view tests/test-revlog-ancestry.py.out @ 28525:dfb21c34e07d

sslutil: allow multiple fingerprints per host

Certificate pinning via [hostfingerprints] is a useful security
feature. Currently, we only support one fingerprint per hostname.
This is simple but it fails in the real world:

* Switching certificates breaks clients until they change the
  pinned certificate fingerprint. This incurs client downtime
  and can require massive amounts of coordination to perform
  certificate changes.
* Some servers operate with multiple certificates on the same
  hostname.

This patch adds support for defining multiple certificate
fingerprints per host. This overcomes the deficiencies listed
above. I anticipate the primary use case of this feature will
be to define both the old and new certificate so a certificate
transition can occur with minimal interruption, so this scenario
has been called out in the help documentation.

Ancestors of 5
4 2 0 
Ancestors of 6 and 5
3 4 2 1 0 
Ancestors of 5 and 4
4 2 0 
Ancestors of 7, stop at 6
6 
Ancestors of 7, including revs
7 6 5 3 4 2 1 0 
Ancestors of 7, 5 and 3, including revs
7 5 3 6 4 2 1 0 

Descendants of 5
7 8 
Descendants of 5 and 3
6 7 8 
Descendants of 5 and 4
5 7 8