Merge lp:~vila/bzr/929179-default-ssl-certs into lp:bzr/2.5

[Vincent Ladeuil]

Default to no ssl cert verification on osx and windows

As discussed during the standup and on IRC, this change the default value of
`ssl.ca_reqs` for osx and windows where we don't yet have a way to access
the native ssl root certificates.

I've filed bug #932647 and bug #932648 for windows and osx so the long term
solution can be tracked.

[Martin Pool (mbp)]

nice.

[fix] typo 'prodvided' in the news

 vote approve

review: Approve

[Vincent Ladeuil (vila)]

sent to pqm by email

=== modified file 'bzrlib/transport/http/_urllib2_wrappers.py'
--- bzrlib/transport/http/_urllib2_wrappers.py	2012-01-31 17:00:22 +0000
+++ bzrlib/transport/http/_urllib2_wrappers.py	2012-02-16 08:32:18 +0000
@@ -86,7 +86,6 @@
     # XXX: Needs checking, can't trust the interweb ;) -- vila 2012-01-25
     u'/etc/openssl/certs/ca-certificates.crt', # Solaris
     ]
-
 def default_ca_certs():
     if sys.platform == 'win32':
         return os.path.join(os.path.dirname(sys.executable), u"ca_bundle.crt")
@@ -122,6 +121,13 @@
     except KeyError:
         raise ValueError("invalid value %s" % unicode_str)
 
+def default_ca_reqs():
+    if sys.platform in ('win32', 'darwin'):
+        # FIXME: Once we get a native access to root certificates there, this
+        # won't needed anymore. See http://pad.lv/920455 -- vila 2012-02-15
+        return u'none'
+    else:
+        return u'required'
 
 opt_ssl_ca_certs = config.Option('ssl.ca_certs',
         from_unicode=ca_certs_from_store,
@@ -137,7 +143,7 @@
 """)
 
 opt_ssl_cert_reqs = config.Option('ssl.cert_reqs',
-        default=u"required",
+        default=default_ca_reqs,
         from_unicode=cert_reqs_from_store,
         invalid='error',
         help="""\

=== modified file 'doc/en/release-notes/bzr-2.5.txt'
--- doc/en/release-notes/bzr-2.5.txt	2012-02-03 12:47:10 +0000
+++ doc/en/release-notes/bzr-2.5.txt	2012-02-16 08:32:18 +0000
@@ -33,6 +33,10 @@
 .. Fixes for situations where bzr would previously crash or give incorrect
    or undesirable results.
 
+* Disable ssl certificate verification on osx and windows until a native
+  access to the the root certificates is provided there.
+  (Vincent Ladeuil, #929179)
+
 Documentation
 *************