# [PATCH] ci: work around Debian 12's HTTP/2 authentication failures 13 messages from 2026-09-22 to 2026-10-06. Participants: Johannes Schindelin via GitGitGadget, Junio C Hamano, Jeff King, Johannes Schindelin. Thread: https://gitlist.dev/t/66374 ## Johannes Schindelin via GitGitGadget, 2026-09-22 23:06 Subject: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: ``` From: Johannes Schindelin Since 00fa8502354 (ci: bump debian-11 job to debian-12, 2026-09-05), the `debian-12` job has intermittently failed t5559's half-auth clone with: curl 92 Stream error in the HTTP/2 framing layer Anonymous discovery succeeds, but the upload-pack POST requires authentication. Apache can return an early 401 and close the HTTP/2 stream before libcurl finishes sending the request body. Debian 12's curl 7.88.1 treats that closure as a transport error instead of allowing an authentication retry. Curl fixed this handling in 331b89a319d0 (http2: polish things around POST), included in 8.3.0: https://github.com/curl/curl/pull/11756 This did not happen before switching to Debian 12 because Debian 11 ships with libcurl 7.74.0-1.3+deb11u16, which does not have that bug. Replacing the packaged libcurl with a modern build would defeat this job's purpose of testing older supported distributions. So let's simply exclude the flaky t5559.15 and its dependent t5559.16 on Debian 12 until the packaged curl carries the fix (or until the end of time, whichever comes first). Assisted-by: GPT-6 Astra Signed-off-by: Johannes Schindelin --- ci: work around Debian 12's HTTP/2 authentication failures While this is a regression in v2.56, it does not affect production code, it's just working around a flaky test. In other words: This patch does not need to be fast-tracked into v2.56.0, but it would be good to get it into master pretty soon after that, to reduce developer friction. Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2236%2Fdscho%2Fwork-around-debian-curl-stream-error-92-v1 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2236/dscho/work-around-debian-curl-stream-error-92-v1 Pull-Request: https://github.com/gitgitgadget/git/pull/2236 ci/lib.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ci/lib.sh b/ci/lib.sh index c6ccbf8c17..1cf31b5a2c 100755 --- a/ci/lib.sh +++ b/ci/lib.sh @@ -334,6 +334,12 @@ pull_request,*|push,*next*|push,*master*|push,*main*|push,*maint*) esac case "$distro" in +debian-12) + # Debian 12's curl 7.88.1 mishandles early HTTP/2 responses; see + # https://github.com/curl/curl/pull/11756. Skip the half-auth + # clone and its dependent fetch until Debian has the fix. + export GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5559.15 t5559.16" + ;; ubuntu-*) # Python 2 is end of life, and Ubuntu 23.04 and newer don't actually # have it anymore. We thus only test with Python 2 on older LTS base-commit: 3bc0341126508f78f5869cbfc0005e987efdf0c7 -- gitgitgadget ``` ## Junio C Hamano, 2026-09-23 16:16 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: In-Reply-To: ``` "Johannes Schindelin via GitGitGadget" writes: > From: Johannes Schindelin > > Since 00fa8502354 (ci: bump debian-11 job to debian-12, 2026-09-05), the > `debian-12` job has intermittently failed t5559's half-auth clone with: > > curl 92 Stream error in the HTTP/2 framing layer > > Anonymous discovery succeeds, but the upload-pack POST requires > authentication. Apache can return an early 401 and close the HTTP/2 > stream before libcurl finishes sending the request body. Debian 12's > curl 7.88.1 treats that closure as a transport error instead of allowing > an authentication retry. Curl fixed this handling in 331b89a319d0 > (http2: polish things around POST), included in 8.3.0: > https://github.com/curl/curl/pull/11756 > > This did not happen before switching to Debian 12 because Debian 11 > ships with libcurl 7.74.0-1.3+deb11u16, which does not have that bug. Superb. A well written diagnosis like this is worth a ton. > Replacing the packaged libcurl with a modern build would defeat this > job's purpose of testing older supported distributions. So let's simply > exclude the flaky t5559.15 and its dependent t5559.16 on Debian 12 until > the packaged curl carries the fix (or until the end of time, whichever > comes first). Oh, 100% agree with the reasoning. Thanks for this workaround. > it's just working around a flaky test. In other words: This patch does > not need to be fast-tracked into v2.56.0, but it would be good to get it > into master pretty soon after that, to reduce developer friction. Yes. I do not think there is any reason to cook it as long as other usual patches. Fast-tracking would make sure other things do keep working on older Debian. Thanks. > > Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2236%2Fdscho%2Fwork-around-debian-curl-stream-error-92-v1 > Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2236/dscho/work-around-debian-curl-stream-error-92-v1 > Pull-Request: https://github.com/gitgitgadget/git/pull/2236 > > ci/lib.sh | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/ci/lib.sh b/ci/lib.sh > index c6ccbf8c17..1cf31b5a2c 100755 > --- a/ci/lib.sh > +++ b/ci/lib.sh > @@ -334,6 +334,12 @@ pull_request,*|push,*next*|push,*master*|push,*main*|push,*maint*) > esac > > case "$distro" in > +debian-12) > + # Debian 12's curl 7.88.1 mishandles early HTTP/2 responses; see > + # https://github.com/curl/curl/pull/11756. Skip the half-auth > + # clone and its dependent fetch until Debian has the fix. > + export GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5559.15 t5559.16" > + ;; > ubuntu-*) > # Python 2 is end of life, and Ubuntu 23.04 and newer don't actually > # have it anymore. We thus only test with Python 2 on older LTS > > base-commit: 3bc0341126508f78f5869cbfc0005e987efdf0c7 ``` ## Jeff King, 2026-09-23 16:47 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: <20260923164700.GA28538@coredump.intra.peff.net> In-Reply-To: ``` On Tue, Sep 22, 2026 at 11:06:13PM +0000, Johannes Schindelin via GitGitGadget wrote: > Anonymous discovery succeeds, but the upload-pack POST requires > authentication. Apache can return an early 401 and close the HTTP/2 > stream before libcurl finishes sending the request body. Debian 12's > curl 7.88.1 treats that closure as a transport error instead of allowing > an authentication retry. Curl fixed this handling in 331b89a319d0 > (http2: polish things around POST), included in 8.3.0: > https://github.com/curl/curl/pull/11756 > > This did not happen before switching to Debian 12 because Debian 11 > ships with libcurl 7.74.0-1.3+deb11u16, which does not have that bug. Thanks for finding and fixing. I saw this yesterday but hadn't had time to dig in yet, and your explanation is very satisfying. :) > Replacing the packaged libcurl with a modern build would defeat this > job's purpose of testing older supported distributions. So let's simply > exclude the flaky t5559.15 and its dependent t5559.16 on Debian 12 until > the packaged curl carries the fix (or until the end of time, whichever > comes first). That should reduce the immediate CI pain, though I can think of two downsides: - we're detecting based on CI job name, not on the presence of the known bug. So it won't help anybody running the tests themselves (even people on debian-12!) - we're relying on test numbering, which can change over time. So if we add new setup tests early in t5559 (actually, t5551 which it's based on!) these will silently go out of sync. So an ideal solution to me would be more like t5559 checking for the buggy version itself, setting a prereq, and then marking the tests with !HAVE_CURL_HTTP2_BUG. That said, I'm not sure how tricky that would be to implement. We give the curl version with "git version --build-options", but we'd have to do some version number comparisons. It might not be worth spending a lot of time on this. -Peff ``` ## Jeff King, 2026-09-23 16:53 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: <20260923165348.GA29229@coredump.intra.peff.net> In-Reply-To: <20260923164700.GA28538@coredump.intra.peff.net> ``` On Wed, Sep 23, 2026 at 12:47:01PM -0400, Jeff King wrote: > So an ideal solution to me would be more like t5559 checking for the > buggy version itself, setting a prereq, and then marking the tests with > !HAVE_CURL_HTTP2_BUG. > > That said, I'm not sure how tricky that would be to implement. We give > the curl version with "git version --build-options", but we'd have to do > some version number comparisons. It might not be worth spending a lot of > time on this. I guess our robot overlords^Whelpers could help with that. I passed your patch and my email to Astra, which came up with this: diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh index 805bec025c..8f620f0b44 100755 --- a/t/t5551-http-fetch-smart.sh +++ b/t/t5551-http-fetch-smart.sh @@ -17,6 +17,15 @@ fi test "$HTTP_PROTO" = "HTTP/2" && enable_http2 start_httpd +# Curl 7.88.1 can fail to retry authentication after an early HTTP/2 +# response. This was fixed in curl 8.3.0; see +# https://github.com/curl/curl/pull/11756. Match the known-broken version, +# since older versions (e.g., 7.74.0) work. +test_lazy_prereq HAVE_CURL_HTTP2_BUG ' + test_have_prereq HTTP2 && + test "$(build_option libcurl)" = 7.88.1 +' + test_expect_success HTTP2 'enable client-side http/2' ' git config --global http.version HTTP/2 ' @@ -224,7 +233,7 @@ test_expect_success 'clone from auth-only-for-push repository' ' test_cmp expect actual ' -test_expect_success 'clone from auth-only-for-objects repository' ' +test_expect_success !HAVE_CURL_HTTP2_BUG 'clone from auth-only-for-objects repository' ' echo two >expect && set_askpass user@host pass@host && git clone --bare "$HTTPD_URL/auth-fetch/smart/repo.git" half-auth && @@ -233,7 +242,7 @@ test_expect_success 'clone from auth-only-for-objects repository' ' test_cmp expect actual ' -test_expect_success 'no-op half-auth fetch does not require a password' ' +test_expect_success !HAVE_CURL_HTTP2_BUG 'no-op half-auth fetch does not require a password' ' set_askpass wrong && # NEEDSWORK: When using HTTP(S), protocol v0 supports a "half-auth" Not too bad. I had envisioned checking the range of versions, since you found the fix (but we'd have to either use 7.88.1 as the start, or find the actual bug introduction). But this covers at least as much as the CI debian-12 specifier would. -Peff ``` ## Jeff King, 2026-09-23 16:59 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: <20260923165922.GB29229@coredump.intra.peff.net> In-Reply-To: <20260923165348.GA29229@coredump.intra.peff.net> ``` On Wed, Sep 23, 2026 at 12:53:48PM -0400, Jeff King wrote: > I guess our robot overlords^Whelpers could help with that. I passed your > patch and my email to Astra, which came up with this: > > [...] > > Not too bad. I had envisioned checking the range of versions, since you > found the fix (but we'd have to either use 7.88.1 as the start, or find > the actual bug introduction). But this covers at least as much as the > CI debian-12 specifier would. OK, last email, I promise, since you could probably be feeding this to Astra just as easily as I am (and you did the actual interesting work on the patch of figuring out the problem, so I'll leave it to you decide which approach you like). The range version is something like this: diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh index 805bec025c..3d18f98c9d 100755 --- a/t/t5551-http-fetch-smart.sh +++ b/t/t5551-http-fetch-smart.sh @@ -17,6 +17,21 @@ fi test "$HTTP_PROTO" = "HTTP/2" && enable_http2 start_httpd +# Curl 7.88.1 can fail to retry authentication after an early HTTP/2 +# response. This was fixed in curl 8.3.0; see +# https://github.com/curl/curl/pull/11756. The first affected version is +# unknown, so conservatively assume that versions from 7.88.1 up to (but +# not including) 8.3.0 are broken. +test_lazy_prereq HAVE_CURL_HTTP2_BUG ' + test_have_prereq HTTP2 && + build_option libcurl | + awk -F. '\'' + ($1 == 7 && ($2 > 88 || ($2 == 88 && $3 >= 1))) || + ($1 == 8 && $2 < 3) { broken = 1 } + END { exit !broken } + '\'' +' + test_expect_success HTTP2 'enable client-side http/2' ' git config --global http.version HTTP/2 ' which is not _too_ ugly. -Peff ``` ## Junio C Hamano, 2026-09-23 17:17 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: In-Reply-To: <20260923165922.GB29229@coredump.intra.peff.net> ``` Jeff King writes: > +# Curl 7.88.1 can fail to retry authentication after an early HTTP/2 > +# response. This was fixed in curl 8.3.0; see > +# https://github.com/curl/curl/pull/11756. The first affected version is > +# unknown, so conservatively assume that versions from 7.88.1 up to (but > +# not including) 8.3.0 are broken. Just nitpicking the wording, but if the first affected version is truly unknown, assuming that versions from 7.88.1 up is *not* a conservative thing to do at all, is it? If 7.88.1 is from an irrelevantly ancient past, I would say that we should just skip anything older than 8.3.0, but 7.88.1 is from early 2023 and we cannot do such a simplification. > +test_lazy_prereq HAVE_CURL_HTTP2_BUG ' > + test_have_prereq HTTP2 && > + build_option libcurl | > + awk -F. '\'' > + ($1 == 7 && ($2 > 88 || ($2 == 88 && $3 >= 1))) || > + ($1 == 8 && $2 < 3) { broken = 1 } > + END { exit !broken } > + '\'' > +' > + > test_expect_success HTTP2 'enable client-side http/2' ' > git config --global http.version HTTP/2 > ' > > which is not _too_ ugly. > > -Peff ``` ## Jeff King, 2026-09-23 19:25 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: <20260923192514.GA43344@coredump.intra.peff.net> In-Reply-To: ``` On Wed, Sep 23, 2026 at 10:17:05AM -0700, Junio C Hamano wrote: > Jeff King writes: > > > +# Curl 7.88.1 can fail to retry authentication after an early HTTP/2 > > +# response. This was fixed in curl 8.3.0; see > > +# https://github.com/curl/curl/pull/11756. The first affected version is > > +# unknown, so conservatively assume that versions from 7.88.1 up to (but > > +# not including) 8.3.0 are broken. > > Just nitpicking the wording, but if the first affected version is > truly unknown, assuming that versions from 7.88.1 up is *not* a > conservative thing to do at all, is it? > > If 7.88.1 is from an irrelevantly ancient past, I would say that we > should just skip anything older than 8.3.0, but 7.88.1 is from early > 2023 and we cannot do such a simplification. It depends on what bad outcome we are being conservative against. If the bad outcome is skipping the test on a version for which we could reliably use it, then it is conservative to only select known-bad versions. If the bad outcome is somebody running the test and seeing a flaky fail, then yes, the more conservative thing would be extending to skip older unknown versions (potentially up to "forever"). I think you could argue either way (and I am OK with either, or even just matching 7.88.1). -Peff ``` ## Johannes Schindelin, 2026-09-24 18:59 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: In-Reply-To: <20260923192514.GA43344@coredump.intra.peff.net> ``` Hi Jeff, On Wed, 23 Sep 2026, Jeff King wrote: > On Wed, Sep 23, 2026 at 10:17:05AM -0700, Junio C Hamano wrote: > > > Jeff King writes: > > > > > +# Curl 7.88.1 can fail to retry authentication after an early HTTP/2 > > > +# response. This was fixed in curl 8.3.0; see > > > +# https://github.com/curl/curl/pull/11756. The first affected version is > > > +# unknown, so conservatively assume that versions from 7.88.1 up to (but > > > +# not including) 8.3.0 are broken. > > > > Just nitpicking the wording, but if the first affected version is > > truly unknown, assuming that versions from 7.88.1 up is *not* a > > conservative thing to do at all, is it? > > > > If 7.88.1 is from an irrelevantly ancient past, I would say that we > > should just skip anything older than 8.3.0, but 7.88.1 is from early > > 2023 and we cannot do such a simplification. > > It depends on what bad outcome we are being conservative against. If the > bad outcome is skipping the test on a version for which we could > reliably use it, then it is conservative to only select known-bad > versions. If the bad outcome is somebody running the test and seeing a > flaky fail, then yes, the more conservative thing would be extending to > skip older unknown versions (potentially up to "forever"). > > I think you could argue either way (and I am OK with either, or even > just matching 7.88.1). I had GPT-6 dig deeper into the issue, since you're right: This should not be a CI/Debian-only gate, at the same time I didn't know what was the first version with the bug, so I suspected the version range to be subtly inaccurate. Turns out that the bug appeared first in cURL v7.88.0. So I adjusted your version range in preparation for the next patch iteration. Thank you! Johannes ``` ## Junio C Hamano, 2026-09-24 19:42 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: In-Reply-To: ``` Johannes Schindelin writes: >> I think you could argue either way (and I am OK with either, or even >> just matching 7.88.1). > > I had GPT-6 dig deeper into the issue, since you're right: This should not > be a CI/Debian-only gate, at the same time I didn't know what was the > first version with the bug, so I suspected the version range to be subtly > inaccurate. Turns out that the bug appeared first in cURL v7.88.0. So I > adjusted your version range in preparation for the next patch iteration. Great digging. So it is between 7.88.0 and 8.3.0? ``` ## Johannes Schindelin via GitGitGadget, 2026-09-24 20:53 Subject: [PATCH v2] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: In-Reply-To: ``` From: Johannes Schindelin Since 00fa8502354 (ci: bump debian-11 job to debian-12, 2026-09-05), the `debian-12` job has intermittently failed t5559's half-auth clone with: curl 92 Stream error in the HTTP/2 framing layer Anonymous discovery succeeds, but the upload-pack POST requires authentication. Apache can return an early 401 and close the HTTP/2 stream before libcurl finishes sending the request body. Debian 12's curl 7.88.1 treats that closure as a transport error instead of allowing an authentication retry. Curl fixed this handling in 331b89a319d0 (http2: polish things around POST), included in 8.3.0: https://github.com/curl/curl/pull/11756 This did not happen before switching to Debian 12 because Debian 11 ships with libcurl 7.74.0-1.3+deb11u16, which does not have that bug, it was only introduced in cURL 7.88.0. Replacing the packaged libcurl with a modern build would defeat this job's purpose of testing older supported distributions. So let's simply skip the flaky test cases when a buggy libcurl version is detected. Assisted-by: GPT-6 Astra, GPT-6 Sol Helped-by: Jeff King Signed-off-by: Johannes Schindelin --- ci: work around Debian 12's HTTP/2 authentication failures While this is a regression in v2.56, it does not affect production code, it's just working around a flaky test. In other words: This patch does not need to be fast-tracked into v2.56.0, but it would be good to get it into master pretty soon after that, to reduce developer friction. Changes since v1: * Instead of hard-coding the test case numbers specifically on Debian 12, thanks to Jeff King the test cases now have a libcurl-version-gating prereq. Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2236%2Fdscho%2Fwork-around-debian-curl-stream-error-92-v2 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2236/dscho/work-around-debian-curl-stream-error-92-v2 Pull-Request: https://github.com/gitgitgadget/git/pull/2236 Range-diff vs v1: 1: 1dfabf3ece < -: ---------- ci: work around Debian 12's HTTP/2 authentication failures -: ---------- > 1: e4c5658fb1 ci: work around Debian 12's HTTP/2 authentication failures t/t5551-http-fetch-smart.sh | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh index 805bec025c..57f263ca5b 100755 --- a/t/t5551-http-fetch-smart.sh +++ b/t/t5551-http-fetch-smart.sh @@ -17,6 +17,19 @@ fi test "$HTTP_PROTO" = "HTTP/2" && enable_http2 start_httpd +# The cURL version which Debian 12 ships (v7.88.1) can fail to retry +# authentication after an early HTTP/2 response. This bug was introduced +# in cURL v7.88.0 (8c762f5998 (http2: minor buffer and error path fixes, +# 2023-02-08)) and fixed in v8.3.0 (https://github.com/curl/curl/pull/11756). +test_lazy_prereq HAVE_CURL_HTTP2_BUG " + test_have_prereq HTTP2 && + build_option libcurl | + awk -F. ' + ($1 == 7 && $2 >= 88) || ($1 == 8 && $2 < 3) { broken = 1 } + END { exit !broken } + ' +" + test_expect_success HTTP2 'enable client-side http/2' ' git config --global http.version HTTP/2 ' @@ -224,7 +237,8 @@ test_expect_success 'clone from auth-only-for-push repository' ' test_cmp expect actual ' -test_expect_success 'clone from auth-only-for-objects repository' ' +test_expect_success !HAVE_CURL_HTTP2_BUG \ + 'clone from auth-only-for-objects repository' ' echo two >expect && set_askpass user@host pass@host && git clone --bare "$HTTPD_URL/auth-fetch/smart/repo.git" half-auth && @@ -233,7 +247,8 @@ test_expect_success 'clone from auth-only-for-objects repository' ' test_cmp expect actual ' -test_expect_success 'no-op half-auth fetch does not require a password' ' +test_expect_success !HAVE_CURL_HTTP2_BUG \ + 'no-op half-auth fetch does not require a password' ' set_askpass wrong && # NEEDSWORK: When using HTTP(S), protocol v0 supports a "half-auth" base-commit: 3bc0341126508f78f5869cbfc0005e987efdf0c7 -- gitgitgadget ``` ## Jeff King, 2026-09-24 23:22 Subject: Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures Message-ID: <20260924232214.GA765100@coredump.intra.peff.net> In-Reply-To: ``` On Thu, Sep 24, 2026 at 08:59:24PM +0200, Johannes Schindelin wrote: > I had GPT-6 dig deeper into the issue, since you're right: This should not > be a CI/Debian-only gate, at the same time I didn't know what was the > first version with the bug, so I suspected the version range to be subtly > inaccurate. Turns out that the bug appeared first in cURL v7.88.0. So I > adjusted your version range in preparation for the next patch iteration. Great, it feels nicer knowing the actual start point. Your v2 patch looks good to me! -Peff ``` ## Jeff King, 2026-10-06 03:43 Subject: [PATCH] t5551: fix quoting in curl version bug prereq Message-ID: <20261006034331.GA1325722@coredump.intra.peff.net> In-Reply-To: ``` On Thu, Sep 24, 2026 at 08:53:49PM +0000, Johannes Schindelin via GitGitGadget wrote: > +# The cURL version which Debian 12 ships (v7.88.1) can fail to retry > +# authentication after an early HTTP/2 response. This bug was introduced > +# in cURL v7.88.0 (8c762f5998 (http2: minor buffer and error path fixes, > +# 2023-02-08)) and fixed in v8.3.0 (https://github.com/curl/curl/pull/11756). > +test_lazy_prereq HAVE_CURL_HTTP2_BUG " > + test_have_prereq HTTP2 && > + build_option libcurl | > + awk -F. ' > + ($1 == 7 && $2 >= 88) || ($1 == 8 && $2 < 3) { broken = 1 } > + END { exit !broken } > + ' > +" Doh, this is totally broken. The prereq snippet is in double-quotes, so the $1, etc in the awk invocation are interpolated before we even eval it. Fix is below. -- >8 -- Subject: [PATCH] t5551: fix quoting in curl version bug prereq We have a prereq snippet that invokes awk. The awk script's $1, etc, variables need to be quoted to avoid shell interpolation. We correctly use a single-quote inside the prereq snippet, but the snippet itself is contained in double-quotes. So we interpolate "$1" into whatever value that happens to have in the outer shell, and eval nonsense like: awk '(--some-garbage == 7 && --other-garbage >= 88) ...' As a result, we don't think we have a buggy curl version even when we do, and run the test anyway. But of course it's easy not to notice, since this prereq was protecting us from a racy bug. It only breaks sometimes. There are a few options for fixing the quoting: 1. Backslash-escaping the dollar signs. This is perhaps the least-ugly version, but it's a minor hassle to remember if somebody touches the code later. 2. Single-quote the snippet, then quote interior single-quotes as '\''. Reasonably obvious, but ugly. 3. Use the '<<\EOT' here-doc trick to specify the snippet. This would look nice, but we don't yet support it for prereqs. ;) This patch uses (2), and we can circle back to (3) to make it look nicer later. Signed-off-by: Jeff King --- This should go on top of js/ci-debian-12-http2-workaround. Since I know we both used GPT to work on this, I was curious if this slipped past it. Doesn't look like it from what I sent (which used option 2 above). I wonder if your agent flipped it, or if you saw how ugly it was and flipped it yourself. Not blaming, but it's just a funny and interesting data point if a human second-guessing the AI output introduced a bug. t/t5551-http-fetch-smart.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh index f66d7ce7ac..cb681e644f 100755 --- a/t/t5551-http-fetch-smart.sh +++ b/t/t5551-http-fetch-smart.sh @@ -21,14 +21,14 @@ start_httpd # authentication after an early HTTP/2 response. This bug was introduced # in cURL v7.88.0 (8c762f5998 (http2: minor buffer and error path fixes, # 2023-02-08)) and fixed in v8.3.0 (https://github.com/curl/curl/pull/11756). -test_lazy_prereq HAVE_CURL_HTTP2_BUG " +test_lazy_prereq HAVE_CURL_HTTP2_BUG ' test_have_prereq HTTP2 && build_option libcurl | - awk -F. ' + awk -F. '\'' ($1 == 7 && $2 >= 88) || ($1 == 8 && $2 < 3) { broken = 1 } END { exit !broken } - ' -" + '\'' +' test_expect_success HTTP2 'enable client-side http/2' ' git config --global http.version HTTP/2 -- 2.56.0.399.g9e0ddc9b37 ``` ## Jeff King, 2026-10-06 03:52 Subject: [PATCH 2/1] test-lib: allow lazy prerequisite snippets as here-docs Message-ID: <20261006035239.GA1335881@coredump.intra.peff.net> In-Reply-To: <20261006034331.GA1325722@coredump.intra.peff.net> ``` On Mon, Oct 05, 2026 at 11:43:32PM -0400, Jeff King wrote: > 2. Single-quote the snippet, then quote interior single-quotes as > '\''. Reasonably obvious, but ugly. > > 3. Use the '<<\EOT' here-doc trick to specify the snippet. This would > look nice, but we don't yet support it for prereqs. ;) > > This patch uses (2), and we can circle back to (3) to make it look nicer > later. Doing (3) turned out easier than I thought it would. Patch is below. I think it still makes sense to do the immediate fix with (2), and then this on top as cleanup (or as a separate topic, though obviously there is a textual dependency). -- >8 -- Subject: test-lib: allow lazy prerequisite snippets as here-docs Commit 1d133ae91f (test-lib: allow test snippets as here-docs, 2024-07-10) let test_expect_success and test_expect_failure read their snippets from stdin, making it easier to use single quotes within them. I mentioned there that we could extend this to lazy prerequisites, but left it for later. Let's finish that off now. Since test_body_or_stdin() takes the name of the variable to fill, we can use it directly to populate the saved prereq snippet. We read the body when the prereq is declared, but still evaluate it only when the prereq is used. Converting the curl version check in t5551 shows how this can reduce awkward quoting. Signed-off-by: Jeff King --- t/t5551-http-fetch-smart.sh | 8 ++++---- t/test-lib-functions.sh | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh index cb681e644f..9dd20d1c65 100755 --- a/t/t5551-http-fetch-smart.sh +++ b/t/t5551-http-fetch-smart.sh @@ -21,14 +21,14 @@ start_httpd # authentication after an early HTTP/2 response. This bug was introduced # in cURL v7.88.0 (8c762f5998 (http2: minor buffer and error path fixes, # 2023-02-08)) and fixed in v8.3.0 (https://github.com/curl/curl/pull/11756). -test_lazy_prereq HAVE_CURL_HTTP2_BUG ' +test_lazy_prereq HAVE_CURL_HTTP2_BUG - <<\EOT test_have_prereq HTTP2 && build_option libcurl | - awk -F. '\'' + awk -F. ' ($1 == 7 && $2 >= 88) || ($1 == 8 && $2 < 3) { broken = 1 } END { exit !broken } - '\'' -' + ' +EOT test_expect_success HTTP2 'enable client-side http/2' ' git config --global http.version HTTP/2 diff --git a/t/test-lib-functions.sh b/t/test-lib-functions.sh index 809c662124..de75ae842c 100644 --- a/t/test-lib-functions.sh +++ b/t/test-lib-functions.sh @@ -760,7 +760,7 @@ lazily_testable_prereq= lazily_tested_prereq= # Usage: test_lazy_prereq PREREQ 'script' test_lazy_prereq () { lazily_testable_prereq="$lazily_testable_prereq$1 " - eval test_prereq_lazily_$1=\$2 + test_body_or_stdin "test_prereq_lazily_$1" "$2" } test_run_lazy_prereq_ () { -- 2.56.0.399.g9e0ddc9b37 ```