Only read .hg/hgrc files from trusted users/groups

The list of trusted users and groups is specified in the [trusted]
section of a hgrc; the current user is always trusted; "*" can be
used to trust all users/groups.

Global hgrc files are always read.

On Windows (and other systems that don't have the pwd and grp modules),
all .hg/hgrc files are read.

This is essentially the same patch that was previously applied as
revision 494521a3f142.

tests/test-trusted.py

@@ -0,0 +1,113
+#!/usr/bin/env python
+# Since it's not easy to write a test that portably deals
+# with files from different users/groups, we cheat a bit by
+# monkey-patching some functions in the util module
+
+import os
+from mercurial import ui, util
+
+hgrc = os.environ['HGRCPATH']
+
+def testui(user='foo', group='bar', tusers=(), tgroups=(),
+           cuser='foo', cgroup='bar', debug=False):
+    # user, group => owners of the file
+    # tusers, tgroups => trusted users/groups
+    # cuser, cgroup => user/group of the current process
+
+    # write a global hgrc with the list of trusted users/groups and
+    # some setting so that we can be sure it was read
+    f = open(hgrc, 'w')
+    f.write('[paths]\n')
+    f.write('global = /some/path\n\n')
+
+    if tusers or tgroups:
+        f.write('[trusted]\n')
+        if tusers:
+            f.write('users = %s\n' % ', '.join(tusers))
+        if tgroups:
+            f.write('groups = %s\n' % ', '.join(tgroups))
+    f.close()
+
+    # override the functions that give names to uids and gids
+    def username(uid=None):
+        if uid is None:
+            return cuser
+        return user
+    util.username = username
+
+    def groupname(gid=None):
+        if gid is None:
+            return 'bar'
+        return group
+    util.groupname = groupname
+
+    # try to read everything
+    #print '# File belongs to user %s, group %s' % (user, group)
+    #print '# trusted users = %s; trusted groups = %s' % (tusers, tgroups)
+    kind = ('different', 'same')
+    who = ('', 'user', 'group', 'user and the group')
+    trusted = who[(user in tusers) + 2*(group in tgroups)]
+    if trusted:
+        trusted = ', but we trust the ' + trusted
+    print '# %s user, %s group%s' % (kind[user == cuser], kind[group == cgroup],
+                                     trusted)
+
+    parentui = ui.ui()
+    parentui.updateopts(debug=debug)
+    u = ui.ui(parentui=parentui)
+    u.readconfig('.hg/hgrc')
+    for name, path in u.configitems('paths'):
+        print '   ', name, '=', path
+    print
+
+    return u
+
+os.mkdir('repo')
+os.chdir('repo')
+os.mkdir('.hg')
+f = open('.hg/hgrc', 'w')
+f.write('[paths]\n')
+f.write('local = /another/path\n\n')
+f.close()
+
+#print '# Everything is run by user foo, group bar\n'
+
+# same user, same group
+testui()
+# same user, different group
+testui(group='def')
+# different user, same group
+testui(user='abc')
+# ... but we trust the group
+testui(user='abc', tgroups=['bar'])
+# different user, different group
+testui(user='abc', group='def')
+# ... but we trust the user
+testui(user='abc', group='def', tusers=['abc'])
+# ... but we trust the group
+testui(user='abc', group='def', tgroups=['def'])
+# ... but we trust the user and the group
+testui(user='abc', group='def', tusers=['abc'], tgroups=['def'])
+# ... but we trust all users
+print '# we trust all users'
+testui(user='abc', group='def', tusers=['*'])
+# ... but we trust all groups
+print '# we trust all groups'
+testui(user='abc', group='def', tgroups=['*'])
+# ... but we trust the whole universe
+print '# we trust all users and groups'
+testui(user='abc', group='def', tusers=['*'], tgroups=['*'])
+# ... check that users and groups are in different namespaces
+print "# we don't get confused by users and groups with the same name"
+testui(user='abc', group='def', tusers=['def'], tgroups=['abc'])
+# ... lists of user names work
+print "# list of user names"
+testui(user='abc', group='def', tusers=['foo', 'xyz', 'abc', 'bleh'],
+       tgroups=['bar', 'baz', 'qux'])
+# ... lists of group names work
+print "# list of group names"
+testui(user='abc', group='def', tusers=['foo', 'xyz', 'bleh'],
+       tgroups=['bar', 'def', 'baz', 'qux'])
+
+print "# Can't figure out the name of the user running this process"
+testui(user='abc', group='def', cuser=None)

tests/test-trusted.py.out

@@ -0,0 +1,67
+# same user, same group
+    global = /some/path
+    local = /another/path
+
+# same user, different group
+    global = /some/path
+    local = /another/path
+
+# different user, same group
+Not reading file .hg/hgrc from untrusted user abc, group bar
+    global = /some/path
+
+# different user, same group, but we trust the group
+    global = /some/path
+    local = /another/path
+
+# different user, different group
+Not reading file .hg/hgrc from untrusted user abc, group def
+    global = /some/path
+
+# different user, different group, but we trust the user
+    global = /some/path
+    local = /another/path
+
+# different user, different group, but we trust the group
+    global = /some/path
+    local = /another/path
+
+# different user, different group, but we trust the user and the group
+    global = /some/path
+    local = /another/path
+
+# we trust all users
+# different user, different group
+    global = /some/path
+    local = /another/path
+
+# we trust all groups
+# different user, different group
+    global = /some/path
+    local = /another/path
+
+# we trust all users and groups
+# different user, different group
+    global = /some/path
+    local = /another/path
+
+# we don't get confused by users and groups with the same name
+# different user, different group
+Not reading file .hg/hgrc from untrusted user abc, group def
+    global = /some/path
+
+# list of user names
+# different user, different group, but we trust the user
+    global = /some/path
+    local = /another/path
+
+# list of group names
+# different user, different group, but we trust the group
+    global = /some/path
+    local = /another/path
+
+# Can't figure out the name of the user running this process
+# different user, different group
+    global = /some/path
+    local = /another/path
+

doc/hgrc.5.txt

@@ -1,495 +1,508
 HGRC(5)
 =======
 Bryan O'Sullivan <[e-mail]>
 
 NAME
 ----
 hgrc - configuration files for Mercurial
 
 SYNOPSIS
 --------
 
 The Mercurial system uses a set of configuration files to control
 aspects of its behaviour.
 
 FILES
 -----
 
 Mercurial reads configuration data from several files, if they exist.
 The names of these files depend on the system on which Mercurial is
 installed.
 
 (Unix)    <install-root>/etc/mercurial/hgrc.d/*.rc::
 (Unix)    <install-root>/etc/mercurial/hgrc::
     Per-installation configuration files, searched for in the
     directory where Mercurial is installed.  For example, if installed
     in /shared/tools, Mercurial will look in
     /shared/tools/etc/mercurial/hgrc.  Options in these files apply to
     all Mercurial commands executed by any user in any directory.
 
 (Unix)    /etc/mercurial/hgrc.d/*.rc::
 (Unix)    /etc/mercurial/hgrc::
 (Windows) C:\Mercurial\Mercurial.ini::
     Per-system configuration files, for the system on which Mercurial
     is running.  Options in these files apply to all Mercurial
     commands executed by any user in any directory.  Options in these
     files override per-installation options.
 
 (Unix)    $HOME/.hgrc::
 (Windows) C:\Documents and Settings\USERNAME\Mercurial.ini::
 (Windows) $HOME\Mercurial.ini::
     Per-user configuration file, for the user running Mercurial.
     Options in this file apply to all Mercurial commands executed by
     any user in any directory.  Options in this file override
     per-installation and per-system options.
     On Windows system, one of these is chosen exclusively according
     to definition of HOME environment variable.
 
 (Unix, Windows) <repo>/.hg/hgrc::
     Per-repository configuration options that only apply in a
     particular repository.  This file is not version-controlled, and
     will not get transferred during a "clone" operation.  Options in
     this file override options in all other configuration files.
+    On Unix, this file is only read if it belongs to a trusted user
+    or to a trusted group.
 
 SYNTAX
 ------
 
 A configuration file consists of sections, led by a "[section]" header
 and followed by "name: value" entries; "name=value" is also accepted.
 
     [spam]
     eggs=ham
     green=
        eggs
 
 Each line contains one entry.  If the lines that follow are indented,
 they are treated as continuations of that entry.
 
 Leading whitespace is removed from values.  Empty lines are skipped.
 
 The optional values can contain format strings which refer to other
 values in the same section, or values in a special DEFAULT section.
 
 Lines beginning with "#" or ";" are ignored and may be used to provide
 comments.
 
 SECTIONS
 --------
 
 This section describes the different sections that may appear in a
 Mercurial "hgrc" file, the purpose of each section, its possible
 keys, and their possible values.
 
 decode/encode::
   Filters for transforming files on checkout/checkin. This would
   typically be used for newline processing or other
   localization/canonicalization of files.
 
   Filters consist of a filter pattern followed by a filter command.
   Filter patterns are globs by default, rooted at the repository
   root.  For example, to match any file ending in ".txt" in the root
   directory only, use the pattern "*.txt".  To match any file ending
   in ".c" anywhere in the repository, use the pattern "**.c".
 
   The filter command can start with a specifier, either "pipe:" or
   "tempfile:".  If no specifier is given, "pipe:" is used by default.
 
   A "pipe:" command must accept data on stdin and return the
   transformed data on stdout.
 
   Pipe example:
 
     [encode]
     # uncompress gzip files on checkin to improve delta compression
     # note: not necessarily a good idea, just an example
     *.gz = pipe: gunzip
 
     [decode]
     # recompress gzip files when writing them to the working dir (we
     # can safely omit "pipe:", because it's the default)
     *.gz = gzip
 
   A "tempfile:" command is a template.  The string INFILE is replaced
   with the name of a temporary file that contains the data to be
   filtered by the command.  The string OUTFILE is replaced with the
   name of an empty temporary file, where the filtered data must be
   written by the command.
 
   NOTE: the tempfile mechanism is recommended for Windows systems,
   where the standard shell I/O redirection operators often have
   strange effects.  In particular, if you are doing line ending
   conversion on Windows using the popular dos2unix and unix2dos
   programs, you *must* use the tempfile mechanism, as using pipes will
   corrupt the contents of your files.
 
   Tempfile example:
 
     [encode]
     # convert files to unix line ending conventions on checkin
     **.txt = tempfile: dos2unix -n INFILE OUTFILE
 
     [decode]
     # convert files to windows line ending conventions when writing
     # them to the working dir
     **.txt = tempfile: unix2dos -n INFILE OUTFILE
 
 defaults::
   Use the [defaults] section to define command defaults, i.e. the 
   default options/arguments to pass to the specified commands.
   
   The following example makes 'hg log' run in verbose mode, and
   'hg status' show only the modified files, by default.
   
     [defaults]
     log = -v
     status = -m
   
   The actual commands, instead of their aliases, must be used when 
   defining command defaults. The command defaults will also be
   applied to the aliases of the commands defined.
 
 email::
   Settings for extensions that send email messages.
   from;;
     Optional.  Email address to use in "From" header and SMTP envelope
     of outgoing messages.
   to;;
     Optional.  Comma-separated list of recipients' email addresses.
   cc;;
     Optional.  Comma-separated list of carbon copy recipients'
     email addresses.
   bcc;;
     Optional.  Comma-separated list of blind carbon copy
     recipients' email addresses.  Cannot be set interactively.
   method;;
     Optional.  Method to use to send email messages.  If value is
     "smtp" (default), use SMTP (see section "[smtp]" for
     configuration).  Otherwise, use as name of program to run that
     acts like sendmail (takes "-f" option for sender, list of
     recipients on command line, message on stdin).  Normally, setting
     this to "sendmail" or "/usr/sbin/sendmail" is enough to use
     sendmail to send messages.
 
   Email example:
 
     [email]
     from = Joseph User <[e-mail]>
     method = /usr/sbin/sendmail
 
 extensions::
   Mercurial has an extension mechanism for adding new features. To
   enable an extension, create an entry for it in this section.
 
   If you know that the extension is already in Python's search path,
   you can give the name of the module, followed by "=", with nothing
   after the "=".
 
   Otherwise, give a name that you choose, followed by "=", followed by
   the path to the ".py" file (including the file name extension) that
   defines the extension.
 
   Example for ~/.hgrc:
 
     [extensions]
     # (the mq extension will get loaded from mercurial's path)
     hgext.mq =
     # (this extension will get loaded from the file specified)
     myfeature = ~/.hgext/myfeature.py
 
 hooks::
   Commands or Python functions that get automatically executed by
   various actions such as starting or finishing a commit. Multiple
   hooks can be run for the same action by appending a suffix to the
   action. Overriding a site-wide hook can be done by changing its
   value or setting it to an empty string.
 
   Example .hg/hgrc:
 
     [hooks]
     # do not use the site-wide hook
     incoming =
     incoming.email = /my/email/hook
     incoming.autobuild = /my/build/hook
 
   Most hooks are run with environment variables set that give added
   useful information.  For each hook below, the environment variables
   it is passed are listed with names of the form "$HG_foo".
 
   changegroup;;
     Run after a changegroup has been added via push, pull or
     unbundle. ID of the first new changeset is in $HG_NODE.  URL from
     which changes came is in $HG_URL.
   commit;;
     Run after a changeset has been created in the local repository.
     ID of the newly created changeset is in $HG_NODE.  Parent
     changeset IDs are in $HG_PARENT1 and $HG_PARENT2.
   incoming;;
     Run after a changeset has been pulled, pushed, or unbundled into
     the local repository.  The ID of the newly arrived changeset is in
     $HG_NODE.  URL that was source of changes came is in $HG_URL.
   outgoing;;
     Run after sending changes from local repository to another.  ID of
     first changeset sent is in $HG_NODE.  Source of operation is in
     $HG_SOURCE; see "preoutgoing" hook for description.
   prechangegroup;;
     Run before a changegroup is added via push, pull or unbundle.
     Exit status 0 allows the changegroup to proceed.  Non-zero status
     will cause the push, pull or unbundle to fail.  URL from which
     changes will come is in $HG_URL.
   precommit;;
     Run before starting a local commit.  Exit status 0 allows the
     commit to proceed.  Non-zero status will cause the commit to fail.
     Parent changeset IDs are in $HG_PARENT1 and $HG_PARENT2.
   preoutgoing;;
     Run before computing changes to send from the local repository to
     another.  Non-zero status will cause failure.  This lets you
     prevent pull over http or ssh.  Also prevents against local pull,
     push (outbound) or bundle commands, but not effective, since you
     can just copy files instead then.  Source of operation is in
     $HG_SOURCE.  If "serve", operation is happening on behalf of
     remote ssh or http repository.  If "push", "pull" or "bundle",
     operation is happening on behalf of repository on same system.
   pretag;;
     Run before creating a tag.  Exit status 0 allows the tag to be
     created.  Non-zero status will cause the tag to fail.  ID of
     changeset to tag is in $HG_NODE.  Name of tag is in $HG_TAG.  Tag
     is local if $HG_LOCAL=1, in repo if $HG_LOCAL=0.
   pretxnchangegroup;;
     Run after a changegroup has been added via push, pull or unbundle,
     but before the transaction has been committed.  Changegroup is
     visible to hook program.  This lets you validate incoming changes
     before accepting them.  Passed the ID of the first new changeset
     in $HG_NODE.  Exit status 0 allows the transaction to commit.
     Non-zero status will cause the transaction to be rolled back and
     the push, pull or unbundle will fail.  URL that was source of
     changes is in $HG_URL.
   pretxncommit;;
     Run after a changeset has been created but the transaction not yet
     committed.  Changeset is visible to hook program.  This lets you
     validate commit message and changes.  Exit status 0 allows the
     commit to proceed.  Non-zero status will cause the transaction to
     be rolled back.  ID of changeset is in $HG_NODE.  Parent changeset
     IDs are in $HG_PARENT1 and $HG_PARENT2.
   preupdate;;
     Run before updating the working directory.  Exit status 0 allows
     the update to proceed.  Non-zero status will prevent the update.
     Changeset ID of first new parent is in $HG_PARENT1.  If merge, ID
     of second new parent is in $HG_PARENT2.
   tag;;
     Run after a tag is created.  ID of tagged changeset is in
     $HG_NODE.  Name of tag is in $HG_TAG.  Tag is local if
     $HG_LOCAL=1, in repo if $HG_LOCAL=0.
   update;;
     Run after updating the working directory.  Changeset ID of first
     new parent is in $HG_PARENT1.  If merge, ID of second new parent
     is in $HG_PARENT2.  If update succeeded, $HG_ERROR=0.  If update
     failed (e.g. because conflicts not resolved), $HG_ERROR=1.
 
   Note: In earlier releases, the names of hook environment variables
   did not have a "HG_" prefix.  The old unprefixed names are no longer
   provided in the environment.
 
   The syntax for Python hooks is as follows:
 
     hookname = python:modulename.submodule.callable
 
   Python hooks are run within the Mercurial process.  Each hook is
   called with at least three keyword arguments: a ui object (keyword
   "ui"), a repository object (keyword "repo"), and a "hooktype"
   keyword that tells what kind of hook is used.  Arguments listed as
   environment variables above are passed as keyword arguments, with no
   "HG_" prefix, and names in lower case.
 
   A Python hook must return a "true" value to succeed.  Returning a
   "false" value or raising an exception is treated as failure of the
   hook.
 
 http_proxy::
   Used to access web-based Mercurial repositories through a HTTP
   proxy.
   host;;
     Host name and (optional) port of the proxy server, for example
     "myproxy:8000".
   no;;
     Optional.  Comma-separated list of host names that should bypass
     the proxy.
   passwd;;
     Optional.  Password to authenticate with at the proxy server.
   user;;
     Optional.  User name to authenticate with at the proxy server.
 
 smtp::
   Configuration for extensions that need to send email messages.
   host;;
     Host name of mail server, e.g. "mail.example.com".
   port;;
     Optional.  Port to connect to on mail server.  Default: 25.
   tls;;
     Optional.  Whether to connect to mail server using TLS.  True or
     False.  Default: False.
   username;;
     Optional.  User name to authenticate to SMTP server with.
     If username is specified, password must also be specified.
     Default: none.
   password;;
     Optional.  Password to authenticate to SMTP server with.
     If username is specified, password must also be specified.
     Default: none.
   local_hostname;;
     Optional.  It's the hostname that the sender can use to identify itself
     to the MTA.
 
 paths::
   Assigns symbolic names to repositories.  The left side is the
   symbolic name, and the right gives the directory or URL that is the
   location of the repository.  Default paths can be declared by
   setting the following entries.
   default;;
     Directory or URL to use when pulling if no source is specified.
     Default is set to repository from which the current repository
     was cloned.
   default-push;;
     Optional.  Directory or URL to use when pushing if no destination
     is specified.
 
 server::
   Controls generic server settings.
   uncompressed;;
     Whether to allow clients to clone a repo using the uncompressed
     streaming protocol.  This transfers about 40% more data than a
     regular clone, but uses less memory and CPU on both server and
     client.  Over a LAN (100Mbps or better) or a very fast WAN, an
     uncompressed streaming clone is a lot faster (~10x) than a regular
     clone.  Over most WAN connections (anything slower than about
     6Mbps), uncompressed streaming is slower, because of the extra
     data transfer overhead.  Default is False.
 
+trusted::
+  Mercurial will only read the .hg/hgrc file from a repository if
+  it belongs to a trusted user or to a trusted group.  This section
+  specifies what users and groups are trusted.  The current user is
+  always trusted.  To trust everybody, list a user or a group with
+  name "*".
+  users;;
+    Comma-separated list of trusted users.
+  groups;;
+    Comma-separated list of trusted groups.
+
 ui::
   User interface controls.
   debug;;
     Print debugging information.  True or False.  Default is False.
   editor;;
     The editor to use during a commit.  Default is $EDITOR or "vi".
   ignore;;
     A file to read per-user ignore patterns from. This file should be in
     the same format as a repository-wide .hgignore file. This option
     supports hook syntax, so if you want to specify multiple ignore
     files, you can do so by setting something like
     "ignore.other = ~/.hgignore2". For details of the ignore file
     format, see the hgignore(5) man page.
   interactive;;
     Allow to prompt the user.  True or False.  Default is True.
   logtemplate;;
     Template string for commands that print changesets.
   style;;
     Name of style to use for command output.
   merge;;
     The conflict resolution program to use during a manual merge.
     Default is "hgmerge".
   quiet;;
     Reduce the amount of output printed.  True or False.  Default is False.
   remotecmd;;
     remote command to use for clone/push/pull operations. Default is 'hg'.
   ssh;;
     command to use for SSH connections. Default is 'ssh'.
   strict;;
     Require exact command names, instead of allowing unambiguous
     abbreviations.  True or False.  Default is False.
   timeout;;
     The timeout used when a lock is held (in seconds), a negative value
     means no timeout. Default is 600.
   username;;
     The committer of a changeset created when running "commit".
     Typically a person's name and email address, e.g. "Fred Widget
     <[e-mail]>".  Default is $EMAIL. If no default is found, or the
     configured username is empty, it has to be specified manually.
   verbose;;
     Increase the amount of output printed.  True or False.  Default is False.
 
 
 web::
   Web interface configuration.
   accesslog;;
     Where to output the access log. Default is stdout.
   address;;
     Interface address to bind to. Default is all.
   allow_archive;;
     List of archive format (bz2, gz, zip) allowed for downloading.
     Default is empty.
   allowbz2;;
     (DEPRECATED) Whether to allow .tar.bz2 downloading of repo revisions.
     Default is false.
   allowgz;;
     (DEPRECATED) Whether to allow .tar.gz downloading of repo revisions.
     Default is false.
   allowpull;;
     Whether to allow pulling from the repository. Default is true.
   allow_push;;
     Whether to allow pushing to the repository.  If empty or not set,
     push is not allowed.  If the special value "*", any remote user
     can push, including unauthenticated users.  Otherwise, the remote
     user must have been authenticated, and the authenticated user name
     must be present in this list (separated by whitespace or ",").
     The contents of the allow_push list are examined after the
     deny_push list.
   allowzip;;
     (DEPRECATED) Whether to allow .zip downloading of repo revisions.
     Default is false. This feature creates temporary files.
   baseurl;;
     Base URL to use when publishing URLs in other locations, so
     third-party tools like email notification hooks can construct URLs.
     Example: "http://hgserver/repos/"
   contact;;
     Name or email address of the person in charge of the repository.
     Default is "unknown".
   deny_push;;
     Whether to deny pushing to the repository.  If empty or not set,
     push is not denied.  If the special value "*", all remote users
     are denied push.  Otherwise, unauthenticated users are all denied,
     and any authenticated user name present in this list (separated by
     whitespace or ",") is also denied.  The contents of the deny_push
     list are examined before the allow_push list.
   description;;
     Textual description of the repository's purpose or contents.
     Default is "unknown".
   errorlog;;
     Where to output the error log. Default is stderr.
   ipv6;;
     Whether to use IPv6. Default is false.
   name;;
     Repository name to use in the web interface. Default is current
     working directory.
   maxchanges;;
     Maximum number of changes to list on the changelog. Default is 10.
   maxfiles;;
     Maximum number of files to list per changeset. Default is 10.
   port;;
     Port to listen on. Default is 8000.
   push_ssl;;
     Whether to require that inbound pushes be transported over SSL to
     prevent password sniffing.  Default is true.
   stripes;;
     How many lines a "zebra stripe" should span in multiline output.
     Default is 1; set to 0 to disable.
   style;;
     Which template map style to use.
   templates;;
     Where to find the HTML templates. Default is install path.
 
 
 AUTHOR
 ------
 Bryan O'Sullivan <[e-mail]>.
 
 Mercurial was written by Matt Mackall <[e-mail]>.
 
 SEE ALSO
 --------
 hg(1), hgignore(5)
 
 COPYING
 -------
 This manual page is copyright 2005 Bryan O'Sullivan.
 Mercurial is copyright 2005, 2006 Matt Mackall.
 Free use of this software is granted under the terms of the GNU General
 Public License (GPL).

mercurial/ui.py

@@ -1,343 +1,377
 # ui.py - user interface bits for mercurial
 #
 # Copyright 2005, 2006 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms
 # of the GNU General Public License, incorporated herein by reference.
 
 from i18n import gettext as _
 from demandload import *
 demandload(globals(), "errno getpass os re socket sys tempfile")
 demandload(globals(), "ConfigParser traceback util")
 
 def dupconfig(orig):
     new = util.configparser(orig.defaults())
     updateconfig(orig, new)
     return new
 
 def updateconfig(source, dest, sections=None):
     if not sections:
         sections = source.sections()
     for section in sections:
         if not dest.has_section(section):
             dest.add_section(section)
         for name, value in source.items(section, raw=True):
             dest.set(section, name, value)
 
 class ui(object):
     def __init__(self, verbose=False, debug=False, quiet=False,
                  interactive=True, traceback=False, parentui=None):
         self.overlay = None
         self.header = []
         self.prev_header = []
         if parentui is None:
             # this is the parent of all ui children
             self.parentui = None
             self.readhooks = []
             self.quiet = quiet
             self.verbose = verbose
             self.debugflag = debug
             self.interactive = interactive
             self.traceback = traceback
+            self.trusted_users = {}
+            self.trusted_groups = {}
             self.cdata = util.configparser()
             self.readconfig(util.rcpath())
             self.updateopts(verbose, debug, quiet, interactive)
         else:
             # parentui may point to an ui object which is already a child
             self.parentui = parentui.parentui or parentui
             self.readhooks = self.parentui.readhooks[:]
+            self.trusted_users = parentui.trusted_users.copy()
+            self.trusted_groups = parentui.trusted_groups.copy()
             self.cdata = dupconfig(self.parentui.cdata)
             if self.parentui.overlay:
                 self.overlay = dupconfig(self.parentui.overlay)
 
     def __getattr__(self, key):
         return getattr(self.parentui, key)
 
     def updateopts(self, verbose=False, debug=False, quiet=False,
                    interactive=True, traceback=False, config=[]):
         for section, name, value in config:
             self.setconfig(section, name, value)
 
         if quiet or verbose or debug:
             self.setconfig('ui', 'quiet', str(bool(quiet)))
             self.setconfig('ui', 'verbose', str(bool(verbose)))
             self.setconfig('ui', 'debug', str(bool(debug)))
 
         self.verbosity_constraints()
 
         if not interactive:
             self.setconfig('ui', 'interactive', 'False')
             self.interactive = False
 
         self.traceback = self.traceback or traceback
 
     def verbosity_constraints(self):
         self.quiet = self.configbool('ui', 'quiet')
         self.verbose = self.configbool('ui', 'verbose')
         self.debugflag = self.configbool('ui', 'debug')
 
         if self.debugflag:
             self.verbose = True
             self.quiet = False
         elif self.verbose and self.quiet:
             self.quiet = self.verbose = False
 
+    def _is_trusted(self, fp, f, warn=True):
+        tusers = self.trusted_users
+        tgroups = self.trusted_groups
+        if (tusers or tgroups) and '*' not in tusers and '*' not in tgroups:
+            st = util.fstat(fp)
+            user = util.username(st.st_uid)
+            group = util.groupname(st.st_gid)
+            if user not in tusers and group not in tgroups:
+                if warn:
+                    self.warn(_('Not reading file %s from untrusted '
+                                'user %s, group %s\n') % (f, user, group))
+                return False
+        return True
+
     def readconfig(self, fn, root=None):
         if isinstance(fn, basestring):
             fn = [fn]
         for f in fn:
             try:
-                self.cdata.read(f)
+                fp = open(f)
+            except IOError:
+                continue
+            if not self._is_trusted(fp, f):
+                continue
+            try:
+                self.cdata.readfp(fp, f)
             except ConfigParser.ParsingError, inst:
                 raise util.Abort(_("Failed to parse %s\n%s") % (f, inst))
         # override data from config files with data set with ui.setconfig
         if self.overlay:
             updateconfig(self.overlay, self.cdata)
         if root is None:
             root = os.path.expanduser('~')
         self.fixconfig(root=root)
         for hook in self.readhooks:
             hook(self)
 
     def addreadhook(self, hook):
         self.readhooks.append(hook)
 
     def readsections(self, filename, *sections):
         "read filename and add only the specified sections to the config data"
         if not sections:
             return
 
         cdata = util.configparser()
         try:
             cdata.read(filename)
         except ConfigParser.ParsingError, inst:
             raise util.Abort(_("failed to parse %s\n%s") % (filename,
                                                             inst))
 
         for section in sections:
             if not cdata.has_section(section):
                 cdata.add_section(section)
 
         updateconfig(cdata, self.cdata, sections)
 
     def fixconfig(self, section=None, name=None, value=None, root=None):
         # translate paths relative to root (or home) into absolute paths
         if section is None or section == 'paths':
             if root is None:
                 root = os.getcwd()
             items = section and [(name, value)] or []
             for cdata in self.cdata, self.overlay:
                 if not cdata: continue
                 if not items and cdata.has_section('paths'):
                     pathsitems = cdata.items('paths')
                 else:
                     pathsitems = items
                 for n, path in pathsitems:
                     if path and "://" not in path and not os.path.isabs(path):
                         cdata.set("paths", n, os.path.join(root, path))
 
         # update quiet/verbose/debug and interactive status
         if section is None or section == 'ui':
             if name is None or name in ('quiet', 'verbose', 'debug'):
                 self.verbosity_constraints()
 
             if name is None or name == 'interactive':
                 self.interactive = self.configbool("ui", "interactive", True)
 
+        # update trust information
+        if section is None or section == 'trusted':
+            user = util.username()
+            if user is not None:
+                self.trusted_users[user] = 1
+                for user in self.configlist('trusted', 'users'):
+                    self.trusted_users[user] = 1
+                for group in self.configlist('trusted', 'groups'):
+                    self.trusted_groups[group] = 1
+
     def setconfig(self, section, name, value):
         if not self.overlay:
             self.overlay = util.configparser()
         for cdata in (self.overlay, self.cdata):
             if not cdata.has_section(section):
                 cdata.add_section(section)
             cdata.set(section, name, value)
         self.fixconfig(section, name, value)
 
     def _config(self, section, name, default, funcname):
         if self.cdata.has_option(section, name):
             try:
                 func = getattr(self.cdata, funcname)
                 return func(section, name)
             except ConfigParser.InterpolationError, inst:
                 raise util.Abort(_("Error in configuration section [%s] "
                                    "parameter '%s':\n%s")
                                  % (section, name, inst))
         return default
 
     def config(self, section, name, default=None):
         return self._config(section, name, default, 'get')
 
     def configbool(self, section, name, default=False):
         return self._config(section, name, default, 'getboolean')
 
     def configlist(self, section, name, default=None):
         """Return a list of comma/space separated strings"""
         result = self.config(section, name)
         if result is None:
             result = default or []
         if isinstance(result, basestring):
             result = result.replace(",", " ").split()
         return result
 
     def has_config(self, section):
         '''tell whether section exists in config.'''
         return self.cdata.has_section(section)
 
     def configitems(self, section):
         items = {}
         if self.cdata.has_section(section):
             try:
                 items.update(dict(self.cdata.items(section)))
             except ConfigParser.InterpolationError, inst:
                 raise util.Abort(_("Error in configuration section [%s]:\n%s")
                                  % (section, inst))
         x = items.items()
         x.sort()
         return x
 
     def walkconfig(self):
         sections = self.cdata.sections()
         sections.sort()
         for section in sections:
             for name, value in self.configitems(section):
                 yield section, name, value.replace('\n', '\\n')
 
     def extensions(self):
         result = self.configitems("extensions")
         for i, (key, value) in enumerate(result):
             if value:
                 result[i] = (key, os.path.expanduser(value))
         return result
 
     def hgignorefiles(self):
         result = []
         for key, value in self.configitems("ui"):
             if key == 'ignore' or key.startswith('ignore.'):
                 result.append(os.path.expanduser(value))
         return result
 
     def configrevlog(self):
         result = {}
         for key, value in self.configitems("revlog"):
             result[key.lower()] = value
         return result
 
     def username(self):
         """Return default username to be used in commits.
 
         Searched in this order: $HGUSER, [ui] section of hgrcs, $EMAIL
         and stop searching if one of these is set.
         Abort if no username is found, to force specifying the commit user
         with line option or repo hgrc.
         """
         user = os.environ.get("HGUSER")
         if user is None:
             user = self.config("ui", "username")
         if user is None:
             user = os.environ.get("EMAIL")
         if not user:
             self.status(_("Please choose a commit username to be recorded "
                           "in the changelog via\ncommand line option "
                           '(-u "First Last <[e-mail]>"), in the\n'
                           "configuration files (hgrc), or by setting the "
                           "EMAIL environment variable.\n\n"))
             raise util.Abort(_("No commit username specified!"))
         return user
 
     def shortuser(self, user):
         """Return a short representation of a user name or email address."""
         if not self.verbose: user = util.shortuser(user)
         return user
 
     def expandpath(self, loc, default=None):
         """Return repository location relative to cwd or from [paths]"""
         if "://" in loc or os.path.isdir(loc):
             return loc
 
         path = self.config("paths", loc)
         if not path and default is not None:
             path = self.config("paths", default)
         return path or loc
 
     def write(self, *args):
         if self.header:
             if self.header != self.prev_header:
                 self.prev_header = self.header
                 self.write(*self.header)
             self.header = []
         for a in args:
             sys.stdout.write(str(a))
 
     def write_header(self, *args):
         for a in args:
             self.header.append(str(a))
 
     def write_err(self, *args):
         try:
             if not sys.stdout.closed: sys.stdout.flush()
             for a in args:
                 sys.stderr.write(str(a))
         except IOError, inst:
             if inst.errno != errno.EPIPE:
                 raise
 
     def flush(self):
         try: sys.stdout.flush()
         except: pass
         try: sys.stderr.flush()
         except: pass
 
     def readline(self):
         return sys.stdin.readline()[:-1]
     def prompt(self, msg, pat=None, default="y"):
         if not self.interactive: return default
         while 1:
             self.write(msg, " ")
             r = self.readline()
             if not pat or re.match(pat, r):
                 return r
             else:
                 self.write(_("unrecognized response\n"))
     def getpass(self, prompt=None, default=None):
         if not self.interactive: return default
         return getpass.getpass(prompt or _('password: '))
     def status(self, *msg):
         if not self.quiet: self.write(*msg)
     def warn(self, *msg):
         self.write_err(*msg)
     def note(self, *msg):
         if self.verbose: self.write(*msg)
     def debug(self, *msg):
         if self.debugflag: self.write(*msg)
     def edit(self, text, user):
         (fd, name) = tempfile.mkstemp(prefix="hg-editor-", suffix=".txt",
                                       text=True)
         try:
             f = os.fdopen(fd, "w")
             f.write(text)
             f.close()
 
             editor = (os.environ.get("HGEDITOR") or
                     self.config("ui", "editor") or
                     os.environ.get("EDITOR", "vi"))
 
             util.system("%s \"%s\"" % (editor, name),
                         environ={'HGUSER': user},
                         onerr=util.Abort, errprefix=_("edit failed"))
 
             f = open(name)
             t = f.read()
             f.close()
             t = re.sub("(?m)^HG:.*\n", "", t)
         finally:
             os.unlink(name)
 
         return t
 
     def print_exc(self):
         '''print exception traceback if traceback printing enabled.
         only to call in exception handler. returns true if traceback
         printed.'''
         if self.traceback:
             traceback.print_exc()
         return self.traceback

mercurial/util.py

@@ -1,1021 +1,1051
 """
 util.py - Mercurial utility functions and platform specfic implementations
 
  Copyright 2005 K. Thananchayan <[e-mail]>
  Copyright 2005, 2006 Matt Mackall <[e-mail]>
  Copyright 2006 Vadim Gelfer <[e-mail]>
 
 This software may be used and distributed according to the terms
 of the GNU General Public License, incorporated herein by reference.
 
 This contains helper routines that are independent of the SCM core and hide
 platform-specific details from the core.
 """
 
 from i18n import gettext as _
 from demandload import *
 demandload(globals(), "cStringIO errno getpass popen2 re shutil sys tempfile")
 demandload(globals(), "os threading time calendar ConfigParser")
 
 # used by parsedate
 defaultdateformats = ('%Y-%m-%d %H:%M:%S', '%Y-%m-%d %H:%M',
                       '%a %b %d %H:%M:%S %Y')
 
 class SignalInterrupt(Exception):
     """Exception raised on SIGTERM and SIGHUP."""
 
 # like SafeConfigParser but with case-sensitive keys
 class configparser(ConfigParser.SafeConfigParser):
     def optionxform(self, optionstr):
         return optionstr
 
 def cachefunc(func):
     '''cache the result of function calls'''
     # XXX doesn't handle keywords args
     cache = {}
     if func.func_code.co_argcount == 1:
         # we gain a small amount of time because
         # we don't need to pack/unpack the list
         def f(arg):
             if arg not in cache:
                 cache[arg] = func(arg)
             return cache[arg]
     else:
         def f(*args):
             if args not in cache:
                 cache[args] = func(*args)
             return cache[args]
 
     return f
 
 def pipefilter(s, cmd):
     '''filter string S through command CMD, returning its output'''
     (pout, pin) = popen2.popen2(cmd, -1, 'b')
     def writer():
         try:
             pin.write(s)
             pin.close()
         except IOError, inst:
             if inst.errno != errno.EPIPE:
                 raise
 
     # we should use select instead on UNIX, but this will work on most
     # systems, including Windows
     w = threading.Thread(target=writer)
     w.start()
     f = pout.read()
     pout.close()
     w.join()
     return f
 
 def tempfilter(s, cmd):
     '''filter string S through a pair of temporary files with CMD.
     CMD is used as a template to create the real command to be run,
     with the strings INFILE and OUTFILE replaced by the real names of
     the temporary files generated.'''
     inname, outname = None, None
     try:
         infd, inname = tempfile.mkstemp(prefix='hg-filter-in-')
         fp = os.fdopen(infd, 'wb')
         fp.write(s)
         fp.close()
         outfd, outname = tempfile.mkstemp(prefix='hg-filter-out-')
         os.close(outfd)
         cmd = cmd.replace('INFILE', inname)
         cmd = cmd.replace('OUTFILE', outname)
         code = os.system(cmd)
         if code: raise Abort(_("command '%s' failed: %s") %
                              (cmd, explain_exit(code)))
         return open(outname, 'rb').read()
     finally:
         try:
             if inname: os.unlink(inname)
         except: pass
         try:
             if outname: os.unlink(outname)
         except: pass
 
 filtertable = {
     'tempfile:': tempfilter,
     'pipe:': pipefilter,
     }
 
 def filter(s, cmd):
     "filter a string through a command that transforms its input to its output"
     for name, fn in filtertable.iteritems():
         if cmd.startswith(name):
             return fn(s, cmd[len(name):].lstrip())
     return pipefilter(s, cmd)
 
 def find_in_path(name, path, default=None):
     '''find name in search path. path can be string (will be split
     with os.pathsep), or iterable thing that returns strings.  if name
     found, return path to name. else return default.'''
     if isinstance(path, str):
         path = path.split(os.pathsep)
     for p in path:
         p_name = os.path.join(p, name)
         if os.path.exists(p_name):
             return p_name
     return default
 
 def binary(s):
     """return true if a string is binary data using diff's heuristic"""
     if s and '\0' in s[:4096]:
         return True
     return False
 
 def unique(g):
     """return the uniq elements of iterable g"""
     seen = {}
     for f in g:
         if f not in seen:
             seen[f] = 1
             yield f
 
 class Abort(Exception):
     """Raised if a command needs to print an error and exit."""
 
 def always(fn): return True
 def never(fn): return False
 
 def patkind(name, dflt_pat='glob'):
     """Split a string into an optional pattern kind prefix and the
     actual pattern."""
     for prefix in 're', 'glob', 'path', 'relglob', 'relpath', 'relre':
         if name.startswith(prefix + ':'): return name.split(':', 1)
     return dflt_pat, name
 
 def globre(pat, head='^', tail='$'):
     "convert a glob pattern into a regexp"
     i, n = 0, len(pat)
     res = ''
     group = False
     def peek(): return i < n and pat[i]
     while i < n:
         c = pat[i]
         i = i+1
         if c == '*':
             if peek() == '*':
                 i += 1
                 res += '.*'
             else:
                 res += '[^/]*'
         elif c == '?':
             res += '.'
         elif c == '[':
             j = i
             if j < n and pat[j] in '!]':
                 j += 1
             while j < n and pat[j] != ']':
                 j += 1
             if j >= n:
                 res += '\\['
             else:
                 stuff = pat[i:j].replace('\\','\\\\')
                 i = j + 1
                 if stuff[0] == '!':
                     stuff = '^' + stuff[1:]
                 elif stuff[0] == '^':
                     stuff = '\\' + stuff
                 res = '%s[%s]' % (res, stuff)
         elif c == '{':
             group = True
             res += '(?:'
         elif c == '}' and group:
             res += ')'
             group = False
         elif c == ',' and group:
             res += '|'
         elif c == '\\':
             p = peek()
             if p:
                 i += 1
                 res += re.escape(p)
             else:
                 res += re.escape(c)
         else:
             res += re.escape(c)
     return head + res + tail
 
 _globchars = {'[': 1, '{': 1, '*': 1, '?': 1}
 
 def pathto(n1, n2):
     '''return the relative path from one place to another.
     this returns a path in the form used by the local filesystem, not hg.'''
     if not n1: return localpath(n2)
     a, b = n1.split('/'), n2.split('/')
     a.reverse()
     b.reverse()
     while a and b and a[-1] == b[-1]:
         a.pop()
         b.pop()
     b.reverse()
     return os.sep.join((['..'] * len(a)) + b)
 
 def canonpath(root, cwd, myname):
     """return the canonical path of myname, given cwd and root"""
     if root == os.sep:
         rootsep = os.sep
     elif root.endswith(os.sep):
         rootsep = root
     else:
         rootsep = root + os.sep
     name = myname
     if not os.path.isabs(name):
         name = os.path.join(root, cwd, name)
     name = os.path.normpath(name)
     if name != rootsep and name.startswith(rootsep):
         name = name[len(rootsep):]
         audit_path(name)
         return pconvert(name)
     elif name == root:
         return ''
     else:
         # Determine whether `name' is in the hierarchy at or beneath `root',
         # by iterating name=dirname(name) until that causes no change (can't
         # check name == '/', because that doesn't work on windows).  For each
         # `name', compare dev/inode numbers.  If they match, the list `rel'
         # holds the reversed list of components making up the relative file
         # name we want.
         root_st = os.stat(root)
         rel = []
         while True:
             try:
                 name_st = os.stat(name)
             except OSError:
                 break
             if samestat(name_st, root_st):
                 rel.reverse()
                 name = os.path.join(*rel)
                 audit_path(name)
                 return pconvert(name)
             dirname, basename = os.path.split(name)
             rel.append(basename)
             if dirname == name:
                 break
             name = dirname
 
         raise Abort('%s not under root' % myname)
 
 def matcher(canonroot, cwd='', names=['.'], inc=[], exc=[], head='', src=None):
     return _matcher(canonroot, cwd, names, inc, exc, head, 'glob', src)
 
 def cmdmatcher(canonroot, cwd='', names=['.'], inc=[], exc=[], head='', src=None):
     if os.name == 'nt':
         dflt_pat = 'glob'
     else:
         dflt_pat = 'relpath'
     return _matcher(canonroot, cwd, names, inc, exc, head, dflt_pat, src)
 
 def _matcher(canonroot, cwd, names, inc, exc, head, dflt_pat, src):
     """build a function to match a set of file patterns
 
     arguments:
     canonroot - the canonical root of the tree you're matching against
     cwd - the current working directory, if relevant
     names - patterns to find
     inc - patterns to include
     exc - patterns to exclude
     head - a regex to prepend to patterns to control whether a match is rooted
 
     a pattern is one of:
     'glob:<rooted glob>'
     're:<rooted regexp>'
     'path:<rooted path>'
     'relglob:<relative glob>'
     'relpath:<relative path>'
     'relre:<relative regexp>'
     '<rooted path or regexp>'
 
     returns:
     a 3-tuple containing
     - list of explicit non-pattern names passed in
     - a bool match(filename) function
     - a bool indicating if any patterns were passed in
 
     todo:
     make head regex a rooted bool
     """
 
     def contains_glob(name):
         for c in name:
             if c in _globchars: return True
         return False
 
     def regex(kind, name, tail):
         '''convert a pattern into a regular expression'''
         if kind == 're':
             return name
         elif kind == 'path':
             return '^' + re.escape(name) + '(?:/|$)'
         elif kind == 'relglob':
             return head + globre(name, '(?:|.*/)', tail)
         elif kind == 'relpath':
             return head + re.escape(name) + tail
         elif kind == 'relre':
             if name.startswith('^'):
                 return name
             return '.*' + name
         return head + globre(name, '', tail)
 
     def matchfn(pats, tail):
         """build a matching function from a set of patterns"""
         if not pats:
             return
         matches = []
         for k, p in pats:
             try:
                 pat = '(?:%s)' % regex(k, p, tail)
                 matches.append(re.compile(pat).match)
             except re.error:
                 if src: raise Abort("%s: invalid pattern (%s): %s" % (src, k, p))
                 else: raise Abort("invalid pattern (%s): %s" % (k, p))
 
         def buildfn(text):
             for m in matches:
                 r = m(text)
                 if r:
                     return r
 
         return buildfn
 
     def globprefix(pat):
         '''return the non-glob prefix of a path, e.g. foo/* -> foo'''
         root = []
         for p in pat.split(os.sep):
             if contains_glob(p): break
             root.append(p)
         return '/'.join(root)
 
     pats = []
     files = []
     roots = []
     for kind, name in [patkind(p, dflt_pat) for p in names]:
         if kind in ('glob', 'relpath'):
             name = canonpath(canonroot, cwd, name)
             if name == '':
                 kind, name = 'glob', '**'
         if kind in ('glob', 'path', 're'):
             pats.append((kind, name))
         if kind == 'glob':
             root = globprefix(name)
             if root: roots.append(root)
         elif kind == 'relpath':
             files.append((kind, name))
             roots.append(name)
 
     patmatch = matchfn(pats, '$') or always
     filematch = matchfn(files, '(?:/|$)') or always
     incmatch = always
     if inc:
         inckinds = [patkind(canonpath(canonroot, cwd, i)) for i in inc]
         incmatch = matchfn(inckinds, '(?:/|$)')
     excmatch = lambda fn: False
     if exc:
         exckinds = [patkind(canonpath(canonroot, cwd, x)) for x in exc]
         excmatch = matchfn(exckinds, '(?:/|$)')
 
     return (roots,
             lambda fn: (incmatch(fn) and not excmatch(fn) and
                         (fn.endswith('/') or
                          (not pats and not files) or
                          (pats and patmatch(fn)) or
                          (files and filematch(fn)))),
             (inc or exc or (pats and pats != [('glob', '**')])) and True)
 
 def system(cmd, environ={}, cwd=None, onerr=None, errprefix=None):
     '''enhanced shell command execution.
     run with environment maybe modified, maybe in different dir.
 
     if command fails and onerr is None, return status.  if ui object,
     print error message and return status, else raise onerr object as
     exception.'''
     def py2shell(val):
         'convert python object into string that is useful to shell'
         if val in (None, False):
             return '0'
         if val == True:
             return '1'
         return str(val)
     oldenv = {}
     for k in environ:
         oldenv[k] = os.environ.get(k)
     if cwd is not None:
         oldcwd = os.getcwd()
     try:
         for k, v in environ.iteritems():
             os.environ[k] = py2shell(v)
         if cwd is not None and oldcwd != cwd:
             os.chdir(cwd)
         rc = os.system(cmd)
         if rc and onerr:
             errmsg = '%s %s' % (os.path.basename(cmd.split(None, 1)[0]),
                                 explain_exit(rc)[0])
             if errprefix:
                 errmsg = '%s: %s' % (errprefix, errmsg)
             try:
                 onerr.warn(errmsg + '\n')
             except AttributeError:
                 raise onerr(errmsg)
         return rc
     finally:
         for k, v in oldenv.iteritems():
             if v is None:
                 del os.environ[k]
             else:
                 os.environ[k] = v
         if cwd is not None and oldcwd != cwd:
             os.chdir(oldcwd)
 
 def rename(src, dst):
     """forcibly rename a file"""
     try:
         os.rename(src, dst)
     except OSError, err:
         # on windows, rename to existing file is not allowed, so we
         # must delete destination first. but if file is open, unlink
         # schedules it for delete but does not delete it. rename
         # happens immediately even for open files, so we create
         # temporary file, delete it, rename destination to that name,
         # then delete that. then rename is safe to do.
         fd, temp = tempfile.mkstemp(dir=os.path.dirname(dst) or '.')
         os.close(fd)
         os.unlink(temp)
         os.rename(dst, temp)
         os.unlink(temp)
         os.rename(src, dst)
 
 def unlink(f):
     """unlink and remove the directory if it is empty"""
     os.unlink(f)
     # try removing directories that might now be empty
     try:
         os.removedirs(os.path.dirname(f))
     except OSError:
         pass
 
 def copyfiles(src, dst, hardlink=None):
     """Copy a directory tree using hardlinks if possible"""
 
     if hardlink is None:
         hardlink = (os.stat(src).st_dev ==
                     os.stat(os.path.dirname(dst)).st_dev)
 
     if os.path.isdir(src):
         os.mkdir(dst)
         for name in os.listdir(src):
             srcname = os.path.join(src, name)
             dstname = os.path.join(dst, name)
             copyfiles(srcname, dstname, hardlink)
     else:
         if hardlink:
             try:
                 os_link(src, dst)
             except (IOError, OSError):
                 hardlink = False
                 shutil.copy(src, dst)
         else:
             shutil.copy(src, dst)
 
 def audit_path(path):
     """Abort if path contains dangerous components"""
     parts = os.path.normcase(path).split(os.sep)
     if (os.path.splitdrive(path)[0] or parts[0] in ('.hg', '')
         or os.pardir in parts):
         raise Abort(_("path contains illegal component: %s\n") % path)
 
 def _makelock_file(info, pathname):
     ld = os.open(pathname, os.O_CREAT | os.O_WRONLY | os.O_EXCL)
     os.write(ld, info)
     os.close(ld)
 
 def _readlock_file(pathname):
     return posixfile(pathname).read()
 
 def nlinks(pathname):
     """Return number of hardlinks for the given file."""
     return os.lstat(pathname).st_nlink
 
 if hasattr(os, 'link'):
     os_link = os.link
 else:
     def os_link(src, dst):
         raise OSError(0, _("Hardlinks not supported"))
 
 def fstat(fp):
     '''stat file object that may not have fileno method.'''
     try:
         return os.fstat(fp.fileno())
     except AttributeError:
         return os.stat(fp.name)
 
 posixfile = file
 
 def is_win_9x():
     '''return true if run on windows 95, 98 or me.'''
     try:
         return sys.getwindowsversion()[3] == 1
     except AttributeError:
         return os.name == 'nt' and 'command' in os.environ.get('comspec', '')
 
+def username(uid=None):
+    """Return the name of the user with the given uid.
+
+    If uid is None, return the name of the current user."""
+    try:
+        import pwd
+        if uid is None:
+            uid = os.getuid()
+        try:
+            return pwd.getpwuid(uid)[0]
+        except KeyError:
+            return str(uid)
+    except ImportError:
+        return None
+
+def groupname(gid=None):
+    """Return the name of the group with the given gid.
+
+    If gid is None, return the name of the current group."""
+    try:
+        import grp
+        if gid is None:
+            gid = os.getgid()
+        try:
+            return grp.getgrgid(gid)[0]
+        except KeyError:
+            return str(gid)
+    except ImportError:
+        return None
+
 # Platform specific variants
 if os.name == 'nt':
     demandload(globals(), "msvcrt")
     nulldev = 'NUL:'
 
     class winstdout:
         '''stdout on windows misbehaves if sent through a pipe'''
 
         def __init__(self, fp):
             self.fp = fp
 
         def __getattr__(self, key):
             return getattr(self.fp, key)
 
         def close(self):
             try:
                 self.fp.close()
             except: pass
 
         def write(self, s):
             try:
                 return self.fp.write(s)
             except IOError, inst:
                 if inst.errno != 0: raise
                 self.close()
                 raise IOError(errno.EPIPE, 'Broken pipe')
 
     sys.stdout = winstdout(sys.stdout)
 
     def system_rcpath():
         try:
             return system_rcpath_win32()
         except:
             return [r'c:\mercurial\mercurial.ini']
 
     def os_rcpath():
         '''return default os-specific hgrc search path'''
         path = system_rcpath()
         path.append(user_rcpath())
         userprofile = os.environ.get('USERPROFILE')
         if userprofile:
             path.append(os.path.join(userprofile, 'mercurial.ini'))
         return path
 
     def user_rcpath():
          '''return os-specific hgrc search path to the user dir'''
          return os.path.join(os.path.expanduser('~'), 'mercurial.ini')
 
     def parse_patch_output(output_line):
         """parses the output produced by patch and returns the file name"""
         pf = output_line[14:]
         if pf[0] == '`':
             pf = pf[1:-1] # Remove the quotes
         return pf
 
     def testpid(pid):
         '''return False if pid dead, True if running or not known'''
         return True
 
     def is_exec(f, last):
         return last
 
     def set_exec(f, mode):
         pass
 
     def set_binary(fd):
         msvcrt.setmode(fd.fileno(), os.O_BINARY)
 
     def pconvert(path):
         return path.replace("\\", "/")
 
     def localpath(path):
         return path.replace('/', '\\')
 
     def normpath(path):
         return pconvert(os.path.normpath(path))
 
     makelock = _makelock_file
     readlock = _readlock_file
 
     def samestat(s1, s2):
         return False
 
     def shellquote(s):
         return '"%s"' % s.replace('"', '\\"')
 
     def explain_exit(code):
         return _("exited with status %d") % code, code
 
     try:
         # override functions with win32 versions if possible
         from util_win32 import *
         if not is_win_9x():
             posixfile = posixfile_nt
     except ImportError:
         pass
 
 else:
     nulldev = '/dev/null'
 
     def rcfiles(path):
         rcs = [os.path.join(path, 'hgrc')]
         rcdir = os.path.join(path, 'hgrc.d')
         try:
             rcs.extend([os.path.join(rcdir, f) for f in os.listdir(rcdir)
                         if f.endswith(".rc")])
         except OSError:
             pass
         return rcs
 
     def os_rcpath():
         '''return default os-specific hgrc search path'''
         path = []
         # old mod_python does not set sys.argv
         if len(getattr(sys, 'argv', [])) > 0:
             path.extend(rcfiles(os.path.dirname(sys.argv[0]) +
                                   '/../etc/mercurial'))
         path.extend(rcfiles('/etc/mercurial'))
         path.append(os.path.expanduser('~/.hgrc'))
         path = [os.path.normpath(f) for f in path]
         return path
 
     def parse_patch_output(output_line):
         """parses the output produced by patch and returns the file name"""
         pf = output_line[14:]
         if pf.startswith("'") and pf.endswith("'") and " " in pf:
             pf = pf[1:-1] # Remove the quotes
         return pf
 
     def is_exec(f, last):
         """check whether a file is executable"""
         return (os.lstat(f).st_mode & 0100 != 0)
 
     def set_exec(f, mode):
         s = os.lstat(f).st_mode
         if (s & 0100 != 0) == mode:
             return
         if mode:
             # Turn on +x for every +r bit when making a file executable
             # and obey umask.
             umask = os.umask(0)
             os.umask(umask)
             os.chmod(f, s | (s & 0444) >> 2 & ~umask)
         else:
             os.chmod(f, s & 0666)
 
     def set_binary(fd):
         pass
 
     def pconvert(path):
         return path
 
     def localpath(path):
         return path
 
     normpath = os.path.normpath
     samestat = os.path.samestat
 
     def makelock(info, pathname):
         try:
             os.symlink(info, pathname)
         except OSError, why:
             if why.errno == errno.EEXIST:
                 raise
             else:
                 _makelock_file(info, pathname)
 
     def readlock(pathname):
         try:
             return os.readlink(pathname)
         except OSError, why:
             if why.errno == errno.EINVAL:
                 return _readlock_file(pathname)
             else:
                 raise
 
     def shellquote(s):
         return "'%s'" % s.replace("'", "'\\''")
 
     def testpid(pid):
         '''return False if pid dead, True if running or not sure'''
         try:
             os.kill(pid, 0)
             return True
         except OSError, inst:
             return inst.errno != errno.ESRCH
 
     def explain_exit(code):
         """return a 2-tuple (desc, code) describing a process's status"""
         if os.WIFEXITED(code):
             val = os.WEXITSTATUS(code)
             return _("exited with status %d") % val, val
         elif os.WIFSIGNALED(code):
             val = os.WTERMSIG(code)
             return _("killed by signal %d") % val, val
         elif os.WIFSTOPPED(code):
             val = os.WSTOPSIG(code)
             return _("stopped by signal %d") % val, val
         raise ValueError(_("invalid exit code"))
 
 def opener(base, audit=True):
     """
     return a function that opens files relative to base
 
     this function is used to hide the details of COW semantics and
     remote file access from higher level code.
     """
     p = base
     audit_p = audit
 
     def mktempcopy(name):
         d, fn = os.path.split(name)
         fd, temp = tempfile.mkstemp(prefix='.%s-' % fn, dir=d)
         os.close(fd)
         ofp = posixfile(temp, "wb")
         try:
             try:
                 ifp = posixfile(name, "rb")
             except IOError, inst:
                 if not getattr(inst, 'filename', None):
                     inst.filename = name
                 raise
             for chunk in filechunkiter(ifp):
                 ofp.write(chunk)
             ifp.close()
             ofp.close()
         except:
             try: os.unlink(temp)
             except: pass
             raise
         st = os.lstat(name)
         os.chmod(temp, st.st_mode)
         return temp
 
     class atomictempfile(posixfile):
         """the file will only be copied when rename is called"""
         def __init__(self, name, mode):
             self.__name = name
             self.temp = mktempcopy(name)
             posixfile.__init__(self, self.temp, mode)
         def rename(self):
             if not self.closed:
                 posixfile.close(self)
                 rename(self.temp, localpath(self.__name))
         def __del__(self):
             if not self.closed:
                 try:
                     os.unlink(self.temp)
                 except: pass
                 posixfile.close(self)
 
     class atomicfile(atomictempfile):
         """the file will only be copied on close"""
         def __init__(self, name, mode):
             atomictempfile.__init__(self, name, mode)
         def close(self):
             self.rename()
         def __del__(self):
             self.rename()
 
     def o(path, mode="r", text=False, atomic=False, atomictemp=False):
         if audit_p:
             audit_path(path)
         f = os.path.join(p, path)
 
         if not text:
             mode += "b" # for that other OS
 
         if mode[0] != "r":
             try:
                 nlink = nlinks(f)
             except OSError:
                 d = os.path.dirname(f)
                 if not os.path.isdir(d):
                     os.makedirs(d)
             else:
                 if atomic:
                     return atomicfile(f, mode)
                 elif atomictemp:
                     return atomictempfile(f, mode)
                 if nlink > 1:
                     rename(mktempcopy(f), f)
         return posixfile(f, mode)
 
     return o
 
 class chunkbuffer(object):
     """Allow arbitrary sized chunks of data to be efficiently read from an
     iterator over chunks of arbitrary size."""
 
     def __init__(self, in_iter, targetsize = 2**16):
         """in_iter is the iterator that's iterating over the input chunks.
         targetsize is how big a buffer to try to maintain."""
         self.in_iter = iter(in_iter)
         self.buf = ''
         self.targetsize = int(targetsize)
         if self.targetsize <= 0:
             raise ValueError(_("targetsize must be greater than 0, was %d") %
                              targetsize)
         self.iterempty = False
 
     def fillbuf(self):
         """Ignore target size; read every chunk from iterator until empty."""
         if not self.iterempty:
             collector = cStringIO.StringIO()
             collector.write(self.buf)
             for ch in self.in_iter:
                 collector.write(ch)
             self.buf = collector.getvalue()
             self.iterempty = True
 
     def read(self, l):
         """Read L bytes of data from the iterator of chunks of data.
         Returns less than L bytes if the iterator runs dry."""
         if l > len(self.buf) and not self.iterempty:
             # Clamp to a multiple of self.targetsize
             targetsize = self.targetsize * ((l // self.targetsize) + 1)
             collector = cStringIO.StringIO()
             collector.write(self.buf)
             collected = len(self.buf)
             for chunk in self.in_iter:
                 collector.write(chunk)
                 collected += len(chunk)
                 if collected >= targetsize:
                     break
             if collected < targetsize:
                 self.iterempty = True
             self.buf = collector.getvalue()
         s, self.buf = self.buf[:l], buffer(self.buf, l)
         return s
 
 def filechunkiter(f, size=65536, limit=None):
     """Create a generator that produces the data in the file size
     (default 65536) bytes at a time, up to optional limit (default is
     to read all data).  Chunks may be less than size bytes if the
     chunk is the last chunk in the file, or the file is a socket or
     some other type of file that sometimes reads less data than is
     requested."""
     assert size >= 0
     assert limit is None or limit >= 0
     while True:
         if limit is None: nbytes = size
         else: nbytes = min(limit, size)
         s = nbytes and f.read(nbytes)
         if not s: break
         if limit: limit -= len(s)
         yield s
 
 def makedate():
     lt = time.localtime()
     if lt[8] == 1 and time.daylight:
         tz = time.altzone
     else:
         tz = time.timezone
     return time.mktime(lt), tz
 
 def datestr(date=None, format='%a %b %d %H:%M:%S %Y', timezone=True):
     """represent a (unixtime, offset) tuple as a localized time.
     unixtime is seconds since the epoch, and offset is the time zone's
     number of seconds away from UTC. if timezone is false, do not
     append time zone to string."""
     t, tz = date or makedate()
     s = time.strftime(format, time.gmtime(float(t) - tz))
     if timezone:
         s += " %+03d%02d" % (-tz / 3600, ((-tz % 3600) / 60))
     return s
 
 def strdate(string, format='%a %b %d %H:%M:%S %Y'):
     """parse a localized time string and return a (unixtime, offset) tuple.
     if the string cannot be parsed, ValueError is raised."""
     def hastimezone(string):
         return (string[-4:].isdigit() and
                (string[-5] == '+' or string[-5] == '-') and
                string[-6].isspace())
 
     # NOTE: unixtime = localunixtime + offset
     if hastimezone(string):
         date, tz = string[:-6], string[-5:]
         tz = int(tz)
         offset = - 3600 * (tz / 100) - 60 * (tz % 100)
     else:
         date, offset = string, None
     timetuple = time.strptime(date, format)
     localunixtime = int(calendar.timegm(timetuple))
     if offset is None:
         # local timezone
         unixtime = int(time.mktime(timetuple))
         offset = unixtime - localunixtime
     else:
         unixtime = localunixtime + offset
     return unixtime, offset
 
 def parsedate(string, formats=None):
     """parse a localized time string and return a (unixtime, offset) tuple.
     The date may be a "unixtime offset" string or in one of the specified
     formats."""
     if not formats:
         formats = defaultdateformats
     try:
         when, offset = map(int, string.split(' '))
     except ValueError:
         for format in formats:
             try:
                 when, offset = strdate(string, format)
             except ValueError:
                 pass
             else:
                 break
         else:
             raise ValueError(_('invalid date: %r '
                                'see hg(1) manual page for details')
                              % string)
     # validate explicit (probably user-specified) date and
     # time zone offset. values must fit in signed 32 bits for
     # current 32-bit linux runtimes. timezones go from UTC-12
     # to UTC+14
     if abs(when) > 0x7fffffff:
         raise ValueError(_('date exceeds 32 bits: %d') % when)
     if offset < -50400 or offset > 43200:
         raise ValueError(_('impossible time zone offset: %d') % offset)
     return when, offset
 
 def shortuser(user):
     """Return a short representation of a user name or email address."""
     f = user.find('@')
     if f >= 0:
         user = user[:f]
     f = user.find('<')
     if f >= 0:
         user = user[f+1:]
     f = user.find(' ')
     if f >= 0:
         user = user[:f]
     return user
 
 def walkrepos(path):
     '''yield every hg repository under path, recursively.'''
     def errhandler(err):
         if err.filename == path:
             raise err
 
     for root, dirs, files in os.walk(path, onerror=errhandler):
         for d in dirs:
             if d == '.hg':
                 yield root
                 dirs[:] = []
                 break
 
 _rcpath = None
 
 def rcpath():
     '''return hgrc search path. if env var HGRCPATH is set, use it.
     for each item in path, if directory, use files ending in .rc,
     else use item.
     make HGRCPATH empty to only look in .hg/hgrc of current repo.
     if no HGRCPATH, use default os-specific path.'''
     global _rcpath
     if _rcpath is None:
         if 'HGRCPATH' in os.environ:
             _rcpath = []
             for p in os.environ['HGRCPATH'].split(os.pathsep):
                 if not p: continue
                 if os.path.isdir(p):
                     for f in os.listdir(p):
                         if f.endswith('.rc'):
                             _rcpath.append(os.path.join(p, f))
                 else:
                     _rcpath.append(p)
         else:
             _rcpath = os_rcpath()
     return _rcpath
 
 def bytecount(nbytes):
     '''return byte count formatted as readable string, with units'''
 
     units = (
         (100, 1<<30, _('%.0f GB')),
         (10, 1<<30, _('%.1f GB')),
         (1, 1<<30, _('%.2f GB')),
         (100, 1<<20, _('%.0f MB')),
         (10, 1<<20, _('%.1f MB')),
         (1, 1<<20, _('%.2f MB')),
         (100, 1<<10, _('%.0f KB')),
         (10, 1<<10, _('%.1f KB')),
         (1, 1<<10, _('%.2f KB')),
         (1, 1, _('%.0f bytes')),
         )
 
     for multiplier, divisor, format in units:
         if nbytes >= divisor * multiplier:
             return format % (nbytes / float(divisor))
     return units[-1][2] % nbytes
 
 def drop_scheme(scheme, path):
     sc = scheme + ':'
     if path.startswith(sc):
         path = path[len(sc):]
         if path.startswith('//'):
             path = path[2:]
     return path