Re: [PATCH v6] http: add http.sslVerifyStatus to check stapled OCSP responses

From: Junio C Hamano <gitster@pobox.com>
Date: Aug 31, 2026, 14:16 UTC
Message-ID: <xmqqik4qz86h.fsf@gitster.g>
In-Reply-To: <apUlqvXgChMeCUkp@pks.im>

Patrick Steinhardt <ps@pks.im> writes:

Show 11 quoted lines

>> They do look involved but seem to cover the situations we do care
>> about, except we seem not to test when the server does not explicitly
>> say "this is still good", or am I not reading the tests correctly?
>
> Isn't the following test covering that scenario? Or am I misreading?
>
>     test_expect_success SSL_VERIFYSTATUS 'fetch succeeds with stapled "good" OCSP response'
>            with_ssl_verification git -c http.sslVerifyStatus=true \
>                    ls-remote "$HTTPD_URL/smart/repo.git" >actual &&
>            test_line_count -gt 0 actual
>     '

Probably I misstated. What I meant was a reaction to "fail close" floated earlier. A server does not explicitly give stapled good, and the client says "this is not known-good" and not talking to it. I.e. 'fetch fails without stapled "good"'