##// END OF EJS Templates
identify: add template support...
identify: add template support This is based on a patch proposed last year by Mathias De Maré[1], with a few changes. - Tags and bookmarks are now formatted lists, for more flexible queries. - The templater is populated whether or not [-nibtB] is specified. (Plain output is unchanged.) This seems more consistent with other templated commands. - The 'id' property is a string, instead of a list. - The parents of 'wdir()' have their own list of attributes. I left 'id' as a string because it seems very useful for generating version info. It's also a bit strange because the value and meaning changes depending on whether or not --debug is passed (short vs full hash), whether the revision is a merge or not (one hash or two, separated by a '+'), the working directory or not (node vs p1node), and local or not (remote defaults to tip, and never has '+'). The equivalent string built with {rev} seems much less useful, and I couldn't think of a reasonable name, so I left it out. The discussion seemed to be pointing towards having a list of nodes, with more than one entry for a merge. It seems simpler to give the nodes a name, and use {node} for the actual commit probed, especially now that there is a virtual node for 'wdir()'. Yuya mentioned using fm.nested() in that thread, so I did for the parent nodes. I'm not sure if the plan is to fill in all of the context attributes in these items, or if these nested items should simply be made {p1node} and {p1rev}. I used ':' as the tag separator for consistency with {tags} in the log templater. Likewise, bookmarks are separated by a space for consistency with the corresponding log template. [1] https://www.mercurial-scm.org/pipermail/mercurial-devel/2016-August/087039.html
Matt Harbison -
r33051:15a79ac8 default
Show More
Name Size Modified Last Commit Author
/ tests / sslcerts
README Loading ...
client-cert.pem Loading ...
client-key-decrypted.pem Loading ...
client-key.pem Loading ...
priv.pem Loading ...
pub-expired.pem Loading ...
pub-not-yet.pem Loading ...
pub-other.pem Loading ...
pub.pem Loading ...

Generate a private key (priv.pem):

$ openssl genrsa -out priv.pem 2048

Generate 2 self-signed certificates from this key (pub.pem, pub-other.pem):

$ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
-out pub.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'
$ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
-out pub-other.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Now generate an expired certificate by turning back the system time:

$ faketime 2016-01-01T00:00:00Z \
openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
-out pub-expired.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a certificate not yet active by advancing the system time:

$ faketime 2030-01-1T00:00:00Z \
openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
-out pub-not-yet.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a passphrase protected client certificate private key:

$ openssl genrsa -aes256 -passout pass:1234 -out client-key.pem 2048

Create a copy of the private key without a passphrase:

$ openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem

Create a CSR and sign the key using the server keypair:

$ printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \
openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem
$ openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \
-set_serial 01 -out client-cert.pem

When replacing the certificates, references to certificate fingerprints will
need to be updated in test files.

Fingerprints for certs can be obtained by running:

$ openssl x509 -in pub.pem -noout -sha1 -fingerprint
$ openssl x509 -in pub.pem -noout -sha256 -fingerprint