diff --git a/mercurial/sslutil.py b/mercurial/sslutil.py index b76d8c641746fd19caf5762ca73c4c24a124ea3e_bWVyY3VyaWFsL3NzbHV0aWwucHk=..760a86865f806024af5f4ec45ab7b96e334122dc_bWVyY3VyaWFsL3NzbHV0aWwucHk= 100644 --- a/mercurial/sslutil.py +++ b/mercurial/sslutil.py @@ -10,9 +10,11 @@ from mercurial import util from mercurial.i18n import _ + +_canloaddefaultcerts = False try: # avoid using deprecated/broken FakeSocket in python 2.6 import ssl CERT_REQUIRED = ssl.CERT_REQUIRED try: ssl_context = ssl.SSLContext @@ -13,9 +15,11 @@ try: # avoid using deprecated/broken FakeSocket in python 2.6 import ssl CERT_REQUIRED = ssl.CERT_REQUIRED try: ssl_context = ssl.SSLContext + _canloaddefaultcerts = util.safehasattr(ssl_context, + 'load_default_certs') def ssl_wrap_socket(sock, keyfile, certfile, cert_reqs=ssl.CERT_NONE, ca_certs=None, serverhostname=None): @@ -35,6 +39,8 @@ sslcontext.verify_mode = cert_reqs if ca_certs is not None: sslcontext.load_verify_locations(cafile=ca_certs) + elif _canloaddefaultcerts: + sslcontext.load_default_certs() sslsocket = sslcontext.wrap_socket(sock, server_hostname=serverhostname) @@ -130,7 +136,8 @@ exe.startswith('/system/library/frameworks/python.framework/')) def _defaultcacerts(): + """return path to CA certificates; None for system's store; ! to disable""" if _plainapplepython(): dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem') if os.path.exists(dummycert): return dummycert @@ -133,7 +140,9 @@ if _plainapplepython(): dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem') if os.path.exists(dummycert): return dummycert + if _canloaddefaultcerts: + return None return '!' def sslkwargs(ui, host):