1304793 - Improve certificate pinning for Mercurial 3.9

Status: RESOLVED FIXED

(Developer Services :: Mercurial: configwizard, defect)

Description

[Gregory Szorc [:gps]]

Patches coming.

Comment 1

[Gregory Szorc [:gps]]

Attachment: testing: add capabilities tests for Mercurial 3.8+ and 3.9+;

Pretty self-explanatory.

Review commit: https://reviewboard.mozilla.org/r/80464/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/80464/

Comment 2

[Gregory Szorc [:gps]]

Attachment: configwizard: fix tests;

The hghave file was missing from the directory. This meant that
#if conditions weren't being executed and the condition was being
evaluated as false.

This was also masking a failure in the syntax: inverted conditions
should be prefixed with "no-" not "!".

Review commit: https://reviewboard.mozilla.org/r/80466/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/80466/

Comment 3

[Gregory Szorc [:gps]]

Attachment: configwizard: use [hostsecurity] section to pin fingerprints (bug 1304793);

Mercurial 3.9 supports a new [hostsecurity] section that is everything
[hostfingerprints] was and more.

We add code to detect when running on Mercurial 3.9+. If so, we set
fingerprints in [hostsecurity]. Fingerprints are defined as SHA-256,
since that is harder to create a hash collision for than SHA-1.

If [hostfingerprints] is present, we port fingerprints to
[hostsecurity] automatically.

It's worth noting that we never delete pinned fingerprints. However,
fresh runs on Mercurial 3.9+ with modern SSL won't pin the
fingerprints.

Review commit: https://reviewboard.mozilla.org/r/80468/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/80468/

Comment 4

[Steven MacLeod [:smacleod]]

Comment on attachment 8793847 [details]
testing: add capabilities tests for Mercurial 3.8+ and 3.9+;

https://reviewboard.mozilla.org/r/80464/#review79698

Comment 5

[Steven MacLeod [:smacleod]]

Comment on attachment 8793848 [details]
configwizard: fix tests;

https://reviewboard.mozilla.org/r/80466/#review79700

Comment 6

[Steven MacLeod [:smacleod]]

Comment on attachment 8793849 [details]
configwizard: use [hostsecurity] section to pin fingerprints (bug 1304793);

https://reviewboard.mozilla.org/r/80468/#review79706

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/7c0e12b4cf2c
configwizard: use [hostsecurity] section to pin fingerprints ; r=smacleod