[JENKINS-49868] Disable tool installers entirely - Jenkins Jira

Details

Type: Story
Status: Open (View Workflow)
Priority: Minor
Resolution: Unresolved
Component/s: evergreen-plugin
Labels:
None

Similar Issues:

Show
Epic Link:
Automatic Sane Defaults
Sprint:
Evergreen - Milestone 1

Description

This feature is really problematic and requires a bunch of additional work to make it work, such as creating an Oracle account to get JDKs (lol).

Disabling this feature, and strongly encouraging the use of containers is the right path forward for new users

Attachments

Activity

Ascending order - Click to sort in descending order

R. Tyler Croy added a comment - 2018-08-22 16:25

This came up in relation to ~~JENKINS-53190~~ since rsandell was also unable to configure a Maven tool installer:

09:13 ( rsandell ) So, how to build a maven project on evergreen? The tool installer breaks due to
certificate validation and the default docker agent doesn't support docker in docker
09:13 ( rsandell ) for the DinD the agent is basically missing the docker command, and probably some
other stuff to make it work
09:15 ( rsandell ) Tool installer: sun.security.provider.certpath.SunCertPathBuilderException: unable
to find valid certification path to requested target

This error is basically due to how the certificate store is locked down to prevent forgeries of evergreen.jenkins.io's trust chain. A mechanism I'm loathe to change.

I think the ideal solution is to encourage the heavy use of Pipeline and Docker in Evergreen rather than support half-baked features like Tool Installers.

R. Tyler Croy added a comment - 2018-08-22 16:25 This came up in relation to JENKINS-53190 since rsandell was also unable to configure a Maven tool installer: 09:13 ( rsandell ) So, how to build a maven project on evergreen? The tool installer breaks due to certificate validation and the default docker agent doesn't support docker in docker 09:13 ( rsandell ) for the DinD the agent is basically missing the docker command, and probably some other stuff to make it work 09:15 ( rsandell ) Tool installer: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target This error is basically due to how the certificate store is locked down to prevent forgeries of evergreen.jenkins.io's trust chain. A mechanism I'm loathe to change. I think the ideal solution is to encourage the heavy use of Pipeline and Docker in Evergreen rather than support half-baked features like Tool Installers.

Jesse Glick added a comment - 2018-08-22 18:59

creating an Oracle account to get JDKs

jdk-tool should anyway be amended to use anonymous OpenJDK downloads by default. CC dnusbaum

the certificate store is locked down

In the Jenkins JVM? I thought this was only used in the evergreen-client (client.js acc. to code search)? FWIW this seems like it is guaranteed to cause all kinds of mayhem, not just for tool downloads. Surely you can find some better mechanism, such as restricting certificate customizations to the actual code contacting this server.

encourage the heavy use of Pipeline and Docker in Evergreen rather than support half-baked features like Tool Installers

Well, tools and tool installers are supported by Pipeline, and (writing as a principal author of it!) the Pipeline Docker plugin is one of the least baked features in Jenkins and IMO should not be included in Essentials^H^H^H^H^H^H^H^H^H^HEvergreen at all.

At any rate, to the subject of the issue, I certainly agree with the notion that we should discourage use of tools.

Jesse Glick added a comment - 2018-08-22 18:59 creating an Oracle account to get JDKs jdk-tool should anyway be amended to use anonymous OpenJDK downloads by default. CC dnusbaum the certificate store is locked down In the Jenkins JVM? I thought this was only used in the evergreen-client ( client.js acc. to code search)? FWIW this seems like it is guaranteed to cause all kinds of mayhem, not just for tool downloads. Surely you can find some better mechanism, such as restricting certificate customizations to the actual code contacting this server. encourage the heavy use of Pipeline and Docker in Evergreen rather than support half-baked features like Tool Installers Well, tools and tool installers are supported by Pipeline, and (writing as a principal author of it!) the Pipeline Docker plugin is one of the least baked features in Jenkins and IMO should not be included in Essentials^H^H^H^H^H^H^H^H^H^HEvergreen at all. At any rate, to the subject of the issue, I certainly agree with the notion that we should discourage use of tools.

Devin Nusbaum added a comment - 2018-08-22 19:22

jdk-tool should anyway be amended to use anonymous OpenJDK downloads by default. CC Devin Nusbaum

Yes, I think it would make sense to update https://github.com/jenkins-infra/crawler and jdk-tool to use anonymous downloads from http://jdk.java.net/archive/ for Java 9 and newer, and once Java 8 is officially EOL'd by Oracle (currently planned for January 2019) then I think we could totally remove the code that works with Oracle's website and requires an Oracle account to downloads old versions.

Devin Nusbaum added a comment - 2018-08-22 19:22 jdk-tool should anyway be amended to use anonymous OpenJDK downloads by default. CC Devin Nusbaum Yes, I think it would make sense to update https://github.com/jenkins-infra/crawler and jdk-tool to use anonymous downloads from http://jdk.java.net/archive/ for Java 9 and newer, and once Java 8 is officially EOL'd by Oracle (currently planned for January 2019) then I think we could totally remove the code that works with Oracle's website and requires an Oracle account to downloads old versions.

Jenkins

Disable tool installers entirely

Details

Description

Attachments

Activity

People

Dates