+ https://en.wikipedia.org/wiki/Road_signs_in_Singapore[ + image:https://upload.wikimedia.org/wikipedia/commons/thumb/f/f7/Singapore_Road_Signs_-_Restrictive_Sign_-_Stop_-_Security_Check.svg/240px-Singapore_Road_Signs_-_Restrictive_Sign_-_Stop_-_Security_Check.svg.png[image] + ] + + + I suspect many of you have been impacted by https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271[CVE-2014-6271] (aka "shellshock" bash vulnerability.) We had our share of updates to do for various *.jenkins-ci.org servers. + + + Java application servers in general (including one that ships in Jenkins) do not fork off processes like Apache does to serve requests, so the kind of CGI attacks you see on Apache does not apply. We are currently unaware of any vulnerabilities in Jenkins related to CVE-2014-6271, and no plan to issue a patch for that. + + + That said, we did come up with one possible way attackers can exploit vulnerable bash through Jenkins, that you might want to be aware of. + + + When a build is parameterized, parameters are passed to the processes Jenkins launch as environment variables. So if you have a shell step (which uses `+bash+` by default), and if Eve only has a BUILD permission but not CONFIGURE permission, then Eve can exploit this vulnerability by carefully crafting parameter values, and have the bash runs arbitrary processes on the agent that run the build. + + + In most such scenarios, Eve would have to be an authenticated user on Jenkins. Jenkins also leaves the record of who triggered what build with what parameters, so there's an audit trail. But if your Jenkins fits this description, hopefully this serves as one more reason to update your bash. + + + Finally, to get notified of future security advisories from Jenkins, see https://wiki.jenkins.io/display/JENKINS/Security+Advisories[this Wiki page].

+ image:https://jenkins-ci.org/sites/default/files/images/JavaOne.png[image] + + + + There'll be several talks that touch Jenkins. The first is from me and Jesse called https://oracleus.activeevents.com/2014/connect/sessionDetail.ww?SESSION_ID=3387[Next Step in Automation: Elastic Build Environment [CON3387]] Monday 12:30pm. + + + Then later Tuesday, there's https://oracleus.activeevents.com/2014/connect/sessionDetail.ww?SESSION_ID=11237[Building a Continuous Delivery Pipeline with Gradle and Jenkins [CON11237]] from Benjamin Muschko of Gradleware. + + + Thursday has several Jenkins talks. One is https://oracleus.activeevents.com/2014/connect/sessionDetail.ww?SESSION_ID=1880[The Deploy Factory: Open Source Tools for Java Deployment [CON1880]] from Bruno Souza (aka the Java Man from Brazil) and Edson Yanaga. In this same time slot, guys from eBay are doing https://oracleus.activeevents.com/2014/connect/sessionDetail.ww?SESSION_ID=5685[Platform Upgrades as a Service [CON5685]], which discusses how they rely on automation to make platform upgrades painless. Then https://oracleus.activeevents.com/2014/connect/sessionDetail.ww?SESSION_ID=1844[Mastering Continuous Delivery and DevOps [CON1844]] from Michael Huttermann. + + + In https://www.oracle.com/javaone/exhibit.html[the exhibit area], the Jenkins project doesn't have its own booth (JavaOne is too expensive for that), but I'll be at https://www.oracle.com/us/assets/javaone-14-hilton-exhibits-2023244.pdf[the CloudBees booth], so is Jesse Glick. Find us at the booth for any Jenkins questions or impromptu hacking session, which would really help us as we get distracted from the booth duties that way. Or just drop by to get stickers, pin badges, and other handouts to take for your colleagues. + + + And finally, https://oracleus.activeevents.com/2014/connect/sessionDetail.ww?SESSION_ID=2939[Script Bowl 2014: The Battle Rages On [CON2939]] gets an honorable mention because https://twitter.com/agentdero[our own Tyler Croy] is representing JRuby against other scripting languages, including my favorite Groovy. Hmm, who should I root for...

+ + + + The usual suspects, such as CloudBees, XebiaLabs, SOASTA, PuppetLabs, et al are https://www.cloudbees.com/cdsummit/[doing a Jenkins-themed continuous delivery event series] called "cdSummit." The event is free, has a nice mix of user/vendor talks, and has an appeal to managers and team leads who are working on and struggling with continuous delivery and automation. + + + I've spoken in the past events, and I enjoyed the high-level pitches from various speakers. + The last two events at Paris and London filled up completely, so I suspect others have liked them, too. + + + If you live near Chicago, Washington DC, or San Francisco, check out the date and see if you can make it. https://www.cloudbees.com/cdsummit/[RSVP is from here]. If you do, be sure to pick up Jenkins stickers and pin badges!

+ https://groups.google.com/forum/#!msg/jenkinsci-dev/qY387kOQlW8/vaBxacXYhGwJ[As was discussed some time ago], the workflow summit is being organized, and it's open for RSVP. + + + Due to the overwhelming demand, I've increased the capacity this time to 50, but this is an unconference where everyone needs to participate, which means we really cannot have too many people without changing the dynamics of the event. + + + So please make sure you are willing to participate, as in not just listening and watching, but actually willing to speak. We expect you to bring something to the table — opinions, experiences, rants, presentations, feedbacks, etc. If you don't please let others take the seat, and rest assured we will give a presentation about workflow in https://wiki.jenkins.io/display/JENKINS/Jenkins+User+Conference+US+West+%28San+Francisco%29+Oct+23%2C+2014+-+Agenda[JUC Bay Area]. + + + If you understand the criteria, https://www.meetup.com/jenkinsmeetup/events/203777932/[please RSVP is from here]. +

+ + + + + My apologies for the last minute announcement, but there will be a https://www.meetup.com/jenkinsmeetup/events/203261692/[Jenkins user meet-up in Paris on Sep 10th 7:00pm], which is just next week. The event is hosted by Zenika. You'll hear from https://twitter.com/gboissinot[Gregory Boissinot] and https://twitter.com/alecharp[Adrien Lecharpentier] about plugin development, and I'll be talking about workflow. + + + It's been a while we do a meet-up in Paris. Looking forward to seeing as many of you as possible. The event is free, but https://www.meetup.com/jenkinsmeetup/events/203261692/[please RSVP] so that we know what to expect.

+ https://www.cloudbees.com/event/juc/2014/san-francisco[JUC SF] on October 23, 2014 is shaping up to be bigger and better this year. + + + Here’s what we have in store for you! + + Three Tracks + + We’ve received a record high of 40 stellar proposals this year. To accommodate the many community proposals, we’ve decide to add a third track to the + agenda. https://www.cloudbees.com/event/juc/2014/san-francisco[JUC SF sessions] are now available for you to view. We have speakers from Google, + Target, Gap, Cloudera, Ebay, Chicago Drilling Company, and much more. https://www.eventbrite.com/e/jenkins-user-conference-us-west-san-francisco-oct-23-2014-tickets-10558684309[Register now] for early bird price. + The early bird price is only good until September 21, 2014. + + Live Stream + + If you can’t attend the conference in person, https://www.cloudbees.com/event/juc/2014/san-francisco[Track 1] sessions will be available via live + stream, it’s all free. Brought to you by CloudBees. Registration for JUC SF live stream is https://www.eventbrite.com/e/jenkins-user-conference-us-west-san-francisco-live-stream-tickets-12240011203[here]. + + Get Drunk on Code + + Have a beer while learning how to write Jenkins plugin. Steve Christou, Jenkins support engineer will lead this lecture from 3:30pm to 6:00pm. He will + teach everything from how to get started, to techniques like writing a new https://wiki.jenkins.io/display/JENKINS/Jenkins+CLI[CLI Command], to writing your own builder. + + Ask the Experts + + Meet the Jenkins creator, committers, support engineers, and developers. We have dedicated time slot(s) for our attendees to get 1 on 1 access to our + experts. Exact time is TBD. Ask them anything from plugins, configuration, technical support, to bug fixes. + + + Our current list of experts are: + + + Andrew Bayer + Gareth Bowles + Steve Christou + Jesse Glick + Kohsuke Kawaguchi + Dean Yu + + Want to join our panel of experts? Contact Alyssa Tong aly13@gmail.com + + Exhibit Mixer + + Sixteen technology https://www.cloudbees.com/event/juc/2014/san-francisco[sponsors] will be showcasing their newest technologies during + the exhibition hour from 2:25 – 3:30pm. Grab a beer, visit with sponsors and see how they are using Jenkins. + + + This is just a taste of what you’ll see at JUC SF. We look forward to seeing you there!! +

Jesse and I will walk through the source code of the workflow plugin, highlights key abstractions and extension points, and discuss how they are put together. If you are interested in developing or retrofitting plugins to work with workflows, I think you’ll find this session interesting. The event will be on Google Hangout tomorrow. The time of the day is the same as usual office hours.

+ https://en.wikipedia.org/wiki/London[ + image:https://upload.wikimedia.org/wikipedia/commons/thumb/f/f9/Black_London_Cab.jpg/320px-Black_London_Cab.jpg[image] + ] + + + + https://jenkins-ci.org/content/jenkins-user-meet-london[As I was alluding to earlier], I was hoping to have a meetup of Jenkins users in London for a while. I'm happy to report that https://www.meetup.com/jenkinsmeetup/events/198004202/[the agenda is final and RSVP is open]! The date is September 8th. + + + I'll talk about my recent chef/puppet integration work in Jenkins. Sven from Perforce will talk about how to leverage Perforce features from Jenkins, and then James Nord will talk about workflow. It will be a worthy 2 hours. + + + If the line up of talks will not be enough to sway you, you should also know that I will bring some Jenkins give-aways! + + + I'm not sure how many people to expect, but there's a cap at 80 people, so if you are thinking about coming, https://www.meetup.com/jenkinsmeetup/events/198004202/[be sure to RSVP]. Looking forward to seeing many of you there! + + + Finally, if you are in London, the usual suspects (CloudBees, PuppetLabs, XebiaLabs, MidVision, SOASTA, et al) are doing https://www.eventbrite.com/e/how-to-accelerate-innovation-with-continuous-delivery-london-tickets-12229265061[a free event titled "How To Accelerate Innovation with Continuous Delivery"] that you might also be interested in.