jenkinsci / jenkinsci/git-client-plugin

[JENKINS-69507] JGit fails 2nd and later https fetch with embedded username & password

Open
#1,657 0 comments 0 reactions 0 assignees View on GitHub
component:git-client-plugin imported-jira-issue priority:minor resolution:unresolved
Dominant language
Java
Stars
152
Forks
402
Avg merge
6h 47m
Merged PRs (30d)
4

Description

The git client plugin accepts an https URL with the username and password embedded in the repository URL. For example https://MarkEWaite:access-token-or-password@​gitlab.com/MarkEWaite/tasks.git is accepted as a valid URL The repository clones as expected with command line git across all the versions that I've tested (anything command line git 1.8 and newer) and on both Windows and Unix operating systems. The repository clones on the first creation of a new workspace with JGit, but then fails to clone on later updates of an existing workspace.

If I delete the workspace, JGit will clone into the workspace when creating the new workspace, but will then fail when updating the workspace.. Failure is seen with JGit 5.13.0 (git client plugin 3.11.2) and JGit 5.13.1 (git client plugin 3.12.0), JGit 6.4.0 (git client plugin 4.0.0), and is expected to be visible in JGit 6.5.0 (git client plugin 4.1.0).

Issue is likely a bug in the git client plugin, not any fault of JGit.

Expected result

JGit updates of existing repositories should succeed in the same cases where command line git updates of the repository succeed

Actual result

JGit updates of existing repositories fail when the username and password are embedded in the https URL of the repository.

Workarounds


  1. Use the Jenkins credentials system to store the username and password, then reference that credential in the job definition. Usernames and passwords embedded in a repository URL are displayed in the Jenkins console log by default, while they are not displayed when using Jenkins credentials

  2. Use command line git instead of JGit for those cases where an embedded username and password are required.

  3. Delete the workspace before the build starts (Pipeline cleanWS or freestyle with the workspace cleanup plugin "Delete workspace before build starts"

  4. Delete the workspace before the fetch starts in a freestyle job with the git plugin option "Wipe out repository & force clone"

Console log on failure

The console log when the failure happens:

```
> JGit fetch # timeout=11
ERROR: Error fetching remote repo 'origin'
hudson.plugins.git.GitException: Failed to fetch from https://MarkEWaite@​gitlab.com/MarkEWaite/tasks.git
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1003)
at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1244)
at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1308)
at hudson.scm.SCM.checkout(SCM.java:540)
at hudson.model.AbstractProject.checkout(AbstractProject.java:1239)
at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:647)
at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)
at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:519)
at hudson.model.Run.execute(Run.java:1899)
at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)
at hudson.model.ResourceController.execute(ResourceController.java:107)
at hudson.model.Executor.run(Executor.java:449)
Caused by: hudson.plugins.git.GitException: org.eclipse.jgit.api.errors.TransportException: https://MarkEWaite@​gitlab.com/MarkEWaite/tasks.git: not authorized
at org.jenkinsci.plugins.gitclient.JGitAPIImpl$2.execute(JGitAPIImpl.java:670)
at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:158)
at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:151)
at hudson.remoting.UserRequest.perform(UserRequest.java:211)
at hudson.remoting.UserRequest.perform(UserRequest.java:54)
at hudson.remoting.Request$2.run(Request.java:376)
at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:78)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to rhel-8-a-jagent
at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1784)
at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:356)
at hudson.remoting.Channel.call(Channel.java:1000)
at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:143)
at jdk.internal.reflect.GeneratedMethodAccessor415.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:129)
at com.sun.proxy.$Proxy160.execute(Unknown Source)
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1001)
at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1244)
at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1308)
at hudson.scm.SCM.checkout(SCM.java:540)
at hudson.model.AbstractProject.checkout(AbstractProject.java:1239)
at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:647)
at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)
at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:519)
at hudson.model.Run.execute(Run.java:1899)
at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)
at hudson.model.ResourceController.execute(ResourceController.java:107)
at hudson.model.Executor.run(Executor.java:449)
Caused by: org.eclipse.jgit.api.errors.TransportException: https://MarkEWaite@​gitlab.com/MarkEWaite/tasks.git: not authorized
at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:224)
at org.jenkinsci.plugins.gitclient.JGitAPIImpl$2.execute(JGitAPIImpl.java:668)
... 10 more
Caused by: org.eclipse.jgit.errors.TransportException: https://MarkEWaite@​gitlab.com/MarkEWaite/tasks.git: not authorized
at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:685)
at org.eclipse.jgit.transport.TransportHttp.openFetch(TransportHttp.java:465)
at org.eclipse.jgit.transport.FetchProcess.executeImp(FetchProcess.java:142)
at org.eclipse.jgit.transport.FetchProcess.execute(FetchProcess.java:94)
at org.eclipse.jgit.transport.Transport.fetch(Transport.java:1309)
at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:213)
... 11 more
ERROR: Error fetching remote repo 'origin'

```

---
Originally reported by markewaite, imported from: JGit fails 2nd and later https fetch with embedded username & password


  • status: Open
  • priority: Minor
  • component(s): git-client-plugin
  • resolution: Unresolved
  • votes: 0
  • watchers: 1
  • imported: 20251211-071809

Raw content of original issue

The git client plugin accepts an https URL with the username and password embedded in the repository URL.  For example https://MarkEWaite:access-token-or-password@gitlab.com/MarkEWaite/tasks.git is accepted as a valid URL  The repository clones as expected with command line git across all the versions that I've tested (anything command line git 1.8 and newer) and on both Windows and Unix operating systems.  The repository clones on the first creation of a new workspace with JGit, but then fails to clone on later updates of an existing workspace.



If I delete the workspace, JGit will clone into the workspace when creating the new workspace, but will then fail when updating the workspace..  Failure is seen with JGit 5.13.0 (git client plugin 3.11.2) and JGit 5.13.1 (git client plugin 3.12.0), JGit 6.4.0 (git client plugin 4.0.0), and is expected to be visible in JGit 6.5.0 (git client plugin 4.1.0).  



Issue is likely a bug in the git client plugin, not any fault of JGit.



Expected result



JGit updates of existing repositories should succeed in the same cases where command line git updates of the repository succeed



Actual result



JGit updates of existing repositories fail when the username and password are embedded in the https URL of the repository.



Workarounds



    

    	
  1. Use the Jenkins credentials system to store the username and password, then reference that credential in the job definition.  Usernames and passwords embedded in a repository URL are displayed in the Jenkins console log by default, while they are not displayed when using Jenkins credentials
    2. 

    	
  2. Use command line git instead of JGit for those cases where an embedded username and password are required.
    3. 

    	
  3. Delete the workspace before the build starts (Pipeline cleanWS or freestyle with the workspace cleanup plugin "Delete workspace before build starts"
    4. 

    	
  4. Delete the workspace before the fetch starts in a freestyle job with the git plugin option "Wipe out repository & force clone"
    5. 




Console log on failure



The console log when the failure happens:





> JGit fetch # timeout=11

ERROR: Error fetching remote repo 'origin'

hudson.plugins.git.GitException: Failed to fetch from https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git

	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1003)

	at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1244)

	at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1308)

	at hudson.scm.SCM.checkout(SCM.java:540)

	at hudson.model.AbstractProject.checkout(AbstractProject.java:1239)

	at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:647)

	at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)

	at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:519)

	at hudson.model.Run.execute(Run.java:1899)

	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)

	at hudson.model.ResourceController.execute(ResourceController.java:107)

	at hudson.model.Executor.run(Executor.java:449)

Caused by: hudson.plugins.git.GitException: org.eclipse.jgit.api.errors.TransportException: https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git: not authorized

	at org.jenkinsci.plugins.gitclient.JGitAPIImpl$2.execute(JGitAPIImpl.java:670)

	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:158)

	at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler$GitCommandMasterToSlaveCallable.call(RemoteGitImpl.java:151)

	at hudson.remoting.UserRequest.perform(UserRequest.java:211)

	at hudson.remoting.UserRequest.perform(UserRequest.java:54)

	at hudson.remoting.Request$2.run(Request.java:376)

	at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:78)

	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)

	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

	at java.base/java.lang.Thread.run(Thread.java:829)

	Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to rhel-8-a-jagent

		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1784)

		at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:356)

		at hudson.remoting.Channel.call(Channel.java:1000)

		at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.execute(RemoteGitImpl.java:143)

		at jdk.internal.reflect.GeneratedMethodAccessor415.invoke(Unknown Source)

		at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

		at java.base/java.lang.reflect.Method.invoke(Method.java:566)

		at org.jenkinsci.plugins.gitclient.RemoteGitImpl$CommandInvocationHandler.invoke(RemoteGitImpl.java:129)

		at com.sun.proxy.$Proxy160.execute(Unknown Source)

		at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1001)

		at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1244)

		at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1308)

		at hudson.scm.SCM.checkout(SCM.java:540)

		at hudson.model.AbstractProject.checkout(AbstractProject.java:1239)

		at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:647)

		at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:85)

		at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:519)

		at hudson.model.Run.execute(Run.java:1899)

		at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)

		at hudson.model.ResourceController.execute(ResourceController.java:107)

		at hudson.model.Executor.run(Executor.java:449)

Caused by: org.eclipse.jgit.api.errors.TransportException: https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git: not authorized

	at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:224)

	at org.jenkinsci.plugins.gitclient.JGitAPIImpl$2.execute(JGitAPIImpl.java:668)

	... 10 more

Caused by: org.eclipse.jgit.errors.TransportException: https://MarkEWaite@gitlab.com/MarkEWaite/tasks.git: not authorized

	at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:685)

	at org.eclipse.jgit.transport.TransportHttp.openFetch(TransportHttp.java:465)

	at org.eclipse.jgit.transport.FetchProcess.executeImp(FetchProcess.java:142)

	at org.eclipse.jgit.transport.FetchProcess.execute(FetchProcess.java:94)

	at org.eclipse.jgit.transport.Transport.fetch(Transport.java:1309)

	at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:213)

	... 11 more

ERROR: Error fetching remote repo 'origin'

environment

```
Jenkins 2.346.3

Git client plugin 3.11.2 and git client plugin 3.12.0-pre-release
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.