The patch seems correct to me. However, things are evolving a bit on the Python
side (http://bugs.python.org/issue1424152) and a close synchronization of this
issue and the Python one are important.

So this should do the job?

diff --git a/mercurial/keepalive.py b/mercurial/keepalive.py
--- a/mercurial/keepalive.py
+++ b/mercurial/keepalive.py
@@ -237,6 +237,8 @@
             else:
                 # no (working) free connections were found.  Create a new one.
                 h = http_class(host)
+                if hasattr(req, '_tunnel_host') and req._tunnel_host:
+                    h.set_tunnel(req._tunnel_host)
                 if DEBUG: DEBUG.info("creating new connection to %s (%d)",
                                      host, id(h))
                 self._cm.add(host, h, 0)

It's harmful when python patch isn't applied. But testing for 
_tunnel_host attribute presence should be sufficient to support both 
cases.

It's harmful when python patch isn't applied. But testing for _tunnel_host
attribute presence should be sufficient to support both cases.

@phil
Should the patch be applied to the keepalive.py version used in mercurial? Or is
it harmful when the python patch isn't applied?

Recipe to have it work:

As mentionned earlier, urllib2/httplib do not support it, and a patch is
provided here:
http://bugs.python.org/issue1424152
Apply it.

but mercurial overloads some of the logic, and a part of the patch must be
reported there, so apply this one too:
# HG changeset patch
# User Phil <phil@secdev.org>
# Date 1214998663 -7200
# Node ID 06270abc1d2dbe81c9caa590779209f5d3ba808d
# Parent  e81d2bd669088aa22e3437c610d216500ffeb02c
Code to support https connections through proxy

urllib2/httplib does not support those connections. A patch
is proposed here:
http://bugs.python.org/issue1424152

Because Mercurial overloads some parts of urllib2, a part
of the patch must be transfered to the overloading mercurial code.

diff --git a/mercurial/keepalive.py b/mercurial/keepalive.py
--- a/mercurial/keepalive.py
+++ b/mercurial/keepalive.py
@@ -237,6 +237,8 @@
             else:
                 # no (working) free connections were found.  Create a new one.
                 h = http_class(host)
+                if req._tunnel_host:
+                    h.set_tunnel(req._tunnel_host)
                 if DEBUG: DEBUG.info("creating new connection to %s (%d)",
                                      host, id(h))
                 self._cm.add(host, h, 0)

This was first brought up on the mercurial mailing list and consensus seems to 
be this is really a bug in the Python urllib/urllib2, see

http://bugs.python.org/issue1424152

Just as a clarification, the combination of mercurial, https and a proxy does 
work for plenty of people. In my case it fails because the proxy at my office is  
very strict.

Adding nosy from issue606.

mpm proposed using something like this:

http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/456195

See also issue606.

I can confirm with crew-stable and crew with python 2.4 on Debian etch.

hg sends a request GET https://... instead of using CONNECT.

I'm trying to push to a repo pusblished over https through squid. The push fails:

--
moya@gloria:~/src/foo-trunk$ hg --verbose --debug push https://hg.foo.org/foo-trunk
using https://hg.foo.org/foo-trunk
proxying through http://localhost:3128
pushing to https://hg.foo.org/foo-trunk
sending capabilities command
abort: HTTP Error 501: Not Implemented
--

The same push works if I do it not behind the proxy. The squid log have the
following

1202287933.801      3 127.0.0.1 TCP_DENIED/501 1501 GET
https://hg.foo.org/foo-trunk?cmd=capabilities - NONE/- text/html

Searching the web for 'GET https' I found this
http://wiki.squid-cache.org/SquidFaq/TroubleShooting#head-03d5d82b9c2b2e558084f4ba72b226a711639d62

I'm using mercurial 0.9.5.

Regards,
maykel