Issue
After upgrading to 2.332.1.5 and using a plugin catalog (not the Configuration as Code (CasC) one) it is not posible to install CAP plugins in an air-gapped environment.
When trying to install some of the available CAP plugins the following execeptions can be seen:
Also then following log messages are present in your instance logs:
2022-03-29 12:16:45.724+0000 [id=61979] INFO hudson.PluginManager#install: Starting installation of a batch of 4 plugins plus their dependencies 2022-03-29 12:16:45.725+0000 [id=61979] INFO hudson.model.UpdateSite$Plugin#deploy: Adding dependent install of maven-plugin for plugin conditional-buildstep 2022-03-29 12:16:45.725+0000 [id=82096] INFO h.model.UpdateCenter$DownloadJob#run: Starting the installation of cloudbees-pipeline-policies on behalf of sperts 2022-03-29 12:16:45.725+0000 [id=61979] INFO hudson.model.UpdateSite$Plugin#deploy: Adding dependent install of javadoc for plugin maven-plugin 2022-03-29 12:16:45.726+0000 [id=61979] INFO hudson.model.UpdateSite$Plugin#deploy: Adding dependent install of run-condition for plugin conditional-buildstep 2022-03-29 12:16:45.726+0000 [id=82096] INFO h.m.UpdateCenter$UpdateCenterConfiguration#download: Downloading cloudbees-pipeline-policies 2022-03-29 12:16:45.732+0000 [id=82096] INFO hudson.model.UpdateCenter#verifyChecksums: Attempt to verify a downloaded file (cloudbees-pipeline-policies.jpi.tmp) using SHA-512 or SHA-256 failed since your configured update site does not provide either of those checksums. Falling back to SHA-1. 2022-03-29 12:16:45.733+0000 [id=82096] INFO h.model.UpdateCenter$DownloadJob#run: Starting the installation of javadoc on behalf of sperts 2022-03-29 12:16:45.733+0000 [id=82096] INFO h.m.UpdateCenter$UpdateCenterConfiguration#download: Downloading javadoc 2022-03-29 12:16:45.736+0000 [id=82096] INFO hudson.model.UpdateCenter#verifyChecksums: Attempt to verify a downloaded file (javadoc.jpi.tmp) using SHA-512 or SHA-256 failed since your configured update site does not provide either of those checksums. Falling back to SHA-1. 2022-03-29 12:16:45.736+0000 [id=82096] SEVERE h.model.UpdateCenter$DownloadJob#run: Failed to install javadoc java.io.IOException: Downloaded file /var/jenkins_home/plugins/javadoc.jpi.tmp does not match expected SHA-1, expected '2cacmQkT9GAZtSplATykdJXjcpM=', actual '1R1r3SwZw8YOdMa+Ge7lJK58pVY=' at hudson.model.UpdateCenter.throwVerificationFailure(UpdateCenter.java:2059) at hudson.model.UpdateCenter.verifyChecksums(UpdateCenter.java:2112) at hudson.model.UpdateCenter$InstallationJob.replace(UpdateCenter.java:2292) at hudson.model.UpdateCenter$UpdateCenterConfiguration.install(UpdateCenter.java:1358) at hudson.model.UpdateCenter$DownloadJob._run(UpdateCenter.java:1896) at hudson.model.UpdateCenter$InstallationJob._run(UpdateCenter.java:2205) at hudson.model.UpdateCenter$DownloadJob.run(UpdateCenter.java:1867) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at hudson.remoting.AtmostOneThreadExecutor$Worker.run(AtmostOneThreadExecutor.java:121) at java.base/java.lang.Thread.run(Thread.java:829)
Environment
-
CloudBees CI (CloudBees Core) 2.332.1.5
-
CloudBees CI (CloudBees Core) on modern cloud platforms - Managed controller 2.332.1.5
-
CloudBees CI (CloudBees Core) on modern cloud platforms - Operations Center 2.332.1.5
-
CloudBees CI (CloudBees Core) on traditional platforms - Client controller 2.332.1.5
-
CloudBees CI (CloudBees Core) on traditional platforms - Operations Center 2.332.1.5
Explanation
At /WEB-INF/plugins/update-center.json the offline update center JSON file is defined. There for each plugin a sha1 hash is specified. The issue is that it is not encoded as expected by the runtime. At runtime, the plugin file sha1 is calculated and compared against the entry in the update-center.json. This comparison expects both values to be equal to consider the download (even if that it is using the file:// protocol) valid.