{"action":"created","comment":{"url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/comments/116372741","pull_request_review_id":37992687,"id":116372741,"diff_hunk":"@@ -75,8 +75,20 @@ else\n \t\tfi\n \tfi\n \n+\t# JENKINS_CA_CERT points a path for ca cert (possibly mounted as a secret volume)\n+\tif [ -n \"$JENKINS_CA_CERT\" ]; then\n+\t\tjre_keystore=/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts\n+\t\tkeystore_dir=$HOME/.keystore\n+\t\tmkdir -p $keystore_dir\n+\t\tcp $jre_keystore $keystore_dir\n+\t\tcat $JENKINS_CA_CERT > /tmp/cacert\n+\t\tkeytool -import -keystore $keystore_dir/cacerts -alias master -file /tmp/cacert -storepass changeit -noprompt\n+\t\trm /tmp/cacert\n+\t\tTRUSTSTORE=\"-Djavax.net.ssl.trustStore=$HOME/.keystore/cacerts -Djavax.net.ssl.trustStorePassword=changeit\"\n+\tfi\n+\n \t#TODO: Handle the case when the command-line and Environment variable contain different values.\n \t#It is fine it blows up for now since it should lead to an error anyway.\n \n-\texec java $JAVA_OPTS $JNLP_PROTOCOL_OPTS -cp /usr/share/jenkins/slave.jar hudson.remoting.jnlp.Main -headless $TUNNEL $URL $OPT_JENKINS_SECRET $OPT_JENKINS_AGENT_NAME \"$@\"\n+\texec java $JAVA_OPTS $TRUSTSTORE $JNLP_PROTOCOL_OPTS -cp /usr/share/jenkins/slave.jar hudson.remoting.jnlp.Main -headless $TUNNEL $URL $OPT_JENKINS_SECRET $OPT_JENKINS_AGENT_NAME \"$@\"","path":"jenkins-slave","position":20,"original_position":20,"commit_id":"74b30451a2f5cfc94d5fe76a5e5b188d1e1ed5e4","original_commit_id":"74b30451a2f5cfc94d5fe76a5e5b188d1e1ed5e4","user":{"login":"oleg-nenashev","id":3000480,"avatar_url":"https://avatars3.githubusercontent.com/u/3000480?v=3","gravatar_id":"","url":"https://api.github.com/users/oleg-nenashev","html_url":"https://github.com/oleg-nenashev","followers_url":"https://api.github.com/users/oleg-nenashev/followers","following_url":"https://api.github.com/users/oleg-nenashev/following{/other_user}","gists_url":"https://api.github.com/users/oleg-nenashev/gists{/gist_id}","starred_url":"https://api.github.com/users/oleg-nenashev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oleg-nenashev/subscriptions","organizations_url":"https://api.github.com/users/oleg-nenashev/orgs","repos_url":"https://api.github.com/users/oleg-nenashev/repos","events_url":"https://api.github.com/users/oleg-nenashev/events{/privacy}","received_events_url":"https://api.github.com/users/oleg-nenashev/received_events","type":"User","site_admin":false},"body":"With such approach any user job can access the truststore and to add additional certificates there. It seems like a serious security risk to me. Maybe the password should require external definition in a secure way.","created_at":"2017-05-14T05:33:30Z","updated_at":"2017-05-14T05:33:56Z","html_url":"https://github.com/jenkinsci/docker-jnlp-slave/pull/38#discussion_r116372741","pull_request_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38","_links":{"self":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/comments/116372741"},"html":{"href":"https://github.com/jenkinsci/docker-jnlp-slave/pull/38#discussion_r116372741"},"pull_request":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38"}}},"pull_request":{"url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38","id":120473220,"html_url":"https://github.com/jenkinsci/docker-jnlp-slave/pull/38","diff_url":"https://github.com/jenkinsci/docker-jnlp-slave/pull/38.diff","patch_url":"https://github.com/jenkinsci/docker-jnlp-slave/pull/38.patch","issue_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues/38","number":38,"state":"open","locked":false,"title":"Set custom truststore if JENKINS_CA_CERT env variable is set.","user":{"login":"TamalSaha","id":94814,"avatar_url":"https://avatars2.githubusercontent.com/u/94814?v=3","gravatar_id":"","url":"https://api.github.com/users/TamalSaha","html_url":"https://github.com/TamalSaha","followers_url":"https://api.github.com/users/TamalSaha/followers","following_url":"https://api.github.com/users/TamalSaha/following{/other_user}","gists_url":"https://api.github.com/users/TamalSaha/gists{/gist_id}","starred_url":"https://api.github.com/users/TamalSaha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TamalSaha/subscriptions","organizations_url":"https://api.github.com/users/TamalSaha/orgs","repos_url":"https://api.github.com/users/TamalSaha/repos","events_url":"https://api.github.com/users/TamalSaha/events{/privacy}","received_events_url":"https://api.github.com/users/TamalSaha/received_events","type":"User","site_admin":false},"body":"If users using private certificate with Jenkins master wants\r\nto use JNLP 4 protocol, they should set the JENKINS_CA_CERT\r\nenv variable to path of the PEM encoded bytes of ca certificate file.\r\n\r\nFixes #17 ","created_at":"2017-05-14T04:47:28Z","updated_at":"2017-05-14T05:33:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1bf2c94c3187be30aaba8d9731b2051233c65ee3","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38/commits","review_comments_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38/comments","review_comment_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues/38/comments","statuses_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/statuses/74b30451a2f5cfc94d5fe76a5e5b188d1e1ed5e4","head":{"label":"appscode-ci:jnlp-4","ref":"jnlp-4","sha":"74b30451a2f5cfc94d5fe76a5e5b188d1e1ed5e4","user":{"login":"appscode-ci","id":25044081,"avatar_url":"https://avatars1.githubusercontent.com/u/25044081?v=3","gravatar_id":"","url":"https://api.github.com/users/appscode-ci","html_url":"https://github.com/appscode-ci","followers_url":"https://api.github.com/users/appscode-ci/followers","following_url":"https://api.github.com/users/appscode-ci/following{/other_user}","gists_url":"https://api.github.com/users/appscode-ci/gists{/gist_id}","starred_url":"https://api.github.com/users/appscode-ci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/appscode-ci/subscriptions","organizations_url":"https://api.github.com/users/appscode-ci/orgs","repos_url":"https://api.github.com/users/appscode-ci/repos","events_url":"https://api.github.com/users/appscode-ci/events{/privacy}","received_events_url":"https://api.github.com/users/appscode-ci/received_events","type":"Organization","site_admin":false},"repo":{"id":88864341,"name":"docker-jnlp-slave","full_name":"appscode-ci/docker-jnlp-slave","owner":{"login":"appscode-ci","id":25044081,"avatar_url":"https://avatars1.githubusercontent.com/u/25044081?v=3","gravatar_id":"","url":"https://api.github.com/users/appscode-ci","html_url":"https://github.com/appscode-ci","followers_url":"https://api.github.com/users/appscode-ci/followers","following_url":"https://api.github.com/users/appscode-ci/following{/other_user}","gists_url":"https://api.github.com/users/appscode-ci/gists{/gist_id}","starred_url":"https://api.github.com/users/appscode-ci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/appscode-ci/subscriptions","organizations_url":"https://api.github.com/users/appscode-ci/orgs","repos_url":"https://api.github.com/users/appscode-ci/repos","events_url":"https://api.github.com/users/appscode-ci/events{/privacy}","received_events_url":"https://api.github.com/users/appscode-ci/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/appscode-ci/docker-jnlp-slave","description":"Docker image to run a JNLP slave","fork":true,"url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave","forks_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/forks","keys_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/keys{/key_id}","collaborators_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/teams","hooks_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/hooks","issue_events_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/issues/events{/number}","events_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/events","assignees_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/assignees{/user}","branches_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/branches{/branch}","tags_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/tags","blobs_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/git/refs{/sha}","trees_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/git/trees{/sha}","statuses_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/statuses/{sha}","languages_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/languages","stargazers_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/stargazers","contributors_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/contributors","subscribers_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/subscribers","subscription_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/subscription","commits_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/commits{/sha}","git_commits_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/git/commits{/sha}","comments_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/comments{/number}","issue_comment_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/issues/comments{/number}","contents_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/contents/{+path}","compare_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/compare/{base}...{head}","merges_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/merges","archive_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/downloads","issues_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/issues{/number}","pulls_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/pulls{/number}","milestones_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/milestones{/number}","notifications_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/labels{/name}","releases_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/releases{/id}","deployments_url":"https://api.github.com/repos/appscode-ci/docker-jnlp-slave/deployments","created_at":"2017-04-20T12:41:39Z","updated_at":"2017-04-20T12:41:41Z","pushed_at":"2017-05-14T04:48:51Z","git_url":"git://github.com/appscode-ci/docker-jnlp-slave.git","ssh_url":"git@github.com:appscode-ci/docker-jnlp-slave.git","clone_url":"https://github.com/appscode-ci/docker-jnlp-slave.git","svn_url":"https://github.com/appscode-ci/docker-jnlp-slave","homepage":null,"size":21,"stargazers_count":0,"watchers_count":0,"language":"Shell","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"jenkinsci:master","ref":"master","sha":"4b99d8d92b562fcd72d180f8897122a24d5d8c02","user":{"login":"jenkinsci","id":107424,"avatar_url":"https://avatars3.githubusercontent.com/u/107424?v=3","gravatar_id":"","url":"https://api.github.com/users/jenkinsci","html_url":"https://github.com/jenkinsci","followers_url":"https://api.github.com/users/jenkinsci/followers","following_url":"https://api.github.com/users/jenkinsci/following{/other_user}","gists_url":"https://api.github.com/users/jenkinsci/gists{/gist_id}","starred_url":"https://api.github.com/users/jenkinsci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jenkinsci/subscriptions","organizations_url":"https://api.github.com/users/jenkinsci/orgs","repos_url":"https://api.github.com/users/jenkinsci/repos","events_url":"https://api.github.com/users/jenkinsci/events{/privacy}","received_events_url":"https://api.github.com/users/jenkinsci/received_events","type":"Organization","site_admin":false},"repo":{"id":41536031,"name":"docker-jnlp-slave","full_name":"jenkinsci/docker-jnlp-slave","owner":{"login":"jenkinsci","id":107424,"avatar_url":"https://avatars3.githubusercontent.com/u/107424?v=3","gravatar_id":"","url":"https://api.github.com/users/jenkinsci","html_url":"https://github.com/jenkinsci","followers_url":"https://api.github.com/users/jenkinsci/followers","following_url":"https://api.github.com/users/jenkinsci/following{/other_user}","gists_url":"https://api.github.com/users/jenkinsci/gists{/gist_id}","starred_url":"https://api.github.com/users/jenkinsci/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jenkinsci/subscriptions","organizations_url":"https://api.github.com/users/jenkinsci/orgs","repos_url":"https://api.github.com/users/jenkinsci/repos","events_url":"https://api.github.com/users/jenkinsci/events{/privacy}","received_events_url":"https://api.github.com/users/jenkinsci/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/jenkinsci/docker-jnlp-slave","description":"Docker image to run a JNLP slave","fork":false,"url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave","forks_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/forks","keys_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/teams","hooks_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/hooks","issue_events_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues/events{/number}","events_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/events","assignees_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/assignees{/user}","branches_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/branches{/branch}","tags_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/tags","blobs_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/git/refs{/sha}","trees_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/statuses/{sha}","languages_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/languages","stargazers_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/stargazers","contributors_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/contributors","subscribers_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/subscribers","subscription_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/subscription","commits_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/commits{/sha}","git_commits_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/git/commits{/sha}","comments_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/comments{/number}","issue_comment_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues/comments{/number}","contents_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/contents/{+path}","compare_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/merges","archive_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/downloads","issues_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues{/number}","pulls_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls{/number}","milestones_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/milestones{/number}","notifications_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/labels{/name}","releases_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/releases{/id}","deployments_url":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/deployments","created_at":"2015-08-28T08:28:21Z","updated_at":"2017-04-27T16:07:40Z","pushed_at":"2017-05-14T04:48:51Z","git_url":"git://github.com/jenkinsci/docker-jnlp-slave.git","ssh_url":"git@github.com:jenkinsci/docker-jnlp-slave.git","clone_url":"https://github.com/jenkinsci/docker-jnlp-slave.git","svn_url":"https://github.com/jenkinsci/docker-jnlp-slave","homepage":null,"size":17,"stargazers_count":47,"watchers_count":47,"language":"Shell","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":87,"mirror_url":null,"open_issues_count":4,"forks":87,"open_issues":4,"watchers":47,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38"},"html":{"href":"https://github.com/jenkinsci/docker-jnlp-slave/pull/38"},"issue":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues/38"},"comments":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/issues/38/comments"},"review_comments":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38/comments"},"review_comment":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/pulls/38/commits"},"statuses":{"href":"https://api.github.com/repos/jenkinsci/docker-jnlp-slave/statuses/74b30451a2f5cfc94d5fe76a5e5b188d1e1ed5e4"}}}}
{"actor":{"display_login":"oleg-nenashev"}}