You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "Brill Pappin (JIRA)" <ji...@codehaus.org> on 2009/03/03 21:49:13 UTC
[jira] Commented: (MRELEASE-420) Prepare and Perform should use
profile server settings
[ http://jira.codehaus.org/browse/MRELEASE-420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=167789#action_167789 ]
Brill Pappin commented on MRELEASE-420:
---------------------------------------
It appears the scm password is stored in plain text in the release.properties, someone one unsuspecting could actually check that into a repo that was open to the public.
This is all the more reason that the *correct* way to do it is via the profile server definitions.
> Prepare and Perform should use profile server settings
> ------------------------------------------------------
>
> Key: MRELEASE-420
> URL: http://jira.codehaus.org/browse/MRELEASE-420
> Project: Maven 2.x Release Plugin
> Issue Type: Improvement
> Components: perform, prepare
> Environment: latest in central as of this issue
> Reporter: Brill Pappin
> Priority: Critical
>
> The release plugin for some reason requires -Dusername= and -Dpassword= on the command line.
> The plugin should be using the standard profile server definitions instead (or as well as).
> Forcing the properties onto the command line is a security risk that doesn't need to be there.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira