Skip to content

[12811] Warn about obfuscation-grade password encryption in the CLI - #12882

Closed
slachiewicz wants to merge 1 commit into
maven-3.9.xfrom
cli-encryption-warning-3.9.x
Closed

[12811] Warn about obfuscation-grade password encryption in the CLI#12882
slachiewicz wants to merge 1 commit into
maven-3.9.xfrom
cli-encryption-warning-3.9.x

Conversation

@slachiewicz

@slachiewicz slachiewicz commented Aug 28, 2026

Copy link
Copy Markdown
Member

Implements the console warning from the decision in #12811.

MavenCli.encryption() handles --encrypt-master-password and --encrypt-password. It now prints this notice before the encrypted value:

Note: Maven 3.x password encryption is obfuscation-grade and does not protect against a determined attacker; see https://maven.apache.org/guides/mini/guide-encryption.html

The documentation counterpart is apache/maven-site#1659.

@slachiewicz
slachiewicz requested a review from gnodet August 28, 2026 09:40
@slachiewicz
slachiewicz deleted the cli-encryption-warning-3.9.x branch August 28, 2026 09:43
@slachiewicz
slachiewicz removed the request for review from gnodet August 28, 2026 09:43
@slachiewicz slachiewicz added mvn3 enhancement New feature or request labels Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request mvn3

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant