Eric, thanks for the hint. Nevertheless, the masking just works if I also expose the password as "SCM password environment variable", for both EnvInject and Mask Password plugin.
Kind Regards, Andreas. Am Montag, 30. März 2015 22:06:25 UTC+2 schrieb [email protected]: > > try using the masked password plugin. > > > > > On Monday, March 30, 2015 12:00 PM, Andreas <[email protected] > <javascript:>> wrote: > > > Me again.... > > My current workaround is to additionally expose the password to the > environment by setting "SCM password environment variable" in the advanced > options of the m2release plugin. In this case the password is also stored > as PasswordParameterValue and thus detected as to be masked by the EnvInject > plugin. > > Kind Regards, Andreas. > > Am Montag, 30. März 2015 11:16:50 UTC+2 schrieb Andreas: > > Hi, > > I've a issue with password disclosure when using the M2 Release Plugin and > entering the password. > > During the release build the SCM Password is passed to a child maven > instance and unfortunately dumped in plain text (not masked) to the log > output. I would expect that this password is masked using the 'Default' > Jenkins mechanism but it is not. > > As a easy test I've changed the goal to be executed as "Release goals and > options" to "help:system". If I now start a release build and enter scm > username/password. I can read in the Log: > > <===[JENKINS REMOTING CAPACITY]===>channel started > > Executing Maven: -B -f /export/sbs/jenkins/home/ workspace/am-test/pom.xml > -DdevelopmentVersion=2- SNAPSHOT -DreleaseVersion=1 -Dusername=jenkins > help:system -Dpassword=********* > > [INFO] Scanning for projects... > > [INFO] *--- maven-help-plugin:2.2:system (default-cli) @ my-module --- * > ... > ============================== ============================== > =================== System Properties ============================== > ============================== =================== JOB_NAME=am-test ... > > password=mysecretpassword > ... > > Bug or usage error? Any hint would be appreciated. > > > Kind Regards, > Andreas. > > > > > -- > You received this message because you are subscribed to the Google Groups > "Jenkins Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/jenkinsci-users/69e3b66d-dd12-42de-b3dc-850f43c59a1f%40googlegroups.com > > <https://groups.google.com/d/msgid/jenkinsci-users/69e3b66d-dd12-42de-b3dc-850f43c59a1f%40googlegroups.com?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > > > -- You received this message because you are subscribed to the Google Groups "Jenkins Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/c890efa7-d76a-4dc5-915a-3c8b25278b64%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
