##// END OF EJS Templates
sslutil: require TLS 1.1+ when supported...
sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.

File last commit:

r22046:7a9cbb31 default
r29560:303e9300 default
Show More
test-convert-darcs.t
107 lines | 2.6 KiB | text/troff | Tads3Lexer
/ tests / test-convert-darcs.t
Matt Mackall
tests: replace exit 80 with #require
r22046 #require darcs
Matt Mackall
tests: unify test-convert-darcs
r12524
$ echo "[extensions]" >> $HGRCPATH
$ echo "convert=" >> $HGRCPATH
$ DARCS_EMAIL='test@example.org'; export DARCS_EMAIL
initialize darcs repo
$ mkdir darcs-repo
$ cd darcs-repo
$ darcs init
$ echo a > a
$ darcs record -a -l -m p0
Finished recording patch 'p0'
$ cd ..
branch and update
Bryan O'Sullivan
tests: make test-convert-darcs.t happier with darcs 2.8.0
r16698 $ darcs get -q darcs-repo darcs-clone >/dev/null
Matt Mackall
tests: unify test-convert-darcs
r12524 $ cd darcs-clone
$ echo c >> a
$ echo c > c
$ darcs record -a -l -m p1.1
Finished recording patch 'p1.1'
$ cd ..
Patrick Mezard
test-convert-darcs.t: fix elementtree test...
r17448 skip if we can't import elementtree
$ if hg convert darcs-repo darcs-dummy 2>&1 | grep ElementTree > /dev/null; then
> echo 'skipped: missing feature: elementtree module'
> exit 80
> fi
Matt Mackall
tests: unify test-convert-darcs
r12524 update source
$ cd darcs-repo
$ echo b >> a
$ echo b > b
$ darcs record -a -l -m p1.2
Finished recording patch 'p1.2'
Bryan O'Sullivan
tests: make test-convert-darcs.t happier with darcs 2.8.0
r16698 $ darcs pull -q -a --no-set-default ../darcs-clone
Backing up ./a(*) (glob)
Matt Mackall
tests: unify test-convert-darcs
r12524 We have conflicts in the following files:
./a
$ sleep 1
$ echo e > a
$ echo f > f
$ mkdir dir
$ echo d > dir/d
$ echo d > dir/d2
$ darcs record -a -l -m p2
Finished recording patch 'p2'
test file and directory move
$ darcs mv f ff
Test remove + move
$ darcs remove dir/d2
$ rm dir/d2
$ darcs mv dir dir2
$ darcs record -a -l -m p3
Finished recording patch 'p3'
The converter does not currently handle patch conflicts very well.
When they occur, it reverts *all* changes and moves forward,
letting the conflict resolving patch fix collisions.
Unfortunately, non-conflicting changes, like the addition of the
"c" file in p1.1 patch are reverted too.
Just to say that manifest not listing "c" here is a bug.
Matt Mackall
tests: darcs > 2.5 got "smart" about encoding, disable encoding tests...
r15335 $ cd ..
$ hg convert darcs-repo darcs-repo-hg
initializing destination darcs-repo-hg repository
scanning source...
sorting...
converting...
4 p0
3 p1.2
2 p1.1
1 p2
0 p3
$ hg log -R darcs-repo-hg -g --template '{rev} "{desc|firstline}" ({author}) files: {files}\n' "$@"
4 "p3" (test@example.org) files: dir/d dir/d2 dir2/d f ff
3 "p2" (test@example.org) files: a dir/d dir/d2 f
2 "p1.1" (test@example.org) files:
1 "p1.2" (test@example.org) files: a b
0 "p0" (test@example.org) files: a
Matt Mackall
merge with stable
r12718
Matt Mackall
tests: unify test-convert-darcs
r12524 $ hg up -q -R darcs-repo-hg
$ hg -R darcs-repo-hg manifest --debug
7225b30cdf38257d5cc7780772c051b6f33e6d6b 644 a
1e88685f5ddec574a34c70af492f95b6debc8741 644 b
37406831adc447ec2385014019599dfec953c806 644 dir2/d
b783a337463792a5c7d548ad85a7d3253c16ba8c 644 ff
Patrick Mezard
test-convert-darcs.t: fix elementtree test...
r17448
#if no-outer-repo
try converting darcs1 repository
$ hg clone -q "$TESTDIR/bundles/darcs1.hg" darcs
$ hg convert -s darcs darcs/darcs1 2>&1 | grep darcs-1.0
darcs-1.0 repository format is unsupported, please upgrade
#endif