{"record":{"id":"eba8eae108b2dadd","repo":"GoogleContainerTools/jib","slug":"unable-to-decrypt-server-registry-info-from-se","errorCode":null,"errorMessage":"Unable to decrypt server(${registry}) info from settings.xml: ${problem}","messagePattern":"Unable to decrypt server\\((.+?)\\) info from settings\\.xml: (.+?)","errorType":"exception","errorClass":"InferredAuthException","httpStatus":null,"severity":"error","filePath":"jib-maven-plugin/src/main/java/com/google/cloud/tools/jib/maven/MavenSettingsServerCredentials.java","lineNumber":75,"sourceCode":"   * @param registry the registry\n   * @return the auth info for the registry, or {@link Optional#empty} if none could be retrieved\n   */\n  @Override\n  public Optional<AuthProperty> inferAuth(String registry) throws InferredAuthException {\n\n    Server server = getServerFromMavenSettings(registry);\n    if (server == null) {\n      return Optional.empty();\n    }\n\n    SettingsDecryptionRequest request = new DefaultSettingsDecryptionRequest(server);\n    SettingsDecryptionResult result = decrypter.decrypt(request);\n    // Un-encrypted passwords are passed through, so a problem indicates a real issue.\n    // If there are any ERROR or FATAL problems reported, then decryption failed.\n    for (SettingsProblem problem : result.getProblems()) {\n      if (problem.getSeverity() == SettingsProblem.Severity.ERROR\n          || problem.getSeverity() == SettingsProblem.Severity.FATAL) {\n        throw new InferredAuthException(\n            \"Unable to decrypt server(\" + registry + \") info from settings.xml: \" + problem);\n      }\n    }\n    Server resultServer = result.getServer();\n\n    String username = resultServer.getUsername();\n    String password = resultServer.getPassword();\n\n    return Optional.of(\n        new AuthProperty() {\n\n          @Override\n          public String getUsername() {\n            return username;\n          }\n\n          @Override\n          public String getPassword() {","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-maven-plugin/src/main/java/com/google/cloud/tools/jib/maven/MavenSettingsServerCredentials.java#L57-L93","documentation":"MavenSettingsServerCredentials retrieves registry credentials from settings.xml <servers> entries and decrypts them via Maven's settings decrypter. If decryption yields ERROR/FATAL problems, inferAuth throws InferredAuthException naming the registry, since un-encrypted passwords pass through silently and any reported problem indicates a genuine failure.","triggerScenarios":"settings.xml has a <server> whose <id> matches the registry with an encrypted <password> that cannot be decrypted: missing settings-security.xml, wrong master password, corrupted ciphertext, or malformed encrypted value.","commonSituations":"Registry credentials encrypted on another machine/CI node without the matching settings-security.xml; password re-encrypted after rotating the master password; whitespace or truncation of the {…} ciphertext when copy-pasting into settings.xml.","solutions":["Check the <problem> text in the message — it identifies the failing server entry and root cause.","Regenerate ~/.m2/settings-security.xml with 'mvn --encrypt-master-password' and re-encrypt the registry password with 'mvn --encrypt-password'.","Verify the <server><id> matches the registry host used by Jib (e.g. gcr.io, myregistry.azurecr.io).","Use a plaintext password in settings.xml temporarily to confirm the server config itself is otherwise correct."],"exampleFix":"// before (settings.xml)\n<server>\n  <id>gcr.io</id>\n  <password>{staleCipherFromOldMaster=}</password>\n</server>\n\n// after\nmvn --encrypt-password newPass  # -> {freshCipher}\n<server>\n  <id>gcr.io</id>\n  <password>{freshCipher}</password>\n</server>","handlingStrategy":"validation","validationCode":"// Validate server decryption before building:\n// mvn help:effective-settings — if the server password fails to decrypt this surfaces here.\n// Also confirm the server id matches the registry:\n// effectiveSettings.getServers().stream().anyMatch(s -> s.getId().equals(\"gcr.io\"))","typeGuard":null,"tryCatchPattern":"try {\n  // jib build authenticating against registry via settings.xml\n} catch (InferredAuthException e) {\n  if (e.getMessage().startsWith(\"Unable to decrypt server(\")) {\n    // re-encrypt the password with the current settings-security.xml master password\n  }\n  throw e;\n}","preventionTips":["Keep settings-security.xml in sync with the machine that encrypted the server passwords.","Match the <server><id> exactly to the registry hostname Jib pushes to.","Run 'mvn help:effective-settings' after any settings.xml edit to verify decryption.","Consider credential helpers (docker-credential-gcr etc.) or Jib auth via Docker config as alternatives."],"tags":["maven","settings-xml","registry","credentials","decryption"],"backgroundTag":"missing-credentials","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}