[MRELEASE-1063] Maven release plugin should retain settings.security environment variable for its forked executions of release:prepare and release:perform

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.5.2
• Fix Version/s: waiting-for-feedback, wontfix-candidate
• Labels: up-for-grabs
• Assignee: Unassigned
• Reporter: Hans Aikema
• Created: 16/Apr/21 18:02
• Updated: 25/Dec/22 22:45

Description

While trying to create a build with on-demand local provisioning of the secrets for the technical build-user on the build-slave (removing them directly after their use) I found out the hard way that the Maven-release plugin does not support a custom location for settings-security in the way that is documented at MNG-4853.

When running

mvn --settings myGeneratedSettings.xml -Dsettings.security=myGeneratedSettings-security.xml -B release:prepare release:perform

The user settings.xml flag is honored (by the fix of MRELEASE-577), but the custom settings-security from the environment variable is lost causing password decryption failures and therefor in the end a release failure when running against a repository that requires authentication.

 As a workaround one has to change the invocation to
either

mvn --settings myGeneratedSettings.xml -Dsettings.security=myGeneratedSettings-security.xml -B release:prepare release:perform -DpreparationGoals="clean verify -Dsettings.security=myGeneratedSettings-security.xml" -Dgoals="deploy site-deploy -Dsettings.security=../../myGeneratedSettings-security.xml"
or
mvn --settings myGeneratedSettings.xml -Dsettings.security=myGeneratedSettings-security.xml -B release:prepare release:perform -DpreparationGoals="clean verify -Dsettings.security=myGeneratedSettings-security.xml" -Dgoals="deploy -Dsettings.security=../../myGeneratedSettings-security.xml"

depending on whether there is a site distribution configuration or not.