[PD-dev] how to authenticate commits in SVN?

[Hans-Christoph Steiner]

On Feb 13, 2008, at 2:59 AM, IOhannes m zmoelnig wrote:

> hi miller, matju, all!
>
> Miller Puckette wrote:
>> However, I don't have a password (only ssl auth, if even that
>> exists in the same form) ... anyway to change SVN authentification
>> methods in midstream?
>>
>> And/or should I just get an old-fashioned password from Iohannes?
>>
>
> unfortunately _i_ cannot give you a password.
>
> fortunately it is not that complicated.
> the password is (tada:) your sourceforge-password (with the  
> sourceforge
> username of course); this is the very same password as the one you are
> using to log into the bug-tracker.
>
> unlike CVS, svn does not use ssh as backend for encrypted transport.
> instead it uses http(s) (in our case it _does_ use https, i just
> mentioned http for completeness); as a consequence, there is no more
> ssl-key exchange for authentication.
>
> rather, subversion caches your password on filesystem (once you have
> entered it correctly), so you don't have to re-enter it again and  
> again.
>
> to prevent caching (e.g. because you are on an untrusted machine), you
> can use the "--no-auth-cache" flag when committing.

I believe that like CVS, SVN uses other things to handle network  
communications.  It relies on an external webserver to provide http/ 
https support, and it has a command line version, so you can use ssh  
with svn if the server is setup for it, I believe it's called "svn 
+ssh", i.e. svn+ssh://pure-data.svn.sourceforge.net.  It just seems  
that SourceForge doesn't use that kind of setup.

SSH keys are great and quite secure.  The idea of password caching  
kind of sucks (just like with CVS ;) Any word on how (in)secure that  
password caching is?

.hc



------------------------------------------------------------------------ 
----

All mankind is of one author, and is one volume; when one man dies,  
one chapter is not torn out of the book, but translated into a better  
language; and every chapter must be so translated.... -John Donne