--- a/modules/vcs/manifests/init.pp	Thu Feb 20 16:57:09 2020 +0000
+++ b/modules/vcs/manifests/init.pp	Sat Feb 22 16:22:57 2020 +0000
@@ -8,6 +8,15 @@
     python::pip { 'mercurial-keyring':
         ensure => 'present',
     }
+    # Alt keyrings are insecure, but a) we're on a limited access server and
+    # b) I share the Mecurial config with the desktop, which uses the system
+    # keyring rather than
+    #
+    # [backend]
+    # default-keyring=keyrings.alt.file.PlaintextKeyring
+    python::pip { 'keyrings.alt':
+        ensure => 'present',
+    }
     file { '/etc/bash_completion.d/git-prompt.sh':
         ensure => 'link',
         target => '/usr/share/git-core/contrib/completion/git-prompt.sh',
@@ -17,6 +26,7 @@
 class vcs::client inherits vcs {
 	realize(Package["mercurial"],
 		Python::Pip["mercurial-keyring"],
+		Python::Pip["keyrings.alt"],
 		Package["git"])
 }