views:

305

answers:

2

I need to write a shell script to be scheduled to run daily to backup a directory using mercurial. I have got most of the use cases done except I can figure out a way to do automated login while the script is running.

for REPOSITORY in $@ 
do
    cd $REPOSITORY

    # commit the changes
    hg commit -A -m "Commit changes `date`"

    # push the changes to the remote repository
    if hg push 
    then
        logger hg push success
    else
        logger hg push failure
    fi
done

the login prompt is displayed after the hg push command is issued.

+3  A: 

Mercurial allows you to put the username and password in the Repository URL:

hg push http://username:[email protected]/repo

If you don't want to put the URL on the command line you can edit the hgrc file for the local repository and put the username and password in the default-push URL:

default-push = http://username:[email protected]/repo

This means any hg push will use the username specified in the hgrc file.

Dave Webb
what are the potential security risk by doing this?! sorry for being paranoid...
Jeffrey04
Anyone who can read the file where you put the password - either th script or the hgrc - would have push access to the remote repository. They couldn't do permanent damage to your repository as you could always rollback any changes they sent but they could waste lots of your time and pollute the history of your source.
Dave Webb
+5  A: 

I agree that you should configure your backup script for non-interactive logins. One way is to use SSH keys and a simpler solution is to include the password directly in the URL.

Mercurial 1.3 makes it much easier to include HTTP passwords in your configuration files. I now have a

[auth]
bb.prefix = https://bitbucket.org/mg/
bb.username = mg
bb.password = pw

section in my configuration file. This means that you can avoid storing your passwords in multiple files and only concentrate on securing one file.

In fact, I am using another new feature in order to avoid putting the password in ~/.hgrc, since I might want to show that file to others. Instead I have

%include .hgauth

in ~/.hgrc and ~/.hgauth has the above [auth] section and is readable by me alone.

Martin Geisler