Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-43610

Split Trilead out from Core

    XMLWordPrintable

    Details

    • Epic Name:
      Split Trilead out from Jenkins Core
    • Similar Issues:
    • Released As:
      Jenkins 2.186

      Description

      Jenkins core currently bundles version 8 of the Jenkins fork of Trilead to provide SSH client functionality. Multiple plugins depend on this provision to utilize Trilead classes, so don't bundle Trilead directly. A new version of Trilead has recently been released containing a number of security enhancements (strong MAC algorithms, strong key exchange methods, curve based cryptographic keys etc), but this requires one of the following:

      1. Jenkins core to update the bundled Trilead library. This means anyone using the weekly release from the point we include a new bundled library gets the new features, but users who only upgrade plugins or who are on an LTS release are stuck with an old Trilead version
      2. Any plugin that wants hardened SSH capabilities bundles Trilead directly, but then potentially breaks functionality shared between plugins: SSH credentials uses `Class.isAssignableFrom` to check it can provide credentials, which stops this plugin working if the plugin needing credentials hasn't loaded Trilead from the same classloader (currently core).

      Since nothing in Jenkins core actually needs Trilead or the supporting classes that have been added to core for it, the logical change would be

      1. Copy the Trilead library and supporting classes into a plugin
      2. Update plugins that require Trilead so they depend on this new plugin
      3. Remove Trilead from the core and bundle the new Trilead plugin as a detached plugin

      More plugins will be added to the components list for this issue as investigation is performed into what plugins depend on Trilead. Some plugins may be updated to remove references to Trilead classes where they're only using utility methods from Trilead, such as Base64 methods and `IOUtils.closeQuitely`.

      Current changes required:

      Component Changes PR Raised PR Merged Change Released
      Jenkins Core (Phase 1)
      1. Replace Trilead Base64 references with java.util.Base64 references (various classes)
      2. Replace Trilead MD5 reference with MessageDigest.getInstance("MD5") (ConsistentHash.java)
      Yes Yes Yes
      Jenkins Core (Phase 2)
      1. Move SFTP client into Trilead plugin and remove from core
      2. Update sshd-module and ssh-cli-module dependencies to latest version
      3. Remove Trilead dependency from core
      4. Set Trilead dependency in CLI project to 'optional' to prevent core visibility
      5. Set Trilead API Plugin as a detached plugin
      Yes Yes Yes
      Token Macro Plugin Remove unused import to com.trilead.ssh2.crypto.digest.MAC from JobDescriptionMacro Yes Yes Yes
      SSHD Module
      1. Upgrade SSH CLI Module dependency to a new version (1.2 or above)
      2. Remove direct references to Trilead classes, instead using SSH CLI Auth Module's key comparison functionality found in newer versions
      Yes Yes Yes
      SSH CLI Auth Module
      1. Replace reference to Trilead Base64 with one from Hudson Remoting (could potentially use java.util.Base64, but would required bump to Java 8 which I'm not planning on doing)
      2. Replace reference to Trilead TypesWriter in PublicKeySignatureWriter with a simple PEM writer (only need to support BigInteger, String, int, and byte arrays)
      Yes Yes Yes
      Credentials Plugin Replace references to Trilead Base64 in CertificateCredentialsImpl.java with hudson.remoting.Base64 Yes Yes Yes
      Trilead API Plugin Create new plugin containing Trilead library from Jenkins core and release it to update centre Yes Yes Yes

      Other changed to be confirmed

        Attachments

          Issue Links

            Activity

            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Oleg Nenashev
            Path:
            pom.xml
            src/main/java/org/jenkinsci/main/modules/sshd/PublicKeyAuthenticatorImpl.java
            http://jenkins-ci.org/commit/sshd-module/534ebac23ff600f5d5a564d04c24ae4ecbc11cd0
            Log:
            Merge pull request #13 from mc1arke/JENKINS-43610-remove-trilead-references

            JENKINS-43668 - Remove Trilead references

            Compare: https://github.com/jenkinsci/sshd-module/compare/04216b8201ae...534ebac23ff6

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml src/main/java/org/jenkinsci/main/modules/sshd/PublicKeyAuthenticatorImpl.java http://jenkins-ci.org/commit/sshd-module/534ebac23ff600f5d5a564d04c24ae4ecbc11cd0 Log: Merge pull request #13 from mc1arke/ JENKINS-43610 -remove-trilead-references JENKINS-43668 - Remove Trilead references Compare: https://github.com/jenkinsci/sshd-module/compare/04216b8201ae...534ebac23ff6
            Hide
            ifernandezcalvo Ivan Fernandez Calvo added a comment -

            Repositories affected

            • acceptance-test-harness
            • cloudbees-plugin-gateway
            • extras-ec2-launcher
            • svnkit

            Plugins affected

            • BlameSubversion
            • digitalocean
            • docker
            • ec2
            • ec2-cloud-axis
            • ec2-plugin
            • external-logging-elasticsearch
            • git-client
            • jclouds
            • libvirt-slave
            • mansion-cloud
            • nodepool-agents
            • openstack-cloud
            • pxe
            • scaleway-cloud
            • ssh-agent
            • ssh-cli
            • ssh-cli-auth
            • ssh-credentials
            • ssh-slaves
            • ssh2easy
            • subversion
            • svn-release-mgr
            Show
            ifernandezcalvo Ivan Fernandez Calvo added a comment - Repositories affected acceptance-test-harness cloudbees-plugin-gateway extras-ec2-launcher svnkit Plugins affected BlameSubversion digitalocean docker ec2 ec2-cloud-axis ec2-plugin external-logging-elasticsearch git-client jclouds libvirt-slave mansion-cloud nodepool-agents openstack-cloud pxe scaleway-cloud ssh-agent ssh-cli ssh-cli-auth ssh-credentials ssh-slaves ssh2easy subversion svn-release-mgr
            Hide
            oleg_nenashev Oleg Nenashev added a comment -

            It was released in 2.185 and caused JENKINS-58483

            Show
            oleg_nenashev Oleg Nenashev added a comment - It was released in 2.185 and caused  JENKINS-58483
            Hide
            oleg_nenashev Oleg Nenashev added a comment -

            Reopening since it is an EPIC

            Show
            oleg_nenashev Oleg Nenashev added a comment - Reopening since it is an EPIC
            Hide
            oleg_nenashev Oleg Nenashev added a comment -

            Jenkins 2.186 integrates the regression fixes. https://jenkins.io/changelog/#v2.186

            I assume this EPIC is completed, unless new regressions are reported

            Show
            oleg_nenashev Oleg Nenashev added a comment - Jenkins 2.186 integrates the regression fixes.  https://jenkins.io/changelog/#v2.186 I assume this EPIC is completed, unless new regressions are reported

              People

              • Assignee:
                ifernandezcalvo Ivan Fernandez Calvo
                Reporter:
                mc1arke Michael Clarke
              • Votes:
                5 Vote for this issue
                Watchers:
                14 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: