[
https://issues.apache.org/jira/browse/MNG-8377?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamas Cservenak updated MNG-8377:
---------------------------------
Fix Version/s: (was: 4.0.0-beta-6)
> Gitlab.com PAT cannot be encrypted in settings.xml in httpHeaders field
> -----------------------------------------------------------------------
>
> Key: MNG-8377
> URL: https://issues.apache.org/jira/browse/MNG-8377
> Project: Maven
> Issue Type: Bug
> Components: Bootstrap & Build
> Affects Versions: 3.9.9
> Reporter: Tom Benjamins
> Priority: Minor
>
> Given a gitlab.com account,
> a PAT (personal access token) that is passed to the gitlab.com repo via
> httpHeaders field cannot be encrypted,
> while the regular password field for our legacy nexus repo can be encrypted.
> settings.xml file is as follows:
> <settings xmlns="http://maven.apache.org/SETTINGS/1.1.0";
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.1.0
> http://maven.apache.org/xsd/settings-1.1.0.xsd";>
> <localRepository>/some/dir</localRepository>
> <servers>
> <server>
> <id>nexus</id>
> <username>bla</username>
> <password>\{SOMENCRYTPEDPASSWORD==}</password><!-- encrypted
> standard jenkins password here -->
> </server>
> <server>
> <id>gitlab-maven</id>
> <configuration>
> <httpHeaders>
> <property>
> <name>Private-Token</name>
> <value>\{SOMEENCRYPTEDPAT==}</value> <!-- PAT
> encrypted -->
> </property>
> </httpHeaders>
> </configuration>
> </server>
>
> </servers>
> I know there is a possible workaround to add an extension like
> [https://github.com/causalnet/full-servers-decryption-maven-extension] for an
> individual project, but that is very annoying if you have to do it for every
> single project.
> I just add this issue because this is by far the easiest way for the end user
> to use this type of connection for ALL projects, while also looking from a
> security point of view.
> I'm also hoping this is not a duplicate (I could not find a similar issue at
> least.....)
> Any info or opinion about this is highly appreciated.
> Tom
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
