2

We have a script that auto-deploys (e.g updates) our code. How should it authenticate? should we create a user for it (we do not want to use one of our usernames and passwords, obviously)? Or is there a way to specify this project as readable without the need to authenticate?

flag

1 Answer

1

Have you considered using KilnAuth, available from the Resources/Kiln Client and Tools page of Kiln?

KilnAuth saves an authentication cookie, not your actual username or password, so that is never exposed. The cookie is saved to .hgcookies or _hgcookies in your home directory.

While there is still authentication involved (and a cookie that you want to protect), it’s far preferable to storing your username/password or to making the repository world-readable.

link|flag
it doesn't sound like the ideal solution - why should anyone in my team put their uname and pwd there, thus allowing for other people to push from that machine under his name? – noam Jun 14 2010 at 23:41
One way to deal with that is to create a “deploy” user. You would still want to use KilnAuth, because you don’t want to expose even the deploy user’s password. However, keep in mind that would use up one of your Kiln user licenses. If the auto-deploy platform is a secured server—as it should be—then using a real person’s username/password shouldn’t be too big of a deal (with KilnAuth, so their password isn’t available on the deploy system). – Nate Jun 14 2010 at 23:56
@Nate - I still think that this is not a real solution for the problem. wasting a license on a virtual user? that really is an overkill ("if the ashtray in your car is full, just buy a new car"). I think the proper solution is to allow virtual users to deploy. – noam Jun 15 2010 at 7:59
You should definitely add that as a feature request (here: kiln.stackexchange.com/questions/1130/…) so the Fog Creek employees will see it. – Nate Jun 15 2010 at 15:51

Your Answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.