[JENKINS-75905] Include update site URL in signature verification in error messages

[adhamahmad]

Fixes #16784

This change improves the readability of signature verification error messages in the plugin manager UI.

• The update site URL is appended to error messages provide context.
• Users now see a concise message in the UI instead of a confusing error box dominated by stack trace details.

Testing done

• Added a unit test in UpdateSiteTest that simulates a signature verification failure.
• Verified that the resulting FormValidation error message contains the update site URL.
• Manually started Jenkins with a test update site containing an invalid signature as the original issue. Verified in the plugin manager UI that the error message is concise and includes the URL.

Screenshots (UI changes only)

Before

After

Proposed changelog entries

• Display a brief message on update site signature verification failure instead of showing a stack trace.

Proposed changelog category

/label bug

Proposed upgrade guidelines

N/A

Submitter checklist

• The issue, if it exists, is well-described.
• The changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developers, depending on the change) and are in the imperative mood (see examples). Fill in the Proposed upgrade guidelines section only if there are breaking changes or changes that may require extra steps from users during upgrade.
• There is automated testing or an explanation as to why this change has no tests.
• New public classes, fields, and methods are annotated with @Restricted or have @since TODO Javadocs, as appropriate.
• New deprecations are annotated with @Deprecated(since = "TODO") or @Deprecated(forRemoval = true, since = "TODO"), if applicable.
• UI changes do not introduce regressions when enforcing the current default rules of Content Security Policy Plugin. In particular, new or substantially changed JavaScript is not defined inline and does not call eval to ease future introduction of Content Security Policy (CSP) directives (see documentation).
• For dependency updates, there are links to external changelogs and, if possible, full differentials.
• For new APIs and extension points, there is a link to at least one consumer.

Desired reviewers

N/A

Before the changes are marked as ready-for-merge:

Maintainer checklist

• There are at least two (2) approvals for the pull request and no outstanding requests for change.
• Conversations in the pull request are over, or it is explicit that a reviewer is not blocking the change.
• Changelog entries in the pull request title and/or Proposed changelog entries are accurate, human-readable, and in the imperative mood.
• Proper changelog labels are set so that the changelog can be generated automatically.
• If the change needs additional upgrade steps from users, the upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the pull request title (see example).
• If it would make sense to backport the change to LTS, be a Bug or Improvement, and either the issue or pull request must be labeled as lts-candidate to be considered.

[welcome]

Yay, your first pull request towards Jenkins core was created successfully! Thank you so much!

A contributor will provide feedback soon. Meanwhile, you can join the chats and community forums to connect with other Jenkins users, developers, and maintainers.

[A1exKH]

@adhamahmad, LGTM!
Thank you for screenshots and covering it by adding unit test!

[MarkEWaite]

Thanks for the pull request. It looks good in general.

I have a question to clarify the text substitution, since I was unable to find any way to generate an exception message that would require the substitution.

I also offered two optional suggestions. You are welcome to ignore them if you don't find them to be helpful.

[adhamahmad]

Hey @MarkEWaite,

Thanks for the suggestions, I’ve applied the requested changes.

Regarding the text substitution logic: I added it cause I notcied that the error message shown in case of signature verification errors include escaped HTML characters and the literal default word: 'default' as shown in the attached screenshot, I was not able to determine where this escaping is introduced..

I assumed that the "update site … Path" message pattern was common, and that replacing that segment would both ensure the update site URL is included and avoid the escaped 'default' portion. After further investigation, this assumption turned out to be incorrect.

In the automated test, the actual error message does not match that pattern. The message produced is:

Signature verification failed in update site 'default': Empty input
(URL: http://localhost:51764/plugins/invalid-signature-update-center.json)

Since this message does not contain the "update site … Path" sequence, the substitution branch is not executed, and the code correctly falls back to appending the URL.

Since the escaped HTML content already exists before this code runs, I am unsure whether handling it here is appropriate or whether it should be left as it is or addressed elsewhere. Please advise on the preferred approach.

[MarkEWaite]

I assumed that the "update site … Path" message pattern was common, and that replacing that segment would both ensure the update site URL is included and avoid the escaped 'default' portion.

I like that technique. That's a creative way to avoid showing a poorly formatted string to the user. It handles the issue as reported and you also handle the more general case. I think that your solution is a very reasonable choice. In both cases, the URL of the update site is shown and the stack trace is not shown.

[MarkEWaite]

This PR is now ready for merge. We will merge it after approximately 24 hours if there is no negative feedback.

/label ready-for-merge

[welcome]

Congratulations on getting your very first Jenkins core pull request merged 🎉🥳

This is a fantastic achievement, and we're thrilled to have you as part of our community! Thank you for your valuable input, and we look forward to seeing more of your contributions in the future!

We would like to invite you to join the community chats and forums to meet other Jenkins contributors 😊
Don't forget to check out the participation page to learn more about how to contribute to Jenkins.