try using the masked password plugin.
On Monday, March 30, 2015 12:00 PM, Andreas <[email protected]>
wrote:
Me again....
My current workaround is to additionally expose the password to the environment
by setting "SCM password environment variable" in the advanced options of the
m2release plugin. In this case the password is also stored as
PasswordParameterValue and thus detected as to be masked by the EnvInject
plugin.
Kind Regards, Andreas.
Am Montag, 30. März 2015 11:16:50 UTC+2 schrieb Andreas:
Hi,
I've a issue with password disclosure when using the M2 Release Plugin and
entering the password.
During the release build the SCM Password is passed to a child maven instance
and unfortunately dumped in plain text (not masked) to the log output. I would
expect that this password is masked using the 'Default' Jenkins mechanism but
it is not.
As a easy test I've changed the goal to be executed as "Release goals and
options" to "help:system". If I now start a release build and enter scm
username/password. I can read in the Log:
<===[JENKINS REMOTING CAPACITY]===>channel started
Executing Maven: -B -f /export/sbs/jenkins/home/ workspace/am-test/pom.xml
-DdevelopmentVersion=2- SNAPSHOT -DreleaseVersion=1 -Dusername=jenkins
help:system -Dpassword=*********
[INFO] Scanning for projects...
[INFO] --- maven-help-plugin:2.2:system (default-cli) @ my-module ---...
============================== ==============================
===================System Properties==============================
============================== ===================JOB_NAME=am-test...
password=mysecretpassword
...
Bug or usage error? Any hint would be appreciated.
Kind Regards,
Andreas.
--
You received this message because you are subscribed to the Google Groups
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/jenkinsci-users/69e3b66d-dd12-42de-b3dc-850f43c59a1f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/jenkinsci-users/1133742144.1478170.1427745968182.JavaMail.yahoo%40mail.yahoo.com.
For more options, visit https://groups.google.com/d/optout.
