Skip to content

Commit 90c3d8c

Browse files
dduportaldduportal
authored
Merge pull request #833 from dduportal/stable-2.541
Backport from `master` (Weekly) in `stable-2.541` for LTS 2.541.1
2 parents 0fb5c67 + 2bd42f9 commit 90c3d8c

File tree

14 files changed

+147
-106
lines changed

14 files changed

+147
-106
lines changed

‎.github/ISSUE_TEMPLATE/1-lts-release-checklist.md‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,13 @@ This role should rotate between LTS releases
2525
If the last release of the preceding LTS line is a security release, consider making the matching weekly release the [new LTS baseline](https://groups.google.com/g/jenkinsci-dev/c/ca7Lp0x6Kqs/m/QwHj66hZAgAJ).
2626
For example, 2.462.3 LTS and 2.479 were security releases and it is simpler to use 2.479 as baseline than 2.477.
2727

28-
- [ ] Create or update release branch in [jenkinsci/jenkins](https://github.com/jenkinsci/jenkins), e.g. `stable-2.387`, use the [init-lts-line](https://github.com/jenkins-infra/release/blob/master/tools/init-lts-line) script or carry out the equivalent steps therein.
28+
- [ ] Create or update the release branches in all the repositories below, e.g. `stable-2.387` with the [init-lts-line](https://github.com/jenkins-infra/release/blob/master/tools/init-lts-line) script or carry out the equivalent steps therein. For more info, refer to [stable](https://github.com/jenkins-infra/release#stable).
29+
- [ ] [jenkinsci/jenkins](https://github.com/jenkinsci/jenkins)
30+
- [ ] [jenkinsci/packaging](https://github.com/jenkinsci/packaging)
31+
- [ ] [jenkins-infra/release](https://github.com/jenkins-infra/release)
2932

30-
- [ ] Create or update release branch in [jenkins-infra/release](https://github.com/jenkins-infra/release), e.g. `stable-2.387`. Strike out for initial release.
31-
- [ ] Modify the `RELEASE_GIT_BRANCH` and `JENKINS_VERSION` values in the environment file (`profile.d/stable`) to match the release.
32-
- [ ] Modify the `PACKAGING_GIT_BRANCH` value in the packaging script (`Jenkinsfile.d/core/package`) to match the release.
33-
- For more info, refer to [stable](https://github.com/jenkins-infra/release#stable).
34-
35-
- [ ] Create or update release branch in [jenkinsci/packaging](https://github.com/jenkinsci/packaging), e.g. `stable-2.387`. Strike out for new point release.
33+
- [ ] Check with the Jenkins Infrastructure team for backports on both repositories [jenkinsci/packaging](https://github.com/jenkinsci/packaging) and [jenkins-infra/release](https://github.com/jenkins-infra/release) as per https://github.com/jenkins-infra/release/blob/master/docs/releases.md#open-a-backporting-pr.
34+
- A message in the Matrix channel `#jenkins-infra` mentioning this issue and this item is enough: they will own the backports
3635

3736
- [ ] Create a pull request to update [bom](https://github.com/jenkinsci/bom) to the weekly version that will be the base of the release line (and strike this out for new point release).
3837
Assure that the [bom-weekly version number](https://github.com/jenkinsci/bom/blob/master/sample-plugin/pom.xml#L17) is already testing the base of the release line or a version newer than the base of the release line.

‎Jenkinsfile.d/core/package‎

Lines changed: 8 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,6 @@ pipeline {
6262
description: 'Enable Windows Packaging',
6363
name: 'WINDOWS_PACKAGING_ENABLED'
6464
)
65-
booleanParam(
66-
defaultValue: false,
67-
description: 'Force bootstrap (cleanup + initialization from production) of the packages staging environment if data from previous staged build is present.',
68-
name: 'FORCE_STAGING_BOOTSTRAP_PARAM'
69-
)
7065
booleanParam(
7166
defaultValue: false,
7267
description: 'Select this checkbox if you want to disable promotion to production (e.g. only publish to staging).',
@@ -96,8 +91,9 @@ pipeline {
9691
AZURE_VAULT_CLIENT_SECRET = credentials('azure-vault-client-secret')
9792
AZURE_VAULT_TENANT_ID = credentials('azure-vault-tenant-id')
9893
GPG_FILE = 'jenkins-release.gpg'
99-
GPG_PASSPHRASE = credentials('release-gpg-passphrase-2023')
100-
PACKAGING_GIT_REPOSITORY = 'git@github.com:jenkinsci/packaging.git'
94+
GPG_PASSPHRASE = credentials('release-gpg-passphrase-2026')
95+
// Using HTTPS with no credentials - https://github.com/jenkins-infra/helpdesk/issues/4909 - need a GH app if rate limited or need to write things to git
96+
PACKAGING_GIT_REPOSITORY = 'https://github.com/jenkinsci/packaging.git'
10197
PACKAGING_GIT_BRANCH = 'stable-2.541'
10298
SIGN_KEYSTORE_FILENAME = 'jenkins.pfx'
10399
SIGN_STOREPASS = credentials('signing-cert-pass-2023')
@@ -114,7 +110,6 @@ pipeline {
114110
BASE_BIN_DIR = "${env.GET_JENKINS_IO_STAGING}/${env.BRANCH_NAME.replaceAll('\\.', '_').replaceAll('\\/', '_').replaceAll('\\:', '_')}"
115111
// Sanitize URL to avoid nested subdomains and other URL bad surprises: "feat/foo-stable:2.539" => "feat_foo-stable_2_539"
116112
BASE_PKG_DIR = "${env.PKG_JENKINS_IO_STAGING}/${env.BRANCH_NAME.replaceAll('\\.', '_').replaceAll('\\/', '_').replaceAll('\\:', '_')}"
117-
FORCE_STAGING_BOOTSTRAP = "${params.containsKey("FORCE_STAGING_BOOTSTRAP_PARAM") ? params.FORCE_STAGING_BOOTSTRAP_PARAM : false}"
118113
ONLY_STAGING = "${params.containsKey("ONLY_STAGING_PARAM") ? params.ONLY_STAGING_PARAM : false}"
119114
ONLY_PROMOTION = "${params.containsKey("ONLY_PROMOTION_PARAM") ? params.ONLY_PROMOTION_PARAM : false}"
120115
}
@@ -149,7 +144,7 @@ pipeline {
149144
steps {
150145
checkout scm
151146
dir (WORKING_DIRECTORY) {
152-
git branch: PACKAGING_GIT_BRANCH, credentialsId: 'release-key', url: PACKAGING_GIT_REPOSITORY
147+
git branch: PACKAGING_GIT_BRANCH, url: PACKAGING_GIT_REPOSITORY
153148
}
154149

155150
sh '''
@@ -176,20 +171,7 @@ pipeline {
176171
stage('Prepare package staging environment') {
177172
steps {
178173
sh '''
179-
# Bootstrap (e.g. reset to production) all stagings for this branch if requested by the user or if missing a directory
180-
if [ "${FORCE_STAGING_BOOTSTRAP}" = "true" ] || [ ! -d "${BASE_BIN_DIR}" ] || [ ! -d "${BASE_PKG_DIR}" ]
181-
then
182-
echo "Bootstrap (reset to production) of the staging environment for ${BASE_BIN_DIR} and ${BASE_PKG_DIR} directories..."
183-
rm -rf "${BASE_BIN_DIR}" "${BASE_PKG_DIR}"
184-
mkdir -p "${BASE_BIN_DIR}" "${BASE_PKG_DIR}"
185-
186-
# TODO: Initialize from production with symlinks?
187-
# Initialize from production only for RPMs to get the history when rebuilding index (debian don't care)
188-
rsync -avtz --chown=1000:1000 "${GET_JENKINS_IO_PRODUCTION}/rpm" "${BASE_BIN_DIR}/"
189-
190-
# Initialize from production as we need an initial package state. We don't sync old package index which are kept in production.
191-
rsync -avtz --chown=1000:1000 --exclude="*-legacy/*" "${PKG_JENKINS_IO_PRODUCTION}/" "${BASE_PKG_DIR}/"
192-
fi
174+
./utils/release.bash --prepareStaging
193175
'''
194176
}
195177
}
@@ -277,7 +259,7 @@ pipeline {
277259
container('dotnet') {
278260
checkout scm
279261
dir (WORKING_DIRECTORY) {
280-
git branch: PACKAGING_GIT_BRANCH, credentialsId: 'release-key', url: PACKAGING_GIT_REPOSITORY
262+
git branch: PACKAGING_GIT_BRANCH, url: PACKAGING_GIT_REPOSITORY
281263

282264
unstash 'GPG'
283265
unstash 'WAR'
@@ -343,24 +325,22 @@ pipeline {
343325
}
344326
environment {
345327
SSH_HOSTKEY_ARCHIVES_JENKINS_IO = credentials('ssh-hostkey-archives.jenkins.io')
346-
SSH_HOSTKEY_PKG_ORIGIN_JENKINS_IO = credentials('ssh-hostkey-pkg.origin.jenkins.io')
347328
}
348329
steps {
349330
sshagent(credentials: [
350-
'pkgserver',
351331
'archives.jenkins.io',
352332
]) {
353333
sh '''
354334
mkdir -m 700 -p "${HOME}/.ssh"
355-
cat "${SSH_HOSTKEY_ARCHIVES_JENKINS_IO}" "${SSH_HOSTKEY_PKG_ORIGIN_JENKINS_IO}" >> "${HOME}/.ssh/known_hosts"
335+
cat "${SSH_HOSTKEY_ARCHIVES_JENKINS_IO}" >> "${HOME}/.ssh/known_hosts"
356336
'''
357337
sh '''
358338
./utils/release.bash --promotePackages
359339
'''
360340
}
361341
}
362342
}
363-
stage('Invalidate Fastly Cache') {
343+
stage('Invalidate Fastly Cache for pkg.jenkins.io') {
364344
when {
365345
environment name: 'ONLY_STAGING', value: 'false'
366346
}

‎Jenkinsfile.d/core/release‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ pipeline {
5454
AZURE_VAULT_CLIENT_ID = credentials('azure-vault-client-id')
5555
AZURE_VAULT_CLIENT_SECRET = credentials('azure-vault-client-secret')
5656
AZURE_VAULT_TENANT_ID = credentials('azure-vault-tenant-id')
57-
GPG_PASSPHRASE = credentials('release-gpg-passphrase-2023')
57+
GPG_PASSPHRASE = credentials('release-gpg-passphrase-2026')
5858
GPG_FILE = 'jenkins-release.gpg'
5959
MAVEN_REPOSITORY_USERNAME = credentials('maven-repository-username')
6060
MAVEN_REPOSITORY_PASSWORD = credentials('maven-repository-password')

‎Jenkinsfile.d/infra-agents-health‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ pipeline {
1515
AZURE_VAULT_CLIENT_ID = credentials('azure-vault-client-id')
1616
AZURE_VAULT_CLIENT_SECRET = credentials('azure-vault-client-secret')
1717
AZURE_VAULT_TENANT_ID = credentials('azure-vault-tenant-id')
18+
// Using HTTPS with no credentials - https://github.com/jenkins-infra/helpdesk/issues/4909 - need a GH app if rate limited or need to write things to git
19+
PACKAGING_GIT_REPOSITORY = 'https://github.com/jenkinsci/packaging.git'
20+
PACKAGING_GIT_BRANCH = 'master'
21+
WORKING_DIRECTORY = "release"
1822
}
1923

2024
stages {
@@ -28,13 +32,15 @@ pipeline {
2832
}
2933
environment {
3034
SSH_HOSTKEY_ARCHIVES_JENKINS_IO = credentials('ssh-hostkey-archives.jenkins.io')
31-
SSH_HOSTKEY_PKG_ORIGIN_JENKINS_IO = credentials('ssh-hostkey-pkg.origin.jenkins.io')
3235
}
3336
steps {
37+
checkout scm
38+
3439
// Ensure we can get the secondary git repository used for packaging
35-
dir ('./release'){
36-
git branch: 'master', credentialsId: 'release-key', url: 'git@github.com:jenkinsci/packaging.git'
40+
dir (WORKING_DIRECTORY) {
41+
git branch: PACKAGING_GIT_BRANCH, url: PACKAGING_GIT_REPOSITORY
3742
}
43+
3844
// Ensure we can retrieve the Code Signing Certificate'
3945
sh '''
4046
utils/release.bash --downloadAzureKeyvaultSecret
@@ -56,9 +62,8 @@ pipeline {
5662
]) {
5763
sh '''
5864
mkdir -m 700 -p "${HOME}/.ssh"
59-
cat "${SSH_HOSTKEY_ARCHIVES_JENKINS_IO}" "${SSH_HOSTKEY_PKG_ORIGIN_JENKINS_IO}" >> "${HOME}/.ssh/known_hosts"
65+
cat "${SSH_HOSTKEY_ARCHIVES_JENKINS_IO}" >> "${HOME}/.ssh/known_hosts"
6066
ssh -v mirrorsync@archives.jenkins.io whoami
61-
ssh -v mirrorbrain@pkg.origin.jenkins.io whoami
6267
'''
6368
}
6469
}
@@ -95,6 +100,14 @@ pipeline {
95100
container('dotnet') {
96101
powershell 'msbuild -version'
97102
}
103+
104+
container('dotnet') {
105+
checkout scm
106+
// Ensure we can get the secondary git repository used for packaging
107+
dir (WORKING_DIRECTORY) {
108+
git branch: PACKAGING_GIT_BRANCH, url: PACKAGING_GIT_REPOSITORY
109+
}
110+
}
98111
}
99112
}
100113
}

‎PodTemplates.d/package-windows.yaml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ metadata:
1111
spec:
1212
serviceAccountName: release-ci-jenkins-io-agents
1313
containers:
14-
- image: jenkins/inbound-agent:3355.v388858a_47b_33-3-jdk21-nanoserver-1809
14+
- image: jenkins/inbound-agent:3355.v388858a_47b_33-3-jdk21-nanoserver-ltsc2022
1515
imagePullPolicy: "IfNotPresent"
1616
name: "jnlp"
1717
env:
@@ -31,7 +31,7 @@ spec:
3131
- Start-Sleep -s 2147483 # We must be sure that the process used by the container doesn't stop before the Jenkins job and second is not greater than 2147483
3232
command:
3333
- "powershell.exe"
34-
image: "mcr.microsoft.com/dotnet/framework/sdk:3.5"
34+
image: "mcr.microsoft.com/dotnet/framework/sdk:3.5-windowsservercore-ltsc2022"
3535
imagePullPolicy: "IfNotPresent"
3636
name: "dotnet"
3737
resources:
@@ -45,13 +45,17 @@ spec:
4545
privileged: false
4646
tty: false
4747
nodeSelector:
48-
kubernetes.azure.com/agentpool: w2019
48+
kubernetes.azure.com/agentpool: w2022
4949
kubernetes.io/os: windows
5050
tolerations:
5151
- key: "os"
5252
operator: "Equal"
5353
value: "windows"
5454
effect: "NoSchedule"
55+
- key: "version"
56+
operator: "Equal"
57+
value: "windows2022"
58+
effect: "NoSchedule"
5559
- key: "jenkins"
5660
operator: "Equal"
5761
value: "release.ci.jenkins.io"

‎README.adoc‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,8 @@ All steps need to be done twice: Once for weekly, once for LTS.
365365

366366
==== Staging (before release day)
367367

368+
===== Maven Artifacts
369+
368370
To stage the Maven artifacts, trigger the generic Release link:https://release.ci.jenkins.io/job/core/job/release/[job] from the appropriate branch like `security-stable-2.303.2`.
369371

370372
To do that, follow these steps:
@@ -377,16 +379,35 @@ To do that, follow these steps:
377379
... `MAVEN_REPOSITORY_NAME` set to `unused` as we already define it in the release profile file, which overrides the job parameter
378380
... `VALIDATION_ENABLED` set to true if the validation stage should run
379381

380-
==== Publishing (on release day)
382+
===== Packages
381383

382-
. To create and publish packages, trigger the generic Packaging job link:https://release.ci.jenkins.io/job/core/job/package/[job] from the appropriate branch like `security-stable-2.303.2` with correct parameters
384+
. To create and stage packages (except Docker images), trigger the generic Packaging job link:https://release.ci.jenkins.io/job/core/job/package/[job] from the appropriate branch like `security-stable-2.303.2` with correct parameters
383385
.. `RELEASE_PROFILE` set to `security`
386+
.. `JENKINS_VERSION` set to `unused` same reason as before
384387
.. `RELEASE_GIT_BRANCH` set to `unused` same reason as before
385388
.. `MAVEN_REPOSITORY_NAME` set to `unused` same reason as before
386-
.. `MAVEN_REPOSITORY_PRODUCTION_NAME` set to `unused`
389+
.. `MAVEN_REPOSITORY_PRODUCTION_NAME` set to `unused` same reason as before
390+
.. `MAVEN_STAGING_REPOSITORY_PROMOTION_ENABLED` set to false (manually done by publishing-tool in a parallel process)
391+
.. `GIT_STAGING_REPOSITORY_PROMOTION_ENABLED` set to false (manually merged by security team)
392+
.. `VALIDATION_ENABLED` set to true (we want a summary of what need to be done at the beginning)
393+
.. `WINDOWS_PACKAGING_ENABLED` set to true (we want to generate and stage Windows package along with other packages)
394+
.. `ONLY_STAGING_PARAM` set to true (we only want to stage, not publish)
395+
.. `ONLY_PROMOTION_PARAM` set to false (we only want to stage, not publish)
396+
397+
==== Publishing (on release day)
398+
399+
. To publish packages from staging, trigger the generic Packaging job link:https://release.ci.jenkins.io/job/core/job/package/[job] from the appropriate branch like `security-stable-2.303.2` with correct parameters
400+
.. `RELEASE_PROFILE` set to `security`
401+
.. `JENKINS_VERSION` set to `unused` same reason as before
402+
.. `RELEASE_GIT_BRANCH` set to `unused` same reason as before
403+
.. `MAVEN_REPOSITORY_NAME` set to `unused` same reason as before
404+
.. `MAVEN_REPOSITORY_PRODUCTION_NAME` set to `unused` same reason as before
387405
.. `MAVEN_STAGING_REPOSITORY_PROMOTION_ENABLED` set to false (manually done by publishing-tool in a parallel process)
388406
.. `GIT_STAGING_REPOSITORY_PROMOTION_ENABLED` set to false (manually merged by security team)
389-
.. `VALIDATION_ENABLED` set to true
407+
.. `VALIDATION_ENABLED` set to true (we want a summary of what need to be done at the beginning)
408+
.. `WINDOWS_PACKAGING_ENABLED` set to **false** (no package generation)
409+
.. `ONLY_STAGING_PARAM` set to **false** (we don't want to stage anything)
410+
.. `ONLY_PROMOTION_PARAM` set to **true** (we only want to publish)
390411

391412
== Certificate
392413

‎env/package.mk‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#
22
# Environment definition for the packaging process
33
#
4+
# Note: avoid double quotes in this file (make interpret them as literal characters)
45

56
# where to put binary files
67
export WARDIR=${BASE_BIN_DIR}/war${RELEASELINE}
@@ -17,3 +18,6 @@ export DEB_WEBDIR=${BASE_PKG_DIR}/debian${RELEASELINE}
1718
WEBSERVER=https://pkg.jenkins.io
1819
export RPM_URL=${WEBSERVER}/rpm${RELEASELINE}
1920
export DEB_URL=${WEBSERVER}/debian${RELEASELINE}
21+
22+
# Exposed GPG public key
23+
export GPG_PUBLIC_KEY_FILENAME=jenkins.io-2026.key

‎profile.d/experimental‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ RELEASE_GIT_REPOSITORY=git@github.com:olblak/jenkins.git
33
JENKINS_VERSION=latest
44
GIT_EMAIL=66998184+jenkins-release-bot@users.noreply.github.com
55
GIT_NAME="Jenkins Release Bot"
6-
GPG_KEYNAME="63667EE74BBA1F0A08A698725BA31D57EF5975CA"
7-
GPG_VAULT_NAME="jenkins-release-pgp-2023"
6+
GPG_KEYNAME="5E386EADB55F01504CAE8BCF7198F4B714ABFC68"
7+
GPG_VAULT_NAME="jenkins-release-pgp-2026"
88
MAVEN_REPOSITORY_URL='https://repo.jenkins-ci.org'
99
MAVEN_REPOSITORY_NAME=olblak-sandbox
1010
MAVEN_PUBLIC_JENKINS_REPOSITORY_MIRROR_URL='https://repo.jenkins-ci.org/public/'

‎profile.d/security‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ RELEASE_GIT_REPOSITORY=git@github.com:jenkinsci-cert/jenkins.git
99
#
1010
GIT_EMAIL=66998184+jenkins-release-bot@users.noreply.github.com
1111
GIT_NAME="Jenkins Release Bot"
12-
GPG_KEYNAME="63667EE74BBA1F0A08A698725BA31D57EF5975CA"
13-
GPG_VAULT_NAME="jenkins-release-pgp-2023"
12+
GPG_KEYNAME="5E386EADB55F01504CAE8BCF7198F4B714ABFC68"
13+
GPG_VAULT_NAME="jenkins-release-pgp-2026"
1414
MAVEN_REPOSITORY_URL=https://repo.jenkins-ci.org
1515
MAVEN_PUBLIC_JENKINS_REPOSITORY_MIRROR_URL='https://repo.jenkins-ci.org/public/'
1616
SIGN_ALIAS=jenkins

‎profile.d/stable‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ RELEASE_GIT_BRANCH=stable-2.541
66
RELEASE_GIT_REPOSITORY=git@github.com:jenkinsci/jenkins.git
77
GIT_EMAIL=66998184+jenkins-release-bot@users.noreply.github.com
88
GIT_NAME="Jenkins Release Bot"
9-
GPG_KEYNAME="63667EE74BBA1F0A08A698725BA31D57EF5975CA"
10-
GPG_VAULT_NAME="jenkins-release-pgp-2023"
9+
GPG_KEYNAME="5E386EADB55F01504CAE8BCF7198F4B714ABFC68"
10+
GPG_VAULT_NAME="jenkins-release-pgp-2026"
1111
MAVEN_REPOSITORY_URL='https://repo.jenkins-ci.org'
1212
MAVEN_REPOSITORY_NAME=releases
1313
MAVEN_PUBLIC_JENKINS_REPOSITORY_MIRROR_URL='https://repo.jenkins-ci.org/public/'

0 commit comments

Comments
 (0)