Re: [PATCH] Authentication support for pserver

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Dec 18, 2007, 21:10 UTC
Message-ID: <51dd1af80712181310q38255593t989be64799be2e0e@mail.gmail.com>
In-Reply-To: <46a038f90712181238p7529a02bmde21c89956a3f641@mail.gmail.com>

On Dec 18, 2007 8:38 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:

Show 9 quoted lines

> On Dec 18, 2007 10:41 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:
> >  - git/config is very likely to be readable if the site is served via
> > other means, like dumb http protocol, or git+ssh. So even if the
> > password scrambling is mickey-mouse. it might make sense to force the
> > password data to live elsewhere.
>
> On this aspect, I see no reason why we wouldn't have the passwords
> crypt()ed or SHA1'd. Perl includes crypt() in the default
> distribution, so it wouldn't add any dependency.

It also includes Digest::SHA in the default distribution as of today:)

I could add another option for allowing users to choose their password storage, e.g.:

[gitcvs]
    password_storage = plaintext # or sha1, crypt, ...