[mojo-dev] [jira] (MRPM-174) Use gpg.passphrase if present.

[Niels Basjes (JIRA)]

Title: Message Title

Niels Basjes commented on an issue   Re: Use gpg.passphrase if present. I traced the code back to MRPM-45 and understand the basic goal of keeping the password out of any logging. Now I see two sensible places where I can put the signing password for automated signing: In the project pom.xml directly (i.e. not in a property) and the value will never be logged ( not even with -X ) due to the Passphrase wrapper class. The major drawback here is that the github repo will contain my key password ( = bad idea). In the ~/.m2/settings.xml as (for example) gpg.passphrase which is then used in the project pom.xml in the rpm plugin configuration as $ {gpg.passphrase} . In this case the output of mvn package -X (I tested this using maven 3.0.3) contains lines like this: [DEBUG] properties used {java.vendor=Oracle Corporation, ... , gpg.passphrase=ReadablePassword , ... } So my first question is really: What is the current 'safe' way of using the signing password in an automated way? Add Comment   Mojo's RPM Maven Plugin / MRPM-174 Use gpg.passphrase if present. If in for example the ~/.m2/settings.xml the property gpg.keyname has been set then the RPM plugin will pick this up and use it. If gpg.passphrase has been set in the same way then jar files are signed automatically but the rpm plugin will ask for the password during the build. As a workaround I now have this in the configuration settings: {code} <k... This message was sent by Atlassian JIRA (v6.1.6#6162-sha1:7af547c) --------------------------------------------------------------------- To unsubscribe from this list, please visit: http://xircles.codehaus.org/manage_email