Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY ISSUE: JENKINS_HOME.gitignore must ignore credentials.xml #4547

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

cowlinator
Copy link

@cowlinator cowlinator commented Dec 11, 2024

JENKINS_HOME.gitignore must ignore credentials.xml, as that file may contain encrypted secrets.

Also, job config should be included.

Reasons for making this change:

I am a Jenkins user. I decided to use this JENKINS_HOME.gitignore as I version controlled my jenkins configuration.

  1. Then I discovered that credentials.xml, which contains encrypted passwords, private ssh keys, and other secrets. In general, it is bad practice and a security issue to include any secrets or credentials-- encrypted or not-- in git repositories. (And in this case, they can be decrypted very easily).
  2. I also discovered that the job configurations were being ignored. Job config.xml files are important, sometimes containing a lot of intricate configuration, and in fact sometimes contain <script>{code}</script> which literally contains code. Code should be included in version control.

Links to documentation supporting these rule changes:

  1. Not documented. Just enter any credential into a jenkins instance, and look at the credentials.xml file. You will see your encrypted credential. The need for this change is self-evident.
  2. https://wiki.jenkins-ci.org/display/JENKINS/Administering+Jenkins

pcowley added 2 commits December 11, 2024 14:26
…s that file may contain encrypted secrets.
…ml files contain important configuration data, sometimes including `<script>{code}</script>` which is literally code. Code needs to be version controlled.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant