Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures

From

Jeff King <peff@peff.net>

Date

Sep 23, 2026, 16:53 UTC

Message-ID

<20260923165348.GA29229@coredump.intra.peff.net>

In-Reply-To

<20260923164700.GA28538@coredump.intra.peff.net>

On Wed, Sep 23, 2026 at 12:47:01PM -0400, Jeff King wrote:

> So an ideal solution to me would be more like t5559 checking for the
> buggy version itself, setting a prereq, and then marking the tests with
> !HAVE_CURL_HTTP2_BUG.
> 
> That said, I'm not sure how tricky that would be to implement. We give
> the curl version with "git version --build-options", but we'd have to do
> some version number comparisons. It might not be worth spending a lot of
> time on this.

diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh
index 805bec025c..8f620f0b44 100755
--- a/t/t5551-http-fetch-smart.sh
+++ b/t/t5551-http-fetch-smart.sh
@@ -17,6 +17,15 @@ fi
 test "$HTTP_PROTO" = "HTTP/2" && enable_http2
 start_httpd
 
+# Curl 7.88.1 can fail to retry authentication after an early HTTP/2
+# response. This was fixed in curl 8.3.0; see
+# https://github.com/curl/curl/pull/11756. Match the known-broken version,
+# since older versions (e.g., 7.74.0) work.
+test_lazy_prereq HAVE_CURL_HTTP2_BUG '
+	test_have_prereq HTTP2 &&
+	test "$(build_option libcurl)" = 7.88.1
+'
+
 test_expect_success HTTP2 'enable client-side http/2' '
 	git config --global http.version HTTP/2
 '
@@ -224,7 +233,7 @@ test_expect_success 'clone from auth-only-for-push repository' '
 	test_cmp expect actual
 '
 
-test_expect_success 'clone from auth-only-for-objects repository' '
+test_expect_success !HAVE_CURL_HTTP2_BUG 'clone from auth-only-for-objects repository' '
 	echo two >expect &&
 	set_askpass user@host pass@host &&
 	git clone --bare "$HTTPD_URL/auth-fetch/smart/repo.git" half-auth &&
@@ -233,7 +242,7 @@ test_expect_success 'clone from auth-only-for-objects repository' '
 	test_cmp expect actual
 '
 
-test_expect_success 'no-op half-auth fetch does not require a password' '
+test_expect_success !HAVE_CURL_HTTP2_BUG 'no-op half-auth fetch does not require a password' '
 	set_askpass wrong &&
 
 	# NEEDSWORK: When using HTTP(S), protocol v0 supports a "half-auth"


Not too bad. I had envisioned checking the range of versions, since you
found the fix (but we'd have to either use 7.88.1 as the start, or find
the actual bug introduction). But this covers at least as much as the
CI debian-12 specifier would.

-Peff