sslutil: print a warning when using TLS 1.0 on legacy Python
Mercurial now requires TLS 1.1+ when TLS 1.1+ is supported by the
client. Since we made the decision to require TLS 1.1+ when running
with modern Python versions, it makes sense to do something for
legacy Python versions that only support TLS 1.0.
Feature parity would be to prevent TLS 1.0 connections out of the
box and require a config option to enable them. However, this is
extremely user hostile since Mercurial wouldn't talk to https://
by default in these installations! I can easily see how someone
would do something foolish like use "--insecure" instead - and
that would be worse than allowing TLS 1.0!
This patch takes the compromise position of printing a warning when
performing TLS 1.0 connections when running on old Python
versions. While this warning is no more annoying than the
CA certificate / fingerprint warnings in Mercurial 3.8, we provide
a config option to disable the warning because to many people
upgrading Python to make the warning go away is not an available
recourse (unlike pinning fingerprints is for the CA warning).
The warning appears as optional output in a lot of tests.
Test if logtoprocess correctly captures command-related log calls.
$ hg init
$ cat > $TESTTMP/foocommand.py << EOF
> from mercurial import cmdutil
> from time import sleep
> cmdtable = {}
> command = cmdutil.command(cmdtable)
> @command('foo', [])
> def foo(ui, repo):
> ui.log('foo', 'a message: %(bar)s\n', bar='spam')
> EOF
$ cat >> $HGRCPATH << EOF
> [extensions]
> logtoprocess=
> foocommand=$TESTTMP/foocommand.py
> [logtoprocess]
> command=echo 'logtoprocess command output:';
> echo "\$EVENT";
> echo "\$MSG1";
> echo "\$MSG2"
> commandfinish=echo 'logtoprocess commandfinish output:';
> echo "\$EVENT";
> echo "\$MSG1";
> echo "\$MSG2";
> echo "\$MSG3"
> foo=echo 'logtoprocess foo output:';
> echo "\$EVENT";
> echo "\$MSG1";
> echo "\$OPT_BAR"
> EOF
Running a command triggers both a ui.log('command') and a
ui.log('commandfinish') call. The foo command also uses ui.log.
Use head to ensure we wait for all lines to be produced, and sort to avoid
ordering issues between the various processes we spawn:
$ hg foo | head -n 17 | sort
0
a message: spam
command
commandfinish
foo
foo
foo
foo
foo exited 0 after * seconds (glob)
logtoprocess command output:
logtoprocess commandfinish output:
logtoprocess foo output:
spam