search

jenkins-infra / repository-permissions-updater

Artifactory permissions synchronization tool and data set
76 stars 1.02k forks source link

Request to Host Appcircle Testing Distribution plugin for jenkins #3955

Open guvenkaranfil opened 1 month ago

guvenkaranfil commented 1 month ago

Repository URL

https://github.com/appcircleio/appcircle-testing-distribution-plugin

New Repository Name

appcircle-testing-distribution-plugin

Description

Appcircle Testing Distribution plugin is a unique way to upload your build artifacts to appcircleio mobile DevOps platform

GitHub users to have commit permission

@guvenkaranfil

Jenkins project users to have release permission

guvenkaranfil appcircle

Issue tracker

GitHub issues

jenkins-cert-app commented 1 month ago

Security audit, information and commands

The security team is auditing all the hosting requests, to ensure a better security by default.

This message informs you that a Jenkins Security Scan was triggered on your repository. It takes ~10 minutes to complete.

Commands The bot will parse all comments, and it will check if any line start with a command. Security team only:
  • /audit-ok => the audit is complete, the hosting can continue :tada:.
  • /audit-skip => the audit is not necessary, the hosting can continue :tada:.
  • /audit-findings => the audit reveals some issues that require corrections :pencil2:.
Anyone:
  • /request-security-scan => the findings from the Jenkins Security Scan were corrected, this command will re-scan your repository :mag:.
  • /audit-review => the findings from the audit were corrected, this command will ping the security team to review the findings :eyes:. It's only applicable when the previous audit required changes.
Only one command can be requested per comment.

(automatically generated message, version: 1.28.6)

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

jenkins-cert-app commented 1 month ago

The Jenkins Security Scan discovered 9 finding(s) :mag:.

Please follow the instructions below for every identified issues:

After addressing the findings through one of the above methods:

Stapler: Missing POST/RequirePOST annotation

You can find detailed information about this finding here.

AppcircleBuilder.java#156 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckMessage connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```
AppcircleBuilder.java#151 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckProfileID connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```
AppcircleBuilder.java#146 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckAppPath connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```
AppcircleBuilder.java#141 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckAccessToken connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```

Stapler: Missing permission check

You can find detailed information about this finding here.

AppcircleBuilder.java#156 ``` Potential missing permission check in DescriptorImpl#doCheckMessage ```
AppcircleBuilder.java#151 ``` Potential missing permission check in DescriptorImpl#doCheckProfileID ```
AppcircleBuilder.java#146 ``` Potential missing permission check in DescriptorImpl#doCheckAppPath ```
AppcircleBuilder.java#141 ``` Potential missing permission check in DescriptorImpl#doCheckAccessToken ```

Jenkins: Plaintext password storage

You can find detailed information about this finding here.

AppcircleBuilder.java#27 ``` Field should be reviewed whether it stores a password and is serialized to disk: accessToken ```
guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 1 month ago

Where do I need to add the Isegal user. I follow the links but could not found any settings for user adding.

guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

lsegal commented 1 month ago

@guvenkaranfil I just logged in, please wait until the next hour to re-check this. Sorry about the delay.

guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

lsegal commented 1 month ago

@guvenkaranfil I think you should be giving commit / release permissions to yourself, not me.

GitHub users to have commit permission

@guvenkaranfil 

Jenkins project users to have release permission

guvenkaranfil
guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 1 month ago

/hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 1 month ago

I've updated the "GitHub users to have commit permission" but still getting the same error. What should I do?

timja commented 1 month ago

That error is not the same, its just issuing warnings about the "Jenkins project users to have release permission" section now

guvenkaranfil commented 1 month ago

I see, Could you please guide me through how can i resolve it. I searched the docs and open the link provided in the comment but I could not understand how can i add it. Thank you so much

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

github-actions[bot] commented 1 month ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 4 weeks ago

/hosting re-check

github-actions[bot] commented 4 weeks ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

guvenkaranfil commented 4 weeks ago

@timja I am sorry but I could not understand it seems same. I logged into accounts that I provided 🤔

MarkEWaite commented 4 weeks ago

@guvenkaranfil as far as I can tell, your request lists a GitHub organization appcircleio that you would like to authorize as a committer to the repository. GitHub organizations are not allowed to be committers to a repository. I believe you need to list GitHub users, not GitHub organizations.

I see in the Jira administration interface that user guvenkaranfil has logged in, though maybe the hosting checker does not like the preceding @ character in the text? The polarion plugin hosting request did not include @ in the username list for the Jenkins user names.

I see in the Jira administration interface that user appcircle has logged in, though maybe the hosting checker does not like the preceding @ character in the text? The polarion plugin hosting request did not include @ in the username list for the Jenkins user names.

github-actions[bot] commented 4 weeks ago

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

github-actions[bot] commented 4 weeks ago

Hello from your friendly Jenkins Hosting Checker

It looks like you have everything in order for your hosting request. A member of the Jenkins hosting team will check over things that I am not able to check(code review, README content, etc) and process the request as quickly as possible. Thank you for your patience.

Hosting team members can host this request with /hosting host

NotMyFault commented 4 weeks ago

Hey,

I took a brief look over your hosting request and have some feedback for you:

guvenkaranfil commented 3 weeks ago

Hey,

  1. I have fixed the linter compile error. Now you should be building with the mvn clean verify package
  2. I do not want to configure a pipeline right away if it possible 🤔 I will be publishing it manually
  3. I deleted the function it was unnecessary.
  4. I removed the initially added dependencies.
guvenkaranfil commented 3 weeks ago

/request-security-scan

jenkins-cert-app commented 3 weeks ago

The Jenkins Security Scan discovered 9 finding(s) :mag:.

Please follow the instructions below for every identified issues:

After addressing the findings through one of the above methods:

Stapler: Missing POST/RequirePOST annotation

You can find detailed information about this finding here.

AppcircleBuilder.java#143 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckMessage connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```
AppcircleBuilder.java#138 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckProfileID connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```
AppcircleBuilder.java#133 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckAppPath connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```
AppcircleBuilder.java#128 ``` Potential CSRF vulnerability: If DescriptorImpl#doCheckAccessToken connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST ```

Stapler: Missing permission check

You can find detailed information about this finding here.

AppcircleBuilder.java#143 ``` Potential missing permission check in DescriptorImpl#doCheckMessage ```
AppcircleBuilder.java#138 ``` Potential missing permission check in DescriptorImpl#doCheckProfileID ```
AppcircleBuilder.java#133 ``` Potential missing permission check in DescriptorImpl#doCheckAppPath ```
AppcircleBuilder.java#128 ``` Potential missing permission check in DescriptorImpl#doCheckAccessToken ```

Jenkins: Plaintext password storage

You can find detailed information about this finding here.

AppcircleBuilder.java#27 ``` Field should be reviewed whether it stores a password and is serialized to disk: accessToken ```
guvenkaranfil commented 3 weeks ago

@NotMyFault Did you find a chance to look the commented fixes 🤔

NotMyFault commented 3 weeks ago

Without addressing the outstanding security issues, we will not perform a secondary screening.

guvenkaranfil commented 3 weeks ago

/request-security-scan

guvenkaranfil commented 3 weeks ago

/request-security-scan

jenkins-cert-app commented 3 weeks ago

The Jenkins Security Scan discovered 3 finding(s) :mag:.

Please follow the instructions below for every identified issues:

After addressing the findings through one of the above methods:

Stapler: Missing permission check

You can find detailed information about this finding here.

AppcircleBuilder.java#151 ``` Potential missing permission check in DescriptorImpl#doCheckMessage ```
AppcircleBuilder.java#145 ``` Potential missing permission check in DescriptorImpl#doCheckProfileID ```
AppcircleBuilder.java#139 ``` Potential missing permission check in DescriptorImpl#doCheckAppPath ```
guvenkaranfil commented 3 weeks ago

/request-security-scan

guvenkaranfil commented 3 weeks ago

Without addressing the outstanding security issues, we will not perform a secondary screening.

Thank you for your comments. I believe I have fixed the security issues that came from scan. Could you please move forward the approval process

jenkins-cert-app commented 3 weeks ago

The Jenkins Security Scan did not find anything dangerous with your plugin, congratulations! :tada:

:bulb: The Security team recommends that you are setting up the scan in your repository by following our guide.

guvenkaranfil commented 3 weeks ago

Are there any other things do I need to do for hosting @NotMyFault

NotMyFault commented 3 weeks ago

Hey,

  1. I do not want to configure a pipeline right away if it possible 🤔 I will be publishing it manually

Without adding a pipeline step, the plugin isn't useful for the majority of Jenkins users, given pipelines and folders are the de facto standard job type people choose when working with source code.

guvenkaranfil commented 2 weeks ago

You want me to add a step into readme for showcasing people who want to use the plugin right 🤔

Or do you mean with "pipeline" for distributing the plugin automatically when a PR merged