...

The passwords setting

The passwords setting defines a path to the passwords file that can contain the list of username-password pairs to log in to a Subversion repository. The path can be either absolute or relative to the Git repository.

...

Using credential helper programs

SubGit supports credential helper programs to obtain the authentication data to log in to a Subversion repository. A credential helper program is a script that fetches credentials from the external sources, for example, from LDAP catalogs, authentication servers or databases.

To enable a credential helper program, specify the following setting:

[auth "default"]
credentialHelper = PATH [args]

The credentialHelper setting defines a path to a credential helper program and its optional arguments. The path can be either absolute or relative to the Git repository.

The initial SubGit configuration places the sample credential helper script (the credentialHelper.sh file) to the subgit/samples directory in the Git repository.

The initial script contains the following:

#!/bin/sh
 
echo username=svnUser
echo password=svnPassword
 
exit 0;

You can configure this script to fetch the credentials from some external source to log in to a Subversion repository. Use the standard Git credential helper input/output format with the exception that the command name is not required.

Input:

url = SVN_URL
protocol = SVN_URL_PROTOCOL
path = SVN_URL_PATH
username = PREFFERED_SVN_USER_NAME

Output:

username = SVN_USER_NAME
password = SVN_PASSWORD

Using the Subversion credentials cache

SubGit can refer to the Subversion credentials cache to log in to a Subversion repository.

To enable the authentication with Subversion credentials cache, specify the following settings:

[auth "default"]
subversionConfigurationDirectory = PATH
useDefaultSubversionConfigurationDirectory = [true | false]

The subversionConfigurationDirectory setting defines a path to a Subversion directory that stores cached credentials.

The useDefaultSubversionConfigurationDirectory setting specifies whether SubGit will use the default Subversion configuration directory to obtain the authentication data or not.

The location of the default Subversion configuration directory and the way the cached credentials are stored in it depend on the operating system that you use. The usual configuration is the following:

• On Windows
  

Subversion clients store encrypted passwords in the %APPDATA%\Subversion\auth\svn.simple directory. Passwords are encrypted by the standard Windows cryptographic services.

• On Mac OS X
  

The Subversion authentication realm and usernames are stored in the ~/.subversion/auth/svn.simpledirectory. The encrypted passwords are stored in macOS Keychain.

• On Unix-like operating systems
  

By default, Subversion clients ask permission to store unencrypted passwords in the ~/.subversion/auth/svn.simple directory. The secure storage can be provided by the GNOME Keyring, KDE Wallet or GnuPG Agent services.

The example below shows how to use the Subversion credentials cache with encrypted passwords on Linux.

Example 1. Use of credentials cache with encrypted passwords on Linux

All the passwords stores are disabled in the Subversion configuration file:

[auth]
    ### Set password stores used by Subversion. They should be
    ### delimited by spaces or commas. The order of values determines
    ### the order in which password stores are used.
    ### Valid password stores:
    ###   gnome-keyring        (Unix-like systems)
    ###   kwallet              (Unix-like systems)
    ###   gpg-agent            (Unix-like systems)
    ###   keychain             (Mac OS X)
    ###   windows-cryptoapi    (Windows)
    # password-stores = gpg-agent,gnome-keyring,kwallet
    ### To disable all password stores, use an empty list:
    # password-stores =

1. To enable a password store, in the Subversion configuration file, uncomment a password-stores line and specify the store that you want to enable.

   
   

   Note
   Currently, SubGit supports only GNOME Keyring.

   For example, password-stores = gnome-keyring

2. In a Subversion client, run any command that prompts for the credentials to a Subversion server, for example, svn info url.  After that the credentials cache is stored in a text file in the ~/.subversion/auth/svn.simpledirectory. The encrypted password is stored in GNOME keyring.

SubGit can use the credentials cache from this directory to log in to a Subversion repository.

Using the SSL client certificate authentication

If you want to use the SSL client certificate authentication to access a Subversion repository, specify the following settings:

[auth "default"]
sslClientCertFile = PATH
sslClientCertPassphrase = passphrase

The sslClientCertFile setting defines a path to the SSL client certificate file in PKSC#12 format. The path can be either absolute or relative to the Git repository.

The sslClientCertPassphrase setting specifies a passphrase that can be optionally used to protect the SSL certificate.

A web server that hosts a Subversion repository can be configured to request a username and password after the authentication with an SSL client certificate. For the information on the settings that you can use to specify a username and password, see the Specifying a username and a password section.

The other way to specify a path to an SSL client certificate and an optional passphrase is the the Subversion  servers file that is located in the default Subversion configuration directory. (Add link to ⚓)

 [global]
 ssl-client-cert-file = PATH
 ssl-client-cert-password = passphrase

In this case, no additional settings are required in the [auth "default"] section of the SubGit configuration file. SubGit refers to the servers file for an SSL certificate to log in to a Subversion repository.

If a web server that hosts a Subversion repository along with an SSL client certificate requires a username and a password for authentication, SubGit refers to the servers configuration file for an SSL certificate and uses the Subversion credentials cache to log in to a Subversion repository. To specify the settings that fetch the Subversion credentials cache, see the Using the Subversion credentials cache section.