tools-deps 2024-05-15

I just ran into the missing support for password encryption in settings.xml: https://ask.clojure.org/index.php/13320/support-of-maven-password-encryption-in-tools-deps. I've voted for the issue on Ask. In the meantime, does anyone have a practical workaround where I can avoid keeping unencrypted passwords in settings.xml?

<username>${env.SERVER_USERNAME}</username>
      <password>${env.SERVER_PASSWORD}</password>

๐Ÿ‘ 1

Thanks, I'll give it a go.

Works beautifully, thanks! ๐Ÿ‘ Though I'd love to see that Ask implemented to avoid keep plaintext password laying around.

Alex Miller (Clojure team) 2024-05-15T12:34:08.215849Z

I believe there is a patch on that ticket but Iโ€™m kind of waiting until I make the transition to the newer set of Maven libs as that may change the impl

๐Ÿ‘ 1

the env var is how we do it at my job as well, it works great across teams

I am wondering how much extra security you get by moving it to env varsโ€ฆ

They can be fed from password managers agents, or on ci via a runner, etc etc itโ€™s quite handy

โž• 1

we use the 1password cli tool to inject a bunch of env variables for our common tasks with binstubs

you can use env vars