Mercurial > hg

changeset 29106:fe7ebef8796a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
sslutil: further refactor sslkwargs The logic here and what happens with web.cacerts is mind numbing. Make the code even more explicit.
author Gregory Szorc <gregory.szorc@gmail.com>
date Wed, 04 May 2016 23:01:49 -0700
parents 548e9c8c2841
children c8fbfb9163ce
files mercurial/sslutil.py
diffstat 1 files changed, 12 insertions(+), 7 deletions(-) [+]
line wrap: on
line diff
--- a/mercurial/sslutil.py	Thu May 05 00:31:11 2016 -0700
+++ b/mercurial/sslutil.py	Wed May 04 23:01:49 2016 -0700
@@ -249,17 +249,22 @@
     if cacerts == '!':
         return kws
 
+    # If a value is set in the config, validate against a path and load
+    # and require those certs.
     if cacerts:
         cacerts = util.expandpath(cacerts)
         if not os.path.exists(cacerts):
             raise error.Abort(_('could not find web.cacerts: %s') % cacerts)
-    else:
-        # CA certs aren't explicitly listed in the config. See if we can load
-        # defaults.
-        cacerts = _defaultcacerts()
-        if cacerts and cacerts != '!':
-            ui.debug('using %s to enable OS X system CA\n' % cacerts)
-        ui.setconfig('web', 'cacerts', cacerts, 'defaultcacerts')
+
+        kws.update({'ca_certs': cacerts,
+                    'cert_reqs': ssl.CERT_REQUIRED})
+        return kws
+
+    # No CAs in config. See if we can load defaults.
+    cacerts = _defaultcacerts()
+    if cacerts and cacerts != '!':
+        ui.debug('using %s to enable OS X system CA\n' % cacerts)
+    ui.setconfig('web', 'cacerts', cacerts, 'defaultcacerts')
 
     if cacerts != '!':
         kws.update({'ca_certs': cacerts,