Conversation
Install Jenkins 2.568.2 from the official LTS repository with the 2026 signing key, exact package metadata, and Debian OpenJDK 21. Correct the old weekly-channel source and keep generated and firstboot credentials out of command traces and process arguments. Add a supervised non-mutating updater and focused acceptance for HTTPS admin authentication, a successful persistent build job, CLI and VCS integrations, plugins, mail, and administration modules. Exact runtime acceptance remains pending on the known shared runner blocker; syntax and retained signed-repository gates pass.
Avoid early-exit consumers under pipefail in the supervised updater and focused acceptance. This prevents successful APT metadata, key inspection, CLI, Java, or build-console checks from being misreported when their producer sees SIGPIPE. Keep the validation scope unchanged: the appliance still proves the Jenkins LTS candidate, repository identity, Java 21, CLI version, and real freestyle build marker.
The Jenkins virtual host uses SSLEngine, but the build started Apache before mod_ssl was enabled. Enable the Debian SSL module alongside the existing proxy modules so the HTTPS reverse proxy can start and the appliance can proceed to its normal setup flow. Verified with bash syntax and whitespace checks; exact appliance validation follows.
Enabling mod_ssl alone leaves the Jenkins HTTPS virtual host without TurnKey's default certificate and cipher configuration, so Apache still cannot start during the appliance build. Run the existing shared apache-ssl configuration and remove the redundant product-local module enablement. The prior exact run 20260826t140805z-4031-16671 reproduced the build failure after the first TLS fix. Bash syntax and whitespace checks pass; the next exact run will verify Apache startup and the normal Jenkins flow.
The focused acceptance script assumed jq was installed even though Jenkins and the Core base do not require or provide it. Use Python's standard JSON library for the controller, authentication, crumb, job, and build fields so acceptance does not expand the shipped appliance for a test utility. Verified valid fields and rejection of malformed, missing, null, and false values, plus Bash syntax, ShellCheck, and whitespace checks. This is an acceptance-only correction and consumes no product fix loop.
Trixie's file utility reports the downloaded Jenkins CLI as a ZIP archive even though it is a valid executable JAR. The build therefore redownloaded the same 12 MB artifact until its readiness loop expired. Use the JDK jar tool that the appliance already installs to validate the archive structure. Exact run 20260826t142117z-4992-16165 proved Apache and Jenkins startup before reproducing this mismatch; Bash and whitespace checks pass.
Jenkins 2.568.2 rejects CLI requests until its root URL is configured. The appliance created the administrator, attempted every CLI plugin install, and only then submitted the existing setup-wizard root URL transition, causing the first plugin request to fail with HTTP 403. Move that existing configuration POST immediately after administrator creation so every CLI consumer sees a configured Jenkins instance. Startup, authentication, plugin selection, and shutdown behavior remain unchanged. Bash syntax, ShellCheck, whitespace, and explicit ordering assertions pass.
The exact runtime test exited immediately after Apache syntax validation without identifying the failing assertion, leaving a proven appliance fix unclassified. Add the same minimal ERR trap used by other v19 acceptance scripts so failures report line, status, and command while successful tests remain silent. This changes only test diagnostics and consumes no product fix loop. Bash syntax, ShellCheck, whitespace, and focused success and failure propagation checks pass.
The build shell treated the brace range in the CLI download loop as one literal item. A normal Jenkins warm-up 503 therefore received only one attempt and the terminal JAR assertion failed after three seconds. Use a Bash arithmetic loop so the existing 60-attempt boundary works even when brace expansion is disabled. Preserve the download, JAR validation, sleep interval, and terminal failure assertion unchanged. Bash syntax and whitespace checks pass. Focused disabled-brace probes recover after a transient first failure and perform all 60 attempts before propagating a terminal failure.
Jenkins can finish administrator and root URL setup before its asynchronous default update-site download completes. The first short-name plugin install then fails because no signed update-center data is available. Synchronously refresh the default update site through Jenkins after administrator setup and require the first requested plugin to resolve before entering the existing installation loop. This preserves Jenkins signature validation and fails before partial plugin installation if metadata is unavailable. Record the final product-loop boundary and retained exact evidence. Bash syntax, whitespace, official symbol checks, and focused metadata-success and failure-propagation probes pass.
Exact acceptance kept the Jenkins JVM healthy but received HTTP 503 from the HTTPS CLI endpoint through the existing three-minute readiness boundary. The update-center correction could not run because the build stopped before downloading the CLI JAR. Double only the existing attempt count while preserving the three-second interval, archive validation, and terminal failure assertion. This gives the pinned Jenkins LTS up to six minutes to expose its CLI without adding probes or changing test infrastructure. Record both exact failures and the retained evidence hashes. Bash syntax, whitespace, ordering, and focused last-attempt success and terminal-failure boundary probes pass. This remains a refinement of product loop 6.
SetupWizard could wait indefinitely when the canonical stable metadata path redirected to an unresponsive Jenkins archive endpoint. Start the image-build controller with package-supported Java connection timeouts and preseed a reachable member of the official Jenkins mirror network so ordinary setup can complete. Require signature validation, successful metadata refresh, and SHA-256 metadata for every requested plugin before retaining the normal Jenkins CLI installation flow. Restore the canonical update center and remove the temporary JVM override before sealing so deployed appliances retain package defaults. Verified shell and Python syntax, diff hygiene, timeout state ordering, the Debian package systemd override contract, all requested signed metadata entries, a canonical plugin download checksum, and bounded URLConnection read behavior.
The exact run reached normal firstboot with Apache, Jenkins, and Postfix active, then stopped on a redundant static enablement query before testing application behavior. Normal boot activity already proves the required units participate in the ordinary startup path. Remove only that acceptance query and the equivalent build-time systemctl show probe that the fab compatibility shim cannot implement. Preserve active-service checks, timeout-file removal, runtime JVM-environment absence, canonical update-center evidence, and every Jenkins identity test. Verified shell syntax, diff hygiene, documentation style, and focused source assertions for the retained runtime boundaries.
Runtime acceptance passed the Apache HTTPS login, then forced the Jenkins CLI through that proxy address even though the shipped wrapper is configured for authenticated local use. Jenkins rejected the mismatched WebSocket origin before the remaining identity checks could run. Source the shipped Jenkins environment and run the authenticated wrapper against its default loopback endpoint. Keep the independent HTTPS web assertions unchanged so both documented paths retain direct evidence. Verified shell syntax, diff and documentation hygiene, source alignment with the build-proven wrapper invocation, and preservation of the HTTPS API checks.
Modern Jenkins binds CSRF crumbs to the HTTP session. The acceptance helper fetched a valid crumb but discarded its session cookie, so the authenticated createItem request was rejected with HTTP 403 before the identity flow could run. Give the existing curl helper a private cookie jar under its already-restricted temporary directory. Authentication, crumb validation, and all job assertions remain unchanged. Verified shell syntax, ShellCheck when available, diff hygiene, and a focused local GET/POST flow that rejects a missing cookie and accepts the persisted session cookie.
Exact run 20260827t072754z-6226-13901 passed the appliance build, import, normal initialization, authenticated web and CLI paths, plugin-backed job lifecycle, restart persistence, supervised updater check, and cleanup at candidate ea39b51. Record the retained report and run-log hashes, the preceding session-bound crumb false negative, and the README-aligned local CLI contract. Product behavior is unchanged; this commit seals evidence for independent review. Verified the complete artifact manifest, report PASS status, source archive identity, shell and Python syntax, ShellCheck when available, documentation hygiene, and a docs-only diff.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
20260827t072754z-6226-13901tested product candidateea39b51d98ef8arecords administrator login, authenticated CLI, freestyle job execution, restart persistence, plugins, tools, Postfix, Webmin, and updater checksgit diff --check origin/master...d98ef8a