Upgrade from 2.361.2 to 2.395 fails to download the shared library

Using Jenkins
1

ERROR: Error fetching remote repo ‘origin’
hudson.plugins.git.GitException: Failed to fetch from https://github.com/gh-org-data-platform/dp-tools-jenkins-sharedlib
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:1003)
at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1245)
at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1309)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:129)
at org.jenkinsci.plugins.workflow.libs.SCMSourceRetriever.lambda$doRetrieve$1(SCMSourceRetriever.java:200)
at org.jenkinsci.plugins.workflow.libs.SCMSourceRetriever.retrySCMOperation(SCMSourceRetriever.java:148)
at org.jenkinsci.plugins.workflow.libs.SCMSourceRetriever.doRetrieve(SCMSourceRetriever.java:199)
at org.jenkinsci.plugins.workflow.libs.SCMRetriever.retrieve(SCMRetriever.java:92)
at org.jenkinsci.plugins.workflow.libs.LibraryAdder.retrieve(LibraryAdder.java:260)
at org.jenkinsci.plugins.workflow.libs.LibraryAdder.add(LibraryAdder.java:150)
at org.jenkinsci.plugins.workflow.libs.LibraryDecorator$1.call(LibraryDecorator.java:125)
at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1087)
at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:624)
at org.codehaus.groovy.control.CompilationUnit.processPhaseOperations(CompilationUnit.java:602)
at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:579)
at groovy.lang.GroovyClassLoader.doParseClass(GroovyClassLoader.java:323)
at groovy.lang.GroovyClassLoader.parseClass(GroovyClassLoader.java:293)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox$Scope.parse(GroovySandbox.java:163)
at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.doParse(CpsGroovyShell.java:190)
at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.reparse(CpsGroovyShell.java:175)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.parseScript(CpsFlowExecution.java:569)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.start(CpsFlowExecution.java:519)
at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:336)
at hudson.model.ResourceController.execute(ResourceController.java:107)
at hudson.model.Executor.run(Executor.java:449)
Caused by: hudson.plugins.git.GitException: Command “git config remote.origin.url https://github.com/gh-org-data-platform/dp-tools-jenkins-sharedlib” returned status code 128:
stdout:
stderr: fatal: not in a git directory

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2732)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2658)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2654)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommand(CliGitAPIImpl.java:1979)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommand(CliGitAPIImpl.java:1991)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.setRemoteUrl(CliGitAPIImpl.java:1599)
at hudson.plugins.git.GitAPI.setRemoteUrl(GitAPI.java:161)
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:991)
... 24 more

ERROR: Error fetching remote repo ‘origin’
ERROR: Maximum checkout retry attempts reached, aborting
org.codehaus.groovy.control.MultipleCompilationErrorsException: startup failed:
WorkflowScript: Loading libraries failed

1 error

at org.codehaus.groovy.control.ErrorCollector.failIfErrors(ErrorCollector.java:309)
at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1107)
at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:624)
at org.codehaus.groovy.control.CompilationUnit.processPhaseOperations(CompilationUnit.java:602)
at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:579)
at groovy.lang.GroovyClassLoader.doParseClass(GroovyClassLoader.java:323)
at groovy.lang.GroovyClassLoader.parseClass(GroovyClassLoader.java:293)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox$Scope.parse(GroovySandbox.java:163)
at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.doParse(CpsGroovyShell.java:190)
at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.reparse(CpsGroovyShell.java:175)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.parseScript(CpsFlowExecution.java:569)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.start(CpsFlowExecution.java:519)
at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:336)
at hudson.model.ResourceController.execute(ResourceController.java:107)
at hudson.model.Executor.run(Executor.java:449)

GitHub has been notified of this commit’s build result

[withMaven] downstreamPipelineTriggerRunListener - Failure to introspect build steps: java.io.IOException: data-products-ingestion/gh-dp-data-product-ingestion-acs/feature%2FDPDO-115-TECHNICAL-acs-prod-issue-analysis #35 did not yet start
[withMaven] downstreamPipelineTriggerRunListener - Failure to introspect build steps: java.io.IOException: data-products-ingestion/gh-dp-data-product-ingestion-acs/feature%2FDPDO-115-TECHNICAL-acs-prod-issue-analysis #35 did not yet start
Finished: FAILURE

2

I have checked the token values etc, everything seem fine.
everything worked fine when thee upgrade aborted and rolled back to 2.361.2.

3

Command line git included in recent container images includes a fix for a security issue. Command line git now refuses to perform operations in repositories when the directory is not owned by the current user.

JENKINS-70540 includes a set of steps that show how to duplicate the issue. In that issue report, I noted:

Command line git has decided that it is dangerous to perform git operations in a directory owned by a different user. I may consider a way to better detect it and better alert the administrator that there is a problem, but ultimately it is a mistake to perform git operations in a directory owned by a different user without intentionally configuring the safe.directory to allow it.

The preferred alternative is to fix the permissions on the directories so that they are owned by the user that is calling command line git.

A description of command line git CVE-2022-24765 is available in a GitHub blog post. The Red Hat description is also quite helpful, as is the Debian description.

1 Like
4

Thanks MarkEWaite, that helped.