comparison mercurial/sslutil.py @ 29292:bc5f55493397

sslutil: make cert fingerprints messages more actionable

The previous warning and abort messages were difficult to understand.
This patch makes them slightly better.

I think there is still room to tweak the messaging. And as we adopt
new security defaults, these messages will certainly change again.
But at least this takes us a step in the right direction.

References to "section" have been removed because if no fingerprint
is defined, "section" can never be "hostfingerprints." So just print
"hostsecurity" every time.

29291:15e533b7909c

        raise error.Abort(_('certificate for %s has unexpected '
                            'fingerprint %s') % (host, legacyfingerprint),
                          hint=_('check %s configuration') % section)

    if not sock._hgstate['caloaded']:
        ui.warn(_('warning: %s certificate with fingerprint %s '
                  'not verified (check %s or web.cacerts config '
                  'setting)\n') %
                (host, nicefingerprint, section))
        return

    msg = _verifycert(peercert2, host)
    if msg:
        raise error.Abort(_('%s certificate error: %s') % (host, msg),
                         hint=_('configure %s %s or use '
                                '--insecure to connect insecurely') %
                              (section, nicefingerprint))

29292:bc5f55493397

        raise error.Abort(_('certificate for %s has unexpected '
                            'fingerprint %s') % (host, legacyfingerprint),
                          hint=_('check %s configuration') % section)

    if not sock._hgstate['caloaded']:
        ui.warn(_('warning: certificate for %s not verified '
                  '(set hostsecurity.%s:certfingerprints=%s or web.cacerts '
                  'config settings)\n') % (host, host, nicefingerprint))
        return

    msg = _verifycert(peercert2, host)
    if msg:
        raise error.Abort(_('%s certificate error: %s') % (host, msg),
                         hint=_('set hostsecurity.%s:certfingerprints=%s '
                                'config setting or use --insecure to connect '
                                'insecurely') %
                              (host, nicefingerprint))