nixos/jenkins-job-builder: fix jenkins authentication
The current authentication code is broken against newer jenkins: jenkins-job-builder-start[1257]: Asking Jenkins to reload config jenkins-start[789]: 2022-07-12 14:34:31.148+0000 [id=17] WARNING hudson.security.csrf.CrumbFilter#doFilter: Found invalid crumb 31e96e52938b51f099a61df9505a4427cb9dca7e35192216755659032a4151df. If you are calling this URL with a script, please use the API Token instead. More information: https://www.jenkins.io/redirect/crumb-cannot-be-used-for-script jenkins-start[789]: 2022-07-12 14:34:31.160+0000 [id=17] WARNING hudson.security.csrf.CrumbFilter#doFilter: No valid crumb was included in request for /reload by admin. Returning 403. jenkins-job-builder-start[1357]: curl: (22) The requested URL returned error: 403 Fix it by using `jenkins-cli` instead of messing with `curl`. This rewrite also prevents leaking the password in process listings. (We could probably do it without `replace-secret`, assuming `printf` is a shell built-in, but this implementation should be safe even with shells not having a built-in `printf`.) Ref https://github.com/NixOS/nixpkgs/issues/156400.
This commit is contained in:
parent
5f0abd4712
commit
50eaf82b6f
|
@ -156,12 +156,22 @@ in {
|
|||
reloadScript = ''
|
||||
echo "Asking Jenkins to reload config"
|
||||
curl_opts="--silent --fail --show-error"
|
||||
access_token=${if cfg.accessTokenFile != ""
|
||||
then "$(cat '${cfg.accessTokenFile}')"
|
||||
else cfg.accessToken}
|
||||
jenkins_url="http://${cfg.accessUser}:$access_token@${jenkinsCfg.listenAddress}:${toString jenkinsCfg.port}${jenkinsCfg.prefix}"
|
||||
crumb=$(curl $curl_opts "$jenkins_url"'/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
|
||||
curl $curl_opts -X POST -H "$crumb" "$jenkins_url"/reload
|
||||
access_token_file=${if cfg.accessTokenFile != ""
|
||||
then cfg.accessTokenFile
|
||||
else "$RUNTIME_DIRECTORY/jenkins_access_token.txt"}
|
||||
if [ "${cfg.accessToken}" != "" ]; then
|
||||
(umask 0077; printf "${cfg.accessToken}" >"$access_token_file")
|
||||
fi
|
||||
jenkins_url="http://${jenkinsCfg.listenAddress}:${toString jenkinsCfg.port}${jenkinsCfg.prefix}"
|
||||
auth_file="$RUNTIME_DIRECTORY/jenkins_auth_file.txt"
|
||||
trap 'rm -f "$auth_file"' EXIT
|
||||
printf "${cfg.accessUser}:@password_placeholder@" >"$auth_file"
|
||||
"${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "$access_token_file" "$auth_file"
|
||||
|
||||
if ! "${pkgs.jenkins}/bin/jenkins-cli" -s "$jenkins_url" -auth "@$auth_file" reload-configuration; then
|
||||
echo "error: failed to reload configuration"
|
||||
exit 1
|
||||
fi
|
||||
'';
|
||||
in
|
||||
''
|
||||
|
|
Loading…
Reference in a new issue