annotate tests/sslcerts/README @ 49777:e1953a34c110

bundle: emit full snapshot as is, without doing a redelta

With the new `forced` delta-reused policy, it become important to be able to
send full snapshot where full snapshot are needed. Otherwise, the fallback delta
will simply be used on the client side… creating monstrous delta chain, since
revision that are meant as a reset of delta-chain chain becoming too complex are
simply adding a new full delta-tree on the leaf of another one.

In the `non-forced` cases, client process full snapshot from the bundle
differently from deltas, so client will still try to convert the full snapshot
into a delta if possible. So this will no lead to pathological storage
explosion.

I have considered making this configurable, but the impact seems limited enough
that it does not seems to be worth it. Especially with the current
sparse-revlog format that use "delta-tree" with multiple level snapshots, full
snapshot are much less frequent and not that different from other intermediate
snapshot that we are already sending over the wire anyway.

CPU wise, this will help the bundling side a little as it will not need to
reconstruct revisions and compute deltas. The unbundling side might save a tiny
amount of CPU as it won't need to reconstruct the delta-base to reconstruct the
revision full text. This only slightly visible in some of the benchmarks. And
have no real impact on most of them.

### data-env-vars.name      = pypy-2018-08-01-zstd-sparse-revlog
  # benchmark.name          = perf-bundle
  # benchmark.variants.revs = last-40000
before:          11.467186 seconds
just-emit-full:  11.190576 seconds   (-2.41%)
with-pull-force: 11.041091 seconds   (-3.72%)
  # benchmark.name          = perf-unbundle
  # benchmark.variants.revs = last-40000
before:     16.744862
just-emit-full:: 16.561036 seconds   (-1.10%)
with-pull-force: 16.389344 seconds   (-2.12%)
  # benchmark.name          = pull
  # benchmark.variants.revs = last-40000
before:     26.870569
just-emit-full:  26.391188 seconds   (-1.78%)
with-pull-force: 25.633184 seconds   (-4.60%)


Space wise (so network-wise) the impact is fairly small. When taking compression into
account.

Below are tests the size of `hg bundle --all` for a handful of benchmark repositories
(with bzip, zstd compression and without it)

This show a small increase in the bundle size, but nothing really significant
except maybe for mozilla-try (+12%) that nobody really pulls large chunk of anyway.
Mozilla-try is also the repository that benefit the most for not having to
recompute deltas client size.

### mercurial:
bzip-before:     26 406 342 bytes
bzip-after:      26 691 543 bytes  +1.08%

zstd-before:     27 918 645 bytes
zstd-after:      28 075 896 bytes  +0.56%

none-before:     98 675 601 bytes
none-after:     100 411 237 bytes  +1.76%


### pypy
bzip-before:    201 295 752 bytes
bzip-after:     209 780 282 bytes  +4.21%

zstd-before:    202 974 795 bytes
zstd-after:     205 165 780 bytes  +1.08%

none-before:    871 070 261 bytes
none-after:     993 595 057 bytes +14.07%


### netbeans
bzip-before:    601 314 330 bytes
bzip-after:     614 246 241 bytes  +2.15%

zstd-before:    604 745 136 bytes
zstd-after:     615 497 705 bytes  +1.78%

none-before:  3 338 238 571 bytes
none-after:   3 439 422 535 bytes  +3.03%


### mozilla-central
bzip-before:  1 493 006 921 bytes
bzip-after:   1 549 650 570 bytes  +3.79%

zstd-before:  1 481 910 102 bytes
zstd-after:   1 513 052 415 bytes  +2.10%

none-before:  6 535 929 910 bytes
none-after:   7 010 191 342 bytes  +7.26%


### mozilla-try
bzip-before:  6 583 425 999 bytes
bzip-after:   7 423 536 928 bytes +12.76%

zstd-before:  6 021 009 212 bytes
zstd-after:   6 674 922 420 bytes +10.86%

none-before: 22 954 739 558 bytes
none-after:  26 013 854 771 bytes +13.32%

Generate a private key (priv.pem):

  $ openssl genrsa -out priv.pem 2048

Generate 2 self-signed certificates from this key (pub.pem, pub-other.pem):

  $ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
    -out pub.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'
  $ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
    -out pub-other.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Now generate an expired certificate by turning back the system time:

  $ faketime 2016-01-01T00:00:00Z \
    openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
    -out pub-expired.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a certificate not yet active by advancing the system time:

  $ faketime 2030-01-1T00:00:00Z \
    openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
    -out pub-not-yet.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a passphrase protected client certificate private key:

  $ openssl genrsa -aes256 -passout pass:1234 -out client-key.pem 2048

Create a copy of the private key without a passphrase:

  $ openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem

Create a CSR and sign the key using the server keypair:

  $ printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \
    openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem
  $ openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \
    -set_serial 01 -out client-cert.pem

When replacing the certificates, references to certificate fingerprints will
need to be updated in test files.

Fingerprints for certs can be obtained by running:

  $ openssl x509 -in pub.pem -noout -sha1 -fingerprint
  $ openssl x509 -in pub.pem -noout -sha256 -fingerprint