chore: update CA cert import in README and test #2251
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| * text=auto eol=lf | ||
| *.sh text eol=lf | ||
| jenkins-support text eol=lf | ||
| Dockerfile* text eol=lf | ||
| *.sh binary | ||
| # Ignore the binary line above, it was a mistake in my thought process. | ||
| # Better: | ||
| *.sh text eol=lf | ||
| jenkins-support text eol=lf | ||
| Dockerfile* text eol=lf | ||
| *.key text eol=lf | ||
| *.gpg text eol=lf | ||
| *.adoc text eol=lf | ||
| *.md text eol=lf | ||
| *.txt text eol=lf | ||
| *.xml text eol=lf | ||
| *.groovy text eol=lf | ||
| *.ps1 text eol=crlf | ||
| *.psm1 text eol=crlf | ||
| Makefile text eol=lf | ||
| Jenkinsfile text eol=lf | ||
| docker-bake.hcl text eol=lf |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,11 +10,11 @@ COPY jdk-download-url.sh /usr/bin/jdk-download-url.sh | |
| COPY jdk-download.sh /usr/bin/jdk-download.sh | ||
|
|
||
| RUN dnf install --disableplugin=subscription-manager --setopt=install_weak_deps=0 --setopt=tsflags=nodocs --allowerasing -y \ | ||
| ca-certificates \ | ||
| curl \ | ||
| jq \ | ||
| && dnf clean --disableplugin=subscription-manager all \ | ||
| && /usr/bin/jdk-download.sh | ||
|
|
||
| ENV PATH="/opt/jdk-${JAVA_VERSION}/bin:${PATH}" | ||
|
|
||
|
|
@@ -23,22 +23,22 @@ ENV PATH="/opt/jdk-${JAVA_VERSION}/bin:${PATH}" | |
| # while still saving space (approx 200mb from the full distribution) | ||
| # hadolint ignore=SC2086 | ||
| RUN java_major_version="$(jlink --version 2>&1 | cut -c1-2)"; \ | ||
| if [ "$java_major_version" = "25" ]; then \ | ||
| cp -r "/opt/jdk-${JAVA_VERSION}" /javaruntime; \ | ||
| else \ | ||
| case "$java_major_version" in \ | ||
| "17") options="--compress=2" ;; \ | ||
| "21") options="--compress=zip-6" ;; \ | ||
| *) echo "ERROR: unmanaged jlink version pattern" && exit 1 ;; \ | ||
| esac; \ | ||
| jlink \ | ||
| --strip-java-debug-attributes \ | ||
| ${options} \ | ||
| --add-modules ALL-MODULE-PATH \ | ||
| --no-man-pages \ | ||
| --no-header-files \ | ||
| --output /javaruntime; \ | ||
| fi | ||
|
|
||
| # Jenkins version being bundled in this docker image | ||
| ARG JENKINS_VERSION=2.549 | ||
|
|
@@ -62,14 +62,14 @@ ARG TARGETARCH | |
| ARG COMMIT_SHA | ||
|
|
||
| RUN dnf install --disableplugin=subscription-manager --setopt=install_weak_deps=0 --setopt=tsflags=nodocs -y \ | ||
| fontconfig \ | ||
| freetype \ | ||
| git \ | ||
| git-lfs \ | ||
| unzip \ | ||
| which \ | ||
| tzdata \ | ||
| && dnf clean --disableplugin=subscription-manager all | ||
|
|
||
| ARG user=jenkins | ||
| ARG group=jenkins | ||
|
|
@@ -136,10 +136,15 @@ ENV PATH="${JAVA_HOME}/bin:${PATH}" | |
| COPY --from=jre-and-war /javaruntime $JAVA_HOME | ||
| COPY --from=jre-and-war /war/jenkins.war /usr/share/jenkins/jenkins.war | ||
|
|
||
| # Allow the jenkins user to import custom CA certificates at runtime | ||
| RUN cp "${JAVA_HOME}/lib/security/cacerts" "${JAVA_HOME}/lib/security/cacerts.original" \ | ||
|
Contributor
There was a problem hiding this comment. What is the intent of this instruction exactly? I don't see why duplicating certificates and changing permissions has any reason to be?
Contributor
Author
There was a problem hiding this comment. I realize the chown introduces a security concern, if Jenkins is compromised, the attacker gains write access to the truststore. A safer alternative would be to copy cacerts to JENKINS_HOME at startup and point the JVM at that copy via -Djavax.net.ssl.trustStore, keeping the system keystore root-owned. Would you prefer that approach?
Contributor
There was a problem hiding this comment. No, I'm asking about the purpose of this line change:
Contributor
Author
There was a problem hiding this comment. We’re using chown so the non-root jenkins user actually has permission to update the system truststore (cacerts) at runtime. Without this, the keytool command in our entrypoint just hits a permissions wall and fails. I’ve also added a cacerts.original backup as a safety net, just in case we need to roll back to the default upstream state.
Contributor
There was a problem hiding this comment. Doing such a backup is more a VM/bare metal behavior. In a container image, usually aimed at being immutable, it's better to use volumes. Your proposal above to copy the cert store at runtime makes better sense. I'm more worried by the permissions change to I wonder if, instead, documenting how to generate the new cacert would'nt be better instead? (either with
Contributor
Author
There was a problem hiding this comment. Both approaches sound good to me. Once everyone align on the final scope, let me know and I'll get started on the changes.
Contributor
There was a problem hiding this comment.
I like the idea of documentation, especially with the idea of Docker compose. There are other places on jenkins.io that would benefit from more use of Docker compose. This would be a good step towards wider use of Docker compose in the Jenkins documentation.
Contributor
Author
There was a problem hiding this comment. Thanks for the alignment everyone! I'll:
Would that work?
Contributor
Author
There was a problem hiding this comment.
@MarkEWaite @timja @krisstern @dduportal Hi everyone, just a gentle ping on this! Please let me know if this plan looks good to you all. I'd love to get started on these changes once we have alignment.
Member
There was a problem hiding this comment. That looks good to me, thanks! |
||
| && chown ${user}:${group} "${JAVA_HOME}/lib/security/cacerts" | ||
|
|
||
| USER ${user} | ||
|
|
||
| COPY jenkins-support /usr/local/bin/jenkins-support | ||
| COPY jenkins.sh /usr/local/bin/jenkins.sh | ||
| COPY import-custom-certs.sh /usr/local/bin/import-custom-certs.sh | ||
| COPY jenkins-plugin-cli.sh /bin/jenkins-plugin-cli | ||
|
|
||
| ARG JENKINS_VERSION=2.549 | ||
|
|
@@ -148,11 +153,11 @@ ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins.sh"] | |
|
|
||
| # metadata labels | ||
| LABEL \ | ||
| org.opencontainers.image.vendor="Jenkins project" \ | ||
| org.opencontainers.image.title="Official Jenkins Docker image" \ | ||
| org.opencontainers.image.description="The Jenkins Continuous Integration and Delivery server" \ | ||
| org.opencontainers.image.version="${JENKINS_VERSION}" \ | ||
| org.opencontainers.image.url="https://www.jenkins.io/" \ | ||
| org.opencontainers.image.source="https://github.com/jenkinsci/docker" \ | ||
| org.opencontainers.image.revision="${COMMIT_SHA}" \ | ||
| org.opencontainers.image.licenses="MIT" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please remove these changes to white space. They distract from the other changes.