sslutil: handle setups without .getpeercert() early in the validator

This simplifies the code and makes the flow more obvious and reduces the
indentation level.

mercurial/sslutil.py

@@ -103,6 +103,13 b' class validator(object):'
         host = self.host
         cacerts = self.ui.config('web', 'cacerts')
         hostfingerprint = self.ui.config('hostfingerprints', host)
+        if not getattr(sock, 'getpeercert', False): # python 2.5 ?
+            if hostfingerprint:
+                raise util.Abort(_("host fingerprint for %s can't be "
+                                   "verified (Python too old)") % host)
+            self.ui.warn(_("warning: certificate for %s can't be verified "
+                           "(Python too old)\n") % host)
+            return
         if cacerts and not hostfingerprint:
             msg = _verifycert(sock.getpeercert(), host)
             if msg:
@@ -111,7 +118,6 b' class validator(object):'
                                    'insecurely)') % (host, msg))
             self.ui.debug('%s certificate successfully verified\n' % host)
         else:
-            if getattr(sock, 'getpeercert', False):
                 peercert = sock.getpeercert(True)
                 peerfingerprint = util.sha1(peercert).hexdigest()
                 nicefingerprint = ":".join([peerfingerprint[x:x + 2]
@@ -130,9 +136,3 b' class validator(object):'
                                    '(check hostfingerprints or web.cacerts '
                                    'config setting)\n') %
                                  (host, nicefingerprint))
-            else: # python 2.5 ?
-                if hostfingerprint:
-                    raise util.Abort(_("host fingerprint for %s can't be "
-                                       "verified (Python too old)") % host)
-                self.ui.warn(_("warning: certificate for %s can't be "
-                               "verified (Python too old)\n") % host)