[Python-apps-team] Bug#918475: mercurial fails to fetch clone bundles from bitbucket.org (SSL error)

[Julien Cristau]

Control: tag -1 moreinfo unreproducible

On 1/6/19 1:46 PM, Nicolas Braud-Santoni wrote:
> Package: mercurial
> Version: 4.8.1-2
> Severity: important
> 
> Dear maintainers,
> 
> I just installed mercurial on my buster system, and it fails to clone
> repositories from bitbucket.org:
> 
>> $ hg clone https://bitbucket.org/pypy/pypy
>>
>> destination directory: pypy
>> applying clone bundle from https://api.media.atlassian.com/file/ade8a479-34db-4526-9823-6bd33d7703fa/binary?client=b64ca8e6-e703-4cb9-8f30-cae44f70ea24&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3MiOnsidXJuOmZpbGVzdG9yZTpmaWxlOmFkZThhNDc5LTM0ZGItNDUyNi05ODIzLTZiZDMzZDc3MDNmYSI6WyJyZWFkIl19LCJleHAiOjE1NDY3Nzg3NDAsImlzcyI6ImI2NGNhOGU2LWU3MDMtNGNiOS04ZjMwLWNhZTQ0ZjcwZWEyNCIsIm5iZiI6MTU0Njc3ODMyMH0.DyHo3Ft-mk_ixHgL1Q6LXGJ1grzALRLarTtXJKD91rk
>> error fetching bundle: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:727)
>> abort: error applying bundle
>> (if this error persists, consider contacting the server operator or disable clone bundles via "--config ui.clonebundles=false")
> 
> 
> Accessing the bundle URL with a different HTTP client (in my case, Firefox
> nightly) works without issue, so this is unlikely to be a server-side issue.
> 
> The suggested workaround (--config ui.clonebundles=false) works, but performance
> is abysmal on large repositories (such as the PyPy repo I was trying to clone).
> 
I can't reproduce.  And it shouldn't use sslv3 so that bit seems fishy.

Cheers,
Julien