##// END OF EJS Templates
sslutil: require TLS 1.1+ when supported...
sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.

File last commit:

r28013:e529b5f1 default
r29560:303e9300 default
Show More
test-contrib-check-commit.t
115 lines | 4.2 KiB | text/troff | Tads3Lexer
/ tests / test-contrib-check-commit.t
Pierre-Yves David
check-commit: add a test for the patch checking script in contrib...
r27328 Test the 'check-commit' script
==============================
Matt Mackall
tests: extend check-commit self-tests...
r27700 A fine patch:
Pierre-Yves David
check-commit: add a test for the patch checking script in contrib...
r27328
$ cat > patch-with-long-header.diff << EOF
> # HG changeset patch
> # User timeless <timeless@mozdev.org>
> # Date 1448911706 0
> # Mon Nov 30 19:28:26 2015 +0000
> # Node ID c41cb6d2b7dbd62b1033727f8606b8c09fc4aa88
> # Parent 42aa0e570eaa364a622bc4443b0bcb79b1100a58
> # ClownJoke This is a veryly long header that should not be warned about because its not the description
Matt Mackall
tests: extend check-commit self-tests...
r27700 > bundle2: use Oxford comma (issue123) (BC)
>
> diff --git a/hgext/transplant.py b/hgext/transplant.py
> --- a/hgext/transplant.py
> +++ b/hgext/transplant.py
> @@ -599,7 +599,7 @@
> return
> if not (opts.get('source') or revs or
> opts.get('merge') or opts.get('branch')):
> - raise error.Abort(_('no source URL, branch revision or revision '
> + raise error.Abort(_('no source URL, branch revision, or revision '
> 'list provided'))
> if opts.get('all'):
>
> + def blahblah(x):
> + pass
> EOF
$ cat patch-with-long-header.diff | $TESTDIR/../contrib/check-commit
A patch with lots of errors:
$ cat > patch-with-long-header.diff << EOF
> # HG changeset patch
> # User timeless
> # Date 1448911706 0
> # Mon Nov 30 19:28:26 2015 +0000
> # Node ID c41cb6d2b7dbd62b1033727f8606b8c09fc4aa88
> # Parent 42aa0e570eaa364a622bc4443b0bcb79b1100a58
> # ClownJoke This is a veryly long header that should not be warned about because its not the description
> transplant/foo: this summary is way too long use Oxford comma (bc) (bug123) (issue 244)
Pierre-Yves David
check-commit: add a test for the patch checking script in contrib...
r27328 >
> diff --git a/hgext/transplant.py b/hgext/transplant.py
> --- a/hgext/transplant.py
> +++ b/hgext/transplant.py
> @@ -599,7 +599,7 @@
> return
> if not (opts.get('source') or revs or
> opts.get('merge') or opts.get('branch')):
> - raise error.Abort(_('no source URL, branch revision or revision '
> + raise error.Abort(_('no source URL, branch revision, or revision '
> 'list provided'))
> if opts.get('all'):
> EOF
$ cat patch-with-long-header.diff | $TESTDIR/../contrib/check-commit
timeless
check-commit: sort errors by line number
r27783 1: username is not an email address
# User timeless
7: summary keyword should be most user-relevant one-word command or topic
Matt Mackall
tests: extend check-commit self-tests...
r27700 transplant/foo: this summary is way too long use Oxford comma (bc) (bug123) (issue 244)
timeless
check-commit: sort errors by line number
r27783 7: (BC) needs to be uppercase
Matt Mackall
tests: extend check-commit self-tests...
r27700 transplant/foo: this summary is way too long use Oxford comma (bc) (bug123) (issue 244)
7: use (issueDDDD) instead of bug
transplant/foo: this summary is way too long use Oxford comma (bc) (bug123) (issue 244)
timeless
check-commit: sort errors by line number
r27783 7: no space allowed between issue and number
Matt Mackall
tests: extend check-commit self-tests...
r27700 transplant/foo: this summary is way too long use Oxford comma (bc) (bug123) (issue 244)
7: summary line too long (limit is 78)
transplant/foo: this summary is way too long use Oxford comma (bc) (bug123) (issue 244)
[1]
A patch with other errors:
$ cat > patch-with-long-header.diff << EOF
> # HG changeset patch
> # User timeless
> # Date 1448911706 0
> # Mon Nov 30 19:28:26 2015 +0000
> # Node ID c41cb6d2b7dbd62b1033727f8606b8c09fc4aa88
> # Parent 42aa0e570eaa364a622bc4443b0bcb79b1100a58
> # ClownJoke This is a veryly long header that should not be warned about because its not the description
> This has no topic and ends with a period.
>
> diff --git a/hgext/transplant.py b/hgext/transplant.py
> --- a/hgext/transplant.py
> +++ b/hgext/transplant.py
> @@ -599,7 +599,7 @@
> if opts.get('all'):
>
Matt Mackall
check-commit: check for double-addition of blank lines...
r28013 >
> +
> + some = otherjunk
> +
Matt Mackall
tests: extend check-commit self-tests...
r27700 > +
> + def blah_blah(x):
> + pass
> +
>
> EOF
$ cat patch-with-long-header.diff | $TESTDIR/../contrib/check-commit
1: username is not an email address
# User timeless
timeless
check-commit: sort errors by line number
r27783 7: don't capitalize summary lines
Matt Mackall
tests: extend check-commit self-tests...
r27700 This has no topic and ends with a period.
timeless
check-commit: sort errors by line number
r27783 7: summary line doesn't start with 'topic: '
Matt Mackall
tests: extend check-commit self-tests...
r27700 This has no topic and ends with a period.
7: don't add trailing period on summary line
This has no topic and ends with a period.
timeless
check-commit: sort errors by line number
r27783 19: adds double empty line
+
Matt Mackall
check-commit: check for double-addition of blank lines...
r28013 20: adds a function with foo_bar naming
+ def blah_blah(x):
23: adds double empty line
+
Matt Mackall
tests: extend check-commit self-tests...
r27700 [1]