##// END OF EJS Templates
sslutil: require TLS 1.1+ when supported...
sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.

File last commit:

r29219:3c9066ed default
r29560:303e9300 default
Show More
test-contrib-perf.t
150 lines | 4.0 KiB | text/troff | Tads3Lexer
#require test-repo
Set vars:
$ . "$TESTDIR/helpers-testrepo.sh"
$ CONTRIBDIR="$TESTDIR/../contrib"
Prepare repo:
$ hg init
$ echo this is file a > a
$ hg add a
$ hg commit -m first
$ echo adding to file a >> a
$ hg commit -m second
$ echo adding more to file a >> a
$ hg commit -m third
$ hg up -r 0
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ echo merge-this >> a
$ hg commit -m merge-able
created new head
$ hg up -r 2
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
perfstatus
$ cat >> $HGRCPATH << EOF
> [extensions]
> perfstatusext=$CONTRIBDIR/perf.py
> [perf]
> presleep=0
> stub=on
> parentscount=1
> EOF
$ hg help perfstatusext
perfstatusext extension - helper extension to measure performance
list of commands:
perfaddremove
(no help text available)
perfancestors
(no help text available)
perfancestorset
(no help text available)
perfannotate (no help text available)
perfbranchmap
benchmark the update of a branchmap
perfcca (no help text available)
perfchangeset
(no help text available)
perfctxfiles (no help text available)
perfdiffwd Profile diff of working directory changes
perfdirfoldmap
(no help text available)
perfdirs (no help text available)
perfdirstate (no help text available)
perfdirstatedirs
(no help text available)
perfdirstatefoldmap
(no help text available)
perfdirstatewrite
(no help text available)
perffncacheencode
(no help text available)
perffncacheload
(no help text available)
perffncachewrite
(no help text available)
perfheads (no help text available)
perfindex (no help text available)
perfloadmarkers
benchmark the time to parse the on-disk markers for a repo
perflog (no help text available)
perflookup (no help text available)
perflrucachedict
(no help text available)
perfmanifest (no help text available)
perfmergecalculate
(no help text available)
perfmoonwalk benchmark walking the changelog backwards
perfnodelookup
(no help text available)
perfparents (no help text available)
perfpathcopies
(no help text available)
perfrawfiles (no help text available)
perfrevlog Benchmark reading a series of revisions from a revlog.
perfrevlogrevision
Benchmark obtaining a revlog revision.
perfrevrange (no help text available)
perfrevset benchmark the execution time of a revset
perfstartup (no help text available)
perfstatus (no help text available)
perftags (no help text available)
perftemplating
(no help text available)
perfvolatilesets
benchmark the computation of various volatile set
perfwalk (no help text available)
(use "hg help -v perfstatusext" to show built-in aliases and global options)
$ hg perfaddremove
$ hg perfancestors
$ hg perfancestorset 2
$ hg perfannotate a
$ hg perfbranchmap
$ hg perfcca
$ hg perfchangeset 2
$ hg perfctxfiles 2
$ hg perfdiffwd
$ hg perfdirfoldmap
$ hg perfdirs
$ hg perfdirstate
$ hg perfdirstatedirs
$ hg perfdirstatefoldmap
$ hg perfdirstatewrite
$ hg perffncacheencode
$ hg perffncacheload
$ hg perffncachewrite
$ hg perfheads
$ hg perfindex
$ hg perfloadmarkers
$ hg perflog
$ hg perflookup 2
$ hg perflrucache
$ hg perfmanifest 2
$ hg perfmergecalculate -r 3
$ hg perfmoonwalk
$ hg perfnodelookup 2
$ hg perfpathcopies 1 2
$ hg perfrawfiles 2
$ hg perfrevlog .hg/store/data/a.i
$ hg perfrevlogrevision -m 0
$ hg perfrevrange
$ hg perfrevset 'all()'
$ hg perfstartup
$ hg perfstatus
$ hg perftags
$ hg perftemplating
$ hg perfvolatilesets
$ hg perfwalk
$ hg perfparents