Hg Source Control
Hg source control is the command tool for the Mercurial version system. Teams use it to track code changes, manage branches, and share files across servers. Most groups set up central servers where developers push and pull code. When team roles are too broad, anyone can change main branches or read private keys. Clear rules help teams keep their code safe and organized. How hg source control works in team workflows Mercurial stores a full copy of the code history on each local machine. Develo
Snyk Open Source: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Hg source control is the command tool for the Mercurial version system. Teams use it to track code changes, manage branches, and share files across servers. Most groups set up central servers where developers push and pull code. When team roles are too broad, anyone can change main branches or read private keys. Clear rules help teams keep their code safe and organized.
How hg source control works in team workflows
Mercurial stores a full copy of the code history on each local machine. Developers write code, save changes locally, and then push updates to a shared server. The server checks who the user is before it accepts any new files. Teams often use SSH keys or web passwords to log in to the host.
Once a user logs in, the server checks its access rules. Admins write these rules in text files on the central host. A rule might say that junior staff can read code but cannot write to main. Senior staff might get full write rights for all branches and tags. Hooks on the server can also run scripts before a push finishes. These scripts check commit messages or block files that are too large.
What native hg source control settings cover and what they miss
Built-in server rules do a good job of stopping random guests from reading code. They let admins group users by team and lock down release branches. Hooks also help teams enforce basic style rules before code lands on the server. For small groups with simple needs, these local text files work fine.
Still, native settings mainly decide who can log in to the server. They do not track every action a user takes during a live session. If a developer logs in to the host machine to fix a broken repo, they often get broad shell rights. Static SSH keys also sit on laptops for months without expiring. If someone steals a key, they can pull every repo right away. Server logs show that a pull happened, but they lack deep detail for audits. Teams also struggle when they must update access files across dozens of separate hosts.
Snyk Open Source: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Best practices for securing Mercurial servers
Start by separating read rights from write rights for every project. Give build tools read-only keys so they cannot push changes back to the repo. Review your server access lists every month and remove old staff accounts. Use pre-commit hooks to scan for secrets like API keys or passwords in code. Keep your central Mercurial hosts patched and limit who can open a shell on them.
Teams should also centralize how users log in across all engineering tools. Tying repo access to a single directory makes it easy to revoke rights fast. When someone leaves the team, one click should cut off their code access. Good logs should record who ran which command and when they did it. This clear trail helps security teams pass audits and spot strange actions early.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why is Mercurial called hg source control?
The letters hg come from hydrargyrum, which is the chemical symbol for the element mercury. All commands in the tool start with those two letters.
How does hg source control handle branches differently than Git?
Mercurial embeds the branch name inside each commit record forever. Git uses movable pointers that can change or be deleted later on.
Can teams restrict access to specific folders in a Mercurial repo?
Native rules can block writes to specific paths using server hooks. Still, anyone who can clone the repo can still read the full history.