From: Grayson Gordon Date: Tue, 08 Sep 2026 12:55:06 GMT Subject: Re: [PATCH v6] http: add http.sslVerifyStatus to check stapled OCSP responses Message-ID: In-Reply-To: hello all, Sorry I've been away awhile. I'll put together the combined patch and shoot it over. - Grayson On Mon, Aug 31, 2026 at 10:31 AM Junio C Hamano wrote: > > Patrick Steinhardt writes: > > > On Mon, Aug 31, 2026 at 07:16:54AM -0700, Junio C Hamano wrote: > >> Patrick Steinhardt writes: > >> > >> >> They do look involved but seem to cover the situations we do care > >> >> about, except we seem not to test when the server does not explicitly > >> >> say "this is still good", or am I not reading the tests correctly? > >> > > >> > Isn't the following test covering that scenario? Or am I misreading? > >> > > >> > test_expect_success SSL_VERIFYSTATUS 'fetch succeeds with stapled "good" OCSP response' > >> > with_ssl_verification git -c http.sslVerifyStatus=true \ > >> > ls-remote "$HTTPD_URL/smart/repo.git" >actual && > >> > test_line_count -gt 0 actual > >> > ' > >> > >> Probably I misstated. What I meant was a reaction to "fail close" > >> floated earlier. A server does not explicitly give stapled good, > >> and the client says "this is not known-good" and not talking to it. > >> I.e. 'fetch fails without stapled "good"' > > > > Ah, I think you're correct, my tests didn't include that. But Grayson's > > already did as it doesn't require any setup, so that's why I didn't > > include it specifically. > > Ah, I missed that. So a combined patch taking the best parts from > both sides is what we want. Thanks for helping move the topic > forward.