jelmerk / maven-settings-decoder

A tool to decrypt the password passwords stored in maven settings.xml files

Maven 2.1.0+ supports server password encryption This tool lets you decrypt these passwords as long as you have access to both the settings.xml file and the settings-security.xml file.

To use it download the compiled distributable or build it from source with

./gradlew

This will produce the distribution zip file in build/distributions

usage: settings-decoder
 -f,--settings <arg>            location of settings.xml file.
 -s,--settings-security <arg>   location of settings-security.xml.

maven-settings-decoder's Issues

Add Gradle wrapper

Since users of this project are, by definition, Maven developers, and since if you are like me you would not want to run a tool like this on a precompiled binary, it would be polite to include a gradlew file in the repository to make it as foolproof as possible to build—along with instructions on how to use the build product: I had to find from trial and error that build/scripts/maven-settings-decoder does not work and you actually need to unpack build/distributions/maven-settings-decoder.zip.

ArrayIndexOutOfBoundsException

Sadly does not work for me:

./bin/maven-settings-decoder -f ~/.m2/settings.xml -s ~/.m2/settings-security.xml 
Master password is : <my username>
Exception in thread "main" org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
	at org.sonatype.plexus.components.cipher.PBECipher.decrypt64(PBECipher.java:193)
	at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt(DefaultPlexusCipher.java:72)
	at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decryptDecorated(DefaultPlexusCipher.java:89)
	at org.github.jelmerk.maven.settings.Decorder.decodePassword(Decorder.java:67)
	at org.github.jelmerk.maven.settings.Decorder.printPasswords(Decorder.java:109)
	at org.github.jelmerk.maven.settings.Decorder.main(Decorder.java:62)
Caused by: java.lang.ArrayIndexOutOfBoundsException
	at java.lang.System.arraycopy(Native Method)
	at org.sonatype.plexus.components.cipher.PBECipher.decrypt64(PBECipher.java:175)
	... 5 more

Handle server without <username>

Not all server definitions use the username element. I just want to suggest handling of those elements that use only password (when using OUATH), or just passphrase (when dealing with encrypted files). Examples:

<server>
	<!-- Works fine with username and password -->
	<id>central</id>
	<username>aibaioe</username>
	<password>{mBwLxJFyppMH2940209mabioawHA8HnHPnWCEwddpceLlunQ=}</password>
</server>
<server>
	<!-- Password-only throws IndexOutOfBoundsException -->
	<id>github</id>
	<password>656044bd7622c1981903n28492niban83a49224</password>
</server>
<server>
	<!-- Passphrase-only throws IndexOutOfBoundsException -->
	<id>gpg.passphrase</id>
	<passphrase>{pRfzVmCm7joHKeWh1y4p3c5ama2njfdITbrmhURqcwPMQij/gK5ue6e80uMqK4N}</passphrase>
</server>

Here is the stacktrace when field is missing:

Exception in thread "main" org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
	at org.sonatype.plexus.components.cipher.PBECipher.decrypt64(PBECipher.java:193)
	at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt(DefaultPlexusCipher.java:72)
	at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decryptDecorated(DefaultPlexusCipher.java:89)
	at org.github.jelmerk.maven.settings.Decorder.decodePassword(Decorder.java:66)
	at org.github.jelmerk.maven.settings.Decorder.printPasswords(Decorder.java:107)
	at org.github.jelmerk.maven.settings.Decorder.main(Decorder.java:61)

Specify Java target level

I have both OpenJDK 8 & 11 installed, with 8 as the default. I ran a Gradle build and tried to run the result but it crashed with an error about bytecode version; only worked when I overrode JAVA_HOME to point to 11. I presume this has to do with build.gradle not mentioning a Java level and defaulting to whatever is chosen by the copy of javac that happened to be used. Since the sources seem to be 8-compatible I would suggest enforcing that so that the binary will work on any supported version of Java.

Crash After Master Password Recovery

Exception in thread "main" org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.NegativeArraySizeException
        at org.sonatype.plexus.components.cipher.PBECipher.decrypt64(PBECipher.java:193)
        at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt(DefaultPlexusCipher.java:72)
        at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decryptDecorated(DefaultPlexusCipher.java:89)
        at org.github.jelmerk.maven.settings.Decorder.decodePassword(Decorder.java:66)
        at org.github.jelmerk.maven.settings.Decorder.printPasswords(Decorder.java:107)
        at org.github.jelmerk.maven.settings.Decorder.main(Decorder.java:61)
Caused by: java.lang.NegativeArraySizeException
        at org.sonatype.plexus.components.cipher.PBECipher.decrypt64(PBECipher.java:179)
        ... 5 more