# Git HTTP proxy loopback lab

This is a synthetic routing and authentication fixture. It creates a tiny Git repository, serves a bare copy over dumb HTTP, and forwards its requests through a separate authenticated loopback proxy. All network endpoints bind to `127.0.0.1`; the proxy refuses other origins. Credentials are deliberately fake.

Requires Git with `GIT_CONFIG_GLOBAL` (introduced in Git2.32) and Python with `http.server.ThreadingHTTPServer` (introduced in Python3.7) on `PATH`; uses only the Python standard library. These are documented feature requirements, not an executed compatibility claim for every old version. Only the recorded Git2.50.1/Python3.14.8 environment was tested. Run the exact downloadable script from a terminal:

```sh
python3 git_proxy_lab.py > results.json
```

Exit 0 means every declared expectation passed. The report includes all command arguments, command stdout/stderr, separate origin/proxy request logs, positive repository verification and expected failure evidence. Script paths, temporary directories and ports naturally vary. The fake credentials in this fixture and its output are safe to inspect; do not replace them with production credentials.

The recorded run on 12 October 2026 used Git 2.50.1 (Apple Git-155), Python 3.14.8 and macOS 15.7.4 arm64. Ten of ten cases passed: nine successful clones/fetches each reproduced commit `68fc8d06804800de20dea2c692b046750b01c3cd` and the exact `payload.txt` contents, and one rejected wrong credentials with exit 128 / HTTP 407 before any origin request. The expected payload SHA-256 is `cc32e4df0ae80f8292236e0ab1aad5d31b52fe00264ed62b67c0d593dad8a073`.

| Case | Acceptance | Recorded result |
| --- | --- | --- |
| One-off `-c http.proxy` | Correct commit/blob via authenticated proxy after its challenge | Passed |
| Wrong synthetic credentials | HTTP 407, failing Git command, no origin request | Passed |
| Matching URL-scoped proxy | Correct commit/blob through proxy | Passed |
| Unrelated URL path | Correct commit/blob directly, no proxy request | Passed |
| `remote.origin.proxy` override | Correct commit/blob despite broken generic proxy configuration | Passed |
| Empty `remote.origin.proxy` | Correct commit/blob directly despite generic proxy | Passed |
| Empty command `http.proxy` | Correct commit/blob directly despite generic global proxy | Passed |
| Empty command `http.proxy`, matching global URL key | Matching URL key still routes through proxy; generic empty value did not remove it | Passed |
| Empty URL-scoped proxy | Correct commit/blob directly despite generic global proxy | Passed |
| `no_proxy=127.0.0.1` | Correct commit/blob directly despite configured proxy | Passed |

The eighth case matters when removing a proxy: a generic `http.proxy` value and `http.<url>.proxy` are different keys. An empty generic command value did not clear the matching URL key in this run. Inspect that URL's selected HTTP configuration and the named remote's proxy setting before assuming a bypass.

The fixture removes inherited proxy variables and `GIT_*` variables from subprocesses, disables system configuration, uses a temporary global configuration file, and clears credential helpers. It never overwrites the user's Git configuration or repurposes `HOME`. Its temporary repositories and configuration are deleted on exit. Proxy authorization is logged only as presence/acceptance booleans and is stripped before forwarding to the origin.

The diagnostic output separately demonstrates `--show-origin --show-scope --get-all http.proxy` with global, local and command values and `--get-urlmatch http.proxy URL`. A configuration lookup explains selected settings; the request logs and validated repository establish what this fixture actually did.

This does not test smart HTTP, pushes, external repositories/providers, HTTPS CONNECT or certificates, SSH, SOCKS, packet capture, speed or blocking rates. Documentation covers HTTP/HTTPS settings; this experiment executed dumb HTTP clone/fetch only. Request counts depend on the Git/libcurl build and are not performance metrics. The fixture is intended to diagnose configuration behavior, not establish production service capabilities.