Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-44041

Windows authenticated git checkout fails if '(' or ')' in path to workspace

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • Jenkins Server:
      Jenkins ver. 2.58
      git-client-plugin 2.4.5
      git-plugin 3.3.0

      Windows Slave:
      slave.jar (obtained from server/jnlpJars/slave.jar)
      Git-2.12.2.2-64-bit (default install)

      Builds on Windows slave fail reliably at git checkout

      Log:

      Building remotely on Flex slave (flash) in workspace C:\jenkins\workspace\(FLASH)AXA-Module
       > git rev-parse --is-inside-work-tree # timeout=10
      Fetching changes from the remote Git repository
       > git config remote.origin.url git@git.domain.local:flash/axa-flash.git # timeout=10
      Fetching upstream changes from git@git.domain.local:flash/axa-flash.git
       > git --version # timeout=10
      using GIT_SSH to set credentials Jenkins deploy key
       > git fetch --tags --progress git@git.domain.local:flash/axa-flash.git +refs/heads/*:refs/remotes/origin/*
      ERROR: Error fetching remote repo 'origin'
      hudson.plugins.git.GitException: Failed to fetch from git@git.domain.local:flash/axa-flash.git
      	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:809)
      	at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1076)
      	at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1107)
      	at org.jenkinsci.plugins.multiplescms.MultiSCM.checkout(MultiSCM.java:143)
      	at hudson.scm.SCM.checkout(SCM.java:495)
      	at hudson.model.AbstractProject.checkout(AbstractProject.java:1281)
      	at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:604)
      	at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:86)
      	at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:529)
      	at hudson.model.Run.execute(Run.java:1735)
      	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
      	at hudson.model.ResourceController.execute(ResourceController.java:97)
      	at hudson.model.Executor.run(Executor.java:405)
      Caused by: hudson.plugins.git.GitException: Command "git fetch --tags --progress git@git.domain.local:flash/axa-flash.git +refs/heads/*:refs/remotes/origin/*" returned status code 128:
      stdout: 
      stderr: 'C:\jenkins\workspace\' is not recognized as an internal or external command,
      operable program or batch file.
      fatal: Could not read from remote repository.
      
      Please make sure you have the correct access rights
      and the repository exists.
      
      	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1877)
      	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1596)
      	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$300(CliGitAPIImpl.java:71)
      	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:348)
      	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$1.call(RemoteGitImpl.java:153)
      	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$1.call(RemoteGitImpl.java:146)
      	at hudson.remoting.UserRequest.perform(UserRequest.java:153)
      	at hudson.remoting.UserRequest.perform(UserRequest.java:50)
      	at hudson.remoting.Request$2.run(Request.java:336)
      	at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:68)
      	at java.util.concurrent.FutureTask.run(Unknown Source)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
      	at hudson.remoting.Engine$1$1.run(Engine.java:94)
      	at java.lang.Thread.run(Unknown Source)
      	at ......remote call to JNLP4-connect connection from 192.168.100.20/192.168.100.20:59588(Native Method)
      	at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1545)
      	at hudson.remoting.UserResponse.retrieve(UserRequest.java:253)
      	at hudson.remoting.Channel.call(Channel.java:830)
      	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:146)
      	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      	at java.lang.reflect.Method.invoke(Method.java:498)
      	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:132)
      	at com.sun.proxy.$Proxy91.execute(Unknown Source)
      	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:807)
      	... 12 more
      ERROR: null
      [BFA] Scanning build for known causes...
      [BFA] No failure causes found
      [BFA] Done. 0s
      Finished: FAILURE
      

          [JENKINS-44041] Windows authenticated git checkout fails if '(' or ')' in path to workspace

          Mark Waite added a comment - - edited

          fbruzelius thanks for the additional data point. Can you confirm that your failure case is also on Windows as the others are?

          I'll need to run through a series of tests to identify those characters which are allowed in a Windows workspace directory absolute path name, and then revert to using the system temporary directory if the workspace absolute path includes any characters outside the allowed set.

          It's complicated integrating authentication with a command line program. Sorry for all the struggles with this!

          Mark Waite added a comment - - edited fbruzelius thanks for the additional data point. Can you confirm that your failure case is also on Windows as the others are? I'll need to run through a series of tests to identify those characters which are allowed in a Windows workspace directory absolute path name, and then revert to using the system temporary directory if the workspace absolute path includes any characters outside the allowed set. It's complicated integrating authentication with a command line program. Sorry for all the struggles with this!

          Of course. We are using a Debian GNU/Linux master and Windows 7 (x64) agents.

          Fredrik Bruzelius added a comment - Of course. We are using a Debian GNU/Linux master and Windows 7 (x64) agents.

          Hi markewaite, we are observed the same error on Linux agents as well: 

          Obtained Jenkinsfile from 91c49cef39716aff75766ce6ed268d1d7d93bbff
          [Pipeline] node
          Running on HAL 9000 in /var/jenkins/workspace/routing/dev%2Fjenkins-integration
          [Pipeline] {
          [Pipeline] stage
          [Pipeline] { (Declarative: Checkout SCM)
          [Pipeline] checkout
           > git rev-parse --is-inside-work-tree # timeout=10
          Fetching changes from the remote Git repository
           > git config remote.origin.url ssh://git@code.logiball.de/loc/routing.git # timeout=10
          Fetching upstream changes from ssh://git@code.logiball.de/loc/routing.git
           > git --version # timeout=10
          using GIT_SSH to set credentials Test
           > git fetch --tags --progress ssh://git@code.logiball.de/loc/routing.git +refs/heads/*:refs/remotes/origin/*
          ERROR: Error fetching remote repo 'origin'
          hudson.plugins.git.GitException: Failed to fetch from ssh://git@code.logiball.de/loc/routing.git
          	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:809)
          	at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1076)
          	at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1107)
          	at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:109)
          	at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:83)
          	at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:73)
          	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
          	at hudson.security.ACL.impersonate(ACL.java:260)
          	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
          	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
          	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
          	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          	at java.lang.Thread.run(Thread.java:745)
          Caused by: hudson.plugins.git.GitException: Command "git fetch --tags --progress ssh://git@code.logiball.de/loc/routing.git +refs/heads/*:refs/remotes/origin/*" returned status code 128:
          stdout: 
          stderr: percent_expand: unknown key %2
          fatal: Could not read from remote repository.
          
          Please make sure you have the correct access rights
          and the repository exists.
          
          	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1877)
          	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1596)
          	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$300(CliGitAPIImpl.java:71)
          	at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:348)
          	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$1.call(RemoteGitImpl.java:153)
          	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$1.call(RemoteGitImpl.java:146)
          	at hudson.remoting.UserRequest.perform(UserRequest.java:153)
          	at hudson.remoting.UserRequest.perform(UserRequest.java:50)
          	at hudson.remoting.Request$2.run(Request.java:336)
          	at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:68)
          	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
          	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          	at java.lang.Thread.run(Thread.java:745)
          	at ......remote call to HAL 9000(Native Method)
          	at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1545)
          	at hudson.remoting.UserResponse.retrieve(UserRequest.java:253)
          	at hudson.remoting.Channel.call(Channel.java:830)
          	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:146)
          	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
          	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          	at java.lang.reflect.Method.invoke(Method.java:498)
          	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:132)
          	at com.sun.proxy.$Proxy92.execute(Unknown Source)
          	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:807)
          	... 13 more

          Branches - not containing a slash in the name - work without problems. Hopefully this bug can be fixed soon.

          Sven Friedrich added a comment - Hi markewaite , we are observed the same error on Linux agents as well:  Obtained Jenkinsfile from 91c49cef39716aff75766ce6ed268d1d7d93bbff [Pipeline] node Running on HAL 9000 in / var /jenkins/workspace/routing/dev%2Fjenkins-integration [Pipeline] { [Pipeline] stage [Pipeline] { (Declarative: Checkout SCM) [Pipeline] checkout > git rev-parse --is-inside-work-tree # timeout=10 Fetching changes from the remote Git repository > git config remote.origin.url ssh: //git@code.logiball.de/loc/routing.git # timeout=10 Fetching upstream changes from ssh: //git@code.logiball.de/loc/routing.git > git --version # timeout=10 using GIT_SSH to set credentials Test > git fetch --tags --progress ssh: //git@code.logiball.de/loc/routing.git +refs/heads/*:refs/remotes/origin/* ERROR: Error fetching remote repo 'origin' hudson.plugins.git.GitException: Failed to fetch from ssh: //git@code.logiball.de/loc/routing.git at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:809) at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1076) at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1107) at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:109) at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:83) at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:73) at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47) at hudson.security.ACL.impersonate(ACL.java:260) at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang. Thread .run( Thread .java:745) Caused by: hudson.plugins.git.GitException: Command "git fetch --tags --progress ssh: //git@code.logiball.de/loc/routing.git +refs/heads/*:refs/remotes/origin/*" returned status code 128: stdout: stderr: percent_expand: unknown key %2 fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1877) at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1596) at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$300(CliGitAPIImpl.java:71) at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:348) at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$1.call(RemoteGitImpl.java:153) at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$1.call(RemoteGitImpl.java:146) at hudson.remoting.UserRequest.perform(UserRequest.java:153) at hudson.remoting.UserRequest.perform(UserRequest.java:50) at hudson.remoting.Request$2.run(Request.java:336) at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:68) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang. Thread .run( Thread .java:745) at ......remote call to HAL 9000(Native Method) at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1545) at hudson.remoting.UserResponse.retrieve(UserRequest.java:253) at hudson.remoting.Channel.call(Channel.java:830) at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:146) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:132) at com.sun.proxy.$Proxy92.execute(Unknown Source) at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:807) ... 13 more Branches - not containing a slash in the name - work without problems. Hopefully this bug can be fixed soon.

          Mark Waite added a comment - - edited

          sweynson you are seeing a similar symptom with a different root cause. Could you submit a separate bug report which notes that a "%" character embedded in the temporary directory name will cause ssh authentication to fail? The root cause is that ssh has a concept of "percent expansion" (or tokens as they are called in the OpenBSD man page).

          I'll be looking for a way to disable percent expansion. If I can't find that, the system temporary directory will have to be used for those workspaces which include a "%" character, rather than using the temporary directory adjacent to the workspace.

          Mark Waite added a comment - - edited sweynson you are seeing a similar symptom with a different root cause. Could you submit a separate bug report which notes that a "%" character embedded in the temporary directory name will cause ssh authentication to fail? The root cause is that ssh has a concept of " percent expansion " (or tokens as they are called in the OpenBSD man page). I'll be looking for a way to disable percent expansion. If I can't find that, the system temporary directory will have to be used for those workspaces which include a "%" character, rather than using the temporary directory adjacent to the workspace.

          Sure, I created the following issue https://issues.jenkins-ci.org/browse/JENKINS-44127 Thanks in advance for your effort, markewaite 

          Sven Friedrich added a comment - Sure, I created the following issue  https://issues.jenkins-ci.org/browse/JENKINS-44127  Thanks in advance for your effort, markewaite  

          Mark Waite added a comment -

          I've created a pull request which includes a fix for this. The pull request build is available for test now. Could you test it within the next few days and report results?

          I'd like to release either Saturday 20 May 2017 or Tuesday 23 May 2017.

          Mark Waite added a comment - I've created a pull request which includes a fix for this. The pull request build is available for test now. Could you test it within the next few days and report results? I'd like to release either Saturday 20 May 2017 or Tuesday 23 May 2017.

          The patched version seems to resolve the issue I had with forward slashes in branch names on a multibranch pipeline performing "checkout scm", and I did not experience any problems with parentheses or percent symbols either. Agent is a Windows 7 machine.

          Fredrik Bruzelius added a comment - The patched version seems to resolve the issue I had with forward slashes in branch names on a multibranch pipeline performing "checkout scm", and I did not experience any problems with parentheses or percent symbols either. Agent is a Windows 7 machine.

          Code changed in jenkins
          User: Mark Waite
          Path:
          src/test/java/org/jenkinsci/plugins/gitclient/CredentialsTest.java
          http://jenkins-ci.org/commit/git-client-plugin/5c74414a6ef50488e9006d83f127a69b6a7b8da0
          Log:
          Test special characters in credentials workspace path

          JENKINS-44041 - Windows authenticated git checkout fails if '(' or ')' in path to workspace
          JENKINS-43931 - Windows authenticated git checkout fails if ' ' in path to workspace
          JENKINS-44127 - Authenticated git checkout fails if '%' in path to workspace (Windows & Linux)

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Mark Waite Path: src/test/java/org/jenkinsci/plugins/gitclient/CredentialsTest.java http://jenkins-ci.org/commit/git-client-plugin/5c74414a6ef50488e9006d83f127a69b6a7b8da0 Log: Test special characters in credentials workspace path JENKINS-44041 - Windows authenticated git checkout fails if '(' or ')' in path to workspace JENKINS-43931 - Windows authenticated git checkout fails if ' ' in path to workspace JENKINS-44127 - Authenticated git checkout fails if '%' in path to workspace (Windows & Linux)

          Code changed in jenkins
          User: Mark Waite
          Path:
          src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
          http://jenkins-ci.org/commit/git-client-plugin/8a2ddf222f4463e2458e387121bf8d4c7840c37a
          Log:
          Fix special characters bugs in credentials workspace path

          JENKINS-44041 - Windows authenticated git checkout fails if '(' or ')' in path to workspace
          JENKINS-43931 - Windows authenticated git checkout fails if ' ' in path to workspace
          JENKINS-44127 - Authenticated git checkout fails if '%' in path to workspace (Windows & Linux)

          Also safeguards against use for "`" (grave) in a workspace path.
          Jenkins already guards against that, but the added safety check is low
          cost and passes the credentials tests.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Mark Waite Path: src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java http://jenkins-ci.org/commit/git-client-plugin/8a2ddf222f4463e2458e387121bf8d4c7840c37a Log: Fix special characters bugs in credentials workspace path JENKINS-44041 - Windows authenticated git checkout fails if '(' or ')' in path to workspace JENKINS-43931 - Windows authenticated git checkout fails if ' ' in path to workspace JENKINS-44127 - Authenticated git checkout fails if '%' in path to workspace (Windows & Linux) Also safeguards against use for "`" (grave) in a workspace path. Jenkins already guards against that, but the added safety check is low cost and passes the credentials tests.

          Mark Waite added a comment -

          Fixed in git client plugin 2.4.6 released 24 May 2017

          Mark Waite added a comment - Fixed in git client plugin 2.4.6 released 24 May 2017

            markewaite Mark Waite
            packeteer Andrew Zed
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: