url: verify correctness of https server certificates (
issue2407)
Pythons SSL module verifies that certificates received for HTTPS are valid
according to the specified cacerts, but it doesn't verify that the certificate
is for the host we connect to.
We now explicitly verify that the commonName in the received certificate
matches the requested hostname and is valid for the time being.
This is a minimal patch where we try to fail to the safe side, but we do still
rely on Python's SSL functionality and do not try to implement the standards
fully and correctly. CRLs and subjectAltName are not handled and proxies
haven't been considered.
This change might break connections to some sites if cacerts is specified and
the certificates (by our definition) isn't correct. The workaround is to
disable cacerts which in most cases isn't much worse than it was before with
cacerts.
mq: Removed extra ... in short help for qdelete
Update to
57ad5c4e4213, which left a ... too much, after removing
-r [REV]
mq: removed short option in help for deprecated options
Removed help for deprecated short option for:
-n NAME for qpush
-n NAME for qpop
-r REV for qdelete|qremove|qrm
test-subrepo-recursion: deleted default arguments
Deleted default arguments from test-sub-repo-recursion. Rationale is
that it is confusing to read, when the arguments aren't at each
command in the test
tests: removed test names in tests
The name of the test files is replaced with a glob * expression,
thereby the tests does not depend on the filename of the file they are
in.
tests: fix
05210e955bef merge error in test-git-import.t
init: expand destination url as a configured paths
Most commands expands configured paths when repositories are specified, just as
the urls help says. Clone also expands the destination path. Clone is morally
equivalent to init + push/pull, so init should also expand the destination path
- and that is what this patch makes it do.
There is no really good usecases for this and in most cases it doesn't matter,
but consistency is nice, and otherwise we would have to document the exception.
transplant: add the transplanted revset predicate
This adds support to identify a particular transplanted changeset or set
of changesets. The argument is optional. Examples:
hg log -r 'transplanted(1234 or 2345)'
hg log -r 'transplanted()'