slachiewicz opened a new pull request, #1659: URL: https://github.com/apache/maven-site/pull/1659
Follow-up to gnodet's recommendation in apache/maven#12811 (after the plexus-cipher 2.1.0 break and subsequent pin back to 2.0.x on the Maven 3.x branches). This adds a short note to the Maven 3.x edition of the mini encryption guide (`content/markdown/guides/mini/guide-encryption.md`) making it explicit that: - the `settings.xml` password encryption in Maven 3.x is obfuscation-grade (single-hash key derivation, no authenticated encryption), - it is suitable to keep secrets out of logs and screenshots, but not to resist a determined attacker with access to the ciphertext, - users should rely on restrictive file permissions on `settings.xml` (e.g. `chmod 600`), secrets vaults / CI secret stores, or Maven 4 for stronger protection. The Maven 4 edition of the guide (`guide-encryption-4.md`) is intentionally left untouched. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
