Description:
Per https://maven.apache.org/plugins/maven-gpg-plugin/sign-mojo.html#passphraseenvname the mechanism currently used by this task is deprecated. This is reenforced by the fact that https://maven.apache.org/plugins/maven-gpg-plugin/sign-mojo.html#passphrase will fail if <bestPractices> is true.

The recommended way to pass the passphrase is now https://maven.apache.org/plugins/maven-gpg-plugin/sign-mojo.html#passphraseEnvName

Task version:
v4

Expected behavior:

• Stop writing gpg.passphrase to server.xml.
• Set gpg.passphraseEnvName if the user specifies a value other than MAVEN_GPG_PASSPHRASE