SoundSoftware Code Site

We have archive downloads already through hgweb.

We want the following adjustments to httpd config:

• Avoid redirecting to https in cases where a login is not required
• Use content type discrimination to redirect to Redmine when hgweb pages are requested through a browser (this has been a desirable thing for a while, might as well roll them together)
• Also any fixes required to avoid information leakage on nonexistent projects.

And then we need an extension (to the checkout plugin?) to synthesise an archive URL for a project based on its checkout URL and show it.

So, we need:

1. Apache config stops redirecting all hg traffic to https
2. hg auth Apache module redirects to https before auth, only if auth required
3. also, hg auth Apache module insists on auth before revealing project is nonexistent
4. Apache config redirects all /hg/X to /projects/X/repository when HTML is requested? How to deal with e.g. /hg/X/rev/Y or /hg/X/archive/Y?

OK, we have 1-3, more or less, in 897bc2b63bfe. But there's a catch.

The way it's now set up, hg connections initiated with an http URL are made through http until something requires authentication, and then the module redirects to https.

But if you are using a public project repository then the only things that require authentication will be the read-write methods (POST etc), so if you issue an hg push through an http URL, the first time the module will issue a redirect will be on the POST request that follows the initial fact-finding GETs. And that will fail, because (even with a 307) Mercurial refuses to redirect for POST. Result: push fails with the incomprehensible message "Abort: HTTP Error 307: Temporary Redirect" (or something else equally arcane depending on the server's choice of redirect code).

Sequence of HTTP requests for clone of public repo:

GET /hg/xx?cmd=capabilities
GET /hg/xx?cmd=heads
GET /hg/xx?cmd=changegroup&roots=yy
GET /hg/xx?cmd=listkeys&namespace=bookmarks

for pull of public repo, no changes to pull:

GET /hg/xx?cmd=capabilities
GET /hg/xx?cmd=heads
GET /hg/xx?cmd=listkeys&namespace=bookmarks

for push to public repo, auth required:

GET /hg/xx?pairs=yy&cmd=between
GET /hg/xx?cmd=capabilities
GET /hg/xx?cmd=heads
GET /hg/xx?cmd=branchmap
POST /hg/xx?cmd=unbundle&heads=yy

Do we always get a branchmap before the post, I wonder?

Branchmap-related hack now in 1d1b8170c2f7

N.B. we should also update the Checkout config so that it shows http:// URLs instead of https:// ones, at least for non logged-in users -- now that it is actually more efficient to use http where auth is not required.