User masquerading - audit trail?

[Jeremy Lizakowski]

 >due to the hashes identifying not only a changeset itself but
 >all ancestors, this is also what becomes signed.

Interesting.  The user could sign just before push or pull, essentially 
signing a group of changesets.  As long as the string of changes were 
all made by the same person (or that's what they intend to claim) - that 
might work too.

 >in addition to the mentioned hook solution which would be the direct

I tried this, but it isn't working.  It is intended to require the 
commit before tip to be signed upon push, but I'm missing something:

.hgrc:
[hooks]
pretxncommit.signed = hg sigcheck $((`hg id -n`-1)) | grep -qv "is 
signed by"

That line of script works in bash by itself.
I added that both to the client (the pusher), and the server (pushee) 
.hgrc files (not sure which one is runnning the hook)

> AFAIK there is an extension for logging the ssh username for 
> each commit, maybe that's enough for you then?

Do you know the name of that?  I tried modifying hg-ssh to do this, but 
hit a some roadblocks (one being that I don't know python).  It doesn't 
handle pulls done outside of the central server, but it would be a step 
towards that goal.

Jeremy


Hans Meine wrote:
> Hi Jeremy,
>
> in addition to the mentioned hook solution which would be the direct answer to 
> your question, I have two more:
>
> On Wednesday 14 January 2009 04:41:22 Jeremy Lizakowski wrote:
>   
>> I have a solution to a problem posted back in October:  the ui.username
>> field is easily forgeable.  One solution was to use the GPG extension,
>> but this is not sufficient - contributors are unlikely to sign every
>> commit.
>>     
>
> It was mentioned in the past that this is probably not needed - due to the 
> hashes identifying not only a changeset itself but all ancestors, this is also 
> what becomes signed.
>
>   
>> I'm using hg-ssh to authenticate ssh sessions and limit shell access.
>>     
>
> AFAIK there is an extension for logging the ssh username for each commit, 
> maybe that's enough for you then?
>
> Greetings,
>   Hans
> _______________________________________________
> Mercurial mailing list
> Mercurial at selenic.com
> http://selenic.com/mailman/listinfo/mercurial
>