apache / apache/polaris

Don't ask release managers to put plain text passwords in plain text files

Open
#2,173 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
1d 17h
Merged PRs (30d)
137

Description

### Describe the bug

The release guide currently says that [release managers _have to_ put plain text credentials into plain text files](https://github.com/apache/polaris/blob/b501bfc266147dc80b4e1b3a87b98edbb55fc98c/site/content/release-guide.md?plain=1#L61-L66).

That's not a good practice. Everything that a release manager executes (Gradle builds, Maven builds, tests, browsers) can read that information and the credentials are leaked.

### To Reproduce

_No response_

### Actual Behavior

_No response_

### Expected Behavior

_No response_

### Additional context

_No response_

### System information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with site/content/release-guide.md, especially the linked lines 61-66, and review how the release process currently handles credentials during Gradle and Maven builds. Update the guide so it no longer instructs release managers to store credentials in plain-text files, then verify the revised instructions are secure and clear.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
documentation, release, security
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.