##// END OF EJS Templates
sslutil: abort when unable to verify peer connection (BC)...
sslutil: abort when unable to verify peer connection (BC) Previously, when we connected to a server and were unable to verify its certificate against a trusted certificate authority we would issue a warning and continue to connect. This is obviously not great behavior because the x509 certificate model is based upon trust of specific CAs. Failure to enforce that trust erodes security. This behavior was defined several years ago when Python did not support loading the system trusted CA store (Python 2.7.9's backports of Python 3's improvements to the "ssl" module enabled this). This commit changes behavior when connecting to abort if the peer certificate can't be validated. With an empty/default Mercurial configuration, the peer certificate can be validated if Python is able to load the system trusted CA store. Environments able to load the system trusted CA store include: * Python 2.7.9+ on most platforms and installations * Python 2.7 distributions with a modern ssl module (e.g. RHEL7's patched 2.7.5 package) * Python shipped on OS X Environments unable to load the system trusted CA store include: * Python 2.6 * Python 2.7 on many existing Linux installs (because they don't ship 2.7.9+ or haven't backported modern ssl module) * Python 2.7.9+ on some installs where Python is unable to locate the system CA store (this is hopefully rare) Users of these Pythongs will need to configure Mercurial to load the system CA store using web.cacerts. This should ideally be performed by packagers (by setting web.cacerts in the global/system hgrc file). Where Mercurial packagers aren't setting this, the linked URL in the new abort message can contain instructions for users. In the future, we may want to add more code for finding the system CA store. For example, many Linux distributions have the CA store at well-known locations (such as /etc/ssl/certs/ca-certificates.crt in the case of Ubuntu). This will enable CA loading to "just work" on more Python configurations and will be best for our users since they won't have to change anything after upgrading to a Mercurial with this patch. We may also want to consider distributing a trusted CA store with Mercurial. Although we should think long and hard about that because most systems have a global CA store and Mercurial should almost certainly use the same store used by everything else on the system.

File last commit:

r27925:f6d73c87 stable
r29411:e1778b9c default
Show More
hg.1.txt
119 lines | 3.1 KiB | text/plain | TextLexer
====
hg
====
---------------------------------------
Mercurial source code management system
---------------------------------------
:Author: Matt Mackall <mpm@selenic.com>
:Organization: Mercurial
:Manual section: 1
:Manual group: Mercurial Manual
.. contents::
:backlinks: top
:class: htmlonly
:depth: 1
Synopsis
""""""""
**hg** *command* [*option*]... [*argument*]...
Description
"""""""""""
The **hg** command provides a command line interface to the Mercurial
system.
Command Elements
""""""""""""""""
files...
indicates one or more filename or relative path filenames; see
`File Name Patterns`_ for information on pattern matching
path
indicates a path on the local machine
revision
indicates a changeset which can be specified as a changeset
revision number, a tag, or a unique substring of the changeset
hash value
repository path
either the pathname of a local repository or the URI of a remote
repository.
.. include:: hg.1.gendoc.txt
Files
"""""
``/etc/mercurial/hgrc``, ``$HOME/.hgrc``, ``.hg/hgrc``
This file contains defaults and configuration. Values in
``.hg/hgrc`` override those in ``$HOME/.hgrc``, and these override
settings made in the global ``/etc/mercurial/hgrc`` configuration.
See |hgrc(5)|_ for details of the contents and format of these
files.
``.hgignore``
This file contains regular expressions (one per line) that
describe file names that should be ignored by **hg**. For details,
see |hgignore(5)|_.
``.hgsub``
This file defines the locations of all subrepositories, and
tells where the subrepository checkouts came from. For details, see
:hg:`help subrepos`.
``.hgsubstate``
This file is where Mercurial stores all nested repository states. *NB: This
file should not be edited manually.*
``.hgtags``
This file contains changeset hash values and text tag names (one
of each separated by spaces) that correspond to tagged versions of
the repository contents. The file content is encoded using UTF-8.
``.hg/last-message.txt``
This file is used by :hg:`commit` to store a backup of the commit message
in case the commit fails.
``.hg/localtags``
This file can be used to define local tags which are not shared among
repositories. The file format is the same as for ``.hgtags``, but it is
encoded using the local system encoding.
Some commands (e.g. revert) produce backup files ending in ``.orig``,
if the ``.orig`` file already exists and is not tracked by Mercurial,
it will be overwritten.
Bugs
""""
Probably lots, please post them to the mailing list (see Resources_
below) when you find them.
See Also
""""""""
|hgignore(5)|_, |hgrc(5)|_
Author
""""""
Written by Matt Mackall <mpm@selenic.com>
Resources
"""""""""
Main Web Site: https://mercurial-scm.org/
Source code repository: http://selenic.com/hg
Mailing list: http://selenic.com/mailman/listinfo/mercurial
Copying
"""""""
Copyright (C) 2005-2016 Matt Mackall.
Free use of this software is granted under the terms of the GNU General
Public License version 2 or any later version.
.. include:: common.txt