ant security risk

[Christopher William Turner <cw...@cycom.co.uk>]

I'm using ant to build signed jars with a real expensive certificate.
Obviously I don't want my passphrases to be embedded
anywhere. So

<signjar ... storepass="mysecretisout" />
is an unsafe solution
 
<signjar ... storepass="${keystorepass}" /> 
is little better since I must do builds like:
ant -Dkeystorepass=mysecretisout
which gets recorded in my command history file.

The solution is to prompt for the password. I would like
ant to support this but I couldn't find any prompting tasks.

Please could such a password prompt facility be built into ant?.
Maybe with a syntax like:

<askuser destproperty="keystorepass" echo="false" prompt="enter keystore
password" url="console:"/>

-- 
Christopher William Turner, http://www.cycom.co.uk/ "Serving fine Java
since 1996"

Re: ant security risk

[Stefan Bodewig <bo...@apache.org>]

Christopher William Turner <cw...@cycom.co.uk> wrote:

> Please could such a password prompt facility be built into ant?.

Its on the list of features to implement for Ant2.

Stefan

Re: ant security risk

[Peter Donald <do...@apache.org>]

At 01:30 PM 6/8/01 +0100, Christopher William Turner wrote:
>Please could such a password prompt facility be built into ant?.
>Maybe with a syntax like:
>
><askuser destproperty="keystorepass" echo="false" prompt="enter keystore
>password" url="console:"/>

It has been something requested and scheduled for Ant2 but as yet no one
besides Connor has looked at it I don't think. So it will get done ...
eventually. Probably faster if you donate your time ;)

Cheers,

Pete

*-----------------------------------------------------*
| "Faced with the choice between changing one's mind, |
| and proving that there is no need to do so - almost |
| everyone gets busy on the proof."                   |
|              - John Kenneth Galbraith               |
*-----------------------------------------------------*