Re: [PATCH v7] http: add http.sslVerifyStatus to check stapled OCSP responses

From: Junio C Hamano <gitster@pobox.com>
Date: Oct 7, 2026, 18:18 UTC
Message-ID: <xmqq33uh8jcv.fsf@gitster.g>
In-Reply-To: <arTUNYVvCNwX1pDp@szeder.dev>

SZEDER Gábor <szeder.dev@gmail.com> writes:

Show 25 quoted lines

> On Wed, Sep 23, 2026 at 02:47:18PM -0700, Junio C Hamano wrote:
>> SZEDER Gábor <szeder.dev@gmail.com> writes:
>> 
>> > On Tue, Sep 15, 2026 at 12:23:48PM -0400, graysongordon-gl wrote:
>> >> From: Grayson Gordon <graysongordon1@gmail.com>
>> >> 
>> >> git never sets CURLOPT_SSL_VERIFYSTATUS, so libcurl never requests the
>> >> OCSP "Certificate Status Request" extension and any stapled response a
>> >> server sends is ignored, including responses that explicitly state the
>> >> certificate has been revoked.
>> > ...
>> > This patch was merged to 'next' the other day, and the last test in
>> > the new t5585 fails on my system.
>> 
>> Sorry about a premature merge.  Since we are not in a hurry to take
>> this topic in (or no new feature topic in general), let me revert it
>> out of 'next' and give it a clean slate to try again.
>
> Well, if you hadn't merged it, we would perhaps still be none the
> wiser, because, alas, I don't have the bandwidth to run tests on the
> seen branch regularly...
>
> However, CI does, but I can't seem to find any CI runs that failed
> because of this, which makes me worried that something is wrong on my
> end.

Well, I was bisecting between jch..seen, making a wishful assumption that there is only one topic to blame the recent CI timeouts (see [*1*] and [*2*] for examples) that many linux-* jobs spin forever and time out after 6 hours, for the past few days. I finally found out that 'seen' with this topic ejected, even though it seems to fail jobs that depend on older version of Ubuntu, does not exhibit the time-out-after-spinning-for-6-hours symptom ([*3*]).

So tentatively I am ejecting it out of 'seen'. It might be some funny interactions with other topics; I haven't tried to push it alone to see what happens there at CI to test.

[References]

*1* https://github.com/git/git/actions/runs/37377476653 *2* https://github.com/git/git/actions/runs/37568540157 *3* https://github.com/git/git/actions/runs/37662034989