Mercurial > public > mercurial-scm > hg-stable
comparison mercurial/sslutil.py @ 29292:bc5f55493397
sslutil: make cert fingerprints messages more actionable
The previous warning and abort messages were difficult to understand.
This patch makes them slightly better.
I think there is still room to tweak the messaging. And as we adopt
new security defaults, these messages will certainly change again.
But at least this takes us a step in the right direction.
References to "section" have been removed because if no fingerprint
is defined, "section" can never be "hostfingerprints." So just print
"hostsecurity" every time.
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Tue, 31 May 2016 19:21:08 -0700 |
parents | 15e533b7909c |
children | 1b3a0b0c414f |
comparison
equal
deleted
inserted
replaced
29291:15e533b7909c | 29292:bc5f55493397 |
---|---|
395 raise error.Abort(_('certificate for %s has unexpected ' | 395 raise error.Abort(_('certificate for %s has unexpected ' |
396 'fingerprint %s') % (host, legacyfingerprint), | 396 'fingerprint %s') % (host, legacyfingerprint), |
397 hint=_('check %s configuration') % section) | 397 hint=_('check %s configuration') % section) |
398 | 398 |
399 if not sock._hgstate['caloaded']: | 399 if not sock._hgstate['caloaded']: |
400 ui.warn(_('warning: %s certificate with fingerprint %s ' | 400 ui.warn(_('warning: certificate for %s not verified ' |
401 'not verified (check %s or web.cacerts config ' | 401 '(set hostsecurity.%s:certfingerprints=%s or web.cacerts ' |
402 'setting)\n') % | 402 'config settings)\n') % (host, host, nicefingerprint)) |
403 (host, nicefingerprint, section)) | |
404 return | 403 return |
405 | 404 |
406 msg = _verifycert(peercert2, host) | 405 msg = _verifycert(peercert2, host) |
407 if msg: | 406 if msg: |
408 raise error.Abort(_('%s certificate error: %s') % (host, msg), | 407 raise error.Abort(_('%s certificate error: %s') % (host, msg), |
409 hint=_('configure %s %s or use ' | 408 hint=_('set hostsecurity.%s:certfingerprints=%s ' |
410 '--insecure to connect insecurely') % | 409 'config setting or use --insecure to connect ' |
411 (section, nicefingerprint)) | 410 'insecurely') % |
411 (host, nicefingerprint)) |