jfrog / jenkins-jfrog-plugin

Easy integration between Jenkins and the JFrog Platform.
https://github.com/jfrog/jenkins-jfrog-plugin
Apache License 2.0
39 stars 17 forks source link

Slim down plugin #61

Closed basil closed 1 year ago

basil commented 1 year ago

This plugin is unnecessarily large in footprint: it bundles a large number of plugins that are either provided by core (and therefore loaded from core rather than this plugin's WEB-INF/lib directory) or library Jenkins plugins. For example, core bundles symbol-annotation already. See this page for more information. This PR implements dynamic linking and slims down this plugin's footprint:

[INFO] --- hpi:3.38:hpi (default-hpi) @ jfrog ---
[INFO] Generating /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog/META-INF/MANIFEST.MF
[INFO] Checking for attached .jar artifact ...
[INFO] Generating jar /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog.jar
[INFO] Building jar: /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog.jar
[INFO] Exploding webapp...
[INFO] Copy webapp webResources to /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog
[INFO] Assembling webapp jfrog in /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog
[INFO] Bundling direct dependency build-info-api-2.37.2.jar
[INFO] Bundling direct dependency build-info-client-2.37.2.jar
[INFO] Bundling direct dependency build-info-extractor-2.37.2.jar
[INFO] Bundling direct dependency file-specs-java-1.1.1.jar
[INFO] Generating hpi /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog.hpi
[INFO] Building jar: /home/basil/src/jenkinsci/jfrog-plugin/target/jfrog.hpi
github-actions[bot] commented 1 year ago

What is Frogbot?

SEVERITY DIRECT DEPENDENCIES DIRECT DEPENDENCIES VERSIONS IMPACTED DEPENDENCY NAME IMPACTED DEPENDENCY VERSION FIXED VERSIONS CVE

High
org.jenkins-ci.plugins:jackson2-api 2.13.3-285.vc03c0256d517 com.fasterxml.jackson.core:jackson-databind 2.13.3 [2.12.7.1]
[2.13.4]
CVE-2022-42004

High
org.jenkins-ci.plugins:jackson2-api 2.13.3-285.vc03c0256d517 com.fasterxml.jackson.core:jackson-databind 2.13.3 [2.12.7.2]
[2.13.4.1]
[2.14.0]
CVE-2022-42003
github-actions[bot] commented 1 year ago

What is Frogbot?