slachiewicz commented on PR #12786: URL: https://github.com/apache/maven/pull/12786#issuecomment-5396335704
The `plexus-cipher` 2.0 to 2.1.0 bump replaces the key derivation function. 2.0 chains `SHA-256(password || salt)` in the style of OpenSSL `EVP_BytesToKey`; 2.1.0 uses `PBKDF2WithHmacSHA1` at 310000 iterations, from [codehaus-plexus/plexus-cipher#23](https://github.com/codehaus-plexus/plexus-cipher/pull/23). The two derivations are unrelated, so ciphertext produced by one never decrypts under the other. That is why `testitEncryption` fails: `MavenCli.encryption()` cannot decrypt the checked-in `settings-security.xml` fixture's `<master>` password with the new algorithm. This reaches users rather than only the test. The same `DefaultSecDispatcher` path decrypts server passwords from `settings.xml` during ordinary builds, and no migration exists for credentials already on disk. The upstream pull request describes the break as intentional. Closing this in favour of #12811, which lays out the options for the maintenance lines. `master` and `maven-4.0.x` are unaffected — they no longer depend on `plexus-cipher`. *This comment was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
