[Python-apps-team] Bug#918475: mercurial fails to fetch clone bundles from bitbucket.org (SSL error)

[Nicolas Braud-Santoni]

Package: mercurial
Version: 4.8.1-2
Severity: important

Dear maintainers,

I just installed mercurial on my buster system, and it fails to clone
repositories from bitbucket.org:

> $ hg clone https://bitbucket.org/pypy/pypy
> 
> destination directory: pypy
> applying clone bundle from https://api.media.atlassian.com/file/ade8a479-34db-4526-9823-6bd33d7703fa/binary?client=b64ca8e6-e703-4cb9-8f30-cae44f70ea24&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3MiOnsidXJuOmZpbGVzdG9yZTpmaWxlOmFkZThhNDc5LTM0ZGItNDUyNi05ODIzLTZiZDMzZDc3MDNmYSI6WyJyZWFkIl19LCJleHAiOjE1NDY3Nzg3NDAsImlzcyI6ImI2NGNhOGU2LWU3MDMtNGNiOS04ZjMwLWNhZTQ0ZjcwZWEyNCIsIm5iZiI6MTU0Njc3ODMyMH0.DyHo3Ft-mk_ixHgL1Q6LXGJ1grzALRLarTtXJKD91rk
> error fetching bundle: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:727)
> abort: error applying bundle
> (if this error persists, consider contacting the server operator or disable clone bundles via "--config ui.clonebundles=false")


Accessing the bundle URL with a different HTTP client (in my case, Firefox
nightly) works without issue, so this is unlikely to be a server-side issue.

The suggested workaround (--config ui.clonebundles=false) works, but performance
is abysmal on large repositories (such as the PyPy repo I was trying to clone).


Best,

  nicoo

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages mercurial depends on:
ii  libc6             2.28-2
ii  mercurial-common  4.8.1-2
ii  python            2.7.15-3
ii  ucf               3.0038+nmu1

Versions of packages mercurial recommends:
ii  openssh-client  1:7.9p1-4

Versions of packages mercurial suggests:
ii  meld  3.18.3-1
pn  qct   <none>

-- no debconf information