##// END OF EJS Templates
sslutil: per-host config option to define certificates...
sslutil: per-host config option to define certificates Recent work has introduced the [hostsecurity] config section for defining per-host security settings. This patch builds on top of this foundation and implements the ability to define a per-host path to a file containing certificates used for verifying the server certificate. It is logically a per-host web.cacerts setting. This patch also introduces a warning when both per-host certificates and fingerprints are defined. These are mutually exclusive for host verification and I think the user should be alerted when security settings are ambiguous because, well, security is important. Tests validating the new behavior have been added. I decided against putting "ca" in the option name because a non-CA certificate can be specified and used to validate the server certificate (commonly this will be the exact public certificate used by the server). It's worth noting that the underlying Python API used is load_verify_locations(cafile=X) and it calls into OpenSSL's SSL_CTX_load_verify_locations(). Even OpenSSL's documentation seems to omit that the file can contain a non-CA certificate if it matches the server's certificate exactly. I thought a CA certificate was a special kind of x509 certificate. Perhaps I'm wrong and any x509 certificate can be used as a CA certificate [as far as OpenSSL is concerned]. In any case, I thought it best to drop "ca" from the name because this reflects reality.

File last commit:

r28523:045fe704 default
r29334:ecc9b788 default
Show More
requirements.txt
110 lines | 3.4 KiB | text/plain | TextLexer
Requirements
============
Repositories contain a file (``.hg/requires``) containing a list of
features/capabilities that are *required* for clients to interface
with the repository. This file has been present in Mercurial since
version 0.9.2 (released December 2006).
One of the first things clients do when opening a repository is read
``.hg/requires`` and verify that all listed requirements are supported,
aborting if not. Requirements are therefore a strong mechanism to
prevent incompatible clients from reading from unknown repository
formats or even corrupting them by writing to them.
Extensions may add requirements. When they do this, clients not running
an extension will be unable to read from repositories.
The following sections describe the requirements defined by the
Mercurial core distribution.
revlogv1
--------
When present, revlogs are version 1 (RevlogNG). RevlogNG was introduced
in 2006. The ``revlogv1`` requirement has been enabled by default
since the ``requires`` file was introduced in Mercurial 0.9.2.
If this requirement is not present, version 0 revlogs are assumed.
store
-----
The *store* repository layout should be used.
This requirement has been enabled by default since the ``requires`` file
was introduced in Mercurial 0.9.2.
fncache
-------
The *fncache* repository layout should be used.
The *fncache* layout hash encodes filenames with long paths and
encodes reserved filenames.
This requirement is enabled by default when the *store* requirement is
enabled (which is the default behavior). It was introduced in Mercurial
1.1 (released December 2008).
shared
------
Denotes that the store for a repository is shared from another location
(defined by the ``.hg/sharedpath`` file).
This requirement is set when a repository is created via :hg:`share`.
The requirement was added in Mercurial 1.3 (released July 2009).
dotencode
---------
The *dotencode* repository layout should be used.
The *dotencode* layout encodes the first period or space in filenames
to prevent issues on OS X and Windows.
This requirement is enabled by default when the *store* requirement
is enabled (which is the default behavior). It was introduced in
Mercurial 1.7 (released November 2010).
parentdelta
-----------
Denotes a revlog delta encoding format that was experimental and
replaced by *generaldelta*. It should not be seen in the wild because
it was never enabled by default.
This requirement was added in Mercurial 1.7 and removed in Mercurial
1.9.
generaldelta
------------
Revlogs should be created with the *generaldelta* flag enabled. The
generaldelta flag will cause deltas to be encoded against a parent
revision instead of the previous revision in the revlog.
Support for this requirement was added in Mercurial 1.9 (released
July 2011). The requirement was disabled on new repositories by
default until Mercurial 3.7 (released February 2016).
manifestv2
----------
Denotes that version 2 of manifests are being used.
Support for this requirement was added in Mercurial 3.4 (released
May 2015). The requirement is currently experimental and is disabled
by default.
treemanifest
------------
Denotes that tree manifests are being used. Tree manifests are
one manifest per directory (as opposed to a single flat manifest).
Support for this requirement was added in Mercurial 3.4 (released
August 2015). The requirement is currently experimental and is
disabled by default.