http: exponential backoff, configurable status codes, and post_rpc() retries

Commit 640657ffd0 (http: add support for HTTP 429 rate limit retries, 2026-03-17) added HTTP 429 retry support using http.maxRetries, http.retryAfter, and http.maxRetryTime.

In practice, when running Git against hosting backends and reverse proxies under high concurrency, four gaps remain:

1. Off-by-one retry count and Retry-After Trace2 timing: Because http_request_recoverable() pre-decrements the retry counter (--rate_limit_retries) in its loop condition, setting http.maxRetries=1 performs 0 retries (and N configured retries performs N-1 retries). In addition, the Retry-After header is extracted after Trace2 logging has already run, so the http/429-retry-after Trace2 event always logs -1.

2. No exponential backoff (and 0s default) when Retry-After is absent: When a server does not send a Retry-After header, Git defaults http.retryAfter to 0 (retrying immediately in a tight loop) and waits the same fixed delay on every retry when configured. Doubling the delay on each attempt and defaulting http.retryAfter to 10 seconds (10s, 20s, 40s, ...) gives overloaded servers breathing room while keeping interactive commands reasonably responsive.

3. Transient 5xx errors cannot be retried: Reverse proxies, load balancers, and Git backends frequently surface transient overload or connection resets as 502 Bad Gateway, 503 Service Unavailable, or 504 Gateway Timeout. Because 5xx errors are not universally transient across all environments, 429 should remain the default, with an opt-in config to specify additional status codes.

4. HTTP POST requests are not retried: Git's existing 429 retry logic only covers HTTP GET requests (such as the initial /info/refs handshake). However, the actual data transfer during fetch and clone, as well as on-demand blob downloads in partial clones (during checkout, diff, or blame), are sent as HTTP POST requests (/git-upload-pack) via post_rpc(), which only retries authentication and immediately aborts on 429 or 5xx.

This 5-patch series addresses all four gaps:

* Patch 1/5 fixes the off-by-one retry count bug and extracts Retry-After in finish_active_slot() before Trace2 logging runs.
* Patch 2/5 doubles http.retryAfter on each subsequent retry attempt (capped at http.maxRetryTime) when Retry-After is absent.
* Patch 3/5 adds http.retryStatusCodes (and GIT_HTTP_RETRY_STATUS_CODES), defaulting to "429", so environments can opt into retrying codes like "429,502,503,504".
* Patch 4/5 extracts a shared http_retry_wait() helper and extends retry support to HTTP POST requests in probe_rpc() and post_rpc() (while fixing a missing Content-Encoding: gzip header on retry).
* Patch 5/5 changes the default of http.retryAfter from 0 to 10 seconds so Git does not immediately hammer a rate-limiting server when no Retry-After header is provided.

Prior discussions:

* https://lore.kernel.org/git/[email protected]/
* https://lore.kernel.org/git/[email protected]/

Changes since v2:

* Patches 1/5..4/5: Unchanged from v2.
* Added Patch 5/5 to default http.retryAfter to 10 seconds instead of 0 when Retry-After is absent (per feedback from Junio C Hamano and brian m. carlson).

Changes since v1:

* Patch 1/4: Clarified in the commit message why the http_max_retries <= 0 check was moved after the retry loop.
* Patch 2/4: Passed http_max_retries - rate_limit_retries instead of adding a separate attempt counter, and clarified the http.retryAfter and http.maxRetryTime docs.
* Patch 3/4: Restored (Too Many Requests) and clarified http.retryStatusCodes in the config docs, and moved the 400..599 range check to the top of is_retryable_http_code().
* Patch 4/4: Added the attempt counter here when replacing rate_limit_retries with http_retry_wait().

Ravi Mistry (5):
http: fix retry count and Retry-After timing
http: add exponential backoff without Retry-After
http: add http.retryStatusCodes config option
remote-curl: retry transient HTTP errors in post_rpc()
http: default http.retryAfter to 10 seconds

 Documentation/config/http.adoc |  61 ++++++++---
 http.c                         | 129 +++++++++++++++--------
 http.h                         |  12 ++-
 remote-curl.c                  |  75 +++++++-------
 t/lib-httpd/http-429.sh        |  63 ++++++++++--
 t/t5584-http-429-retry.sh      | 181 +++++++++++++++++++++++++++++++--
 6 files changed, 412 insertions(+), 109 deletions(-)

base-commit: 8d1b215c01512b9658d4525c54ff9b9245f9a7e8
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2287%2Frmistry%2Fhttp-exponential-retries-v3
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2287/rmistry/http-exponential-retries-v3
Pull-Request: https://github.com/gitgitgadget/git/pull/2287

Range-diff vs v2:

 1:  d53778dd46 = 1:  d53778dd46 http: fix retry count and Retry-After timing
 2:  fe1e847ded = 2:  fe1e847ded http: add exponential backoff without Retry-After
 3:  6510dddc39 = 3:  6510dddc39 http: add http.retryStatusCodes config option
 4:  786964ff00 = 4:  786964ff00 remote-curl: retry transient HTTP errors in post_rpc()
 -:  ---------- > 5:  61e3ffe9ab http: default http.retryAfter to 10 seconds

gitgitgadget