[MNG-8425] creating maven encryption settings creates invalid settings

[jira-importer]

James Nord opened MNG-8425 and commented

I ran through the wizard to create a new maven4 encryption setup and then tried to encrypt a password.
the password encryption failed telling me
"Maven Encryption is not configured, run mvnenc init first."

 

Steps to reproduce

Create a maven 4 encryption context to use an environment variable:

• Start the Maven 4 encryption wizard to setup encryption ({}mvn --force --enc init{})
• Choose "Master Password Dispatcher"
• Choose "Environment variable (variable name should be edited)"
• Choose "AES/GCM/NoPadding"
• when promped for the variable enter "{}MVN_PASSWORD{}"
• check the proposed values look correct and approve with "Y"
• wait for the file to be written

Set the variable for maven to use

• SET MVN_PASSWORD=TESTING_PASSWORD  (or use export on *nix like system)

Attempt to create an encrypted password

•  mvn --enc encrypt

Expected results

• there is a prompt for the password that is to be encrytped
• an encrypted password is output

Actual results

The command tells you encryption is not configured.

 

mvn --enc encrypt
Configuration validation of MavenSecDispatcher: INVALID
  Configuration file present on path C:\Users\jnord\.m2\settings-security4.xml
  Default dispatcher configured
  Legacy dispatcher present in system
  Legacy dispatcher is operational; transparent fallback possible
  Configured default dispatcher configuration is invalid
  Configuration validation of MasterDispatcher: INVALID
    Configured Cipher supported
    Configured Source configuration not handled
  Configuration validation of LegacyDispatcher: VALID
    Legacy configuration found with encrypted master password
    Legacy master password successfully decrypted
Maven Encryption is not configured, run `mvnenc init` first. 

 

 

---

Affects: 4.0.0-rc-1

[jira-importer]

James Nord commented

it appears as though this is because the encrytor wants you to enter "enc:$" before the environment variable name (e.g. {}enc:$MAVEN_PASSWORD{}) , but this is poor UX, I have already been asked where I want to source it so as a user I expect it to be sourced from the environment, and if maven internals need that to have "env:$" prefixed to the entry then the internals add that not the user.

Same occurs for all types.  

[jira-importer]

Tamas Cservenak commented

Yes, sadly mvnenc is not 100% done. It needs editing (the generated XML), as the env variable name, system property name, or pinentry executable or gpg-agent pipe path is not (yet) discovered and/or added.
Also, rc1 had quite some issues already fixed on master (see rc-2 issues related to mvnenc).

[jira-importer]

James Nord commented

I Apologize if I am filing issues for WIP and known incomplete things.

Is there a somewhere I can check other than Jira for these things before filling?
(being an RC I was expecting a release that was "ready but we may have missed some things so please take it for a spin, kick the tyres and let us know if there is something not working" release).

[Hiteshsai007]

I have opened a PR to address this issue.

Root Cause: The Init goal in maven-cli presents editable templates like env:$VARIABLE_NAME during the encryption setup wizard. When the user provides their input (e.g., MVN_PASSWORD), the code saves only the raw input, discarding the required env: prefix. This results in <value>MVN_PASSWORD</value> in settings-security4.xml instead of the correct <value>env:MVN_PASSWORD</value>. The MasterDispatcher in plexus-sec-dispatcher then fails validation because no MasterSource can handle a config string without its prefix, producing the "Configured Source configuration not handled" error.

Fix: After the user provides input for an editable field, the code now extracts the prefix from the template (everything before the $ placeholder) and automatically prepends it if the user's input doesn't already include it. This ensures settings-security4.xml always contains well-formed source values regardless of whether the user includes the prefix themselves.