[MWRAPPER-46] Simplify use of Maven Wrapper in different environments (basic auth required)

**[Jimisola Laursen](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=JIRAUSER281352)** opened **[MWRAPPER-46](https://issues.apache.org/jira/browse/MWRAPPER-46?redirect=false)** and commented

I'll describe our use-case as I suspect that we might be alone with this one.

This ticket relates to:
1. MVNW_REPOURL being insufficient
2. user not being able to set MVNW_USERNAME/PASSWORD in plain text due security

**Prerequisites:** 
* _Self-hosted Maven 2 repo that requires basic auth_ (Nexus with proxy for Maven Central)
* Environments:
* Local machine: need to use proxy for Internet, can't set MVNW_USERNAME/PASSWORD in plain text due security
* Pipeline/Deployment (k8s): need to use proxy for Internet, MVNW_USERNAME/PASSWORD are set
* We want to be able to specify wrapper and/or Maven version (hence, use maven-wrapper.properties)

**Use-case:** all downloads, but local and in cluster/cloud, should go via our self-hosted Maven 2 repo that requires basic auth

**Setup cases:**
1. Setting MVNW_REPOURL in both environments causes two problems:

1. local machine: we would have to set MVNW_USER/PASSWORD (can't due to security risk)
2. k8s: MVNW_REPOURL environment variable, strangely, doesn't override value in maven-wrapper.properties, but vice versa. Is this really common practise? Compare with e.g. [Spring Boot's Externalized Configuration](https://docs.spring.io/spring-boot/docs/1.2.3.RELEASE/reference/html/boot-features-external-config.html). So, we would have to either change the base url in the maven-wrapper.properties in k8s explicitly since we want to keep the version information for maven-wrapper and Maven.
2. Changing the urls to the self-hosted repo in maven-wrapper.properties:

1. local machine: we would have to set MVNW_USER/PASSWORD (can't due to security risk)
2. k8s: would work since MVNW_USERNAME/PASSWORD are set
3. Having maven-wrapper.jar checked in doesn't solve the issue since Maven itself has to be downloaded as well and basic auth not set.

**Ideas:**
1. be able to use [Password Encryption](https://maven.apache.org/guides/mini/guide-encryption.html) and have password encrypted in settings.xml or in MVNW_PASSWORD: issue of course being that Maven Password Encryption is not available during bootstrapping.
2. change the behavior of MVNW_REPOURL so that it has the highest priority and supersedes defaults in mvnw[.cmd] script as well as in maven-wrapper.properties: at least then we can keep a correct maven-wrapper.properties (w/ self-hosted Maven repo) and set MVNW_REPOURL to Maven Central on local machine for bootstrapping.

**Proposed semi-solution:**
* Change priority of MVNW_REPOURL or, for backwards compatibility, add another environment variable which supersedes all other settings

---

**Affects:** 3.1.0

0 votes, 5 watchers