Re: [PATCH http-server 1/1] apiserver: send TLS close notify at the end of streamed responses

["Michael Köppl" <m.koeppl@proxmox.com>]

I was made aware and simply forgot that I should probably give an
example how to reproduce this.

1. Create a container
2. Back it up to PBS
3. The script below covers a simplified form of what the E2E test does.
   Running it as root on a test node, pointing it at the container
   backup like `repro.sh pbs:backup/ct/100/2026-11-03T12:00:00Z` will
   return the data (the container's hostname) successfully downloaded,
   but curl will show error 56.

```
#!/bin/bash
# e.g. repro.sh pbs:backup/ct/100/2026-11-03T12:00:00Z

volid=$1
storage=${volid%%:*}
ticket=$(perl -MPVE::AccessControl -e 'print PVE::AccessControl::assemble_ticket("root\@pam")')
filepath=$(printf '/root.pxar.didx/etc/hostname' | base64 -w0)

curl -sSk -G -H "Cookie: PVEAuthCookie=$ticket" \
    --data-urlencode "volume=$volid" --data-urlencode "filepath=$filepath" \
    "https://localhost:8006/api2/json/nodes/$(hostname)/storage/$storage/file-restore/download"
echo "exit code: $?"
```

Thanks, @Maximiliano for pointing this out.

On Tue Nov 3, 2026 at 4:52 PM CET, Michael Köppl wrote:
> A streamed response (e.g. for the single file restore download), has no
> Content-Length nor chunked encoding, so the client can only tell where
> the body ends by the connection being closed. The response accounced
> 'Connection: Keep-Alive' and, at the end of the stream, push_shutdown()
> shut down the socket directly, bypassing the TLS layer. The client then

[snip]