| pulkit |
| hg-reviewers |
Otherwise we attempt to compare a bytes to a str on Python 3
and it always fails.
| Lint Skipped |
| Unit Tests Skipped |
| modernssl and not sslcontext.get_ca_certs()): | modernssl and not sslcontext.get_ca_certs()): | ||||
| ui.warn(_('(an attempt was made to load CA certificates but ' | ui.warn(_('(an attempt was made to load CA certificates but ' | ||||
| 'none were loaded; see ' | 'none were loaded; see ' | ||||
| 'https://mercurial-scm.org/wiki/SecureConnections ' | 'https://mercurial-scm.org/wiki/SecureConnections ' | ||||
| 'for how to configure Mercurial to avoid this ' | 'for how to configure Mercurial to avoid this ' | ||||
| 'error)\n')) | 'error)\n')) | ||||
| except ssl.SSLError: | except ssl.SSLError: | ||||
| pass | pass | ||||
| # Try to print more helpful error messages for known failures. | # Try to print more helpful error messages for known failures. | ||||
| if util.safehasattr(e, 'reason'): | if util.safehasattr(e, 'reason'): | ||||
| # This error occurs when the client and server don't share a | # This error occurs when the client and server don't share a | ||||
| # common/supported SSL/TLS protocol. We've disabled SSLv2 and SSLv3 | # common/supported SSL/TLS protocol. We've disabled SSLv2 and SSLv3 | ||||
| # outright. Hopefully the reason for this error is that we require | # outright. Hopefully the reason for this error is that we require | ||||
| # TLS 1.1+ and the server only supports TLS 1.0. Whatever the | # TLS 1.1+ and the server only supports TLS 1.0. Whatever the | ||||
| # reason, try to emit an actionable warning. | # reason, try to emit an actionable warning. | ||||
| if e.reason == 'UNSUPPORTED_PROTOCOL': | if e.reason == r'UNSUPPORTED_PROTOCOL': | ||||
| # We attempted TLS 1.0+. | # We attempted TLS 1.0+. | ||||
| if settings['protocolui'] == 'tls1.0': | if settings['protocolui'] == 'tls1.0': | ||||
| # We support more than just TLS 1.0+. If this happens, | # We support more than just TLS 1.0+. If this happens, | ||||
| # the likely scenario is either the client or the server | # the likely scenario is either the client or the server | ||||
| # is really old. (e.g. server doesn't support TLS 1.0+ or | # is really old. (e.g. server doesn't support TLS 1.0+ or | ||||
| # client doesn't support modern TLS versions introduced | # client doesn't support modern TLS versions introduced | ||||
| # several years from when this comment was written). | # several years from when this comment was written). | ||||
| if supportedprotocols != {'tls1.0'}: | if supportedprotocols != {'tls1.0'}: | ||||
| 'hostsecurity.%s:minimumprotocol=tls1.0 to allow ' | 'hostsecurity.%s:minimumprotocol=tls1.0 to allow ' | ||||
| 'use of legacy, less secure protocols when ' | 'use of legacy, less secure protocols when ' | ||||
| 'communicating with this server)\n') % | 'communicating with this server)\n') % | ||||
| serverhostname) | serverhostname) | ||||
| ui.warn(_( | ui.warn(_( | ||||
| '(see https://mercurial-scm.org/wiki/SecureConnections ' | '(see https://mercurial-scm.org/wiki/SecureConnections ' | ||||
| 'for more info)\n')) | 'for more info)\n')) | ||||
| elif (e.reason == 'CERTIFICATE_VERIFY_FAILED' and | elif (e.reason == r'CERTIFICATE_VERIFY_FAILED' and | ||||
| pycompat.iswindows): | pycompat.iswindows): | ||||
| ui.warn(_('(the full certificate chain may not be available ' | ui.warn(_('(the full certificate chain may not be available ' | ||||
| 'locally; see "hg help debugssl")\n')) | 'locally; see "hg help debugssl")\n')) | ||||
| raise | raise | ||||
| # check if wrap_socket failed silently because socket had been | # check if wrap_socket failed silently because socket had been | ||||
| # closed | # closed | ||||