* Plugins that interact with Subversion can use {@link DescriptorImpl#createAuthenticationProvider()} * so that it can use the credentials (username, password, etc.) that the user entered for Hudson. * See the javadoc of this method for the precautions you need to take if you run Subversion operations * remotely on slaves. * *
* Because this instance refers to some other classes that are not necessarily
* Java serializable (like {@link #browser}), remotable {@link FileCallable}s all
* need to be declared as static inner classes.
*
* @author Kohsuke Kawaguchi
*/
public class SubversionSCM extends SCM implements Serializable {
/**
* the locations field is used to store all configured SVN locations (with
* their local and remote part). Direct access to this filed should be
* avoided and the getLocations() method should be used instead. This is
* needed to make importing of old hudson-configurations possible as
* getLocations() will check if the modules field has been set and import
* the data.
*
* @since 1.91
*/
private ModuleLocation[] locations = new ModuleLocation[0];
private boolean useUpdate;
private final SubversionRepositoryBrowser browser;
private String excludedRegions;
// No longer in use but left for serialization compatibility.
@Deprecated
private String modules;
/**
* @deprecated as of 1.286
*/
public SubversionSCM(String[] remoteLocations, String[] localLocations,
boolean useUpdate, SubversionRepositoryBrowser browser) {
this(remoteLocations,localLocations, useUpdate, browser, null);
}
public SubversionSCM(String[] remoteLocations, String[] localLocations,
boolean useUpdate, SubversionRepositoryBrowser browser, String excludedRegions) {
List
* Note that the format of the file has changed in 1.180 from simple text file to XML.
*
* @return
* immutable list. Can be empty but never null.
*/
/*package*/ static List
* Use canonical path to avoid SVNKit/symlink problem as described in
* https://wiki.svnkit.com/SVNKit_FAQ
*
* @return null
* if the operation failed. Otherwise the set of local workspace paths
* (relative to the workspace root) that has loaded due to svn:external.
*/
private List
* This method must be executed on the slave where svn operations are performed.
*
* @param authProvider
* The value obtained from {@link DescriptorImpl#createAuthenticationProvider()}.
* If the operation runs on slaves,
* (and properly remoted, if the svn operations run on slaves.)
*/
public static SVNClientManager createSvnClientManager(ISVNAuthenticationProvider authProvider) {
ISVNAuthenticationManager sam = SVNWCUtil.createDefaultAuthenticationManager();
sam.setAuthenticationProvider(authProvider);
return SVNClientManager.newInstance(SVNWCUtil.createDefaultOptions(true),sam);
}
/**
* Creates {@link SVNClientManager} for code running on the master.
*
* CAUTION: this code only works when invoked on master. On slaves, use
* {@link #createSvnClientManager(ISVNAuthenticationProvider)} and get {@link ISVNAuthenticationProvider}
* from the master via remoting.
*/
public static SVNClientManager createSvnClientManager() {
return createSvnClientManager(Hudson.getInstance().getDescriptorByType(DescriptorImpl.class).createAuthenticationProvider());
}
public static final class SvnInfo implements Serializable, Comparable
* {@link Credential} holds data in a persistence-friendly way,
* and it's capable of creating {@link SVNAuthentication} object,
* to be passed to SVNKit.
*/
private static abstract class Credential implements Serializable {
/**
* @param kind
* One of the constants defined in {@link ISVNAuthenticationManager},
* indicating what subype of {@link SVNAuthentication} is expected.
*/
abstract SVNAuthentication createSVNAuthentication(String kind) throws SVNException;
}
/**
* Username/password based authentication.
*/
private static final class PasswordCredential extends Credential {
private final String userName;
private final String password; // scrambled by base64
public PasswordCredential(String userName, String password) {
this.userName = userName;
this.password = Scrambler.scramble(password);
}
@Override
SVNAuthentication createSVNAuthentication(String kind) {
if(kind.equals(ISVNAuthenticationManager.SSH))
return new SVNSSHAuthentication(userName,Scrambler.descramble(password),-1,false);
else
return new SVNPasswordAuthentication(userName,Scrambler.descramble(password),false);
}
}
/**
* Publickey authentication for Subversion over SSH.
*/
private static final class SshPublicKeyCredential extends Credential {
private final String userName;
private final String passphrase; // scrambled by base64
private final String id;
/**
* @param keyFile
* stores SSH private key. The file will be copied.
*/
public SshPublicKeyCredential(String userName, String passphrase, File keyFile) throws SVNException {
this.userName = userName;
this.passphrase = Scrambler.scramble(passphrase);
Random r = new Random();
StringBuilder buf = new StringBuilder();
for(int i=0;i<16;i++)
buf.append(Integer.toHexString(r.nextInt(16)));
this.id = buf.toString();
try {
FileUtils.copyFile(keyFile,getKeyFile());
} catch (IOException e) {
throw new SVNException(SVNErrorMessage.create(SVNErrorCode.AUTHN_CREDS_UNAVAILABLE,"Unable to save private key"),e);
}
}
/**
* Gets the location where the private key will be permanently stored.
*/
private File getKeyFile() {
File dir = new File(Hudson.getInstance().getRootDir(),"subversion-credentials");
if(dir.mkdirs()) {
// make sure the directory exists. if we created it, try to set the permission to 600
// since this is sensitive information
try {
Chmod chmod = new Chmod();
chmod.setProject(new Project());
chmod.setFile(dir);
chmod.setPerm("600");
chmod.execute();
} catch (Throwable e) {
// if we failed to set the permission, that's fine.
LOGGER.log(Level.WARNING, "Failed to set directory permission of "+dir,e);
}
}
return new File(dir,id);
}
@Override
SVNSSHAuthentication createSVNAuthentication(String kind) throws SVNException {
if(kind.equals(ISVNAuthenticationManager.SSH)) {
try {
Channel channel = Channel.current();
String privateKey;
if(channel!=null) {
// remote
privateKey = channel.call(new Callable
* Therefore, to access {@link ISVNAuthenticationProvider}, you need to call this method
* on the master, then pass the object to the slave side, then call
* {@link SubversionSCM#createSvnClientManager(ISVNAuthenticationProvider)} on the slave.
*
* @see SubversionSCM#createSvnClientManager(ISVNAuthenticationProvider)
*/
public ISVNAuthenticationProvider createAuthenticationProvider() {
return new SVNAuthenticationProviderImpl(remotableProvider);
}
/**
* Submits the authentication info.
*
* This code is fairly ugly because of the way SVNKit handles credentials.
*/
// TODO: stapler should do multipart/form-data handling
public void doPostCredential(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
Hudson.getInstance().checkPermission(Hudson.ADMINISTER);
MultipartFormDataParser parser = new MultipartFormDataParser(req);
String url = parser.get("url");
String kind = parser.get("kind");
int idx = Arrays.asList("","password","publickey","certificate").indexOf(kind);
final String username = parser.get("username"+idx);
final String password = parser.get("password"+idx);
// SVNKit wants a key in a file
final File keyFile;
FileItem item=null;
if(idx <= 1) {
keyFile = null;
} else {
item = parser.getFileItem(kind.equals("publickey")?"privateKey":"certificate");
keyFile = File.createTempFile("hudson","key");
if(item!=null) {
try {
item.write(keyFile);
} catch (Exception e) {
throw new IOException2(e);
}
if(PuTTYKey.isPuTTYKeyFile(keyFile)) {
// TODO: we need a passphrase support
LOGGER.info("Converting "+keyFile+" from PuTTY format to OpenSSH format");
new PuTTYKey(keyFile,null).toOpenSSH(keyFile);
}
}
}
// we'll record what credential we are trying here.
StringWriter log = new StringWriter();
final PrintWriter logWriter = new PrintWriter(log);
final boolean[] authenticationAttemped = new boolean[1];
final boolean[] authenticationAcknowled = new boolean[1];
SVNRepository repository = null;
try {
// the way it works with SVNKit is that
// 1) svnkit calls AuthenticationManager asking for a credential.
// this is when we can see the 'realm', which identifies the user domain.
// 2) DefaultSVNAuthenticationManager returns the username and password we set below
// 3) if the authentication is successful, svnkit calls back acknowledgeAuthentication
// (so we store the password info here)
repository = SVNRepositoryFactory.create(SVNURL.parseURIDecoded(url));
repository.setAuthenticationManager(new DefaultSVNAuthenticationManager(SVNWCUtil.getDefaultConfigurationDirectory(),true,username,password,keyFile,password) {
Credential cred = null;
@Override
public SVNAuthentication getFirstAuthentication(String kind, String realm, SVNURL url) throws SVNException {
authenticationAttemped[0] = true;
if(kind.equals(ISVNAuthenticationManager.USERNAME))
// when using svn+ssh, svnkit first asks for ISVNAuthenticationManager.SSH
// authentication to connect via SSH, then calls this method one more time
// to get the user name. Perhaps svn takes user name on its own, separate
// from OS user name? In any case, we need to return the same user name.
// I don't set the cred field here, so that the 1st credential for ssh
// won't get clobbered.
return new SVNUserNameAuthentication(username,false);
if(kind.equals(ISVNAuthenticationManager.PASSWORD)) {
logWriter.println("Passing user name "+username+" and password you entered");
cred = new PasswordCredential(username,password);
}
if(kind.equals(ISVNAuthenticationManager.SSH)) {
if(keyFile==null) {
logWriter.println("Passing user name "+username+" and password you entered to SSH");
cred = new PasswordCredential(username,password);
} else {
logWriter.println("Attempting a public key authentication with username "+username);
cred = new SshPublicKeyCredential(username,password,keyFile);
}
}
if(kind.equals(ISVNAuthenticationManager.SSL)) {
logWriter.println("Attempting an SSL client certificate authentcation");
cred = new SslClientCertificateCredential(keyFile,password);
}
if(cred==null) {
logWriter.println("Unknown authentication method: "+kind);
return null;
}
return cred.createSVNAuthentication(kind);
}
/**
* Getting here means the authentication tried in {@link #getFirstAuthentication(String, String, SVNURL)}
* didn't work.
*/
@Override
public SVNAuthentication getNextAuthentication(String kind, String realm, SVNURL url) throws SVNException {
SVNErrorManager.authenticationFailed("Authentication failed for "+url, null);
return null;
}
@Override
public void acknowledgeAuthentication(boolean accepted, String kind, String realm, SVNErrorMessage errorMessage, SVNAuthentication authentication) throws SVNException {
authenticationAcknowled[0] = true;
if(accepted) {
assert cred!=null;
credentials.put(realm,cred);
save();
} else {
logWriter.println("Failed to authenticate: "+errorMessage);
if(errorMessage.getCause()!=null)
errorMessage.getCause().printStackTrace(logWriter);
}
super.acknowledgeAuthentication(accepted, kind, realm, errorMessage, authentication);
}
});
repository.testConnection();
if(!authenticationAttemped[0]) {
logWriter.println("No authentication was attemped.");
throw new SVNCancelException();
}
if(!authenticationAcknowled[0]) {
logWriter.println("Authentication was not acknowledged.");
throw new SVNCancelException();
}
rsp.sendRedirect("credentialOK");
} catch (SVNException e) {
logWriter.println("FAILED: "+e.getErrorMessage());
req.setAttribute("message",log.toString());
req.setAttribute("pre",true);
req.setAttribute("exception",e);
rsp.forward(Hudson.getInstance(),"error",req);
} finally {
if(keyFile!=null)
keyFile.delete();
if(item!=null)
item.delete();
if (repository != null)
repository.closeSession();
}
}
/**
* validate the value for a remote (repository) location.
*/
public void doSvnRemoteLocationCheck(final StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
// false==No permisison needed for basic check
new FormFieldValidator(req, rsp, false) {
protected void check() throws IOException, ServletException {
// syntax check first
String url = Util.nullify(request.getParameter("value"));
if (url == null) {
ok(); // not entered yet
return;
}
// remove unneeded whitespaces
url = url.trim();
if(!URL_PATTERN.matcher(url).matches()) {
errorWithMarkup("Invalid URL syntax. See "
+ "this "
+ "for information about valid URLs.");
return;
}
// Test the connection only if we have admin permission
if (!Hudson.getInstance().hasPermission(Hudson.ADMINISTER)) {
ok();
} else try {
SVNURL repoURL = SVNURL.parseURIDecoded(url);
if (checkRepositoryPath(repoURL)==SVNNodeKind.NONE) {
SVNRepository repository = null;
try {
repository = getRepository(repoURL);
long rev = repository.getLatestRevision();
// now go back the tree and find if there's anything that exists
String repoPath = getRelativePath(repoURL, repository);
String p = repoPath;
while(p.length()>0) {
p = SVNPathUtil.removeTail(p);
if(repository.checkPath(p,rev)==SVNNodeKind.DIR) {
// found a matching path
List
* Intended to be invoked from Groovy console.
*/
public static void enableSshDebug(Level level) {
if(level==null) level= Level.FINEST; // default
final Level lv = level;
com.trilead.ssh2.log.Logger.enabled=true;
com.trilead.ssh2.log.Logger.logger = new DebugLogger() {
private final Logger LOGGER = Logger.getLogger(SCPClient.class.getPackage().getName());
public void log(int level, String className, String message) {
LOGGER.log(lv,className+' '+message);
}
};
}
}
";
LOGGER.log(Level.INFO, "Failed to access subversion repository "+url,e);
errorWithMarkup(message);
}
}
}.process();
}
public SVNNodeKind checkRepositoryPath(SVNURL repoURL) throws SVNException {
SVNRepository repository = null;
try {
repository = getRepository(repoURL);
repository.testConnection();
long rev = repository.getLatestRevision();
String repoPath = getRelativePath(repoURL, repository);
return repository.checkPath(repoPath, rev);
} finally {
if (repository != null)
repository.closeSession();
}
}
protected SVNRepository getRepository(SVNURL repoURL) throws SVNException {
SVNRepository repository = SVNRepositoryFactory.create(repoURL);
ISVNAuthenticationManager sam = SVNWCUtil.createDefaultAuthenticationManager();
sam = new FilterSVNAuthenticationManager(sam) {
// If there's no time out, the blocking read operation may hang forever, because TCP itself
// has no timeout. So always use some time out. If the underlying implementation gives us some
// value (which may come from ~/.subversion), honor that, as long as it sets some timeout value.
@Override
public int getReadTimeout(SVNRepository repository) {
int r = super.getReadTimeout(repository);
if(r<=0) r = DEFAULT_TIMEOUT;
return r;
}
};
sam.setAuthenticationProvider(createAuthenticationProvider());
repository.setAuthenticationManager(sam);
return repository;
}
public static String getRelativePath(SVNURL repoURL, SVNRepository repository) throws SVNException {
String repoPath = repoURL.getPath().substring(repository.getRepositoryRoot(false).getPath().length());
if(!repoPath.startsWith("/")) repoPath="/"+repoPath;
return repoPath;
}
/**
* validate the value for a local location (local checkout directory).
*/
public void doSvnLocalLocationCheck(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
// false==No permission needed for this syntax check
new FormFieldValidator(req, rsp, false) {
protected void check() throws IOException, ServletException {
String v = Util.nullify(request.getParameter("value"));
if (v == null) {
// local directory is optional so this is ok
ok();
return;
}
v = v.trim();
// check if a absolute path has been supplied
// (the last check with the regex will match windows drives)
if (v.startsWith("/") || v.startsWith("\\") || v.startsWith("..") || v.matches("^[A-Za-z]:")) {
error("absolute path is not allowed");
}
// all tests passed so far
ok();
}
}.process();
}
/**
* Validates the excludeRegions Regex
*/
public void doExcludeRegionsCheck(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
new FormFieldValidator(req,rsp,false) {
protected void check() throws IOException, ServletException {
String v = fixEmptyAndTrim(request.getParameter("value"));
if(v != null) {
String[] regions = v.split("\\r\\n");
for (String region : regions) {
try {
Pattern.compile(region);
}
catch (PatternSyntaxException e) {
error("Invalid regular expression. " + e.getMessage());
}
}
}
ok();
}
}.process();
}
static {
new Initializer();
}
}
public boolean repositoryLocationsExist(AbstractBuild build,
TaskListener listener) throws SVNException {
PrintStream out = listener.getLogger();
for (ModuleLocation l : getLocations(build))
if (getDescriptor().checkRepositoryPath(l.getSVNURL()) == SVNNodeKind.NONE) {
out.println("Location '" + l.remote + "' does not exist");
ParametersAction params = build
.getAction(ParametersAction.class);
if (params != null) {
out.println("Location could be expanded on build '" + build
+ "' parameters values:");
for (ParameterValue paramValue : params) {
out.println(" " + paramValue);
}
}
return false;
}
return true;
}
static final Pattern URL_PATTERN = Pattern.compile("(https?|svn(\\+[a-z0-9]+)?|file)://.+");
private static final long serialVersionUID = 1L;
// noop, but this forces the initializer to run.
public static void init() {}
static {
new Initializer();
}
private static final class Initializer {
static {
if(Boolean.getBoolean("hudson.spool-svn"))
DAVRepositoryFactory.setup(new DefaultHTTPConnectionFactory(null,true,null));
else
DAVRepositoryFactory.setup(); // http, https
SVNRepositoryFactoryImpl.setup(); // svn, svn+xxx
FSRepositoryFactory.setup(); // file
// work around for http://www.nabble.com/Slow-SVN-Checkout-tf4486786.html
if(System.getProperty("svnkit.symlinks")==null)
System.setProperty("svnkit.symlinks","false");
// disable the connection pooling, which causes problems like
// http://www.nabble.com/SSH-connection-problems-p12028339.html
if(System.getProperty("svnkit.ssh2.persistent")==null)
System.setProperty("svnkit.ssh2.persistent","false");
// use SVN1.4 compatible workspace by default.
SVNAdminAreaFactory.setSelector(new SubversionWorkspaceSelector());
}
}
/**
* small structure to store local and remote (repository) location
* information of the repository. As a addition it holds the invalid field
* to make failure messages when doing a checkout possible
*/
public static final class ModuleLocation implements Serializable {
/**
* Subversion URL to check out.
*
* This may include "@NNN" at the end to indicate a fixed revision.
*/
public final String remote;
/**
* Local directory to place the file to.
* Relative to the workspace root.
*/
public final String local;
public ModuleLocation(String remote, String local) {
if(local==null)
local = getLastPathComponent(remote);
this.remote = remote.trim();
this.local = local.trim();
}
/**
* Returns the pure URL portion of {@link #remote} by removing
* possible "@NNN" suffix.
*/
public String getURL() {
int idx = remote.lastIndexOf('@');
if(idx>0) {
try {
String n = remote.substring(idx+1);
Long.parseLong(n);
return remote.substring(0,idx);
} catch (NumberFormatException e) {
// not a revision number
}
}
return remote;
}
/**
* Gets {@link #remote} as {@link SVNURL}.
*/
public SVNURL getSVNURL() throws SVNException {
return SVNURL.parseURIEncoded(getURL());
}
/**
* Figures out which revision to check out.
*
* If {@link #remote} is {@code url@rev}, then this method
* returns that specific revision.
*
* @param defaultValue
* If "@NNN" portion is not in the URL, this value will be returned.
* Normally, this is the SVN revision timestamped at the build date.
*/
public SVNRevision getRevision(SVNRevision defaultValue) {
int idx = remote.lastIndexOf('@');
if(idx>0) {
try {
String n = remote.substring(idx+1);
return SVNRevision.create(Long.parseLong(n));
} catch (NumberFormatException e) {
// not a revision number
}
}
return defaultValue;
}
private String getExpandedRemote(AbstractBuild build) {
String outRemote = remote;
ParametersAction parameters = build.getAction(ParametersAction.class);
if (parameters != null)
outRemote = parameters.substitute(build, remote);
return outRemote;
}
/**
* Expand location value based on Build parametric execution.
*
* @param build
* Build instance for expanding parameters into their values
*
* @return Output ModuleLocation expanded according to Build parameters
* values.
*/
public ModuleLocation getExpandedLocation(AbstractBuild build) {
return new ModuleLocation(getExpandedRemote(build), local);
}
public String toString() {
return remote;
}
private static final long serialVersionUID = 1L;
}
private static final Logger LOGGER = Logger.getLogger(SubversionSCM.class.getName());
/**
* Network timeout in milliseconds.
* The main point of this is to prevent infinite hang, so it should be a rather long value to avoid
* accidental time out problem.
*/
public static int DEFAULT_TIMEOUT = Integer.getInteger(SubversionSCM.class.getName()+".timeout",3600*1000);
/**
* Enables trace logging of Ganymed SSH library.
*