ant-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Christopher William Turner <>
Subject ant security risk
Date Fri, 08 Jun 2001 12:30:34 GMT
I'm using ant to build signed jars with a real expensive certificate.
Obviously I don't want my passphrases to be embedded
anywhere. So

<signjar ... storepass="mysecretisout" />
is an unsafe solution
<signjar ... storepass="${keystorepass}" /> 
is little better since I must do builds like:
ant -Dkeystorepass=mysecretisout
which gets recorded in my command history file.

The solution is to prompt for the password. I would like
ant to support this but I couldn't find any prompting tasks.

Please could such a password prompt facility be built into ant?.
Maybe with a syntax like:

<askuser destproperty="keystorepass" echo="false" prompt="enter keystore
password" url="console:"/>

Christopher William Turner, "Serving fine Java
since 1996"

View raw message