GoogleContainerTools/jib · error · MojoExecutionException

Unable to decrypt proxy info from settings.xml: ${problem}

Error message

Unable to decrypt proxy info from settings.xml: ${problem}

What it means

MavenSettingsProxyProvider decrypts server passwords for proxies configured in Maven's settings.xml using the Maven settings decrypter. When the decryption reports any ERROR- or FATAL-severity problem, activation of HTTP/HTTPS proxies fails with this MojoExecutionException so Jib does not proceed with broken proxy credentials.

Source

Thrown at jib-maven-plugin/src/main/java/com/google/cloud/tools/jib/maven/MavenSettingsProxyProvider.java:71

      }
      settings.getProxies().stream()
          .filter(Proxy::isActive)
          .filter(proxy -> protocol.equals(proxy.getProtocol()))
          .findFirst()
          .ifPresent(proxies::add);
    }

    if (proxies.isEmpty()) {
      return;
    }

    SettingsDecryptionRequest request = new DefaultSettingsDecryptionRequest().setProxies(proxies);
    SettingsDecryptionResult result = decrypter.decrypt(request);

    for (SettingsProblem problem : result.getProblems()) {
      if (problem.getSeverity() == SettingsProblem.Severity.ERROR
          || problem.getSeverity() == SettingsProblem.Severity.FATAL) {
        throw new MojoExecutionException(
            "Unable to decrypt proxy info from settings.xml: " + problem);
      }
    }

    result.getProxies().forEach(MavenSettingsProxyProvider::setProxyProperties);
  }

  /**
   * Set proxy system properties based on Maven proxy configuration.
   *
   * @param proxy Maven proxy settings
   */
  @VisibleForTesting
  static void setProxyProperties(Proxy proxy) {
    String protocol = proxy.getProtocol();

    setPropertySafe(protocol + ".proxyHost", proxy.getHost());
    setPropertySafe(protocol + ".proxyPort", String.valueOf(proxy.getPort()));

View on GitHub (pinned to fb949e2676)

Solutions

  1. Read the <problem> detail appended to the message — it names the exact decryption issue and which proxy entry failed.
  2. Re-encrypt the proxy password on the current machine: create ~/.m2/settings-security.xml via 'mvn --encrypt-master-password' then 'mvn --encrypt-password'.
  3. Use a plaintext password in settings.xml temporarily to isolate whether encryption setup is the issue.
  4. Ensure the same settings-security.xml used for encryption is present and readable at build time (CI machines need it too).

Example fix

// before (settings.xml)
<proxy><password>{corruptedCipherText=}</password></proxy>

// regenerate
mvn --encrypt-master-password  # -> settings-security.xml
mvn --encrypt-password myPassword  # -> paste into <password>
Defensive patterns

Strategy: validation

Validate before calling

// Pre-check decryption setup before building:
// test that ~/.m2/settings-security.xml exists and decrypt works:
// mvn help:effective-settings  (decrypted settings are echoed; failure surfaces here first)
if (!java.nio.file.Files.exists(java.nio.file.Path.of(System.getProperty("user.home"), ".m2", "settings-security.xml"))) {
  throw new IllegalStateException("Create settings-security.xml via 'mvn --encrypt-master-password' first");
}

Try / catch

try {
  // jib build using settings.xml proxies
} catch (MojoExecutionException e) {
  if (e.getMessage().startsWith("Unable to decrypt proxy info from settings.xml")) {
    // re-encrypt password on this machine or use plaintext to isolate
  }
  throw e;
}

Prevention

When it happens

Trigger: settings.xml contains <proxies> with encrypted <password> entries that cannot be decrypted: missing/unreadable settings-security.xml, master password mismatch, ciphertext corrupted, or decrypter misconfigured.

Common situations: Passwords encrypted with 'mvn --encrypt-password' on a machine with a different settings-security.xml master password; copying encrypted passwords between machines; empty or malformed settings-security.xml at ~/.m2/settings-security.xml; typo in the encrypted string.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/784d3ede4a66cd8e. Report an issue: GitHub.