SVN commit from bash script WITHOUT a password

Question

I have a bash script that needs to check in the result of a test into SVN. Problem is that whenever I commit to svn, it requires a user name and password which I really REALLY don't want to include into my script. I am fairly new to Linux/Cygwin land so I am aware there may be something obvious....

I am using cygwin on a windows 8 box

Answer 1

There isn't anything obvious, per se. But here are some ideas:

1. When I had a script at work that needed access to svn, I created a new username just for the script, and had the script know how to calculate the password. It's security by obscurity, which isn't secure, but it kept the casual onlooker from determining the password. (And since any coworkers that would have access to the script also have their own subversion logins, it's really not a security risk.)

2. Something I hadn't thought of when I made my script, but might work: if you can restrict access to a file so that only your cygwin and/or windows user has read-access to a secret key file, your script could use gpg with that key to encrypt/decrypt a file containing scriptusername's password, and use that to access svn. I don't know that that's really any more secure than the first or second option, because you'd have to have the secret key not have a password (otherwise you're in the identical situation to the )

3. If you trust svn to store passwords, you could use the scriptusername once, have it store the password, and have the script access svn that way.

You might want to see if https://stackoverflow.com/questions/3824513/svn-encrypted-password-store and/or What's the best way to store an encrypted svn password on Ubuntu Server? can help you store the password encrypted rather than plaintext. At my work, svn was not compiled with gnome-keyring or kwallet support, so I wasn't able to try it out to give you more details on how. But I would think that cygwin's svn would have them compiled in, or you could recompile.

I think that svn --version will tell you if gnome-keyring or kwallet are compiled in; if not, you could also 'ldd which svn', which will list all linked libraries. Look for something like libsvn_auth_gnome_keyring-1.so or presumably similar for kwallet. (thanks http://blogs.collab.net/subversion/subversion-16-security-improvements#.Vkan8b9mpu8 and http://technicalprose.blogspot.com/2011/06/using-subversion-with-gnome-keyring.html)