Re: [PATCH] ci: work around Debian 12's HTTP/2 authentication failures

[Jeff King <peff@peff.net>]

On Wed, Sep 23, 2026 at 12:53:48PM -0400, Jeff King wrote:

> I guess our robot overlords^Whelpers could help with that. I passed your
> patch and my email to Astra, which came up with this:
>
> [...]
>
> Not too bad. I had envisioned checking the range of versions, since you
> found the fix (but we'd have to either use 7.88.1 as the start, or find
> the actual bug introduction). But this covers at least as much as the
> CI debian-12 specifier would.

OK, last email, I promise, since you could probably be feeding this to
Astra just as easily as I am (and you did the actual interesting work on
the patch of figuring out the problem, so I'll leave it to you decide
which approach you like). The range version is something like this:

diff --git a/t/t5551-http-fetch-smart.sh b/t/t5551-http-fetch-smart.sh
index 805bec025c..3d18f98c9d 100755
--- a/t/t5551-http-fetch-smart.sh
+++ b/t/t5551-http-fetch-smart.sh
@@ -17,6 +17,21 @@ fi
 test "$HTTP_PROTO" = "HTTP/2" && enable_http2
 start_httpd
 
+# Curl 7.88.1 can fail to retry authentication after an early HTTP/2
+# response. This was fixed in curl 8.3.0; see
+# https://github.com/curl/curl/pull/11756. The first affected version is
+# unknown, so conservatively assume that versions from 7.88.1 up to (but
+# not including) 8.3.0 are broken.
+test_lazy_prereq HAVE_CURL_HTTP2_BUG '
+	test_have_prereq HTTP2 &&
+	build_option libcurl |
+	awk -F. '\''
+		($1 == 7 && ($2 > 88 || ($2 == 88 && $3 >= 1))) ||
+		($1 == 8 && $2 < 3) { broken = 1 }
+		END { exit !broken }
+	'\''
+'
+
 test_expect_success HTTP2 'enable client-side http/2' '
 	git config --global http.version HTTP/2
 '

which is not _too_ ugly.

-Peff