Merge branch 'master' into JENKINS-71578

.github/dependabot.yml

@@ -58,7 +58,7 @@ updates:
         versions: [">=7.0.0"]
   - package-ecosystem: "maven"
     directory: "/"
-    target-branch: "stable-2.401"
+    target-branch: "stable-2.414"
     labels:
       - "into-lts"
       - "needs-justification"

.github/workflows/announce-lts-rc.yml

@@ -0,0 +1,30 @@
+name: Announce LTS RCs
+
+on:
+  release:
+    types: [prereleased]
+
+jobs:
+  post:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post on Discourse
+        uses: roots/discourse-topic-github-release-action@fc9e50fa1a1ce6255ba4d03f104382845b79ad5f # v1.0.0
+        with:
+          discourse-api-key: ${{ secrets.DISCOURSE_RELEASES_API_KEY }}
+          discourse-base-url: https://community.jenkins.io/
+          discourse-author-username: jenkins-release-bot
+          discourse-category: 23
+      - name: Post on mailing list
+        uses: dawidd6/action-send-mail@v3
+        with:
+          server_address: smtp.gmail.com
+          server_port: 465
+          username: ${{secrets.MAIL_USERNAME}}
+          password: ${{secrets.MAIL_PASSWORD}}
+          secure: true
+          subject: ${{ github.event.release.tag_name }} has been released
+          to: [email protected]
+          from: Jenkins Release Bot
+          html_body: ${{ github.event.release.body }}
+          convert_markdown: true

.github/workflows/label-lts-prs.yaml

@@ -0,0 +1,23 @@
+name: Label PRs targeting LTS branches
+
+on: [pull_request_target]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if PR targets LTS branch
+        if: startsWith(github.event.pull_request.base.ref, 'stable-')
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.rest.issues.addLabels({
+              owner: context.payload.repository.owner.login,
+              repo: context.payload.repository.name,
+              issue_number: context.payload.pull_request.number,
+              labels: ['into-lts']
+            });

.gitpod/Dockerfile

@@ -1,6 +1,6 @@
 FROM gitpod/workspace-full
 
-ARG MAVEN_VERSION=3.9.3
+ARG MAVEN_VERSION=3.9.4
 
 RUN brew install gh && \
     bash -c ". /home/gitpod/.sdkman/bin/sdkman-init.sh && sdk install maven ${MAVEN_VERSION} && sdk default maven ${MAVEN_VERSION}"

Jenkinsfile

@@ -14,7 +14,7 @@ properties([
 
 def axes = [
   platforms: ['linux', 'windows'],
-  jdks: [11, 17, 19],
+  jdks: [11, 17, 21],
 ]
 
 stage('Record build') {

ath.sh

@@ -6,7 +6,7 @@ set -o xtrace
 cd "$(dirname "$0")"
 
 # https://github.com/jenkinsci/acceptance-test-harness/releases
-export ATH_VERSION=5659.v28d85a_47a_73a_
+export ATH_VERSION=5699.v27deb_ef5796c
 
 if [[ $# -eq 0 ]]; then
 	export JDK=17

bom/pom.xml

@@ -64,7 +64,7 @@ THE SOFTWARE.
         <!-- https://docs.spring.io/spring-security/site/docs/5.5.4/reference/html5/#getting-maven-no-boot -->
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-bom</artifactId>
-        <version>5.8.4</version>
+        <version>5.8.5</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -82,7 +82,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
-        <version>32.1.1-jre</version>
+        <version>32.1.2-jre</version>
       </dependency>
       <dependency>
         <!-- Overriding Stapler’s 1.1.3 version to diagnose JENKINS-20618: -->

core/pom.xml

@@ -654,7 +654,7 @@ THE SOFTWARE.
         <!-- Version specified in grandparent POM -->
         <configuration>
           <!-- Make sure to keep the directives in test/pom.xml and war/pom.xml in sync with these. -->
-          <argLine>@{jacocoSurefireArgs} --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.desktop/com.sun.beans.introspect=ALL-UNNAMED</argLine>
+          <argLine>@{jacocoSurefireArgs} --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED</argLine>
           <reuseForks>false</reuseForks>
         </configuration>
       </plugin>

core/src/main/java/hudson/AbstractMarkupText.java

@@ -83,7 +83,7 @@ public final int length() {
      * @since 1.349
      */
     public void addHyperlink(int startPos, int endPos, String url) {
-        addMarkup(startPos, endPos, "<a href='" + url + "'>", "</a>");
+        addMarkup(startPos, endPos, "<a href='" + Functions.htmlAttributeEscape(url) + "'>", "</a>");
     }
 
     /**
@@ -93,7 +93,7 @@ public void addHyperlink(int startPos, int endPos, String url) {
      * @since 1.395
      */
     public void addHyperlinkLowKey(int startPos, int endPos, String url) {
-        addMarkup(startPos, endPos, "<a class='lowkey' href='" + url + "'>", "</a>");
+        addMarkup(startPos, endPos, "<a class='lowkey' href='" + Functions.htmlAttributeEscape(url) + "'>", "</a>");
     }
 
     /**

core/src/main/java/hudson/TcpSlaveAgentListener.java

@@ -314,6 +314,7 @@ private void respondHello(String header, Socket s) throws IOException {
                 if (header.startsWith("GET / ")) {
                     response = "HTTP/1.0 200 OK\r\n" +
                             "Content-Type: text/plain;charset=UTF-8\r\n" +
+                            "X-Content-Type-Options: nosniff\r\n" +
                             "\r\n" +
                             "Jenkins-Agent-Protocols: " + getAgentProtocolNames() + "\r\n" +
                             "Jenkins-Version: " + Jenkins.VERSION + "\r\n" +

core/src/main/java/hudson/Util.java

@@ -1927,4 +1927,29 @@ public static long daysElapsedSince(@NonNull Date date) {
     private static PathRemover newPathRemover(@NonNull PathRemover.PathChecker pathChecker) {
         return PathRemover.newFilteredRobustRemover(pathChecker, DELETION_RETRIES, GC_AFTER_FAILED_DELETE, WAIT_BETWEEN_DELETION_RETRIES);
     }
+
+    /**
+     * Returns SHA-256 Digest of input bytes
+     */
+    @Restricted(NoExternalUse.class)
+    public static byte[] getSHA256DigestOf(@NonNull byte[] input) {
+        try {
+                MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
+                messageDigest.update(input);
+                return messageDigest.digest();
+        } catch (NoSuchAlgorithmException noSuchAlgorithmException) {
+            throw new IllegalStateException("SHA-256 could not be instantiated, but is required to" +
+                    " be implemented by the language specification", noSuchAlgorithmException);
+        }
+    }
+
+    /**
+     * Returns Hex string of SHA-256 Digest of passed input
+     */
+    @Restricted(NoExternalUse.class)
+    public static String getHexOfSHA256DigestOf(byte[] input) throws IOException {
+        //get hex string of sha 256 of payload
+        byte[] payloadDigest = Util.getSHA256DigestOf(input);
+        return (payloadDigest != null) ? Util.toHexString(payloadDigest) : null;
+    }
 }

core/src/main/java/hudson/model/DirectoryBrowserSupport.java

@@ -869,5 +869,5 @@ private static OpenOption[] getOpenOptions() {
     private static final Logger LOGGER = Logger.getLogger(DirectoryBrowserSupport.class.getName());
 
     @Restricted(NoExternalUse.class)
-    public static final String DEFAULT_CSP_VALUE = "sandbox; default-src 'none'; img-src 'self'; style-src 'self';";
+    public static final String DEFAULT_CSP_VALUE = "sandbox allow-same-origin; default-src 'none'; img-src 'self'; style-src 'self';";
 }

core/src/main/java/hudson/model/ManageJenkinsAction.java

@@ -79,13 +79,13 @@ public ContextMenu doContextMenu(StaplerRequest request, StaplerResponse respons
      * menu.
      */
     @Restricted(NoExternalUse.class)
-    public void addContextMenuItem(ContextMenu menu, String url, String icon, String iconXml, String text, boolean post, boolean requiresConfirmation, Badge badge) {
+    public void addContextMenuItem(ContextMenu menu, String url, String icon, String iconXml, String text, boolean post, boolean requiresConfirmation, Badge badge, String message) {
         if (Stapler.getCurrentRequest().findAncestorObject(this.getClass()) != null || !Util.isSafeToRedirectTo(url)) {
             // Default behavior if the URL is absolute or scheme-relative, or the current object is an ancestor (i.e. would resolve correctly)
-            menu.add(url, icon, iconXml, text, post, requiresConfirmation, badge);
+            menu.add(url, icon, iconXml, text, post, requiresConfirmation, badge, message);
             return;
         }
         // If neither is the case, rewrite the relative URL to point to inside the /manage/ URL space
-        menu.add("manage/" + url, icon, iconXml, text, post, requiresConfirmation, badge);
+        menu.add("manage/" + url, icon, iconXml, text, post, requiresConfirmation, badge, message);
     }
 }

core/src/main/java/hudson/model/Run.java

@@ -1242,12 +1242,7 @@ private static int addArtifacts(@NonNull VirtualFile dir,
     /**
      * Maximum number of artifacts to list before using switching to the tree view.
      */
-    public static final int LIST_CUTOFF = Integer.parseInt(SystemProperties.getString("hudson.model.Run.ArtifactList.listCutoff", "16"));
-
-    /**
-     * Maximum number of artifacts to show in tree view before just showing a link.
-     */
-    public static final int TREE_CUTOFF = Integer.parseInt(SystemProperties.getString("hudson.model.Run.ArtifactList.treeCutoff", "40"));
+    public static final int LIST_CUTOFF = Integer.parseInt(SystemProperties.getString("hudson.model.Run.ArtifactList.listCutoff", "20"));
 
     // ..and then "too many"
 

core/src/main/java/hudson/slaves/SlaveComputer.java

@@ -329,10 +329,11 @@ protected Future<?> _connect(boolean forceReconnect) {
 
     @Override
     public void taskAccepted(Executor executor, Queue.Task task) {
+        LOGGER.log(Level.FINER, "Accepted {0} on {1}", new Object[] {task.toString(), executor.getOwner().getDisplayName()});
+
         if (launcher instanceof ExecutorListener) {
             ((ExecutorListener) launcher).taskAccepted(executor, task);
         }
-
         //getNode() can return null at indeterminate times when nodes go offline
         Slave node = getNode();
         if (node != null && node.getRetentionStrategy() instanceof ExecutorListener) {
@@ -342,6 +343,7 @@ public void taskAccepted(Executor executor, Queue.Task task) {
 
     @Override
     public void taskStarted(Executor executor, Queue.Task task) {
+        LOGGER.log(Level.FINER, "Started {0} on {1}", new Object[] {task.toString(), executor.getOwner().getDisplayName()});
         if (launcher instanceof ExecutorListener) {
             ((ExecutorListener) launcher).taskStarted(executor, task);
         }
@@ -353,6 +355,7 @@ public void taskStarted(Executor executor, Queue.Task task) {
 
     @Override
     public void taskCompleted(Executor executor, Queue.Task task, long durationMS) {
+        LOGGER.log(Level.FINE, "Completed {0} on {1}", new Object[] {task.toString(), executor.getOwner().getDisplayName()});
         if (launcher instanceof ExecutorListener) {
             ((ExecutorListener) launcher).taskCompleted(executor, task, durationMS);
         }
@@ -364,6 +367,7 @@ public void taskCompleted(Executor executor, Queue.Task task, long durationMS) {
 
     @Override
     public void taskCompletedWithProblems(Executor executor, Queue.Task task, long durationMS, Throwable problems) {
+        LOGGER.log(Level.FINE, "Completed with problems {0} on {1}", new Object[] {task.toString(), executor.getOwner().getDisplayName()});
         if (launcher instanceof ExecutorListener) {
             ((ExecutorListener) launcher).taskCompletedWithProblems(executor, task, durationMS, problems);
         }

core/src/main/java/hudson/util/DescribableList.java

@@ -100,7 +100,11 @@ public void setOwner(Owner owner) {
      * Removes all instances of the same type, then add the new one.
      */
     public void replace(T item) throws IOException {
-        removeAll((Class) item.getClass());
+        for (T t : data) {
+            if (t.getClass() == item.getClass()) {
+                data.remove(t);
+            }
+        }
         data.add(item);
         onModified();
     }

core/src/main/java/jenkins/model/Jenkins.java

@@ -225,6 +225,7 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
@@ -2049,13 +2050,7 @@ public boolean isUpgradedFromBefore(VersionNumber v) {
      * Gets the read-only list of all {@link Computer}s.
      */
     public Computer[] getComputers() {
-        Computer[] r = computers.values().toArray(new Computer[0]);
-        Arrays.sort(r, (lhs, rhs) -> {
-            if (lhs.getNode() == Jenkins.this)  return -1;
-            if (rhs.getNode() == Jenkins.this)  return 1;
-            return lhs.getName().compareTo(rhs.getName());
-        });
-        return r;
+        return computers.values().stream().sorted(Comparator.comparing(Computer::getName)).toArray(Computer[]::new);
     }
 
     @CLIResolver

core/src/main/java/jenkins/security/ConfidentialStore.java

@@ -122,14 +122,16 @@ void clear() {
 
         @Override
         protected void store(ConfidentialKey key, byte[] payload) throws IOException {
-            LOGGER.fine(() -> "storing " + key.getId() + " " + Util.getDigestOf(Util.toHexString(payload)));
+            //called only from tests, get hex string of sha 256 for logging payload
+            LOGGER.fine("storing " + key.getId() + " " + Util.getHexOfSHA256DigestOf(payload));
             data.put(key.getId(), payload);
         }
 
         @Override
         protected byte[] load(ConfidentialKey key) throws IOException {
             byte[] payload = data.get(key.getId());
-            LOGGER.fine(() -> "loading " + key.getId() + " " + (payload != null ? Util.getDigestOf(Util.toHexString(payload)) : "null"));
+            //called only from tests, get hex string of sha 256 for logging payload
+            LOGGER.fine("loading " + key.getId() + " " + (payload != null ? Util.getHexOfSHA256DigestOf(payload) : "null"));
             return payload;
         }
 

core/src/main/resources/hudson/Messages_fr.properties

@@ -20,6 +20,9 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
 
+AbstractItem.NewNameInUse=Le nom "{0}" est déjà utilisé.
+AbstractItem.NewNameUnchanged=Le nouveau nom est identique au nom actuel.
+
 FilePath.did_not_manage_to_validate_may_be_too_sl=Impossible de valider {0} (peut-être est-ce trop lent)
 FilePath.validateAntFileMask.whitespaceSeprator=\
   Les espaces ne peuvent plus être utilisés comme séparateurs. Merci d''utiliser maintenant '','' comme séparateur à la place.

core/src/main/resources/hudson/PluginManager/_installed.js

@@ -22,7 +22,7 @@
       {
         method: "post",
         headers: crumb.wrap({}),
-      }
+      },
     ).then((rsp) => {
       if (!rsp.ok) {
         rsp.text().then((responseText) => {
@@ -36,9 +36,7 @@
   function updateMsg() {
     // has anything changed since its original state?
     let e = Array.from(
-      document
-        .getElementById("plugins")
-        .querySelectorAll("input[type='checkbox']")
+      document.querySelectorAll("#plugins input[type='checkbox']"),
     ).find(function (e) {
       return String(e.checked) !== e.getAttribute("original");
     });