On Wed, Mar 16, 2011 at 5:08 PM, Jan Danielsson <jan.m.daniels...@gmail.com> wrote: > I need to read up on ~/.fossil and _FOSSIL_ though to see if there's > any risk of accidental information leak when pushing/pulling. The > question is if the client key should be stored in the database, or if > it's safer to store a reference to it instead, and keep the actual key > outside (in the file system).
I would keep the certs, themselves, completely outside of Fossil or any other VCS, just storing paths to the files containing the certs. Even the public certs. The public certs you use are your means for authenticating who you trust. You want to be very careful accepting them. > On that note.. Planning a little bit further into the future here. Is > anyone interested in "full" support for PKI in fossil? For instance, > signing commits using a client key belonging to a certificate Signing commits is a good idea. I would recomend invoking gpg (or other crypto tool) to generate and validate signatures, rather than even using a library. Tools like gpg receive a huge amount of scrutiny, so it is very probably safer than performing those functions in Fossil. I know this goes against the Fossil philosophy of providing a single, self-contained executable, but this is one area where using a dedicated, purpose-made tool for the job makes sense. _______________________________________________ fossil-users mailing list fossil-users@lists.fossil-scm.org http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
