4 ms·

And while we're at it https://issues.apache.org/jira/plugins/servlet/mobile#issue/MNG-5814 https://issues.apache.org/jira/plugins/servlet/mobile#issue/... Als

by raggi 9y ago

And while we're at it https://issues.apache.org/jira/plugins/servlet/mobile#issue/MNG-5814 https://issues.apache.org/jira/plugins/servlet/mobile#issue/... Also, if you read the docs you'll notice that the deploy plugins encourage users to put their central passwords in an xml file in the plain AND their pgp key passphrase in another, in the plain. No joke. Read the docs.

thehardsphere 9y ago
An injection attack on a download is not one of the problems we're actually talking about here. That's a problem that affects any package manager. And it's patently false to say that the deploy plugin documentation encourages you to include that information. They very clearly preface that with "if your repository is secured" and use the explicit example of an internal repository within a corporate context. People smart enough to read that documentation in detail should also be smart enough to determine when it is and isn't a good idea to do that.