Mercurial > hg
diff mercurial/sslutil.py @ 29106:fe7ebef8796a
sslutil: further refactor sslkwargs
The logic here and what happens with web.cacerts is mind numbing.
Make the code even more explicit.
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Wed, 04 May 2016 23:01:49 -0700 |
parents | 548e9c8c2841 |
children | c8fbfb9163ce |
line wrap: on
line diff
--- a/mercurial/sslutil.py Thu May 05 00:31:11 2016 -0700 +++ b/mercurial/sslutil.py Wed May 04 23:01:49 2016 -0700 @@ -249,17 +249,22 @@ if cacerts == '!': return kws + # If a value is set in the config, validate against a path and load + # and require those certs. if cacerts: cacerts = util.expandpath(cacerts) if not os.path.exists(cacerts): raise error.Abort(_('could not find web.cacerts: %s') % cacerts) - else: - # CA certs aren't explicitly listed in the config. See if we can load - # defaults. - cacerts = _defaultcacerts() - if cacerts and cacerts != '!': - ui.debug('using %s to enable OS X system CA\n' % cacerts) - ui.setconfig('web', 'cacerts', cacerts, 'defaultcacerts') + + kws.update({'ca_certs': cacerts, + 'cert_reqs': ssl.CERT_REQUIRED}) + return kws + + # No CAs in config. See if we can load defaults. + cacerts = _defaultcacerts() + if cacerts and cacerts != '!': + ui.debug('using %s to enable OS X system CA\n' % cacerts) + ui.setconfig('web', 'cacerts', cacerts, 'defaultcacerts') if cacerts != '!': kws.update({'ca_certs': cacerts,