##// END OF EJS Templates
interfaces: mark a few dirstate methods abstract...
interfaces: mark a few dirstate methods abstract I'm not sure what's going on here, but when enabling pytype checking on this package, it spits out the following errors: File "/mnt/c/Users/Matt/hg/mercurial/interfaces/dirstate.py", line 136, in changing_parents: bad return type [bad-return-type] Expected: Iterator Actually returned: None Attributes of protocol Iterator are not implemented on None: __next__ File "/mnt/c/Users/Matt/hg/mercurial/interfaces/dirstate.py", line 145, in changing_files: bad return type [bad-return-type] Expected: Iterator Actually returned: None Attributes of protocol Iterator are not implemented on None: __next__ I guess technically that's true, because these methods only have a doc comment, and don't explicitly return something or unconditionally raise an error. The strange thing is that both before and after this change, the *.pyi file that is generated is unchanged, and contains: def changing_files(self, repo) -> contextlib._GeneratorContextManager: ... def changing_parents(self, repo) -> contextlib._GeneratorContextManager: ... I'm not sure if the `@abstractmethod` should be the most inner or most outer decoration. We'll roll the dice with being the innermost, because that's how `@abstractproperty` says it should be used in conjunction with `@property`. We should probably make all of the methods without an actual body abstract, like was done for some `mercurial.wireprototypes` classes in fd200f5bcaea. But let's hold off for now and do that enmass later.
Matt Harbison -
r53328:2c8c46c3 default
Show More
Name Size Modified Last Commit Author
/ tests / sslcerts
README Loading ...
client-cert.pem Loading ...
client-key-decrypted.pem Loading ...
client-key.pem Loading ...
priv.pem Loading ...
pub-expired.pem Loading ...
pub-not-yet.pem Loading ...
pub-other.pem Loading ...
pub.pem Loading ...

Generate a private key (priv.pem):

$ openssl genrsa -out priv.pem 2048

Generate 2 self-signed certificates from this key (pub.pem, pub-other.pem):

$ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
-out pub.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'
$ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
-out pub-other.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Now generate an expired certificate by turning back the system time:

$ faketime 2016-01-01T00:00:00Z \
openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
-out pub-expired.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a certificate not yet active by advancing the system time:

$ faketime 2030-01-1T00:00:00Z \
openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
-out pub-not-yet.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a passphrase protected client certificate private key:

$ openssl genrsa -aes256 -passout pass:1234 -out client-key.pem 2048

Create a copy of the private key without a passphrase:

$ openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem

Create a CSR and sign the key using the server keypair:

$ printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \
openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem
$ openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \
-set_serial 01 -out client-cert.pem

When replacing the certificates, references to certificate fingerprints will
need to be updated in test files.

Fingerprints for certs can be obtained by running:

$ openssl x509 -in pub.pem -noout -sha1 -fingerprint
$ openssl x509 -in pub.pem -noout -sha256 -fingerprint