upstream/mercurial-mirror Files · tests/test-convert-clonebranches.t

sslutil: require TLS 1.1+ when supported...

sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.

Matt Mackall - - Load All Authors

File last commit:

r25295:701df761 default


                r29560:303e9300

default

Download file

             test-convert-clonebranches.t
        
                    87 lines
            
             | 2.0 KiB
            
                | text/troff
            
             |
                Tads3Lexer
            
             / tests / test-convert-clonebranches.t
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

        $ cat <<EOF >> $HGRCPATH

        > [extensions]

        > convert =

        > [convert]

        > hg.tagsbranch = 0

        > EOF

        $ hg init source

        $ cd source

        $ echo a > a

        $ hg ci -qAm adda

      Add a merge with one parent in the same branch

        $ echo a >> a

        $ hg ci -qAm changea

        $ hg up -qC 0

        $ hg branch branch0

        marked working directory as branch branch0

        (branches are permanent and global, did you want a bookmark?)

        $ echo b > b

        $ hg ci -qAm addb

        $ hg up -qC

        $ hg merge default

        1 files updated, 0 files merged, 0 files removed, 0 files unresolved

        (branch merge, don't forget to commit)

        $ hg ci -qm mergeab

        $ hg tag -ql mergeab

        $ cd ..

      Miss perl... sometimes

        $ cat > filter.py <<EOF

        > import sys, re

        > 

        > r = re.compile(r'^(?:\d+|pulling from)')

        > sys.stdout.writelines([l for l in sys.stdin if r.search(l)])

        > EOF

      convert

        $ hg convert -v --config convert.hg.clonebranches=1 source dest |

        >     python filter.py

        3 adda

        2 changea

        1 addb

        pulling from default into branch0

        1 changesets found

        0 mergeab

        pulling from default into branch0

        1 changesets found

      Add a merge with both parents and child in different branches

        $ cd source

        $ hg branch branch1

        marked working directory as branch branch1

        $ echo a > file1

        $ hg ci -qAm c1

        $ hg up -qC mergeab

        $ hg branch branch2

        marked working directory as branch branch2

        $ echo a > file2

        $ hg ci -qAm c2

        $ hg merge branch1

        1 files updated, 0 files merged, 0 files removed, 0 files unresolved

        (branch merge, don't forget to commit)

        $ hg branch branch3

        marked working directory as branch branch3

        $ hg ci -qAm c3

        $ cd ..

      incremental conversion

        $ hg convert -v --config convert.hg.clonebranches=1 source dest |

        >     python filter.py

        2 c1

        pulling from branch0 into branch1

        4 changesets found

        1 c2

        pulling from branch0 into branch2

        4 changesets found

        0 c3

        pulling from branch1 into branch3

        5 changesets found

        pulling from branch2 into branch3

        1 changesets found

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages


				$ cat <<EOF >> $HGRCPATH
				> [extensions]
				> convert =
				> [convert]
				> hg.tagsbranch = 0
				> EOF
				$ hg init source
				$ cd source
				$ echo a > a
				$ hg ci -qAm adda

				Add a merge with one parent in the same branch

				$ echo a >> a
				$ hg ci -qAm changea
				$ hg up -qC 0
				$ hg branch branch0
				marked working directory as branch branch0
				(branches are permanent and global, did you want a bookmark?)
				$ echo b > b
				$ hg ci -qAm addb
				$ hg up -qC
				$ hg merge default
				1 files updated, 0 files merged, 0 files removed, 0 files unresolved
				(branch merge, don't forget to commit)
				$ hg ci -qm mergeab
				$ hg tag -ql mergeab
				$ cd ..

				Miss perl... sometimes

				$ cat > filter.py <<EOF
				> import sys, re
				>
				> r = re.compile(r'^(?:\d+\|pulling from)')
				> sys.stdout.writelines([l for l in sys.stdin if r.search(l)])
				> EOF

				convert

				$ hg convert -v --config convert.hg.clonebranches=1 source dest \|
				> python filter.py
				3 adda
				2 changea
				1 addb
				pulling from default into branch0
				1 changesets found
				0 mergeab
				pulling from default into branch0
				1 changesets found

				Add a merge with both parents and child in different branches

				$ cd source
				$ hg branch branch1
				marked working directory as branch branch1
				$ echo a > file1
				$ hg ci -qAm c1
				$ hg up -qC mergeab
				$ hg branch branch2
				marked working directory as branch branch2
				$ echo a > file2
				$ hg ci -qAm c2
				$ hg merge branch1
				1 files updated, 0 files merged, 0 files removed, 0 files unresolved
				(branch merge, don't forget to commit)
				$ hg branch branch3
				marked working directory as branch branch3
				$ hg ci -qAm c3
				$ cd ..

				incremental conversion

				$ hg convert -v --config convert.hg.clonebranches=1 source dest \|
				> python filter.py
				2 c1
				pulling from branch0 into branch1
				4 changesets found
				1 c2
				pulling from branch0 into branch2
				4 changesets found
				0 c3
				pulling from branch1 into branch3
				5 changesets found
				pulling from branch2 into branch3
				1 changesets found