Giter Club home page Giter Club logo

custom-war-packager's Introduction

Jenkins Custom WAR Packager

GitHub release GitHub release

WARNING: This page documents the 2.x version which is in alpha state now. The new baseline includes incompatible changes in the YAML configuration file format. If you use Custom WAR Packager 1.x, see the 1.x branch.

Custom WAR Packager (CWP) allows building ready-to-fly Jenkins packages using a YAML specification. The tool can produce Docker images, WAR files, and Jenkinsfile Runner docker images (aka single-shot Jenkins masters). These bundles may include Jenkins core, plugins, extra libraries, and self-configuration via Groovy Hook Scripts or Configuration-as-Code Plugin YAML files.

See this blog post for more information.

Demo

Usage

The tool offers a CLI interface and a Maven Plugin wrapper.

CLI

You can find the binary file from here. For the CLI use case, you should pick up a jar file with dependencies.

java -jar custom-war-packager-cli.jar -configPath=mywar.yml -version=1.0-SNAPSHOT -tmpDir=tmp

After the build the generated WAR file will be put to tmp/output/target/${artifactId}.war.

To run the tool in a demo mode with this config, use the following command:

java -jar war-packager-cli.jar -demo

Invoke the tool without options to get a full CLI options list.

Maven

Maven plugin runs the packager and generates the artifact. The artifact will be put to "target/custom-war-packager-maven-plugin/output/target/${bundle.artifactId}.war" and added to the project artifacts.

  <build>
    <plugins>
      <plugin>
        <groupId>io.jenkins.tools.custom-war-packager</groupId>
        <artifactId>custom-war-packager-maven-plugin</artifactId>
        <version>@project.version@</version>
        <executions>
          <execution>
            <phase>package</phase>
            <goals>
              <goal>custom-war</goal>
            </goals>
            <configuration>
              <configFilePath>spotcheck.yml</configFilePath>
              <warVersion>1.1-SNAPSHOT</warVersion>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

Note that this plugin invokes Maven-in-Maven, and that it won't pass build options to the plugin. Configuration file can be used to configure the downstream builder.

Prerequisites

  • Maven 3.5.0 or above
  • Java 8
  • Git (if any Git sources are defined)

Custom WAR Packager offers a Docker Image which bundles all the required tools.

Configuration file

Example:

bundle:
  groupId: "io.github.oleg-nenashev"
  artifactId: "mywar"
  description: "Just a WAR auto-generation-sample"
  vendor: "Jenkins project"
buildSettings:
  docker:
    base: "jenkins/jenkins:2.121.1"
    tag: "jenkins/demo-external-task-logging-elk"
    build: true
war:
  groupId: "org.jenkins-ci.main"
  artifactId: "jenkins-war"
  source:
    version: 2.107
plugins:
  - groupId: "org.jenkins-ci.plugins"
    artifactId: "matrix-project"
    source:
      version: 1.9
  - groupId: "org.jenkins-ci.plugins"
    artifactId: "durable-task"
    source:
      git: https://github.com/jglick/durable-task-plugin.git
      branch: watch-JENKINS-38381
  - groupId: "org.jenkins-ci.plugins.workflow"
    artifactId: "workflow-durable-task-step"
    source:
      git: https://github.com/jglick/workflow-durable-task-step-plugin.git
      commit: 6c424e059bba90fc94a9c1e87dc9c4a324bfef26
  - groupId: "io.jenkins"
    artifactId: "configuration-as-code"
    source:
      version: 0.11-alpha-rc373.933033f6b51e
libPatches:
  - groupId: "org.jenkins-ci.main"
    artifactId: "remoting"
    source:
      git: https://github.com/jenkinsci/remoting.git
systemProperties: {
     jenkins.model.Jenkins.slaveAgentPort: "50000",
     jenkins.model.Jenkins.slaveAgentPortEnforce: "true"}
groovyHooks:
  - type: "init"
    id: "initScripts"
    source: 
      dir: scripts
casc:
  - id: "jcasc-config"
    source:
      dir: jenkins.yml

There are more options available. See the linked demos and the automated tests for examples.

Please note that given to the build workspace being defaulted to "/build", the Jenkinsfile-runner version used must be at least 1.0-beta-7.

Build multi-platform images

Docker Buildx provides the ability to build a multi-platform image.

Simply you can follow three steps to build a multi-platform image:

  1. Enable CLI experimental features of you docker daemon.
  2. Create a appropriate driver via docker buildx create --use.
  3. Set it in the YAML config file. Basically, you need to add buildx and platform.

Example:

buildSettings:
  docker:
    base: "jenkins/jenkins:2.121.1"
    tag: "jenkins/demo-external-task-logging-elk"
    platform: linux/amd64,linux/arm64
    output: push
    buildx: true
    build: true

BOM support

The plugin supports Bill of Materials (BOM), described in JEP-309, as an input.

If BOM is defined, Custom WAR Packager will load plugin and component dependencies from there. In case we want BOM to specify the core version, the bomIncludeWar flag must be set to true. The example below takes the input from BOM and produces custom WAR and Docker packages.

bundle:
  groupId: "io.jenkins.tools.war-packager.demo"
  artifactId: "bom-demo"
buildSettings:
  bom: bom.yml
  bomIncludeWar: true
  environment: aws
  docker:
    base: "jenkins/jenkins:2.121.2"
    tag: "jenkins/cwp-bom-demo"
    build: true

An example of such configuration is available here.

Plugins from POM

In order to simplify packaging for development versions, it is possible to link Custom War Packager to the POM file so that it takes plugins to be bundled from there.

If the pom option is set, all dependencies will be added, including test ones. The current parent will be also bundled unless the pomIgnoreRoot flag is set.

bundle:
  groupId: "io.jenkins.tools.war-packager.demo"
  artifactId: "pom-input-demo"
buildSettings:
  pom: pom.xml
  pomIgnoreRoot: true
  pomIncludeWar: true
war:
  groupId: "org.jenkins-ci.main"
  artifactId: "jenkins-war"
  source:
    version: 2.121.1

In the same way as BOM does, we can specify the core version from the pom file. If the global flag pomIncludeWar is true and the pom sets the jenkins-war.version, the jenkins.version property or it contains a dependency on org.jenkins-ci.main:jenkins-core or org.jenkins-ci.main:jenkins-war the war section in yml file will be omitted. Consequently, if the flag is set to true and the pom file does not configure the core, then the build fails.

Example is available here.

Plugin information providers

Custom WAR packager uses plugin information caching for some cases, e.g. for deciding whether a dependency is a plugin in pom.xml inputs. Right now there are 2 supported information sources: a Jenkins Update Center and a Maven repo.

Update Center Information provider

The mode was introduced in Custom WAR Packager 2.0.0, and this is a default mode in the tool.

  • Plugin information is retrieved from Jenkins update centers
  • Default update center: http://updates.jenkins.io/update-center.json
  • Custom update center URL can be set using the updateCenterUrl flag in buildSettings
  • Advanced configurations (e.g. proxy configuration) are not available for this mode at the moment

Maven Repo Information provider

Information is retrieved from Maven repositories, and hence it allows installing unreleased or blacklisted plugins which are not available through update centers. pomUseMavenPluginInfoProvider: true in buildSettings can be set to enable this mode.

  • The mode caches information about plugins in the Maven repo
  • The mode is not reliable when used outside clean build environments, because false positive and false negative decisions may be cached in the case of infrastructure issues
  • This mode is not recommended for most of the cases. Use at your own risk.
buildSettings:
  pom: pom.xml
  pomUseMavenPluginInfoProvider: true
  pomIgnoreRoot: true

Before Custom WAR Packager 2.0.0, this provider was used by default. Builds using this version may need an update if they rely on custom update centers or unreleased/blacklisted plugins.

Advanced features

Features:

  • Rebuilding Jenkins core with custom dependencies (e.g., Remoting or Stapler)
  • Adding extra libraries to the Jenkins core so that they can be used in extensions

Limitations

Currently, the tool is in the alpha state. It has some serious limitations:

  • All built artifacts with Git source are being installed to the local repository
    • Versions are unique for every commit, so beware of local repo pollution
  • System properties work only for a custom jenkins.util.SystemProperties class defined in the core
    • Use Groovy Hook Scripts if you need to set up other system properties
  • libPatches steps bundles only a specified JAR file, but not its dependencies Dependencies need to be explicitly packaged as well if they change compared to the base WAR file
    • libExcludes can be used to remove dependencies which are not required anymore

custom-war-packager's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

custom-war-packager's Issues

Use local WAR file as war source

Hi Im trying to customize a Cloudbees Managed Master, but the only public source of package is the jenkins.war in official docker image.

So, can I use that local war file as war source?

BOM example

I'm trying to build a custom war for pipeline development purposes with the same plugins found in production instance. It's working, but it's quite hard to prepare the plugins section with all dependencies tree, endless try & error work.

So I've tried to specify the plugins through a BOM file without success.
Please, could you provide a full CWP demo using BOM file?

demo/jenkinsfile-runner has build issues

Steps to reproduce:

Output:

ERROR] COMPILATION ERROR :
[INFO] -------------------------------------------------------------
[ERROR] custom-war-packager/demo/jenkinsfile-runner/tmp/build/jenkinsfile-runner/bootstrap/src/main/java/io/jenkins/jenkinsfile/runner/bootstrap/Bootstrap.java:[11,24] cannot find symbol
symbol: class PostConstruct
location: package javax.annotation
[ERROR] /custom-war-packager/demo/jenkinsfile-runner/tmp/build/jenkinsfile-runner/bootstrap/src/main/java/io/jenkins/jenkinsfile/runner/bootstrap/Bootstrap.java:[142,6] cannot find symbol
symbol: class PostConstruct
location: class io.jenkins.jenkinsfile.runner.bootstrap.Bootstrap

Resolution:
Looks like jenkinsfile runner is missing the dependency that provides PostConstruct.

Can't use the CLI on Windows

It seems, that on Windows the parent environment is not forwarded to the spawned mvn process, like it is on Linux.
So that I get the following error, when I try to build a simple custom war configuration:

Exception in thread "main" java.io.IOException: Cannot run program "mvn" (in directory "tmp\prebuild"): CreateProcess error=2, Das System kann die angegebene Datei nicht finden
	at java.lang.ProcessBuilder.start(Unknown Source)
	at io.jenkins.tools.warpackager.lib.util.SystemCommandHelper.runFor(SystemCommandHelper.java:29)
	at io.jenkins.tools.warpackager.lib.util.SystemCommandHelper.processFor(SystemCommandHelper.java:20)
	at io.jenkins.tools.warpackager.lib.util.MavenHelper.run(MavenHelper.java:60)
	at io.jenkins.tools.warpackager.lib.util.MavenHelper.run(MavenHelper.java:42)
	at io.jenkins.tools.warpackager.lib.impl.Builder.build(Builder.java:142)
	at io.jenkins.tools.warpackager.cli.Main.main(Main.java:56)
Caused by: java.io.IOException: CreateProcess error=2, Das System kann die angegebene Datei nicht finden
	at java.lang.ProcessImpl.create(Native Method)
	at java.lang.ProcessImpl.<init>(Unknown Source)
	at java.lang.ProcessImpl.start(Unknown Source)
	... 7 more

On Linux it works out of the box.

I can workaround this on windows, by calling the inner mvn command by myself:

cd tmp\prebuild
mvn package

Dockerized Image build service (with Kaniko?)

To simplify building Jenkins images in Docker, it would be great to be able to package and deploy images from the container itself. It is possible to use Kaniko or PodMan/Buildah for such purpose.

Acceptance criteria:

  • Update the Custom WAR Packager image to be based on Kaniko (or create a new image)
  • Update Docker build steps to support the Kaniko invocation from inside the container
  • Expose publishing option so that the created images can be deployed to DockerHub or private container images
  • Document the flow and create a demo for it

For evaluation purposes, https://github.com/jenkinsci/ci.jenkins.io-runner can be built with Kaniko out of the box

Nexus Proxy url

I need to use our own Nexus proxy url instead of update center url. Currently I am getting below error. How to resolve?

Downloading: http://repo.maven.apache.org/maven2/org/jenkins-ci/tools/maven-hpi-plugin/2.2/maven-hpi-plugin-2.2.pom
Plugin org.jenkins-ci.tools:maven-hpi-plugin:2.2 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.jenkins-ci.tools:maven-hpi-plugin:jar:2.2: Could not transfer artifact org.jenkins-ci.tools:maven-hpi-plugin:pom:2.2 from/to repo.jenkins-ci.org (https://repo.jenkins-ci.org/public/): repo.jenkins-ci.org: Name or service not known: Unknown host repo.jenkins-ci.org: Name or service not known -> [Help 1]
[21:34:27][Step 1/1] [ERROR]

Make plugin Group IDs optional in the YAML specification

Custom WAR Packager 2.x uses the Jenkins update center to retrieve the plugin information, and it can also do pluginID => groupId/artifactId mapping . There is no need to strictly require Group IDs in the current Custom WAR Packager implementation.

Acceptance criteria

  • groupId field is now optional when Update Center Plugin plugin info Provider s used
  • There is a groupId resolution logic in Custom WAR Packager. This logic is invoked if there is no Group ID is specified for a plugin field
  • There is a test coverage for specifications without Group ID

Error assembling WAR: webxml attribute is required

Hi,

when I try to execute the demos (e.g. all-latest-core) it fails with Error assembling WAR: webxml attribute is required (full log below). I tried several Java/Maven version combinations (Java 1.8.0_202, Maven 3.6.0, Maven 3.5.4) without success.

Adding the 'webxml' parameter to the 'maven-war-plugin' config in tmp\output\pom.xml and letting it point to tmp\prebuild\exploded-war\WEB-INF\web.xml makes it build successfully. I prepared a Pull Request #67.

Question, am I doing something wrong, is my environment wrong, or is this a bug?

Thanks and kind regards, Alex

Log

[INFO] Building war: [...]\custom-war-packager\demo\all-latest-core\tmp\output\target\jenkins-all-latest-1.0-SNAPSHOT.war
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  5.698 s
[INFO] Finished at: 2019-01-24T12:00:39+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-war-plugin:3.0.0:war (default-war) on project jenkins-all-latest: Error assembling WAR: webxml attribute is required (or pre-existing WEB-INF/web.xml if executing in update mode) -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Exception in thread "main" java.io.IOException: Command failed with exit code 1: cmd.exe /C mvn.cmd clean package
        at io.jenkins.tools.warpackager.lib.util.SystemCommandHelper.processFor(SystemCommandHelper.java:39)
        at io.jenkins.tools.warpackager.lib.util.MavenHelper.run(MavenHelper.java:66)
        at io.jenkins.tools.warpackager.lib.util.MavenHelper.run(MavenHelper.java:46)
        at io.jenkins.tools.warpackager.lib.impl.Builder.build(Builder.java:161)
        at io.jenkins.tools.warpackager.cli.Main.main(Main.java:56)

Neither Jenkins core nor Jenkins war have been defined by configuration file or BOM/POM

It seems that the bom option in the packager-config.yml does not recognize that Jenkins core is specified in bom.yml.

Steps to reproduce:

bom.yml

metadata:
  labels:
    name: bom-it
    groupId: org.jenkins-ci.main
    artifactId: jenkins-war
    version: 2.176
spec:
  core:
    version: 2.176
  plugins:
    - groupId: "org.jenkins-ci.plugins.workflow"
      artifactId: "workflow-aggregator"
      version: 2.6

packager-config.yml

bundle:
  groupId: "test.group"
  artifactId: "custom-jenkins"

bomIncludeWar: true
buildSettings:
  bom: bom.yml

Run:

java -jar custom-war-packager-cli.jar -configPath=packager-config.yml -version=1.0-SNAPSHOT

Output:

Exception in thread "main" java.io.IOException: Neither Jenkins core nor Jenkins war have been defined by configuration file or BOM/POM
	at io.jenkins.tools.warpackager.lib.impl.Builder.build(Builder.java:106)
	at io.jenkins.tools.warpackager.cli.Main.main(Main.java:53)

Adding a valid war section to packager-config.yml results in a successful build, but all plugins from bom.yml are missing.

packager-config.yml - modified

bundle:
  groupId: "test.group"
  artifactId: "custom-jenkins"

bomIncludeWar: true
buildSettings:
  bom: bom.yml

war:
  groupId: org.jenkins-ci.main
  artifactId: jenkins-war
  source:  
    version: 2.176

Output:

May 07, 2019 8:45:08 AM io.jenkins.tools.warpackager.lib.impl.Builder buildIfNeeded
INFO: Component org.jenkins-ci.main:jenkins-war:2.176: no build required

Things I tried:
jenkinsci/artifact-manager-s3-plugin#20
https://github.com/jenkinsci/jep/tree/master/jep/309

Workaround
Add --bomPath to the packaging command.

java -jar custom-war-packager-cli.jar -configPath=packager-config.yml -version=1.0-SNAPSHOT --bomPath bom.yml

[JENKINS-51070] - Caching: Add a warmup call for dependency:get

dependency:get now always gets invoked in the offline mode. If the artifact is missing in the local repo, caching won't work properly

[INFO] --- custom-war-packager-maven-plugin:0.1-alpha-3:custom-war (default) @ artifact-manager-s3-demo ---
Mar 28, 2018 1:39:04 AM io.jenkins.tools.warpackager.lib.impl.Builder buildIfNeeded
INFO: Will checkout jenkins-war from git: git: https://github.com/jglick/jenkins.git, checkout: 2090468d82e49345519a2457f1d1e7426f01540b
[INFO] Scanning for projects...
[WARNING] The POM for org.apache.maven.plugins:maven-install-plugin:jar:2.4 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-install-plugin:2.4: Plugin org.apache.maven.plugins:maven-install-plugin:2.4 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-install-plugin:jar:2.4 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-deploy-plugin:jar:2.7 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-deploy-plugin:2.7: Plugin org.apache.maven.plugins:maven-deploy-plugin:2.7 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-deploy-plugin:jar:2.7 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-site-plugin:jar:3.3 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-site-plugin:3.3: Plugin org.apache.maven.plugins:maven-site-plugin:3.3 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-site-plugin:jar:3.3 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-antrun-plugin:jar:1.3 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-antrun-plugin:1.3: Plugin org.apache.maven.plugins:maven-antrun-plugin:1.3 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-antrun-plugin:jar:1.3 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-assembly-plugin:jar:2.2-beta-5 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5: Plugin org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-assembly-plugin:jar:2.2-beta-5 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-dependency-plugin:jar:2.8 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-dependency-plugin:2.8: Plugin org.apache.maven.plugins:maven-dependency-plugin:2.8 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-dependency-plugin:jar:2.8 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-release-plugin:jar:2.3.2 is missing, no dependency information available
[WARNING] Failed to retrieve plugin descriptor for org.apache.maven.plugins:maven-release-plugin:2.3.2: Plugin org.apache.maven.plugins:maven-release-plugin:2.3.2 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-release-plugin:jar:2.3.2 has not been downloaded from it before.
[WARNING] The POM for org.apache.maven.plugins:maven-dependency-plugin:jar:2.8 is missing, no dependency information available
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.147 s
[INFO] Finished at: 2018-03-28T01:39:05Z
[INFO] Final Memory: 7M/106M
[INFO] ------------------------------------------------------------------------
[ERROR] Plugin org.apache.maven.plugins:maven-dependency-plugin:2.8 or one of its dependencies could not be resolved: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.plugins:maven-dependency-plugin:jar:2.8 has not been downloaded from it before. -> [Help 1]

https://issues.jenkins-ci.org/browse/JENKINS-51070

Wrong plugin version included sometimes

I'm having a weird issue where the wrong plugin version is sometimes included. Some builds are produced right, sometimes one plugin has the wrong version and sometimes two plugins are wrong.

It's always the same two plugins that are problematic: git and git-client.
The strange thing is that tmp/prebuild/pom.xml specifies the right version for the plugin(s).

Haven't been able to reproduce this in my local enviromment, but sees it in our CI (Jenkins) environment on Linux (RHEL). Not sure how to figure out what the problem is.
I've tested v1.6, 1.7 and 2.0-alpha-2 of customer-war-packager-cli. Also tested Maven 3.5.4 and 3.6.2. The same problem regardless.

This is how we execute:
java -jar ./lib/custom-war-packager-cli-1.7-jar-with-dependencies.jar --batch-mode -configPath packager-config.yml -mvnSettingsFile SOMEMAVENSETTINGSINJENKINS -version SOMEVERSION

I'm attaching the packager-config.yml (had to add .txt extension for Github to accept it.)
packager-config.yml.txt

YAML parser does not honor YAML anchors in definition

When using the YAML config file in v1.7 it appears that it does correctly process YAML anchors.

  - groupId: "io.jenkins.blueocean"
    artifactId: "blueocean"
    source:
      version: &blueocean_version
          "1.22.0"
  - groupId: "io.jenkins.blueocean"
    artifactId: "blueocean-web"
    source:
      version: *blueocean_version
  - groupId: "io.jenkins.blueocean"
    artifactId: "blueocean-web"
    source:
      version: *blueocean_version

Should correctly process all three plugins to version 1.22.0, instead you get the error The POM for io.jenkins.blueocean:blueocean-web:jar:blueocean_version is missing, no dependency information available

Release 2.0.0

I found that README references 2.0.0 version of CWP, however could not find any public releases since 1.6.
Is it planned in the nearest time?

[JENKINS-51068] - Maven HPI Plugin is invoked without Upper Bounds Check

When a Custom WAR is packaged by invoking Maven HPI plugin, the intermediate POM has no upper bounds checks. So the resulting WAR may compile but then fail to start depending on the inclusion order.

Mar 28, 2018 2:48:42 AM jenkins.InitReactorRunner$1 onTaskFailed
SEVERE: Failed Loading plugin Artifact Manager on S3 plugin v256.0-master-bc845780854b6a522f6a07a63f24fe2c21a739bc-SNAPSHOT (private-bc845780-nenashev) (artifact-manager-s3)
java.io.IOException: Artifact Manager on S3 plugin v256.0-master-bc845780854b6a522f6a07a63f24fe2c21a739bc-SNAPSHOT (private-bc845780-nenashev) failed to load.
 - Structs Plugin v1.7 is older than required. To fix, install v1.10 or later.
	at hudson.PluginWrapper.resolvePluginDependencies(PluginWrapper.java:655)
	at hudson.PluginManager$2$1$1.run(PluginManager.java:514)
	at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:169)
	at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:296)
	at jenkins.model.Jenkins$5.runTask(Jenkins.java:1062)
	at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:214)
	at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:745)

https://issues.jenkins-ci.org/browse/JENKINS-51068

Adding plugins from pom.xml fails

I tried to generate the war for https://github.com/oleg-nenashev/ci.jenkins.io-runner but it failed:

Exception in thread "main" java.io.IOException: CasC section is declared, but CasC plugin is not declared in the plugins list
	at io.jenkins.tools.warpackager.lib.impl.Builder.verifyConfig(Builder.java:66)
	at io.jenkins.tools.warpackager.lib.impl.Builder.build(Builder.java:97)
	at io.jenkins.tools.warpackager.cli.Main.main(Main.java:53)
make: *** [Makefile:38: build] Error 1

i tracked the error down to the missing dependencies. Every plugin is a jar file in tmp/hpiDownloads/dependencies.txt
e.g. :

The following files have been resolved:
   org.jenkins-ci.plugins.workflow:workflow-job:jar:2.32:compile
   org.apache.commons:commons-csv:jar:1.5:compile
   org.apache.maven:maven-plugin-api:jar:3.1.0:compile
   org.jenkins-ci.ui:handlebars:jar:1.1:compile
   org.jenkins-ci.plugins.workflow:workflow-durable-task-step:jar:2.22:compile
...

i've wrote a small patch that doesn't check for the defined dependencies to be hpi files and it is working for me.

Index: custom-war-packager-lib/src/main/java/io/jenkins/tools/warpackager/lib/config/Config.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- custom-war-packager-lib/src/main/java/io/jenkins/tools/warpackager/lib/config/Config.java	(date 1557242355000)
+++ custom-war-packager-lib/src/main/java/io/jenkins/tools/warpackager/lib/config/Config.java	(date 1557308159000)
@@ -207,9 +207,7 @@
 
         List<DependencyInfo> deps = helper.listDependenciesFromPom(tmpDir, pom, destination);
 
-        for (DependencyInfo dep : deps) {
-            processMavenDep(helper, tmpDir, dep, plugins);
-        }
+        plugins.addAll(deps);
 
         if (!pomIgnoreRoot) {
             // Add the artifact itself, no validation as we assume the pom is from a plugin

[JENKINS-51072] - Release flow: Maven plugin deployment fails

Seems that the current Parent POM does not play nicely with Maven Plugin packaging within a multi-module repo. To be investigated, but it does not block deployment of essential artifacts.

[INFO] Uploading: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/0.1-alpha-2/custom-war-packager-maven-plugin-0.1-alpha-2.jar
[INFO] Progress (1): 2.0/7.3 kB
[INFO] Progress (1): 4.1/7.3 kB
[INFO] Progress (1): 6.1/7.3 kB
[INFO] Progress (1): 7.3 kB    
[INFO]                     
[INFO] Uploaded: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/0.1-alpha-2/custom-war-packager-maven-plugin-0.1-alpha-2.jar (7.3 kB at 9.0 kB/s)
[INFO] Uploading: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/0.1-alpha-2/custom-war-packager-maven-plugin-0.1-alpha-2.pom
[INFO] Progress (1): 2.0/3.8 kB
[INFO] Progress (1): 3.8 kB    
[INFO]                     
[INFO] Uploaded: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/0.1-alpha-2/custom-war-packager-maven-plugin-0.1-alpha-2.pom (3.8 kB at 4.6 kB/s)
[INFO] Downloading: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/maven-metadata.xml
[INFO] Progress (1): 447 B
[INFO]                    
[INFO] Downloaded: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/maven-metadata.xml (447 B at 1.8 kB/s)
[INFO] Downloading: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/maven-metadata.xml
[INFO] Progress (1): 302 B
[INFO]                    
[INFO] Downloaded: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/maven-metadata.xml (302 B at 1.2 kB/s)
[INFO] Uploading: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/maven-metadata.xml
[INFO] Progress (1): 393 B
[INFO]                    
[INFO] Uploaded: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/custom-war-packager-maven-plugin/maven-metadata.xml (393 B at 519 B/s)
[INFO] Uploading: https://repo.jenkins-ci.org/releases/io/jenkins/tools/custom-war-packager/maven-metadata.xml
[INFO] Progress (1): 302 B

Caching glitch for artifacts with non-jar reference

If a dependency is defined by commit, the cache resolution polls for improper artifact:

FO] --- maven-dependency-plugin:2.8:get (default-cli) @ standalone-pom ---
[INFO] Resolving org.jenkins-ci.main:jenkins-war:jar:256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.167 s
[INFO] Finished at: 2018-03-28T02:25:22+02:00
[INFO] Final Memory: 14M/309M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:2.8:get (default-cli) on project standalone-pom: Couldn't download artifact: Cannot access local.central (@localRepositoryUrl@) in offline mode and the artifact org.jenkins-ci.main:jenkins-war:jar:256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT has not been downloaded from it before.
[ERROR] 
[ERROR] Try downloading the file manually from the project website.
[ERROR] 
[ERROR] Then, install it using the command: 
[ERROR]     mvn install:install-file -DgroupId=org.jenkins-ci.main -DartifactId=jenkins-war -Dversion=256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT -Dpackaging=jar -Dfile=/path/to/file
[ERROR] 
[ERROR] Alternatively, if you host your own repository you can deploy the file there: 
[ERROR]     mvn deploy:deploy-file -DgroupId=org.jenkins-ci.main -DartifactId=jenkins-war -Dversion=256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT -Dpackaging=jar -Dfile=/path/to/file -Durl=[url] -DrepositoryId=[id]
[ERROR] 
[ERROR] 
[ERROR]   org.jenkins-ci.main:jenkins-war:jar:256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT
[ERROR] 
[ERROR] from the specified remote repositories:
[ERROR]   local.central (@localRepositoryUrl@, releases=true, snapshots=true),
[ERROR]   central (https://repo.maven.apache.org/maven2, releases=true, snapshots=false)
[ERROR] 
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Mar 28, 2018 2:25:23 AM io.jenkins.tools.warpackager.lib.impl.Builder buildIfNeeded
INFO: Snapshot is missing for org.jenkins-ci.main:jenkins-war:git: https://github.com/jglick/jenkins.git, checkout: 2090468d82e49345519a2457f1d1e7426f01540b: 256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT. Will run the build

Building original "version-SNAPSHOT" builds should be opt-in

Currently Custom WAR Packager builds all snapshots twice: for internal version format and for "whatever is defined in pom.xml". The latter mode is useful in case when a developer does not deploy timestamped snapshots (bad approach), but it doubles the build time since we need to build any cache miss twice.

It would be great to make this option opt-in.

Documentation

Hello,
Is there any documentation or reference for CWP configuration file?
Currently, I've copy-pasted samples from projects mentioned in README and for now it is ok, since my goal is covered by most of them.
In order to have full list of available parameters, however, I have to explore code.

Is it possible at least to publish something like that: https://github.com/jenkinsci/custom-war-packager#configuration-file, but with all possible keys (where applicable)?

Thanks in advance.

Jenkins WAR version in POM is overridden by transitive plugin dependency

packager-config.yml:

bundle:
  groupId: com.test
  artifactId: jenkins
  vendor: andreyakostov
buildSettings:
  pom: pom.xml
  pomIgnoreRoot: true
  pomIncludeWar: true

pom.xml:

<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.test</groupId>
  <artifactId>jenkins-plugins</artifactId>
  <version>1.0.0</version>
  <packaging>pom</packaging>

  <properties>
    <jenkins.version>2.190.1</jenkins.version>
    <java.level>8</java.level>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.jenkins-ci.plugins</groupId>
      <artifactId>resource-disposer</artifactId>
      <version>0.13</version>
    </dependency>
  </dependencies>

</project>

resource-disposer depends on jenkins-core 2.54, which overrides the version specified in the jenkins.version property.

Request to have a way to check if there are any plugins dependency errors

What feature do you want to see added?

Like the following log output when I try to build a custom Jenkins package, I found it's pretty easy to meet the plugin dependency errors. So, I'm wondering if there are any possible chances to check or report it.

Any ideas or clues are appreciated.

 2022-01-06 07:22:03.943+0000 [id=28]	SEVERE	jenkins.InitReactorRunner$1#onTaskFailed: Failed Loading plugin Kubernetes plugin v1.31.2 (kubernetes)

 java.io.IOException: Failed to load: Kubernetes plugin (1.31.2)

  - Update required: Credentials Plugin (2.3.15) to be updated to 2.6.1 or higher

  - Update required: Variant Plugin (1.3) to be updated to 1.4 or higher

  - Update required: Pipeline: API (2.42) to be updated to 1108.v57edf648f5d4 or higher

  - Update required: Kubernetes Credentials Plugin (0.7.0) to be updated to 0.9.0 or higher

Upstream changes

No response

Cleanup FindSecBugs warnings

Recent Jenkins Parent POM versions introduce FindSecBugs: https://find-sec-bugs.github.io/ (introduced in jenkinsci/pom#61). All these issues do not seem to be relevant to Custom WAR Packager itself, but some of them might be relevant to https://github.com/jenkinsci/custom-distribution-service from @sladyn98 , also CC @halkeye . It is unlikely, but it is better to do a graceful review/cleanup while the service is in the alpha state.


[2020-10-12T05:54:06.847Z] [INFO] --- spotbugs-maven-plugin:4.1.3:check (spotbugs) @ custom-war-packager-lib ---

[2020-10-12T05:54:06.848Z] [INFO] BugInstance size is 20

[2020-10-12T05:54:06.848Z] [INFO] Error size is 0

[2020-10-12T05:54:06.848Z] [INFO] Total bugs: 20

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.config.Config, io.jenkins.tools.warpackager.lib.config.BuildSettings, io.jenkins.tools.warpackager.lib.config.Config] At Config.java:[line 118]At BuildSettings.java:[line 111]At Config.java:[line 118] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.config.Config, io.jenkins.tools.warpackager.lib.config.BuildSettings, io.jenkins.tools.warpackager.lib.config.Config] At Config.java:[line 114]At BuildSettings.java:[line 111]At Config.java:[line 114] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.config.Config, io.jenkins.tools.warpackager.lib.config.Config] At Config.java:[line 72]At Config.java:[line 72] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder] At Builder.java:[line 150]At Builder.java:[line 150] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder] At Builder.java:[line 204]At Builder.java:[line 204] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder] At Builder.java:[line 274]At Builder.java:[line 274] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder] At Builder.java:[line 327]At Builder.java:[line 327] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder] At Builder.java:[line 234]At Builder.java:[line 135]At Builder.java:[line 136] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder] At Builder.java:[line 241]At Builder.java:[line 241] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 205] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 211] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 73] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 164]At Builder.java:[line 156]At Builder.java:[line 157]At JenkinsWarPatcher.java:[line 110]At JenkinsWarPatcher.java:[line 135]At JenkinsWarPatcher.java:[line 140]At JenkinsWarPatcher.java:[line 164] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 224] XXE_DOCUMENT

[2020-10-12T05:54:06.848Z] [ERROR] Medium: The use of TransformerFactory.newInstance(...) (TransformerFactory) is vulnerable to XML External Entity attacks [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 252] XXE_DTD_TRANSFORM_FACTORY

[2020-10-12T05:54:06.848Z] [ERROR] Medium: The use of TransformerFactory.newInstance(...) is vulnerable to XSLT External Entity attacks [io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher] At JenkinsWarPatcher.java:[line 252] XXE_XSLT_TRANSFORM_FACTORY

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This web server request could be used by an attacker to expose internal services and filesystem. [io.jenkins.tools.warpackager.lib.impl.plugins.UpdateCenterPluginInfoProvider] At UpdateCenterPluginInfoProvider.java:[line 46] URLCONNECTION_SSRF_FD

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.config.SourceInfo, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.plugins.MavenPluginInfoProvider, io.jenkins.tools.warpackager.lib.impl.plugins.MavenPluginInfoProvider, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper] At MavenHelper.java:[line 106]At SourceInfo.java:[line 43]At Builder.java:[line 114]At Builder.java:[line 118]At Builder.java:[line 121]At Builder.java:[line 128]At Builder.java:[line 197]At Builder.java:[line 261]At Builder.java:[line 291]At Builder.java:[line 292]At Builder.java:[line 298]At Builder.java:[line 303]At Builder.java:[line 306]At MavenPluginInfoProvider.java:[line 32]At MavenPluginInfoProvider.java:[line 33]At MavenHelper.java:[line 92]At MavenHelper.java:[line 95]At MavenHelper.java:[line 104] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input [io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.impl.plugins.MavenPluginInfoProvider, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper] At MavenHelper.java:[line 86]At MavenPluginInfoProvider.java:[line 32]At MavenHelper.java:[line 85]At MavenHelper.java:[line 92]At MavenHelper.java:[line 95] PATH_TRAVERSAL_IN

[2020-10-12T05:54:06.848Z] [ERROR] Medium: This usage of java/lang/ProcessBuilder.<init>([Ljava/lang/String;)V can be vulnerable to Command Injection [io.jenkins.tools.warpackager.lib.util.SystemCommandHelper, io.jenkins.tools.warpackager.lib.config.DockerBuildSettings, io.jenkins.tools.warpackager.lib.config.SourceInfo, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.Builder, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.JenkinsWarPatcher, io.jenkins.tools.warpackager.lib.impl.plugins.MavenPluginInfoProvider, io.jenkins.tools.warpackager.lib.impl.plugins.MavenPluginInfoProvider, io.jenkins.tools.warpackager.lib.util.DockerfileBuilder, io.jenkins.tools.warpackager.lib.util.DockerfileBuilder, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.MavenHelper, io.jenkins.tools.warpackager.lib.util.SystemCommandHelper, io.jenkins.tools.warpackager.lib.util.SystemCommandHelper, io.jenkins.tools.warpackager.lib.util.SystemCommandHelper, io.jenkins.tools.warpackager.lib.util.SystemCommandHelper, io.jenkins.tools.warpackager.lib.util.SystemCommandHelper] At SystemCommandHelper.java:[line 32]At DockerBuildSettings.java:[line 67]At SourceInfo.java:[line 43]At Builder.java:[line 114]At Builder.java:[line 118]At Builder.java:[line 121]At Builder.java:[line 128]At Builder.java:[line 147]At Builder.java:[line 156]At Builder.java:[line 157]At Builder.java:[line 165]At Builder.java:[line 197]At Builder.java:[line 261]At Builder.java:[line 291]At Builder.java:[line 292]At Builder.java:[line 298]At Builder.java:[line 303]At Builder.java:[line 306]At Builder.java:[line 329]At Builder.java:[line 344]At Builder.java:[line 349]At Builder.java:[line 350]At JenkinsWarPatcher.java:[line 110]At JenkinsWarPatcher.java:[line 135]At JenkinsWarPatcher.java:[line 140]At JenkinsWarPatcher.java:[line 165]At MavenPluginInfoProvider.java:[line 32]At MavenPluginInfoProvider.java:[line 33]At DockerfileBuilder.java:[line 55]At DockerfileBuilder.java:[line 60]At MavenHelper.java:[line 46]At MavenHelper.java:[line 53]At MavenHelper.java:[line 59]At MavenHelper.java:[line 61]At MavenHelper.java:[line 62]At MavenHelper.java:[line 66]At MavenHelper.java:[line 69]At MavenHelper.java:[line 107]At MavenHelper.java:[line 114]At MavenHelper.java:[line 132]At MavenHelper.java:[line 138]At MavenHelper.java:[line 161]At MavenHelper.java:[line 165]At MavenHelper.java:[line 166]At SystemCommandHelper.java:[line 29]At SystemCommandHelper.java:[line 36]At SystemCommandHelper.java:[line 37]At SystemCommandHelper.java:[line 44]At SystemCommandHelper.java:[line 50] COMMAND_INJECTION

[2020-10-12T05:54:06.848Z] [INFO] 

Custom WAR Packager should be packaging WAR with Upper Bounds Check by default

Maven HPI Plugin custom-war step does not contribute to the proper dependency resolution, and effectively we may be packaging WAR file with incompatible dependencies. WAR Builds successfully, but then the startup fails due to dependency issues.

Enabling Maven Enforcer plugin in the build by default could help a lot.

Fix encoding warning from m-resources-p

During the build Maven (actually maven-resources-plugin) reports warnings that platform encoding is used, i.e. build is platform dependent. I believe there are no resource files involved but it would be nice to get these warnings removed as they could confuse.
In my case I don't provide the pom myself so it is generated and the solution would then be that the generated pom should declare:

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

[JENKINS-51071] - UX: CommitID gets duplicated in version when the the spec is specified for commitId

Just a minor issue which leads to long version strings. Noticed it in https://github.com/oleg-nenashev/jenkins-custom-war-packager-ci-demo

war:
  groupId: "org.jenkins-ci.main"
  artifactId: "jenkins-war"
  source:
    git: https://github.com/jglick/jenkins.git
    commit: 2090468d82e49345519a2457f1d1e7426f01540b
[ERROR] No plugin found for prefix 'dependency' in the current project and in the plugin groups [org.apache.maven.plugins, org.codehaus.mojo] available from the repositories [local (/home/ec2-user/.m2/repository), central (https://repo.maven.apache.org/maven2)] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/NoPluginFoundForPrefixException
Mar 28, 2018 1:21:54 AM io.jenkins.tools.warpackager.lib.impl.Builder buildIfNeeded
INFO: Snapshot is missing for org.jenkins-ci.main:jenkins-war:git: https://github.com/jglick/jenkins.git, checkout: 2090468d82e49345519a2457f1d1e7426f01540b: 256.0-2090468d82e49345519a2457f1d1e7426f01540b-2090468d82e49345519a2457f1d1e7426f01540b-SNAPSHOT. Will run the build
Cloning into '.'...
Note: checking out '2090468d82e49345519a2457f1d1e7426f01540b'.

https://issues.jenkins-ci.org/browse/JENKINS-51071

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.