Re: [PATCH 2/3] http: attempt Negotiate auth in http.emptyAuth=auto mode

From: Matthew John Cheetham <mjcheetham@outlook.com>
Date: Apr 28, 2026, 14:38 UTC
Message-ID: <VI0PR03MB11634FE845793CEA7D25FA2D0C0372@VI0PR03MB11634.eurprd03.prod.outlook.com>
In-Reply-To: <xmqq7bq63lll.fsf@gitster.g>

On 2026-04-16 17:40, Junio C Hamano wrote:

Show 12 quoted lines

>> The true and false modes are unchanged: true sends empty credentials
>> on the very first request (before any 401), and false never sends
>> them.
> 
> OK.  This is a tangent, but "git config --help" on "http.emptyAuth"
> is horrible.  It does not say what the allowed values are, so I had
> to first write "There are million other things in the system that
> this patch does not modify, so what's the point of singling out
> these two settings and saying that this patch does not change
> them?", before realizing that 'auto' the patch (and the explanation
> of the "empty-autho auto-detction" above) is about the third
> possiblity of the same variable and take it back.

Agreed - the existing description is pretty opaque about what values it actually takes. Should I add another patch to this series to spell out the three values explicitly? How about something like this:

      http.emptyAuth::
              Attempt authentication without seeking a username or
              password.  This can be used to attempt GSS-Negotiate
              authentication without specifying a username in the URL,
              as libcurl normally requires a username for
              authentication. Possible values are:
      +
      --
      * `auto` (default) - Send empty credentials only if the server's
        401 response advertises an authentication mechanism that
        requires them (such as GSS-Negotiate); otherwise fall back to
        prompting via the credential helper.
      * `true` - Always send empty credentials on the very first
        request, before receiving any 401 response from the server.
      * `false` - Never send empty credentials. Mechanisms that
        require empty credentials, such as GSS-Negotiate, will not
        work.
      --

  Does that read better?

  Thanks,
  Matthew