* [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
@ 2013-10-12 9:23 arnaud.brejeon
2013-10-12 9:23 ` [PATCH 2/2] Add SVN trust-server-cert parameter to git svn to accept SSL server certificates from unknwon authorities without prompting arnaud.brejeon
2013-10-14 14:11 ` [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt Jonathan Nieder
0 siblings, 2 replies; 9+ messages in thread
From: arnaud.brejeon @ 2013-10-12 9:23 UTC (permalink / raw)
To: git; +Cc: arnaudbrejeon
From: arnaudbrejeon <arnaud.brejeon@gmail.com>
Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
---
git-svn.perl | 3 +++
perl/Git/SVN/Prompt.pm | 12 +++++++++---
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/git-svn.perl b/git-svn.perl
index ff1ce3d..07f0a6c 100755
--- a/git-svn.perl
+++ b/git-svn.perl
@@ -123,6 +123,7 @@ sub opt_prefix { return $_prefix || '' }
$Git::SVN::Fetcher::_placeholder_filename = ".gitignore";
$_q ||= 0;
my %remote_opts = ( 'username=s' => \$Git::SVN::Prompt::_username,
+ 'password=s' => \$Git::SVN::Prompt::_password,
'config-dir=s' => \$Git::SVN::Ra::config_dir,
'no-auth-cache' => \$Git::SVN::Prompt::_no_auth_cache,
'ignore-paths=s' => \$Git::SVN::Fetcher::_ignore_regex,
@@ -206,6 +207,7 @@ my %cmd = (
'parents' => \$_parents,
'tag|t' => \$_tag,
'username=s' => \$Git::SVN::Prompt::_username,
+ 'password=s' => \$Git::SVN::Prompt::_password,
'commit-url=s' => \$_commit_url } ],
tag => [ sub { $_tag = 1; cmd_branch(@_) },
'Create a tag in the SVN repository',
@@ -214,6 +216,7 @@ my %cmd = (
'dry-run|n' => \$_dry_run,
'parents' => \$_parents,
'username=s' => \$Git::SVN::Prompt::_username,
+ 'password=s' => \$Git::SVN::Prompt::_password,
'commit-url=s' => \$_commit_url } ],
'set-tree' => [ \&cmd_set_tree,
"Set an SVN repository to a git tree-ish",
diff --git a/perl/Git/SVN/Prompt.pm b/perl/Git/SVN/Prompt.pm
index e940b08..a94a847 100644
--- a/perl/Git/SVN/Prompt.pm
+++ b/perl/Git/SVN/Prompt.pm
@@ -2,7 +2,7 @@ package Git::SVN::Prompt;
use strict;
use warnings;
require SVN::Core;
-use vars qw/$_no_auth_cache $_username/;
+use vars qw/$_no_auth_cache $_username $_password/;
sub simple {
my ($cred, $realm, $default_username, $may_save, $pool) = @_;
@@ -17,8 +17,14 @@ sub simple {
} else {
username($cred, $realm, $may_save, $pool);
}
- $cred->password(_read_password("Password for '" .
- $cred->username . "': ", $realm));
+
+ if (defined $_password && length $_password) {
+ $cred->password($_password);
+ } else {
+ $cred->password(_read_password("Password for '" .
+ $cred->username . "': ", $realm));
+ }
+
$cred->may_save($may_save);
$SVN::_Core::SVN_NO_ERROR;
}
--
1.7.10.2 (Apple Git-33)
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH 2/2] Add SVN trust-server-cert parameter to git svn to accept SSL server certificates from unknwon authorities without prompting
2013-10-12 9:23 [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt arnaud.brejeon
@ 2013-10-12 9:23 ` arnaud.brejeon
2013-10-14 14:11 ` [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt Jonathan Nieder
1 sibling, 0 replies; 9+ messages in thread
From: arnaud.brejeon @ 2013-10-12 9:23 UTC (permalink / raw)
To: git; +Cc: arnaudbrejeon
From: arnaudbrejeon <arnaud.brejeon@gmail.com>
Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
---
git-svn.perl | 1 +
perl/Git/SVN/Prompt.pm | 9 ++++++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/git-svn.perl b/git-svn.perl
index 07f0a6c..3dfd4d3 100755
--- a/git-svn.perl
+++ b/git-svn.perl
@@ -124,6 +124,7 @@ $Git::SVN::Fetcher::_placeholder_filename = ".gitignore";
$_q ||= 0;
my %remote_opts = ( 'username=s' => \$Git::SVN::Prompt::_username,
'password=s' => \$Git::SVN::Prompt::_password,
+ 'trust-server-cert' => \$Git::SVN::Prompt::_trust_server_cert,
'config-dir=s' => \$Git::SVN::Ra::config_dir,
'no-auth-cache' => \$Git::SVN::Prompt::_no_auth_cache,
'ignore-paths=s' => \$Git::SVN::Fetcher::_ignore_regex,
diff --git a/perl/Git/SVN/Prompt.pm b/perl/Git/SVN/Prompt.pm
index a94a847..71459ad 100644
--- a/perl/Git/SVN/Prompt.pm
+++ b/perl/Git/SVN/Prompt.pm
@@ -2,7 +2,7 @@ package Git::SVN::Prompt;
use strict;
use warnings;
require SVN::Core;
-use vars qw/$_no_auth_cache $_username $_password/;
+use vars qw/$_no_auth_cache $_username $_password $_trust_server_cert/;
sub simple {
my ($cred, $realm, $default_username, $may_save, $pool) = @_;
@@ -32,6 +32,13 @@ sub simple {
sub ssl_server_trust {
my ($cred, $realm, $failures, $cert_info, $may_save, $pool) = @_;
$may_save = undef if $_no_auth_cache;
+
+ if ( defined $_trust_server_cert)
+ {
+ $cred->may_save($may_save);
+ return $SVN::_Core::SVN_NO_ERROR;
+ }
+
print STDERR "Error validating server certificate for '$realm':\n";
{
no warnings 'once';
--
1.7.10.2 (Apple Git-33)
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-12 9:23 [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt arnaud.brejeon
2013-10-12 9:23 ` [PATCH 2/2] Add SVN trust-server-cert parameter to git svn to accept SSL server certificates from unknwon authorities without prompting arnaud.brejeon
@ 2013-10-14 14:11 ` Jonathan Nieder
2013-10-14 18:40 ` Eric Wong
1 sibling, 1 reply; 9+ messages in thread
From: Jonathan Nieder @ 2013-10-14 14:11 UTC (permalink / raw)
To: arnaud.brejeon; +Cc: git, Eric Wong
Hi,
arnaud.brejeon@gmail.com wrote:
> Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
Thanks.
Can you say a little more about the context? Do you run a script that
wants to pass a password to 'git svn', do you type it each time on the
command line, or something else? Is it ok that the password would
show up in "ps" output? Would the platform's keyring or netrc be
usable here, or is there something in the context that avoids that?
> ---
> git-svn.perl | 3 +++
> perl/Git/SVN/Prompt.pm | 12 +++++++++---
> 2 files changed, 12 insertions(+), 3 deletions(-)
If we're going to do this, it would also need to be documented in
Documentation/git-svn.txt, and ideally tested in one of the t/t91*.sh
test scripts.
The implementation looks reasonable from a quick glance. Cc-ing
Eric for other comments.
Hope that helps,
Jonathan
(patch left unsnipped for reference)
> diff --git a/git-svn.perl b/git-svn.perl
> index ff1ce3d..07f0a6c 100755
> --- a/git-svn.perl
> +++ b/git-svn.perl
> @@ -123,6 +123,7 @@ sub opt_prefix { return $_prefix || '' }
> $Git::SVN::Fetcher::_placeholder_filename = ".gitignore";
> $_q ||= 0;
> my %remote_opts = ( 'username=s' => \$Git::SVN::Prompt::_username,
> + 'password=s' => \$Git::SVN::Prompt::_password,
> 'config-dir=s' => \$Git::SVN::Ra::config_dir,
> 'no-auth-cache' => \$Git::SVN::Prompt::_no_auth_cache,
> 'ignore-paths=s' => \$Git::SVN::Fetcher::_ignore_regex,
> @@ -206,6 +207,7 @@ my %cmd = (
> 'parents' => \$_parents,
> 'tag|t' => \$_tag,
> 'username=s' => \$Git::SVN::Prompt::_username,
> + 'password=s' => \$Git::SVN::Prompt::_password,
> 'commit-url=s' => \$_commit_url } ],
> tag => [ sub { $_tag = 1; cmd_branch(@_) },
> 'Create a tag in the SVN repository',
> @@ -214,6 +216,7 @@ my %cmd = (
> 'dry-run|n' => \$_dry_run,
> 'parents' => \$_parents,
> 'username=s' => \$Git::SVN::Prompt::_username,
> + 'password=s' => \$Git::SVN::Prompt::_password,
> 'commit-url=s' => \$_commit_url } ],
> 'set-tree' => [ \&cmd_set_tree,
> "Set an SVN repository to a git tree-ish",
> diff --git a/perl/Git/SVN/Prompt.pm b/perl/Git/SVN/Prompt.pm
> index e940b08..a94a847 100644
> --- a/perl/Git/SVN/Prompt.pm
> +++ b/perl/Git/SVN/Prompt.pm
> @@ -2,7 +2,7 @@ package Git::SVN::Prompt;
> use strict;
> use warnings;
> require SVN::Core;
> -use vars qw/$_no_auth_cache $_username/;
> +use vars qw/$_no_auth_cache $_username $_password/;
>
> sub simple {
> my ($cred, $realm, $default_username, $may_save, $pool) = @_;
> @@ -17,8 +17,14 @@ sub simple {
> } else {
> username($cred, $realm, $may_save, $pool);
> }
> - $cred->password(_read_password("Password for '" .
> - $cred->username . "': ", $realm));
> +
> + if (defined $_password && length $_password) {
> + $cred->password($_password);
> + } else {
> + $cred->password(_read_password("Password for '" .
> + $cred->username . "': ", $realm));
> + }
> +
> $cred->may_save($may_save);
> $SVN::_Core::SVN_NO_ERROR;
> }
> --
> 1.7.10.2 (Apple Git-33)
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-14 14:11 ` [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt Jonathan Nieder
@ 2013-10-14 18:40 ` Eric Wong
2013-10-14 22:36 ` Jeff King
0 siblings, 1 reply; 9+ messages in thread
From: Eric Wong @ 2013-10-14 18:40 UTC (permalink / raw)
To: Jonathan Nieder; +Cc: arnaud.brejeon, git
Jonathan Nieder <jrnieder@gmail.com> wrote:
> Hi,
>
> arnaud.brejeon@gmail.com wrote:
>
> > Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
>
> Thanks.
>
> Can you say a little more about the context? Do you run a script that
> wants to pass a password to 'git svn', do you type it each time on the
> command line, or something else? Is it ok that the password would
> show up in "ps" output? Would the platform's keyring or netrc be
> usable here, or is there something in the context that avoids that?
I think using keyring or netrc is more appropriate. Having a password
on the command-line and visible to all via ps doesn't seem like
something git should support.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-14 18:40 ` Eric Wong
@ 2013-10-14 22:36 ` Jeff King
2013-10-14 23:35 ` Eric Wong
0 siblings, 1 reply; 9+ messages in thread
From: Jeff King @ 2013-10-14 22:36 UTC (permalink / raw)
To: Eric Wong; +Cc: Jonathan Nieder, arnaud.brejeon, git
On Mon, Oct 14, 2013 at 06:40:05PM +0000, Eric Wong wrote:
> > arnaud.brejeon@gmail.com wrote:
> >
> > > Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
> >
> > Thanks.
> >
> > Can you say a little more about the context? Do you run a script that
> > wants to pass a password to 'git svn', do you type it each time on the
> > command line, or something else? Is it ok that the password would
> > show up in "ps" output? Would the platform's keyring or netrc be
> > usable here, or is there something in the context that avoids that?
>
> I think using keyring or netrc is more appropriate. Having a password
> on the command-line and visible to all via ps doesn't seem like
> something git should support.
Agreed. We have ready-made git-credential helpers to handle this exact
problem. We would need to convert SVN::Prompt to use git-credential
rather than prompting itself, though. One of the things that held me
back from writing such a patch is that I thought libsvn already handled
things like keychain integration, and it was better for git-svn to be
more svn-like than git-like in its access of SVN repos.
Are those already supported out of the box by libsvn? If git's
credential helpers are significantly more featureful, it might be worth
converting, but if not, I think it makes sense to stay with svn's
existing code.
-Peff
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-14 22:36 ` Jeff King
@ 2013-10-14 23:35 ` Eric Wong
2013-10-15 17:07 ` arnaud brejeon
2013-10-21 17:06 ` arnaud brejeon
0 siblings, 2 replies; 9+ messages in thread
From: Eric Wong @ 2013-10-14 23:35 UTC (permalink / raw)
To: Jeff King; +Cc: Jonathan Nieder, arnaud.brejeon, git, matthijs
Jeff King <peff@peff.net> wrote:
> On Mon, Oct 14, 2013 at 06:40:05PM +0000, Eric Wong wrote:
>
> > > arnaud.brejeon@gmail.com wrote:
> > >
> > > > Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
> > >
> > > Thanks.
> > >
> > > Can you say a little more about the context? Do you run a script that
> > > wants to pass a password to 'git svn', do you type it each time on the
> > > command line, or something else? Is it ok that the password would
> > > show up in "ps" output? Would the platform's keyring or netrc be
> > > usable here, or is there something in the context that avoids that?
> >
> > I think using keyring or netrc is more appropriate. Having a password
> > on the command-line and visible to all via ps doesn't seem like
> > something git should support.
>
> Agreed. We have ready-made git-credential helpers to handle this exact
> problem. We would need to convert SVN::Prompt to use git-credential
> rather than prompting itself, though. One of the things that held me
> back from writing such a patch is that I thought libsvn already handled
> things like keychain integration, and it was better for git-svn to be
> more svn-like than git-like in its access of SVN repos.
>
> Are those already supported out of the box by libsvn? If git's
> credential helpers are significantly more featureful, it might be worth
> converting, but if not, I think it makes sense to stay with svn's
> existing code.
I looks like this patch was forgotten once again:
http://mid.gmane.org/1371573490-21973-1-git-send-email-matthijs@stdin.nl
Matthijs: can you add a Signed-off-by for your patch? I'm inclined to
push it to Junio as-is since it looks reasonable.
I admit I don't know SVN callbacks anymore well enough and don't have
time to test with GNOME.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-14 23:35 ` Eric Wong
@ 2013-10-15 17:07 ` arnaud brejeon
2013-10-21 17:06 ` arnaud brejeon
1 sibling, 0 replies; 9+ messages in thread
From: arnaud brejeon @ 2013-10-15 17:07 UTC (permalink / raw)
To: Eric Wong; +Cc: Jeff King, Jonathan Nieder, git, matthijs
Le 15 oct. 2013 à 01:35, Eric Wong <normalperson@yhbt.net> a écrit :
> Jeff King <peff@peff.net> wrote:
>> On Mon, Oct 14, 2013 at 06:40:05PM +0000, Eric Wong wrote:
>>
>>>> arnaud.brejeon@gmail.com wrote:
>>>>
>>>>> Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
>>>>
>>>> Thanks.
>>>>
>>>> Can you say a little more about the context? Do you run a script that
>>>> wants to pass a password to 'git svn', do you type it each time on the
>>>> command line, or something else? Is it ok that the password would
>>>> show up in "ps" output? Would the platform's keyring or netrc be
>>>> usable here, or is there something in the context that avoids that?
>>>
>>> I think using keyring or netrc is more appropriate. Having a password
>>> on the command-line and visible to all via ps doesn't seem like
>>> something git should support.
>>
>> Agreed. We have ready-made git-credential helpers to handle this exact
>> problem. We would need to convert SVN::Prompt to use git-credential
>> rather than prompting itself, though. One of the things that held me
>> back from writing such a patch is that I thought libsvn already handled
>> things like keychain integration, and it was better for git-svn to be
>> more svn-like than git-like in its access of SVN repos.
>>
>> Are those already supported out of the box by libsvn? If git's
>> credential helpers are significantly more featureful, it might be worth
>> converting, but if not, I think it makes sense to stay with svn's
>> existing code.
>
> I looks like this patch was forgotten once again:
>
> http://mid.gmane.org/1371573490-21973-1-git-send-email-matthijs@stdin.nl
>
> Matthijs: can you add a Signed-off-by for your patch? I'm inclined to
> push it to Junio as-is since it looks reasonable.
> I admit I don't know SVN callbacks anymore well enough and don't have
> time to test with GNOME.
I wanted to provide some contexts, I should have done before.
I want to use git svn in some scripts that are launched un-attended. As my SVN server requires a password, I need to provide it but it can not be at user prompt.
This is why I wanted to add the password parameter that is available in svn CLI.
I understand the concern regarding the fact that the password can be retrieved through ps.
You are right, it would be better to be able to use git-credential or libsvn solution for this purpose.
Arnaud
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-14 23:35 ` Eric Wong
2013-10-15 17:07 ` arnaud brejeon
@ 2013-10-21 17:06 ` arnaud brejeon
2013-10-25 7:24 ` Jeff King
1 sibling, 1 reply; 9+ messages in thread
From: arnaud brejeon @ 2013-10-21 17:06 UTC (permalink / raw)
To: git@vger.kernel.org; +Cc: Jeff King, Jonathan Nieder, matthijs, Eric Wong
I played with GIT_ASKPASS and managed to get a fully automated behavior without any user prompt.
I guess that the patches are not necessary as we can provide the same , it is just less straightforward than direct parameters but I understand the security concerns.
I dont know if you plan to keep GIT_ASKPASS as is, but this environment variable is not mentioned on git svn documentation and I guess just a few people know about it. Moreover, the name is misleading as it handles all the prompts, not only the password one.
Arnaud
Le 15 oct. 2013 à 01:35, Eric Wong <normalperson@yhbt.net> a écrit :
> Jeff King <peff@peff.net> wrote:
>> On Mon, Oct 14, 2013 at 06:40:05PM +0000, Eric Wong wrote:
>>
>>>> arnaud.brejeon@gmail.com wrote:
>>>>
>>>>> Signed-off-by: Arnaud Brejeon <arnaud.brejeon <at> gmail.com>
>>>>
>>>> Thanks.
>>>>
>>>> Can you say a little more about the context? Do you run a script that
>>>> wants to pass a password to 'git svn', do you type it each time on the
>>>> command line, or something else? Is it ok that the password would
>>>> show up in "ps" output? Would the platform's keyring or netrc be
>>>> usable here, or is there something in the context that avoids that?
>>>
>>> I think using keyring or netrc is more appropriate. Having a password
>>> on the command-line and visible to all via ps doesn't seem like
>>> something git should support.
>>
>> Agreed. We have ready-made git-credential helpers to handle this exact
>> problem. We would need to convert SVN::Prompt to use git-credential
>> rather than prompting itself, though. One of the things that held me
>> back from writing such a patch is that I thought libsvn already handled
>> things like keychain integration, and it was better for git-svn to be
>> more svn-like than git-like in its access of SVN repos.
>>
>> Are those already supported out of the box by libsvn? If git's
>> credential helpers are significantly more featureful, it might be worth
>> converting, but if not, I think it makes sense to stay with svn's
>> existing code.
>
> I looks like this patch was forgotten once again:
>
> http://mid.gmane.org/1371573490-21973-1-git-send-email-matthijs@stdin.nl
>
> Matthijs: can you add a Signed-off-by for your patch? I'm inclined to
> push it to Junio as-is since it looks reasonable.
> I admit I don't know SVN callbacks anymore well enough and don't have
> time to test with GNOME.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt
2013-10-21 17:06 ` arnaud brejeon
@ 2013-10-25 7:24 ` Jeff King
0 siblings, 0 replies; 9+ messages in thread
From: Jeff King @ 2013-10-25 7:24 UTC (permalink / raw)
To: arnaud brejeon; +Cc: git@vger.kernel.org, Jonathan Nieder, matthijs, Eric Wong
On Mon, Oct 21, 2013 at 07:06:29PM +0200, arnaud brejeon wrote:
> I dont know if you plan to keep GIT_ASKPASS as is, but this
> environment variable is not mentioned on git svn documentation and I
> guess just a few people know about it. Moreover, the name is
> misleading as it handles all the prompts, not only the password one.
Yes, the "askpass" name is a little odd, but it is historical. The
calling convention was invented for ssh, who used that name (and we do
respect SSH_ASKPASS if it is set). Besides being a lousy name for
requesting non-password data, it's also a lousy program for doing it.
There's no way for the caller to specify "this is not a password", so
the program always hides the characters as they are typed. It's one of
the reasons the "git credential" subsystem was invented, which has a
more flexible interface.
The askpass variables are documented in "git help credentials". However,
the rest of that document does not apply to git-svn, which is unlike the
rest of git in the way it handles authentication. So it might or might
not make sense to point to it from the git-svn docs. Patches welcome if
you want to look into it.
-Peff
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2013-10-25 7:24 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-12 9:23 [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt arnaud.brejeon
2013-10-12 9:23 ` [PATCH 2/2] Add SVN trust-server-cert parameter to git svn to accept SSL server certificates from unknwon authorities without prompting arnaud.brejeon
2013-10-14 14:11 ` [PATCH 1/2] Add password parameter to git svn commands and use it when provided instead of defaulting to end-user prompt Jonathan Nieder
2013-10-14 18:40 ` Eric Wong
2013-10-14 22:36 ` Jeff King
2013-10-14 23:35 ` Eric Wong
2013-10-15 17:07 ` arnaud brejeon
2013-10-21 17:06 ` arnaud brejeon
2013-10-25 7:24 ` Jeff King
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).