[JENKINS-51820] Removing Java Web Start support #532

jglick · 2022-05-06T17:36:41Z

Preparation for dropping Java 8 support, since we did not support JWS on newer Java versions anyway.

GUI mode (Swing window) removed. This was normally only used in javaws launch mode.
-headless argument made into a no-op.
JAR signature removed, since this was only useful for convincing JWS that it was OK to run the JAR.
- (This also means that we no longer need to use trusted.ci.jenkins.io to release; anyone with push access according to RPU could run MRP, or we could set up CD as we do for some other core components such as Stapler.)
Removing SecurityManager call which printed warnings on Java 17 (superseding Don't set null SecurityManager on Java 17 #531 and thus also Remove setting of null security manager #481 & [JENKINS-67000] Restore setting of null security manager #507) since this was only used to undo what JWS did.

Should only be merged & released if jenkinsci/jenkins#6543 is also approved, as otherwise the GUI would offer an option which no longer works.

jtnord

+1 on the removal of the UI etc.

I am not so sure about the removal of the signing though. this can be used by people to validate the agent.jar that they obtain is indeed correct and has not been tampered with (similar to the way we sign the war files).

jglick · 2022-05-06T21:59:47Z

this can be used by people to validate the agent.jar that they obtain is indeed correct and has not been tampered with

It could but why would you feel the need to do this, if you are downloading the agent from the link on the controller, which you presumably trust already? Or using it from an image published on a trustworthy registry?

(And if someone wanted to “tamper with” the JAR file after you downloaded it, they would merely need to delete the signature—nothing other than javaws would be requiring one. And what if they decided to tamper with plugin JARs, which are unsigned?)

JAR signatures are a 1990s technology. If there is a current threat model we can discuss what that is, and how best to address it with current tools and conventions. I would rather remove something which adds complexity to our build & release process with no clear remaining value, in the same PR which removes the scenario for which that thing was (so far as I know) originally added.

basil

Very nice! The references to hudson.remoting.jnlp.MainDialog and hudson.remoting.jnlp.MainMenu in src/spotbugs/excludeFilter.xml also need to be removed.

basil · 2022-05-07T02:03:24Z

pom.xml

-                    <!-- see http://docs.oracle.com/javase/8/docs/technotes/guides/jweb/security/manifest.html -->
-                    <Permissions>all-permissions</Permissions>
-                    <Codebase>*</Codebase>
-                    <Application-Name>Jenkins Remoting Agent</Application-Name>


Needs at least a corresponding change to org.jenkinsci.plugins.pipeline.utility.steps.conf.mf.ReadManifestStepTest:

hudson.remoting.ProxyException: Assertion failed: assert man.main['Application-Name'] == 'Jenkins Remoting Agent' at org.codehaus.groovy.runtime.InvokerHelper.assertFailed(InvokerHelper.java:420) at org.codehaus.groovy.runtime.ScriptBytecodeAdapter.assertFailed(ScriptBytecodeAdapter.java:663) at com.cloudbees.groovy.cps.impl.AssertBlock$ContinuationImpl.fail(AssertBlock.java:47) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.ConstantBlock.eval(ConstantBlock.java:21) at com.cloudbees.groovy.cps.Next.step(Next.java:83) at com.cloudbees.groovy.cps.Continuable$1.call(Continuable.java:174) at com.cloudbees.groovy.cps.Continuable$1.call(Continuable.java:163) at org.codehaus.groovy.runtime.GroovyCategorySupport$ThreadCategoryInfo.use(GroovyCategorySupport.java:136) at org.codehaus.groovy.runtime.GroovyCategorySupport.use(GroovyCategorySupport.java:275) at com.cloudbees.groovy.cps.Continuable.run0(Continuable.java:163) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.access$001(SandboxContinuable.java:18) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.run0(SandboxContinuable.java:51) at org.jenkinsci.plugins.workflow.cps.CpsThread.runNextChunk(CpsThread.java:187) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup.java:420) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.access$400(CpsThreadGroup.java:95) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:330) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:294) at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$2.call(CpsVmExecutorService.java:67) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:139) at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28) at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at java.base/java.lang.Thread.run(Thread.java:829) Finished: FAILURE

⇒ jenkinsci/pipeline-utility-steps-plugin#143

jeffret-b

I am strongly in favor of this improvement. I tried a couple of times previously to push this removal through, but wasn't able then to overcome the resistance. There really is no reason to continue supporting JWS, especially as we move forward with Java versions.

Similarly there really isn't any value in continuing to sign the jar. The suggestions that it may continue to be useful in some situations never manage to explain the benefit or the scenarios.

The PR looks like it covers all of the necessary bits in Remoting that need to change. As noted various places, there are other related changes in other areas.

I'm approving, contingent on getting a successful build. (I'll be traveling for a while and unable to assist further until afterwards.)

timja · 2022-05-11T13:42:03Z

I guess we can just release this from someones machine given the signature is removed? No need to use release.ci.jenkins.io?

This PR is now ready for merge, after ~24 hours, we will merge it if there's no negative feedback.

Thanks!

jeffret-b · 2022-05-11T14:05:09Z

There should be some announcement somewhere about stopping the signing. Doesn't need to be a big deal, but just somewhere to let people know / point people to. Some people will notice and probably a few will complain.

timja · 2022-05-11T14:37:09Z

Quick blog post before shipping this I guess?

jglick · 2022-05-11T14:44:45Z

announcement somewhere about stopping the signing

Noted in the changelog for jenkinsci/jenkins#6543; do you think we need something more?

we can just release this from someones machine

Someone could, yes, if we prefer not to use trusted.ci or (especially pending jenkins-infra/jenkins-maven-cd-action#14) set up CD.

timja · 2022-05-11T14:46:16Z

Looks fine to me

jeffret-b · 2022-05-11T14:47:37Z

I was thinking something more, but, yes, I think the changelog is sufficient and we don't need to bother with more.

jglick · 2022-05-12T13:44:31Z

@timja what did you to do release Remoting? There are no commits in master after this merge commit, which is tagged with the release version despite being a snapshot. Seems like 4.14 is botched and 4.15 needs to be cut to fix it.

jglick · 2022-05-12T13:45:37Z

The JAR looks OK, but the Git history does not.

timja · 2022-05-12T13:47:48Z

Same as I do for all machine releases.

mvn release:{prepare,perform}

Looking at the log currently but all looks fine

timja · 2022-05-12T13:48:43Z

I'm guessing this repo has some extra config for releasing

timja · 2022-05-12T13:48:58Z

https://github.com/jenkinsci/remoting/blob/master/pom.xml#L332

timja · 2022-05-12T13:51:35Z

The JAR looks OK, but the Git history does not.

fixed

jglick · 2022-05-12T15:40:24Z

OK, https://github.com/jenkinsci/remoting/commits/master looks right now.

Remoting releases from older baselines (like stable-4.13.x) need to deliver a signed jar file for compatibility. This pull request changes the default branch used for remoting releases from release.ci.jenkins.io to use the stable-4.13.x branch instead of the master branch. Remoting development on the remoting master branch no longer requires a signed jar file with the removal of Java Web Start in jenkinsci/remoting#532 The release.ci.jenkins.io job that delivers remoting with signed jars is no longer used for releases of the master branch of the remoting repository. This change should allow us to deliver remoting 4.13.1. Remoting releases from the master branch will continue to use JEP-229 as was done for https://github.com/jenkinsci/remoting/releases/tag/3020.vcc32c3b_cc767

Removing JavaWebStart support

3660af2

jglick changed the title ~~Removing JavaWebStart support~~ Removing Java Web Start support May 6, 2022

jglick mentioned this pull request May 6, 2022

[JENKINS-51820] Removing Java Web Start support jenkinsci/jenkins#6543

Merged

6 tasks

jglick marked this pull request as ready for review May 6, 2022 21:37

jglick added the removed Functionality removed or otherwise cleaned up label May 6, 2022

jglick requested a review from a team May 6, 2022 21:42

jtnord reviewed May 6, 2022

View reviewed changes

jtnord requested a review from a team May 6, 2022 21:49

basil approved these changes May 7, 2022

View reviewed changes

timja approved these changes May 9, 2022

View reviewed changes

offa mentioned this pull request May 9, 2022

Don't set null SecurityManager on Java 17 #531

Closed

6 tasks

@basil noticed orphaned SpotBugs excludes: jenkinsci#532 (review)

a206ff7

jglick mentioned this pull request May 9, 2022

Make ReadManifestStepTest.testRemotingJar pass on post-JWS Remoting jenkinsci/pipeline-utility-steps-plugin#143

Merged

jeffret-b approved these changes May 11, 2022

View reviewed changes

olamy approved these changes May 11, 2022

View reviewed changes

jtnord approved these changes May 11, 2022

View reviewed changes

timja added the ready-to-merge label May 11, 2022

timja mentioned this pull request May 11, 2022

Add core team to remoting jenkins-infra/repository-permissions-updater#2542

Merged

14 tasks

timja removed the ready-to-merge label May 11, 2022

timja added the ready-to-merge label May 11, 2022

jglick changed the title ~~Removing Java Web Start support~~ [JENKINS-51820] Removing Java Web Start support May 11, 2022

timja merged commit 7fb340c into jenkinsci:master May 12, 2022

jglick deleted the no-jws branch May 12, 2022 13:40

timja mentioned this pull request May 12, 2022

Push changes as part of release #536

Merged

basil mentioned this pull request May 17, 2022

Test project configure page jenkinsci/bom#1133

Closed

jglick mentioned this pull request May 18, 2022

Enable CD (JEP-229) #538

Merged

6 tasks

Vlatombe mentioned this pull request May 23, 2022

[JENKINS-68542] [WebSocket] Capture cookie returned by server and reuse for reconnection attempts #539

Merged

6 tasks

MarkEWaite mentioned this pull request May 23, 2022

Release signed remoting from stable-4.13.x branch, not master branch jenkins-infra/release#236

Merged

timja mentioned this pull request Oct 24, 2022

Introduce the JDK8 branch (with cherry-picks and version bumps) jenkinsci/docker-agent#299

Merged

dduportal mentioned this pull request Nov 12, 2022

chore(linux tests) remove deprecated jdk17-only check jenkinsci/docker-agent#317

Merged

6 tasks

basil mentioned this pull request Oct 12, 2023

Remove usage of deprecated -headless argument jenkinsci/docker-inbound-agent#428

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[JENKINS-51820] Removing Java Web Start support #532

[JENKINS-51820] Removing Java Web Start support #532

jglick commented May 6, 2022 •

edited

Loading

jtnord left a comment

jglick commented May 6, 2022

basil left a comment

basil May 7, 2022

jglick May 9, 2022

jeffret-b left a comment

timja commented May 11, 2022

jeffret-b commented May 11, 2022

timja commented May 11, 2022

jglick commented May 11, 2022

timja commented May 11, 2022

jeffret-b commented May 11, 2022

jglick commented May 12, 2022

jglick commented May 12, 2022

timja commented May 12, 2022

timja commented May 12, 2022

timja commented May 12, 2022

timja commented May 12, 2022

jglick commented May 12, 2022

[JENKINS-51820] Removing Java Web Start support #532

[JENKINS-51820] Removing Java Web Start support #532

Conversation

jglick commented May 6, 2022 • edited Loading

jtnord left a comment

Choose a reason for hiding this comment

jglick commented May 6, 2022

basil left a comment

Choose a reason for hiding this comment

basil May 7, 2022

Choose a reason for hiding this comment

jglick May 9, 2022

Choose a reason for hiding this comment

jeffret-b left a comment

Choose a reason for hiding this comment

timja commented May 11, 2022

jeffret-b commented May 11, 2022

timja commented May 11, 2022

jglick commented May 11, 2022

timja commented May 11, 2022

jeffret-b commented May 11, 2022

jglick commented May 12, 2022

jglick commented May 12, 2022

timja commented May 12, 2022

timja commented May 12, 2022

timja commented May 12, 2022

timja commented May 12, 2022

jglick commented May 12, 2022

jglick commented May 6, 2022 •

edited

Loading