Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-74781

Jenkins asking for same script approval even after script is approved with the latest release plugin

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Trivial Trivial
    • script-security-plugin
    • None
    • 1366.vd44b_49a_5c85c

        [JENKINS-74781] Jenkins asking for same script approval even after script is approved with the latest release plugin

        FNU created issue -

        Mark Waite added a comment -

        I'm unable to duplicate the problem as described. You'll need to provide much more information so that others can duplicate the issue. "How to report an issue" describes the type of information needed. Steps that I took while trying to duplicate the issue:

        1. Run the most recent Jenkins weekly release (2.482)
        2. Complete the setup wizard by installing Pipeline plugins and by creating a user account
        3. Create a Pipeline that invokes a groovy method that needs approval. I used
          pipeline {
              agent any
              stages {
                  stage('get script approval') {
                      steps {
                          script {
                              org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval scriptApproval = org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.get()
                          }
                      }
                  }
              }
          }
          
        4. Run the Pipeline and confirm that the job fails because script approval is required
        5. Approve the script from "Manage Jenkins" -> "In-process script approval"
        6. Run the Pipeline and confirm that the job succeeds
        7. Confirm that the script is still approved in "Manage Jenkins" -> "In-process script approval"
        8. Run the Pipeline again and confirm that the job succeeds

        If additional information is not provided, this issue will be closed as "Cannot reproduce".

        Mark Waite added a comment - I'm unable to duplicate the problem as described. You'll need to provide much more information so that others can duplicate the issue. "How to report an issue" describes the type of information needed. Steps that I took while trying to duplicate the issue: Run the most recent Jenkins weekly release (2.482) Complete the setup wizard by installing Pipeline plugins and by creating a user account Create a Pipeline that invokes a groovy method that needs approval. I used pipeline { agent any stages { stage( 'get script approval' ) { steps { script { org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval scriptApproval = org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.get() } } } } } Run the Pipeline and confirm that the job fails because script approval is required Approve the script from "Manage Jenkins" -> "In-process script approval" Run the Pipeline and confirm that the job succeeds Confirm that the script is still approved in "Manage Jenkins" -> "In-process script approval" Run the Pipeline again and confirm that the job succeeds If additional information is not provided, this issue will be closed as "Cannot reproduce".
        Mark Waite made changes -
        Priority Original: Critical [ 2 ] New: Trivial [ 5 ]
        FNU made changes -
        Attachment New: image-2024-10-29-11-04-23-808.png [ 63477 ]

        FNU added a comment -

        Hi Mark,

        Our pipeline scripts were working fine until we updated the plugin to latest version 1366.vd44b_49a_5c85c.

        After updating the plugin we started getting the failure complaining about the script needs to approved as below 

         

        We tried to approve the script multiple times and executed the scripts again. and still was not resolved. (Every time we run we see that JsonSluperClassic  is in both "pending signature approvals" and "Signatures already approved" section, )

        Later on we installed the previous version of the script security plugin and pipeline got executed successfully.  

        We are trying to execute the jenkinsfile from the Bitbucket which uses the groovy.json.JsonSlurperClassic.

         

        Please let me know if you need more information

        FNU added a comment - Hi Mark, Our pipeline scripts were working fine until we updated the plugin to latest version 1366.vd44b_49a_5c85c. After updating the plugin we started getting the failure complaining about the script needs to approved as below    We tried to approve the script multiple times and executed the scripts again. and still was not resolved. (Every time we run we see that JsonSluperClassic  is in both "pending signature approvals" and "Signatures already approved" section, ) Later on we installed the previous version of the script security plugin and pipeline got executed successfully.   We are trying to execute the jenkinsfile from the Bitbucket which uses the groovy.json.JsonSlurperClassic.   Please let me know if you need more information

        Mark Waite added a comment -

        Please let me know if you need more information

        Please provide an example script that shows the failure. Others are much more likely to investigate if there is an example script that shows the issue.

        Mark Waite added a comment - Please let me know if you need more information Please provide an example script that shows the failure. Others are much more likely to investigate if there is an example script that shows the issue.

        FNU added a comment -

        Please find the sample script below.

         

        import groovy.json.JsonSlurperClassic

        pipeline {
            agent any
            stages {
                stage('List Credentials') {
                    steps {
                        script

        {                    input = "[\{\"test\":\"test12\"}

        ]"
                            println(input)
                            def inputJSON = new JsonSlurperClassic().parseText(input)
                            def keys = inputJSON.toSet() as List
                            println(keys)
                            }
                        }
                    }
                }
        }

         

        FNU added a comment - Please find the sample script below.   import groovy.json.JsonSlurperClassic pipeline {     agent any     stages {         stage('List Credentials') {             steps {                 script {                    input = "[\{\"test\":\"test12\"} ]"                     println(input)                     def inputJSON = new JsonSlurperClassic().parseText(input)                     def keys = inputJSON.toSet() as List                     println(keys)                     }                 }             }         } }  

        Mark Waite added a comment - - edited

        Thanks. Using that script, I can see the message the first time when it reports that JSONSlurper requires approval. After approval of that class, then the second run wants approval of a method on the JSONSlurper class. Once I've approved those two items, then no further approvals are required.

        I see no difference whether I use the previous release 1365.v4778ca_84b_de5 or the most recent release 1366.vd44b_49a_5c85c. With both releases, it requires two approvals for the JSONSlurper.parseText(String) method to be approved. Do you see something different?

        I modified your script slightly to be this:

        import groovy.json.JsonSlurperClassic
        
        pipeline {
            agent any
            stages {
                stage('Script approval test') {
                    steps {
                        script {
                            input = '[{"test":"test12"}]'
                            println(input)
                            def inputJSON = new JsonSlurperClassic().parseText(input)
                            def keys = inputJSON.toSet() as List
                            println(keys)
                        }
                    }
                }
            }
        }
        

        Mark Waite added a comment - - edited Thanks. Using that script, I can see the message the first time when it reports that JSONSlurper requires approval. After approval of that class, then the second run wants approval of a method on the JSONSlurper class. Once I've approved those two items, then no further approvals are required. I see no difference whether I use the previous release 1365.v4778ca_84b_de5 or the most recent release 1366.vd44b_49a_5c85c. With both releases, it requires two approvals for the JSONSlurper.parseText(String) method to be approved. Do you see something different? I modified your script slightly to be this: import groovy.json.JsonSlurperClassic pipeline { agent any stages { stage( 'Script approval test' ) { steps { script { input = '[{ "test" : "test12" }]' println(input) def inputJSON = new JsonSlurperClassic().parseText(input) def keys = inputJSON.toSet() as List println(keys) } } } } }
        FNU made changes -
        Attachment New: image-2024-10-29-13-27-08-710.png [ 63480 ]

        FNU added a comment -

        This is the error we were getting in jenkins system console.

        FNU added a comment - This is the error we were getting in jenkins system console.

          Unassigned Unassigned
          prakashshetty1990 FNU
          Votes:
          0 Vote for this issue
          Watchers:
          3 Start watching this issue

            Created:
            Updated: