jenkins-infra / docker-jenkins-lts

a docker image containing the latest jenkins lts release and plugins
https://hub.docker.com/r/jenkinsciinfra/jenkins-lts
6 stars 6 forks source link

Verify checksum of plugin installation manager tool before executing #865

Open basil opened 6 months ago

basil commented 6 months ago

https://github.com/jenkins-infra/docker-jenkins-lts/blob/b40a31cf522c11ee13c7a66ec29e13ba14aa9947/bin/update-plugins.sh#L15 downloads the plugin installation manager tool without verifying its checksum as in https://github.com/jenkinsci/docker/pull/1868, meaning that a truncated download or corrupted file could result in an execution failure later on. Better to verify the checksum immediately and fail fast in that case.