bug#36810: 26.2; package.el; package-refresh-contents, Bad Request (http over https)

[Noam Postavsky]

merge 36810 36725
quit

gnu@crabapple.me.uk writes:

> Replicate with:
> emacs -Q
> M-x package-initialize RET
> M-x set-variable RET debug-on-error RET t RET
> package-refresh-contents
> => Debugger entered--Lisp error: (file-error
> "https://elpa.gnu.org/packages/archive-contents"; "Bad Request")
>
> In wireshark I observe a TLS1.2 session with elpa.gnu.org, terminated
> from localhost, then another connection established to port 443 on
> elpa.gun.org but no TLS setup and then a straight HTTP GET request (for
> /packages/archive-contents).
> Server responds 400 (Bad Request):
> "Your browser sent a request that this server could not understand.
> Reason: You're speaking plain HTTP to an SSL-enabled server port."

I believe this is another case of Bug#36725/36749/34341.  It should work
in 26.2.90 pretest.  As a workaround, doing

    (setq gnutls-algorithm-priority "NORMAL:-VERS-TLS1.3")

seems to help (it somehow affects the timing so as to avoid the bug).