adoptium / adoptium/infrastructure

Audit all plugins on our jenkins server

Open
#3,214 0 comments 0 reactions 0 assignees View on GitHub
Jenkins security
Dominant language
Python
Stars
96
Forks
106
Avg merge
1d 23h
Merged PRs (30d)
13

Description

Follow-on to the work done in https://github.com/adoptium/infrastructure/issues/2108:
We have been using the current jenkins server for some time and we should look at all the plugins that we have in order to ensure the following:
- Anything we rely on is being kept patched from a security perspective (i.e. has some sort of maintainer)
- Everything we have installed is understood and we have a record of what it is needed and used for
- Ensure that we can recreate the server from scratch if required with the plugins we need.
As a starting point for some that are required, the ones used in our private jenkins server are listed at https://github.com/eclipse-cbi/jiro/blob/master/instances/adoptium.temurin-compliance/target/jenkins/plugins-list.txt and should be a subset of the ones we have on the public server.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the follow-on issue 2108 and the private-server reference at jiro/instances/adoptium.temurin-compliance/target/jenkins/plugins-list.txt. Audit the public Jenkins server's installed plugins, recording each plugin's purpose, usage, and security maintenance status. Done means the required set is documented and the server can be recreated with those plugins.

Written by the indexing model from the issue text.

Assessment

Domain
devops, infrastructure, tooling
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.