Locksmith

Give Maven the ability to use the macOS Keychain, or defer to a Unix Socket, giving you the ability to defer to a custom password manager.

Hide your plaintext secrets/passwords in ~/.m2/settings.xml . For those in regulated industries, this makes ~/.m2/settings.xml FIPS-140 compliant.

In general, storing your passwords or any gplat tokens in ~/.m2/settings.xml is a bad idea in the age of user-hostile software and unfettered outbound internet access... After all, we want to avoid having secrets getting sucked into a "misconfigured" LLM or a piece of software with an RCE.

So, for those of us with short attention spans, Locksmith allows your settings.xml to look like this:

If the macOS Keychain is unavailable, as it is happens on Linux, it defers to a Unix Socket. This socket could be anything, like a custom password manager, but a common use case is to support remote builds over ssh, where the socket is forwarded and a local script answers with items from the macOS Keychain.

If your Maven Build requires a lower JDK vesion that Java 25, set up the toolchains plugin for your project, so the Maven JDK and your project JDK are different.

Maven's DefaultSecDispatcher basically existence-checks settings-security.xml before it dispatches to any custom PasswordDecryptor s. The file must exist.