Happy New Year! 2022 edition

The Jenkins project continued its deep commitment to Google Summer of Code in 2021.

Five Jenkins projects were accepted into Google Summer of Code. All five projects were completed successfully.

Special thanks to the Google Summer of Code students:

Read more about their results and their impact on the Jenkins project in the end of project report.

Hacktoberfest 2021 contributors provided over 90 pull requests to Jenkins repositories. The pull requests included improvements to Jenkins core, Jenkins plugins, Jenkins infrastructure, and Jenkins documentation.

Key results included:

The Jenkins project was a mentoring organization in the first ever She Code Africa Contributhon. The She Code Africa Contributhon pays African women to work with open source organizations on selected projects with dedicated mentors. This program aims to create a more diverse, inclusive, and innovative culture within the African open source ecosystem by matching African women in technology with sponsor and mentor open source organizations.

The five women met with mentors twice weekly for a month. They built Jenkins core and Jenkins plugins and submitted pull requests to improve Jenkins plugin online help and documentation. The 5 mentees on the Jenkins project joined the project from Nigeria, Kenya, and Rwanda.

More details are available in the She Code Africa blogpost.

As the culmination of 12 months of work by many different people, Jenkins modernized its configuration forms in Jenkins 2.277.1. The Jenkins user interface is now much better adapted to narrow screens and modern web layout techniques. It works well on all modern web browsers.

The configuration form modernization introduction included a changelog, an upgrade guide, and an introductory webinar.

Many outdated Jenkins dependencies were updated or replaced by 2021 development work.

The Jenkins core security library was converted from a forked copy of Acegi Security to the most recent release of the standard Spring Security library. The Jenkins core XML serialization library was converted from a forked copy of the XStream library to the most recent release of the standard XStream library. The Jenkins internal class management libraries were converted from a forked copy of Apache Ant libraries to the most recent release of the standard Apache Ant libraries.

Outdated libraries were removed from Jenkins core including ASM 5, ASM 6, Apache Commons Digester, Bytecode Compatibility Transformer, Akuma, Woodstox, JNA Posix, JTidy, and libpam4j. Removals were accompanied by plugin updates as needed to retain compatibility and functionality.

Key libraries were updated to use more recent releases of the libraries. Guava was upgraded from 11.0.1 to 31.0.1. Guice was upgraded from 4.0 to 5.0.1. Groovy was upgraded from 2.4.12 to 2.4.21. Many Apache Commons libraries were upgraded to their most recent releases.

Continuous delivery of Jenkins components was proposed in 2020 by Jesse Glick as Jenkins Enhancement Proposal 229. By the end of 2021, 119 plugins had adopted continuous delivery, providing new plugin releases each time a relevant commit was merged to the plugin repository. Additional components have adopted continuous delivery as well, including the plugin bill of materials and the Jenkins test harness.

We look forward to even greater adoption of continuous delivery for plugins in 2022.

Java 11 was adopted as the recommended JDK during 2021. Docker images now use JDK 11 by default. See the blogpost for more information about the Docker image transition.

Docker images with Java 11 are also available for multiple platforms, including 64 bit ARM and IBM s390x.

Daniel Beck proposed Jenkins Enhancement Proposal 235 in November, 2021 to remove the ability to disable or customize the agent-to-controller security system. Telemetry has been added to Jenkins releases beginning with 2.319.1 and Jenkins 2.326. The telemetry reports agent use of methods to access files on the controller. As controller file access from agents is detected by the telemetry, issues are raised to remove that access from the offending plugin.

December 2021 included the announcement of multiple zero day vulnerabilities in the Apache Log4j 2 library. The Jenkins security team assessed the impact of the vulnerabilities and confirmed that Jenkins core was not affected by the vulnerabilities. Further research showed that Jenkins plugins might be affected by the vulnerabilities. Instructions were shared in a blogpost so that Jenkins administrators could check their system for issues. A Jira epic tracks the progress of corrections in the plugins that were including the affected Apache Log4j 2 library versions.

In September, 2021, a zero day vulnerability was disclosed in the Confluence version used in the Jenkins project. The infrastructure team permanently disabled the service, rotated privileged credentials, and actively reduced the scope of access across the Jenkins infrastructure. Passwords for all user accounts on jenkins.io were reset. Users were required to perform a password recovery in order to regain access to their jenkins.io accounts. See the blogpost for more details.

The page content from the Jenkins Confluence instance has been returned to service as static HTML pages. The plugin documentation from the Jenkins Confluence instance is now integrated into the plugin site build process.

Wadeck Follonier coordinated and mentored an end-of-study security research project for four students during the last year of their Master’s Degree - Reliability and IT Security at the University of Aix-Marseille. The students applied their university training to audit Jenkins core and many Jenkins plugins for specific types of security issues. Their project resulted in 14 vulnerabilities reported in Jenkins security advisories. More details of their results and their processes are available in the blogpost.