GitHub throttles unauthenticated git-upload-pack and selects targets by TLS
fingerprint (x-github-edge-protection: ja4-campaign-git-error). A clone gets 200
for the ref advertisement and then 401 for the fetch, so git asks for a password,
finds no terminal, and the configure stops with no error and hangs to the CI
timeout. Whether an image is hit follows its OpenSSL version: rocky8 (1.1.1)
passed 5/5 while rocky9 (3.5.5) and ubuntu2204 (3.0.2) failed 5/5, which is why
it presented as two broken build images.
The archive endpoint is not part of the campaign, and a tarball is a fraction of
the transfer -- hdf5 is 40 MB against a 271 MB shallow clone. Every URL is pinned
by tag or commit and its bytes by URL_HASH.
Ceres is the exception: it carries abseil as a git submodule, so it is populated
first, the abseil commit its submodule points at is unpacked into
third_party/abseil-cpp, and the subdirectory is added only then.
Versions are unchanged; the archives are the same trees the clones checked out.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6iekpDa2xiKobEj1R5xnp
