Re: [PATCH]: Add --password-file and --password-envvar

2014-07-09 Thread Greg Stein
On Tue, Jul 8, 2014 at 7:14 AM, Branko Čibej wrote: >... > I just realized that even the variant without --force and with access to > the may not always work. Consider what "authenticate" means in ra_serf: > it would rely on issuing a request to the server that does not modify > the repository, b

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-08 Thread Ben Reser
On 7/7/14 7:38 PM, Martin Furter wrote: >> On Linux I see only the environment of my own processes. On OpenBSD I >> see only HOME and PATH for other users. So envvar seems to not be less >> secure than a password file. Except that it shows in up for the root user for all commands regardless of use

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-08 Thread Branko Čibej
On 07.07.2014 10:51, Julian Foad wrote: > Branko Čibej wrote: >> On 07.07.2014 10:27, Julian Foad wrote: >>> Aha! But Subversion already has a way to read authn creds from a file: >>> >>> --config-dir=x >>> >>> All we're lacking is a convenient way to put the required creds into >>> the file. A

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Martin Furter
Again reply to the list too :) GUI's which change buttons etc. depending on whatever they like are bad... On 07/08/14 08:02, Martin Furter wrote: On 07/08/14 03:33, Ben Reser wrote: On 7/6/14 5:16 AM, Martin Furter wrote: Attached is a log message and a patch which adds the new options '--pas

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Ben Reser
On 7/6/14 5:16 AM, Martin Furter wrote: > Attached is a log message and a patch which adds the new options > '--password-file' and '--password-envvar'. It also adds Julians warning to the > '--password' help text. I veto (-1) --password-envar (and peters follow-up suggestion of a hard-coded enviro

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Peter Samuelson
[Martin Furter] > Attached is a log message and a patch which adds the new options > '--password-file' and '--password-envvar'. I don't agree with --password-envvar. If we're going to support reading a password from the environment at all, just do what everyone always does with the environment:

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Branko Čibej
On 07.07.2014 10:51, Julian Foad wrote: > Branko Čibej wrote: >> On 07.07.2014 10:27, Julian Foad wrote: >>> Aha! But Subversion already has a way to read authn creds from a file: >>> >>> --config-dir=x >>> >>> All we're lacking is a convenient way to put the required creds into >>> the file. A

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Julian Foad
Branko Čibej wrote: > On 07.07.2014 10:27, Julian Foad wrote: >> Aha! But Subversion already has a way to read authn creds from a file: >> >>   --config-dir=x >> >> All we're lacking is a convenient way to put the required creds into >> the file. A user interface could be: >> >>   svn auth auth

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Branko Čibej
On 07.07.2014 10:27, Julian Foad wrote: > Martin Furter wrote: > For the file solution it might be more useful to use both username and password from that file. >>> I guess the option should be named different then, maybe something like >>> --auth-file or --creds-file or so. > Aha! Bu

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Julian Foad
Martin Furter wrote: >>> For the file solution it might be more useful to use both username and >>> password from that file. >> >> I guess the option should be named different then, maybe something like >> --auth-file or --creds-file or so. Aha! But Subversion already has a way to read authn

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Stefan Sperling
On Sun, Jul 06, 2014 at 08:43:06PM +0530, Martin Furter wrote: > > Resending my reply to the list too... > > >I don't know a command which shows the environment of a process as nice > >as 'ps' shows the process arguments. ps -e on OpenBSD < 5.3 used to show the environment of every process on th

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-06 Thread Martin Furter
Resending my reply to the list too... On 07/06/14 20:39, Martin Furter wrote: On 07/06/14 20:09, Bert Huijben wrote: I'm not sure if the envvar option is really any safer than the argument option, if the command line is really read from the environment block on these platforms. As such I don't

RE: [PATCH]: Add --password-file and --password-envvar

2014-07-06 Thread Bert Huijben
I'm not sure if the envvar option is really any safer than the argument option, if the command line is really read from the environment block on these platforms. As such I don't think having a command option for that really helps. For the file solution it might be more useful to use both usernam