User: stephent
Date: 09/04/17 15:11:37
Modified: xemacsweb/Develop ChangeLog hgaccess.content
Log:
Document hg "untrusted user" issue. <[email protected]>
Revision Changes Path
1.286 +5 -0 XEmacs/xemacsweb/ChangeLog
Index: ChangeLog
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacsweb/ChangeLog,v
retrieving revision 1.285
retrieving revision 1.286
diff -u -p -r1.285 -r1.286
--- ChangeLog 2009/04/15 19:16:01 1.285
+++ ChangeLog 2009/04/17 13:11:28 1.286
@@ -1,3 +1,8 @@
+2009-04-17 Stephen J. Turnbull <[email protected]>
+
+ * index.content (News): Document Mercurial upgrade and untrusted
+ user issue.
+
2009-04-15 Norbert Koch <[email protected]>
* index.content: New packages have been released (2009-02-17).
1.190 +8 -0 XEmacs/xemacsweb/index.content
Index: index.content
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacsweb/index.content,v
retrieving revision 1.189
retrieving revision 1.190
diff -u -p -r1.189 -r1.190
--- index.content 2009/04/15 19:16:01 1.189
+++ index.content 2009/04/17 13:11:29 1.190
@@ -109,6 +109,14 @@ Martin Buchholz
<dl>
<!-- one of (dd dt) -->
+ <dt><strong>2008-03-15</strong></dt>
+ <dd>
+ <p>Around this date, Debian upgraded Mercurial on Alioth (the
+ host for hg.xemacs.org), and tightened security somewhat.
+ <a href="Develop/hgaccess.html#trusted-users">How to tell
+ Mercurial to trust a developer.</a>
+ </p>
+ </dd>
<dt><strong>2008-02-10</strong></dt>
<dd>
<p>
1.112 +4 -0 XEmacs/xemacsweb/Develop/ChangeLog
Index: ChangeLog
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacsweb/Develop/ChangeLog,v
retrieving revision 1.111
retrieving revision 1.112
diff -u -p -r1.111 -r1.112
--- ChangeLog 2009/02/24 15:02:34 1.111
+++ ChangeLog 2009/04/17 13:11:36 1.112
@@ -1,3 +1,7 @@
+2009-04-17 Stephen J. Turnbull <[email protected]>
+
+ * hgaccess.content (trusted-users): Document issue.
+
2009-02-24 Stephen J. Turnbull <[email protected]>
* jobs.content: Add Vladimir Ivanovic as Reviewer.
1.5 +38 -0 XEmacs/xemacsweb/Develop/hgaccess.content
Index: hgaccess.content
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacsweb/Develop/hgaccess.content,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -p -r1.4 -r1.5
--- hgaccess.content 2008/06/24 07:03:05 1.4
+++ hgaccess.content 2009/04/17 13:11:36 1.5
@@ -9,6 +9,10 @@ Stephen J. Turnbull <[email protected]
<h1>XEmacs Mercurial Repository</h1>
+ <p>Debian has upgraded Mercurial, and security tightened somewhat.
+ <a href="#trusted-users">How to tell Mercurial to trust a
+ developer.</a></p>
+
<p>As of 5 December 2007, the development mainline (aka version
21.5) has been moved to a
<a href="http://hgbook.red-bean.com/hgbook.html">Mercurial</a>
@@ -38,6 +42,8 @@ Stephen J. Turnbull <[email protected]
<li><a href="#tutorial">Using the XEmacs Mercurial server</a></li>
+ <li><a href="#trusted-users">Trusting other users</a></li>
+
<li><a href="#tags">Tags: what they are and their use</a></li>
<li><a href="#packages">Packages info</a></li>
@@ -297,6 +303,38 @@ hg commit -m "Merge $date."
(WARNING: The above use of named branches is as yet untested by me!)
</pre>
+
+ <h3><a name="trusted-users">Do you have the paranoia blues?</a></h3>
+
+ <p>
+ Recent versions of Mercurial have had their security
+ consciousness strengthened. Specifically, when another user has
+ committed an hgrc to the repository you're pulling from, you may
+ get a message that looks like
+ </p>
+
+ <pre> xml:space="preserve">
+remote: not trusting file hg/xemacs/xemacs/.hg/hgrc from untrusted user sperber-guest, group xemacs
+ </pre>
+
+ <p>
+ In theory, Mike could cause execution of arbitrary code on your
+ box. But hey, what's to worry: you're already running Dired and
+ EFS, aren't you? Mike could have pwnzered you long ago, right?
+ So if you find that comforting, and you'd like to trust Mike,
+ run his workspace hgrc file in your xemacs workspace(s), and
+ incidentally suppress the warning, you can add
+ </p>
+
+ <pre> xml:space="preserve">
+[trusted]
+users = sperber-guest
+ </pre>
+
+ <p>
+ to your ~/.hgrc <strong>on alioth.debian.org</strong>. For more
+ information, see the Mercurial documentation.
+ </p>
<h3><a name="tags">Just how much do you want to bleed?</a></h3>
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.