690cc018255362c9d1af6ed5f4fa15ae7a0fc81d
max
  Wed Aug 5 11:26:22 2026 -0700
changes after automated code review

hgLogin: sign the pending social identity with hmacMd5() instead of a hand-built
cookieSalt-prefix + MD5. The salt now keys the HMAC rather than being prepended to
the hashed message. This is the signature that closes the account-takeover hole in
the OAuth account chooser, so it should use a real MAC. It also now fails closed:
with login.cookieSalt unset the old code hashed an empty salt, so anyone could
compute a valid signature and the protection was silently absent - hgLogin refuses
to run a social login without the salt. Ordinary login pages never reach this check.
Pending identities in flight across the upgrade no longer validate; those users are
asked to sign in again.

lib/hmac.c: hmacSha1() and hmacMd5() sized their hex buffers at exactly 40 and 32
chars, so the last sprintf wrote its terminating zero one byte past the array and
the following strlen read out of bounds. Grow both by one and use cloneString().
Output is unchanged, verified against openssl dgst -hmac.

userAccounts.css: drop the #helpBox rule, unused since the last id="helpBox" was
removed from hgLogin.c.

mirrorManual, ex.hg.conf: the login section claimed "three" extra ways to sign in
when there are two (external provider, one-time email link). Also document that
login.cookieSalt is required for social sign-in, now that the check fails closed.
Edited mirrorManual.txt and regenerated the html with mirrorDocs/make, since the
html is pandoc output and hand edits there do not survive.

refs #37984

diff --git src/hg/htdocs/style/userAccounts.css src/hg/htdocs/style/userAccounts.css
index a86f9db3747..b6c5bbac7c7 100644
--- src/hg/htdocs/style/userAccounts.css
+++ src/hg/htdocs/style/userAccounts.css
@@ -58,36 +58,30 @@
 
 input.largeButton:hover,
 a.cancelButton:hover {
     background: #e6e6e6;
     border-color: #666;
 }
 
 /* Small "Forgot username / password" links under the login form fields. */
 a.forgotLink {
     display: block;
     margin-top: 3px;
     font-size: 0.8em;
     text-align: left;
 }
 
-#helpBox {
-    margin-top: 20px;
-    padding: 20px 0 10px 0; 
-    border-top: 1px solid #eed5b7;
-}
-
 label small {
     font-style: italic;
     font-size: 0.9em;
 }
 
 .topBarContainer { /* only needed for login screens */
     padding: 6px 0;    
 }
 
 .highlightBox { /* combine with classes error, alert, or highlight */
 	border: 2px solid;
     padding: 10px;
 }
 
 .error { /* for use with highlightBox, when used for error msgs */