Introduction

Maven 4 introduces an enhanced encryption providing more secure handling of passwords than provided by the one from Maven 3. It ships with multiple pluggable providers (internally referred to as dispatchers) which use different approaches for decrypting secret values from settings.xml.

Dispatchers

Master Key Sources

There are different master key source implementations shipping with Maven with which the master key may be retrieved. Each of them have a unique prefix used in the dispatcher's source property of the settings-security4.xml (for the Master Dispatcher) or the reference used in the settings.xml (for the Master Source Lookup Dispatcher). This is the list of implementations (in parentheses the format of the source):

1. Plain file (file:<filepath>), the given filepath must be absolute. Only considered secure if located on a protected file system.
2. Environment variable (env:<variable-name>), the environment variable must be externally populated via some secure means.
3. Java System Properties (system-property:<property-name>), the Java system property must be externally populated via some secure means.
4. GnuPG Agent (gpg-agent:<agentSocketPath>(?non-interactive)), requires one manual input per user session. The default agent socket path is .gnupg/S.gpg-agent within the user's home directory.
5. Pinentry (pinentry-prompt:<pinentry-binary-path>), requires manual input of the password every time a decryption is required. The path should specify the absolute location of the pinentry binary to be used. The one used by GnuPG Agent can be found in ~/.gnupg/gpg-agent.conf in property pinentry-program.
6. 1Password CLI (onepassword:<1Password Secret Reference URI>), looks up secret values from a 1Password vault leveraging the 1Password CLI. The 1Password Secret Reference URI always starts with op://.

One has to pick a suitable source depending on the security and ease-of-use requirements.

Setup

There is a dedicated tool named mvnenc shipping with Maven 4 which helps both with the setup and encryption of values, as well as diagnosis in case of issues. Start by executing mvnenc init and then select the desired dispatcher.

Depending on this choice there may be multiple subsequent configuration steps.

Afterwards check with mvnenc diag if the configuration is valid.

In contrast to settings.xml there is no support for expressions in the security related settings

Create encrypted values

Execute mvnenc encrypt and afterwards enter the value to encrypt via the CLI. The tool emits the encrypted value in the format

{[name=<dispatcher name>,<dispatcher-specific attributes>,version=4.0]<the encrypted value>}

which can be just used as is in the settings.xml.

Implementation

The implementation relies on the Plexus Security Dispatcher Component which also provides an SPI to implement your own source of the master password or other dispatcher implementations.