我目前正在尝试让Jenkins构建在GitHub企业级存储库中托管的项目。 我们使用自签名证书来保护GitHub服务器,这导致了一些问题。
我已经成功解决了大部分问题:
Git命令行:
获取PEM格式的证书并教会git使用.config文件查找信息:
[http "https://github.*******************.com"]
sslCAInfo = "path\\to\\selvSignedCerts\\fileName.pem"
sslCAPath = "path\\to\\selvSignedCerts\\"
sslVerify = true
Jenkins GitHub 插件:
将证书信息添加到 Java cacerts 密钥库中:
keytool -import -trustcacerts -alias myAlias
-keystore "%JenkinsInstallDir\jre\lib\security\cacerts"
-file "myCertsInfo.pem"
将信息导入密钥库后重新启动Jenkins最终解决了问题,因此我能够在
管理Jenkins -> 配置系统 -> GitHub企业服务器 -> API端点
由于以下原因,以前无法进行此配置:
SSL certificate problem: self signed certificate in certificate chain
现在,我的git命令行很好用,Jenkins中的GitHub插件也很好用,这意味着Jenkins本身很好用,但是git-client插件显然不好用。
我在Jenkins中创建了一个GitHub组织任务,指定链接到企业服务器上的组织。配置使用在全局jenkins设置中配置的API端点,使用配置凭据,并查找具有默认名称Jenkinsfile的流水线文件。
该任务能够执行检出操作,识别两个分支,在每个分支中找到相应的Jenkinsfile。它还使用Jenkinsfile配置自动为每个分支创建了一个新任务。
Jenkinsfile目前看起来像这样:
#!/usr/bin/env groovy
pipeline {
agent any
stages {
stage('Scan for new jobs') {
steps {
echo 'Scanning...'
}
}
stage('Build') {
steps {
echo 'Build'
}
}
}
}
现在,流水线的第一步是隐式的源代码管理系统检出。但此步骤失败了,输出结果如下:
14:01:27 Connecting to https://github.*********.com/api/v3 using <userId>/******
Obtained Jenkinsfile from <commitHash>
[Pipeline] node
Running on Jenkins in D:\****\Jenkins\****\workspace\****
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Declarative: Checkout SCM)
[Pipeline] checkout
> C:\Program Files\Git\bin\git.exe rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
> C:\Program Files\Git\bin\git.exe config remote.origin.url https://github.****.com/***/***.git # timeout=10
Fetching without tags
Fetching upstream changes from https://github.****.com/***/***.git
> C:\Program Files\Git\bin\git.exe --version # timeout=10
using GIT_ASKPASS to set credentials
> C:\Program Files\Git\bin\git.exe fetch --no-tags --progress https://github.****.com/***/***.git +refs/heads/develop:refs/remotes/origin/develop
ERROR: Error fetching remote repo 'origin'
hudson.plugins.git.GitException: Failed to fetch from https://github.****.com/***/***.git
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:825)
at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1092)
at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1123)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:113)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:85)
at org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:75)
at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
at hudson.security.ACL.impersonate(ACL.java:260)
at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: hudson.plugins.git.GitException: Command "C:\Program Files\Git\bin\git.exe fetch --no-tags --progress https://github.****.com/***/***.git +refs/heads/develop:refs/remotes/origin/develop" returned status code 128:
stdout:
stderr: fatal: unable to access 'https://github.****.com/***/***.git/': SSL certificate problem: self signed certificate in certificate chain
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:1970)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1689)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$300(CliGitAPIImpl.java:71)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:380)
at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:823)
... 13 more
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
所以错误再次出现:
stderr: fatal: unable to access 'https://github.****.com/***/***.git/': SSL certificate problem: self signed certificate in certificate chain
现在看来,git客户端插件(或git插件)似乎不是在lib\security\cacerts密钥库中查找证书,也不关心.gitconfig文件。
那么我的问题是,这个插件将在哪里查找有效的证书?还是我有什么其他的疑问吗?
所有关于此问题或类似问题的研究都表明需要将证书添加到Java密钥库中,这一步我已经完成。我没有找到任何其他指向正确方向的信息。而且我大部分的疑问是,为什么GitHub组织工作可以很好地处理存储库,检测所有的分支,检出并处理Jenkinsfile和其他工作(我手动创建了一个自由样式的工作,以检查它是否能够检出repo - 结果仍然是无法访问自签名证书问题...) 环境: Jenkins运行在Windows 7 x64上 git版本1.9.4.msysgit.0 Jenkins版本:2.73.2 Java JRE:1.8.0_144-b01 插件: git 3.6.3 git-client 2.6.0 git-server 1.7 github 1.28.1 github-api 1.90