Unable to release, unable to access my account

[Anna Karjakina]

Hi folks,

I'm afraid there's something wrong with my account and I need your help. 

We have a plugin release scheduled for today, but when I tried doing the regular "mvn release:prepare release:perform", it showed "[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin ... 401 Unauthorized -> [Help 1]".

I checked, and I could not log in to https://repo.jenkins-ci.org/ui/login/ with my usual credentials ("Login has failed. Due to Incorrect username/password or locked user.").

Trying "Forgot Password?" to reset it also failed, saying that the user is not allowed to reset their password.

Now, I wanted to try to figure out if my account is there, but accounts.jenkins.io give me... 404. Did I miss anything? Did we change the way authentication works? 

And when I tried logging in at https://issues.jenkins.io/secure/Dashboard.jspa, it just endlessly asks me to enter the captcha.

I know that it used to work just a couple of months ago... Is it just me, or we had a major update? Is there anything that can be done to help?

[Gavin Mogan]

security team has taken down accounts.jenkins.io and beta.accounts.jenkins.io as they are java apps until they have a chance to look at the log4j exploit in them.

As for your password, it was reset early September because of the confluence hack - https://www.jenkins.io/blog/2021/09/04/wiki-attacked/

Sadly, because of this perfect storm, your a little out of luck to reset your password till things are investigated and brought back up.

Gavin

--
You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/3e522ed2-10e4-44de-85ab-0416ddc0fcbcn%40googlegroups.com.

[Anna Karjakina]

Thanks Gavin! That's my fault for not resetting the password on time.

Oh well, and that log4jshell one messed up a lot of things for us today, too.

I hope the investigation goes well, it seems that JREs should default trustURLCodebase to false everywhere.

Thanks for the info, as always!

Thanks,

Anna.

[Jesse Glick]

As an alternative, you can consider https://www.jenkins.io/doc/developer/publishing/releasing-cd/ which does not require you to have any credentials beyond GitHub write access to the plugin.