Subversion and the GNOME Keyring


Login or Register to Reply

 
Thread Tools Search this Thread
# 1  
Old 04-11-2011
Java Subversion and the GNOME Keyring

The reason I'm posting this message is because I've written a Korn shell script that will be of use to those people who use the Subversion client on Linux or Solaris and would like their passwords to be encrypted. I realise this isn't strictly a question or matter concerning shell scripts, but as this is a very useful script I couldn't think of anywhere better to post it so that the wider community can make use of it.

I wrote it in Korn shell because I needed something up and running quickly. If someone else would prefer it written an A. N. Other favourite language (perl, python, ruby, prose, you name it), please feel free to write a port.

For a background of the task at hand, see http://technicalprose.blogspot.com/2...e-keyring.html. What the attached script will do is act as a wrapper for the 'svn' tool, starting the 'gnome-keyring-daemon' on your behalf and managing the set-up of the keyring. This is needed on servers where the GNOME Desktop is not installed. Using this script and the process I've documented below will save you hours of pain (the pain I've already had to go through).

Initial Set-up

Steps to get this working if your login shell is bash:
  1. Install CollabNet Subversion v1.6.x or later client on Linux or Solaris (I've tested this on v1.6.16), which has built-in GNOME Keyring support.
  2. Install the GNOME Keyring daemon (e.g. gnome-keyring RPM on Red Hat, on Solaris this requires the SUNWgnome-base-libs and SUNWgnome-libspackages only, you can safely ignore the other dependencies).
  3. Install the attached wrapper script as /opt/CollabNet_Subversion/bin/svn_wrapper.
  4. Add the following line to your ~/.bash_login and ~/.bashrc files which will set-up an 'svn' alias so that the wrapper script is called instead:
    [ -x /opt/CollabNet_Subversion/bin/svn_wrapper ] && alias svn=/opt/CollabNet_Subversion/bin/svn_wrapper
  5. Add the following line to your ~/.bash_logout file, which will kill the GNOME Keyring daemon on exit if you have no further login sessions:
    [ -x /opt/CollabNet_Subversion/bin/svn_wrapper ] && /opt/CollabNet_Subversion/bin/svn_wrapper --gkd-logout
  6. Logout/login again to pick up the changes to your login script.
  7. Run svn --gkd-help to confirm that the wrapper script is being called. This will also display further details about the wrapper script that is of use.
  8. Edit ~/.subversion/config and set the following parameter in the [auth] section:
    password-stores = gnome-keyring
  9. Edit ~/.subversion/servers and set the following parameters in the [global] section:
    store-passwords = yes
    store-plaintext-passwords = no
  10. To remove any previously cached plain-text passwords and cache your encrypted password, run svn --gkd-clear followed by svn up in a checked-out folder.
When you invoke the 'svn up' command above, if the GNOME Keyring Daemon is not already running, it will be started by the wrapper script. You'll be prompted for the GNOME Keyring password. If this is the first time you've run the daemon, pick any password. This password is used to encrypt the keyring, and you'll be prompted for it once per session. A session lasts as long as you have a login on that server (as reported by the UNIX 'w' command).

Note that the wrapper script actually sets up one keyring per OS platform, so if you run 'svn' on both Linux and Solaris clients and automount your home directories between the two, there will be a keyring called 'svn_linux' and one called 'svn_sunos' in ~/.gnome2/keyrings. This is required to work around an incompatibility between keyrings on different platforms, as each platform provides its own version of the GNOME Keyring. This could be mitigated by compiling the same version of the GNOME Keyring for each platform you wish to support, although I've not tested that.

When Your Password Changes

If the password cached in the GNOME Keyring needs to be changed, run svn --gkd-clear followed by svn up in a checked-out folder. This will clear all passwords currently cached by the Subversion client, and then re-cache your new password.

Changing the Keyring Password

If you would like to change the password you are using to encrypt your GNOME Keyring, run rm ~/.gnome2/keyrings/svn* to delete the old 'svn' keyrings, then --gkd-clear followed by svn up in a checked-out folder.

I hope this script is of use to the wider community.

Best regards,
Mark Bannister.

Last edited by cambridge; 06-16-2011 at 10:11 AM.. Reason: Update link to blog article
These 3 Users Gave Thanks to cambridge For This Post:
Ding (08-26-2013) RickPDX (08-06-2014) Roturgo (07-21-2011)
# 2  
Old 05-20-2011
Amended with fix for >9 arguments

I've amended my original svn_wrapper script with a minor fix for handling greater than 9 arguments. Please find attached.

Best regards,
Mark Bannister.
These 4 Users Gave Thanks to cambridge For This Post:
cpk4 (08-23-2011) Dennis McRitchi (09-08-2011) pjaytycy (01-06-2012) Roturgo (07-21-2011)
# 4  
Old 09-12-2011
Lightbulb

Quote:
Here's your script with the additional configuration test I mentioned on your blog.
Thanks Dennis. Although I am sure there are other ways of disabling the authentication cache if you're not using Subversion client default settings, e.g.
Code:
store-auth-creds = no

Rather than write in lots of checks and measures I assume my steps 2-10 occur immediately after step 1, i.e. you are using a default installation of the Subversion client and not one with a tinkered configuration Smilie
# 5  
Old 09-12-2011
Good point.

Nonetheless since I would imagine that others, like me, might want to start using your very useful script after having used the svn client for a while, it is probably good that this exchange has resulted in your assumption being explicitly stated. It might save others the hours I spent trying to get the keyring working. Smilie

Thanks again for a very well-written script!

Dennis
Login or Register to Reply

|
Thread Tools Search this Thread
Search this Thread:
Advanced Search

More UNIX and Linux Forum Topics You Might Find Helpful
Backup & restore Gnome Desktop and all settings in Gnome ccc Shell Programming and Scripting 0 06-09-2012 09:20 PM
Subversion Timestamp Issue tanlccc Red Hat 0 09-26-2011 09:19 PM
About Apache Subversion kidzer0 Web Development 0 09-04-2010 11:56 AM
Install of Subversion on AIX saddlerken AIX 1 02-11-2009 08:25 PM
KDevelop And Subversion hotjava Linux 0 10-19-2008 07:43 AM
Install of Subversion on AIX saddlerken AIX 0 07-27-2007 04:35 AM
Binaries/Depot for Subversion 1.4.3 for HP/UX 11.11 spud HP-UX 3 03-29-2007 10:27 AM
subversion installation problem ECBROWN Solaris 2 02-15-2005 07:17 PM
Looking for a subversion GUI for Solaris 9 ECBROWN Solaris 1 01-30-2005 06:07 PM
Subversion ECBROWN Linux 4 01-19-2005 09:33 AM