GoogleContainerTools/jib · error · InferredAuthException

Unable to decrypt server(${registry}) info from settings.xml

Error message

Unable to decrypt server(${registry}) info from settings.xml: ${problem}

What it means

MavenSettingsServerCredentials retrieves registry credentials from settings.xml <servers> entries and decrypts them via Maven's settings decrypter. If decryption yields ERROR/FATAL problems, inferAuth throws InferredAuthException naming the registry, since un-encrypted passwords pass through silently and any reported problem indicates a genuine failure.

Source

Thrown at jib-maven-plugin/src/main/java/com/google/cloud/tools/jib/maven/MavenSettingsServerCredentials.java:75

   * @param registry the registry
   * @return the auth info for the registry, or {@link Optional#empty} if none could be retrieved
   */
  @Override
  public Optional<AuthProperty> inferAuth(String registry) throws InferredAuthException {

    Server server = getServerFromMavenSettings(registry);
    if (server == null) {
      return Optional.empty();
    }

    SettingsDecryptionRequest request = new DefaultSettingsDecryptionRequest(server);
    SettingsDecryptionResult result = decrypter.decrypt(request);
    // Un-encrypted passwords are passed through, so a problem indicates a real issue.
    // If there are any ERROR or FATAL problems reported, then decryption failed.
    for (SettingsProblem problem : result.getProblems()) {
      if (problem.getSeverity() == SettingsProblem.Severity.ERROR
          || problem.getSeverity() == SettingsProblem.Severity.FATAL) {
        throw new InferredAuthException(
            "Unable to decrypt server(" + registry + ") info from settings.xml: " + problem);
      }
    }
    Server resultServer = result.getServer();

    String username = resultServer.getUsername();
    String password = resultServer.getPassword();

    return Optional.of(
        new AuthProperty() {

          @Override
          public String getUsername() {
            return username;
          }

          @Override
          public String getPassword() {

View on GitHub (pinned to fb949e2676)

Solutions

Check the <problem> text in the message — it identifies the failing server entry and root cause.
Regenerate ~/.m2/settings-security.xml with 'mvn --encrypt-master-password' and re-encrypt the registry password with 'mvn --encrypt-password'.
Verify the <server><id> matches the registry host used by Jib (e.g. gcr.io, myregistry.azurecr.io).
Use a plaintext password in settings.xml temporarily to confirm the server config itself is otherwise correct.

Example fix

// before (settings.xml)
<server>
  <id>gcr.io</id>
  <password>{staleCipherFromOldMaster=}</password>
</server>

// after
mvn --encrypt-password newPass  # -> {freshCipher}
<server>
  <id>gcr.io</id>
  <password>{freshCipher}</password>
</server>

Defensive patterns

Strategy: validation

Validate before calling

// Validate server decryption before building:
// mvn help:effective-settings — if the server password fails to decrypt this surfaces here.
// Also confirm the server id matches the registry:
// effectiveSettings.getServers().stream().anyMatch(s -> s.getId().equals("gcr.io"))

Try / catch

try {
  // jib build authenticating against registry via settings.xml
} catch (InferredAuthException e) {
  if (e.getMessage().startsWith("Unable to decrypt server(")) {
    // re-encrypt the password with the current settings-security.xml master password
  }
  throw e;
}

Prevention

Keep settings-security.xml in sync with the machine that encrypted the server passwords.
Match the <server><id> exactly to the registry hostname Jib pushes to.
Run 'mvn help:effective-settings' after any settings.xml edit to verify decryption.
Consider credential helpers (docker-credential-gcr etc.) or Jib auth via Docker config as alternatives.

When it happens

Trigger: settings.xml has a <server> whose <id> matches the registry with an encrypted <password> that cannot be decrypted: missing settings-security.xml, wrong master password, corrupted ciphertext, or malformed encrypted value.

Common situations: Registry credentials encrypted on another machine/CI node without the matching settings-security.xml; password re-encrypted after rotating the master password; whitespace or truncation of the {…} ciphertext when copy-pasting into settings.xml.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/eba8eae108b2dadd. Report an issue: GitHub.