Re: [Cvs-dev] Re: cvs-passwd patch

[Mark D. Baushke]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

P J P <address@hidden> writes:

>    No, I didn't mean to give up! I thought, I'll skip the verification
> step, and do it the way CVSNT does. But no, I'll do the verification
> myself, as you suggested, by passing current password with the new
> one, in single connection...

If you use the 'passwd' protocol, then you may wish to still add the
supported_request("passwd-e") code and send the current password as an
option and refuse to perform the "cvs passwd" command if you are talking
with a CVSNT server which doesn't support the extra option. You will
probably also need to reject the password change of a CVSNT client that
is not sending you the old password. So, be sure to come up with good
error messages to let the user know what is happening.

To be honest, you will probably do better to choose to implement just a
"passwd-e" protocol rather than deal with any of the CVSNT compatibility
issues. That is probably an easier approach for maintaining your patch
going forward in any case. I would probably recommend against calling
the source 'passwd.c' and 'passwd.h' in case CVS ever chooses to
implement the CVSNT model.

Using something other than "passwd" will likely run prevent problems
when your code tries to deal with implementations of GUI clients which
violate the protocol you are trying to specify as 'better' than the
CVSNT model because they have just followed the CVSNT model.

Be advised that CVSNT also uses the CVS_GETPASS environment variable if
it exists as a way to obtain the password from the GUI programs that
interface with it (see cvstools/ProtocolLibrary.cpp in the CVSNT
sources). We never discussed things like connections with GUI interfaces
to CVS that are used. Things like cvsgui.sourceforge.net, eclipse.org
and others are of possible interest here.

I hope I have helped you with your design. I do regret that we seem not
to communicate very well. You have a lot of enthusiasm and it lets you
rush into a project and hack code quickly. The downside is that this can
lead to some design decisions that may be hard to maintain going
forward, so perhaps it is for the best that for now the patch will be
unofficial to allow you to changes things for the better without
necessarily having to live with any hasty decisions for the next twenty
years.

I suspect you know a great deal more about CVS internals of which you
were previously unaware. I hope you feel the time was well spent.

I think this probably needs to be our last private e-mail exchange. Feel
free to announce your new patches on the address@hidden site when
you are ready.

> Thank you Mark!

You are welcome.

        Best Wishes,
        -- Mark
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (FreeBSD)

iD8DBQFFSuTtCg7APGsDnFERAi5LAJ42CDhaFVdA47Ix9Cv177Foso4lCwCaAzbh
PkJ4Pr4OkN0/IxYzEk+yCrg=
=PIh9
-----END PGP SIGNATURE-----