{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/3541","repository_url":"https://api.github.com/repos/Homebrew/homebrew-core","labels_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/3541/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/3541/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/3541/events","html_url":"https://github.com/Homebrew/homebrew-core/issues/3541","id":168926273,"number":3541,"title":"Mercurial should use Homebrew python so it can support TLS 1.1+","user":{"login":"indygreg","id":342993,"avatar_url":"https://avatars.githubusercontent.com/u/342993?v=3","gravatar_id":"","url":"https://api.github.com/users/indygreg","html_url":"https://github.com/indygreg","followers_url":"https://api.github.com/users/indygreg/followers","following_url":"https://api.github.com/users/indygreg/following{/other_user}","gists_url":"https://api.github.com/users/indygreg/gists{/gist_id}","starred_url":"https://api.github.com/users/indygreg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/indygreg/subscriptions","organizations_url":"https://api.github.com/users/indygreg/orgs","repos_url":"https://api.github.com/users/indygreg/repos","events_url":"https://api.github.com/users/indygreg/events{/privacy}","received_events_url":"https://api.github.com/users/indygreg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-08-02T16:11:58Z","updated_at":"2016-08-02T16:54:25Z","closed_at":null,"body":"### Bug reports:\r\n\r\nThe mercurial package currently installs a `hg` script with a shebang of `#!/usr/bin/python`.\r\n\r\nApple's Python (even on the latest beta of MacOS) doesn't support TLS 1.1+ and other modern crypto features. Homebrew's Python does support modern crypto because it is built/linked with a modern OpenSSL.\r\n\r\nMercurial 3.9 takes a much more strict approach to connection security and issues warnings when TLS 1.1+ cannot be used. See https://www.mercurial-scm.org/wiki/SecureConnections for more.\r\n\r\nWhat this all means is that Mercurial 3.9 out of the box on Homebrew issues warnings when connecting to https:// URLs.\r\n\r\nThe issue can be fixed by having Mercurial use Homebrew's Python in its shebang. According to Mercurial's Makefile, this can be resolved by ensuring `python` resolves to the Homebrew Python 2.7 during installation."},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/comments/236968268","html_url":"https://github.com/Homebrew/homebrew-core/issues/3541#issuecomment-236968268","issue_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/3541","id":236968268,"user":{"login":"tdsmith","id":173889,"avatar_url":"https://avatars.githubusercontent.com/u/173889?v=3","gravatar_id":"","url":"https://api.github.com/users/tdsmith","html_url":"https://github.com/tdsmith","followers_url":"https://api.github.com/users/tdsmith/followers","following_url":"https://api.github.com/users/tdsmith/following{/other_user}","gists_url":"https://api.github.com/users/tdsmith/gists{/gist_id}","starred_url":"https://api.github.com/users/tdsmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tdsmith/subscriptions","organizations_url":"https://api.github.com/users/tdsmith/orgs","repos_url":"https://api.github.com/users/tdsmith/repos","events_url":"https://api.github.com/users/tdsmith/events{/privacy}","received_events_url":"https://api.github.com/users/tdsmith/received_events","type":"User","site_admin":false},"created_at":"2016-08-02T16:54:25Z","updated_at":"2016-08-02T16:54:25Z","body":"Fair; thanks for the correction. 2.7.9+ is necessary but not sufficient: python also needs to be linked against a sufficiently new OpenSSL and the system Python is not.\r\n\r\n```\r\ntim@rocketman:lib-dynload$ otool -L /System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-dynload/_ssl.so \r\n_ssl.so:\r\n\t/usr/lib/libssl.0.9.8.dylib (compatibility version 0.9.8, current version 0.9.8)\r\n\t/usr/lib/libcrypto.0.9.8.dylib (compatibility version 0.9.8, current version 0.9.8)\r\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1226.10.1)\r\n```\r\n\r\nApple is being lobbied to link Python against a newer SSL library, so we'll see if anything changes in the Sierra builds.\r\n\r\n> How will adding PyOpenSSL support to Mercurial improve things for Homebrew? Homebrew will install PyOpenSSL against the Homebrew Python.\r\n\r\nNo, we can install PyOpenSSL against a generic 2.7 python; it will work with system python."}}
{"actor":{"display_login":"tdsmith"}}