Re: git smart-http do not authent to allow git ls-remote to be called anonymously

From: Jeff King <peff@peff.net>
Date: Oct 31, 2012, 11:53 UTC
Message-ID: <20121031115346.GC30879@sigill.intra.peff.net>
In-Reply-To: <CAHtLG6SsMgwquaD_Rd0YvR9Ues-u1ktEdOXC2MAfEM9Naac=5g@mail.gmail.com>

[+cc git@vger; please keep discussion on the list]

On Sun, Oct 28, 2012 at 01:26:51PM +0800, 乙酸鋰 wrote:

Show 13 quoted lines

> > POST /git/Cat1/SubCat1/xsp.git/git-upload-pack HTTP/1.1
> User-Agent: git/1.8.0
> Host: localhost
> Accept-Encoding: gzip
> Content-Type: application/x-git-upload-pack-request
> Accept: application/x-git-upload-pack-result
> Content-Length: 190
> 
> * The requested URL returned error: 401
> * Closing connection #0
> Username for 'http://localhost': user
> Password for 'http://user@localhost':
> fatal: The remote end hung up unexpectedly

OK, I see what is going on. The code in b81401c to retry POST requests does not handle gzipped contents, and upload-pack tends to gzip what it sends.

Your apache configuration is not really something that we ever intended to support, and I am a little dubious of the security tradeoff being made. But it is actually pretty easy for us to support, and it eliminates a special case from the code, so I am tempted to do so.

The following patch series (on top of the current master, as they require some cleanup that did not make it into 1.8.0) seems to fix it for me.

  [1/2]: remote-curl: hoist gzip buffer size to top of post_rpc
  [2/2]: remote-curl: retry failed requests for auth even with gzip

-Peff