From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: X-Spam-Status: No, score=-3.8 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.6 Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by dcvr.yhbt.net (Postfix) with ESMTP id BCF201F428 for ; Mon, 20 Mar 2023 17:16:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232650AbjCTRQd (ORCPT ); Mon, 20 Mar 2023 13:16:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35202 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232615AbjCTRQL (ORCPT ); Mon, 20 Mar 2023 13:16:11 -0400 Received: from cloud.peff.net (cloud.peff.net [104.130.231.41]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10B9B311C8 for ; Mon, 20 Mar 2023 10:12:03 -0700 (PDT) Received: (qmail 18823 invoked by uid 109); 20 Mar 2023 17:10:54 -0000 Received: from Unknown (HELO peff.net) (10.0.1.2) by cloud.peff.net (qpsmtpd/0.94) with ESMTP; Mon, 20 Mar 2023 17:10:54 +0000 Authentication-Results: cloud.peff.net; auth=none Received: (qmail 25102 invoked by uid 111); 20 Mar 2023 17:10:52 -0000 Received: from coredump.intra.peff.net (HELO sigill.intra.peff.net) (10.0.0.2) by peff.net (qpsmtpd/0.94) with (TLS_AES_256_GCM_SHA384 encrypted) ESMTPS; Mon, 20 Mar 2023 13:10:52 -0400 Authentication-Results: peff.net; auth=none Date: Mon, 20 Mar 2023 13:10:51 -0400 From: Jeff King To: Stanislav Malishevskiy via GitGitGadget Cc: Todd Zullinger , git@vger.kernel.org, Stanislav Malishevskiy , Stanislav Malishevskiy Subject: Re: [PATCH v2] http: add support for different sslcert and sslkey types. Message-ID: <20230320171051.GA2615782@coredump.intra.peff.net> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org On Mon, Mar 20, 2023 at 03:48:49PM +0000, Stanislav Malishevskiy via GitGitGadget wrote: > From: Stanislav Malishevskiy > > Basically git work with default curl ssl type - PEM. But for support > eTokens like SafeNet tokens via pksc11 need setup 'ENG' as sslcert type > and as sslkey type. So there added additional options for http to make > that possible. Seems like a reasonable thing to want, and the patch looks pretty clean. Two small points: > http.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) There are no tests here. I think it might be possible to add them, but our https test support is currently optional, and has bit-rotted a bit over the years. There's some discussion here: https://lore.kernel.org/git/Y9s7vyHKXP+TQPRm@pobox.com/ So I don't think it makes sense to block this patch over the lack of tests, but it's something we might keep in mind to add if the test situation improves. > @@ -1014,10 +1020,14 @@ static CURL *get_curl_handle(void) > > if (ssl_cert) > curl_easy_setopt(result, CURLOPT_SSLCERT, ssl_cert); > + if (ssl_cert_type) > + curl_easy_setopt(result, CURLOPT_SSLCERTTYPE, ssl_cert_type); We're just feeding curl whatever string the user gave us (which is good, since we don't know which ones are valid). But what happens with: GIT_SSL_CERT_TYPE=bogus git fetch ... Should we check for an error here, or will the actual request later complain properly? -Peff