Update plugins related to 2022-10-19 security advisory; add `ionicons-api` #1507

dwnusbaum · 2022-10-25T14:09:13Z

Replaces #1506, #1504, #1501, and #1496. We have to add ionicons-api, whose oldest version requires Jenkins 2.346.1, and I am not sure how we exclude it from bom-2.332.x and bom-2.319.x (if it is even possible (MNG-5600), and if we even care).

Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
Ensure that the pull request title represents the desired changelog entry
Please describe what you did
Link to relevant issues in GitHub or Jira
Link to relevant pull requests, esp. upstream and downstream changes
Ensure you have provided tests - that demonstrates feature works or fixes the issue

…2.x for compatibility with workflow-cps and pipeline-groovy-lib

bom-weekly/pom.xml

jglick · 2022-10-25T14:26:38Z

sample-plugin/pom.xml

+        <dependency>
+            <groupId>io.jenkins.plugins</groupId>
+            <artifactId>ionicons-api</artifactId>
+        </dependency>


This is going to fail prep in 2.332.x and 2.319.x lines. Maybe you can add it to the 2.346.x and 2.361.x profiles? But then we would also need to introduce a weekly profile and make sure prep.sh calls that, so a bit bigger change.

Looking at README.md, I think we can just delete the dependency here, since ionicons-api will be picked up transitively via workflow-cps on the appropriate LTS lines. Then we just need to tweak check.groovy to accept the fact that ionicons-api is part of dependencyManagement in 2.332.x and 2.319.x but is not used by the plugin.

See 1e8f8b6.

jglick · 2022-10-25T14:31:35Z

See background in #1159, #1160, etc. I need to think about whether the limitation can be solved. Ideas welcome obviously.

…check.groovy to allow it to be unused when testing BOM on old LTS lines

jglick · 2022-10-25T16:50:56Z

sample-plugin/check.groovy

@@ -7,7 +7,8 @@ assert artifactMap['junit:junit'] == project.artifactMap['junit:junit']
 def managedPluginDeps = managedDeps.collect {stripAllButGA(it)}.grep { ga ->
    def art = artifactMap[ga]
    if (art == null) {
-        if (ga.contains('.plugins')) { // TODO without an Artifact, we have no reliable way of checking whether it is actually a plugin
+        if (ga.contains('.plugins') // TODO without an Artifact, we have no reliable way of checking whether it is actually a plugin
+                && !(ga == 'io.jenkins.plugins:ionicons-api' && settings.activeProfiles.any {it ==~ /^2[.](332|319)[.]x$/})) { // TODO: Remove once 2.332.x is no longer part of the BOM (or if MNG-5600 is fixed and we can exclude this dependency in the BOM for old LTS lines)


Seems fine for now. If we need to do this sort of thing regularly we should probably introduce a text file with a list of plugins limited to newer lines.

(And now I am curious whether we can do the same for example for instance-identity.)

jglick · 2022-10-25T16:51:56Z

sample-plugin/check.groovy

@@ -7,7 +7,8 @@ assert artifactMap['junit:junit'] == project.artifactMap['junit:junit']
 def managedPluginDeps = managedDeps.collect {stripAllButGA(it)}.grep { ga ->
    def art = artifactMap[ga]
    if (art == null) {
-        if (ga.contains('.plugins')) { // TODO without an Artifact, we have no reliable way of checking whether it is actually a plugin
+        if (ga.contains('.plugins') // TODO without an Artifact, we have no reliable way of checking whether it is actually a plugin
+                && !(ga == 'io.jenkins.plugins:ionicons-api' && settings.activeProfiles.any {it ==~ /^2[.](332|319)[.]x$/})) { // TODO: Remove once 2.332.x is no longer part of the BOM (or if MNG-5600 is fixed and we can exclude this dependency in the BOM for old LTS lines)


or simply

Suggested change

&& !(ga == 'io.jenkins.plugins:ionicons-api' && settings.activeProfiles.any {it ==~ /^2[.](332|319)[.]x$/})) { // TODO: Remove once 2.332.x is no longer part of the BOM (or if MNG-5600 is fixed and we can exclude this dependency in the BOM for old LTS lines)

&& ga != 'io.jenkins.plugins:ionicons-api') { // TODO: Remove once 2.332.x is no longer part of the BOM (or if MNG-5600 is fixed and we can exclude this dependency in the BOM for old LTS lines)

Yeah, I added this defensively before I realized that there was a transitive dependency on ionicons-api because I wanted to make sure that we still verified its inclusion in sample on the recent LTS lines. If you are confident that it will be a long-term dependency of various plugins used by sample, then simplifying this check is probably fine.

confident that it will be a long-term dependency

Not really, but at some point we will drop 2.332.x and be able to delete this exemption as well, so I just thought we could simplify a bit. OTOH the check as written here does textually mention the old line names, making it more likely to appear in a text search when dropping old lines.

dwnusbaum · 2022-10-25T17:35:33Z

The pipeline-model-definition test failures look legitimately related to pipeline-input-step: "java.lang.IllegalArgumentException: InputStep id is required to be URL safe, but the provided id Matrix - AXIS_VALUE = 'A' is not safe". The reason is that pipeline-model-definition is locked to an old version in 2.319.x, so we'll need to do the same for pipeline-input-step.

…r compatibility with pipeline-model-definition

jglick

Can be taken out of draft I think; is there any reason for reservation here?

dwnusbaum · 2022-10-25T17:42:32Z

Can be taken out of draft I think; is there any reason for reservation here?

Should be fine at this point. Previously I was not sure what to do about ionicons-api.

dwnusbaum · 2022-10-25T19:27:52Z

Looks like the PCT failed while trying to test data-tables-api with this error:

[2022-10-25T18:25:46.325Z] [ERROR] Error executing Maven.
[2022-10-25T18:25:46.325Z] org.apache.maven.cli.internal.ExtensionResolutionException: Extension io.jenkins.tools.incrementals:git-changelist-maven-extension:1.4 or one of its dependencies could not be resolved: Could not transfer artifact org.apache.maven:maven-builder-support:jar:3.5.0 from/to central (https://repo.maven.apache.org/maven2): transfer failed for https://repo.maven.apache.org/maven2/org/apache/maven/maven-builder-support/3.5.0/maven-builder-support-3.5.0.jar
...
[2022-10-25T18:25:46.326Z] Caused by: org.apache.maven.wagon.providers.http.httpclient.conn.ConnectTimeoutException: Connect to repo.maven.apache.org:443 [repo.maven.apache.org/146.75.116.215] failed: Connection timed out

At a glance, it does not seem related to my changes. Should we be connecting to https://repo.jenkins-ci.org/ instead?

jglick · 2022-10-25T19:39:05Z

We should, yes. That plugin’s POM does specify repositories so I am not sure why it would be contacting Central.

dwnusbaum · 2022-10-25T19:55:58Z

Does Maven use a different context when looking up the dependencies for Maven plugins or something? Do we need repositories or pluginRepositories in https://github.com/jenkinsci/incrementals-tools somewhere?

jglick · 2022-10-25T22:04:55Z

Oh sorry I missed that it was referring to the Maven extension. Yes this is loaded prior to parsing the POM, so will go to Central. Probably we could override that with a custom settings file. #1508

dwnusbaum added 3 commits October 25, 2022 10:02

Add ionicons-api to BOM since workflow-cps requires it

0b47c1d

Update plugins affected by SECURITY-2824

71139ef

Update plugins related to Pipeline input step vulnerabilities

e74c37b

dwnusbaum mentioned this pull request Oct 25, 2022

Bump pipeline-groovy-lib from 612.v84da_9c54906d to 613.v9c41a_160233f in /bom-weekly #1496

Closed

script-security must be frozen to a pre-SECURITY-2824 version on 2.33…

113b0f4

…2.x for compatibility with workflow-cps and pipeline-groovy-lib

dwnusbaum commented Oct 25, 2022

View reviewed changes

bom-weekly/pom.xml Show resolved Hide resolved

jglick reviewed Oct 25, 2022

View reviewed changes

Only depend on ionicons-api transitively in sample-plugin and modify …

1e8f8b6

…check.groovy to allow it to be unused when testing BOM on old LTS lines

jglick approved these changes Oct 25, 2022

View reviewed changes

Lock pipeline-input-step to a pre-SECURITY-2880 version in 2.319.x fo…

3845d2e

…r compatibility with pipeline-model-definition

jglick changed the title ~~Update plugins related to 2022-10-19 security advisory~~ Update plugins related to 2022-10-19 security advisory; add ionicons-api Oct 25, 2022

jglick added the enhancement New feature or request label Oct 25, 2022

jglick approved these changes Oct 25, 2022

View reviewed changes

dwnusbaum marked this pull request as ready for review October 25, 2022 17:42

jglick enabled auto-merge (squash) October 25, 2022 18:12

Merge branch 'master' into 2022-10-advisory

f2ca765

uhafner mentioned this pull request Oct 26, 2022

Combine JS PRs #1478

Closed

jglick merged commit cb69d03 into jenkinsci:master Oct 26, 2022

dwnusbaum deleted the 2022-10-advisory branch October 26, 2022 13:12

timja mentioned this pull request Oct 31, 2022

add updatecli for plugins #1063

Merged

6 tasks

This was referenced Nov 2, 2022

Drop 2.319.x #1543

Merged

Disable updatecli on plugins #1556

Merged

jglick mentioned this pull request Dec 14, 2022

Add instance-identity to managed set #1647

Closed

jglick mentioned this pull request Jan 3, 2023

Dropping 2.332.x & 2.346.x #1668

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update plugins related to 2022-10-19 security advisory; add `ionicons-api` #1507

Update plugins related to 2022-10-19 security advisory; add `ionicons-api` #1507

dwnusbaum commented Oct 25, 2022 •

edited

jglick Oct 25, 2022

dwnusbaum Oct 25, 2022

dwnusbaum Oct 25, 2022

jglick commented Oct 25, 2022

jglick Oct 25, 2022

jglick Oct 25, 2022

jglick Oct 25, 2022

dwnusbaum Oct 25, 2022

jglick Oct 25, 2022

dwnusbaum commented Oct 25, 2022

jglick left a comment

dwnusbaum commented Oct 25, 2022

dwnusbaum commented Oct 25, 2022 •

edited

jglick commented Oct 25, 2022

dwnusbaum commented Oct 25, 2022

jglick commented Oct 25, 2022

	&& !(ga == 'io.jenkins.plugins:ionicons-api' && settings.activeProfiles.any {it ==~ /^2[.](332\|319)[.]x$/})) { // TODO: Remove once 2.332.x is no longer part of the BOM (or if MNG-5600 is fixed and we can exclude this dependency in the BOM for old LTS lines)
	&& ga != 'io.jenkins.plugins:ionicons-api') { // TODO: Remove once 2.332.x is no longer part of the BOM (or if MNG-5600 is fixed and we can exclude this dependency in the BOM for old LTS lines)

Update plugins related to 2022-10-19 security advisory; add ionicons-api #1507

Update plugins related to 2022-10-19 security advisory; add ionicons-api #1507

Conversation

dwnusbaum commented Oct 25, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jglick commented Oct 25, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dwnusbaum commented Oct 25, 2022

jglick left a comment

Choose a reason for hiding this comment

dwnusbaum commented Oct 25, 2022

dwnusbaum commented Oct 25, 2022 • edited

jglick commented Oct 25, 2022

dwnusbaum commented Oct 25, 2022

jglick commented Oct 25, 2022

Update plugins related to 2022-10-19 security advisory; add `ionicons-api` #1507

Update plugins related to 2022-10-19 security advisory; add `ionicons-api` #1507

dwnusbaum commented Oct 25, 2022 •

edited

dwnusbaum commented Oct 25, 2022 •

edited