sslutil: document the Apple OpenSSL cert trick This is sort of documented in _plainapplypython()'s docstring. But it helps to be explicit in security code.

sslutil: use certificates provided by certifi if available The "certifi" Python package provides a distribution of the Mozilla trusted CA certificates as a Python package. If it is present, we assume the user intends it to be used and we use it to provide the default CA certificates when certificates are otherwise not configured. It's worth noting that this behavior roughly matches the popular "requests" package, which also attempts to use "certifi" if present.

py3: make files use absolute_import and print_function This patch includes addition of absolute_import and print_function to the files where they are missing. The modern importing conventions are also followed.

sslutil: don't attempt to find default CA certs file when told not to Before, devel.disableloaddefaultcerts only impacted the loading of default certs via SSLContext. After this patch, the config option also prevents sslutil._defaultcacerts() from being called. This config option is meant to be used by tests to force no CA certs to be loaded. Future patches will enable _defaultcacerts() to have success more often. Without this change we can't reliably test the failure to load CA certs. (This patch also likely fixes test failures on some OS X configurations.)

sslutil: pass ui to _defaultcacerts We'll use this shortly.

sslutil: change comment and logged message for found ca cert file Future patches will change _defaultcacerts() to do something on platforms that aren't OS X. Change the comment and logged message to reflect the future.

tests: better testing of loaded certificates Tests were failing on systems like RHEL 7 where loading the system certificates results in CA certs being reported to Python. We add a feature that detects when we're able to load *and detect* the loading of system certificates. We update the tests to cover the 3 scenarios: 1) system CAs are loadable and detected 2) system CAs are loadable but not detected 3) system CAs aren't loadable

update: teach hg to override untracked dir with a tracked file on update This is a fix to an old problem when Mercurial got confused by an untracked folder with the same name as one of the files in a commit hg was trying to update to. It is pretty safe to remove this folder if it is empty. Backing up an empty folder seems to go against Mercurial's "don't track dirs" philosophy.

rebase: move handling of obsolete commits to be a separate RR class method

rebase: move rebase finish logic to be a method of the RR class Rebase finish logic includes collapsing working directorystate into a single commit, moving bookmarks, clearing status and collapsemsg files, reporting skipped commits to the user and obsoleting precursors of the newly created commits.

rebase: move core rebase logic to be a method of the RR class

rebase: move local variable 'extrafn' to the RR class

rebase: move local variable 'currentbookmarks' to the RR class

rebase: make collapsing use explicit logic to decide on the rev to reuse This code: for rev in sortedstate: ... ... newnode = concludenode(repo, rev, p1, rbsrt.external, commitmsg=commitmsg, extrafn=extrafn, editor=editor, keepbranches=rbsrt.keepbranchesf, date=rbsrt.date) uses 'rev' variable in 'concludenode' function invocation. It is not explicitly assigned before, but its value comes as last value or 'rev' in a for loop, e.g. last element in a 'sortedstate'. IMO this a bad style and it also makes it hard to refactor the function, so it is better to explicitly define the value passed to 'concludenode'.

rebase: move new rebase preparation to be a method of the RR class This commit moves logic that prepares the execution of a new rebase operation to be a method of the rebaseruntime class.

rebase: move abort/continue prep to be a method of the RR class This commit moves logic that prepares the execution of abort and continue phases or rebase operation to be a method of the rebaseruntime class.

hgweb: expose list of per-repo labels to templates hgweb currently offers limited functionality for "classifying" repositories. This patch aims to change that. The web.labels config option list is introduced. Its values are exposed to the "index" and "summary" templates. Custom templates can use template features like ifcontains() to e.g. look for the presence of a specific label and engage specific behavior. For example, a site operator may wish to assign a "defunct" label to a repository so the repository is prominently marked as dead in repository indexes.

histedit: move autoverb rule to the commit it matches Inspired by how 'git rebase -i' works, we move the autoverb to the commit line summary that it matches. We do this by iterating over all rules and inserting each non-autoverb line into a key in an ordered dictionary. If we find an autoverb line later, we then search for the matching key and append it to the list (which is the value of each key in the dictionary). If we can't find a previous line to move to, then we leave the rule in the same spot. Tests have been updated but the diff looks a little messy because we need to change one of the summary lines so that it will actually move to a new spot. On top of that, we added -q flags to future some of the output and needed to change the file it modified so that it wouldn't cause a conflict.

histedit: use _getsummary in ruleeditor This patch uses our common method instead of duplicating logic.

histedit: use _getsummary in torule This patch uses our common method instead of duplicating logic.

histedit: extract common summary code into method We're going to need to use this code in our autoverb logic so let's extract it now and save ourselves from code duplication.

histedit: remove unneeded initial parameter Now that the autoverb logic no longer acts on an individual rule line, we don't need this parameter since we apply our logic just once at the time of initialization.

histedit: move autoverb logic from torule to ruleeditor This is needed for an upcoming change that will automatically rearrange the rules based on the commit message. Before this patch, the autoverb logic only applied to one rule at a time. This moves that logic one step up so that it can iterate over all the rules and rearrange as needed.

treemanifests: actually strip directory manifests Stripping has only partly worked since 7cbb3a01fa38 (repair: use cg3 for treemanifests, 2016-01-19): the bundle seems to have been created correctly, but revlog entries in subdirectory revlogs were not stripped. This meant that e.g. "hg verify" would fail after stripping in a tree manifest repo. To find the revisions to strip, we simply iterate over all directories in the repo (included in store.datafiles()). This is inefficient for stripping few commits, but efficient for stripping many commits. To optimize for stripping few commits, we could instead walk the tree from the root and find modified subdirectories, just like we do in the changegroup code. I'm leaving that for another day.

logtoprocess: do not leak the ui object in uisetup logtoprocess.log should use "self" passed in function arguments instead of the "ui" object from outside the function.

chgserver: document why we don't merge mtimehash and confighash People may get confused about chg's mtimehash and confighash design: why two hashes instead of just one. This patch adds text addressing the concern.

extensions: move uisetup and extsetup to standalone functions This is to make them wrap-able. chgserver wants to know if an extension accesses config or environment variables during uisetup and extsetup and include them in confighash accordingly.

sslutil: don't access message attribute in exception (issue5285) I should have ran the entire test suite on Python 2.6. Since the hostname matching tests are implemented in Python (not .t tests), it didn't uncover this warning. I'm not sure why - warnings should be printed regardless. This is possibly a bug in the test runner. But that's for another day...