Hi,

I tested the freshly-tagged 2.55.0-rc0 and noticed some new failures on the in-progress Fedora 45 (AKA Rawhide) for t5563.18 (http.emptyAuth=auto attempts Negotiate before credential_fill) which was added in 9b1630b972 (t5563: add tests for http.emptyAuth with Negotiate, 2026-04-16).

I notice that Fedora 44 (where the tests all pass) has curl-8.18.0 while Fedora 45 has curl-8.21.0-rc2. The version of httpd is the same between them, FWIW. I didn't compare other package differences; it could be something else entirely.

Here is the output from a failing test run:

--8<-- ++ test_when_finished per_test_cleanup ++ test 0 = 0 ++ test_cleanup=$'{ per_test_cleanup\n\t\t} || eval_ret=$?; :' ++ set_credential_reply get +++ test -n '' ++ local suffix= ++ cat ++ cat ++ cat ++ test_config_global credential.helper test-helper ++ test_when_finished 'test_unconfig --global '\''credential.helper'\''' ++ test 0 = 0 ++ test_cleanup=$'{ test_unconfig --global \'credential.helper\'\n\t\t} || eval_ret=$?; { per_test_cleanup\n\t\t} || eval_ret=$?; :' ++ git config --global credential.helper test-helper ++ GIT_TRACE_CURL='/builddir/build/BUILD/git-2.55.0_rc0-build/git-2.55.0.rc0/t/trash directory.t5563-simple-http-auth/trace-auto' ++ git -c http.emptyAuth=auto ls-remote http://127.0.0.1:5563/custom_auth/repo.git ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 HEAD ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 refs/heads/master ddd63c907a6168e9992caee4ef0e0fa1139e4eb3 refs/tags/foo ++ grep 'HTTP/[0-9.]* 401' '/builddir/build/BUILD/git-2.55.0_rc0-build/git-2.55.0.rc0/t/trash directory.t5563-simple-http-auth/trace-auto' ++ test_line_count = 3 actual_401s ++ test 3 '!=' 3 +++ wc -l ++ test 2 = 3 ++ echo 'test_line_count: line count for actual_401s != 3' test_line_count: line count for actual_401s != 3 ++ cat actual_401s <= Recv header: HTTP/1.1 401 Authorization Required <= Recv header: HTTP/1.1 401 Authorization Required ++ return 1 error: last command exited with $?=1 not ok 18 - http.emptyAuth=auto attempts Negotiate before credential_fill --8<--

And a diff of the trace-auto from Fedora 44 and 45 via ./t5563-simple-http-auth.sh -dix --run='-18' (with the sending port normalized to 44444 to reduce the noise):

--- /dev/fd/63 2026-06-11 16:51:05.852135692 -0400 +++ /dev/fd/62 2026-06-11 16:51:05.853135711 -0400

On 2026-06-11 22:04, Todd Zullinger wrote:

Thanks for the report. The failure is not in Git, it is a libcurl behaviour change, and there is already an open upstream issue:

   https://github.com/curl/curl/issues/21943
   "Negotiate ignored with --anyauth" (Dan Fandrich, 2026-06-10)

Dan also bisected it to the same commit I had locally, `8f71d0fde515` ("creds: hold credentials", curl PR #21548).

His report describes the regression at the `curl(1)` level (`curl --anyauth -u : ...` no longer attempts Negotiate); t5563 test 18 is the same regression observed through `http.emptyAuth=auto`, which under the hood is the same `CURLOPT_USERPWD=":"` pattern.

Dan also notes a workaround: replacing `-u :` with `-u literally:anything` (any non-blank username, real or fake) puts libcurl back on the Negotiate path. That suggests a small Git-side escape hatch is possible if we want to unblock people running against current libcurl while we wait for an upstream fix; I have not tried it yet and would want to be sure it does not have side effects on other auth schemes before proposing it.

Daniel Stenberg has acknowledged the curl issue but has not yet posted a fix. I will follow curl#21943 and, if the upstream answer is "the new behaviour is intended", come back here with a proposal for what Git should do about `http.emptyAuth` and test 18.

Thanks, Matthew

Hi,

Matthew John Cheetham wrote:

[...]

Excellent.  This is it good hands all around.

With luck, curl is updated and the canary of distributions like Fedora's Rawhide will have served a useful purpose in flushing out issues before they affect most people. With the help of git's excellent and thorough test suite, of course. :)

If there is a curl update, I imagine it will be picked up reasonably quickly in Fedora (and elsewhere that was testing 8.21.0 release candidates) and there will hopefully be no strong need to make any changes on the git side.

Thanks!

Hi,

I wrote:

[...]

I saw Fedora picked up curl-8.21.0-rc3 this morning and confirmed it resolves the git test failures. Someone else has already commented on the upstream curl issue to note that.

Thanks,

On 2026-06-18 15:49, Todd Zullinger wrote:

Thanks for confirming rc3 fixes things!

The CURLOPT_USERPWD = ":" behaviour was never codified in curl's documentation, but given the fix they've put in place it's probably a good sign we can continue to rely on this.

I may propose a patch to curl documentation's patch to say that this behaviour is expected and supported, if the they don't do it themselves soon already.

Thanks, Matthew

Todd Zullinger <tmz@pobox.com> writes:

Thanks.