-
Bug
-
Resolution: Fixed
-
Major
-
Jenkins: 2.377
OS: Linux - 5.4.0-113-generic
---
ace-editor:1.1
analysis-model-api:10.20.0
antisamy-markup-formatter:155.v795fb_8702324
apache-httpcomponents-client-4-api:4.5.13-138.v4e7d9a_7b_a_e61
bootstrap5-api:5.2.1-3
bouncycastle-api:2.26
branch-api:2.1051.v9985666b_f6cc
build-timeout:1.24
caffeine-api:2.9.3-65.v6a_47d0f4d1fe
checks-api:1.8.0
cloudbees-folder:6.795.v3e23d3c6f194
command-launcher:90.v669d7ccb_7c31
commons-lang3-api:3.12.0-36.vd97de6465d5b_
commons-text-api:1.10.0-27.vb_fa_3896786a_7
configuration-as-code:1569.vb_72405b_80249
credentials:1214.v1de940103927
credentials-binding:523.vd859a_4b_122e6
data-tables-api:1.12.1-4
display-url-api:2.3.6
durable-task:501.ve5d4fc08b0be
echarts-api:5.4.0-1
email-ext:2.92
file-operations:1.11
font-awesome-api:6.2.0-3
forensics-api:1.16.0
generic-webhook-trigger:1.85.2
git:4.13.0
git-client:3.13.0
git-parameter:0.9.18
handlebars:3.0.8
html-audio-notifier:0.4
html5-notifier-plugin:1.5
http_request:1.16
instance-identity:116.vf8f487400980
ionicons-api:31.v4757b_6987003
jackson2-api:2.13.4.20221013-295.v8e29ea_354141
jakarta-activation-api:2.0.1-2
jakarta-mail-api:2.0.1-2
javax-activation-api:1.2.0-5
javax-mail-api:1.6.2-8
jaxb:2.3.7-1
jdk-tool:63.v62d2fd4b_4793
job-dsl:1.81
jquery:1.12.4-1
jquery3-api:3.6.1-2
jsch:0.1.55.61.va_e9ee26616e7
junit:1159.v0b_396e1e07dd
locale:204.v2a_f305fe7e9d
mailer:438.v02c7f0a_12fa_4
matrix-auth:3.1.5
matrix-project:785.v06b_7f47b_c631
mina-sshd-api-common:2.9.1-44.v476733c11f82
mina-sshd-api-core:2.9.1-44.v476733c11f82
momentjs:1.1.1
pipeline-build-step:2.18
pipeline-graph-analysis:195.v5812d95a_a_2f9
pipeline-groovy-lib:613.v9c41a_160233f
pipeline-input-step:456.vd8a_957db_5b_e9
pipeline-milestone-step:101.vd572fef9d926
pipeline-model-api:2.2118.v31fd5b_9944b_5
pipeline-model-definition:2.2118.v31fd5b_9944b_5
pipeline-model-extensions:2.2118.v31fd5b_9944b_5
pipeline-rest-api:2.27
pipeline-stage-step:296.v5f6908f017a_5
pipeline-stage-tags-metadata:2.2118.v31fd5b_9944b_5
pipeline-stage-view:2.27
pipeline-utility-steps:2.13.1
plain-credentials:139.ved2b_9cf7587b
plugin-util-api:2.18.0
popper2-api:2.11.6-2
prism-api:1.29.0-1
rebuild:1.34
remote-file:1.23
resource-disposer:0.20
run-condition:1.5
scm-api:621.vda_a_b_055e58f7
script-security:1189.vb_a_b_7c8fd5fde
snakeyaml-api:1.33-90.v80dcb_3814d35
sonar:2.14
ssh-agent:295.v9ca_a_1c7cc3a_a_
ssh-credentials:305.v8f4381501156
sshd:3.249.v2dc2ea_416e33
structs:324.va_f5d6774f3a_d
test-results-analyzer:0.4.0
timestamper:1.21
token-macro:308.v4f2b_ed62b_b_16
trilead-api:2.72.v2a_3236754f73
variant:59.vf075fe829ccb
warnings-ng:9.20.1
windows-slaves:1.8.1
workflow-aggregator:590.v6a_d052e5a_a_b_5
workflow-api:1200.v8005c684b_a_c6
workflow-basic-steps:994.vd57e3ca_46d24
workflow-cps:2803.v1a_f77ffcc773
workflow-durable-task-step:1210.va_1e5d77e122b
workflow-job:1254.v3f64639b_11dd
workflow-multibranch:716.vc692a_e52371b_
workflow-scm-step:400.v6b_89a_1317c9a_
workflow-step-api:639.v6eca_cd8c04a_a_
workflow-support:839.v35e2736cfd5c
ws-cleanup:0.43Jenkins: 2.377 OS: Linux - 5.4.0-113-generic --- ace-editor:1.1 analysis-model-api:10.20.0 antisamy-markup-formatter:155.v795fb_8702324 apache-httpcomponents-client-4-api:4.5.13-138.v4e7d9a_7b_a_e61 bootstrap5-api:5.2.1-3 bouncycastle-api:2.26 branch-api:2.1051.v9985666b_f6cc build-timeout:1.24 caffeine-api:2.9.3-65.v6a_47d0f4d1fe checks-api:1.8.0 cloudbees-folder:6.795.v3e23d3c6f194 command-launcher:90.v669d7ccb_7c31 commons-lang3-api:3.12.0-36.vd97de6465d5b_ commons-text-api:1.10.0-27.vb_fa_3896786a_7 configuration-as-code:1569.vb_72405b_80249 credentials:1214.v1de940103927 credentials-binding:523.vd859a_4b_122e6 data-tables-api:1.12.1-4 display-url-api:2.3.6 durable-task:501.ve5d4fc08b0be echarts-api:5.4.0-1 email-ext:2.92 file-operations:1.11 font-awesome-api:6.2.0-3 forensics-api:1.16.0 generic-webhook-trigger:1.85.2 git:4.13.0 git-client:3.13.0 git-parameter:0.9.18 handlebars:3.0.8 html-audio-notifier:0.4 html5-notifier-plugin:1.5 http_request:1.16 instance-identity:116.vf8f487400980 ionicons-api:31.v4757b_6987003 jackson2-api:2.13.4.20221013-295.v8e29ea_354141 jakarta-activation-api:2.0.1-2 jakarta-mail-api:2.0.1-2 javax-activation-api:1.2.0-5 javax-mail-api:1.6.2-8 jaxb:2.3.7-1 jdk-tool:63.v62d2fd4b_4793 job-dsl:1.81 jquery:1.12.4-1 jquery3-api:3.6.1-2 jsch:0.1.55.61.va_e9ee26616e7 junit:1159.v0b_396e1e07dd locale:204.v2a_f305fe7e9d mailer:438.v02c7f0a_12fa_4 matrix-auth:3.1.5 matrix-project:785.v06b_7f47b_c631 mina-sshd-api-common:2.9.1-44.v476733c11f82 mina-sshd-api-core:2.9.1-44.v476733c11f82 momentjs:1.1.1 pipeline-build-step:2.18 pipeline-graph-analysis:195.v5812d95a_a_2f9 pipeline-groovy-lib:613.v9c41a_160233f pipeline-input-step:456.vd8a_957db_5b_e9 pipeline-milestone-step:101.vd572fef9d926 pipeline-model-api:2.2118.v31fd5b_9944b_5 pipeline-model-definition:2.2118.v31fd5b_9944b_5 pipeline-model-extensions:2.2118.v31fd5b_9944b_5 pipeline-rest-api:2.27 pipeline-stage-step:296.v5f6908f017a_5 pipeline-stage-tags-metadata:2.2118.v31fd5b_9944b_5 pipeline-stage-view:2.27 pipeline-utility-steps:2.13.1 plain-credentials:139.ved2b_9cf7587b plugin-util-api:2.18.0 popper2-api:2.11.6-2 prism-api:1.29.0-1 rebuild:1.34 remote-file:1.23 resource-disposer:0.20 run-condition:1.5 scm-api:621.vda_a_b_055e58f7 script-security:1189.vb_a_b_7c8fd5fde snakeyaml-api:1.33-90.v80dcb_3814d35 sonar:2.14 ssh-agent:295.v9ca_a_1c7cc3a_a_ ssh-credentials:305.v8f4381501156 sshd:3.249.v2dc2ea_416e33 structs:324.va_f5d6774f3a_d test-results-analyzer:0.4.0 timestamper:1.21 token-macro:308.v4f2b_ed62b_b_16 trilead-api:2.72.v2a_3236754f73 variant:59.vf075fe829ccb warnings-ng:9.20.1 windows-slaves:1.8.1 workflow-aggregator:590.v6a_d052e5a_a_b_5 workflow-api:1200.v8005c684b_a_c6 workflow-basic-steps:994.vd57e3ca_46d24 workflow-cps:2803.v1a_f77ffcc773 workflow-durable-task-step:1210.va_1e5d77e122b workflow-job:1254.v3f64639b_11dd workflow-multibranch:716.vc692a_e52371b_ workflow-scm-step:400.v6b_89a_1317c9a_ workflow-step-api:639.v6eca_cd8c04a_a_ workflow-support:839.v35e2736cfd5c ws-cleanup:0.43
-
-
script-security 1244.ve463715a_f89c
After upgrading plugins to the versions specified in Environment, our build jobs started failing with the following error:
java.lang.VerifyError: (class: com/codemanufaktur/rbs/tools/conan/ConanBuildTask, method: <init> signature: (Ljava/util/Map;)V) Unable to pop operand off an empty stack at java.base/java.lang.Class.getDeclaredConstructors0(Native Method) at java.base/java.lang.Class.privateGetDeclaredConstructors(Class.java:3137) at java.base/java.lang.Class.getDeclaredConstructors(Class.java:2357) at org.kohsuke.groovy.sandbox.impl.GroovyCallSiteSelector.constructor(GroovyCallSiteSelector.java:67) at org.kohsuke.groovy.sandbox.impl.GroovyCallSiteSelector.findConstructor(GroovyCallSiteSelector.java:45) at org.kohsuke.groovy.sandbox.impl.Checker.checkedConstructor(Checker.java:223) at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.constructorCall(SandboxInvoker.java:21) at com.codemanufaktur.rbs.tools.conan.ConanBuilder.createTask(ConanBuilder.groovy:87) at com.codemanufaktur.rbs.tools.conan.ConanBuilder.buildTasks(ConanBuilder.groovy:102) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.collect(CpsDefaultGroovyMethods:3287) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.collect(CpsDefaultGroovyMethods:3257) at com.codemanufaktur.rbs.tools.conan.ConanBuilder.buildTasks(ConanBuilder.groovy:102) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.callClosureForMapEntry(CpsDefaultGroovyMethods:5361) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.collectMany(CpsDefaultGroovyMethods:3485) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.collectMany(CpsDefaultGroovyMethods:3506) at com.codemanufaktur.rbs.tools.conan.ConanBuilder.buildTasks(ConanBuilder.groovy:99) at com.codemanufaktur.rbs.tools.conan.ConanBuilder.run(ConanBuilder.groovy:49) at com.codemanufaktur.rbs.pipeline.Pipeline.build(Pipeline.groovy:64) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.each(CpsDefaultGroovyMethods:2125) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.each(CpsDefaultGroovyMethods:2110) at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.each(CpsDefaultGroovyMethods:2151) at com.codemanufaktur.rbs.pipeline.Pipeline.build(Pipeline.groovy:63) at pipelineFactory.call(pipelineFactory.groovy:51) at ___cps.transform___(Native Method) at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl.dispatchOrArg(FunctionCallBlock.java:100) at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl.fixArg(FunctionCallBlock.java:85) at jdk.internal.reflect.GeneratedMethodAccessor317.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.CollectionLiteralBlock$ContinuationImpl.dispatch(CollectionLiteralBlock.java:55) at com.cloudbees.groovy.cps.impl.CollectionLiteralBlock$ContinuationImpl.item(CollectionLiteralBlock.java:45) at jdk.internal.reflect.GeneratedMethodAccessor367.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.PropertyishBlock$ContinuationImpl.get(PropertyishBlock.java:75) at com.cloudbees.groovy.cps.LValueBlock$GetAdapter.receive(LValueBlock.java:30) at com.cloudbees.groovy.cps.impl.PropertyishBlock$ContinuationImpl.fixName(PropertyishBlock.java:65) at jdk.internal.reflect.GeneratedMethodAccessor363.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.ConstantBlock.eval(ConstantBlock.java:21) at com.cloudbees.groovy.cps.Next.step(Next.java:83) at com.cloudbees.groovy.cps.Continuable$1.call(Continuable.java:158) at com.cloudbees.groovy.cps.Continuable$1.call(Continuable.java:152) at org.codehaus.groovy.runtime.GroovyCategorySupport$ThreadCategoryInfo.use(GroovyCategorySupport.java:136) at org.codehaus.groovy.runtime.GroovyCategorySupport.use(GroovyCategorySupport.java:275) at com.cloudbees.groovy.cps.Continuable.run0(Continuable.java:152) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.access$001(SandboxContinuable.java:18) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.run0(SandboxContinuable.java:51) at org.jenkinsci.plugins.workflow.cps.CpsThread.runNextChunk(CpsThread.java:187) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup.java:420) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.access$400(CpsThreadGroup.java:95) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:330) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:294) at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$2.call(CpsVmExecutorService.java:67) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:139) at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:30) at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:70) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at java.base/java.lang.Thread.run(Thread.java:829)
After a downgrade of the following plugins to the following versions, everything started working again.
git:4.12.1 git-client:3.12.1 junit:1156.vcf492e95a_a_b_0 pipeline-groovy-lib:612.v84da_9c54906d script-security:1183.v774b_0b_0a_a_451 workflow-cps:2802.v5ea_628154b_c2
It seems to me that the fix for SECURITY-2824 introduced this problem. I'll try to boil this down to a MCVE, but in the mean time, here is the code in question:
// from class ConanBuilder private ConanBuildTask createTask(String tag, String hostProfile) { new ConanBuildTask( recipe: this.recipe, hostProfile: hostProfile, buildProfile: this.buildProfile, tag: tag, remotes: this.remotes, stageRemote: this.stageRemote, config: this.config ) } private List<ConanBuildTask> buildTasks() { return artefacts?.findAll { tag, _ -> !this.tags || tag in this.tags } .collectMany { tag, profiles -> if (profiles in Collection) { return profiles.collect { profile -> createTask(tag, profile) } } return createTask(tag, profiles) } }
class ConanBuildTask { ConanBuildTask(Map params) { // never reached } }
- links to
[JENKINS-70080] Update breaks compound assignments
kgiloo
added a comment - set Issue to "Major": all of a sudden very damaging and enigmatic I just saw this issue and will look into it. In the meantime, I think you can avoid the issue by expanding all compound assignments to fields in constructors or @NonCPS methods as noted by degelma. For example, this is currently broken:
class Test {
def field
@NonCPS
def method() {
field += ...
}
}
A workaround is to avoid the compound operator:
class Test {
def field
@NonCPS
def method() {
field = field + ...
}
}
Depending on your specific case, another workaround is to perform the assignment in CPS-transformed code (i.e. remove @NonCPS), but this may not work in all cases and is impossible if the assignment happens in a constructor.
A fix for this issue has just been released in Script Security plugin version 1244.ve463715a_f89c.
We have a similar error after the latest update which we could boil down to the following minimal example:
which causes:
Our original error from our script was less speaking and more comparable to the one from lho:
From what we can tell our issue appears to be related to the list append we're doing, namely:
If we replace this with:
the error disappears and the script works as before.
We're not sure what has changed here.