From: Todd Zullinger Date: Thu, 11 Jun 2026 21:04:56 GMT Subject: t5563-simple-http-auth failures with v2.55.0-rc0 Message-ID: <20260611210456.XYfhytSL@teonanacatl.net> Hi, I tested the freshly-tagged 2.55.0-rc0 and noticed some new failures on the in-progress Fedora 45 (AKA Rawhide) for t5563.18 (http.emptyAuth=auto attempts Negotiate before credential_fill) which was added in 9b1630b972 (t5563: add tests for http.emptyAuth with Negotiate, 2026-04-16). I notice that Fedora 44 (where the tests all pass) has curl-8.18.0 while Fedora 45 has curl-8.21.0-rc2. The version of httpd is the same between them, FWIW. I didn't compare other package differences; it could be something else entirely. Here is the output from a failing test run: --8<-- ++ test_when_finished per_test_cleanup ++ test 0 = 0 ++ test_cleanup=$'{ per_test_cleanup\n\t\t} || eval_ret=$?; :' ++ set_credential_reply get +++ test -n '' ++ local suffix= ++ cat ++ cat ++ cat ++ test_config_global credential.helper test-helper ++ test_when_finished 'test_unconfig --global '\''credential.helper'\''' ++ test 0 = 0 ++ test_cleanup=$'{ test_unconfig --global \'credential.helper\'\n\t\t} || eval_ret=$?; { per_test_cleanup\n\t\t} || eval_ret=$?; :' ++ git config --global credential.helper test-helper ++ GIT_TRACE_CURL='/builddir/build/BUILD/git-2.55.0_rc0-build/git-2.55.0.rc0/t/trash directory.t5563-simple-http-auth/trace-auto' ++ git -c http.emptyAuth=auto ls-remote http://127.0.0.1:5563/custom_auth/repo.git ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 HEAD ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 refs/heads/master ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 refs/tags/foo ++ grep 'HTTP/[0-9.]* 401' '/builddir/build/BUILD/git-2.55.0_rc0-build/git-2.55.0.rc0/t/trash directory.t5563-simple-http-auth/trace-auto' ++ test_line_count = 3 actual_401s ++ test 3 '!=' 3 +++ wc -l ++ test 2 = 3 ++ echo 'test_line_count: line count for actual_401s != 3' test_line_count: line count for actual_401s != 3 ++ cat actual_401s <= Recv header: HTTP/1.1 401 Authorization Required <= Recv header: HTTP/1.1 401 Authorization Required ++ return 1 error: last command exited with $?=1 not ok 18 - http.emptyAuth=auto attempts Negotiate before credential_fill --8<-- And a diff of the trace-auto from Fedora 44 and 45 via ./t5563-simple-http-auth.sh -dix --run='-18' (with the sending port normalized to 44444 to reduce the noise): --- /dev/fd/63 2026-06-11 16:51:05.852135692 -0400 +++ /dev/fd/62 2026-06-11 16:51:05.853135711 -0400 @@ -23,6 +23,7 @@ <= Recv header: <= Recv data, 0000000000 bytes (0x00000000) == Info: shutting down connection #0 +== Info: Could not find host 127.0.0.1 in the .netrc file; using defaults == Info: NTLM-proxy picked AND auth done set, clear picked == Info: Hostname 127.0.0.1 was found in DNS cache == Info: Trying 127.0.0.1:5563... @@ -47,37 +48,8 @@ == Info: no chunk, no close, no size. Assume close to signal end <= Recv header, 0000000001 bytes (0x00000001) <= Recv header: -== Info: shutting down connection #1 -== Info: Issue another request to this URL: 'http://127.0.0.1:5563/custom_auth/repo.git/info/refs?service=git-upload-pack' -== Info: NTLM-proxy picked AND auth done set, clear picked -== Info: Hostname 127.0.0.1 was found in DNS cache -== Info: Trying 127.0.0.1:5563... -== Info: Established connection to 127.0.0.1 (127.0.0.1 port 5563) from 127.0.0.1 port 44444 -== Info: using HTTP/1.x -== Info: gss_init_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible. SPNEGO cannot find mechanisms to negotiate. -== Info: Server auth using Negotiate with user '' -=> Send header, 0000000214 bytes (0x000000d6) -=> Send header: GET /custom_auth/repo.git/info/refs?service=git-upload-pack HTTP/1.1 -=> Send header: Host: 127.0.0.1:5563 -=> Send header: User-Agent: git/2.55.0.rc0 -=> Send header: Accept: */* -=> Send header: Accept-Encoding: deflate, gzip, br -=> Send header: Pragma: no-cache -=> Send header: Git-Protocol: version=2 -=> Send header: -== Info: Request completely sent off -<= Recv header, 0000000036 bytes (0x00000024) -<= Recv header: HTTP/1.1 401 Authorization Required -== Info: gss_init_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible. SPNEGO cannot find mechanisms to negotiate. -<= Recv header, 0000000028 bytes (0x0000001c) -<= Recv header: WWW-Authenticate: Negotiate -<= Recv header, 0000000044 bytes (0x0000002c) -<= Recv header: WWW-Authenticate: Basic realm="example.com" -== Info: no chunk, no close, no size. Assume close to signal end -<= Recv header, 0000000001 bytes (0x00000001) -<= Recv header: <= Recv data, 0000000000 bytes (0x00000000) -== Info: shutting down connection #2 +== Info: shutting down connection #1 == Info: NTLM-proxy picked AND auth done set, clear picked == Info: Hostname 127.0.0.1 was found in DNS cache == Info: Trying 127.0.0.1:5563... @@ -113,7 +85,7 @@ <= Recv data: orn.0020fetch=shallow wait-for-done.0012server-option.0017ob <= Recv data: ject-format=sha1.0000 <= Recv data, 0000000000 bytes (0x00000000) -== Info: shutting down connection #3 +== Info: shutting down connection #2 == Info: NTLM-proxy picked AND auth done set, clear picked == Info: Hostname 127.0.0.1 was found in DNS cache == Info: Trying 127.0.0.1:5563... @@ -154,4 +126,4 @@ <= Recv data: 9e4eb3 refs/heads/master.003bddd63c907a6168e9992caee4ef0e0fa <= Recv data: 1139e4eb3 refs/tags/foo.0000 <= Recv data, 0000000000 bytes (0x00000000) -== Info: shutting down connection #4 +== Info: shutting down connection #3 The absence of one of the requests stands out. Anyone familiar with this area have suggestions for how to further debug it? It should reproduce easily in a Fedora 45 container, if anyone wants to poke at it more directly. Thanks, -- Todd