oscerd opened a new issue, #1805:
URL: https://github.com/apache/camel-kafka-connector/issues/1805
## Description
Two things in `release-utils/release.sh` worth tightening.
**1. Credentials on the command line**
```sh
./mvnw -Prelease -P"$GPG_PROFILE" -DreleaseVersion="$RELEASE_VERSION"
-DdevelopmentVersion="$NEXT_VERSION" \
-Dtag="$RELEASE_TAG" -Dusername="$APACHE_USER"
-Dpassword="$APACHE_PASS" release:prepare
```
`-Dpassword=...` appears in the process table for the lifetime of the build
and in the shell history
of whoever runs the script. A `settings.xml` `<server>` entry (optionally
with a
`maven-password-encryption` master password) or an environment variable read
by `settings.xml` keeps
it out of `ps`.
**2. The release tag is force-pushed**
```sh
git tag -f "$RELEASE_TAG" && git push -f origin "$RELEASE_TAG"
```
The tag created by `release:prepare` is deleted and re-created so that the
regenerated catalog
descriptors are included, then force-pushed. That makes a published release
tag mutable: the commit
a given `camel-kafka-connector-X.Y.Z` tag points at can change after the
fact, and anyone who fetched
it earlier has a different tree than anyone who fetches it later.
Since the intent is only to add the regenerated descriptors, an alternative
is to regenerate them
**before** `release:prepare` runs (so the tag is right the first time), or
to commit them on the
release branch and tag once, so no tag ever needs re-pointing.
## Expected Behavior
The release process does not put the account password on a command line, and
a release tag, once
pushed, always points at the same commit.
## Actual Behavior
As described above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
