// Copyright 2014 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT package auth import ( "context" "net/http" "strings" "time" actions_model "code.gitea.io/gitea/models/actions" auth_model "code.gitea.io/gitea/models/auth" user_model "code.gitea.io/gitea/models/user" "code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/timeutil" "code.gitea.io/gitea/services/actions" "code.gitea.io/gitea/services/oauth2_provider" ) // Ensure the struct implements the interface. var ( _ Method = &OAuth2{} ) // GetOAuthAccessTokenScopeAndUserID returns access token scope and user id func GetOAuthAccessTokenScopeAndUserID(ctx context.Context, accessToken string) (auth_model.AccessTokenScope, int64) { var accessTokenScope auth_model.AccessTokenScope if !setting.OAuth2.Enabled { return accessTokenScope, 0 } // JWT tokens require a ".", if the token isn't like that, return early if !strings.Contains(accessToken, ".") { return accessTokenScope, 0 } token, err := oauth2_provider.ParseToken(accessToken, oauth2_provider.DefaultSigningKey) if err != nil { log.Trace("oauth2.ParseToken: %v", err) return accessTokenScope, 0 } var grant *auth_model.OAuth2Grant if grant, err = auth_model.GetOAuth2GrantByID(ctx, token.GrantID); err != nil || grant == nil { return accessTokenScope, 0 } if token.Kind != oauth2_provider.KindAccessToken { return accessTokenScope, 0 } if token.ExpiresAt.Before(time.Now()) || token.IssuedAt.After(time.Now()) { return accessTokenScope, 0 } accessTokenScope = oauth2_provider.GrantAdditionalScopes(grant.Scope) return accessTokenScope, grant.UserID } // CheckTaskIsRunning verifies that the TaskID corresponds to a running task func CheckTaskIsRunning(ctx context.Context, taskID int64) bool { // Verify the task exists task, err := actions_model.GetTaskByID(ctx, taskID) if err != nil { return false } // Verify that it's running return task.Status == actions_model.StatusRunning } // OAuth2 implements the Auth interface and authenticates requests // (API requests only) by looking for an OAuth token in query parameters or the // "Authorization" header. type OAuth2 struct{} // Name represents the name of auth method func (o *OAuth2) Name() string { return "oauth2" } // parseToken returns the token from request, and a boolean value // representing whether the token exists or not func parseToken(req *http.Request) (string, bool) { _ = req.ParseForm() if !setting.DisableQueryAuthToken { // Check token. if token := req.Form.Get("token"); token != "" { return token, true } // Check access token. if token := req.Form.Get("access_token"); token != "" { return token, true } } else if req.Form.Get("token") != "" || req.Form.Get("access_token") != "" { log.Warn("API token sent in query string but DISABLE_QUERY_AUTH_TOKEN=true") } // check header token if auHead := req.Header.Get("Authorization"); auHead != "" { auths := strings.Fields(auHead) if len(auths) == 2 && (auths[0] == "token" || strings.ToLower(auths[0]) == "bearer") { return auths[1], true } } return "", false } // userIDFromToken returns the user id corresponding to the OAuth token. // It will set 'IsApiToken' to true if the token is an API token and // set 'ApiTokenScope' to the scope of the access token func (o *OAuth2) userIDFromToken(ctx context.Context, tokenSHA string, store DataStore) int64 { // Let's see if token is valid. if strings.Contains(tokenSHA, ".") { // First attempt to decode an actions JWT, returning the actions user if taskID, err := actions.TokenToTaskID(tokenSHA); err == nil { if CheckTaskIsRunning(ctx, taskID) { store.GetData()["IsActionsToken"] = true store.GetData()["ActionsTaskID"] = taskID return user_model.ActionsUserID } } // Otherwise, check if this is an OAuth access token accessTokenScope, uid := GetOAuthAccessTokenScopeAndUserID(ctx, tokenSHA) if uid != 0 { store.GetData()["IsApiToken"] = true store.GetData()["ApiTokenScope"] = accessTokenScope } return uid } t, err := auth_model.GetAccessTokenBySHA(ctx, tokenSHA) if err != nil { if auth_model.IsErrAccessTokenNotExist(err) { // check task token task, err := actions_model.GetRunningTaskByToken(ctx, tokenSHA) if err == nil && task != nil { log.Trace("Basic Authorization: Valid AccessToken for task[%d]", task.ID) store.GetData()["IsActionsToken"] = true store.GetData()["ActionsTaskID"] = task.ID return user_model.ActionsUserID } } else if !auth_model.IsErrAccessTokenNotExist(err) && !auth_model.IsErrAccessTokenEmpty(err) { log.Error("GetAccessTokenBySHA: %v", err) } return 0 } t.UpdatedUnix = timeutil.TimeStampNow() if err = auth_model.UpdateAccessToken(ctx, t); err != nil { log.Error("UpdateAccessToken: %v", err) } store.GetData()["IsApiToken"] = true store.GetData()["ApiTokenScope"] = t.Scope return t.UID } // Verify extracts the user ID from the OAuth token in the query parameters // or the "Authorization" header and returns the corresponding user object for that ID. // If verification is successful returns an existing user object. // Returns nil if verification fails. func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) { // These paths are not API paths, but we still want to check for tokens because they maybe in the API returned URLs detector := newAuthPathDetector(req) if !detector.isAPIPath() && !detector.isAttachmentDownload() && !detector.isAuthenticatedTokenRequest() && !detector.isGitRawOrAttachPath() && !detector.isArchivePath() { return nil, nil } token, ok := parseToken(req) if !ok { return nil, nil } id := o.userIDFromToken(req.Context(), token, store) if id <= 0 && id != -2 { // -2 means actions, so we need to allow it. return nil, user_model.ErrUserNotExist{} } log.Trace("OAuth2 Authorization: Found token for user[%d]", id) user, err := user_model.GetPossibleUserByID(req.Context(), id) if err != nil { if !user_model.IsErrUserNotExist(err) { log.Error("GetUserByName: %v", err) } return nil, err } log.Trace("OAuth2 Authorization: Logged in user %-v", user) return user, nil } iva-webapp/src/main/archiva-web/http-cache-semantics-and-angular/cli-4.1.1'>dependabot/npm_and_yarn/archiva-modules/archiva-web/archiva-webapp/src/main/archiva-web/http-cache-semantics-and-angular/cli-4.1.1 Apache Archiva Repository: https://github.com/apache/archivawww-data
aboutsummaryrefslogtreecommitdiffstats
path: root/Jenkinsfile
blob: eaebba1bdb1511a02a408c9f25599a7b6be11ab4 (plain) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

/**
 * Main build file for Jenkins Multibranch pipeline.
 *
 * The pipeline builds, runs the test and deploys to the archiva snapshot repository.
 *
 * Uses one stage for build and deploy to avoid running it multiple times.
 * The settings for deployment with the credentials must be provided by a MavenSettingsProvider.
 *
 * Only the war and zip artifacts are archived in the jenkins build archive.
 */
LABEL = 'ubuntu && !H23'
buildJdk = 'jdk_1.8_latest'
buildJdk9 = 'jdk_1.9_latest'
buildJdk10 = 'jdk_10_latest'
buildJdk11 = 'jdk_11_latest'
buildMvn = 'maven_3.6.3'
//localRepository = ".repository"
//localRepository = "../.maven_repositories/${env.EXECUTOR_NUMBER}"
mavenOpts = '-Xms1g -Xmx2g -Djava.awt.headless=true'
publishers = [artifactsPublisher(disabled: false),
              junitPublisher(disabled: false, ignoreAttachments: false),
              pipelineGraphPublisher(disabled: false),mavenLinkerPublisher(disabled: false)]

cmdLine = (env.NONAPACHEORG_RUN != 'y' && env.BRANCH_NAME == 'master') ? "clean deploy" : "clean install"


        INTEGRATION_PIPELINE = "/Archiva/Archiva-IntegrationTests-Gitbox"

pipeline {
    agent {
        label "${LABEL}"
    }
    // Build should also start, if redback has been built successfully
    triggers { 
        upstream(upstreamProjects: 'Archiva/Archiva-TLP-Gitbox/archiva-redback-core/master,Archiva/Archiva-TLP-Gitbox/archiva-components/master,Archiva/Archiva-TLP-Gitbox/archiva-parent/master', threshold: hudson.model.Result.SUCCESS) 
    }
    options {
        disableConcurrentBuilds()
        buildDiscarder(logRotator(numToKeepStr: '7', artifactNumToKeepStr: '5'))
    }
    parameters {
        booleanParam(name: 'PRECLEANUP', defaultValue: false, description: 'Clears the local maven repository before build.')
        string(name: 'THREADS', defaultValue: '3', description: 'Number of threads for the mvn build (-T option). Must be a integer value>0.')
    }
    environment {          
        LOCAL_REPOSITORY = "../.maven_repositories/${env.EXECUTOR_NUMBER}"
    }


    stages {

        stage('PreCleanup') {
            when {
                expression {
                    params.PRECLEANUP
                }
            }
            steps {
                sh "rm -rf ${env.LOCAL_REPOSITORY}"
            }
        }

        stage('BuildAndDeploy') {
            environment {
                ARCHIVA_USER_CONFIG_FILE = '/tmp/archiva-master-jdk-8-${env.JOB_NAME}.xml'
            }

            steps {
                timeout(120) {
                    withMaven(maven: buildMvn, jdk: buildJdk,
                            mavenLocalRepo: env.LOCAL_REPOSITORY,
                            publisherStrategy: 'EXPLICIT',
                            mavenOpts: mavenOpts,
                            options: publishers )
                            {
                                sh "chmod 755 ./src/ci/scripts/prepareWorkspace.sh"
                                sh "./src/ci/scripts/prepareWorkspace.sh"
                                // Needs a lot of time to reload the repository files, try without cleanup
                                // Not sure, but maybe
                                // sh "rm -rf .repository"

                                // Run test phase / ignore test failures
                                // -B: Batch mode
                                // -U: Force snapshot update
                                // -e: Produce execution error messages
                                // -fae: Fail at the end
                                // -Dmaven.compiler.fork=true: Do compile in a separate forked process
                                // -Dmaven.test.failure.ignore=true: Do not stop, if some tests fail
                                // -Pci-build: Profile for CI-Server
                                sh "mvn ${cmdLine} -B -U -e -fae -Dorg.slf4j.simpleLogger.showThreadName=true -Pci-build -T${THREADS}"
                            }
                }
            }
            post {
                always {
                    sh "rm -f /tmp/archiva-master-jdk-8-${env.JOB_NAME}.xml"
                }
                failure {
                    script{
                        asfStandardBuild.notifyBuild("Failure in BuildAndDeploy stage")
                    }
                }
            }
        }



        stage('Postbuild') {
            parallel {
                stage('IntegrationTest') {
                    steps {
                        build(job: "${INTEGRATION_PIPELINE}/archiva/${env.BRANCH_NAME}", propagate: false, quietPeriod: 5, wait: false)
                    }
                }

                stage('JDK11') {
                    environment {
                        ARCHIVA_USER_CONFIG_FILE = '/tmp/archiva-master-jdk-11-${env.JOB_NAME}.xml'
                    }
                    steps {
                        ws("${env.JOB_NAME}-JDK11") {
                            checkout scm
                            timeout(120) {
                                withMaven(maven: buildMvn, jdk: buildJdk11,
                                          mavenLocalRepo: ".repository",
                                          publisherStrategy: 'EXPLICIT',
                                          mavenOpts: mavenOpts,
                                          options: publishers
                                )
                                        {
                                            sh "chmod 755 ./src/ci/scripts/prepareWorkspace.sh"
                                            sh "./src/ci/scripts/prepareWorkspace.sh"
                                            sh "mvn clean install -U -B -e -fae -Dorg.slf4j.simpleLogger.showThreadName=true -Pci-build -T${THREADS}"
                                        }
                            }
                        }
                    }
                    post {
                        always {
                            sh "rm -f /tmp/archiva-master-jdk-11-${env.JOB_NAME}.xml"
                        }
                        success {
                            cleanWs()
                        }
                    }
                }
            }
        }

    }

    post {
        unstable {
            script {
                asfStandardBuild.notifyBuild("Unstable Build")
            }
        }
        success {
            script {
                def previousResult = currentBuild.previousBuild?.result
                if (previousResult && !currentBuild.resultIsWorseOrEqualTo(previousResult)) {
                    asfStandardBuild.notifyBuild("Fixed")
                }
            }
        }
    }
}

// vim: et:ts=4:sw=4:ft=groovy