Mercurial > public > mercurial-scm > hg-stable
comparison mercurial/sslutil.py @ 29499:9c5325c79683
sslutil: issue warning when unable to load certificates on OS X
Previously, failure to load system certificates on OS X would lead
to a certificate verify failure and that's it. We now print a warning
message with a URL that will contain information on how to configure
certificates on OS X.
As the inline comment states, there is room to improve here. I think
we could try harder to detect Homebrew and MacPorts installed
certificate files, for example. It's worth noting that Homebrew's
openssl package uses `security find-certificate -a -p` during package
installation to export the system keychain root CAs to
etc/openssl/cert.pem. This is something we could consider adding
to setup.py. We could also encourage packagers to do this. For now,
I'd just like to get this warning (which matches Windows behavior)
landed. We should have time to improve things before release.
| author | Gregory Szorc <gregory.szorc@gmail.com> |
|---|---|
| date | Wed, 06 Jul 2016 20:46:05 -0700 |
| parents | 54ad81b0665f |
| children | 4b16a5bd9948 |
comparison
equal
deleted
inserted
replaced
| 29498:1b38cfde9530 | 29499:9c5325c79683 |
|---|---|
| 466 if _plainapplepython(): | 466 if _plainapplepython(): |
| 467 dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem') | 467 dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem') |
| 468 if os.path.exists(dummycert): | 468 if os.path.exists(dummycert): |
| 469 return dummycert | 469 return dummycert |
| 470 | 470 |
| 471 # The Apple OpenSSL trick isn't available to us. If Python isn't able to | |
| 472 # load system certs, we're out of luck. | |
| 473 if sys.platform == 'darwin': | |
| 474 # FUTURE Consider looking for Homebrew or MacPorts installed certs | |
| 475 # files. Also consider exporting the keychain certs to a file during | |
| 476 # Mercurial install. | |
| 477 if not _canloaddefaultcerts: | |
| 478 ui.warn(_('(unable to load CA certificates; see ' | |
| 479 'https://mercurial-scm.org/wiki/SecureConnections for ' | |
| 480 'how to configure Mercurial to avoid this message)\n')) | |
| 481 return None | |
| 482 | |
| 471 return None | 483 return None |
| 472 | 484 |
| 473 def validatesocket(sock): | 485 def validatesocket(sock): |
| 474 """Validate a socket meets security requiremnets. | 486 """Validate a socket meets security requiremnets. |
| 475 | 487 |