##// END OF EJS Templates
upstream » mercurial-mirror
RSS

Clone from https://www.mercurial-scm.org/repo/hg-all

sslutil: issue warning when [hostfingerprint] is used...
sslutil: issue warning when [hostfingerprint] is used Mercurial 3.9 added the [hostsecurity] section, which is better than [hostfingerprints] in every way. One of the ways that [hostsecurity] is better is that it supports SHA-256 and SHA-512 fingerprints, not just SHA-1 fingerprints. The world is moving away from SHA-1 because it is borderline secure. Mercurial should be part of that movement. This patch adds a warning when a valid SHA-1 fingerprint from the [hostfingerprints] section is being used. The warning informs users to switch to [hostsecurity]. It even prints the config option they should set. It uses the SHA-256 fingerprint because recommending a SHA-1 fingerprint in 2017 would be ill-advised. The warning will print itself on every connection to a server until it is fixed. There is no way to suppress the warning. I admit this is annoying. But given the security implications of sticking with SHA-1, I think this is justified. If this patch is accepted, I'll likely send a follow-up to start warning on SHA-1 certificates in [hostsecurity] as well. Then sometime down the road, we can drop support for SHA-1 fingerprints. Credit for this idea comes from timeless in issue 5466.
Thomas Arendsen Hein - - Load All Authors

File last commit:

r18526:9409aeaa stable
r31290:f819aa9d default
Show More
header.tmpl
7 lines | 495 B | application/x-cheetah | CheetahLexer
/ mercurial / templates / monoblue / header.tmpl
History | Source | Raw |Copy content |Copy permalink
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
 r9999 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
 r18526 <link rel="icon" href="{staticurl|urlescape}hgicon.png" type="image/png" />
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
 r9999 <meta name="robots" content="index, nofollow"/>
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
 r18526 <link rel="stylesheet" href="{staticurl|urlescape}style-monoblue.css" type="text/css" />
<script type="text/javascript" src="{staticurl|urlescape}mercurial.js"></script>