Instead, rhq-container.build.xml should use the encrypted version of "${rhq.dev.ds.password}", which it could computer by using the Ant exec task to invoke generate-db-password.sh|bat, passing "${rhq.dev.ds.password}" as a command-line arg.