git-commit-id/git-commit-id-maven-plugin

Allow to limit git properties exposed

dslivka opened this issue · 3 comments

dslivka commented

The plugin discloses too many properties, which may be undesirable when e.g. generated jar package is distributed. It should be possible to prevent some properties from being inserted into git.properties file, mainly:
git.commit.message.full, git.commit.message.short
git.commit.user.email, git.build.user.email
git.commit.user.name, git.build.user.name
git.remote.origin.url <- especially this one, it may even contain repo password!

Generally all properties possibly containing private sensitive information should be possible to ommit. In my case, git.commit.id.describe is the only property I need.

ktoso commented

Hi @dslivka,
Thanks for the issue and bringing up these very good points - didn't think of this.

I assume the scenario is like closed source product development, and then you ship the jars to the client... Definitely see why exposing too much info here could be a big deal.

// I lol'ed @ git.remote.origin.url <- especially this one, it may even contain repo password! but certainly true! :-)

Will look at it, should not be too hard to add :-)

ktoso commented

Implemented :-)
3 hours from reporting... I hope it wasn't too long of a wait ;-) :shipit:

Releasing as 2.1.9, grab it from central :-)

dslivka commented

Tested, 6 hours from releasing :)
Works well, thanks!!!