Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-69507

JGit fails 2nd and later https fetch with embedded username & password

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • git-client-plugin
    • None
    • Jenkins 2.346.3
      Git client plugin 3.11.2 and git client plugin 3.12.0-pre-release

      The git client plugin accepts an https URL with the username and password embedded in the repository URL. For example https://MarkEWaite:access-token-or-password@gitlab.com/MarkEWaite/tasks.git is accepted as a valid URL The repository clones as expected with command line git across all the versions that I've tested (anything command line git 1.8 and newer) and on both Windows and Unix operating systems. The repository clones on the first creation of a new workspace with JGit, but then fails to clone on later updates of an existing workspace.

      If I delete the workspace, JGit will clone into the workspace when creating the new workspace, but will then fail when updating the workspace.. Failure is seen with JGit 5.13.0 (git client plugin 3.11.2) and JGit 5.13.1 (git client plugin 3.12.0), JGit 6.4.0 (git client plugin 4.0.0), and is expected to be visible in JGit 6.5.0 (git client plugin 4.1.0).

      Issue is likely a bug in the git client plugin, not any fault of JGit.

      Expected result

      JGit updates of existing repositories should succeed in the same cases where command line git updates of the repository succeed

      Actual result

      JGit updates of existing repositories fail when the username and password are embedded in the https URL of the repository.

      Workarounds

      1. Use the Jenkins credentials system to store the username and password, then reference that credential in the job definition. Usernames and passwords embedded in a repository URL are displayed in the Jenkins console log by default, while they are not displayed when using Jenkins credentials
      2. Use command line git instead of JGit for those cases where an embedded username and password are required.
      3. Delete the workspace before the build starts (Pipeline cleanWS or freestyle with the workspace cleanup plugin "Delete workspace before build starts"
      4. Delete the workspace before the fetch starts in a freestyle job with the git plugin option "Wipe out repository & force clone"

      Console log on failure

      The console log when the failure happens:

      > JGit fetch # timeout=11
ERROR: Error fetching remote repo 'origin'
hudson.plugins.git.GitException: Failed to fetch from https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git
	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1003)
	at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1244)
	at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1308)
	at hudson.scm.SCM.checkout(SCM.java:540)
	at hudson.model.AbstractProject.checkout(AbstractProject.java:1239)
	at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:647)
	at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)
	at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:519)
	at hudson.model.Run.execute(Run.java:1899)
	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)
	at hudson.model.ResourceController.execute(ResourceController.java:107)
	at hudson.model.Executor.run(Executor.java:449)
Caused by: hudson.plugins.git.GitException: org.eclipse.jgit.api.errors.TransportException: https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git: not authorized
	at org.jenkinsci.plugins.gitclient.JGitAPIImpl$2.execute(JGitAPIImpl.java:670)
	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:158)
	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:151)
	at hudson.remoting.UserRequest.perform(UserRequest.java:211)
	at hudson.remoting.UserRequest.perform(UserRequest.java:54)
	at hudson.remoting.Request$2.run(Request.java:376)
	at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:78)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:829)
	Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to rhel-8-a-jagent
		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1784)
		at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:356)
		at hudson.remoting.Channel.call(Channel.java:1000)
		at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:143)
		at jdk.internal.reflect.GeneratedMethodAccessor415.invoke(Unknown Source)
		at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
		at java.base/java.lang.reflect.Method.invoke(Method.java:566)
		at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:129)
		at com.sun.proxy.$Proxy160.execute(Unknown Source)
		at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1001)
		at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1244)
		at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1308)
		at hudson.scm.SCM.checkout(SCM.java:540)
		at hudson.model.AbstractProject.checkout(AbstractProject.java:1239)
		at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:647)
		at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)
		at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:519)
		at hudson.model.Run.execute(Run.java:1899)
		at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)
		at hudson.model.ResourceController.execute(ResourceController.java:107)
		at hudson.model.Executor.run(Executor.java:449)
Caused by: org.eclipse.jgit.api.errors.TransportException: https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git: not authorized
	at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:224)
	at org.jenkinsci.plugins.gitclient.JGitAPIImpl$2.execute(JGitAPIImpl.java:668)
	... 10 more
Caused by: org.eclipse.jgit.errors.TransportException: https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git: not authorized
	at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:685)
	at org.eclipse.jgit.transport.TransportHttp.openFetch(TransportHttp.java:465)
	at org.eclipse.jgit.transport.FetchProcess.executeImp(FetchProcess.java:142)
	at org.eclipse.jgit.transport.FetchProcess.execute(FetchProcess.java:94)
	at org.eclipse.jgit.transport.Transport.fetch(Transport.java:1309)
	at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:213)
	... 11 more
ERROR: Error fetching remote repo 'origin'

            Unassigned Unassigned
            markewaite Mark Waite
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: