A critical security vulnerability has been identified in the popular "Apache Log4j 2" library. This vulnerability is identified as CVE-2021-44228. Log4j in Jenkins The Jenkins security team has confirmed that Log4j is not used in Jenkins core. Jenkins plugins may be using Log4j. You can identify whether Log4j is included with any plugin by running the following Groovy script in the Script Console: org.apache.logging.log4j.core.lookup.JndiLookup.class.protectionDomain.codeSource If this results in the following error,...

Earlier this week the Jenkins infrastructure team identified a successful attack against our deprecated Confluence service. We responded immediately by taking the affected server offline while we investigated the potential impact. At this time we have no reason to believe that any Jenkins releases, plugins, or source code have been affected. Thus far in our investigation, we have learned that the Confluence CVE-2021-26084 exploit was used to...

The Jenkins project has used Jira to track issues for many years. Jenkins core, Jenkins modules, Jenkins infrastructure, and many Jenkins plugins manage their issue reports with our Jira server. Jira helps the Jenkins project manage issues and tasks related to over 250 000 Jenkins installations. It tracks bugs, enhancement requests, tasks, and security issues. It is used regularly by users around the world. We’re grateful for the long-standing contribution...

Table of Contents Context The Problems The Solution Shared Library Duplication Documentation Scalability Installation Agnostic Feature Toggling This post will describe how I use a shared library in Jenkins. Typically when using multibranch pipeline. If possible (if not forced to) I implement the pipelines without multibranch. I previously wrote about how I do that with my Generic Webhook Trigger Plugin in a previous post. But this will be my second choice, If I am not...

The Jenkins project relies heavily on its infrastructure. We use websites like www.jenkins.io and plugins.jenkins.io, ticketing systems like issues.jenkins.io , CI/CD infrastructure like ci.jenkins.io , and many other services. Just to provide some context about the Jenkins infrastructure scale, here are some stats from April 2020: Over 600 000 people visited www.jenkins.io Over 250 000 Jenkins servers regularly checked the Jenkins package server and the Jenkins update server Over 43...

Next week Olivier Vernin from CloudBees and Brian Benz from Microsoft will be presenting a session at DevOps World | Jenkins World about how Microsoft has been working with Jenkins to build Jenkins plugins and produce Jenkins on Microsoft Azure. These plugins run Jenkins on Azure Linux and Windows VMs, Kubernetes, azure App service, as well as deploy artifacts to those Azure platforms and more. All...

Jenkins infrastructure is continuously improving. The latest service to get some attention and major improvement is the Jenkins javadoc. There were a number of issues affecting that service: Irregular updates - Developers wouldn’t find the latest java documentation because of inadequate update frequence. Broken HTTPS support - when users would go to the Javadoc site they would get an unsafe site warning and then an incorrect redirection. Obsolete content - Javadoc...

I am pleased to announce that we have partnered with Microsoft to migrate and power the Jenkins project’s infrastructure with Microsoft Azure. The partnership comes at an important time, after the recent launch of Jenkins 2.0, Jenkins users are more readily adopting Pipeline as Code and many other plugins at an increasing rate, elevating the importance of Jenkins infrastructure to the overall success of the project. That strong and continued growth...

I recently wrote about the two day outage of our wiki and issue tracker: While this was a rather lengthy outage, it could have been much worse. We lost none of the data, after all. OSUOSL have since published their post mortem. I was really wrong about not losing any data: A further complication was that our backups were pointed at mysql2, which was out-of-date with mysql1,...

As you may have noticed, our wiki and issue tracker were unavailable from Thursday to Sunday last week. What happened? We host parts of our infrastructure at the Open Source Lab at Oregon State (OSUOSL), including the databases for these two services. So far, there’s no post mortem by OSUOSL (they expect to post one later this week), so we need to piece together what...