Skip to content

Commit cbf2dda

Browse files
lemeurhervelemeurherve
committed
chore: verify WAR signature when downloading it (jenkinsci#2233)
1 parent ae42051 commit cbf2dda

File tree

10 files changed

+132
-106
lines changed

10 files changed

+132
-106
lines changed

‎.ci/publish.sh‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,15 +90,13 @@ mkdir -p target
9090
BUILD_METADATA_PATH="target/build-result-metadata_${BAKE_TARGET}_${metadata_suffix}.json"
9191
build_opts+=("--metadata-file=${BUILD_METADATA_PATH}")
9292

93-
WAR_SHA="$(curl --disable --fail --silent --show-error --location "https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war.sha256")"
9493
COMMIT_SHA=$(git rev-parse HEAD)
95-
export COMMIT_SHA JENKINS_VERSION WAR_SHA LATEST_WEEKLY LATEST_LTS BUILD_METADATA_PATH
94+
export COMMIT_SHA JENKINS_VERSION LATEST_WEEKLY LATEST_LTS BUILD_METADATA_PATH
9695

9796
cat <<EOF
9897
Using the following settings:
9998
* JENKINS_REPO: ${JENKINS_REPO}
10099
* JENKINS_VERSION: ${JENKINS_VERSION}
101-
* WAR_SHA: ${WAR_SHA}
102100
* COMMIT_SHA: ${COMMIT_SHA}
103101
* LATEST_WEEKLY: ${LATEST_WEEKLY}
104102
* LATEST_LTS: ${LATEST_LTS}

‎HACKING.adoc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,6 @@ Dry run, will not publish images
161161
Using the following settings:
162162
* JENKINS_REPO: jenkins/jenkins
163163
* JENKINS_VERSION: 2.528.3
164-
* WAR_SHA: bfa31f1e3aacebb5bce3d5076c73df97bf0c0567eeb8d8738f54f6bac48abd74
165164
* COMMIT_SHA: 1c72a9383191562eb3c44838aeeadad0839c2c92
166165
* LATEST_WEEKLY: false
167166
* LATEST_LTS: true
@@ -179,7 +178,6 @@ $ ./.ci/publish.sh -n
179178
Using the following settings:
180179
* JENKINS_REPO: jenkins/jenkins
181180
* JENKINS_VERSION: 2.528.3
182-
* WAR_SHA: bfa31f1e3aacebb5bce3d5076c73df97bf0c0567eeb8d8738f54f6bac48abd74
183181
* COMMIT_SHA: aaf4e7faf887b7ac4879c3bf540ede48220cca9f
184182
* LATEST_WEEKLY: false
185183
* LATEST_LTS: true
@@ -211,7 +209,6 @@ Using the following settings:
211209
"JAVA_VERSION": "25.0.1_8",
212210
"JENKINS_VERSION": "2.528.3",
213211
"PLUGIN_CLI_VERSION": "2.13.2",
214-
"WAR_SHA": "bfa31f1e3aacebb5bce3d5076c73df97bf0c0567eeb8d8738f54f6bac48abd74",
215212
"WAR_URL": "https://get.jenkins.io/war-stable/2.528.3/jenkins.war"
216213
},
217214
"tags": [

‎Jenkinsfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ if (SIMULATE_LTS_BUILD) {
3434
'TAG_NAME=2.504.3',
3535
// TODO: replace by the first LTS based on 2.534+ when available
3636
'JENKINS_VERSION=2.504.3',
37-
'WAR_SHA=ea8883431b8b5ef6b68fe0e5817c93dc0a11def380054e7de3136486796efeb0'
37+
// Filter out golden file based testing
38+
// To filter out all tests, set BATS_FLAGS="--filter-tags none"
39+
'BATS_FLAGS=--filter-tags "\\!test-type:golden-file"'
3840
]
3941
}
4042

‎alpine/hotspot/Dockerfile‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG ALPINE_TAG=3.23.3
22

3-
FROM alpine:"${ALPINE_TAG}" AS jre-build
3+
FROM alpine:"${ALPINE_TAG}" AS jre-and-war
44

55
ARG JAVA_VERSION=17.0.18_8
66

@@ -11,6 +11,7 @@ COPY jdk-download.sh /usr/bin/jdk-download.sh
1111

1212
RUN apk add --no-cache \
1313
ca-certificates \
14+
gnupg \
1415
jq \
1516
curl \
1617
&& rm -fr /var/cache/apk/* \
@@ -40,6 +41,20 @@ RUN java_major_version="$(jlink --version 2>&1 | cut -c1-2)"; \
4041
--output /javaruntime; \
4142
fi
4243

44+
# Jenkins version being bundled in this docker image
45+
ARG JENKINS_VERSION=2.534
46+
# Can be used to customize where jenkins.war get downloaded from
47+
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
48+
49+
COPY jenkins.io-2026.key /war/jenkins-key.pub
50+
51+
# Not using ADD as it does not check Last-Modified header
52+
# see https://github.com/docker/docker/issues/8331
53+
RUN curl -fsSL "${WAR_URL}" -o /war/jenkins.war \
54+
&& curl -fsSL "${WAR_URL}.asc" -o /war/jenkins.war.asc \
55+
&& gpg --import /war/jenkins-key.pub \
56+
&& gpg --verify --trust-model direct /war/jenkins.war.asc /war/jenkins.war
57+
4358
FROM alpine:"${ALPINE_TAG}" AS controller
4459

4560
RUN apk add --no-cache \
@@ -48,7 +63,6 @@ RUN apk add --no-cache \
4863
curl \
4964
git \
5065
git-lfs \
51-
gnupg \
5266
musl-locales \
5367
musl-locales-lang \
5468
openssh-client \
@@ -93,23 +107,6 @@ VOLUME $JENKINS_HOME
93107
# or config file with your custom jenkins Docker image.
94108
RUN mkdir -p ${REF}/init.groovy.d
95109

96-
# jenkins version being bundled in this docker image
97-
ARG JENKINS_VERSION
98-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
99-
100-
# jenkins.war checksum, download will be validated using it
101-
ARG WAR_SHA=ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088
102-
103-
# Can be used to customize where jenkins.war get downloaded from
104-
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
105-
106-
# could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
107-
# see https://github.com/docker/docker/issues/8331
108-
RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
109-
&& echo "${WAR_SHA} /usr/share/jenkins/jenkins.war" >/tmp/war_sha \
110-
&& sha256sum -c --strict /tmp/war_sha \
111-
&& rm -f /tmp/war_sha
112-
113110
ENV JENKINS_UC=https://updates.jenkins.io
114111
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
115112
ENV JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
@@ -118,9 +115,9 @@ RUN chown -R ${user} "$JENKINS_HOME" "$REF"
118115
ARG PLUGIN_CLI_VERSION=2.13.2
119116
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/${PLUGIN_CLI_VERSION}/jenkins-plugin-manager-${PLUGIN_CLI_VERSION}.jar
120117
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /opt/jenkins-plugin-manager.jar \
121-
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/war_sha \
122-
&& sha256sum -c --strict /tmp/war_sha \
123-
&& rm -f /tmp/war_sha
118+
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/jpm_sha \
119+
&& sha256sum -c --strict /tmp/jpm_sha \
120+
&& rm -f /tmp/jpm_sha
124121

125122
# for main web interface:
126123
EXPOSE ${http_port}
@@ -132,14 +129,17 @@ ENV COPY_REFERENCE_FILE_LOG=$JENKINS_HOME/copy_reference_file.log
132129

133130
ENV JAVA_HOME=/opt/java/openjdk
134131
ENV PATH="${JAVA_HOME}/bin:${PATH}"
135-
COPY --from=jre-build /javaruntime $JAVA_HOME
132+
COPY --from=jre-and-war /javaruntime $JAVA_HOME
133+
COPY --from=jre-and-war /war/jenkins.war /usr/share/jenkins/jenkins.war
136134

137135
USER ${user}
138136

139137
COPY jenkins-support /usr/local/bin/jenkins-support
140138
COPY jenkins.sh /usr/local/bin/jenkins.sh
141139
COPY jenkins-plugin-cli.sh /bin/jenkins-plugin-cli
142140

141+
ARG JENKINS_VERSION=2.534
142+
143143
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins.sh"]
144144

145145
# metadata labels

‎debian/Dockerfile‎

Lines changed: 23 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ ARG TRIXIE_TAG=20251103
33
ARG DEBIAN_RELEASE_LINE=trixie
44
ARG DEBIAN_VERSION=20251117
55
ARG DEBIAN_VARIANT="-slim"
6-
FROM debian:"${DEBIAN_RELEASE_LINE}-${DEBIAN_VERSION}${DEBIAN_VARIANT}" AS jre-build
6+
FROM debian:"${DEBIAN_RELEASE_LINE}-${DEBIAN_VERSION}${DEBIAN_VARIANT}" AS jre-and-war
77

88
ARG JAVA_VERSION=17.0.18_8
99

@@ -16,6 +16,7 @@ RUN apt-get update \
1616
&& apt-get install --no-install-recommends -y \
1717
ca-certificates \
1818
curl \
19+
gnupg \
1920
jq \
2021
&& rm -rf /var/lib/apt/lists/* \
2122
&& /usr/bin/jdk-download.sh
@@ -44,15 +45,27 @@ RUN java_major_version="$(jlink --version 2>&1 | cut -c1-2)"; \
4445
--output /javaruntime; \
4546
fi
4647

48+
# Jenkins version being bundled in this docker image
49+
ARG JENKINS_VERSION=2.534
50+
# Can be used to customize where jenkins.war get downloaded from
51+
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
52+
53+
COPY jenkins.io-2026.key /war/jenkins-key.pub
54+
55+
# Not using ADD as it does not check Last-Modified header
56+
# see https://github.com/docker/docker/issues/8331
57+
RUN curl -fsSL "${WAR_URL}" -o /war/jenkins.war \
58+
&& curl -fsSL "${WAR_URL}.asc" -o /war/jenkins.war.asc \
59+
&& gpg --import /war/jenkins-key.pub \
60+
&& gpg --verify --trust-model direct /war/jenkins.war.asc /war/jenkins.war
61+
4762
FROM debian:"${DEBIAN_RELEASE_LINE}-${DEBIAN_VERSION}${DEBIAN_VARIANT}" AS controller
4863

4964
RUN apt-get update \
5065
&& apt-get install -y --no-install-recommends \
5166
ca-certificates \
5267
curl \
5368
git \
54-
gnupg \
55-
gpg \
5669
libfontconfig1 \
5770
libfreetype6 \
5871
procps \
@@ -107,23 +120,6 @@ VOLUME $JENKINS_HOME
107120
# or config file with your custom jenkins Docker image.
108121
RUN mkdir -p ${REF}/init.groovy.d
109122

110-
# jenkins version being bundled in this docker image
111-
ARG JENKINS_VERSION
112-
ENV JENKINS_VERSION=${JENKINS_VERSION:-2.547}
113-
114-
# jenkins.war checksum, download will be validated using it
115-
ARG WAR_SHA=ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088
116-
117-
# Can be used to customize where jenkins.war get downloaded from
118-
ARG WAR_URL=https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war
119-
120-
# could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
121-
# see https://github.com/docker/docker/issues/8331
122-
RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
123-
&& echo "${WAR_SHA} /usr/share/jenkins/jenkins.war" >/tmp/war_sha \
124-
&& sha256sum -c --strict /tmp/war_sha \
125-
&& rm -f /tmp/war_sha
126-
127123
ENV JENKINS_UC=https://updates.jenkins.io
128124
ENV JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
129125
ENV JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
@@ -132,9 +128,9 @@ RUN chown -R ${user} "$JENKINS_HOME" "$REF"
132128
ARG PLUGIN_CLI_VERSION=2.13.2
133129
ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/${PLUGIN_CLI_VERSION}/jenkins-plugin-manager-${PLUGIN_CLI_VERSION}.jar
134130
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /opt/jenkins-plugin-manager.jar \
135-
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/war_sha \
136-
&& sha256sum -c --strict /tmp/war_sha \
137-
&& rm -f /tmp/war_sha
131+
&& echo "$(curl -fsSL "${PLUGIN_CLI_URL}.sha256") /opt/jenkins-plugin-manager.jar" >/tmp/jpm_sha \
132+
&& sha256sum -c --strict /tmp/jpm_sha \
133+
&& rm -f /tmp/jpm_sha
138134

139135
# for main web interface:
140136
EXPOSE ${http_port}
@@ -146,14 +142,17 @@ ENV COPY_REFERENCE_FILE_LOG=$JENKINS_HOME/copy_reference_file.log
146142

147143
ENV JAVA_HOME=/opt/java/openjdk
148144
ENV PATH="${JAVA_HOME}/bin:${PATH}"
149-
COPY --from=jre-build /javaruntime $JAVA_HOME
145+
COPY --from=jre-and-war /javaruntime $JAVA_HOME
146+
COPY --from=jre-and-war /war/jenkins.war /usr/share/jenkins/jenkins.war
150147

151148
USER ${user}
152149

153150
COPY jenkins-support /usr/local/bin/jenkins-support
154151
COPY jenkins.sh /usr/local/bin/jenkins.sh
155152
COPY jenkins-plugin-cli.sh /bin/jenkins-plugin-cli
156153

154+
ARG JENKINS_VERSION=2.534
155+
157156
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/jenkins.sh"]
158157

159158
# metadata labels

‎docker-bake.hcl‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,6 @@ variable "JENKINS_VERSION" {
1515
default = "2.544"
1616
}
1717

18-
variable "WAR_SHA" {
19-
default = "ef0301ce35bff7ead76201a8202acad6338568f0832666a2672831b260e08088"
20-
}
21-
2218
variable "WAR_URL" {
2319
default = ""
2420
}
@@ -115,7 +111,6 @@ target "alpine" {
115111
context = "."
116112
args = {
117113
JENKINS_VERSION = JENKINS_VERSION
118-
WAR_SHA = WAR_SHA
119114
WAR_URL = war_url()
120115
COMMIT_SHA = COMMIT_SHA
121116
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
@@ -136,7 +131,6 @@ target "debian" {
136131
context = "."
137132
args = {
138133
JENKINS_VERSION = JENKINS_VERSION
139-
WAR_SHA = WAR_SHA
140134
WAR_URL = war_url()
141135
COMMIT_SHA = COMMIT_SHA
142136
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
@@ -158,7 +152,6 @@ target "rhel" {
158152
context = "."
159153
args = {
160154
JENKINS_VERSION = JENKINS_VERSION
161-
WAR_SHA = WAR_SHA
162155
WAR_URL = war_url()
163156
COMMIT_SHA = COMMIT_SHA
164157
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
@@ -180,7 +173,6 @@ target "windowsservercore" {
180173
context = "."
181174
args = {
182175
JENKINS_VERSION = JENKINS_VERSION
183-
WAR_SHA = WAR_SHA
184176
WAR_URL = war_url()
185177
COMMIT_SHA = COMMIT_SHA
186178
PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION

‎jenkins.io-2026.key‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
3+
mQINBGlJRoMBEADGTw4Jms5rD1Wd0evqpTkNBgAIvCzvsjgGXHevmNIsDmm/niiE
4+
gKJlrl73T9d8GZeoacsAqwGTIq29ZA1jEt1lUZ8YkVxD3VxoL0RBhgMcy3qhiu37
5+
mQN1mzuItob8P2pft5pPqCWQDojXRpnMB/BTHgbtIH3i4chKVLJoCEX/Gw7abDbj
6+
cUpoKMTByd0+Zv2OBtdm7ZOYXHObPmSqRoiYNiCsW3mZRsgN1LkwTl5IwJQ7Xpj8
7+
9J4DK1Y6Fuyxi+QTbZk9Z3inrTx3pbARPd91MylIsOtuXkUFNQkA/ZWnKHTFgWQA
8+
qx//KrsCKLe6r3+CQ4/1R4F7jHjBB01qHrxofEzGo0LB/+QNwf1ISqD7piw20IMt
9+
vhlOqdsF2MQQAeyg8fv4nuLglI9ueh4T5FJabp6oL0QDozx1toa5Q58n0nX8gSBq
10+
3VTd8FkzTTsaihyypWmzbdVPwAAfXhRh7sNAUvALkq4vj/EWjPruQElWyP8DwmiC
11+
Aq8iduFb66oN58vlT1rf3z/jJH3FeByVEHEymz4E9rhBN1oOUQ++ONqCMOZHwnpY
12+
K549A+mHrK12RDQTYjgbi9BH2ktPqPUE37rZDoGN9hzZ9dqG8dMEEz5qVMzsGhuw
13+
nm1d86yQRUzscHwgPELc7xiIuV3taLf2KI4qSHTDmq6nRFxcgKI2LGFfcwARAQAB
14+
tDJKZW5raW5zIFByb2plY3QgPGplbmtpbnNjaS1ib2FyZEBnb29nbGVncm91cHMu
15+
Y29tPokCVwQTAQgAQRYhBF44bq21XwFQTK6Lz3GY9LcUq/xoBQJpSUaDAhsDBQkF
16+
o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEHGY9LcUq/xouboP/1Zd
17+
KxZXkTj20jnBn8MJ9scr17wzGLy2/EaAelbfeIYmsWJ6A7ZuuUw/41dUbTuI3k3D
18+
Ta1Ft0oO5K63sJqvTQzUdas6x3HMsjYSo+YtbRZnMmR/KO4//5Lewm3LPQnCV662
19+
8ZI73T22msQAbyxa8do56dmBT4N/NO6oGFZI6JBFnkiIlXmKDzm3aiEZi//piN3X
20+
PZgtu8wHqpFleJXUbCpk8Db69xTjdXhnFpaYg29VrzvD/0jBEZE47Bekrl6YgjJ8
21+
CKyhaPWZfxYxNeuVRTn+yxlAcDc8o9tboSKnlZ8HSOBPbf36qmLKbD4rPQmTAVgJ
22+
hwBY2mxDUT5hTVom25KeyueIyN4l6OZEoLxcq5GxN85RkU2Zfq1jodpnm/PnF47Y
23+
7qS4zu8bOOeUCFpJXG3kDYo34tkFKk5CT8PJLHdjgLWGvhQeL95ytPvrTLkEj4yk
24+
6SXHH4EcKimgi0c/zotnzv997kGCpoMZoeIXpkhrTJoZvSQqFpeCamFRwl/AfM/l
25+
ppyH905Cm/GcB+W0hQqTsA0wm+6ZQn4fAR/rhqRk4Ka1TuX2ow3OQKlyoA4EgvdI
26+
41MQEw4y9spjH2RgyJpOAgIagidECrFJbqNcyzHUZUxcD7fKMRaiv5LepxVLXZ0/
27+
XDDBGd3AXh6nv2BTDhoE+ZI1suWZAMwvxyoFDDFO
28+
=8CuH
29+
-----END PGP PUBLIC KEY BLOCK-----

‎make.ps1‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,6 @@ if([String]::IsNullOrWhiteSpace($env:WAR_URL)) {
5757
$env:WAR_URL = 'https://get.jenkins.io/{0}/{1}/jenkins.war' -f $releaseLine, $env:JENKINS_VERSION
5858
}
5959

60-
# Retrieve the sha256 corresponding to the war file
61-
$warShaURL = '{0}.sha256' -f $env:WAR_URL
62-
$webClient = New-Object System.Net.WebClient
63-
$env:WAR_SHA = $webClient.DownloadString($warShaURL).Split(' ')[0]
64-
6560
# Check for required commands
6661
Function Test-CommandExists {
6762
Param (

0 commit comments

Comments
 (0)