mercurial_keyring /

Filename Size Date modified Message
117 B
329 B
4.8 KB
12.8 KB
1.0 KB


mercurial_keyring is a Mercurial extension used to securely save HTTP and SMTP authentication passwords in password databases (Gnome Keyring, KDE KWallet, OSXKeyChain, specific solutions for Win32 and command line). This extension uses and wraps services of the keyring library.

How does it work

The extension prompts for the password on the first pull/push (in case of HTTP) or first email (in case of SMTP), just like it is done by default, but saves the password. On successive runs it checks for the username in .hg/hgrc, then for suitable password in the password database, and uses those credentials (if found).

In case password turns out to be incorrect (either because it was invalid, or because it was changed on the server) or missing it just prompts the user again.

Passwords are identified by the combination of username and remote repository url (for HTTP) or username and smtp server address (for SMTP), so they can be reused between repositories if they access the same remote repository.



Install the keyring library:

easy_install keyring

(or pip keyring). On Debian "Sid" the library can be also installed from the official archive (packages python-keyring and either python-keyring-gnome or python-keyring-kwallet).

Extension installation

There are two possible ways of installing the extension: using PyPi package, or using individual file.

To install as a package use easy_install:

easy_install mercurial_keyring

and then enable it in ~/.hgrc (or /etc/mercurial/hgrc) using:

mercurial_keyring =

To install using individual file, download the file, save it anywhere you like, and put the following in ~/.hgrc (or /etc/mercurial/hgrc):

hgext.mercurial_keyring = /path/to/

Password backend configuration

The library should usually pick the most appropriate password backend without configuration. Still, if necessary, it can be configured using ~/keyringrc.cfg file (keyringrc.cfg in the home directory of the current user). Refer to keyring docs for more details.

I considered handling similar options in hgrc, but decided that single user may use more than one keyring-based script. Still, I am open to suggestions.

Repository configuration (HTTP)

Edit repository-local .hg/hgrc and save there the remote repository path and the username, but do not save the password. For example:

myremote =

myremote.schemes = http https
myremote.prefix =
myremote.username = mekk

Simpler form with url-embedded name can also be used:

bitbucket =

Note: if both username and password are given in .hg/hgrc, extension will use them without using the password database. If username is not given, extension will prompt for credentials every time, also without saving the password.

Repository configuration (SMTP)

Edit either repository-local .hg/hgrc, or ~/.hgrc and set there all standard email and smtp properties, including SMTP username, but without SMTP password. For example:

method = smtp
from = Joe Doe <>

host =
port = 587
username =
tls = true

Just as in case of HTTP, you must set username, but must not set password here to use the extension, in other cases it will revert to the default behavior.


Configure the repository as above, then just hg pull, hg push, etc. You should be asked for the password only once (per every username+remote_repository_url combination).

Similarly, for email, configure as above and just hg email. Again, you will be asked for the password once (per every username+email_server_name+email_server_port).

Implementation details

The extension is monkey-patching the mercurial passwordmgr class to replace the find_user_password method. Detailed order of operations is described in the comments inside the code.


Development is tracked on BitBucket, see

Additional notes

Information about this extension is also available on Mercurial Wiki:

Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.