@thomas The container is already privileged and nesting is also enabled. I'll try to get a minimal reproducer tomorrow after making sure everything is upgraded as much as possible.

@astro I read that as optional? RFC9421 signatures are checked, if present, but not required? Or am I missing something?

@glyph Does not help much if the HTTP client lib in question (aiohttp.client) wraps URLs in `yarl.URL` internally, which does the normalization by default. A design flaw if you ask me. I can only side-step the issue by wrapping all URLs with `yarl.URL(url, encoded=True)` myself to avoid this […]

Yes, this is documented behavior, but I rarely read the documentation for HTTP client libraries. I know how HTTP works, I know how those libraries should work, and silently altering URLs without any need is something I really did not expect from a low level HTTP lib.

Imagine #curl would […]

At which point it's just considered cheating? https://sqlite.org/json1.html#jptr

@GossiTheDog :thisisfine: