The Jenkins project provides a download mirror infrastructure allowing to download Jenkins packages and plugins from a download server close to your location. How Does it Work? When a download request is emitted to either mirrors.jenkins.io or get.jenkins.io, an HTTP redirect response to a mirror download server is answered. The Jenkins infrastructure uses a database of existing mirror servers provided by volunteers and donators to select the...

A remote code execution vulnerability has been identified in the Spring Framework. This vulnerability is identified as CVE-2022-22965. Spring officially reacted early in an early announcement. SpringShell in Jenkins Core and Plugins The Jenkins security team has confirmed that the Spring vulnerability is not affecting Jenkins Core. There is no impact because we are using Stapler as a servlet, and neither Spring MVC nor Spring WebFlux. An analysis was done...

A critical security vulnerability has been identified in the popular "Apache Log4j 2" library. This vulnerability is identified as CVE-2021-44228. Log4j in Jenkins The Jenkins security team has confirmed that Log4j is not used in Jenkins core. Jenkins plugins may be using Log4j. You can identify whether Log4j is included with any plugin by running the following Groovy script in the Script Console: org.apache.logging.log4j.core.lookup.JndiLookup.class.protectionDomain.codeSource If this results in the following error,...

Earlier this week the Jenkins infrastructure team identified a successful attack against our deprecated Confluence service. We responded immediately by taking the affected server offline while we investigated the potential impact. At this time we have no reason to believe that any Jenkins releases, plugins, or source code have been affected. Thus far in our investigation, we have learned that the Confluence CVE-2021-26084 exploit was used to...

The Jenkins project has used Jira to track issues for many years. Jenkins core, Jenkins modules, Jenkins infrastructure, and many Jenkins plugins manage their issue reports with our Jira server. Jira helps the Jenkins project manage issues and tasks related to over 250 000 Jenkins installations. It tracks bugs, enhancement requests, tasks, and security issues. It is used regularly by users around the world. We’re grateful for the long-standing contribution...

Table of Contents Context The Problems The Solution Shared Library Duplication Documentation Scalability Installation Agnostic Feature Toggling This post will describe how I use a shared library in Jenkins. Typically when using multibranch pipeline. If possible (if not forced to) I implement the pipelines without multibranch. I previously wrote about how I do that with my Generic Webhook Trigger Plugin in a previous post. But this will be my second choice, If I am not...

The Jenkins project relies heavily on its infrastructure. We use websites like www.jenkins.io and plugins.jenkins.io, ticketing systems like issues.jenkins.io , CI/CD infrastructure like ci.jenkins.io , and many other services. Just to provide some context about the Jenkins infrastructure scale, here are some stats from April 2020: Over 600 000 people visited www.jenkins.io Over 250 000 Jenkins servers regularly checked the Jenkins package server and the Jenkins update server Over 43...

Next week Olivier Vernin from CloudBees and Brian Benz from Microsoft will be presenting a session at DevOps World | Jenkins World about how Microsoft has been working with Jenkins to build Jenkins plugins and produce Jenkins on Microsoft Azure. These plugins run Jenkins on Azure Linux and Windows VMs, Kubernetes, azure App service, as well as deploy artifacts to those Azure platforms and more. All...

Jenkins infrastructure is continuously improving. The latest service to get some attention and major improvement is the Jenkins javadoc. There were a number of issues affecting that service: Irregular updates - Developers wouldn’t find the latest java documentation because of inadequate update frequency. Broken HTTPS support - when users would go to the Javadoc site they would get an unsafe site warning and then an incorrect redirection. Obsolete content - Javadoc...

I am pleased to announce that we have partnered with Microsoft to migrate and power the Jenkins project’s infrastructure with Microsoft Azure. The partnership comes at an important time, after the recent launch of Jenkins 2.0, Jenkins users are more readily adopting Pipeline as Code and many other plugins at an increasing rate, elevating the importance of Jenkins infrastructure to the overall success of the project. That strong and continued growth...