view mercurial/scmwindows.py @ 28525:dfb21c34e07d

sslutil: allow multiple fingerprints per host

Certificate pinning via [hostfingerprints] is a useful security
feature. Currently, we only support one fingerprint per hostname.
This is simple but it fails in the real world:

* Switching certificates breaks clients until they change the
  pinned certificate fingerprint. This incurs client downtime
  and can require massive amounts of coordination to perform
  certificate changes.
* Some servers operate with multiple certificates on the same
  hostname.

This patch adds support for defining multiple certificate
fingerprints per host. This overcomes the deficiencies listed
above. I anticipate the primary use case of this feature will
be to define both the old and new certificate so a certificate
transition can occur with minimal interruption, so this scenario
has been called out in the help documentation.

from __future__ import absolute_import

import _winreg
import os

from . import (
    osutil,
    util,
)

def systemrcpath():
    '''return default os-specific hgrc search path'''
    rcpath = []
    filename = util.executablepath()
    # Use mercurial.ini found in directory with hg.exe
    progrc = os.path.join(os.path.dirname(filename), 'mercurial.ini')
    rcpath.append(progrc)
    # Use hgrc.d found in directory with hg.exe
    progrcd = os.path.join(os.path.dirname(filename), 'hgrc.d')
    if os.path.isdir(progrcd):
        for f, kind in osutil.listdir(progrcd):
            if f.endswith('.rc'):
                rcpath.append(os.path.join(progrcd, f))
    # else look for a system rcpath in the registry
    value = util.lookupreg('SOFTWARE\\Mercurial', None,
                           _winreg.HKEY_LOCAL_MACHINE)
    if not isinstance(value, str) or not value:
        return rcpath
    value = util.localpath(value)
    for p in value.split(os.pathsep):
        if p.lower().endswith('mercurial.ini'):
            rcpath.append(p)
        elif os.path.isdir(p):
            for f, kind in osutil.listdir(p):
                if f.endswith('.rc'):
                    rcpath.append(os.path.join(p, f))
    return rcpath

def userrcpath():
    '''return os-specific hgrc search path to the user dir'''
    home = os.path.expanduser('~')
    path = [os.path.join(home, 'mercurial.ini'),
            os.path.join(home, '.hgrc')]
    userprofile = os.environ.get('USERPROFILE')
    if userprofile and userprofile != home:
        path.append(os.path.join(userprofile, 'mercurial.ini'))
        path.append(os.path.join(userprofile, '.hgrc'))
    return path