Spring Boot Gradle plugin credentials - spring-boot

Question

I'm using the Spring Boot Gradle plugin to build and push Docker images to a remote Docker registry
bootBuildImage {
imageName = "docker-repo/app-name"
publish = true
docker {
publishRegistry {
username = project.property('repoUsername')
password = project.property('repoPassword')
}
}
}
The Docker repository credentials are stored in ~/.gradle/gradle.properties.
Is this secure? Would I need to store a similar ~/.gradle/gradle.properties file in the CI/CD environment?
What are the best approaches from a security perspective?

Answer 1

What I do think about this ( Opinion ) is NO .
Storing the credentials with gradle.properties as plain text is a bad idea . but still it widely usable .
For me , I'd rather use the environment variables as its one level above the plain text , where it get tricky to find .
I can assure you that both ways are bad , but i guess that environment variables is a bit more tricky than plain text .
this is my gradle method to retrive env variables or to look at gradle.properties
artifactoryUser = getConfigurationProperty("ARTIFACTORY_USER", "artifactoryUser", null)
artifactoryPwd = getConfigurationProperty("ARTIFACTORY_PWD", "artifactoryPwd", null)
String getConfigurationProperty(String envVar, String sysProp, String defaultValue) {
def result = System.getenv(envVar) ?: project.findProperty(sysProp)
result ?: defaultValue
}
I use it and I am sure that there is a more secure way to do so .