Hello.
To save my Windows %userprofile% from gb of data I have set GRADLE_USER_HOME somewhere outside, say C:\MyGradleHome.
Now I need to add credentials (e.g. username, pwd for artifactory) to gradle.properties located within GRADLE_USER_HOME, which obviously is not the best place now. As far as I know with GRADLE_USER_HOME pointing somewhere else there is no simple way to still have a user specific gradle.properties file inside %userprofile% which gradle will take into account when running?
What is the recommended way to have credentials globally (per user) available save within user home directory yet still have GRADLE_USER_HOME pointing somewhere else? Or alternatively do not set GRADLE_USER_HOME thus with gradle.properties inside %userprofile%; but at least have the larger folders, tmp, jdk, cache, wrapper outside of %userprofile%? Create a hardlink for each of the folders? Or can some of the locations be configured?
Placing user environment properties for username and password does not feel right either.
Not quite sure yet whether net.saliman.properties might help. Still need to check this.
To me it is not obvious, why should it be less appropriate?
Not quite sure yet whether net.saliman.properties might help. Still need to check this.
Probably not, it also checks in GRADLE_USER_HOME, because that is the current user’s Gradle home, everything else would be a bug.
Also, the plugin technically cannot set Gradle project properties but only “extra” properties, so depending on how the property is read it might not use the value from the “local” file, for example if the standard repository credentials functionality is used, or if providers.gradleProperty is used.
To me it is not obvious, why should it be less appropriate?
At least it does not feel right as this location could be accessed by any user on the machine. Well, not that there are any (with the exception of Admins).
So on the one hand it seems (to me) a valid concern whether this is the right place for unencrypted credentials. Also the location might be part of some backup. So things are then somehow out of my control.
On the other hand I surely might see a problem where there is none.
As it seems that there is no easy way I might likely leave it like that.
But with that in mind the outcome might also have been to “never” change the location of GRADLE_USER_HOME and leave it with the %userprofile%. But I still remember situations when I got error messages on the quota of the %userprofile%, so I am always trying to keep stuff out of %userprofile% if achievable with reasonable effort.
At least it does not feel right as this location could be accessed by any user on the machine.
You can restrict it the same as your user home is, just change the access rights for the folder.
whether this is the right place for unencrypted credentials
ANY Gradle build you execute can accesss these, so if you happen to execute a malicious build, it can just read all Gradle properties and send them to some location.
Also any other executable you execute could just read that file and send the properties to some location.
I don’t think you can configure it more fine-grained.
Hard-links would not work, as those are only usable for files, not folders.
But you maybe meant to use Junctions for the resource-intense folders, that might be a way.
ANY Gradle build you execute can accesss these, so if you happen to execute a malicious build, it can just read all Gradle properties and send them to some location.
Yes, that’s true. It’s just a question of “how likely THIS is”; as it is not part of my job to randomly “build around” .
I will check the credentials plugin you suggested.
And yes. You’re absolutely right. Junctions is the correct strategy here.. not hard links.
.