{"thread":{"id":"63045","subject":"PKCS#11 authentication fails due to escaped URI","startedAt":"2025-03-02T23:22:33Z","lastAt":"2025-03-02T23:22:33Z","messageCount":1,"participants":["Henry Reed"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"513373","messageId":"CAKe9kabKXpPQVvJX9vryNi8btk9DeFjOaE=bqp9yDvA3oaiqEA@mail.gmail.com","threadId":"63045","inReplyTo":null,"subject":"PKCS#11 authentication fails due to escaped URI","fromName":"Henry Reed","fromEmail":"henrymicreed@gmail.com","sentAt":"2025-03-02T23:21:55Z","receivedAt":"2025-03-02T23:22:33Z","isPatch":false,"sender":{"key":"henrymicreed@gmail.com","avatar":null},"body":"Thank you for filling out a Git bug report!\nPlease answer the following questions to help us understand your issue.\n\nWhat did you do before the bug happened? (Steps to reproduce your issue)\nI modified ~/.gitconfig to include my PKCS#11 URI for my YubiKey 5 smart\ncard. The contents of my ~/.gitconfig are:\n[http \"https://git.example.com\"]\n        sslCert =\n\"pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=0011223344556677;token=someUsername\"\n        sslKey =\n\"pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=0011223344556677;token=someUsername\"\n        sslbackend = openssl\n        sslkeytype = ENG\n        sslcerttype = ENG\n        sslCertPasswordProtected = true\n\nWhat did you expect to happen? (Expected behavior)\nI expected the URI to be passed, as is, to OpenSSL, without escaping\nspecial characters\n\nWhat happened instead? (Actual behavior)\nGit appears to escape special characters in the URI, like the equals sign,\ncolon and semicolon, causing OpenSSL to not recognize the URI. This is\nthe command line output is:\ngit clone https://git.example.com/org/repo.git\nCloning into 'repo'...\nfatal: cannot exec '/usr/bin/ksshaskpass': No such file or directory\nPassword for 'cert:///pkcs11%3Amodel%3DPKCS%252315%2520emulated%3Bmanufacturer%3Dpiv_II%3Bserial%3D0011223344556677%3Btoken%3DsomeUsername':\nfatal: Authentication failed for 'https://git.example.com/org/repo.git/'\n\nWhat's different between what you expected and what actually happened?\nThe URI should never be escaped.\n\nAnything else you want to add:\nThe version of Git in Rocky Linux 9 is 4.35.5. The URI is not escaped in\nthis version.\n\nSeparately, note that the serial, username and repo URL have been modified.\nI am working on a non-Internet connected system with Fedora 41. I am unable\nto disclose the YubiKey serial, username nor the repo URL.\n\nPlease review the rest of the bug report below.\nYou can delete any lines you don't wish to share.\n\n\n[System Info]\ngit version:\ngit version 2.48.1\ncpu: x86_64\nno commit associated with this build\nsizeof-long: 8\nsizeof-size_t: 8\nshell-path: /bin/sh\nlibcurl: 8.9.1\nOpenSSL: OpenSSL 3.2.2 4 Jun 2024\nzlib: 1.3.1.zlib-ng\nuname: Linux 6.12.13-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Feb  8\n20:05:26 UTC 2025 x86_64\ncompiler info: gnuc: 14.2\nlibc info: glibc: 2.40\n$SHELL (typically, interactive shell): /bin/bash\n\n\n[Enabled Hooks]\nnot run from a git repository - no hooks to show\n"}]}