comparison mercurial/sslutil.py @ 24291:760a86865f80

ssl: load CA certificates from system's store by default on Python 2.7.9

This will make it easy to manage in-house CA certificates, which are often
used in corporate environment and installed into the Windows' certs store.

Unlike Apple python, the dummycert trick isn't necessary on Python 2.7.9.
The default web.cacerts will be set as follows:

  environment    web.cacerts  behavior
  -------------  -----------  -----------------------------------------
  Apple Python   dummycert    fall back to system's store
  Python 2.7.8   '!'          never use CA certs (show warning instead)
  Python 2.7.9+  None         load CA certs from system's store

24290:b76d8c641746

# GNU General Public License version 2 or any later version.
import os, sys

from mercurial import util
from mercurial.i18n import _
try:
    # avoid using deprecated/broken FakeSocket in python 2.6
    import ssl
    CERT_REQUIRED = ssl.CERT_REQUIRED
    try:
        ssl_context = ssl.SSLContext

        def ssl_wrap_socket(sock, keyfile, certfile, cert_reqs=ssl.CERT_NONE,
                            ca_certs=None, serverhostname=None):
            # Allow any version of SSL starting with TLSv1 and
            # up. Note that specifying TLSv1 here prohibits use of

            if certfile is not None:
                sslcontext.load_cert_chain(certfile, keyfile)
            sslcontext.verify_mode = cert_reqs
            if ca_certs is not None:
                sslcontext.load_verify_locations(cafile=ca_certs)

            sslsocket = sslcontext.wrap_socket(sock,
                                               server_hostname=serverhostname)
            # check if wrap_socket failed silently because socket had been
            # closed

    exe = (sys.executable or '').lower()
    return (exe.startswith('/usr/bin/python') or
            exe.startswith('/system/library/frameworks/python.framework/'))

def _defaultcacerts():
    if _plainapplepython():
        dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem')
        if os.path.exists(dummycert):
            return dummycert
    return '!'

def sslkwargs(ui, host):
    kws = {}
    hostfingerprint = ui.config('hostfingerprints', host)

24291:760a86865f80

# GNU General Public License version 2 or any later version.
import os, sys

from mercurial import util
from mercurial.i18n import _

_canloaddefaultcerts = False
try:
    # avoid using deprecated/broken FakeSocket in python 2.6
    import ssl
    CERT_REQUIRED = ssl.CERT_REQUIRED
    try:
        ssl_context = ssl.SSLContext
        _canloaddefaultcerts = util.safehasattr(ssl_context,
                                                'load_default_certs')

        def ssl_wrap_socket(sock, keyfile, certfile, cert_reqs=ssl.CERT_NONE,
                            ca_certs=None, serverhostname=None):
            # Allow any version of SSL starting with TLSv1 and
            # up. Note that specifying TLSv1 here prohibits use of

            if certfile is not None:
                sslcontext.load_cert_chain(certfile, keyfile)
            sslcontext.verify_mode = cert_reqs
            if ca_certs is not None:
                sslcontext.load_verify_locations(cafile=ca_certs)
            elif _canloaddefaultcerts:
                sslcontext.load_default_certs()

            sslsocket = sslcontext.wrap_socket(sock,
                                               server_hostname=serverhostname)
            # check if wrap_socket failed silently because socket had been
            # closed

    exe = (sys.executable or '').lower()
    return (exe.startswith('/usr/bin/python') or
            exe.startswith('/system/library/frameworks/python.framework/'))

def _defaultcacerts():
    """return path to CA certificates; None for system's store; ! to disable"""
    if _plainapplepython():
        dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem')
        if os.path.exists(dummycert):
            return dummycert
    if _canloaddefaultcerts:
        return None
    return '!'

def sslkwargs(ui, host):
    kws = {}
    hostfingerprint = ui.config('hostfingerprints', host)