Extended E-mail Notification (Email-ext) Default Pre-Send Script and Script Security...

[Matt Childress]

This is driving me nuts.   Jenkins has been running just fine until during one of the updates in the past month or so something went south.  We're now getting no e-mail and the following error in the Job logs:

Executing pre-send script
Pre-send script tried to access secured objects: classpath entry file:/ (7a4a36093f15af3f79ad37dbe1308c5da1d8bace) not yet approved for use
ERROR: Could not send email as a part of the post-build publishers.
org.jenkinsci.plugins.scriptsecurity.scripts.UnapprovedClasspathException: classpath entry file:/ (7a4a36093f15af3f79ad37dbe1308c5da1d8bace) not yet approved for use

I've gone into the Manage Jenkins->In Process Script Security and nothing is pending approval.   

I've taken the "7aa3609" string (which I'm guessing is a hash) and tried putting it directly into the approvedClasspathEntries in scriptApproval.xml

There is no "groovy sandbox" checkbox near the script as mentioned in similar problems I've seen described on the 'net.

I've started to play with Permissive Script Security Plugin, but would like to avoid that (and the instructions didn't make a lot of sense yet on MacOS).

The script is below.  Is there an easy fix for this?!?

Thanks much!

M@

Pre-send script:

// Load up the first 1000 lines of the log file into a variable

def log = build.getLog(1000)

// Let's setup a boolean of the result of searching for the string that appears

// in the log file when a job successfully completes but no work occurred.

def NothingDone = (log ==~/.*Nothing downloaded, packaged or imported.*/)

assert NothingDone instanceof Boolean

logger.println("** NothingDone is " + NothingDone)

def Error = (log ==~/.*Error.*/)

assert Error instanceof Boolean

logger.println("** Error is " + Error)

def error = (log ==~/.*error.*/)

assert error instanceof Boolean

logger.println("** error is " + error)

// New items were imported into the munki repo

def NewItemsImported = (log ==~/.*new items were imported into Munki.*/)

assert NewItemsImported instanceof Boolean

logger.println("** NewItemsImported is " + NewItemsImported)

// New items were downloaded to the AutoPkg Cache directory

def NewItemsDownloaded = (log ==~/.*new items were downloaded.*/)

assert NewItemsDownloaded instanceof Boolean

logger.println("** NewItemsDownloaded is " + NewItemsDownloaded)

/* The below code is for AutoPkg FAQ #1:

 *

 * Every time I run a recipe it downloads something even if it didn't change. Why?

 *      https://github.com/autopkg/autopkg/wiki/FAQ

 *

 * the IS_TROUBLEMAKER is a per-job environmental variable set using the 

 * Jenkins EnvInject Plugin -- https://wiki.jenkins-ci.org/display/JENKINS/EnvInject+Plugin

 *

 * below is the elvis/ternary operator that does the following:

 * if IS_TROUBLEMAKER is set from the Jenkins job configuration, take that value

 * (it should be true).  If it's not set/doesn't exist, set it to false

 * because we have a lot of existing jobs and only set the IS_TROUBLEMAKER on jobs that

 * ARE troublemakers!

 */

try { 

   // if IS_TROUBLMAKER is set by EnvInject plugin, set known_troublemaker to that value

   // (as it could've been a troublemaker in the past, and set to false when it was

   // fixed

   known_troublemaker = $IS_TROUBLEMAKER 

} catch (MissingPropertyExceptionmpe) { 

   // if we get an error, then it's because $IS_TROUBLEMAKER doesn't exist, so we

   // should set it to false

   

   known_troublemaker = false

   logger.println("** IS_TROUBLEMAKER try failed, caught MissingPropertyExceptionmpe and set known_troublemaker to " + known_troublemaker)

} 

logger.println("** known_troublemaker is " + known_troublemaker)

/* And now let's test against that boolean and kill the e-mail (cancelEmail = true) if it found the

 * -Nothing downloaded, packaged or imported- string  AND it hasn't found a string with Error or error

 */

 

if (NothingDone && !Error && !error) {

// AutoPkg neither downloaded to the AutoPkg Cache nor imported anything to the munki repo, 

// so no e-mail this is the case 99% of the time

logger.println("=== e-mail cancelled: Job completed without errors but nothing was done (nothing downloaded or imported)")

cancel=true

} else if (NewItemsImported) {

// New items were imported into the Munki Repo, send the email.

logger.println("=*=*=*=*=*=*=*=*=*=*=*=* New Item in Munki Repo, E-mail Sent !!!! =*=*=*=*=*=*=*=*=*=*=*=*")

cancel=false

} else if (NewItemsDownloaded && known_troublemaker) {

// logger.println("** AutoPkg downloaded, but not imported to Munki as " + $JOB_NAME + " is a known troublemaker.")

logger.println("=== e-mail cancelled: KNOWN TROUBLEMAKER: AutoPkg downloaded sucessufully (but no import as this version was already in the munki repo")

logger.println("=== See AutoPkg FAQ, item #1 at https://github.com/autopkg/autopkg/wiki/FAQ")

cancel=true

} else { 

    // Send the email, something's run amok

    cancel=false

logger.println('@#$%&!@#$%&!@#$%&!@#$%&!      Ruh Roh!  Something went wrong -- E-mail Sent !!!!! @#$%&!@#$%&!@#$%&!@#$%&!')

}

 

// logger.println("** End of Presend Script and it is " + IS_TROUBLEMAKER + " that " + JOB_NAME + " is a known troublemaker.")

// logger.println("** cancel = " + cancel)

// logger.println("** \n\nlogfile begin ..........\n" + log + "\n\n..........\nlog file end")

[Robert Sandell]

Your script doesn't seem to need a classpath entry, and the classpath entry seems to be an empty string, or just white space?

/B

[Hickel, Kelly]

Then I think you shoul duse build 403.

 

Kelly Hickel Product Development Architect BMC Software phone: 952.345.8677 BMC 5 digit: 58677 fax: 952.345.8721 cell: 651-815-5531 1600 Tower, Suite 450 1600 Utica Av. So. St. Louis Park, MN 55416

 

 

--
You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/2478b64a-d976-41c8-b0d4-419e4c1d00ee%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[fbe...@gmail.com]

Hi Matt,

I had roughly the same problem. It can happen that you've configured "Additional groovy classpath" in Jenkins -> Manage Jenkins -> Configure System -> Extended E-mail Notification; then later you've probably deleted it. But because of a bug the actual delete is not performed, instead the config would still contain at least one element; no matter what you're doing on the GUI at least one entry will be there next to "Additional groovy classpath". In my case I was trying to set it to the empty string. No luck.
As I observed empty string in this context is resolved to the current working directory of the Jenkins' JVM. (In my case the error came for the HOME directory of the running unix user of my jenkins instance. In your case it comes for /).

You can verify if you're struggling with this same buggy behavior if you save your changes on the bottom of the configuration page and then reload it (Manage Jenkins -> Configure System); if you see an entry next to Additional groovy classpath then... Only an Add button should be seen if you don't have classpath entries.

Here's a messy and short groovy script which does the deletion (please note that the path should be already empty):

import java.io.File;
import java.nio.charset.StandardCharsets;

def jenkins = Jenkins.getInstanceOrNull();
def config = new File(jenkins.getRootDir(), "hudson.plugins.emailext.ExtendedEmailPublisher.xml");
def original = config.getText('UTF-8');
println(original);

def changed = original.replace("      <path></path>\n", "").replace("  </defaultClasspath>\n", "").replace("<defaultClasspath>", "<defaultClasspath/>").replace("    <hudson.plugins.emailext.GroovyScriptPath>\n", "").replace("    </hudson.plugins.emailext.GroovyScriptPath>\n", "");
println(changed);

def fos = new FileOutputStream(config);
def OutputStreamWriter writer = new OutputStreamWriter(fos, StandardCharsets.UTF_8);
writer.write(changed, 0, changed.length());

writer.close();

If you do not have access to the script console to run this script, as a workaround you can try to set a nonexisting path to the classpath element. The downside is that you will get WARNs in your build logs about non-existing file...

Good luck,
benz