[ANN] autosign extension

[Martin Geisler]

Hi everybody,

I've updated the autosign extension to sign the whole changeset (commit
message, username, date, changeset parents, changed files, and changeset
manifest).

So please go test it:

  http://bitbucket.org/mg/autosign/src/tip/autosign.py

You can verify some or all signatures with 'hg checksigs'. This looks
like this:

  85:286738f92d3f: ** no signature
  86:bc7de65702b7: ** bad signature on 1e9a254defd6
  87:88f1c9bc2f9a: good signature

and could probably use some improvements. Also, calling it 'verifysigs'
might be a better name?

Unlike the gpg extension there is no support for changing signing keys
or the path to gpg -- we should probably add that.

When I started I of course figured that I would combine this with the
gpg extension, but haven't done so yet. One reason is that I want this
to support signatures made by other programs and mechanisms (say, X.509
certs via openssl) and then the name 'gpg' is a misnormer :-)

Another reason is that, the 'gpg' extension has a lot of infrastructure
for collecting all signatures on each changeset and for reading the
.hgsigs file -- this is not needed for this extension. So I don't know
if we should merge them or not.

Feel free to come up with a good way to support other programs and write
some nice test cases for it! I don't think I'll be doing that, so here's
your chance :-)

-- 
Martin Geisler

VIFF (Virtual Ideal Functionality Framework) brings easy and efficient
SMPC (Secure Multiparty Computation) to Python. See: http://viff.dk/.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : http://selenic.com/pipermail/mercurial/attachments/20090513/fd030d18/attachment.pgp