How to clean confidential data in mercurial changesets?

Question

I want to sell a copy of my system and need to transfer the source code to my customers. I use Mercurial as the VCS. There are some confidential data in my code. For example, Amazon access key/secert key, database passwords and ssl private keys. Those keys are written in the code or configuration files, like this:

# settings of Amazon S3 storage
s3.storages:
    access_key: <secret>
    secret_key: <secret>

Before I transfer my code to them, I need to clean all those confidential data in the code base. But all of them are in history (changesets). With Mercurial, how can I clean those secret?

Answer 1

If you're giving the customers only a snapshot you can do it after you run hg archive.

If you want to give them access to the repository with full history you need to use hg convert to exclude that file.

In that case you're probably better off just invalidating the AWS key and using a new one in the future -- Amazon makes that very easy.

Going forward you're better off not putting those keys into source control. Instead put in a config.sample file and then add config.actual top your .hgignore.