Mercurial > hg
view tests/sslcerts/README @ 40417:49c7b701fdc2 stable
phase: add an archived phase
This phase allows for hidden changesets in the "user space". It differs from
the "internal" phase which is intended for internal by-product only. There
have been discussions at the 4.8 sprint to use such phase to speedup cleanup
after history rewriting operation.
Shipping it in the same release as the 'internal-phase' groups the associated
`requires` entry. The important bit is to have support for this phase in the
earliest version of mercurial possible. Adding the UI to manipulate this new
phase later seems fine.
The current plan for archived usage and user interface are as follow. On a
repository with internal-phase on and evolution off:
* history rewriting command set rewritten changeset in the archived phase.
(This mean updating the cleanupnodes method).
* keep `hg unbundle .hg/strip-backup/X.hg` as a way to restore changeset for
now
(backup bundle need to contains phase data)
* [maybe] add a `hg strip --soft` advance flag
(a light way to expose the feature without getting in the way of a better
UI)
Mercurial 4.8 freeze is too close to get the above in by then.
We don't introduce a new repository `requirement` as we reuse the one
introduced with the 'archived' phase during the 4.8 cycle.
author | Boris Feld <boris.feld@octobus.net> |
---|---|
date | Wed, 17 Oct 2018 14:47:01 +0200 |
parents | 43f3c0df2fab |
children |
line wrap: on
line source
Generate a private key (priv.pem): $ openssl genrsa -out priv.pem 2048 Generate 2 self-signed certificates from this key (pub.pem, pub-other.pem): $ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \ -out pub.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/' $ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 9000 \ -out pub-other.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/' Now generate an expired certificate by turning back the system time: $ faketime 2016-01-01T00:00:00Z \ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \ -out pub-expired.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/' Generate a certificate not yet active by advancing the system time: $ faketime 2030-01-1T00:00:00Z \ openssl req -new -x509 -key priv.pem -nodes -sha256 -days 1 \ -out pub-not-yet.pem -batch -subj '/CN=localhost/emailAddress=hg@localhost/' Generate a passphrase protected client certificate private key: $ openssl genrsa -aes256 -passout pass:1234 -out client-key.pem 2048 Create a copy of the private key without a passphrase: $ openssl rsa -in client-key.pem -passin pass:1234 -out client-key-decrypted.pem Create a CSR and sign the key using the server keypair: $ printf '.\n.\n.\n.\n.\n.\nhg-client@localhost\n.\n.\n' | \ openssl req -new -key client-key.pem -passin pass:1234 -out client-csr.pem $ openssl x509 -req -days 9000 -in client-csr.pem -CA pub.pem -CAkey priv.pem \ -set_serial 01 -out client-cert.pem When replacing the certificates, references to certificate fingerprints will need to be updated in test files. Fingerprints for certs can be obtained by running: $ openssl x509 -in pub.pem -noout -sha1 -fingerprint $ openssl x509 -in pub.pem -noout -sha256 -fingerprint