view tests/sslcerts/README @ 40417:49c7b701fdc2 stable

phase: add an archived phase

This phase allows for hidden changesets in the "user space". It differs from
the "internal" phase which is intended for internal by-product only. There
have been discussions at the 4.8 sprint to use such phase to speedup cleanup
after history rewriting operation.

Shipping it in the same release as the 'internal-phase' groups the associated
`requires` entry. The important bit is to have support for this phase in the
earliest version of mercurial possible. Adding the UI to manipulate this new
phase later seems fine.

The current plan for archived usage and user interface are as follow. On a
repository with internal-phase on and evolution off:

* history rewriting command set rewritten changeset in the archived phase.
  (This mean updating the cleanupnodes method).
* keep `hg unbundle .hg/strip-backup/X.hg` as a way to restore changeset for
  now
  (backup bundle need to contains phase data)
* [maybe] add a `hg strip --soft` advance flag
  (a light way to expose the feature without getting in the way of a better
  UI)

Mercurial 4.8 freeze is too close to get the above in by then.

We don't introduce a new repository `requirement` as we reuse the one
introduced with the 'archived' phase during the 4.8 cycle.

Generate a private key (priv.pem):

  $ openssl genrsa -out priv.pem 2048

Generate 2 self-signed certificates from this key (pub.pem, pub-other.pem):

  $ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
    -out pub.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'
  $ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \
    -out pub-other.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Now generate an expired certificate by turning back the system time:

  $ faketime 2016-01-01T00:00:00Z \
    openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
    -out pub-expired.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a certificate not yet active by advancing the system time:

  $ faketime 2030-01-1T00:00:00Z \
    openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \
    -out pub-not-yet.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/'

Generate a passphrase protected client certificate private key:

  $ openssl genrsa -aes256 -passout pass:1234 -out client-key.pem 2048

Create a copy of the private key without a passphrase:

  $ openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem

Create a CSR and sign the key using the server keypair:

  $ printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \
    openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem
  $ openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \
    -set_serial 01 -out client-cert.pem

When replacing the certificates, references to certificate fingerprints will
need to be updated in test files.

Fingerprints for certs can be obtained by running:

  $ openssl x509 -in pub.pem -noout -sha1 -fingerprint
  $ openssl x509 -in pub.pem -noout -sha256 -fingerprint