Re: [PATCH v6] http: add http.sslVerifyStatus to check stapled OCSP responses

hello all,

Sorry I've been away awhile. I'll put together the combined patch and
shoot it over.

- Grayson

On Mon, Aug 31, 2026 at 10:31 AM Junio C Hamano [off-list ref] wrote:

Patrick Steinhardt [off-list ref] writes:

quoted

On Mon, Aug 31, 2026 at 07:16:54AM -0700, Junio C Hamano wrote:

quoted

Patrick Steinhardt [off-list ref] writes:

quoted

quoted

They do look involved but seem to cover the situations we do care
about, except we seem not to test when the server does not explicitly
say "this is still good", or am I not reading the tests correctly?

Isn't the following test covering that scenario? Or am I misreading?

    test_expect_success SSL_VERIFYSTATUS 'fetch succeeds with stapled "good" OCSP response'
           with_ssl_verification git -c http.sslVerifyStatus=true \
                   ls-remote "$HTTPD_URL/smart/repo.git" >actual &&
           test_line_count -gt 0 actual
    '

Probably I misstated.  What I meant was a reaction to "fail close"
floated earlier.  A server does not explicitly give stapled good,
and the client says "this is not known-good" and not talking to it.
I.e. 'fetch fails without stapled "good"'

Ah, I think you're correct, my tests didn't include that. But Grayson's
already did as it doesn't require any setup, so that's why I didn't
include it specifically.

Ah, I missed that.  So a combined patch taking the best parts from
both sides is what we want.  Thanks for helping move the topic
forward.