Re: [PATCH v6] http: add http.sslVerifyStatus to check stapled OCSP responses

>
> Patrick Steinhardt <ps@pks.im> writes:
>
> > On Mon, Aug 31, 2026 at 07:16:54AM -0700, Junio C Hamano wrote:
> >> Patrick Steinhardt <ps@pks.im> writes:
> >>
> >> >> They do look involved but seem to cover the situations we do care
> >> >> about, except we seem not to test when the server does not explicitly
> >> >> say "this is still good", or am I not reading the tests correctly?
> >> >
> >> > Isn't the following test covering that scenario? Or am I misreading?
> >> >
> >> >     test_expect_success SSL_VERIFYSTATUS 'fetch succeeds with stapled "good" OCSP response'
> >> >            with_ssl_verification git -c http.sslVerifyStatus=true \
> >> >                    ls-remote "$HTTPD_URL/smart/repo.git" >actual &&
> >> >            test_line_count -gt 0 actual
> >> >     '
> >>
> >> Probably I misstated.  What I meant was a reaction to "fail close"
> >> floated earlier.  A server does not explicitly give stapled good,
> >> and the client says "this is not known-good" and not talking to it.
> >> I.e. 'fetch fails without stapled "good"'
> >
> > Ah, I think you're correct, my tests didn't include that. But Grayson's
> > already did as it doesn't require any setup, so that's why I didn't
> > include it specifically.
>
> Ah, I missed that.  So a combined patch taking the best parts from
> both sides is what we want.  Thanks for helping move the topic
> forward.