Skip to content

Commit b8601e9

Browse files
jimklimovjimklimov
committed
Merge remote-tracking branch 'upstream/master' into JENKINS-69731-scm-BRANCH_NAME
Signed-off-by: Jim Klimov <[email protected]>
2 parents b8c4a88 + dddedf8 commit b8601e9

24 files changed

+640
-366
lines changed

‎.github/workflows/jenkins-security-scan.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Jenkins Security Scan
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
types: [ opened, synchronize, reopened ]
9+
workflow_dispatch:
10+
11+
permissions:
12+
security-events: write
13+
contents: read
14+
actions: read
15+
16+
jobs:
17+
security-scan:
18+
uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
19+
with:
20+
java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.
21+
# java-version: 21 # Optionally specify what version of Java to set up for the build, or remove to use a recent default.

‎.mvn/extensions.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
<extension>
33
<groupId>io.jenkins.tools.incrementals</groupId>
44
<artifactId>git-changelist-maven-extension</artifactId>
5-
<version>1.7</version>
5+
<version>1.8</version>
66
</extension>
77
</extensions>

‎pom.xml

Lines changed: 15 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<parent>
2929
<groupId>org.jenkins-ci.plugins</groupId>
3030
<artifactId>plugin</artifactId>
31-
<version>4.77</version>
31+
<version>5.7</version>
3232
<relativePath/>
3333
</parent>
3434
<groupId>io.jenkins.plugins</groupId>
@@ -63,15 +63,18 @@
6363
</pluginRepositories>
6464
<properties>
6565
<changelist>999999-SNAPSHOT</changelist>
66-
<jenkins.version>2.414.3</jenkins.version>
66+
<!-- https://www.jenkins.io/doc/developer/plugin-development/choosing-jenkins-baseline/ -->
67+
<jenkins.baseline>2.479</jenkins.baseline>
68+
<jenkins.version>${jenkins.baseline}.1</jenkins.version>
6769
<gitHubRepo>jenkinsci/${project.artifactId}-plugin</gitHubRepo>
70+
<useBeta>true</useBeta>
6871
</properties>
6972
<dependencyManagement>
7073
<dependencies>
7174
<dependency>
7275
<groupId>io.jenkins.tools.bom</groupId>
73-
<artifactId>bom-2.414.x</artifactId>
74-
<version>2705.vf5c48c31285b_</version>
76+
<artifactId>bom-${jenkins.baseline}.x</artifactId>
77+
<version>3893.v213a_42768d35</version>
7578
<scope>import</scope>
7679
<type>pom</type>
7780
</dependency>
@@ -82,7 +85,7 @@
8285
<dependency>
8386
<groupId>org.apache.ivy</groupId>
8487
<artifactId>ivy</artifactId>
85-
<version>2.5.2</version>
88+
<version>2.5.3</version>
8689
</dependency>
8790

8891
<!-- required plugins -->
@@ -135,6 +138,13 @@
135138
</dependency>
136139

137140
<!-- test only plugins -->
141+
<dependency>
142+
<!-- GlobalUntrustedLibrariesTest#configRoundtrip -->
143+
<groupId>io.jenkins.plugins</groupId>
144+
<artifactId>manage-permission</artifactId>
145+
<version>1.0.1</version>
146+
<scope>test</scope>
147+
</dependency>
138148
<dependency>
139149
<groupId>org.jenkins-ci.plugins.workflow</groupId>
140150
<artifactId>workflow-support</artifactId>
@@ -186,32 +196,5 @@
186196
<classifier>tests</classifier>
187197
<scope>test</scope>
188198
</dependency>
189-
<dependency>
190-
<groupId>org.jenkins-ci.plugins</groupId>
191-
<artifactId>subversion</artifactId>
192-
<scope>test</scope>
193-
<exclusions>
194-
<exclusion>
195-
<groupId>org.apache.sshd</groupId>
196-
<artifactId>sshd-common</artifactId>
197-
</exclusion>
198-
<exclusion>
199-
<groupId>org.apache.sshd</groupId>
200-
<artifactId>sshd-core</artifactId>
201-
</exclusion>
202-
</exclusions>
203-
</dependency>
204-
<dependency>
205-
<groupId>org.jenkins-ci.plugins</groupId>
206-
<artifactId>subversion</artifactId>
207-
<classifier>tests</classifier>
208-
<scope>test</scope>
209-
</dependency>
210-
<dependency>
211-
<groupId>org.tmatesoft.svnkit</groupId>
212-
<artifactId>svnkit-cli</artifactId>
213-
<version>1.10.10</version>
214-
<scope>test</scope>
215-
</dependency>
216199
</dependencies>
217200
</project>

‎src/main/java/org/jenkinsci/plugins/workflow/cps/global/GrapeHack.java

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,20 @@
3535
import java.net.URLClassLoader;
3636
import java.util.logging.Level;
3737
import java.util.logging.Logger;
38+
import org.apache.ivy.core.cache.DefaultRepositoryCacheManager;
39+
import org.apache.ivy.core.cache.RepositoryCacheManager;
40+
import org.apache.ivy.core.settings.IvySettings;
41+
import org.apache.ivy.plugins.lock.LockStrategy;
42+
import org.apache.ivy.plugins.lock.NoLockStrategy;
3843

3944
public class GrapeHack {
4045

4146
private static final Logger LOGGER = Logger.getLogger(GrapeHack.class.getName());
4247

48+
@SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
49+
public static boolean DISABLE_NIO_FILE_LOCK =
50+
Boolean.getBoolean(GrapeHack.class.getName() + ".DISABLE_NIO_FILE_LOCK");
51+
4352
@SuppressFBWarnings(value="DP_CREATE_CLASSLOADER_INSIDE_DO_PRIVILEGED", justification="the least of our concerns")
4453
@Initializer(after=InitMilestone.PLUGINS_PREPARED, fatal=false)
4554
public static void hack() throws Exception {
@@ -63,6 +72,32 @@ public static void hack() throws Exception {
6372
l = engine.getClass().getClassLoader();
6473
LOGGER.log(Level.FINE, "was also able to load {0}", l.loadClass(ivyGrabRecordName));
6574
LOGGER.log(Level.FINE, "linked to {0}", l.loadClass("org.apache.ivy.core.module.id.ModuleRevisionId").getProtectionDomain().getCodeSource().getLocation());
75+
if (!DISABLE_NIO_FILE_LOCK) {
76+
try {
77+
/*
78+
* We must use reflection instead of simply casting to GrapeIvy and invoking directly due to the use of
79+
* MaskingClassLoader a few lines above.
80+
*/
81+
IvySettings settings = (IvySettings) c.getMethod("getSettings").invoke(instance.get(null));
82+
RepositoryCacheManager repositoryCacheManager = settings.getDefaultRepositoryCacheManager();
83+
if (repositoryCacheManager instanceof DefaultRepositoryCacheManager) {
84+
DefaultRepositoryCacheManager defaultRepositoryCacheManager =
85+
(DefaultRepositoryCacheManager) repositoryCacheManager;
86+
LockStrategy lockStrategy = defaultRepositoryCacheManager.getLockStrategy();
87+
LOGGER.log(Level.FINE, "default lock strategy {0}", lockStrategy);
88+
if (lockStrategy == null || lockStrategy instanceof NoLockStrategy) {
89+
lockStrategy = settings.getLockStrategy("artifact-lock-nio");
90+
if (lockStrategy != null) {
91+
defaultRepositoryCacheManager.setLockStrategy(lockStrategy.getName());
92+
defaultRepositoryCacheManager.setLockStrategy(lockStrategy);
93+
}
94+
}
95+
LOGGER.log(Level.FINE, "using lock strategy {0}", defaultRepositoryCacheManager.getLockStrategy());
96+
}
97+
} catch (RuntimeException | LinkageError x) {
98+
LOGGER.log(Level.FINE, "failed to enable NIO file lock", x);
99+
}
100+
}
66101
}
67102

68103
private GrapeHack() {}

‎src/main/java/org/jenkinsci/plugins/workflow/libs/AbstractGlobalLibraries.java

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
/*
2+
* The MIT License
3+
*
4+
* Copyright 2024 CloudBees, Inc.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in
14+
* all copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22+
* THE SOFTWARE.
23+
*/
24+
package org.jenkinsci.plugins.workflow.libs;
25+
26+
import edu.umd.cs.findbugs.annotations.NonNull;
27+
import hudson.model.ItemGroup;
28+
import hudson.model.Job;
29+
import java.util.ArrayList;
30+
import java.util.Collection;
31+
import java.util.Collections;
32+
import java.util.List;
33+
import java.util.Map;
34+
import java.util.stream.Collectors;
35+
import jenkins.model.GlobalConfiguration;
36+
import jenkins.model.Jenkins;
37+
import net.sf.json.JSONObject;
38+
import org.kohsuke.stapler.StaplerRequest2;
39+
40+
/**
41+
* Common code between {@link GlobalLibraries} and {@link GlobalUntrustedLibraries}.
42+
*/
43+
public abstract class AbstractGlobalLibraries extends GlobalConfiguration {
44+
private List<LibraryConfiguration> libraries = new ArrayList<>();
45+
46+
protected AbstractGlobalLibraries() {
47+
load();
48+
}
49+
50+
public abstract String getDescription();
51+
52+
public List<LibraryConfiguration> getLibraries() {
53+
return libraries;
54+
}
55+
56+
public void setLibraries(List<LibraryConfiguration> libraries) {
57+
this.libraries = libraries;
58+
save();
59+
}
60+
61+
@Override public boolean configure(StaplerRequest2 req, JSONObject json) throws FormException {
62+
if (Jenkins.get().hasPermission(getRequiredGlobalConfigPagePermission())) {
63+
setLibraries(Collections.emptyList()); // allow last library to be deleted
64+
return super.configure(req, json);
65+
} else {
66+
return true;
67+
}
68+
}
69+
70+
abstract static class AbstractForJob extends LibraryResolver {
71+
@NonNull
72+
protected abstract AbstractGlobalLibraries getConfiguration();
73+
74+
@NonNull @Override public final Collection<LibraryConfiguration> forJob(@NonNull Job<?,?> job, @NonNull Map<String,String> libraryVersions) {
75+
return getLibraries();
76+
}
77+
78+
@NonNull @Override public final Collection<LibraryConfiguration> fromConfiguration(@NonNull StaplerRequest2 request) {
79+
if (Jenkins.get().hasPermission(getConfiguration().getRequiredGlobalConfigPagePermission())) {
80+
return getLibraries();
81+
}
82+
return Collections.emptySet();
83+
}
84+
85+
@NonNull @Override public final Collection<LibraryConfiguration> suggestedConfigurations(@NonNull ItemGroup<?> group) {
86+
return getLibraries();
87+
}
88+
89+
private List<LibraryConfiguration> getLibraries() {
90+
return getConfiguration()
91+
.getLibraries()
92+
.stream()
93+
.map(this::mayWrapLibrary)
94+
.collect(Collectors.toList());
95+
}
96+
97+
@NonNull
98+
protected abstract LibraryConfiguration mayWrapLibrary(@NonNull LibraryConfiguration library);
99+
}
100+
}

‎src/main/java/org/jenkinsci/plugins/workflow/libs/FolderLibraries.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
import edu.umd.cs.findbugs.annotations.CheckForNull;
3939
import net.sf.json.JSONObject;
4040
import org.kohsuke.stapler.DataBoundConstructor;
41-
import org.kohsuke.stapler.StaplerRequest;
41+
import org.kohsuke.stapler.StaplerRequest2;
4242

4343
/**
4444
* Like {@link GlobalLibraries} but scoped to a folder.
@@ -57,7 +57,7 @@ public List<LibraryConfiguration> getLibraries() {
5757

5858
@Extension public static class DescriptorImpl extends AbstractFolderPropertyDescriptor {
5959

60-
@Override public AbstractFolderProperty<?> newInstance(StaplerRequest req, JSONObject formData) throws FormException {
60+
@Override public AbstractFolderProperty<?> newInstance(StaplerRequest2 req, JSONObject formData) throws FormException {
6161
FolderLibraries prop = (FolderLibraries) super.newInstance(req, formData);
6262
return prop.libraries.isEmpty() ? null : prop;
6363
}
@@ -91,7 +91,7 @@ private Collection<LibraryConfiguration> forGroup(@CheckForNull ItemGroup<?> gro
9191
return forGroup(job.getParent(), false);
9292
}
9393

94-
@Override public Collection<LibraryConfiguration> fromConfiguration(StaplerRequest request) {
94+
@Override public Collection<LibraryConfiguration> fromConfiguration(StaplerRequest2 request) {
9595
return forGroup(request.findAncestorObject(AbstractFolder.class), true);
9696
}
9797

0 commit comments

Comments
 (0)