Skip to content

Commit afdfd28

Browse files
authored
[MGPG-138] Drop direct use of plexus-cipher and secdispatcher (#115)
Use proper Maven 3 API instead. --- https://issues.apache.org/jira/browse/MGPG-138
1 parent 7516e7c commit afdfd28

File tree

3 files changed

+49
-50
lines changed

3 files changed

+49
-50
lines changed

pgp-keys-map.list

+2-3
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,7 @@ org.opentest4j:opentest4j = 0xFF6E2C001948C5F2F38B0CC385911F425EC61B51
2828
org.apache.maven.resolver = 0x29BEA2A645F2D6CED7FB12E02B172E3E156466E8
2929
org.apache.maven.shared:maven-invoker = 0x84789D24DF77A32433CE1F079EB80E92EB2135B1
3030
org.apache.maven.shared:maven-shared-utils = 0x84789D24DF77A32433CE1F079EB80E92EB2135B1
31-
org.codehaus.plexus:plexus-cipher = 0x6A814B1F869C2BBEAB7CB7271A2A1C94BDE89688
3231
org.codehaus.plexus:plexus-classworlds = 0xB91AB7D2121DC6B0A61AA182D7742D58455ECC7C
3332
org.codehaus.plexus:plexus-component-annotations = 0xFA77DCFEF2EE6EB2DEBEDD2C012579464D01C06A
34-
org.codehaus.plexus:plexus-utils = 0xF254B35617DC255D9344BCFA873A8E86B4372146
35-
org.codehaus.plexus:plexus-sec-dispatcher = 0x2BE13D052E9AA567D657D9791FD507154FB9BA39
33+
org.codehaus.plexus:plexus-utils = 0x84789D24DF77A32433CE1F079EB80E92EB2135B1
34+
org.codehaus.plexus:plexus-xml = 0x84789D24DF77A32433CE1F079EB80E92EB2135B1

pom.xml

+16-24
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@ under the License.
6969
</properties>
7070

7171
<dependencies>
72+
<dependency>
73+
<groupId>javax.inject</groupId>
74+
<artifactId>javax.inject</artifactId>
75+
<version>1</version>
76+
<scope>provided</scope>
77+
</dependency>
7278
<dependency>
7379
<groupId>org.apache.maven</groupId>
7480
<artifactId>maven-plugin-api</artifactId>
@@ -105,6 +111,12 @@ under the License.
105111
<version>${mavenVersion}</version>
106112
<scope>provided</scope>
107113
</dependency>
114+
<dependency>
115+
<groupId>org.apache.maven</groupId>
116+
<artifactId>maven-settings-builder</artifactId>
117+
<version>${mavenVersion}</version>
118+
<scope>provided</scope>
119+
</dependency>
108120
<dependency>
109121
<groupId>org.apache.maven.resolver</groupId>
110122
<artifactId>maven-resolver-api</artifactId>
@@ -126,7 +138,10 @@ under the License.
126138
<dependency>
127139
<groupId>org.codehaus.plexus</groupId>
128140
<artifactId>plexus-utils</artifactId>
129-
<version>3.5.1</version>
141+
</dependency>
142+
<dependency>
143+
<groupId>org.codehaus.plexus</groupId>
144+
<artifactId>plexus-xml</artifactId>
130145
</dependency>
131146
<dependency>
132147
<groupId>org.bouncycastle</groupId>
@@ -149,29 +164,6 @@ under the License.
149164
<version>2.10.0</version>
150165
<type>pom</type>
151166
</dependency>
152-
<!-- These two below must go in pair -->
153-
<dependency>
154-
<groupId>org.codehaus.plexus</groupId>
155-
<artifactId>plexus-sec-dispatcher</artifactId>
156-
<version>2.0</version>
157-
<exclusions>
158-
<exclusion>
159-
<groupId>*</groupId>
160-
<artifactId>*</artifactId>
161-
</exclusion>
162-
</exclusions>
163-
</dependency>
164-
<dependency>
165-
<groupId>org.codehaus.plexus</groupId>
166-
<artifactId>plexus-cipher</artifactId>
167-
<version>2.0</version>
168-
<exclusions>
169-
<exclusion>
170-
<groupId>*</groupId>
171-
<artifactId>*</artifactId>
172-
</exclusion>
173-
</exclusions>
174-
</dependency>
175167

176168
<dependency>
177169
<groupId>org.junit.jupiter</groupId>

src/main/java/org/apache/maven/plugins/gpg/AbstractGpgMojo.java

+31-23
Original file line numberDiff line numberDiff line change
@@ -18,23 +18,23 @@
1818
*/
1919
package org.apache.maven.plugins.gpg;
2020

21+
import javax.inject.Inject;
22+
2123
import java.io.File;
22-
import java.util.Collections;
2324
import java.util.List;
2425

2526
import org.apache.maven.execution.MavenSession;
2627
import org.apache.maven.plugin.AbstractMojo;
2728
import org.apache.maven.plugin.MojoExecutionException;
2829
import org.apache.maven.plugin.MojoFailureException;
29-
import org.apache.maven.plugins.annotations.Component;
3030
import org.apache.maven.plugins.annotations.Parameter;
3131
import org.apache.maven.project.MavenProject;
3232
import org.apache.maven.settings.Server;
3333
import org.apache.maven.settings.Settings;
34-
import org.sonatype.plexus.components.cipher.DefaultPlexusCipher;
35-
import org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher;
36-
import org.sonatype.plexus.components.sec.dispatcher.SecDispatcher;
37-
import org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException;
34+
import org.apache.maven.settings.building.SettingsProblem;
35+
import org.apache.maven.settings.crypto.DefaultSettingsDecryptionRequest;
36+
import org.apache.maven.settings.crypto.SettingsDecrypter;
37+
import org.apache.maven.settings.crypto.SettingsDecryptionResult;
3838

3939
/**
4040
* @author Benjamin Bentmann
@@ -256,12 +256,6 @@ public abstract class AbstractGpgMojo extends AbstractMojo {
256256
@Parameter(property = "gpg.signer", defaultValue = GpgSigner.NAME)
257257
private String signer;
258258

259-
/**
260-
* @since 3.0.0
261-
*/
262-
@Component
263-
protected MavenSession session;
264-
265259
/**
266260
* Switch to improve plugin enforcement of "best practices". If set to {@code false}, plugin retains all the
267261
* backward compatibility regarding getting secrets (but will warn). If set to {@code true}, plugin will fail
@@ -285,14 +279,16 @@ public abstract class AbstractGpgMojo extends AbstractMojo {
285279
protected Settings settings;
286280

287281
/**
288-
* Maven Security Dispatcher.
289-
*
290-
* @since 1.6
291-
* @deprecated Provides quasi-encryption, should be avoided.
282+
* @since 3.0.0
292283
*/
293-
@Deprecated
294-
private final SecDispatcher secDispatcher =
295-
new DefaultSecDispatcher(new DefaultPlexusCipher(), Collections.emptyMap(), "~/.m2/settings-security.xml");
284+
@Inject
285+
protected MavenSession session;
286+
287+
/**
288+
* @since 3.2.6
289+
*/
290+
@Inject
291+
protected SettingsDecrypter settingsDecrypter;
296292

297293
@Override
298294
public final void execute() throws MojoExecutionException, MojoFailureException {
@@ -415,11 +411,23 @@ private String loadGpgPassphrase() throws MojoFailureException {
415411
Server server = settings.getServer(passphraseServerId);
416412
if (server != null) {
417413
if (isNotBlank(server.getPassphrase())) {
418-
try {
419-
return secDispatcher.decrypt(server.getPassphrase());
420-
} catch (SecDispatcherException e) {
421-
throw new MojoFailureException("Unable to decrypt gpg passphrase", e);
414+
SettingsDecryptionResult result =
415+
settingsDecrypter.decrypt(new DefaultSettingsDecryptionRequest(server));
416+
for (SettingsProblem problem : result.getProblems()) {
417+
switch (problem.getSeverity()) {
418+
case WARNING:
419+
case ERROR:
420+
getLog().warn(problem.getMessage(), problem.getException());
421+
break;
422+
case FATAL:
423+
getLog().error(problem.getMessage(), problem.getException());
424+
throw new MojoFailureException(problem.getMessage(), problem.getException());
425+
default:
426+
throw new IllegalStateException("Unknown severity: "
427+
+ problem.getSeverity().toString());
428+
}
422429
}
430+
return result.getServer().getPassphrase();
423431
}
424432
}
425433
}

0 commit comments

Comments
 (0)