You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@maven.apache.org by "Tamas Cservenak (Jira)" <ji...@apache.org> on 2024/03/04 14:51:00 UTC

[jira] [Reopened] (MGPG-105) Stop propagating bad practices

     [ https://issues.apache.org/jira/browse/MGPG-105?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tamas Cservenak reopened MGPG-105:
----------------------------------

> Stop propagating bad practices
> ------------------------------
>
>                 Key: MGPG-105
>                 URL: https://issues.apache.org/jira/browse/MGPG-105
>             Project: Maven GPG Plugin
>          Issue Type: Task
>            Reporter: Tamas Cservenak
>            Assignee: Tamas Cservenak
>            Priority: Major
>             Fix For: 3.2.0
>
>
> Storing any kind of "password-like" things on disk in files is bad (and no, SecDispatcher IS a joke).
> Passphrase should be acquired only by two means:
>  * using gpg-agent (when on workstation locally)
>  * using env variables (when on CI where they are set up as "secrets")
> Plugin should in fact FAIL to warn user about presence of any secrets in settings/properties/projects. That is wrong way.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)