facebook/libphutil — pull request #20 by CodeBlock (2012-11-21 23:54:11+00:00)
Title: D3953

Summary:
This patch provides a better fallback path for SSL certificates in libphutil.
The path now works like this:
- See if a certificate has been set externally (e.g. by arcanist -- I'll get to
this in a minute).
- See if a custom.pem exists. This provides another "local" option before we ask
the system for a global option.
- Ask php if curl.cainfo is set, and use that.
- Lastly, fall back to default.pem, which ships with libphutil.

As for setting the certificate externally -- I'd like to (next) patch Arcanist
to accept an "ssl_cert" key in .arcrc, for specific hosts, and use it if it
exists. The ssl cert there will be the full certificate. It prevents the user
from having to maintain bundles of certs themselves. It also allows for saner
fallback -- e.g. if I use arc for both secure.phabricator.com and my own
instance with a custom cert -- previously Phabricator would try to use
`custom.pem` for both. This patch provides a //way// to fix that issue, and a
patch to Arcanist will provide the actual fix.

Test Plan:
Lots of stuff. :)

- Threw a custom.pem in `libphutil/resources/ssl`, and it tried to use it.
- Added a `curl.cainfo` and saw that it wasn't used (custom.pem takes
precedence).
- Moved the custom.pem out of the way, and saw that `curl.cainfo` was now used.
- Removed `curl.cainfo` and saw it fall back to default.pem.

Reviewers: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D3953