Unauthenticated clone of a public repo intermittently returns 401 (prompts for Username) from CI workers

[RazvanLiviuVarzaru]

🏷️ Discussion Type

Bug

Body

Our CI workers (Docker containers) clone the public repo MariaDB/server
over HTTPS with no credentials configured. The clone fails at the negotiation
step, not at the ref advertisement.

This started to occur intermittently since ~ 11 CET 02.09.2026. Our CI workers are EU based.
Even if it gets past the initial clone, recursively updating sub modules will eventually hit the same issue.

Please let us know if the issue is known and if there are currently any workarounds available.

$ GIT_TERMINAL_PROMPT=0 git clone --branch bb-11.4-pkgtest-MDEV-40608 --depth 1 https://github.com/MariaDB/server . --progress
Cloning into '.'...
fatal: could not read Username for 'https://github.com': terminal prompts disabled
fatal: expected flush after ref listing

GIT_CURL_VERBOSE shows the anonymous advertisement succeeding:

GET /MariaDB/server/info/refs?service=git-upload-pack HTTP/2
<= HTTP/2 200
<= server: GitHub-Babel/3.0
<= content-type: application/x-git-upload-pack-advertisement
<= x-github-request-id: 9852:5FF9A:2FBF6AE:2946898:6A98014F
<= x-github-edge-region: fra

and the follow-up POST on the same connection being rejected:

POST /MariaDB/server/git-upload-pack HTTP/2
git-protocol: version=2
content-length: 175
<= HTTP/2 401
<= cache-control: no-cache
<= content-type: text/plain; charset=utf-8
<= strict-transport-security: max-age=31536000; includeSubDomains; preload
<= x-content-type-options: nosniff
<= www-authenticate: Basic realm="GitHub"

Environment:

• git 2.39.5 (Debian 12 container), protocol v2
• No credential helper, no credentials in the URL, no proxy in the environment
• Direct connection to github.com (140.82.121.3), certificate verifies, no MITM

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[archont94]

+1

Sometimes it work, sometimes not, so I guess it depends on worker which handled the request.

[wiakr-vestas]

We are experiencing the same issue beginning around 09:26 UTC today.

Adding the following line resolved the issue for us:

git config --global http.version HTTP/1.1

No credentials or other pipeline changes were needed.

[tomasvilda]

Same here, same fix works.

By the way we get this using git 2.34.1

When we use git 2.53.0 there is no such problem and no workaround needed.

[hwti]

When we use git 2.53.0 there is no such problem and no workaround needed.

I got the issue with git 2.55.0, on a fetch from my local machine.

[MaadixNet]

Same issue here

[ccudennec-otto]

Another possible fix seems to be to use "actions/checkout" instead of "git clone"
"actions/checkout" uses a Github token by default and thus is authenticated.

[ccudennec-otto]

Oh, I guess then I was just lucky that my workflows worked after the change. I'll watch this issue to see what other solutions pop up. git config --global http.version HTTP/1.1 sounds kind of strange to me. Why does this fix the issue?

[rob-mur]

Also same, for us configuring git to use http/1.1 works around it

[enescakir]

We're also observing some ghcr.io request failures. They started around the same time as this issue.

https://github.com/orgs/community/discussions/206598

[enescakir]

@nebuk89 Do you have any known active issues with your European servers?

[samus-aran]

Hey everyone! 👋 Thank you for raising this. We have shared this with our internal teams to investigate - if we have any updates we will post here and in appropriate discussions ✨

[petefoth]

Also present for the LineageOS for microG project. Our build servers started being prompted for username around midday BST. As all our interactions with GitHub are through the repo tool, which doesn't support interactive authentication, our builds are completely broken. We have two servers each running builds in a single active Docker image.

I have tried git clone operations from the servers, using https GitHub urls, and those are also prompting for username. I donlt recall this ever happening before.

EDIT:
And it's not intermittent: happening consistently and repeatably from both servers. Let me know of you need ip addresses, or any more information.

[baznikin]

It's not resolved, I suppose you should remove 'Answered'

[samus-aran]

Hey @baznikin I've marked my response as the answer so folks can see it at the top of the discussion and also to elevate it as a more "official" answer but it doesn't necessarily means it's resolved.

Just to provide an update that we are still investigating this, but you may see improvements when cloning or fetching repositories over HTTPS. To help ensure reliable access, we recommend updating workflows that use HTTPS Git operations to authenticate with a Git credential, such as a personal access token.

---

@petefoth Can you share a little more with the blockers or hurdles you face to set up authentication for your runs?

As all our interactions with GitHub are through the repo tool, which doesn't support interactive authentication, our builds are completely broken.

[petefoth]

Can you share a little more with the blockers or hurdles you face to set up authentication for your runs?
We (the LineageOS for microG project) run (and maintain) a docker image that builds LineageOS for microG Android custom ROMs (and unofficial iodéOS, and 'vanilla' LineageOS ROMs also).

All the operations we perform on GitHub repos are 'read-only', and the docker image designed to work anonymously, so it can be used 'out of the box' both by us (to make around 300 builds per month using two servers) and by anyone else who wants to make builds of those custom ROMs.

We have never tried to setup authentication, because we have never needed it: all the operations we do (essentially a series of git clone operations, wrapped up in the repo tool) have always worked anonymously, with no authentication, over HTTPS urls. Changing that would be a major piece of work. We are a very small project, and don't have resources to do that, even if we wanted to.

EDIT:
Bedtime here in UK. I'll check back in the morning to see if the HTTPS urls are working again for us.
Thanks for your help

[baznikin]

terraform init for community modules failed as well:

Downloading registry.terraform.io/terraform-aws-modules/eks-pod-identity/aws 2.9.0 for aws_ebs_csi_pod_identity...
Username for 'https://github.com': 
Password for 'https://github.com': 
Downloading registry.terraform.io/cloudposse/iam-s3-user/aws 1.2.0 for s3_gitlab_user...
Username for 'https://github.com': 
Password for 'https://github.com': 
Downloading registry.terraform.io/terraform-aws-modules/vpc/aws 5.20.0 for vpc_endpoints...
Username for 'https://github.com': 
Password for 'https://github.com': 
Downloading registry.terraform.io/terraform-aws-modules/eks/aws 20.37.2 for eks-auth...
Username for 'https://github.com': 
Password for 'https://github.com': 

╷
│ Error: Failed to download module
│ 
│   on cluster.tf line 148:
│  148: module "eks-auth" {
│ 
│ Could not download module "eks-auth" (cluster.tf:148) source code from "git::https://github.com/terraform-aws-modules/terraform-aws-eks?ref=8a0efdbbc84180a26e0bacfd2b6fcfceac53b3b6": error downloading
│ 'https://github.com/terraform-aws-modules/terraform-aws-eks?ref=8a0efdbbc84180a26e0bacfd2b6fcfceac53b3b6': /usr/bin/git exited with 128: Cloning into '.terraform/modules/eks-auth'...
│ error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401
│ fatal: expected flush after ref listing
│ .

Module usage:

module "s3_gl_runner-cache" {
  source = "cloudposse/s3-bucket/aws"
  version   = "4.0.1"
  ...
}

[nikolaeff]

In case if you need more traces. Here is one from ancient ruby:2.7.7 docker container:

root@52158b9558d5:/app# cat /etc/debian_version 
11.6

root@52158b9558d5:/app# git --version
git version 2.30.2

root@52158b9558d5:/app# GIT_CURL_VERBOSE=true git clone https://github.com/nvm-sh/nvm.git nvm.git
Cloning into 'nvm.git'...
15:32:43.812527 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
15:32:43.816796 http.c:756              == Info:   Trying 140.82.121.3:443...
15:32:43.882261 http.c:756              == Info: Connected to github.com (140.82.121.3) port 443 (#0)
15:32:43.917563 http.c:756              == Info: found 391 certificates in /etc/ssl/certs
15:32:43.917717 http.c:756              == Info: ALPN, offering h2
15:32:43.917745 http.c:756              == Info: ALPN, offering http/1.1
15:32:43.983639 http.c:756              == Info: SSL connection using TLS1.3 / ECDHE_RSA_AES_128_GCM_SHA256
15:32:43.986726 http.c:756              == Info: 	server certificate verification OK
15:32:43.986784 http.c:756              == Info: 	server certificate status verification SKIPPED
15:32:43.986985 http.c:756              == Info: 	common name: github.com (matched)
15:32:43.987021 http.c:756              == Info: 	server certificate expiration date OK
15:32:43.987028 http.c:756              == Info: 	server certificate activation date OK
15:32:43.987061 http.c:756              == Info: 	certificate public key: EC/ECDSA
15:32:43.987066 http.c:756              == Info: 	certificate version: #3
15:32:43.987094 http.c:756              == Info: 	subject: CN=github.com
15:32:43.987103 http.c:756              == Info: 	start date: Tue, 01 Sep 2026 00:00:00 GMT
15:32:43.987108 http.c:756              == Info: 	expire date: Sun, 29 Nov 2026 23:59:59 GMT
15:32:43.987132 http.c:756              == Info: 	issuer: C=GB,O=Sectigo Limited,CN=Sectigo Public Server Authentication CA DV E36
15:32:43.987160 http.c:756              == Info: ALPN, server accepted to use h2
15:32:43.987239 http.c:756              == Info: Using HTTP2, server supports multi-use
15:32:43.987244 http.c:756              == Info: Connection state changed (HTTP/2 confirmed)
15:32:43.987252 http.c:756              == Info: Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
15:32:43.987360 http.c:756              == Info: Using Stream ID: 1 (easy handle 0xaaaac65f09a0)
15:32:43.987425 http.c:703              => Send header, 0000000227 bytes (0x000000e3)
15:32:43.987432 http.c:715              => Send header: GET /nvm-sh/nvm.git/info/refs?service=git-upload-pack HTTP/2
15:32:43.987435 http.c:715              => Send header: Host: github.com
15:32:43.987437 http.c:715              => Send header: user-agent: git/2.30.2
15:32:43.987439 http.c:715              => Send header: accept: */*
15:32:43.987444 http.c:715              => Send header: accept-encoding: deflate, gzip, br
15:32:43.987447 http.c:715              => Send header: accept-language: C, *;q=0.9
15:32:43.987450 http.c:715              => Send header: pragma: no-cache
15:32:43.987452 http.c:715              => Send header: git-protocol: version=2
15:32:43.987454 http.c:715              => Send header:
15:32:44.144236 http.c:756              == Info: Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
15:32:44.277693 http.c:703              <= Recv header, 0000000013 bytes (0x0000000d)
15:32:44.277749 http.c:715              <= Recv header: HTTP/2 200
15:32:44.277755 http.c:703              <= Recv header, 0000000026 bytes (0x0000001a)
15:32:44.277760 http.c:715              <= Recv header: server: GitHub-Babel/3.0
15:32:44.277765 http.c:703              <= Recv header, 0000000059 bytes (0x0000003b)
15:32:44.277768 http.c:715              <= Recv header: content-type: application/x-git-upload-pack-advertisement
15:32:44.277770 http.c:703              <= Recv header, 0000000054 bytes (0x00000036)
15:32:44.277789 http.c:715              <= Recv header: content-security-policy: default-src 'none'; sandbox
15:32:44.277792 http.c:703              <= Recv header, 0000000040 bytes (0x00000028)
15:32:44.277795 http.c:715              <= Recv header: expires: Fri, 01 Jan 1980 00:00:00 GMT
15:32:44.277804 http.c:703              <= Recv header, 0000000018 bytes (0x00000012)
15:32:44.277807 http.c:715              <= Recv header: pragma: no-cache
15:32:44.277809 http.c:703              <= Recv header, 0000000053 bytes (0x00000035)
15:32:44.277811 http.c:715              <= Recv header: cache-control: no-cache, max-age=0, must-revalidate
15:32:44.277813 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:32:44.277815 http.c:715              <= Recv header: vary: Accept-Encoding
15:32:44.277817 http.c:703              <= Recv header, 0000000045 bytes (0x0000002d)
15:32:44.277819 http.c:715              <= Recv header: strict-transport-security: max-age=31536000
15:32:44.277822 http.c:703              <= Recv header, 0000000037 bytes (0x00000025)
15:32:44.277824 http.c:715              <= Recv header: date: Wed, 02 Sep 2026 15:32:44 GMT
15:32:44.277845 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:32:44.277848 http.c:715              <= Recv header: x-frame-options: DENY
15:32:44.277850 http.c:703              <= Recv header, 0000000056 bytes (0x00000038)
15:32:44.277851 http.c:715              <= Recv header: x-github-request-id: F91A:A109E:7E1D12:6C4541:6A98419B
15:32:44.277858 http.c:703              <= Recv header, 0000000027 bytes (0x0000001b)
15:32:44.277860 http.c:715              <= Recv header: x-github-edge-region: fra
15:32:44.277867 http.c:703              <= Recv header, 0000000002 bytes (0x00000002)
15:32:44.277870 http.c:715              <= Recv header:
15:32:44.277898 http.c:756              == Info: Connection #0 to host github.com left intact
15:32:44.278229 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
15:32:44.278252 http.c:756              == Info: Found bundle for host github.com: 0xaaaac65f7390 [can multiplex]
15:32:44.278266 http.c:756              == Info: Re-using existing connection! (#0) with host github.com
15:32:44.278272 http.c:756              == Info: Connected to github.com (140.82.121.3) port 443 (#0)
15:32:44.278301 http.c:756              == Info: Using Stream ID: 3 (easy handle 0xaaaac65f09a0)
15:32:44.278395 http.c:703              => Send header, 0000000270 bytes (0x0000010e)
15:32:44.278408 http.c:715              => Send header: POST /nvm-sh/nvm.git/git-upload-pack HTTP/2
15:32:44.278411 http.c:715              => Send header: Host: github.com
15:32:44.278413 http.c:715              => Send header: user-agent: git/2.30.2
15:32:44.278422 http.c:715              => Send header: accept-encoding: deflate, gzip, br
15:32:44.278424 http.c:715              => Send header: content-type: application/x-git-upload-pack-request
15:32:44.278426 http.c:715              => Send header: accept: application/x-git-upload-pack-result
15:32:44.278432 http.c:715              => Send header: git-protocol: version=2
15:32:44.278434 http.c:715              => Send header: content-length: 164
15:32:44.278435 http.c:715              => Send header:
15:32:44.278465 http.c:756              == Info: We are completely uploaded and fine
15:32:44.346302 http.c:703              <= Recv header, 0000000013 bytes (0x0000000d)
15:32:44.346376 http.c:715              <= Recv header: HTTP/2 401
15:32:44.346384 http.c:703              <= Recv header, 0000000025 bytes (0x00000019)
15:32:44.346389 http.c:715              <= Recv header: cache-control: no-cache
15:32:44.346394 http.c:703              <= Recv header, 0000000041 bytes (0x00000029)
15:32:44.346404 http.c:715              <= Recv header: content-type: text/plain; charset=utf-8
15:32:44.346409 http.c:703              <= Recv header, 0000000073 bytes (0x00000049)
15:32:44.346413 http.c:715              <= Recv header: strict-transport-security: max-age=31536000; includeSubDomains; preload
15:32:44.346419 http.c:703              <= Recv header, 0000000033 bytes (0x00000021)
15:32:44.346424 http.c:715              <= Recv header: x-content-type-options: nosniff
15:32:44.346432 http.c:703              <= Recv header, 0000000040 bytes (0x00000028)
15:32:44.346435 http.c:715              <= Recv header: www-authenticate: Basic realm="GitHub"
15:32:44.346441 http.c:703              <= Recv header, 0000000002 bytes (0x00000002)
15:32:44.346444 http.c:715              <= Recv header:
15:32:44.346524 http.c:756              == Info: Connection #0 to host github.com left intact
Username for 'https://github.com': ^C

With HTTP/1.1

root@52158b9558d5:/app# git config --global http.version HTTP/1.1
root@52158b9558d5:/app# git --version
git version 2.30.2
root@52158b9558d5:/app# GIT_CURL_VERBOSE=true git clone https://github.com/nvm-sh/nvm.git nvm.git
Cloning into 'nvm.git'...
15:35:46.117638 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
15:35:46.188776 http.c:756              == Info:   Trying 140.82.121.3:443...
15:35:46.286465 http.c:756              == Info: Connected to github.com (140.82.121.3) port 443 (#0)
15:35:46.326998 http.c:756              == Info: found 391 certificates in /etc/ssl/certs
15:35:46.327095 http.c:756              == Info: ALPN, offering http/1.1
15:35:46.392673 http.c:756              == Info: SSL connection using TLS1.3 / ECDHE_RSA_AES_128_GCM_SHA256
15:35:46.396115 http.c:756              == Info: 	server certificate verification OK
15:35:46.396143 http.c:756              == Info: 	server certificate status verification SKIPPED
15:35:46.396219 http.c:756              == Info: 	common name: github.com (matched)
15:35:46.396226 http.c:756              == Info: 	server certificate expiration date OK
15:35:46.396229 http.c:756              == Info: 	server certificate activation date OK
15:35:46.396236 http.c:756              == Info: 	certificate public key: EC/ECDSA
15:35:46.396243 http.c:756              == Info: 	certificate version: #3
15:35:46.396263 http.c:756              == Info: 	subject: CN=github.com
15:35:46.396272 http.c:756              == Info: 	start date: Tue, 01 Sep 2026 00:00:00 GMT
15:35:46.396277 http.c:756              == Info: 	expire date: Sun, 29 Nov 2026 23:59:59 GMT
15:35:46.396292 http.c:756              == Info: 	issuer: C=GB,O=Sectigo Limited,CN=Sectigo Public Server Authentication CA DV E36
15:35:46.396308 http.c:756              == Info: ALPN, server accepted to use http/1.1
15:35:46.396396 http.c:703              => Send header, 0000000229 bytes (0x000000e5)
15:35:46.396413 http.c:715              => Send header: GET /nvm-sh/nvm.git/info/refs?service=git-upload-pack HTTP/1.1
15:35:46.396415 http.c:715              => Send header: Host: github.com
15:35:46.396417 http.c:715              => Send header: User-Agent: git/2.30.2
15:35:46.396419 http.c:715              => Send header: Accept: */*
15:35:46.396420 http.c:715              => Send header: Accept-Encoding: deflate, gzip, br
15:35:46.396422 http.c:715              => Send header: Accept-Language: C, *;q=0.9
15:35:46.396424 http.c:715              => Send header: Pragma: no-cache
15:35:46.396426 http.c:715              => Send header: Git-Protocol: version=2
15:35:46.396428 http.c:715              => Send header:
15:35:46.701371 http.c:756              == Info: Mark bundle as not supporting multiuse
15:35:46.701402 http.c:703              <= Recv header, 0000000017 bytes (0x00000011)
15:35:46.701408 http.c:715              <= Recv header: HTTP/1.1 200 OK
15:35:46.701410 http.c:703              <= Recv header, 0000000026 bytes (0x0000001a)
15:35:46.701413 http.c:715              <= Recv header: Server: GitHub-Babel/3.0
15:35:46.701416 http.c:703              <= Recv header, 0000000059 bytes (0x0000003b)
15:35:46.701418 http.c:715              <= Recv header: Content-Type: application/x-git-upload-pack-advertisement
15:35:46.701421 http.c:703              <= Recv header, 0000000054 bytes (0x00000036)
15:35:46.701426 http.c:715              <= Recv header: Content-Security-Policy: default-src 'none'; sandbox
15:35:46.701428 http.c:703              <= Recv header, 0000000040 bytes (0x00000028)
15:35:46.701430 http.c:715              <= Recv header: expires: Fri, 01 Jan 1980 00:00:00 GMT
15:35:46.701431 http.c:703              <= Recv header, 0000000018 bytes (0x00000012)
15:35:46.701438 http.c:715              <= Recv header: pragma: no-cache
15:35:46.701443 http.c:703              <= Recv header, 0000000053 bytes (0x00000035)
15:35:46.701444 http.c:715              <= Recv header: Cache-Control: no-cache, max-age=0, must-revalidate
15:35:46.701446 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:35:46.701448 http.c:715              <= Recv header: Vary: Accept-Encoding
15:35:46.701450 http.c:703              <= Recv header, 0000000045 bytes (0x0000002d)
15:35:46.701452 http.c:715              <= Recv header: Strict-Transport-Security: max-age=31536000
15:35:46.701455 http.c:703              <= Recv header, 0000000028 bytes (0x0000001c)
15:35:46.701457 http.c:715              <= Recv header: Transfer-Encoding: chunked
15:35:46.701458 http.c:703              <= Recv header, 0000000037 bytes (0x00000025)
15:35:46.701460 http.c:715              <= Recv header: Date: Wed, 02 Sep 2026 15:35:46 GMT
15:35:46.701461 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:35:46.701463 http.c:715              <= Recv header: X-Frame-Options: DENY
15:35:46.701465 http.c:703              <= Recv header, 0000000057 bytes (0x00000039)
15:35:46.701466 http.c:715              <= Recv header: X-GitHub-Request-Id: FA15:1330EC:8AAF41:7715E2:6A984252
15:35:46.701468 http.c:703              <= Recv header, 0000000027 bytes (0x0000001b)
15:35:46.701483 http.c:715              <= Recv header: x-github-edge-region: fra
15:35:46.701485 http.c:703              <= Recv header, 0000000002 bytes (0x00000002)
15:35:46.701486 http.c:715              <= Recv header:
15:35:46.701502 http.c:756              == Info: Connection #0 to host github.com left intact
15:35:46.701693 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
15:35:46.701713 http.c:756              == Info: Found bundle for host github.com: 0xaaaadcab45a0 [serially]
15:35:46.701721 http.c:756              == Info: Re-using existing connection! (#0) with host github.com
15:35:46.701725 http.c:756              == Info: Connected to github.com (140.82.121.3) port 443 (#0)
15:35:46.701785 http.c:703              => Send header, 0000000272 bytes (0x00000110)
15:35:46.701798 http.c:715              => Send header: POST /nvm-sh/nvm.git/git-upload-pack HTTP/1.1
15:35:46.701799 http.c:715              => Send header: Host: github.com
15:35:46.701801 http.c:715              => Send header: User-Agent: git/2.30.2
15:35:46.701803 http.c:715              => Send header: Accept-Encoding: deflate, gzip, br
15:35:46.701805 http.c:715              => Send header: Content-Type: application/x-git-upload-pack-request
15:35:46.701806 http.c:715              => Send header: Accept: application/x-git-upload-pack-result
15:35:46.701808 http.c:715              => Send header: Git-Protocol: version=2
15:35:46.701810 http.c:715              => Send header: Content-Length: 164
15:35:46.701811 http.c:715              => Send header:
15:35:46.701815 http.c:756              == Info: upload completely sent off: 164 out of 164 bytes
15:35:46.962732 http.c:756              == Info: Mark bundle as not supporting multiuse
15:35:46.962979 http.c:703              <= Recv header, 0000000017 bytes (0x00000011)
15:35:46.963028 http.c:715              <= Recv header: HTTP/1.1 200 OK
15:35:46.963048 http.c:703              <= Recv header, 0000000026 bytes (0x0000001a)
15:35:46.963055 http.c:715              <= Recv header: Server: GitHub-Babel/3.0
15:35:46.963070 http.c:703              <= Recv header, 0000000052 bytes (0x00000034)
15:35:46.963076 http.c:715              <= Recv header: Content-Type: application/x-git-upload-pack-result
15:35:46.963082 http.c:703              <= Recv header, 0000000054 bytes (0x00000036)
15:35:46.963087 http.c:715              <= Recv header: Content-Security-Policy: default-src 'none'; sandbox
15:35:46.963092 http.c:703              <= Recv header, 0000000040 bytes (0x00000028)
15:35:46.963096 http.c:715              <= Recv header: expires: Fri, 01 Jan 1980 00:00:00 GMT
15:35:46.963101 http.c:703              <= Recv header, 0000000018 bytes (0x00000012)
15:35:46.963105 http.c:715              <= Recv header: pragma: no-cache
15:35:46.963110 http.c:703              <= Recv header, 0000000053 bytes (0x00000035)
15:35:46.963114 http.c:715              <= Recv header: Cache-Control: no-cache, max-age=0, must-revalidate
15:35:46.963119 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:35:46.963124 http.c:715              <= Recv header: Vary: Accept-Encoding
15:35:46.963203 http.c:703              <= Recv header, 0000000045 bytes (0x0000002d)
15:35:46.963253 http.c:715              <= Recv header: Strict-Transport-Security: max-age=31536000
15:35:46.963278 http.c:703              <= Recv header, 0000000028 bytes (0x0000001c)
15:35:46.963281 http.c:715              <= Recv header: Transfer-Encoding: chunked
15:35:46.963283 http.c:703              <= Recv header, 0000000037 bytes (0x00000025)
15:35:46.963284 http.c:715              <= Recv header: Date: Wed, 02 Sep 2026 15:35:46 GMT
15:35:46.963286 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:35:46.963288 http.c:715              <= Recv header: X-Frame-Options: DENY
15:35:46.963290 http.c:703              <= Recv header, 0000000057 bytes (0x00000039)
15:35:46.963297 http.c:715              <= Recv header: X-GitHub-Request-Id: FA15:1330EC:8AB26E:77186F:6A984252
15:35:46.963299 http.c:703              <= Recv header, 0000000027 bytes (0x0000001b)
15:35:46.963301 http.c:715              <= Recv header: x-github-edge-region: fra
15:35:46.963306 http.c:703              <= Recv header, 0000000002 bytes (0x00000002)
15:35:46.963308 http.c:715              <= Recv header:
15:35:46.963635 http.c:756              == Info: Connection #0 to host github.com left intact
15:35:46.968791 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
15:35:46.968832 http.c:756              == Info: Found bundle for host github.com: 0xaaaadcab45a0 [serially]
15:35:46.968845 http.c:756              == Info: Re-using existing connection! (#0) with host github.com
15:35:46.968859 http.c:756              == Info: Connected to github.com (140.82.121.3) port 443 (#0)
15:35:46.968989 http.c:703              => Send header, 0000000297 bytes (0x00000129)
15:35:46.969002 http.c:715              => Send header: POST /nvm-sh/nvm.git/git-upload-pack HTTP/1.1
15:35:46.969004 http.c:715              => Send header: Host: github.com
15:35:46.969005 http.c:715              => Send header: User-Agent: git/2.30.2
15:35:46.969007 http.c:715              => Send header: Accept-Encoding: deflate, gzip, br
15:35:46.969010 http.c:715              => Send header: Content-Type: application/x-git-upload-pack-request
15:35:46.969012 http.c:715              => Send header: Accept: application/x-git-upload-pack-result
15:35:46.969014 http.c:715              => Send header: Git-Protocol: version=2
15:35:46.969015 http.c:715              => Send header: Content-Encoding: gzip
15:35:46.969017 http.c:715              => Send header: Content-Length: 3242
15:35:46.969018 http.c:715              => Send header:
15:35:46.969022 http.c:756              == Info: upload completely sent off: 3242 out of 3242 bytes
15:35:47.242098 http.c:756              == Info: Mark bundle as not supporting multiuse
15:35:47.242194 http.c:703              <= Recv header, 0000000017 bytes (0x00000011)
15:35:47.242211 http.c:715              <= Recv header: HTTP/1.1 200 OK
15:35:47.242220 http.c:703              <= Recv header, 0000000026 bytes (0x0000001a)
15:35:47.242224 http.c:715              <= Recv header: Server: GitHub-Babel/3.0
15:35:47.242234 http.c:703              <= Recv header, 0000000052 bytes (0x00000034)
15:35:47.242241 http.c:715              <= Recv header: Content-Type: application/x-git-upload-pack-result
15:35:47.242247 http.c:703              <= Recv header, 0000000054 bytes (0x00000036)
15:35:47.242253 http.c:715              <= Recv header: Content-Security-Policy: default-src 'none'; sandbox
15:35:47.242257 http.c:703              <= Recv header, 0000000040 bytes (0x00000028)
15:35:47.242285 http.c:715              <= Recv header: expires: Fri, 01 Jan 1980 00:00:00 GMT
15:35:47.242291 http.c:703              <= Recv header, 0000000018 bytes (0x00000012)
15:35:47.242320 http.c:715              <= Recv header: pragma: no-cache
15:35:47.242326 http.c:703              <= Recv header, 0000000053 bytes (0x00000035)
15:35:47.242330 http.c:715              <= Recv header: Cache-Control: no-cache, max-age=0, must-revalidate
15:35:47.242334 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:35:47.242338 http.c:715              <= Recv header: Vary: Accept-Encoding
15:35:47.242343 http.c:703              <= Recv header, 0000000045 bytes (0x0000002d)
15:35:47.242347 http.c:715              <= Recv header: Strict-Transport-Security: max-age=31536000
15:35:47.242354 http.c:703              <= Recv header, 0000000028 bytes (0x0000001c)
15:35:47.242383 http.c:715              <= Recv header: Transfer-Encoding: chunked
15:35:47.242388 http.c:703              <= Recv header, 0000000037 bytes (0x00000025)
15:35:47.242392 http.c:715              <= Recv header: Date: Wed, 02 Sep 2026 15:35:47 GMT
15:35:47.242397 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
15:35:47.242400 http.c:715              <= Recv header: X-Frame-Options: DENY
15:35:47.242404 http.c:703              <= Recv header, 0000000057 bytes (0x00000039)
15:35:47.242408 http.c:715              <= Recv header: X-GitHub-Request-Id: FA15:1330EC:8AB611:771BE8:6A984252
15:35:47.242413 http.c:703              <= Recv header, 0000000027 bytes (0x0000001b)
15:35:47.242416 http.c:715              <= Recv header: x-github-edge-region: fra
15:35:47.242422 http.c:703              <= Recv header, 0000000002 bytes (0x00000002)
15:35:47.242426 http.c:715              <= Recv header:
remote: Enumerating objects: 10901, done.
remote: Counting objects: 100% (299/299), done.
remote: Compressing objects: 100% (85/85), done.
15:35:47.725728 http.c:756              == Info: Connection #0 to host github.com left intact
remote: Total 10901 (delta 272), reused 214 (delta 214), pack-reused 10602 (from 3)
Receiving objects: 100% (10901/10901), 4.29 MiB | 8.93 MiB/s, done.
Resolving deltas: 100% (7092/7092), done.

[arne-tt]

+1

[kitt159]

I have made an interesting observation - this exact problem occurs with gnutls, but not with openssl (for example on arch linux)

[hwti]

It's probably just random, I got the issue on Fedora (git 2.53.0, curl 8.15.0, OpenSSL 3.5.8, nghttp2 1.66.0).

[kitt159]

I probably didn't express myself clearly - I meant git built against gnutls vs git built against openssl. Basically if you run git clone <something> on ubuntu (where it is build with gnutls) it fails but on arch (where it is build with opeenssl) it just works.

[daniel-balke]

For me, it fails on these versions (when using HTTP/2):

• git 2.39 with libcurl-gnutls 7.88 and gnutls 3.7
• git 2.43 with libcurl-gnutls 8.5.0 and gnutls 3.8.3
• git 2.43 with libcurl-gnutls 8.9 and gnutls 3.8.6

And it works on these versions:

• git 2.47 with libcurl-gnutls 8.14 and gnutls 3.8.9
• git 2.51 with libcurl-gnutls 8.14 and gnutls 3.8.9

[Ururu221]

Seeing the same intermittent failures on EU-based CI runners. Switching to HTTP/1.1 seems to reduce the issue, but it doesn’t feel like a reliable long-term workaround.

[kugel-]

FTR, I stumbled on this when trying to build zephyr which clones modules as part of the build. Chatting with AI gave the hint to try HTTP/1.1 (which works), further investigation then led me to this discussion.

[dribic]

I just encountered this issue when trying to update Homebrew on Ubuntu 24.04 in EU

[u1735067]

TrueNAS users are affected too (both community and enterprise I guess), see https://forums.truenas.com/t/truenas-apps-catalog-fails-to-sync-git-http-2-returns-401-http-1-1-works/67742