Re: [PATCH]: Add --password-file and --password-envvar

2014-07-09 Thread Greg Stein
On Tue, Jul 8, 2014 at 7:14 AM, Branko Čibej br...@wandisco.com wrote: ... I just realized that even the variant without --force and with access to the may not always work. Consider what authenticate means in ra_serf: it would rely on issuing a request to the server that does not modify the

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-08 Thread Branko Čibej
On 07.07.2014 10:51, Julian Foad wrote: Branko Čibej wrote: On 07.07.2014 10:27, Julian Foad wrote: Aha! But Subversion already has a way to read authn creds from a file: --config-dir=x All we're lacking is a convenient way to put the required creds into the file. A user interface could

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-08 Thread Ben Reser
On 7/7/14 7:38 PM, Martin Furter wrote: On Linux I see only the environment of my own processes. On OpenBSD I see only HOME and PATH for other users. So envvar seems to not be less secure than a password file. Except that it shows in up for the root user for all commands regardless of user.

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Stefan Sperling
On Sun, Jul 06, 2014 at 08:43:06PM +0530, Martin Furter wrote: Resending my reply to the list too... I don't know a command which shows the environment of a process as nice as 'ps' shows the process arguments. ps -e on OpenBSD 5.3 used to show the environment of every process on the

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Julian Foad
Martin Furter wrote: For the file solution it might be more useful to use both username and password from that file. I guess the option should be named different then, maybe something like --auth-file or --creds-file or so. Aha! But Subversion already has a way to read authn creds from

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Branko Čibej
On 07.07.2014 10:27, Julian Foad wrote: Martin Furter wrote: For the file solution it might be more useful to use both username and password from that file. I guess the option should be named different then, maybe something like --auth-file or --creds-file or so. Aha! But Subversion

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Julian Foad
Branko Čibej wrote: On 07.07.2014 10:27, Julian Foad wrote: Aha! But Subversion already has a way to read authn creds from a file:   --config-dir=x All we're lacking is a convenient way to put the required creds into the file. A user interface could be:   svn auth authenticate

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Branko Čibej
On 07.07.2014 10:51, Julian Foad wrote: Branko Čibej wrote: On 07.07.2014 10:27, Julian Foad wrote: Aha! But Subversion already has a way to read authn creds from a file: --config-dir=x All we're lacking is a convenient way to put the required creds into the file. A user interface could

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Peter Samuelson
[Martin Furter] Attached is a log message and a patch which adds the new options '--password-file' and '--password-envvar'. I don't agree with --password-envvar. If we're going to support reading a password from the environment at all, just do what everyone always does with the environment:

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Ben Reser
On 7/6/14 5:16 AM, Martin Furter wrote: Attached is a log message and a patch which adds the new options '--password-file' and '--password-envvar'. It also adds Julians warning to the '--password' help text. I veto (-1) --password-envar (and peters follow-up suggestion of a hard-coded

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-07 Thread Martin Furter
Again reply to the list too :) GUI's which change buttons etc. depending on whatever they like are bad... On 07/08/14 08:02, Martin Furter wrote: On 07/08/14 03:33, Ben Reser wrote: On 7/6/14 5:16 AM, Martin Furter wrote: Attached is a log message and a patch which adds the new options

[PATCH]: Add --password-file and --password-envvar

2014-07-06 Thread Martin Furter
Attached is a log message and a patch which adds the new options '--password-file' and '--password-envvar'. It also adds Julians warning to the '--password' help text. I haven't found out yet how the test suite checks the '--password' option. So I tested it just by hand :) Also I added a

RE: [PATCH]: Add --password-file and --password-envvar

2014-07-06 Thread Bert Huijben
username and password from that file. Bert -Original Message- From: Martin Furter m...@apache.org Sent: ‎6-‎7-‎2014 14:16 To: dev@subversion.apache.org dev@subversion.apache.org Subject: [PATCH]: Add --password-file and --password-envvar Attached is a log message and a patch which adds the new

Re: [PATCH]: Add --password-file and --password-envvar

2014-07-06 Thread Martin Furter
Resending my reply to the list too... On 07/06/14 20:39, Martin Furter wrote: On 07/06/14 20:09, Bert Huijben wrote: I'm not sure if the envvar option is really any safer than the argument option, if the command line is really read from the environment block on these platforms. As such I