Skip to content

Commit 198d44f

Browse files
lemeurhervelemeurherve
committed
chore: verify WAR signature when downloading it
1 parent 1180511 commit 198d44f

File tree

12 files changed

+91
-108
lines changed

12 files changed

+91
-108
lines changed

‎.ci/publish.sh‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,15 +90,13 @@ mkdir -p target
9090
BUILD_METADATA_PATH="target/build-result-metadata_${BAKE_TARGET}_${metadata_suffix}.json"
9191
build_opts+=("--metadata-file=${BUILD_METADATA_PATH}")
9292

93-
WAR_SHA="$(curl --disable --fail --silent --show-error --location "https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war.sha256")"
9493
COMMIT_SHA=$(git rev-parse HEAD)
95-
export COMMIT_SHA JENKINS_VERSION WAR_SHA LATEST_WEEKLY LATEST_LTS BUILD_METADATA_PATH
94+
export COMMIT_SHA JENKINS_VERSION LATEST_WEEKLY LATEST_LTS BUILD_METADATA_PATH
9695

9796
cat <<EOF
9897
Using the following settings:
9998
* JENKINS_REPO: ${JENKINS_REPO}
10099
* JENKINS_VERSION: ${JENKINS_VERSION}
101-
* WAR_SHA: ${WAR_SHA}
102100
* COMMIT_SHA: ${COMMIT_SHA}
103101
* LATEST_WEEKLY: ${LATEST_WEEKLY}
104102
* LATEST_LTS: ${LATEST_LTS}

‎HACKING.adoc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,6 @@ Dry run, will not publish images
161161
Using the following settings:
162162
* JENKINS_REPO: jenkins/jenkins
163163
* JENKINS_VERSION: 2.528.3
164-
* WAR_SHA: bfa31f1e3aacebb5bce3d5076c73df97bf0c0567eeb8d8738f54f6bac48abd74
165164
* COMMIT_SHA: 1c72a9383191562eb3c44838aeeadad0839c2c92
166165
* LATEST_WEEKLY: false
167166
* LATEST_LTS: true
@@ -179,7 +178,6 @@ $ ./.ci/publish.sh -n
179178
Using the following settings:
180179
* JENKINS_REPO: jenkins/jenkins
181180
* JENKINS_VERSION: 2.528.3
182-
* WAR_SHA: bfa31f1e3aacebb5bce3d5076c73df97bf0c0567eeb8d8738f54f6bac48abd74
183181
* COMMIT_SHA: aaf4e7faf887b7ac4879c3bf540ede48220cca9f
184182
* LATEST_WEEKLY: false
185183
* LATEST_LTS: true
@@ -211,7 +209,6 @@ Using the following settings:
211209
"JAVA_VERSION": "25.0.1_8",
212210
"JENKINS_VERSION": "2.528.3",
213211
"PLUGIN_CLI_VERSION": "2.13.2",
214-
"WAR_SHA": "bfa31f1e3aacebb5bce3d5076c73df97bf0c0567eeb8d8738f54f6bac48abd74",
215212
"WAR_URL": "https://get.jenkins.io/war-stable/2.528.3/jenkins.war"
216213
},
217214
"tags": [

‎Jenkinsfile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ if (SIMULATE_LTS_BUILD) {
3434
'TAG_NAME=2.504.3',
3535
// TODO: replace by the first LTS based on 2.534+ when available
3636
'JENKINS_VERSION=2.541.1',
37-
'WAR_SHA=8b12678aa6f9550b06825b006f9096186b17a7b857e9b68ad3f980d9f430fc94',
3837
// Filter out golden file based testing
3938
// To filter out all tests, set BATS_FLAGS="--filter-tags none"
4039
'BATS_FLAGS=--filter-tags "\\!test-type:golden-file"'

‎alpine/hotspot/Dockerfile‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -97,18 +97,17 @@ RUN mkdir -p ${REF}/init.groovy.d
9797
ARG JENKINS_VERSION
9898
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
9999

100-
# jenkins.war checksum, download will be validated using it
101-
ARG WAR_SHA=ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088
102-
103100
# Can be used to customize where jenkins.war get downloaded from
104101
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
102+
COPY jenkins.io-2026.key /tmp/jenkins-key.pub
105103

106-
# could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
104+
# could use ADD but this one does not check Last-Modified header
107105
# see https://github.com/docker/docker/issues/8331
108-
RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
109-
&& echo "${WAR_SHA} /usr/share/jenkins/jenkins.war" >/tmp/war_sha \
110-
&& sha256sum -c --strict /tmp/war_sha \
111-
&& rm -f /tmp/war_sha
106+
RUN curl -fsSL "${WAR_URL}" -o /usr/share/jenkins/jenkins.war \
107+
&& curl -fsSL "${WAR_URL}.asc" -o /tmp/jenkins.war.asc \
108+
&& gpg --import /tmp/jenkins-key.pub \
109+
&& gpg --verify --trust-model direct /tmp/jenkins.war.asc /usr/share/jenkins/jenkins.war \
110+
&& rm -f /tmp/*
112111

113112
ENV JENKINS_UC=https://updates.jenkins.io
114113
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
@@ -118,9 +117,9 @@ RUN chown -R ${user} "$JENKINS_HOME" "$REF"
118117
ARG PLUGIN_CLI_VERSION=2.13.2
119118
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/${PLUGIN_CLI_VERSION}/jenkins-plugin-manager-${PLUGIN_CLI_VERSION}.jar
120119
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /opt/jenkins-plugin-manager.jar \
121-
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/war_sha \
122-
&& sha256sum -c --strict /tmp/war_sha \
123-
&& rm -f /tmp/war_sha
120+
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/jpm_sha \
121+
&& sha256sum -c --strict /tmp/jpm_sha \
122+
&& rm -f /tmp/jpm_sha
124123

125124
# for main web interface:
126125
EXPOSE ${http_port}

‎debian/Dockerfile‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -111,18 +111,17 @@ RUN mkdir -p ${REF}/init.groovy.d
111111
ARG JENKINS_VERSION
112112
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
113113

114-
# jenkins.war checksum, download will be validated using it
115-
ARG WAR_SHA=ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088
116-
117114
# Can be used to customize where jenkins.war get downloaded from
118115
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
116+
COPY jenkins.io-2026.key /tmp/jenkins-key.pub
119117

120-
# could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
118+
# could use ADD but this one does not check Last-Modified header
121119
# see https://github.com/docker/docker/issues/8331
122-
RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
123-
&& echo "${WAR_SHA} /usr/share/jenkins/jenkins.war" >/tmp/war_sha \
124-
&& sha256sum -c --strict /tmp/war_sha \
125-
&& rm -f /tmp/war_sha
120+
RUN curl -fsSL "${WAR_URL}" -o /usr/share/jenkins/jenkins.war \
121+
&& curl -fsSL "${WAR_URL}.asc" -o /tmp/jenkins.war.asc \
122+
&& gpg --import /tmp/jenkins-key.pub \
123+
&& gpg --verify --trust-model direct /tmp/jenkins.war.asc /usr/share/jenkins/jenkins.war \
124+
&& rm -f /tmp/*
126125

127126
ENV JENKINS_UC=https://updates.jenkins.io
128127
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
@@ -132,9 +131,9 @@ RUN chown -R ${user} "$JENKINS_HOME" "$REF"
132131
ARG PLUGIN_CLI_VERSION=2.13.2
133132
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/${PLUGIN_CLI_VERSION}/jenkins-plugin-manager-${PLUGIN_CLI_VERSION}.jar
134133
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /opt/jenkins-plugin-manager.jar \
135-
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/war_sha \
136-
&& sha256sum -c --strict /tmp/war_sha \
137-
&& rm -f /tmp/war_sha
134+
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/jpm_sha \
135+
&& sha256sum -c --strict /tmp/jpm_sha \
136+
&& rm -f /tmp/jpm_sha
138137

139138
# for main web interface:
140139
EXPOSE ${http_port}

‎docker-bake.hcl‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,6 @@ variable "JENKINS_VERSION" {
1515
default = "2.547"
1616
}
1717

18-
variable "WAR_SHA" {
19-
default = "ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088"
20-
}
21-
2218
variable "WAR_URL" {
2319
default = ""
2420
}
@@ -115,7 +111,6 @@ target "alpine" {
115111
context = "."
116112
args = {
117113
JENKINS_VERSION = JENKINS_VERSION
118-
WAR_SHA = WAR_SHA
119114
WAR_URL = war_url()
120115
COMMIT_SHA = COMMIT_SHA
121116
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
@@ -136,7 +131,6 @@ target "debian" {
136131
context = "."
137132
args = {
138133
JENKINS_VERSION = JENKINS_VERSION
139-
WAR_SHA = WAR_SHA
140134
WAR_URL = war_url()
141135
COMMIT_SHA = COMMIT_SHA
142136
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
@@ -158,7 +152,6 @@ target "rhel" {
158152
context = "."
159153
args = {
160154
JENKINS_VERSION = JENKINS_VERSION
161-
WAR_SHA = WAR_SHA
162155
WAR_URL = war_url()
163156
COMMIT_SHA = COMMIT_SHA
164157
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
@@ -180,7 +173,6 @@ target "windowsservercore" {
180173
context = "."
181174
args = {
182175
JENKINS_VERSION = JENKINS_VERSION
183-
WAR_SHA = WAR_SHA
184176
WAR_URL = war_url()
185177
COMMIT_SHA = COMMIT_SHA
186178
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION

‎jenkins.io-2026.key‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
3+
mQINBGlJRoMBEADGTw4Jms5rD1Wd0evqpTkNBgAIvCzvsjgGXHevmNIsDmm/niiE
4+
gKJlrl73T9d8GZeoacsAqwGTIq29ZA1jEt1lUZ8YkVxD3VxoL0RBhgMcy3qhiu37
5+
mQN1mzuItob8P2pft5pPqCWQDojXRpnMB/BTHgbtIH3i4chKVLJoCEX/Gw7abDbj
6+
cUpoKMTByd0+Zv2OBtdm7ZOYXHObPmSqRoiYNiCsW3mZRsgN1LkwTl5IwJQ7Xpj8
7+
9J4DK1Y6Fuyxi+QTbZk9Z3inrTx3pbARPd91MylIsOtuXkUFNQkA/ZWnKHTFgWQA
8+
qx//KrsCKLe6r3+CQ4/1R4F7jHjBB01qHrxofEzGo0LB/+QNwf1ISqD7piw20IMt
9+
vhlOqdsF2MQQAeyg8fv4nuLglI9ueh4T5FJabp6oL0QDozx1toa5Q58n0nX8gSBq
10+
3VTd8FkzTTsaihyypWmzbdVPwAAfXhRh7sNAUvALkq4vj/EWjPruQElWyP8DwmiC
11+
Aq8iduFb66oN58vlT1rf3z/jJH3FeByVEHEymz4E9rhBN1oOUQ++ONqCMOZHwnpY
12+
K549A+mHrK12RDQTYjgbi9BH2ktPqPUE37rZDoGN9hzZ9dqG8dMEEz5qVMzsGhuw
13+
nm1d86yQRUzscHwgPELc7xiIuV3taLf2KI4qSHTDmq6nRFxcgKI2LGFfcwARAQAB
14+
tDJKZW5raW5zIFByb2plY3QgPGplbmtpbnNjaS1ib2FyZEBnb29nbGVncm91cHMu
15+
Y29tPokCVwQTAQgAQRYhBF44bq21XwFQTK6Lz3GY9LcUq/xoBQJpSUaDAhsDBQkF
16+
o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEHGY9LcUq/xouboP/1Zd
17+
KxZXkTj20jnBn8MJ9scr17wzGLy2/EaAelbfeIYmsWJ6A7ZuuUw/41dUbTuI3k3D
18+
Ta1Ft0oO5K63sJqvTQzUdas6x3HMsjYSo+YtbRZnMmR/KO4//5Lewm3LPQnCV662
19+
8ZI73T22msQAbyxa8do56dmBT4N/NO6oGFZI6JBFnkiIlXmKDzm3aiEZi//piN3X
20+
PZgtu8wHqpFleJXUbCpk8Db69xTjdXhnFpaYg29VrzvD/0jBEZE47Bekrl6YgjJ8
21+
CKyhaPWZfxYxNeuVRTn+yxlAcDc8o9tboSKnlZ8HSOBPbf36qmLKbD4rPQmTAVgJ
22+
hwBY2mxDUT5hTVom25KeyueIyN4l6OZEoLxcq5GxN85RkU2Zfq1jodpnm/PnF47Y
23+
7qS4zu8bOOeUCFpJXG3kDYo34tkFKk5CT8PJLHdjgLWGvhQeL95ytPvrTLkEj4yk
24+
6SXHH4EcKimgi0c/zotnzv997kGCpoMZoeIXpkhrTJoZvSQqFpeCamFRwl/AfM/l
25+
ppyH905Cm/GcB+W0hQqTsA0wm+6ZQn4fAR/rhqRk4Ka1TuX2ow3OQKlyoA4EgvdI
26+
41MQEw4y9spjH2RgyJpOAgIagidECrFJbqNcyzHUZUxcD7fKMRaiv5LepxVLXZ0/
27+
XDDBGd3AXh6nv2BTDhoE+ZI1suWZAMwvxyoFDDFO
28+
=8CuH
29+
-----END PGP PUBLIC KEY BLOCK-----

‎make.ps1‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Param(
44
# Default script target
55
[String] $Target = 'build',
66
# Jenkins version to include
7-
[String] $JenkinsVersion = '2.534',
7+
[String] $JenkinsVersion = '2.547',
88
# Windows flavor and windows version to build
99
[String] $ImageType = 'windowsservercore-ltsc2022',
1010
# Generate a docker compose file even if it already exists
@@ -57,11 +57,6 @@ if([String]::IsNullOrWhiteSpace($env:WAR_URL)) {
5757
$env:WAR_URL = 'https://get.jenkins.io/{0}/{1}/jenkins.war' -f $releaseLine, $env:JENKINS_VERSION
5858
}
5959

60-
# Retrieve the sha256 corresponding to the war file
61-
$warShaURL = '{0}.sha256' -f $env:WAR_URL
62-
$webClient = New-Object System.Net.WebClient
63-
$env:WAR_SHA = $webClient.DownloadString($warShaURL).Split(' ')[0]
64-
6560
# Check for required commands
6661
Function Test-CommandExists {
6762
Param (

‎rhel/Dockerfile‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -101,18 +101,17 @@ RUN curl -fsSL "https://github.com/krallin/tini/releases/download/${TINI_VERSION
101101
ARG JENKINS_VERSION
102102
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
103103

104-
# jenkins.war checksum, download will be validated using it
105-
ARG WAR_SHA=ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088
106-
107104
# Can be used to customize where jenkins.war get downloaded from
108105
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
106+
COPY jenkins.io-2026.key /tmp/jenkins-key.pub
109107

110-
# could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
108+
# could use ADD but this one does not check Last-Modified header
111109
# see https://github.com/docker/docker/issues/8331
112-
RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
113-
&& echo "${WAR_SHA} /usr/share/jenkins/jenkins.war" >/tmp/war_sha \
114-
&& sha256sum -c --strict /tmp/war_sha \
115-
&& rm -f /tmp/war_sha
110+
RUN curl -fsSL "${WAR_URL}" -o /usr/share/jenkins/jenkins.war \
111+
&& curl -fsSL "${WAR_URL}.asc" -o /tmp/jenkins.war.asc \
112+
&& gpg --import /tmp/jenkins-key.pub \
113+
&& gpg --verify --trust-model direct /tmp/jenkins.war.asc /usr/share/jenkins/jenkins.war \
114+
&& rm -f /tmp/*
116115

117116
ENV JENKINS_UC=https://updates.jenkins.io
118117
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
@@ -122,9 +121,9 @@ RUN chown -R ${user} "$JENKINS_HOME" "$REF"
122121
ARG PLUGIN_CLI_VERSION=2.13.2
123122
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/${PLUGIN_CLI_VERSION}/jenkins-plugin-manager-${PLUGIN_CLI_VERSION}.jar
124123
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /opt/jenkins-plugin-manager.jar \
125-
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/war_sha \
126-
&& sha256sum -c --strict /tmp/war_sha \
127-
&& rm -f /tmp/war_sha
124+
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/jpm_sha \
125+
&& sha256sum -c --strict /tmp/jpm_sha \
126+
&& rm -f /tmp/jpm_sha
128127

129128
# for main web interface:
130129
EXPOSE ${http_port}

‎updatecli/updatecli.d/jenkins-version-simulated-lts.yaml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,6 @@ sources:
2828
\d+\.\d+\.1$
2929
transformers:
3030
- trimprefix: "jenkins-"
31-
latestWarSha:
32-
kind: shell
33-
name: Get latest Jenkins Core LTS sha256 checksum
34-
spec:
35-
command: curl --disable --fail --silent --show-error --location "https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/{{ source "latestVersion" }}/jenkins-war-{{ source "latestVersion" }}.war.sha256"
3631

3732
conditions:
3833
isDockerImagePublished:
@@ -74,17 +69,6 @@ targets:
7469
file: tests/golden/expected_tags_latest_lts.txt
7570
matchpattern: :(\d+\.\d+\.\d+)
7671
replacepattern: :{{ source "latestVersion" }}
77-
updateWarSha:
78-
name: Update default value of simulated LTS WAR_SHA in Jenkinsfile
79-
kind: file
80-
scmid: default
81-
sourceid: latestWarSha
82-
spec:
83-
file: Jenkinsfile
84-
matchpattern: >-
85-
'WAR_SHA=(.*)'
86-
content: >-
87-
'WAR_SHA={{ source "latestWarSha" }}'
8872

8973
actions:
9074
default:

0 commit comments

Comments
 (0)