.htaccess : allow download of Mercurial archive but only that

Question

Hello,

I was fairly happy with my Mercurial setup until now. I use it for personal projects and it is hosted on a shared server at OVH (a French hosting provider).

Currently, I have a .htaccess to protect my projects and only allow certain people to pull/push from my repositories. However, I would like to make the changesets archives public.

The URLs look like this :

http://domain/hg/projectname/archive/486e5be13c82.tar.bz2
http://domain/hg/projectname/archive/tip.tar.bz2

My .htaccess looks like this :

AuthUserFile /home/******/.hgusers
AuthName "Mercurial"
AuthType Basic

Order allow,deny
Allow from all

Require valid-user

And I would like to have the archive URLs to not ask a username/password. I don't mind using mod_rewrite for that. Thanks!

Remi Gillig.

Answer 1

If you allow public access to all the changeset tarballs, then I suggest simply making the repository public (without allowing push, obviously). That is quite simple: hg push is done with a POST HTTP request, so you only need to Require valid-user for that. See also the wiki.

My thinking is that by giving people access to the tarballs, you have effectively given them access to the entire repository with the exception of the commit messages. So the cleanest solution is probably to just admit that and only restrict hg push :-)

Apart from that piece of wanna-be advice, I suggest you look at the <Location> and <LocationMatch> directives if you have access to a system-wide configuration file for Apache (they cannot be put in a .htaccess file). I'm not a big Apache guru, so sorry for not giving you a ready-made rule you can insert.