Mercurial > hg
annotate README @ 29334:ecc9b788fd69
sslutil: per-host config option to define certificates
Recent work has introduced the [hostsecurity] config section for
defining per-host security settings. This patch builds on top
of this foundation and implements the ability to define a per-host
path to a file containing certificates used for verifying the server
certificate. It is logically a per-host web.cacerts setting.
This patch also introduces a warning when both per-host
certificates and fingerprints are defined. These are mutually
exclusive for host verification and I think the user should be
alerted when security settings are ambiguous because, well,
security is important.
Tests validating the new behavior have been added.
I decided against putting "ca" in the option name because a
non-CA certificate can be specified and used to validate the server
certificate (commonly this will be the exact public certificate
used by the server). It's worth noting that the underlying
Python API used is load_verify_locations(cafile=X) and it calls
into OpenSSL's SSL_CTX_load_verify_locations(). Even OpenSSL's
documentation seems to omit that the file can contain a non-CA
certificate if it matches the server's certificate exactly. I
thought a CA certificate was a special kind of x509 certificate.
Perhaps I'm wrong and any x509 certificate can be used as a
CA certificate [as far as OpenSSL is concerned]. In any case,
I thought it best to drop "ca" from the name because this reflects
reality.
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Tue, 07 Jun 2016 20:29:54 -0700 |
parents | 4b0fc75f9403 |
children | 76b171209151 |
rev | line source |
---|---|
12857
a9f91c844a3b
README: add small introduction
Martin Geisler <mg@lazybytes.net>
parents:
12856
diff
changeset
|
1 Mercurial |
a9f91c844a3b
README: add small introduction
Martin Geisler <mg@lazybytes.net>
parents:
12856
diff
changeset
|
2 ========= |
a9f91c844a3b
README: add small introduction
Martin Geisler <mg@lazybytes.net>
parents:
12856
diff
changeset
|
3 |
a9f91c844a3b
README: add small introduction
Martin Geisler <mg@lazybytes.net>
parents:
12856
diff
changeset
|
4 Mercurial is a fast, easy to use, distributed revision control tool |
a9f91c844a3b
README: add small introduction
Martin Geisler <mg@lazybytes.net>
parents:
12856
diff
changeset
|
5 for software developers. |
a9f91c844a3b
README: add small introduction
Martin Geisler <mg@lazybytes.net>
parents:
12856
diff
changeset
|
6 |
3935 | 7 Basic install: |
0
9117c6561b0b
Add back links from file revisions to changeset revisions
mpm@selenic.com
parents:
diff
changeset
|
8 |
3935 | 9 $ make # see install targets |
10 $ make install # do a system-wide install | |
11 $ hg debuginstall # sanity-check setup | |
12 $ hg # see help | |
205
d255d99a7cbd
README: integrate some changes from Kevin Smith
mpm@selenic.com
parents:
204
diff
changeset
|
13 |
16217
df5ecb813426
readme: mention how to run in-place
Ross Lagerwall <rosslagerwall@gmail.com>
parents:
12857
diff
changeset
|
14 Running without installing: |
df5ecb813426
readme: mention how to run in-place
Ross Lagerwall <rosslagerwall@gmail.com>
parents:
12857
diff
changeset
|
15 |
df5ecb813426
readme: mention how to run in-place
Ross Lagerwall <rosslagerwall@gmail.com>
parents:
12857
diff
changeset
|
16 $ make local # build for inplace usage |
df5ecb813426
readme: mention how to run in-place
Ross Lagerwall <rosslagerwall@gmail.com>
parents:
12857
diff
changeset
|
17 $ ./hg --version # should show the latest version |
df5ecb813426
readme: mention how to run in-place
Ross Lagerwall <rosslagerwall@gmail.com>
parents:
12857
diff
changeset
|
18 |
26421
4b0fc75f9403
urls: bulk-change primary website URLs
Matt Mackall <mpm@selenic.com>
parents:
16217
diff
changeset
|
19 See https://mercurial-scm.org/ for detailed installation |
3935 | 20 instructions, platform-specific notes, and Mercurial user information. |