view Makefile @ 12592:f2937d6492c5 stable

url: verify correctness of https server certificates (issue2407)

Pythons SSL module verifies that certificates received for HTTPS are valid
according to the specified cacerts, but it doesn't verify that the certificate
is for the host we connect to.

We now explicitly verify that the commonName in the received certificate
matches the requested hostname and is valid for the time being.

This is a minimal patch where we try to fail to the safe side, but we do still
rely on Python's SSL functionality and do not try to implement the standards
fully and correctly. CRLs and subjectAltName are not handled and proxies
haven't been considered.

This change might break connections to some sites if cacerts is specified and
the certificates (by our definition) isn't correct. The workaround is to
disable cacerts which in most cases isn't much worse than it was before with
cacerts.

# If you want to change PREFIX, do not just edit it below. The changed
# value wont get passed on to recursive make calls. You should instead
# override the variable on the command like:
#
# % make PREFIX=/opt/ install

PREFIX=/usr/local
export PREFIX
PYTHON=python
PURE=
PYTHON_FILES:=$(shell find mercurial hgext doc -name '*.py')

help:
	@echo 'Commonly used make targets:'
	@echo '  all          - build program and documentation'
	@echo '  install      - install program and man pages to PREFIX ($(PREFIX))'
	@echo '  install-home - install with setup.py install --home=HOME ($(HOME))'
	@echo '  local        - build for inplace usage'
	@echo '  tests        - run all tests in the automatic test suite'
	@echo '  test-foo     - run only specified tests (e.g. test-merge1)'
	@echo '  dist         - run all tests and create a source tarball in dist/'
	@echo '  clean        - remove files created by other targets'
	@echo '                 (except installed files or dist source tarball)'
	@echo '  update-pot   - update i18n/hg.pot'
	@echo
	@echo 'Example for a system-wide installation under /usr/local:'
	@echo '  make all && su -c "make install" && hg version'
	@echo
	@echo 'Example for a local installation (usable in this directory):'
	@echo '  make local && ./hg version'

all: build doc

local:
	$(PYTHON) setup.py $(PURE) build_py -c -d . build_ext -i build_mo
	$(PYTHON) hg version

build:
	$(PYTHON) setup.py $(PURE) build

doc:
	$(MAKE) -C doc

clean:
	-$(PYTHON) setup.py clean --all # ignore errors from this command
	find . -name '*.py[cdo]' -exec rm -f '{}' ';'
	rm -f MANIFEST mercurial/__version__.py mercurial/*.so tests/*.err
	rm -rf mercurial/locale
	$(MAKE) -C doc clean

install: install-bin install-doc

install-bin: build
	$(PYTHON) setup.py $(PURE) install --root="$(DESTDIR)/" --prefix="$(PREFIX)" --force

install-doc: doc
	cd doc && $(MAKE) $(MFLAGS) install

install-home: install-home-bin install-home-doc

install-home-bin: build
	$(PYTHON) setup.py $(PURE) install --home="$(HOME)" --force

install-home-doc: doc
	cd doc && $(MAKE) $(MFLAGS) PREFIX="$(HOME)" install

MANIFEST-doc:
	$(MAKE) -C doc MANIFEST

MANIFEST: MANIFEST-doc
	hg manifest > MANIFEST
	echo mercurial/__version__.py >> MANIFEST
	cat doc/MANIFEST >> MANIFEST

dist:	tests dist-notests

dist-notests:	doc MANIFEST
	TAR_OPTIONS="--owner=root --group=root --mode=u+w,go-w,a+rX-s" $(PYTHON) setup.py -q sdist

tests:
	cd tests && $(PYTHON) run-tests.py $(TESTFLAGS)

test-%:
	cd tests && $(PYTHON) run-tests.py $(TESTFLAGS) $@

update-pot: i18n/hg.pot

i18n/hg.pot: $(PYTHON_FILES) mercurial/help/*.txt
	$(PYTHON) i18n/hggettext mercurial/commands.py \
	  hgext/*.py hgext/*/__init__.py mercurial/help/*.txt > i18n/hg.pot
        # All strings marked for translation in Mercurial contain
        # ASCII characters only. But some files contain string
        # literals like this '\037\213'. xgettext thinks it has to
        # parse them even though they are not marked for translation.
        # Extracting with an explicit encoding of ISO-8859-1 will make
        # xgettext "parse" and ignore them.
	echo $(PYTHON_FILES) | xargs \
	  xgettext --package-name "Mercurial" \
	  --msgid-bugs-address "<[e-mail]>" \
	  --copyright-holder "Matt Mackall <[e-mail]> and others" \
	  --from-code ISO-8859-1 --join --sort-by-file \
	  -d hg -p i18n -o hg.pot
	$(PYTHON) i18n/posplit i18n/hg.pot

%.po: i18n/hg.pot
	msgmerge --no-location --update $@ $^

.PHONY: help all local build doc clean install install-bin install-doc \
	install-home install-home-bin install-home-doc dist dist-notests tests \
	update-pot