[
http://jira.codehaus.org/browse/MRELEASE-420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=167789#action_167789
]
Brill Pappin commented on MRELEASE-420:
---------------------------------------
It appears the scm password is stored in plain text in the release.properties,
someone one unsuspecting could actually check that into a repo that was open to
the public.
This is all the more reason that the *correct* way to do it is via the profile
server definitions.
> Prepare and Perform should use profile server settings
> ------------------------------------------------------
>
> Key: MRELEASE-420
> URL: http://jira.codehaus.org/browse/MRELEASE-420
> Project: Maven 2.x Release Plugin
> Issue Type: Improvement
> Components: perform, prepare
> Environment: latest in central as of this issue
> Reporter: Brill Pappin
> Priority: Critical
>
> The release plugin for some reason requires -Dusername= and -Dpassword= on
> the command line.
> The plugin should be using the standard profile server definitions instead
> (or as well as).
> Forcing the properties onto the command line is a security risk that doesn't
> need to be there.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
