Add support for SHA-256/512 in update site metadata #3356

daniel-beck · 2018-03-17T13:00:53Z

If the update site metadata provides SHA-512 or SHA-256 checksums, check those.

This is intended as a security hardening. SHA-1 isn't a good choice anymore.

Companion PR in infra: jenkins-infra/update-center2#191. As Jenkins will continue to support update sites that only provide SHA-1 (for now, and with a warning), they could be merged independently, but probably should not be.

Proposed changelog entries

RFE: Check SHA-512 or SHA-256 checksums of update site metadata and core and plugin downloads if the update site provides them.

Submitter checklist

[n/a] JIRA issue is well described
Changelog entry appropriate for the audience affected by the change (users or developer, depending on the change). Examples
* Use the Internal: prefix if the change has no user-visible impact (API, test frameworks, etc.)
Appropriate autotests or explanation to why this change has no tests
[n/a] For dependency updates: links to external changelogs and, if possible, full diffs

Wadeck

🐝 nothing seems weird.

Build failed but no errors are shown...

oleg-nenashev · 2018-04-10T15:58:53Z

@daniel-beck is it still on hold?

daniel-beck · 2018-04-10T20:12:01Z

@oleg-nenashev This is on-hold because it depends on the corresponding PR to Jenkins project infra. Timeline:

merge update-center2 PR
Run this PR build and confirm it works as expected against a live UC
Merge this.

This is ready to be reviewed etc. -- in fact, I invite feedback before I make infra changes.

daniel-beck · 2018-04-25T09:51:17Z

Corresponding infra change is merged.

@jenkinsci/code-reviewers Ping -- would like to land this this week.

daniel-beck · 2018-04-26T12:54:50Z

@rtyler objected to the massive increase in size of update-center.json, so I've followed up in jenkins-infra/update-center2#196 and need to adapt this PR.

daniel-beck · 2018-04-26T14:33:01Z

Rebased to current master.

I'm not convinced this needs adapting, will try the upcoming PR build.

daniel-beck · 2018-05-29T16:21:35Z

Un-onholding this. @jenkinsci/code-reviewers assemble!

Wadeck

🐝

dwnusbaum

What is the reason for the partial SHA-256 support if the update center only has SHA-1 and SHA-512 after jenkins-infra/update-center2#196? Is it so that if we eventually add SHA-256 back to the update center we don't have to modify as much code on the Jenkins side? Other than that question the changes look good to me.

dwnusbaum · 2018-05-29T18:18:09Z

core/src/main/java/hudson/model/UpdateCenter.java

+        VerificationResult result512 = verifyChecksums(entry.getSha512(), job.getComputedSHA512(), false);
+        switch (result512) {
+            case PASS:
+                // this has passed but no real reason not to check the others


Is the idea behind falling through here that if there is a SHA-512 collision that isn't also a SHA-256 or SHA-1 collision it will be caught by checking the other signatures?

Basically, yes. Seems extremely unlikely that this is a likely case, but as the comment says, no real reason not to check the others, if they are defined.

daniel-beck · 2018-05-30T10:55:57Z

What is the reason for the partial SHA-256 support if the update center only has SHA-1 and SHA-512 after jenkins-infra/update-center2#196?

It's essentially free to support this way, and SHA-256 could be a desirable mode for some custom update sites.

dwnusbaum · 2018-05-30T13:33:26Z

It's essentially free to support this way, and SHA-256 could be a desirable mode for some custom update sites.

In that case, should we add support for SHA-256 to JSONSignatureValidator for consistency?

daniel-beck · 2018-05-31T17:14:15Z

In that case, should we add support for SHA-256 to JSONSignatureValidator for consistency?

That's probably a good idea. Let's see whether I can find the time to do this within this PR.

dwnusbaum

Looks good to me. I am fine with SHA-256 support being added to JSONSignatureValidator as a separate change.

oleg-nenashev

Looks good

oleg-nenashev · 2018-06-08T21:32:22Z

core/src/main/java/hudson/model/UpdateCenter.java

-                // Irrelevant as the Java spec says SHA-1 must exist. Still, if this fails
-                // the DownloadJob will just have computedSha1 = null and that is expected
-                // to be handled by caller
+                sha256 = MessageDigest.getInstance("SHA-256");


is it considered as weak now? Logging message would say so if there is no SHA-512

oleg-nenashev · 2018-06-08T21:36:01Z

core/src/main/java/hudson/model/UpdateCenter.java

            try {
+                // Java spec says SHA-1 and SHA-256 exist, and SHA-512 might not, so one try/catch block should be fine
                sha1 = MessageDigest.getInstance("SHA-1");


I suggest to create a follow-up ticket to disable weak algorithms (e.g. via Security settings or system property)

oleg-nenashev · 2018-06-08T21:37:49Z

core/src/main/java/hudson/model/UpdateCenter.java

@@ -1107,12 +1108,15 @@ public void postValidate(DownloadJob job, File src) throws IOException {
         */
        public File download(DownloadJob job, URL src) throws IOException {
            MessageDigest sha1 = null;


having one digest field and ENUM for type would simplify the logic below

daniel-beck · 2018-06-09T16:13:27Z

I forgot to adapt the tool installer metadata as well, so on-holding this while Jenkins would show messages like this:

INFO: JSON data source 'downloadable 'hudson.tasks.Maven.MavenInstaller'' does not provide a SHA-512 content checksum or signature. Looking for SHA-1.

daniel-beck · 2018-06-26T14:11:41Z

Un-onholding this, after releasing update-center2-2.0 and using it in jenkins-infra/crawler#77 tools metadata include the additional checksums.

Haven't attempted this PR build yet, but I expect this to resolve the problem from the previous comment.

daniel-beck · 2018-06-26T14:20:09Z

Jun 26, 2018 4:18:59 PM hudson.model.UpdateSite updateData
INFO: Obtained the latest update center data file for UpdateSource default
Jun 26, 2018 4:19:00 PM hudson.model.DownloadService$Downloadable load
INFO: Obtained the updated data file for hudson.tasks.Maven.MavenInstaller
Jun 26, 2018 4:19:00 PM hudson.model.DownloadService$Downloadable load
INFO: Obtained the updated data file for hudson.tasks.Ant.AntInstaller
Jun 26, 2018 4:19:01 PM hudson.model.DownloadService$Downloadable load
INFO: Obtained the updated data file for hudson.plugins.gradle.GradleInstaller
Jun 26, 2018 4:19:02 PM hudson.model.DownloadService$Downloadable load
INFO: Obtained the updated data file for hudson.tools.JDKInstaller

😃

varyvol · 2018-08-23T13:51:26Z

@daniel-beck please note the behavior for the 'verifyChecksums' method has changed, since no error was thrown previously if no SHA-1 was provided.

daniel-beck added needs-more-reviews Complex change, which would benefit from more eyes on-hold This pull request depends on another event/release, and it cannot be merged right now labels Mar 17, 2018

daniel-beck mentioned this pull request Mar 17, 2018

Add SHA-256 and SHA-512 digests, SHA-512/RSA signature jenkins-infra/update-center2#191

Merged

Wadeck approved these changes Mar 20, 2018

View reviewed changes

daniel-beck removed the on-hold This pull request depends on another event/release, and it cannot be merged right now label Apr 25, 2018

daniel-beck added the on-hold This pull request depends on another event/release, and it cannot be merged right now label Apr 26, 2018

daniel-beck added the work-in-progress The PR is under active development, not ready to the final review label Apr 26, 2018

Add support for SHA-256/512 in update site metadata

6dc3297

daniel-beck force-pushed the sha-256-512 branch from a099442 to 6dc3297 Compare April 26, 2018 14:32

Adapt to base64 encoded SHA-512 checksums

fcf9b67

daniel-beck removed on-hold This pull request depends on another event/release, and it cannot be merged right now work-in-progress The PR is under active development, not ready to the final review labels May 29, 2018

daniel-beck requested review from dwnusbaum and Wadeck May 29, 2018 16:21

Wadeck approved these changes May 29, 2018

View reviewed changes

dwnusbaum reviewed May 29, 2018

View reviewed changes

dwnusbaum approved these changes May 31, 2018

View reviewed changes

oleg-nenashev approved these changes Jun 8, 2018

View reviewed changes

oleg-nenashev added ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback and removed needs-more-reviews Complex change, which would benefit from more eyes labels Jun 8, 2018

daniel-beck added the on-hold This pull request depends on another event/release, and it cannot be merged right now label Jun 9, 2018

daniel-beck mentioned this pull request Jun 12, 2018

Add update-center2 jenkins-infra/repository-permissions-updater#729

Merged

6 tasks

daniel-beck removed the on-hold This pull request depends on another event/release, and it cannot be merged right now label Jun 26, 2018

daniel-beck merged commit a2b24b3 into jenkinsci:master Jun 29, 2018

daniel-beck mentioned this pull request Jul 11, 2018

Accept SHA-256 without complaint in logs #3546

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for SHA-256/512 in update site metadata #3356

Add support for SHA-256/512 in update site metadata #3356

daniel-beck commented Mar 17, 2018 •

edited

Wadeck left a comment

oleg-nenashev commented Apr 10, 2018

daniel-beck commented Apr 10, 2018

daniel-beck commented Apr 25, 2018

daniel-beck commented Apr 26, 2018

daniel-beck commented Apr 26, 2018

daniel-beck commented May 29, 2018

Wadeck left a comment

dwnusbaum left a comment

dwnusbaum May 29, 2018

daniel-beck May 30, 2018

daniel-beck commented May 30, 2018

dwnusbaum commented May 30, 2018

daniel-beck commented May 31, 2018

dwnusbaum left a comment

oleg-nenashev left a comment

oleg-nenashev Jun 8, 2018

oleg-nenashev Jun 8, 2018

oleg-nenashev Jun 8, 2018

daniel-beck commented Jun 9, 2018

daniel-beck commented Jun 26, 2018

daniel-beck commented Jun 26, 2018

varyvol commented Aug 23, 2018

Add support for SHA-256/512 in update site metadata #3356

Add support for SHA-256/512 in update site metadata #3356

Conversation

daniel-beck commented Mar 17, 2018 • edited

Proposed changelog entries

Submitter checklist

Wadeck left a comment

Choose a reason for hiding this comment

oleg-nenashev commented Apr 10, 2018

daniel-beck commented Apr 10, 2018

daniel-beck commented Apr 25, 2018

daniel-beck commented Apr 26, 2018

daniel-beck commented Apr 26, 2018

daniel-beck commented May 29, 2018

Wadeck left a comment

Choose a reason for hiding this comment

dwnusbaum left a comment

Choose a reason for hiding this comment

dwnusbaum May 29, 2018

Choose a reason for hiding this comment

daniel-beck May 30, 2018

Choose a reason for hiding this comment

daniel-beck commented May 30, 2018

dwnusbaum commented May 30, 2018

daniel-beck commented May 31, 2018

dwnusbaum left a comment

Choose a reason for hiding this comment

oleg-nenashev left a comment

Choose a reason for hiding this comment

oleg-nenashev Jun 8, 2018

Choose a reason for hiding this comment

oleg-nenashev Jun 8, 2018

Choose a reason for hiding this comment

oleg-nenashev Jun 8, 2018

Choose a reason for hiding this comment

daniel-beck commented Jun 9, 2018

daniel-beck commented Jun 26, 2018

daniel-beck commented Jun 26, 2018

varyvol commented Aug 23, 2018

daniel-beck commented Mar 17, 2018 •

edited