Mercurial > hg
view tests/test-import-unknown.t @ 28525:dfb21c34e07d
sslutil: allow multiple fingerprints per host
Certificate pinning via [hostfingerprints] is a useful security
feature. Currently, we only support one fingerprint per hostname.
This is simple but it fails in the real world:
* Switching certificates breaks clients until they change the
pinned certificate fingerprint. This incurs client downtime
and can require massive amounts of coordination to perform
certificate changes.
* Some servers operate with multiple certificates on the same
hostname.
This patch adds support for defining multiple certificate
fingerprints per host. This overcomes the deficiencies listed
above. I anticipate the primary use case of this feature will
be to define both the old and new certificate so a certificate
transition can occur with minimal interruption, so this scenario
has been called out in the help documentation.
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Sun, 13 Mar 2016 14:03:58 -0700 |
parents | f2719b387380 |
children | 6a454e7053a1 |
line wrap: on
line source
$ cat <<EOF >> $HGRCPATH > [extensions] > purge = > EOF $ hg init test $ cd test $ echo a > changed $ echo a > removed $ echo a > source $ hg ci -Am addfiles adding changed adding removed adding source $ echo a >> changed $ echo a > added $ hg add added $ hg rm removed $ hg cp source copied $ hg diff --git > ../unknown.diff Test adding on top of an unknown file $ hg up -qC 0 $ hg purge $ echo a > added $ hg import --no-commit ../unknown.diff applying ../unknown.diff file added already exists 1 out of 1 hunks FAILED -- saving rejects to file added.rej abort: patch failed to apply [255] Test modifying an unknown file $ hg revert -aq $ hg purge $ hg rm changed $ hg ci -m removechanged $ echo a > changed $ hg import --no-commit ../unknown.diff applying ../unknown.diff abort: cannot patch changed: file is not tracked [255] Test removing an unknown file $ hg up -qC 0 $ hg purge $ hg rm removed $ hg ci -m removeremoved created new head $ echo a > removed $ hg import --no-commit ../unknown.diff applying ../unknown.diff abort: cannot patch removed: file is not tracked [255] Test copying onto an unknown file $ hg up -qC 0 $ hg purge $ echo a > copied $ hg import --no-commit ../unknown.diff applying ../unknown.diff abort: cannot create copied: destination already exists [255] $ cd ..