Bug 5305 - TLS v1.0 abort cannot be suppressed via hgrc
Summary: TLS v1.0 abort cannot be suppressed via hgrc
Status: RESOLVED FIXED
Alias: None
Product: Mercurial
Classification: Unclassified
Component: Mercurial (show other bugs)
Version: 3.9-rc
Hardware: PC Mac OS
: wish feature
Assignee: Bugzilla
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-19 15:59 UTC by Sean Farley
Modified: 2016-07-20 16:31 UTC (History)
3 users (show)

See Also:
Python Version: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sean Farley 2016-07-19 15:59 UTC
Following the error I just got:

pulling from https://svn.macports.org/repository/macports
(could not negotiate a common protocol; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error)
abort: error: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:590)

Adding `--config hostsecurity.svn.macports.org:minimumprotocol=tls1.0` temporarily allows a pull but adding:

[hostsecurity]
svn.macports.org:minimumprotocol=tls1.0

to .hg/hgrc does not work.
Comment 1 Pulkit Goyal 2016-07-19 18:23 UTC
I also got the same error while running hg out.

comparing with https://selenic.com/hg
(could not negotiate a common protocol; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error)
abort: error: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:590)
Comment 2 Gregory Szorc 2016-07-19 18:28 UTC
selenic.com isn't supporting TLS 1.1 or 1.2, hence why you get the "unsupported protocol" error. See bug 5303 for tweaking the error output. The current situation is not exactly helpful.
Comment 3 Gregory Szorc 2016-07-19 18:32 UTC
I was able to reproduce.

Setting the option in ~/.hgrc works. However, setting in .hg/hgrc does not. I reckon the ui instance we're using didn't come from the repo :/
Comment 4 Pulkit Goyal 2016-07-19 18:46 UTC
(In reply to Gregory Szorc from comment #3)
Yeah adding 

[hostsecurity]
selenic.com:minimumprotocol=tls1.0

to .hgrc works for me.
Comment 5 Pulkit Goyal 2016-07-19 18:49 UTC
By .hgrc I mean ~/.hgrc
Comment 6 HG Bot 2016-07-20 15:15 UTC
Fixed by https://selenic.com/repo/hg/rev/3fde328d0913
Gregory Szorc <gregory.szorc@gmail.com>
hg: copy [hostsecurity] options to remote ui instances (issue5305)

TIL that ui instances for remote/peer repos don't automagically inherit
config options from .hg/hgrc files.

This patch makes remote ui instances inherit options from the
[hostsecurity] section. We were already inheriting options
from [hostfingerprints] and [auth]. So adding [hostsecurity] to the
list seems appropriate.

(please test the fix)
Comment 7 Sean Farley 2016-07-20 16:31 UTC
Verified that this changeset fixes it!