view mercurial/policy.py @ 33493:9a9f95214f46

debug: add a method to check the state of, and built an SSL cert chain

This is only useful on Windows, and avoids the need to use Internet Explorer to
build the certificate chain.  I can see this being extended in the future to
print information about the certificate(s) to help debug issues on any platform.
Maybe even perform some of the python checks listed on the secure connections
wiki page.  But for now, all I need is 1) a command that can be invoked in a
setup script to ensure the certificate is installed, and 2) a command that the
user can run if/when a certificate changes in the future.

It would have been nice to leverage the sslutil library to pick up host specific
settings, but attempting to use sslutil.wrapsocket() failed the
'not sslsocket.cipher()' check in it and aborted.

The output is a little more chatty than some commands, but I've seen the update
take 10+ seconds, and this is only a debug command.

# policy.py - module policy logic for Mercurial.
#
# Copyright 2015 Gregory Szorc <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

from __future__ import absolute_import

import os
import sys

# Rules for how modules can be loaded. Values are:
#
#    c - require C extensions
#    allow - allow pure Python implementation when C loading fails
#    cffi - required cffi versions (implemented within pure module)
#    cffi-allow - allow pure Python implementation if cffi version is missing
#    py - only load pure Python modules
#
# By default, fall back to the pure modules so the in-place build can
# run without recompiling the C extensions. This will be overridden by
# __modulepolicy__ generated by setup.py.
policy = b'allow'
_packageprefs = {
    # policy: (versioned package, pure package)
    b'c': (r'cext', None),
    b'allow': (r'cext', r'pure'),
    b'cffi': (r'cffi', None),
    b'cffi-allow': (r'cffi', r'pure'),
    b'py': (None, r'pure'),
}

try:
    from . import __modulepolicy__
    policy = __modulepolicy__.modulepolicy
except ImportError:
    pass

# PyPy doesn't load C extensions.
#
# The canonical way to do this is to test platform.python_implementation().
# But we don't import platform and don't bloat for it here.
if r'__pypy__' in sys.builtin_module_names:
    policy = b'cffi'

# Our C extensions aren't yet compatible with Python 3. So use pure Python
# on Python 3 for now.
if sys.version_info[0] >= 3:
    policy = b'py'

# Environment variable can always force settings.
if sys.version_info[0] >= 3:
    if r'HGMODULEPOLICY' in os.environ:
        policy = os.environ[r'HGMODULEPOLICY'].encode(r'utf-8')
else:
    policy = os.environ.get(r'HGMODULEPOLICY', policy)

def _importfrom(pkgname, modname):
    # from .<pkgname> import <modname> (where . is looked through this module)
    fakelocals = {}
    pkg = __import__(pkgname, globals(), fakelocals, [modname], level=1)
    try:
        fakelocals[modname] = mod = getattr(pkg, modname)
    except AttributeError:
        raise ImportError(r'cannot import name %s' % modname)
    # force import; fakelocals[modname] may be replaced with the real module
    getattr(mod, r'__doc__', None)
    return fakelocals[modname]

# keep in sync with "version" in C modules
_cextversions = {
    (r'cext', r'base85'): 1,
    (r'cext', r'bdiff'): 1,
    (r'cext', r'diffhelpers'): 1,
    (r'cext', r'mpatch'): 1,
    (r'cext', r'osutil'): 1,
    (r'cext', r'parsers'): 1,
}

def _checkmod(pkgname, modname, mod):
    expected = _cextversions.get((pkgname, modname))
    actual = getattr(mod, r'version', None)
    if actual != expected:
        raise ImportError(r'cannot import module %s.%s '
                          r'(expected version: %d, actual: %r)'
                          % (pkgname, modname, expected, actual))

def importmod(modname):
    """Import module according to policy and check API version"""
    try:
        verpkg, purepkg = _packageprefs[policy]
    except KeyError:
        raise ImportError(r'invalid HGMODULEPOLICY %r' % policy)
    assert verpkg or purepkg
    if verpkg:
        try:
            mod = _importfrom(verpkg, modname)
            _checkmod(verpkg, modname, mod)
            return mod
        except ImportError:
            if not purepkg:
                raise
    return _importfrom(purepkg, modname)