Anton Shestakov <av6@dwimlabs.net> [Fri, 01 Jul 2016 13:54:35 +0800] rev 29458
hgweb: add absolute urls for archives in json-summary
Anton Shestakov <av6@dwimlabs.net> [Fri, 01 Jul 2016 13:36:59 +0800] rev 29457
tests: allow bz2 archives in test-hgweb-json.t
Only testing a specific type because list items seem to be in arbitrary order.
Pulkit Goyal <7895pulkit@gmail.com> [Fri, 01 Jul 2016 19:17:16 +0530] rev 29456
keepalive: switch from thread to threading module
The thread module in py3 is renamed to _thread, but we can use
the high level threading module instead.
Pulkit Goyal <7895pulkit@gmail.com> [Tue, 28 Jun 2016 16:01:53 +0530] rev 29455
py3: conditionalize httplib import
The httplib library is renamed to http.client in python 3. So the
import is conditionalized and a test is added in check-code to warn
to use util.httplib
Matt Mackall <mpm@selenic.com> [Fri, 01 Jul 2016 15:12:33 -0500] rev 29454
Added signature for changeset 26a5d605b868
Matt Mackall <mpm@selenic.com> [Fri, 01 Jul 2016 15:12:32 -0500] rev 29453
Added tag 3.8.4 for changeset 26a5d605b868
Gregory Szorc <gregory.szorc@gmail.com> [Sun, 26 Jun 2016 19:34:48 -0700] rev 29452
sslutil: synchronize hostname matching logic with CPython
sslutil contains its own hostname matching logic. CPython has code
for the same intent. However, it is only available to Python 2.7.9+
(or distributions that have backported 2.7.9's ssl module
improvements).
This patch effectively imports CPython's hostname matching code
from its ssl.py into sslutil.py. The hostname matching code itself
is pretty similar. However, the DNS name matching code is much more
robust and spec conformant.
As the test changes show, this changes some behavior around
wildcard handling and IDNA matching. The new behavior allows
wildcards in the middle of words (e.g. 'f*.com' matches 'foo.com')
This is spec compliant according to RFC 6125 Section 6.5.3 item 3.
There is one test where the matcher is more strict. Before,
'*.a.com' matched '.a.com'. Now it doesn't match. Strictly speaking
this is a security vulnerability.
Gregory Szorc <gregory.szorc@gmail.com> [Sun, 26 Jun 2016 19:16:54 -0700] rev 29451
tests: import CPython's hostname matching tests
CPython has a more comprehensive test suite for it's built-in hostname
matching functionality. This patch adds its tests so we can improve
our hostname matching functionality.
Many of the tests have different results from CPython. These will be
addressed in a subsequent commit.
Wagner Bruna <wbruna@yahoo.com> [Fri, 01 Jul 2016 07:41:37 -0300] rev 29450
i18n-pt_BR: synchronized with dd9175ca81dc
Gregory Szorc <gregory.szorc@gmail.com> [Wed, 29 Jun 2016 19:43:27 -0700] rev 29449
sslutil: emit warning when no CA certificates loaded
If no CA certificates are loaded, that is almost certainly a/the
reason certificate verification fails when connecting to a server.
The modern ssl module in Python 2.7.9+ provides an API to access
the list of loaded CA certificates. This patch emits a warning
on modern Python when certificate verification fails and there are
no loaded CA certificates.
There is no way to detect the number of loaded CA certificates
unless the modern ssl module is present. Hence the differences
in test output depending on whether modern ssl is available.
It's worth noting that a test which specifies a CA file still
renders this warning. That is because the certificate it is loading
is a x509 client certificate and not a CA certificate. This
test could be updated if anyone is so inclined.
Gregory Szorc <gregory.szorc@gmail.com> [Wed, 29 Jun 2016 19:49:39 -0700] rev 29448
tests: test case where default ca certs not available
I'm not a fan of TLS tests not testing both branches of a possible
configuration. While we have test coverage of the inability to validate
a cert later in this file, I insist that we add this branch so
our testing of security code is extra comprehensive.
Gregory Szorc <gregory.szorc@gmail.com> [Wed, 29 Jun 2016 19:38:24 -0700] rev 29447
sslutil: don't load default certificates when they aren't relevant
Before, we would call SSLContext.load_default_certs() when
certificate verification wasn't being used. Since
SSLContext.verify_mode == ssl.CERT_NONE, this would ideally
no-op. However, there is a slim chance the loading of system
certs could cause a failure. Furthermore, this behavior
interfered with a future patch that aims to provide a more
helpful error message when we're unable to load CAs.
The lack of test fallout is hopefully a sign that our
security code and tests are in a relatively good state.
Gregory Szorc <gregory.szorc@gmail.com> [Wed, 29 Jun 2016 19:37:38 -0700] rev 29446
sslutil: display a better error message when CA file loading fails
Before, sslcontext.load_verify_locations() would raise a
ssl.SSLError which would be caught further up the stack and converted
to a urlerror. By that time, we lost track of what actually errored.
Trapping the error here gives users a slightly more actionable error
message.
The behavior between Python <2.7.9 and Python 2.7.9+ differs. This
is because our fake SSLContext class installed on <2.7.9 doesn't
actually do anything during load_verify_locations: it defers actions
until wrap_socket() time. Unfortunately, a number of errors can occur
at wrap_socket() time and we're unable to ascertain what the root
cause is. But that shouldn't stop us from providing better error
messages to people running a modern and secure Python version.
Gregory Szorc <gregory.szorc@gmail.com> [Wed, 29 Jun 2016 18:15:28 -0700] rev 29445
tests: add test for empty CA certs file
smf reported that an environment with no loaded CA certs resulted
in a weird error. I'd like to detect this a bit better so we can
display an actionable error message.
The actual error being globbed over in this patch is "unknown error"
with a ssl.c line number. That isn't useful at all.
Maciej Fijalkowski <fijall@gmail.com> [Mon, 06 Jun 2016 13:08:13 +0200] rev 29444
internals: move the bitmanipulation routines into its own file
This is to allow more flexibility with the C sources -- now the
bitmanipulation routines can be safely imported without importing Python.h
Martijn Pieters <mjpieters@fb.com> [Fri, 24 Jun 2016 16:12:05 +0100] rev 29443
journal: new experimental extension
Records bookmark locations and shows you where bookmarks were located in the
past.
This is the first in a planned series of locations to be recorded; a future
patch will add working copy (dirstate) tracking, and remote bookmarks will be
supported as well, so the journal storage format should be fairly generic to
support those use-cases.
Augie Fackler <raf@durin42.com> [Mon, 27 Jun 2016 11:53:50 -0400] rev 29442
httpclient: update to 54868ef054d2 of httpplus
As of that revision, httpplus fully supports Python 3, including
mimicing all the subtle behavior changes around headers in Python 3's
http.client.
Yuya Nishihara <yuya@tcha.org> [Mon, 27 Jun 2016 20:44:14 +0900] rev 29441
revset: check invalid function syntax "func-name"() explicitly
Before the error was caught at func() as an unknown identifier, and the
optimizer failed to detect the syntax error. This patch introduces getsymbol()
helper to ensure that a string is not allowed as a function name.
Yuya Nishihara <yuya@tcha.org> [Tue, 28 Jun 2016 22:39:06 +0900] rev 29440
chg: silence warning of unused parameter 'sig'
Anton Shestakov <av6@dwimlabs.net> [Wed, 29 Jun 2016 22:48:32 +0800] rev 29439
hgweb: reindent atom/changelogentry.tmpl
It was mixing tabs and spaces, and not in a good way.
Indent style of other atom entries seems to be 1 space per level, so let's
apply it here as well.
Anton Shestakov <av6@dwimlabs.net> [Wed, 29 Jun 2016 21:07:59 +0800] rev 29438
hgweb: remove unused/nonexistent filelogentry from atom/map
filelog in atom style uses changelogentry to show commits, and
atom/filelogentry.tmpl doesn't even exist.
Anton Shestakov <av6@dwimlabs.net> [Wed, 29 Jun 2016 20:58:09 +0800] rev 29437
hgweb: remove unnecessary CDATA markup in atom/branchentry.tmpl
Since content is of type "text" (and is already escaped), using a CDATA section
is not required.
Looks like this was just an artifact of copying things from rss style in
add2f9ddcfb5, because other entries in atom style don't use CDATA in such
places.
Anton Shestakov <av6@dwimlabs.net> [Wed, 29 Jun 2016 20:19:04 +0800] rev 29436
hgweb: reindent rss/changelogentry.tmpl
It was mixing tabs and spaces, and not in a good way.
Indent style of other rss entries seems to be 4 spaces per level, so let's
apply it here as well.
Anton Shestakov <av6@dwimlabs.net> [Wed, 29 Jun 2016 19:40:04 +0800] rev 29435
hgweb: remove a couple of superfluous spaces in rss style
Pulkit Goyal <7895pulkit@gmail.com> [Mon, 27 Jun 2016 19:10:30 +0530] rev 29434
py3: add tests in check-code to load modules from util.py
The conditionalize imports are added in util.py and now we import modules from
there. So adding tests so that someone in future can use that.
Pulkit Goyal <7895pulkit@gmail.com> [Mon, 27 Jun 2016 16:48:54 +0530] rev 29433
py3: conditionalize SocketServer import
The SocketServer is renamed to socketserver in python 3
Pulkit Goyal <7895pulkit@gmail.com> [Mon, 27 Jun 2016 16:37:37 +0530] rev 29432
py3: conditionalize xmlrpclib import
The xmlrpclib library is renamed to xmlrpc.client in python 3
Pulkit Goyal <7895pulkit@gmail.com> [Mon, 27 Jun 2016 16:16:10 +0530] rev 29431
py3: conditionalize the urlparse import
The urlparse library is renamed to urllib.parse in python 3
Pulkit Goyal <7895pulkit@gmail.com> [Mon, 27 Jun 2016 15:53:38 +0530] rev 29430
py3: update tests/test-check-py3-compat.t
The lower part of the test runs with python 3 and hence remain unchanged.
Jun Wu <quark@fb.com> [Fri, 24 Jun 2016 15:21:10 +0100] rev 29429
chg: send SIGPIPE to server immediately when pager exits (issue5278)
If the user press 'q' to leave the 'less' pager, it is expected to end the
hg process immediately. We currently rely on SIGPIPE for this behavior. But
SIGPIPE won't arrive if we don't write anything (like doing heavy
computation, reading from network etc). If that happens, the user will feel
that the hg process just hangs.
The patch address the issue by adding a SIGCHLD signal handler and sends
SIGPIPE to the server as soon as the pager exits.
This is also an issue with hg's pager implementation.