[JIRA] (JENKINS-49699) Doktor plugin affected by JEP-200

[laurent.dufour@ac-montpellier.fr (JIRA)]

Laurent Dufour created an issue

Jenkins / JENKINS-49699 Doktor plugin affected by JEP-200 Issue Type: Bug Assignee: Siarhei Krukau Components: doktor-plugin Created: 2018-02-22 16:52 Environment: debian jessie Labels: JEP-200 Priority: Minor Reporter: Laurent Dufour Doktor plugin is affected by JEP-200 : I use the step doktor and in the log there is this message : java.util.concurrent.ExecutionException: java.lang.SecurityException: Rejected: kotlin.collections.EmptyList; see https://jenkins.io/redirect/class-filter/ and in catalina.out : AVERTISSEMENT: org.jgrapht.DirectedGraph in file:/data/jenkins/plugins/build-flow-plugin/WEB-INF/lib/jgrapht-jdk1.5-0.7.3.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/ févr. 22, 2018 5:44:17 PM jenkins.security.ClassFilterImpl lambda$isBlacklisted$1 AVERTISSEMENT: kotlin.collections.EmptyList in file:/data/jenkins/plugins/doktor/WEB-INF/lib/kotlin-stdlib-1.1.51.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/ Add Comment

This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)

[o.v.nenashev@gmail.com (JIRA)]

Oleg Nenashev commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200 My proposal would be to integrate the plugin with the new Kotlin STL Library plugin and to whitelist the required Kotlin classes on its side

Add Comment

[o.v.nenashev@gmail.com (JIRA)]

Oleg Nenashev commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

The plugin is based on Gradle, so I cannot run PCT against it. It's also hard to say how many Kotlin libs we will need to whitelist in order to make it working. Currently there are 44 installations of the plugin, so for JEP-200 maintainers it has a low priority being compared to other affected plugins. For now I will leave it to Siarhei Krukau, happy to advice if needed.

Add Comment

[siarhei.krukau@gmail.com (JIRA)]

Siarhei Krukau commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

Oleg Nenashev, can you please take a look at this commit and tell whether it will be enough? Thanks a lot!

Add Comment

[o.v.nenashev@gmail.com (JIRA)]

Oleg Nenashev commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

Siarhei Krukau IIUC it won't be enough, the warning also mentions "kotlin.collections.EmptyList". There are testing guidelines here: https://jenkins.io/blog/2018/01/13/jep-200/#testing-plugins-against-jenkins-2-102-and-above Although the section is not applicable to Gradle builds, it may give you some idea how to run autotests (dependency bump generally)

Add Comment

[o.v.nenashev@gmail.com (JIRA)]

Oleg Nenashev commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

Siarhei Krukau Hi, any updates? 2.107.1 lands in public next week, there will be a broader impact on users after that

Add Comment

[siarhei.krukau@gmail.com (JIRA)]

Siarhei Krukau commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

Sorry, not yet. I guess 44 installations are not very critical.

Add Comment

[josephp90@gmail.com (JIRA)]

Joseph Petersen commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

Just released kotlin-v1-stdlib-jdk8 which has the "kotlin.collections.EmptyList" as the initial classFilter Going to suggest a PR at doktor

Add Comment

[siarhei.krukau@gmail.com (JIRA)]

Siarhei Krukau commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

Oleg Nenashev I've tested this change: https://github.com/madhead/doktor/commit/d00e3f24d1b1be92391f3983405b58345b514135 and it seems to be working. I mean, listing those classes in META-INF/hudson.remoting.ClassFilter was enough. I have not seen any warnings about kotlin.collections.EmptyList. Joseph Petersen, Oleg Nenashev I decided not to depend on other plugins. This forces me to use pluginFirstClassLoader is this a bad practice or not? I've seen no issues with it.

Add Comment

[o.v.nenashev@gmail.com (JIRA)]

Oleg Nenashev commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

usage of pluginFirstClassLoader is a really bad practice, because you may corrupt other plugins if they use higher dependency versions. I would advice to use the plugin or shade the libraries

Add Comment

[siarhei.krukau@gmail.com (JIRA)]

Siarhei Krukau commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

I couldn't do that because of AsciidoctorJ library / JRuby runtime that fails, if I am not using this setting. Though, I didn't dig that a lot.

Add Comment

[Christian.Kipping@cgm.com (JIRA)]

Christian Kipping commented on JENKINS-49699

Re: Doktor plugin affected by JEP-200

So it is no longer possible to use this plugin?

Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)