Re: [PATCH v3] t5550: add netrc tests for http 401/403

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 6, 2026, 17:39 UTC
Message-ID: <xmqqtsvtg49h.fsf@gitster.g>
In-Reply-To: <20260206093840.GC2761602@coredump.intra.peff.net>

Jeff King <peff@peff.net> writes:

Show 5 quoted lines

> I think it is fine to check the 403 handling, but note that this _isn't_
> how GitHub would respond. If you try to fetch from a repository you
> don't have access to, it will return a 401 first (so you try to log in)
> and then a 404. The idea being to avoid revealing the existence of the
> repository to unauthorized users.

That is a sensible thing to do on the server side. Presumably when we talk with such a server we would report 404, right? It is not like we behave all that differently with either type of errors---as long as we just give up and do not fall into an infinite loop of asking "oops, that password did not work, try again", it would be OK.

Show 5 quoted lines

>> Just out of curiosity, do we test for these codes with other
>> credential helpers or is this only relevant for .netrc users?
>
> The netrc support here should not involve credential helpers at all. It
> is all being done internally by curl.

Yeah, I phrased my question in a wrong way. As the code paths involving credential helpers are separate, I wondered if we have similar test coverage there as well.

Show 5 quoted lines

> So really, none of this is testing anything novel in Git at all that is
> not covered elsewhere, except for the fact that we pass the flag to curl
> that says "you may use netrc". And so there's some value in adding it in
> that case. But trying to answer your question about other credential
> helpers, no, they're not even entering the picture here.