slachiewicz opened a new pull request, #12882: URL: https://github.com/apache/maven/pull/12882
Implements the console-warning item of gnodet's accepted recommendation in #12811 (after the plexus-cipher 2.1.0 break and the decision to keep plexus-cipher at 2.0 on the Maven 3.x branches, see #12878/#12879/#12880). `MavenCli.encryption()` (which handles `--encrypt-master-password` and `--encrypt-password`) now prints a one-line notice, using the same mechanism the method already uses to print the encrypted value (`System.out.println`): ``` Note: Maven 3.x password encryption is obfuscation-grade and does not protect against a determined attacker; see https://maven.apache.org/guides/mini/guide-encryption.html ``` Rationale: with plexus-cipher staying at 2.0.x on Maven 3.x, users should be clearly told at the point of use that the resulting values are obfuscation-grade only. The user-facing documentation counterpart is in apache/maven-site (PR apache/maven-site#1659). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
