Re: [PATCH] http: check CURLE_SSL_PINNEDPUBKEYNOTMATCH when emitting errors

From: Jeff King <peff@peff.net>
Date: Sep 24, 2021, 21:24 UTC
Message-ID: <YU5CJC9XJvQITfr8@coredump.intra.peff.net>
In-Reply-To: <patch-1.1-6e65734cbce-20210924T100532Z-avarab@gmail.com>

On Fri, Sep 24, 2021 at 12:08:20PM +0200, Ævar Arnfjörð Bjarmason wrote:

Show 6 quoted lines

> Change the error shown when a http.pinnedPubKey doesn't match to point
> the http.pinnedPubKey variable added in aeff8a61216 (http: implement
> public key pinning, 2016-02-15), e.g.:
> 
>     git -c http.pinnedPubKey=sha256/someNonMatchingKey ls-remote https://github.com/git/git.git
>     fatal: unable to access 'https://github.com/git/git.git/' with http.pinnedPubkey configuration: SSL: public key does not match pinned public key!

TBH, I think the message as-is is sufficiently descriptive. That said, it's not too much extra code to handle it specially, so I don't feel all that strongly.

Maybe people care more about the translation aspect, but it feels like that's the tip of the iceberg in terms of curl errors.

The patch itself looks correct to me.

-Peff