135 http.c:913              == Info: Server certificate:\n22:03:25.157152 http.c:913              == Info:  subject: <redacted>\n22:03:25.157160 http.c:913              == Info:  start date: Oct  1 00:00:00 2024 GMT\n22:03:25.157162 http.c:913              == Info:  expire date: Sep 26 23:59:59 2025 GMT\n22:03:25.157188 http.c:913              == Info:  subjectAltName: host \"<redacted>\" matched cert's \"<redacted>\"\n22:03:25.157200 http.c:913              == Info:  issuer: <redacted>\n22:03:25.157202 http.c:913              == Info:  SSL certificate verify ok.\n22:03:25.157232 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:25.157249 http.c:860              => Send header, 0000000223 bytes (0x000000df)\n22:03:25.157253 http.c:872              => Send header: GET /proj/info/refs?service=git-receive-pack HTTP/1.1\n22:03:25.157255 http.c:872              => Send header: Host: <redacted>\n22:03:25.157256 http.c:872              => Send header: User-Agent: git/2.47.1\n22:03:25.157258 http.c:872              => Send header: Accept: */*\n22:03:25.157259 http.c:872              => Send header: Accept-Encoding: deflate, gzip, br\n22:03:25.157260 http.c:872              => Send header: Accept-Language: en-DK, *;q=0.9\n22:03:25.157261 http.c:872              => Send header: Pragma: no-cache\n22:03:25.157263 http.c:872              => Send header:\n22:03:25.185163 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.185308 http.c:913              == Info: Mark bundle as not supporting multiuse\n22:03:25.185321 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:25.185329 http.c:872              <= Recv header: HTTP/1.1 401 Unauthorized\n22:03:25.185356 http.c:860              <= Recv header, 0000000037 bytes (0x00000025)\n22:03:25.185360 http.c:872              <= Recv header: Date: Tue, 18 Feb 2025 21:03:25 GMT\n22:03:25.185363 http.c:860              <= Recv header, 0000000016 bytes (0x00000010)\n22:03:25.185367 http.c:872              <= Recv header: Server: Apache\n22:03:25.185372 http.c:860              <= Recv header, 0000000043 bytes (0x0000002b)\n22:03:25.185376 http.c:872              <= Recv header: WWW-Authenticate: Basic realm=\"User Auth\"\n22:03:25.185381 http.c:860              <= Recv header, 0000000021 bytes (0x00000015)\n22:03:25.185385 http.c:872              <= Recv header: Content-Length: 381\n22:03:25.185390 http.c:860              <= Recv header, 0000000045 bytes (0x0000002d)\n22:03:25.185393 http.c:872              <= Recv header: Content-Type: text/html; charset=iso-8859-1\n22:03:25.185397 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:25.185400 http.c:872              <= Recv header: X-STG-FE: 10.4.1.50:10481\n22:03:25.185404 http.c:860              <= Recv header, 0000000064 bytes (0x00000040)\n22:03:25.185407 http.c:872              <= Recv header: Strict-Transport-Security: max-age=31536000; includeSubDomains\n22:03:25.185413 http.c:860              <= Recv header, 0000000002 bytes (0x00000002)\n22:03:25.185417 http.c:872              <= Recv header:\n22:03:25.185420 http.c:913              == Info: Ignoring the response-body\n22:03:25.185442 http.c:913              == Info: Connection #0 to host <redacted> left intact\n22:03:25.185467 http.c:913              == Info: Issue another request to this URL: 'https://<redacted>/proj/info/refs?service=git-receive-pack'\n22:03:25.185564 http.c:913              == Info: Found bundle for host <redacted>: 0x555555665ca0 [serially]\n22:03:25.185570 http.c:913              == Info: Can not multiplex, even if we wanted to!\n22:03:25.185587 http.c:913              == Info: Re-using existing connection! (#0) with host <redacted>\n22:03:25.185594 http.c:913              == Info: Connected to <redacted> (<redacted>) port 443 (#0)\n22:03:25.185610 http.c:913              == Info: Server auth using Basic with user '<redacted>'\n22:03:25.185649 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:25.185758 http.c:860              => Send header, 0000000286 bytes (0x0000011e)\n22:03:25.185764 http.c:872              => Send header: GET /proj/info/refs?service=git-receive-pack HTTP/1.1\n22:03:25.185767 http.c:872              => Send header: Host: <redacted>\n22:03:25.185770 http.c:872              => Send header: Authorization: Basic <redacted>\n22:03:25.185773 http.c:872              => Send header: User-Agent: git/2.47.1\n22:03:25.185777 http.c:872              => Send header: Accept: */*\n22:03:25.185780 http.c:872              => Send header: Accept-Encoding: deflate, gzip, br\n22:03:25.185783 http.c:872              => Send header: Accept-Language: en-DK, *;q=0.9\n22:03:25.185786 http.c:872              => Send header: Pragma: no-cache\n22:03:25.185789 http.c:872              => Send header:\n22:03:25.218075 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.218312 http.c:913              == Info: Mark bundle as not supporting multiuse\n22:03:25.218327 http.c:860              <= Recv header, 0000000017 bytes (0x00000011)\n22:03:25.218334 http.c:872              <= Recv header: HTTP/1.1 200 OK\n22:03:25.218342 http.c:860              <= Recv header, 0000000037 bytes (0x00000025)\n22:03:25.218346 http.c:872              <= Recv header: Date: Tue, 18 Feb 2025 21:03:25 GMT\n22:03:25.218350 http.c:860              <= Recv header, 0000000016 bytes (0x00000010)\n22:03:25.218353 http.c:872              <= Recv header: Server: Apache\n22:03:25.218357 http.c:860              <= Recv header, 0000000046 bytes (0x0000002e)\n22:03:25.218360 http.c:872              <= Recv header: Last-Modified: Tue, 18 Feb 2025 19:46:37 GMT\n22:03:25.218363 http.c:860              <= Recv header, 0000000026 bytes (0x0000001a)\n22:03:25.218390 http.c:872              <= Recv header: ETag: \"51-62e6fe61f1b01\"\n22:03:25.218394 http.c:860              <= Recv header, 0000000022 bytes (0x00000016)\n22:03:25.218397 http.c:872              <= Recv header: Accept-Ranges: bytes\n22:03:25.218402 http.c:860              <= Recv header, 0000000020 bytes (0x00000014)\n22:03:25.218405 http.c:872              <= Recv header: Content-Length: 81\n22:03:25.218408 http.c:860              <= Recv header, 0000000020 bytes (0x00000014)\n22:03:25.218411 http.c:872              <= Recv header: MS-Author-Via: DAV\n22:03:25.218415 http.c:860              <= Recv header, 0000000033 bytes (0x00000021)\n22:03:25.218418 http.c:872              <= Recv header: Content-Disposition: attachment\n22:03:25.218422 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:25.218425 http.c:872              <= Recv header: X-STG-FE: 10.4.1.50:10481\n22:03:25.218428 http.c:860              <= Recv header, 0000000064 bytes (0x00000040)\n22:03:25.218431 http.c:872              <= Recv header: Strict-Transport-Security: max-age=31536000; includeSubDomains\n22:03:25.218436 http.c:860              <= Recv header, 0000000002 bytes (0x00000002)\n22:03:25.218439 http.c:872              <= Recv header:\n22:03:25.218461 http.c:913              == Info: Connection #0 to host <redacted> left intact\n22:03:25.218606 http.c:913              == Info: Found bundle for host <redacted>: 0x555555665ca0 [serially]\n22:03:25.218612 http.c:913              == Info: Can not multiplex, even if we wanted to!\n22:03:25.218631 http.c:913              == Info: Re-using existing connection! (#0) with host <redacted>\n22:03:25.218639 http.c:913              == Info: Connected to <redacted> (<redacted>) port 443 (#0)\n22:03:25.218654 http.c:913              == Info: Server auth using Basic with user '<redacted>'\n22:03:25.218703 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:25.218810 http.c:860              => Send header, 0000000256 bytes (0x00000100)\n22:03:25.218816 http.c:872              => Send header: GET /proj/HEAD HTTP/1.1\n22:03:25.218820 http.c:872              => Send header: Host: <redacted>\n22:03:25.218823 http.c:872              => Send header: Authorization: Basic <redacted>\n22:03:25.218826 http.c:872              => Send header: User-Agent: git/2.47.1\n22:03:25.218829 http.c:872              => Send header: Accept: */*\n22:03:25.218833 http.c:872              => Send header: Accept-Encoding: deflate, gzip, br\n22:03:25.218836 http.c:872              => Send header: Accept-Language: en-DK, *;q=0.9\n22:03:25.218839 http.c:872              => Send header: Pragma: no-cache\n22:03:25.218842 http.c:872              => Send header:\n22:03:25.249948 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:25.250055 http.c:913              == Info: Mark bundle as not supporting multiuse\n22:03:25.250064 http.c:860              <= Recv header, 0000000017 bytes (0x00000011)\n22:03:25.250068 http.c:872              <= Recv header: HTTP/1.1 200 OK\n22:03:25.250072 http.c:860              <= Recv header, 0000000037 bytes (0x00000025)\n22:03:25.250073 http.c:872              <= Recv header: Date: Tue, 18 Feb 2025 21:03:25 GMT\n22:03:25.250075 http.c:860              <= Recv header, 0000000016 bytes (0x00000010)\n22:03:25.250076 http.c:872              <= Recv header: Server: Apache\n22:03:25.250078 http.c:860              <= Recv header, 0000000046 bytes (0x0000002e)\n22:03:25.250079 http.c:872              <= Recv header: Last-Modified: Sun, 19 Jan 2025 00:35:21 GMT\n22:03:25.250081 http.c:860              <= Recv header, 0000000026 bytes (0x0000001a)\n22:03:25.250083 http.c:872              <= Recv header: ETag: \"15-62c0451a06b79\"\n22:03:25.250120 http.c:860              <= Recv header, 0000000022 bytes (0x00000016)\n22:03:25.250121 http.c:872              <= Recv header: Accept-Ranges: bytes\n22:03:25.250123 http.c:860              <= Recv header, 0000000020 bytes (0x00000014)\n22:03:25.250145 http.c:872              <= Recv header: Content-Length: 21\n22:03:25.250147 http.c:860              <= Recv header, 0000000020 bytes (0x00000014)\n22:03:25.250148 http.c:872              <= Recv header: MS-Author-Via: DAV\n22:03:25.250150 http.c:860              <= Recv header, 0000000033 bytes (0x00000021)\n22:03:25.250151 http.c:872              <= Recv header: Content-Disposition: attachment\n22:03:25.250152 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:25.250154 http.c:872              <= Recv header: X-STG-FE: 10.4.1.50:10481\n22:03:25.250155 http.c:860              <= Recv header, 0000000064 bytes (0x00000040)\n22:03:25.250156 http.c:872              <= Recv header: Strict-Transport-Security: max-age=31536000; includeSubDomains\n22:03:25.250159 http.c:860              <= Recv header, 0000000002 bytes (0x00000002)\n22:03:25.250160 http.c:872              <= Recv header:\n22:03:25.250177 http.c:913              == Info: Connection #0 to host <redacted> left intact\n22:03:27.794427 http.c:913              == Info:   Trying <redacted>:443...\n22:03:27.823405 http.c:913              == Info: Connected to <redacted> (<redacted>) port 443 (#0)\n22:03:27.825857 http.c:913              == Info: ALPN, offering h2\n22:03:27.825876 http.c:913              == Info: ALPN, offering http/1.1\n22:03:27.829660 http.c:913              == Info:  CAfile: /etc/pki/tls/certs/ca-bundle.crt\n22:03:27.829819 http.c:913              == Info: TLSv1.0 (OUT), TLS header, Certificate Status (22):\n22:03:27.829823 http.c:913              == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):\n22:03:27.865042 http.c:913              == Info: TLSv1.2 (IN), TLS header, Certificate Status (22):\n22:03:27.865215 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Server hello (2):\n22:03:27.865527 http.c:913              == Info: TLSv1.2 (IN), TLS header, Finished (20):\n22:03:27.865531 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:27.865554 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):\n22:03:27.865560 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:27.865578 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Certificate (11):\n22:03:27.865986 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:27.892867 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, CERT verify (15):\n22:03:27.893168 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:27.893194 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Finished (20):\n22:03:27.893256 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Finished (20):\n22:03:27.893261 http.c:913              == Info: TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):\n22:03:27.893290 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:27.893293 http.c:913              == Info: TLSv1.3 (OUT), TLS handshake, Finished (20):\n22:03:27.893394 http.c:913              == Info: SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384\n22:03:27.893397 http.c:913              == Info: ALPN, server did not agree to a protocol\n22:03:27.893403 http.c:913              == Info: Server certificate:\n22:03:27.893420 http.c:913              == Info:  subject: <redacted>\n22:03:27.893428 http.c:913              == Info:  start date: Oct  1 00:00:00 2024 GMT\n22:03:27.893431 http.c:913              == Info:  expire date: Sep 26 23:59:59 2025 GMT\n22:03:27.893456 http.c:913              == Info:  subjectAltName: host \"<redacted>\" matched cert's \"<redacted>\"\n22:03:27.893467 http.c:913              == Info:  issuer: <redacted>\n22:03:27.893471 http.c:913              == Info:  SSL certificate verify ok.\n22:03:27.893513 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:27.893525 http.c:860              => Send header, 0000000184 bytes (0x000000b8)\n22:03:27.893529 http.c:872              => Send header: PROPFIND /proj/ HTTP/1.1\n22:03:27.893531 http.c:872              => Send header: Host: <redacted>\n22:03:27.893532 http.c:872              => Send header: User-Agent: git/2.47.1\n22:03:27.893533 http.c:872              => Send header: Accept: */*\n22:03:27.893535 http.c:872              => Send header: Depth: 0\n22:03:27.893536 http.c:872              => Send header: Content-Type: text/xml\n22:03:27.893537 http.c:872              => Send header: Content-Length: 178\n22:03:27.893538 http.c:872              => Send header: Expect: 100-continue\n22:03:27.893539 http.c:872              => Send header:\n22:03:27.922120 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:27.922254 http.c:913              == Info: Mark bundle as not supporting multiuse\n22:03:27.922270 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:27.922280 http.c:872              <= Recv header: HTTP/1.1 401 Unauthorized\n22:03:27.922288 http.c:860              <= Recv header, 0000000037 bytes (0x00000025)\n22:03:27.922292 http.c:872              <= Recv header: Date: Tue, 18 Feb 2025 21:03:27 GMT\n22:03:27.922297 http.c:860              <= Recv header, 0000000016 bytes (0x00000010)\n22:03:27.922302 http.c:872              <= Recv header: Server: Apache\n22:03:27.922309 http.c:860              <= Recv header, 0000000043 bytes (0x0000002b)\n22:03:27.922314 http.c:872              <= Recv header: WWW-Authenticate: Basic realm=\"User Auth\"\n22:03:27.922319 http.c:860              <= Recv header, 0000000021 bytes (0x00000015)\n22:03:27.922324 http.c:872              <= Recv header: Content-Length: 381\n22:03:27.922329 http.c:860              <= Recv header, 0000000019 bytes (0x00000013)\n22:03:27.922333 http.c:872              <= Recv header: Connection: close\n22:03:27.922339 http.c:860              <= Recv header, 0000000045 bytes (0x0000002d)\n22:03:27.922343 http.c:872              <= Recv header: Content-Type: text/html; charset=iso-8859-1\n22:03:27.922348 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:27.922353 http.c:872              <= Recv header: X-STG-FE: 10.4.1.50:10481\n22:03:27.922359 http.c:860              <= Recv header, 0000000002 bytes (0x00000002)\n22:03:27.922364 http.c:872              <= Recv header:\n22:03:27.922390 http.c:913              == Info: Closing connection 0\n22:03:27.922411 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:27.922536 http.c:913              == Info: TLSv1.3 (OUT), TLS alert, close notify (256):\n22:03:27.924348 http.c:913              == Info: Issue another request to this URL: 'https://<redacted>/proj/'\n22:03:27.924478 http.c:913              == Info: NTLM-proxy picked AND auth done set, clear picked!\n22:03:27.924483 http.c:913              == Info: Hostname <redacted> was found in DNS cache\n22:03:27.924513 http.c:913              == Info:   Trying <redacted>:443...\n22:03:27.984070 http.c:913              == Info: Connected to <redacted> (<redacted>) port 443 (#1)\n22:03:27.984655 http.c:913              == Info: ALPN, offering h2\n22:03:27.984660 http.c:913              == Info: ALPN, offering http/1.1\n22:03:27.988803 http.c:913              == Info:  CAfile: /etc/pki/tls/certs/ca-bundle.crt\n22:03:27.989030 http.c:913              == Info: TLSv1.0 (OUT), TLS header, Certificate Status (22):\n22:03:27.989036 http.c:913              == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):\n22:03:28.060771 http.c:913              == Info: TLSv1.2 (IN), TLS header, Certificate Status (22):\n22:03:28.060850 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Server hello (2):\n22:03:28.061047 http.c:913              == Info: TLSv1.2 (IN), TLS header, Finished (20):\n22:03:28.061051 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:28.061125 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):\n22:03:28.061134 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:28.061146 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Certificate (11):\n22:03:28.061530 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:28.061537 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, CERT verify (15):\n22:03:28.061622 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:28.123680 http.c:913              == Info: TLSv1.3 (IN), TLS handshake, Finished (20):\n22:03:28.123827 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Finished (20):\n22:03:28.123833 http.c:913              == Info: TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):\n22:03:28.123853 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:28.123856 http.c:913              == Info: TLSv1.3 (OUT), TLS handshake, Finished (20):\n22:03:28.123958 http.c:913              == Info: SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384\n22:03:28.123962 http.c:913              == Info: ALPN, server did not agree to a protocol\n22:03:28.123967 http.c:913              == Info: Server certificate:\n22:03:28.123984 http.c:913              == Info:  subject: <redacted>\n22:03:28.123992 http.c:913              == Info:  start date: Oct  1 00:00:00 2024 GMT\n22:03:28.123996 http.c:913              == Info:  expire date: Sep 26 23:59:59 2025 GMT\n22:03:28.124029 http.c:913              == Info:  subjectAltName: host \"<redacted>\" matched cert's \"<redacted>\"\n22:03:28.124038 http.c:913              == Info:  issuer: <redacted>\n22:03:28.124041 http.c:913              == Info:  SSL certificate verify ok.\n22:03:28.124055 http.c:913              == Info: Server auth using Basic with user ''\n22:03:28.124074 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:28.124117 http.c:860              => Send header, 0000000211 bytes (0x000000d3)\n22:03:28.124124 http.c:872              => Send header: PROPFIND /proj/ HTTP/1.1\n22:03:28.124126 http.c:872              => Send header: Host: <redacted>\n22:03:28.124128 http.c:872              => Send header: Authorization: Basic <redacted>\n22:03:28.124129 http.c:872              => Send header: User-Agent: git/2.47.1\n22:03:28.124131 http.c:872              => Send header: Accept: */*\n22:03:28.124132 http.c:872              => Send header: Depth: 0\n22:03:28.124134 http.c:872              => Send header: Content-Type: text/xml\n22:03:28.124135 http.c:872              => Send header: Content-Length: 178\n22:03:28.124137 http.c:872              => Send header: Expect: 100-continue\n22:03:28.124138 http.c:872              => Send header:\n22:03:28.184033 http.c:913              == Info: TLSv1.2 (IN), TLS header, Unknown (23):\n22:03:28.184386 http.c:913              == Info: Mark bundle as not supporting multiuse\n22:03:28.184407 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:28.184417 http.c:872              <= Recv header: HTTP/1.1 401 Unauthorized\n22:03:28.184425 http.c:860              <= Recv header, 0000000037 bytes (0x00000025)\n22:03:28.184430 http.c:872              <= Recv header: Date: Tue, 18 Feb 2025 21:03:28 GMT\n22:03:28.184436 http.c:860              <= Recv header, 0000000016 bytes (0x00000010)\n22:03:28.184441 http.c:872              <= Recv header: Server: Apache\n22:03:28.184448 http.c:913              == Info: Authentication problem. Ignoring this.\n22:03:28.184454 http.c:860              <= Recv header, 0000000043 bytes (0x0000002b)\n22:03:28.184459 http.c:872              <= Recv header: WWW-Authenticate: Basic realm=\"User Auth\"\n22:03:28.184464 http.c:860              <= Recv header, 0000000021 bytes (0x00000015)\n22:03:28.184469 http.c:872              <= Recv header: Content-Length: 381\n22:03:28.184502 http.c:860              <= Recv header, 0000000019 bytes (0x00000013)\n22:03:28.184506 http.c:872              <= Recv header: Connection: close\n22:03:28.184512 http.c:860              <= Recv header, 0000000045 bytes (0x0000002d)\n22:03:28.184516 http.c:872              <= Recv header: Content-Type: text/html; charset=iso-8859-1\n22:03:28.184521 http.c:860              <= Recv header, 0000000027 bytes (0x0000001b)\n22:03:28.184526 http.c:872              <= Recv header: X-STG-FE: 10.4.1.50:10481\n22:03:28.184534 http.c:913              == Info: The requested URL returned error: 401\n22:03:28.184560 http.c:913              == Info: Closing connection 1\n22:03:28.184582 http.c:913              == Info: TLSv1.2 (OUT), TLS header, Unknown (23):\n22:03:28.184683 http.c:913              == Info: TLSv1.3 (OUT), TLS alert, close notify (256):\nerror: Cannot access URL https://<redacted>/proj/, return code 22\nfatal: git-http-push failed\nerror: failed to push some refs to 'https://<redacted>/proj'\n"},{"id":"512650","messageId":"Z7UPYY24uk7lLzeP@tapette.crustytoothpaste.net","threadId":"62972","inReplyTo":"2f9629f6-d742-4ee4-8441-8b70981a4629@physik.uni-regensburg.de","subject":"Re: [Bug] git-http-push authentication fails using netrc-file since v2.46","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-02-18T22:53:21Z","receivedAt":"2025-02-18T22:53:23Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-02-18 at 21:34:59, Peter Georg wrote:\n> When pushing to a https remote git used to use the credentials specified in\n> netrc-file. I have not configured any other credential stores.\n> Since Git 2.46, in particular since commit\n> \n> 610cbc1dfb4ad947b82d7312c54c7987177f979f\n> http: allow authenticating proactively\n> \n> this is not the case anymore. With http.proactiveAuth not set or set to none\n> git uses the credentials provided in netrc-file at first correctly, but at\n> later connections uses empty credentials and fails with:\n> \n> error: Cannot access URL https://<redacted>, return code 22\n> \n> fatal: git-http-push failed\n\nThis does sound like a problem.  We've long had code to use the netrc\nbut absolutely zero tests or documentation for it.  I must admit that\nI'm not even sure how it works, so I'll need to do some testing.\n\n> With http.proactiveAuth set to auto or basic Git asks for credentials on\n> prompt. Should it use the credentials specified in netrc-file?\n\nI hadn't intended `http.proactiveAuth` to work that way.  It's\nspecifically designed to call the credential helper because it may get\ncredentials back which are not a username and password (say, a Bearer\ntoken), which it can't do with a netrc file.\n\nAlso, from the documentation, it specifically looks like the netrc file\nis only used if no credentials are provided, and since we can't query\nlibcurl to tell us if we would have credentials from the netrc file, I\ndon't see how we could support the netrc file since we'd have to take\nthe risk that there are no credentials and we'd get a 401 (which is\nexactly what the feature intends to avoid).\n\n> With http.proactiveAuth not set or set to none and no credential specified\n> in .netrc a git-push asks me twice for my credentials and then fails with\n> the same error as with credentials specified in netrc-file.\n\nI'll start taking a look at this tonight, but it may be later this week\nbefore I get time to write and send a patch.\n\nIn the meantime, you can use the git-credential-netrc helper from the\ncontrib directory, which will probably let you get back to normal.\n-- \nbrian m. carlson (they/them or he/him)\nToronto, Ontario, CA\n"},{"id":"512878","messageId":"20250223015331.588161-1-sandals@crustytoothpaste.net","threadId":"62972","inReplyTo":"Z7UPYY24uk7lLzeP@tapette.crustytoothpaste.net","subject":"[PATCH 0/1] Fix netrc usage with WebDAV-based HTTP protocol","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-02-23T01:53:30Z","receivedAt":"2025-02-23T01:55:11Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"For a long time, we've enabled the automatic usage of netrc if the user\ndoesn't provide any credentials.  Unfortunately, in 2.46, this broke for\nthe WebDAV-based HTTP protocol, which this series fixes.\n\nIn looking at this issue, I discovered that we have (before this series)\nzero tests for the netrc functionality and zero documentation for it,\nwhich obviously is suboptimal.  In this series, I am adding one test,\nwhich is for this particular bug.\n\nHowever, I think we need to either decide that we're going to support\nthis as a fully-fledged feature and add documentation and sufficient\ntests, or remove it, since it's not reasonable to have undocumented,\nuntested features that people rely on.  Our HTTP code is quite subtle\nand complex and we can't expect future developers not to break things in\nthis state[0].  I will note, as an argument in favour of removal, that\nwe have git-credential-netrc helper in contrib that users can enable if\nthey want to retain this functionality, and we could even ship it by\ndefault without much difficulty.  For those reasons, I am not planning\nto add more tests and documentation here, but of course I welcome\ninterested parties to do so.\n\n[0] Personally, I had some vague knowledge this feature existed and I\nfeel like I'm reasonably familiar with the HTTP code, and I still\naccidentally introduced a bug, so that doesn't bode well for\ncontributors who are less familiar with it.\n\nbrian m. carlson (1):\n  http: allow using netrc for WebDAV-based HTTP protocol\n\n http.c                      |  3 +--\n t/t5540-http-push-webdav.sh | 10 ++++++++++\n 2 files changed, 11 insertions(+), 2 deletions(-)\n\n"},{"id":"512879","messageId":"20250223015331.588161-2-sandals@crustytoothpaste.net","threadId":"62972","inReplyTo":"20250223015331.588161-1-sandals@crustytoothpaste.net","subject":"[PATCH 1/1] http: allow using netrc for WebDAV-based HTTP protocol","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-02-23T01:53:31Z","receivedAt":"2025-02-23T01:55:11Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"For an extended period of time, we've enabled libcurl's netrc\nfunctionality, which will read credentials from the netrc file if none\nare provided.  Unfortunately, we have also not documented this fact or\nwritten any tests for it, but people have come to rely on it.\n\nIn 610cbc1dfb (\"http: allow authenticating proactively\", 2024-07-10), we\naccidentally broke the ability of users to use the netrc file for the\nWebDAV-based HTTP protocol.  Notably, it works on the initial request\nbut does not work on subsequent requests, which causes failures because\nthat version of the protocol will necessarily make multiple requests.\n\nThis happens because curl_empty_auth_enabled never returns -1, only 0 or\n1, and so if http.proactiveAuth is not enabled, the username and\npassword are always set to empty credentials, which prevents libcurl's\nfallback to netrc from working.  However, in other cases, the server\ncontinues to get a 401 response and the credential helper is invoked,\nwhich is the normal behavior, so this was not noticed earlier.\n\nTo fix this, change the condition to check for enabling empty auth and\nalso not having proactive auth enabled, which should result in the\nusername and password not being set to a single colon in the typical\ncase, and thus the netrc file being used.\n\nReported-by: Peter Georg <peter.georg@physik.uni-regensburg.de>\nSigned-off-by: brian m. carlson <sandals@crustytoothpaste.net>\n---\n http.c                      |  3 +--\n t/t5540-http-push-webdav.sh | 10 ++++++++++\n 2 files changed, 11 insertions(+), 2 deletions(-)\n\ndiff --git a/http.c b/http.c\nindex f4504133e8..0c9a872809 100644\n--- a/http.c\n+++ b/http.c\n@@ -598,8 +598,7 @@ static void init_curl_http_auth(CURL *result)\n {\n \tif ((!http_auth.username || !*http_auth.username) &&\n \t    (!http_auth.credential || !*http_auth.credential)) {\n-\t\tint empty_auth = curl_empty_auth_enabled();\n-\t\tif ((empty_auth != -1 && !always_auth_proactively()) || empty_auth == 1) {\n+\t\tif (!always_auth_proactively() && curl_empty_auth_enabled()) {\n \t\t\tcurl_easy_setopt(result, CURLOPT_USERPWD, \":\");\n \t\t\treturn;\n \t\t} else if (!always_auth_proactively()) {\ndiff --git a/t/t5540-http-push-webdav.sh b/t/t5540-http-push-webdav.sh\nindex 37db3dec0c..3fa05ff185 100755\n--- a/t/t5540-http-push-webdav.sh\n+++ b/t/t5540-http-push-webdav.sh\n@@ -201,4 +201,14 @@ test_expect_failure 'push to password-protected repository (no user in URL)' '\n \ttest_cmp expect actual\n '\n \n+test_expect_success 'push to password-protected repository (netrc)' '\n+\ttest_commit pw-netrc &&\n+\techo \"default login user@host password pass@host\" >\"$HOME/.netrc\" &&\n+\tGIT_TRACE=1 GIT_CURL_VERBOSE=1 git push \"$HTTPD_URL/auth/dumb/test_repo.git\" HEAD &&\n+\tgit rev-parse --verify HEAD >expect &&\n+\tgit --git-dir=\"$HTTPD_DOCUMENT_ROOT_PATH/auth/dumb/test_repo.git\" \\\n+\t\trev-parse --verify HEAD >actual &&\n+\ttest_cmp expect actual\n+'\n+\n test_done\n"},{"id":"512919","messageId":"xmqqa5ab70ka.fsf@gitster.g","threadId":"62972","inReplyTo":"20250223015331.588161-1-sandals@crustytoothpaste.net","subject":"Re: [PATCH 0/1] Fix netrc usage with WebDAV-based HTTP protocol","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-02-24T16:46:29Z","receivedAt":"2025-02-24T16:46:32Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"brian m. carlson\" <sandals@crustytoothpaste.net> writes:\n\n> However, I think we need to either decide that we're going to support\n> this as a fully-fledged feature and add documentation and sufficient\n> tests, or remove it, since it's not reasonable to have undocumented,\n> untested features that people rely on.\n\nDoes \"this\" refer to \"use of netrc in HTTP code paths\", or \"HTTP\nwalker\"?  I am kind of surprised that anybody is still using the\nlatter, regardless of where the credential is locally stored.\n\n> I will note, as an argument in favour of removal, that we have\n> git-credential-netrc helper in contrib that users can enable if\n> they want to retain this functionality, and we could even ship it\n> by default without much difficulty.\n\nI am fine with the approach.\n\nThanks.\n"},{"id":"512930","messageId":"Z7zuMBVrnX_pLE0K@tapette.crustytoothpaste.net","threadId":"62972","inReplyTo":"xmqqa5ab70ka.fsf@gitster.g","subject":"Re: [PATCH 0/1] Fix netrc usage with WebDAV-based HTTP protocol","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-02-24T22:09:52Z","receivedAt":"2025-02-24T22:10:01Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-02-24 at 16:46:29, Junio C Hamano wrote:\n> \"brian m. carlson\" <sandals@crustytoothpaste.net> writes:\n> \n> > However, I think we need to either decide that we're going to support\n> > this as a fully-fledged feature and add documentation and sufficient\n> > tests, or remove it, since it's not reasonable to have undocumented,\n> > untested features that people rely on.\n> \n> Does \"this\" refer to \"use of netrc in HTTP code paths\", or \"HTTP\n> walker\"?  I am kind of surprised that anybody is still using the\n> latter, regardless of where the credential is locally stored.\n\nIt refers to netrc in HTTP code paths.\n\nThere are definitely people using the WebDAV-based HTTP protocol still,\nbut after reading the comment in the code that implies that we don't\nread packed-refs, I'm less and less inclined to say that's a good idea.\nIt's probably going to die pretty quickly when we move to reftable,\nthough, since that protocol only works with the files backend.\n-- \nbrian m. carlson (they/them or he/him)\nToronto, Ontario, CA\n"},{"id":"513076","messageId":"5d53acf4-9d46-4fa7-9430-ac9c5ce47862@physik.uni-regensburg.de","threadId":"62972","inReplyTo":"20250223015331.588161-1-sandals@crustytoothpaste.net","subject":"Re: [PATCH 0/1] Fix netrc usage with WebDAV-based HTTP protocol","fromName":"Peter Georg","fromEmail":"peter.georg@physik.uni-regensburg.de","sentAt":"2025-02-26T12:38:08Z","receivedAt":"2025-02-26T12:47:46Z","isPatch":true,"sender":{"key":"peter.georg@physik.uni-regensburg.de","avatar":null},"body":"On 23/02/2025 02.53, brian m. carlson wrote:\n> I will note, as an argument in favour of removal, that\n> we have git-credential-netrc helper in contrib that users can enable if\n> they want to retain this functionality, and we could even ship it by\n> default without much difficulty.  For those reasons, I am not planning\n> to add more tests and documentation here, but of course I welcome\n> interested parties to do so.\n\nThis approach seems reasonable to me. I personally, for example, did not \neven know that the git-credential-netrc helper exists, but it obviously \nworks for me. Thus it would probably make sense to somehow document \nthis, at least once the undocumented feature of directly using \ncredentials specified in netrc is not working anymore.\n"}]}