t5563-simple-http-auth failures with v2.55.0-rc0

From: Todd Zullinger <tmz@pobox.com>
Date: Jun 11, 2026, 21:04 UTC
Message-ID: <20260611210456.XYfhytSL@teonanacatl.net>

Hi,

I tested the freshly-tagged 2.55.0-rc0 and noticed some new failures on the in-progress Fedora 45 (AKA Rawhide) for t5563.18 (http.emptyAuth=auto attempts Negotiate before credential_fill) which was added in 9b1630b972 (t5563: add tests for http.emptyAuth with Negotiate, 2026-04-16).

I notice that Fedora 44 (where the tests all pass) has curl-8.18.0 while Fedora 45 has curl-8.21.0-rc2. The version of httpd is the same between them, FWIW. I didn't compare other package differences; it could be something else entirely.

Here is the output from a failing test run:

--8<-- ++ test_when_finished per_test_cleanup ++ test 0 = 0 ++ test_cleanup=$'{ per_test_cleanup\n\t\t} || eval_ret=$?; :' ++ set_credential_reply get +++ test -n '' ++ local suffix= ++ cat ++ cat ++ cat ++ test_config_global credential.helper test-helper ++ test_when_finished 'test_unconfig --global '\''credential.helper'\''' ++ test 0 = 0 ++ test_cleanup=$'{ test_unconfig --global \'credential.helper\'\n\t\t} || eval_ret=$?; { per_test_cleanup\n\t\t} || eval_ret=$?; :' ++ git config --global credential.helper test-helper ++ GIT_TRACE_CURL='/builddir/build/BUILD/git-2.55.0_rc0-build/git-2.55.0.rc0/t/trash directory.t5563-simple-http-auth/trace-auto' ++ git -c http.emptyAuth=auto ls-remote http://127.0.0.1:5563/custom_auth/repo.git ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 HEAD ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 refs/heads/master ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 refs/tags/foo ++ grep 'HTTP/[0-9.]* 401' '/builddir/build/BUILD/git-2.55.0_rc0-build/git-2.55.0.rc0/t/trash directory.t5563-simple-http-auth/trace-auto' ++ test_line_count = 3 actual_401s ++ test 3 '!=' 3 +++ wc -l ++ test 2 = 3 ++ echo 'test_line_count: line count for actual_401s != 3' test_line_count: line count for actual_401s != 3 ++ cat actual_401s <= Recv header: HTTP/1.1 401 Authorization Required <= Recv header: HTTP/1.1 401 Authorization Required ++ return 1 error: last command exited with $?=1 not ok 18 - http.emptyAuth=auto attempts Negotiate before credential_fill --8<--

And a diff of the trace-auto from Fedora 44 and 45 via ./t5563-simple-http-auth.sh -dix --run='-18' (with the sending port normalized to 44444 to reduce the noise):

--- /dev/fd/63 2026-06-11 16:51:05.852135692 -0400 +++ /dev/fd/62 2026-06-11 16:51:05.853135711 -0400

@@ -23,6 +23,7 @@
 <= Recv header:
 <= Recv data, 0000000000 bytes (0x00000000)
 == Info: shutting down connection #0
+== Info: Could not find host 127.0.0.1 in the .netrc file; using defaults
 == Info: NTLM-proxy picked AND auth done set, clear picked
 == Info: Hostname 127.0.0.1 was found in DNS cache
 == Info:   Trying 127.0.0.1:5563...
@@ -47,37 +48,8 @@
 == Info: no chunk, no close, no size. Assume close to signal end
 <= Recv header, 0000000001 bytes (0x00000001)
 <= Recv header:
-== Info: shutting down connection #1
-== Info: Issue another request to this URL: 'http://127.0.0.1:5563/custom_auth/repo.git/info/refs?service=git-upload-pack'
-== Info: NTLM-proxy picked AND auth done set, clear picked
-== Info: Hostname 127.0.0.1 was found in DNS cache
-== Info:   Trying 127.0.0.1:5563...
-== Info: Established connection to 127.0.0.1 (127.0.0.1 port 5563) from 127.0.0.1 port 44444
-== Info: using HTTP/1.x
-== Info: gss_init_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible. SPNEGO cannot find mechanisms to negotiate. 
-== Info: Server auth using Negotiate with user ''
-=> Send header, 0000000214 bytes (0x000000d6)
-=> Send header: GET /custom_auth/repo.git/info/refs?service=git-upload-pack HTTP/1.1
-=> Send header: Host: 127.0.0.1:5563
-=> Send header: User-Agent: git/2.55.0.rc0
-=> Send header: Accept: */*
-=> Send header: Accept-Encoding: deflate, gzip, br
-=> Send header: Pragma: no-cache
-=> Send header: Git-Protocol: version=2
-=> Send header:
-== Info: Request completely sent off
-<= Recv header, 0000000036 bytes (0x00000024)
-<= Recv header: HTTP/1.1 401 Authorization Required
-== Info: gss_init_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible. SPNEGO cannot find mechanisms to negotiate. 
-<= Recv header, 0000000028 bytes (0x0000001c)
-<= Recv header: WWW-Authenticate: Negotiate
-<= Recv header, 0000000044 bytes (0x0000002c)
-<= Recv header: WWW-Authenticate: Basic realm="example.com"
-== Info: no chunk, no close, no size. Assume close to signal end
-<= Recv header, 0000000001 bytes (0x00000001)
-<= Recv header:
 <= Recv data, 0000000000 bytes (0x00000000)
-== Info: shutting down connection #2
+== Info: shutting down connection #1
 == Info: NTLM-proxy picked AND auth done set, clear picked
 == Info: Hostname 127.0.0.1 was found in DNS cache
 == Info:   Trying 127.0.0.1:5563...
@@ -113,7 +85,7 @@
 <= Recv data: orn.0020fetch=shallow wait-for-done.0012server-option.0017ob
 <= Recv data: ject-format=sha1.0000
 <= Recv data, 0000000000 bytes (0x00000000)
-== Info: shutting down connection #3
+== Info: shutting down connection #2
 == Info: NTLM-proxy picked AND auth done set, clear picked
 == Info: Hostname 127.0.0.1 was found in DNS cache
 == Info:   Trying 127.0.0.1:5563...
@@ -154,4 +126,4 @@
 <= Recv data: 9e4eb3 refs/heads/master.003bddd63c907a6168e9992caee4ef0e0fa
 <= Recv data: 1139e4eb3 refs/tags/foo.0000
 <= Recv data, 0000000000 bytes (0x00000000)
-== Info: shutting down connection #4
+== Info: shutting down connection #3

The absence of one of the requests stands out.  Anyone
familiar with this area have suggestions for how to further
debug it?  It should reproduce easily in a Fedora 45
container, if anyone wants to poke at it more directly.

Thanks,

-- 
Todd