view tests/test-hgk.t @ 29258:6315c1e14f75

sslutil: introduce a function for determining host-specific settings

This patch marks the beginning of a series that introduces a new,
more configurable, per-host security settings mechanism. Currently,
we have global settings (like web.cacerts and the --insecure argument).
We also have per-host settings via [hostfingerprints].

Global security settings are good for defaults, but they don't
provide the amount of control often wanted. For example, an
organization may want to require a particular CA is used for a
particular hostname.

[hostfingerprints] is nice. But it currently assumes SHA-1.
Furthermore, there is no obvious place to put additional per-host
settings.

Subsequent patches will be introducing new mechanisms for defining
security settings, some on a per-host basis. This commits starts
the transition to that world by introducing the _hostsettings
function. It takes a ui and hostname and returns a dict of security
settings. Currently, it limits itself to returning host fingerprint
info.

We foreshadow the future support of non-SHA1 hashing algorithms
for verifying the host fingerprint by making the "certfingerprints"
key a list of tuples instead of a list of hashes.

We add this dict to the hgstate property on the socket and use it
during socket validation for checking fingerprints. There should be
no change in behavior.

Minimal hgk check

  $ echo "[extensions]" >> $HGRCPATH
  $ echo "hgk=" >> $HGRCPATH
  $ hg init repo
  $ cd repo
  $ echo a > a
  $ hg ci -Am adda
  adding a
  $ hg debug-cat-file commit 0
  tree a0c8bcbbb45c
  parent 000000000000
  author test 0 0
  revision 0
  branch default
  phase draft
  
  adda
  $ echo b > b
  $ hg ci -Am addb
  adding b
  $ hg log -T '{node}\n'
  102a90ea7b4a3361e4082ed620918c261189a36a
  07f4944404050f47db2e5c5071e0e84e7a27bba9

  $ hg debug-diff-tree 07f494440405 102a90ea7b4a
  :000000 100664 000000000000 1e88685f5dde N	b	b
  $ hg debug-diff-tree 07f494440405 102a90ea7b4a --patch
  diff --git a/b b/b
  new file mode 100644
  --- /dev/null
  +++ b/b
  @@ -0,0 +1,1 @@
  +b

Ensure that diff-tree output isn't affected by diffopts
  $ hg --config diff.noprefix=True debug-diff-tree 07f494440405 102a90ea7b4a
  :000000 100664 000000000000 1e88685f5dde N	b	b
  $ hg --config diff.noprefix=True debug-diff-tree --patch 07f494440405 102a90ea7b4a
  diff --git a/b b/b
  new file mode 100644
  --- /dev/null
  +++ b/b
  @@ -0,0 +1,1 @@
  +b

  $ cd ..