828140 - repos should be accessed via https, even hg.m.o

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[hwine]

OpSec recommends using https for pulls, even for inside the firewall connections.

Changing the URL is trivial - the work is to find the configuration tweaks such that the vcs apps won't complain about certs from the repo hosts we care about.

Comment 1

[Aki Sasaki (not active)]

http://kiln.stackexchange.com/questions/2816/mercurial-certificate-warning-certificate-not-verified-web-cacerts

I'm solving this in mozharness by aliasing 'hg' to ['hg', '--config', 'web.cacerts=/src/vcs_conversion/dummycert.pem'] after creating that bogus certificate.

It looks like on linux we can just point to /etc/pki/tls/certs/ca-bundle.crt or /etc/ssl/certs/ca-certificates.crt depending if it's RHEL or Debian based.

Comment 2

[hwine]

That's one way.

We can also just add the following to hgrc files or ~/.hgrc:
[hostfingerprints]
hg.mozilla.org = 10:78:e8:57:2d:95:de:7c:de:90:bd:22:e1:38:17:67:c5:a7:9c:14

Comment 3

[hwine]

I just added the above to the ~vcs2vcs/.hgrc file on github-sync3 to see if that was related to the job08 problems

Comment 4

[Aki Sasaki (not active)]

This is fixed in the new system, which we're pushing to get live.