Page 2

• 

  Introducing the Azure Key Vault Credentials Provider for Jenkins

  Azure Key Vault is a product for securely managing keys, secrets and certificates. I’m happy to announce two new features in the Azure Key Vault plugin: a credential provider to tightly link Jenkins and Azure Key Vault. huge thanks to Jie Shen for contributing this integration with the configuration-as-code plugin. These changes were released in v1.8 but make sure to run the latest version of...

  

  Tim Jacomb March 30, 2020
• Findsecbugs for Developers

  Spotbugs is a utility used in Jenkins and many other Java projects to detect common Java coding mistakes and bugs. It is integrated into the build process to improve the code before it gets merged and released. Findsecbugs is a plugin for Spotbugs that adds 135 vulnerability types focused on the OWASP TOP 10 and the Common Weakness Enumeration (CWE)....

  

  Jeff Thompson March 2, 2020
• Generic Webhook Trigger Plugin

  Table of Contents The Problem Code Duplication And Security A Branch Is Not A Feature Documentation The Solution Code Duplication And Security A Branch Is Not A Feature Documentation This post will describe some common problems I’ve had with Jenkins and how I solved them by developing Generic Webhook Trigger Plugin. The Problem I was often struggling with the same issues when working with Jenkins: Code duplication and security - Jenkinsfiles in...

  

  Tomas Bjerre December 14, 2019
• Introducing the AWS Secrets Manager Credentials Provider for Jenkins

  API keys and secrets are difficult to handle safely, and probably something you avoid thinking about. In this post I’ll show how the new AWS Secrets Manager Credentials Provider plugin allows you to marshal your secrets into one place, and use them securely from Jenkins. When CI/CD pipelines moved to the public cloud, credential management did not evolve with them. If...

  Chris Kilding December 10, 2019
• 

  Do Plugins Store Credentials In A Secure Way? - DevOps World | Jenkins World 2019

  This is a speaker blog post for a DevOps World | Jenkins World 2019 talk in Lisbon, Portugal and has been posted in line with NCC Group responsible disclosure policy. Related Jenkins security advisories: 2017-11-08, 2017-11-16, 2018-06-25, 2018-07-30, 2018-09-25, 2019-02-19, 2019-03-06, 2019-03-25, 2019-04-03, 2019-04-17, 2019-08-07, 2019-09-12, 2019-10-01, 2019-10-16, 2019-10-23. Some of the vulnerabilities have been announced without a fix, see Jenkins Security Spring Cleaning 2019. The most of the announced vulnerabilities are fixed at the moment of this...

  Viktor Gazdag November 29, 2019
• 

  Thinking About Jenkins Security - DevOps World | Jenkins World 2019

  This is a speaker blogpost for a DevOps World | Jenkins World 2019 talk in Lisbon, Portugal Come join us at DevOps World | Jenkins World 2019 for "Thinking about Jenkins Security", a talk about securing your Jenkins server. We’ll review the layers that secure Jenkins and describe techniques that you can use to protect your Jenkins server. Topics will include: The secure by...

  

  Mark Waite

  

  Wadeck Follonier

  

  Meg McRoberts October 21, 2019
• 

  Audit Log Plugin for Jenkins Releases 1.0

  Thanks to our Outreachy interns over the past year, I’m proud to announce the initial release of the Audit Log plugin for Jenkins. This plugin is the first major project completed related to Outreachy, and I’d like to give a brief overview of the functionality that was developed for this release. The primary goal of this plugin is to introduce an audit...

  Matt Sicker September 23, 2019
• 

  Performance Improvements to Role Strategy Plugin

  The task for my Google Summer of Code program was to improve the performance of the Role Strategy Plugin. The performance issues for Role Strategy Plugin had been reported multiple times on Jenkins JIRA. With a large number of roles and with complex regular expressions, a large slow-down was visible on the Web UI. Even before GSoC started, there were a number of patches...

  

  Abhyudaya Sharma August 26, 2019
• Introducing new Folder Authorization Plugin

  During my Google Summer of Code Project, I have created the brand new Folder Auth Plugin for easily managing permissions to projects organized in folders from the Folders plugin. This new plugin is designed for fast permission checks with easy-to-manage roles. The 1.0 version of the plugin has just been released and can be downloaded from your Jenkins' Update center. This plugin was inspired by the...

  

  Abhyudaya Sharma August 16, 2019