From: Junio C Hamano Date: Mon, 31 Aug 2026 14:31:21 GMT Subject: Re: [PATCH v6] http: add http.sslVerifyStatus to check stapled OCSP responses Message-ID: In-Reply-To: Patrick Steinhardt writes: > On Mon, Aug 31, 2026 at 07:16:54AM -0700, Junio C Hamano wrote: >> Patrick Steinhardt writes: >> >> >> They do look involved but seem to cover the situations we do care >> >> about, except we seem not to test when the server does not explicitly >> >> say "this is still good", or am I not reading the tests correctly? >> > >> > Isn't the following test covering that scenario? Or am I misreading? >> > >> > test_expect_success SSL_VERIFYSTATUS 'fetch succeeds with stapled "good" OCSP response' >> > with_ssl_verification git -c http.sslVerifyStatus=true \ >> > ls-remote "$HTTPD_URL/smart/repo.git" >actual && >> > test_line_count -gt 0 actual >> > ' >> >> Probably I misstated. What I meant was a reaction to "fail close" >> floated earlier. A server does not explicitly give stapled good, >> and the client says "this is not known-good" and not talking to it. >> I.e. 'fetch fails without stapled "good"' > > Ah, I think you're correct, my tests didn't include that. But Grayson's > already did as it doesn't require any setup, so that's why I didn't > include it specifically. Ah, I missed that. So a combined patch taking the best parts from both sides is what we want. Thanks for helping move the topic forward.