view mercurial/dummycert.pem @ 48191:67d14d4e036c

exewrapper: find the proper python3X.dll in the registry

Previously, we relied on the default library lookup[1], which for us is
essentially to look on `PATH`.  That has issues- the Python installations are
not necessarily on `PATH`, so I started copying the DLLs locally in 2960b7fac966
and ed286d150aa8 during the build to work around that.  However, it's been
discovered that causes `python3.dll` and `python3X.dll` to get slipped into the
wheel that gets distributed on PyPI.  Additionally, Mercurial would fail to run
in a venv if the Python environment that created it isn't on `PATH`, because
venv creation doesn't copy the DLLs locally.

The logic here is inspired by the `py.exe` launcher[2], though this is simpler
because we don't care about the architecture- if this is a 32 bit process
running on Win64, the registry reflection will redirect to where the 32 bit
Python process wrote its keys.  A nice unintended side effect is to also make
venvs that don't have their root Python on `PATH` work without all of the code
required to read `pyvenv.cfg`[3].  I don't see any reasonable way to create a
venv without Python being installed (other than maybe building Python from
source?), so punt on trying to read that file for now and save a bunch of string
manipulation code.

I somehow managed to corrupt my Windows user profile, and that makes the
Microsoft Store python not run (even loading the DLL gives an access error), so
I'm giving priority to both global and user specific python.org installations.

Loading python3.dll is new, but when I went down the rabbit hole of implementing
`pyvenv.cfg` support, I saw a comment[4] that led me to think we could have
trouble if we don't.  The comment in ed286d150aa8 confirms this, so we should
probably bail out completely if Python3 can't be loaded from the registry,
rather than getting something random on `PATH`.  But I'll leave that for the
default branch.

[1] https://docs.microsoft.com/en-us/windows/win32/Dlls/dynamic-link-library-search-order#standard-search-order-for-desktop-applications
[2] https://github.com/python/cpython/blob/adcd2205565f91c6719f4141ab4e1da6d7086126/PC/launcher.c#L249
[3] https://github.com/python/cpython/blob/bb3e0c240bc60fe08d332ff5955d54197f79751c/PC/getpathp.c#L707
[4] https://github.com/python/cpython/blob/bb3e0c240bc60fe08d332ff5955d54197f79751c/PC/getpathp.c#L1098

Differential Revision: https://phab.mercurial-scm.org/D11454

A dummy certificate that will make OS X 10.6+ Python use the system CA
certificate store:

-----BEGIN CERTIFICATE-----
MIIBIzCBzgIJANjmj39sb3FmMA0GCSqGSIb3DQEBBQUAMBkxFzAVBgNVBAMTDmhn
LmV4YW1wbGUuY29tMB4XDTE0MDgzMDA4NDU1OVoXDTE0MDgyOTA4NDU1OVowGTEX
MBUGA1UEAxMOaGcuZXhhbXBsZS5jb20wXDANBgkqhkiG9w0BAQEFAANLADBIAkEA
mh/ZySGlcq0ALNLmA1gZqt61HruywPrRk6WyrLJRgt+X7OP9FFlEfl2tzHfzqvmK
CtSQoPINWOdAJMekBYFgKQIDAQABMA0GCSqGSIb3DQEBBQUAA0EAF9h49LkSqJ6a
IlpogZuUHtihXeKZBsiktVIDlDccYsNy0RSh9XxUfhk+XMLw8jBlYvcltSXdJ7We
aKdQRekuMQ==
-----END CERTIFICATE-----

This certificate was generated to be syntactically valid but never be usable;
it expired before it became valid.

Created as:

  $ cat > cn.conf << EOT
  > [req]
  > distinguished_name = req_distinguished_name
  > [req_distinguished_name]
  > commonName = Common Name
  > commonName_default = no.example.com
  > EOT
  $ openssl req -nodes -new -x509 -keyout /dev/null \
  >   -out dummycert.pem -days -1 -config cn.conf -subj '/CN=hg.example.com'

To verify the content of this certificate:

  $ openssl x509 -in dummycert.pem -noout -text
  Certificate:
      Data:
          Version: 1 (0x0)
          Serial Number: 15629337334278746470 (0xd8e68f7f6c6f7166)
      Signature Algorithm: sha1WithRSAEncryption
          Issuer: CN=hg.example.com
          Validity
              Not Before: Aug 30 08:45:59 2014 GMT
              Not After : Aug 29 08:45:59 2014 GMT
          Subject: CN=hg.example.com
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
                  Public-Key: (512 bit)
                  Modulus:
                      00:9a:1f:d9:c9:21:a5:72:ad:00:2c:d2:e6:03:58:
                      19:aa:de:b5:1e:bb:b2:c0:fa:d1:93:a5:b2:ac:b2:
                      51:82:df:97:ec:e3:fd:14:59:44:7e:5d:ad:cc:77:
                      f3:aa:f9:8a:0a:d4:90:a0:f2:0d:58:e7:40:24:c7:
                      a4:05:81:60:29
                  Exponent: 65537 (0x10001)
      Signature Algorithm: sha1WithRSAEncryption
           17:d8:78:f4:b9:12:a8:9e:9a:22:5a:68:81:9b:94:1e:d8:a1:
           5d:e2:99:06:c8:a4:b5:52:03:94:37:1c:62:c3:72:d1:14:a1:
           f5:7c:54:7e:19:3e:5c:c2:f0:f2:30:65:62:f7:25:b5:25:dd:
           27:b5:9e:68:a7:50:45:e9:2e:31