Merge lp:~gz/bzr/Base64CredentialStore into lp:bzr

[Martin Packman]

Add Base64CredentialStore for authentication.conf password obfuscation

[Martin Packman (gz)]

sent to pqm by email

=== modified file 'bzrlib/config.py'
--- bzrlib/config.py	2012-07-20 15:46:59 +0000
+++ bzrlib/config.py	2012-07-28 15:30:29 +0000
@@ -81,6 +81,7 @@
 from bzrlib.decorators import needs_write_lock
 from bzrlib.lazy_import import lazy_import
 lazy_import(globals(), """
+import base64
 import fnmatch
 import re
 
@@ -2131,6 +2132,19 @@
 credential_store_registry.default_key = 'plain'
 
 
+class Base64CredentialStore(CredentialStore):
+    __doc__ = """Base64 credential store for the authentication.conf file"""
+    
+    def decode_password(self, credentials):
+        """See CredentialStore.decode_password."""
+        # GZ 2012-07-28: Will raise binascii.Error if password is not base64,
+        #                should probably propogate as something more useful.
+        return base64.decodestring(credentials['password'])
+
+credential_store_registry.register('base64', Base64CredentialStore,
+                                   help=Base64CredentialStore.__doc__)
+
+
 class BzrDirConfig(object):
 
     def __init__(self, bzrdir):

=== modified file 'bzrlib/tests/test_config.py'
--- bzrlib/tests/test_config.py	2012-07-21 02:00:58 +0000
+++ bzrlib/tests/test_config.py	2012-07-28 15:30:29 +0000
@@ -15,17 +15,16 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 
 """Tests for finding and reading the bzr config file[s]."""
-# import system imports here
+
+import base64
 from cStringIO import StringIO
 from textwrap import dedent
 import os
 import sys
 import threading
 
-
 from testtools import matchers
 
-#import bzrlib specific imports here
 from bzrlib import (
     branch,
     config,
@@ -4842,6 +4841,15 @@
         self.assertEquals('secret', decoded)
 
 
+class TestBase64CredentialStore(tests.TestCase):
+
+    def test_decode_password(self):
+        r = config.credential_store_registry
+        plain_text = r.get_credential_store('base64')
+        decoded = plain_text.decode_password(dict(password='c2VjcmV0'))
+        self.assertEquals('secret', decoded)
+
+
 # FIXME: Once we have a way to declare authentication to all test servers, we
 # can implement generic tests.
 # test_user_password_in_url

=== modified file 'doc/developers/authentication-ring.txt'
--- doc/developers/authentication-ring.txt	2010-11-12 22:46:28 +0000
+++ doc/developers/authentication-ring.txt	2012-07-28 15:30:29 +0000
@@ -158,7 +158,7 @@
 
 Encoding passwords in ``base64``, while weak, provides protection against
 accidental reading (if an administrator have to look into the file, he will not
-see the passwords in clear).(Not implemented yet).
+see the passwords in clear).
 
 This specification intends to ease the authentication providing, not to secure
 it in the best possible way.
@@ -266,6 +266,7 @@
         scheme=https
         host=home.net
         user=joe
+        # Obtain the base64 encoded password by running 'echo -n "secret-pass" | base64'
         password='c2VjcmV0LXBhc3M='
         password_encoding=base64
         verify_certificates=no # Still searching a free certificate provider

=== modified file 'doc/en/release-notes/bzr-2.6.txt'
--- doc/en/release-notes/bzr-2.6.txt	2012-07-28 14:46:45 +0000
+++ doc/en/release-notes/bzr-2.6.txt	2012-07-28 15:30:29 +0000
@@ -28,6 +28,9 @@
 specified, not the branch you use.  This was enabled by a new API call in
 Launchpad's web service.  (Aaron Bentley)
 
+* Implement authentication.conf password obfuscation, the password_encoding
+  option can now be set to base64. (Florian Dorn)
+
 Bug Fixes
 *********