Recent Blog Posts

I’m Tracy Miranda, and I’m really excited to have joined CloudBees this month leading the open source program. CloudBees’ contributions to Jenkins include developing Pipeline and Blue Ocean, staffing the infrastructure team, advocacy and events work, as well as security efforts. My focus is on making sure there is a great relationship between the Jenkins community and CloudBees, which means strong communication, help get traction on things the community wants, and generally working to make Jenkins and the community thrive and stay awesome in an ever-changing tech landscape. Here’s a little background on me: I come from an electronics/EDA background but switched to software early in my career when I first got involved with open source software. I’ve been part of the Eclipse community for around 15 years, definitely from before git was even a thing. I love being involved with all levels: project committer, conference chair, steering committee for working groups and more recently board of directors. On a personal note, I … Live in the UK with my husband and 2 young kids Grew up in Kenya Enjoy playing badminton, love good food & am always first at any buffets I am looking forward to getting to know the Jenkins community well, and really getting a feel for your Jenkins stories, good and bad. Please feel free to let me know: What you love about the Jenkins community & how you are using Jenkins What you’re working on doing with Jenkins What you don’t like and want improved You can find me on the mailing lists or via: Twitter @tracymiranda Email: tmiranda@cloudbees.com IRC: tracymiranda Also I’ll be at the upcoming events: DevOps World - Jenkins World in San Francisco, California and Nice, France so if you plan to attend do come and say hi. The Jenkins community is the real force behind Jenkins. And in turn Jenkins powers so much of the software out there. It is an honour to be joining this wonderful community.

On behalf of the Jenkins GSoC team and mentors, I would like to welcome Shenyu Zheng, Udara De Silva, Pham Vu Tuan and Abhishek Gautam. They will be working on Google Summer of Code projects in the Jenkins organization, and they have already done some contributions. This year we have the following projects: Code Coverage API Plugin - create a new API Plugin to unify existing Code Coverage plugins and provide new features. Student: Shenyu Zheng from Henan University, Kaifeng, China Mentors: Steven Christou and Supun Wanniarachchi Electronic Design Automation Plugins - create plugins for open-source Electronic Design Automation tools for synthesis, simulation and coverage analysis (iVerilog, covered, Yosys). Student: Udara De Silva from University of Akron, Ohio, USA Mentors: Martin d’Anjou and Oleg Nenashev Jenkins Remoting over Message Bus/Queue - add support of a popular message queue/bus technology (RabbitMQ or Kafka) as a fault-tolerant communication layer in Jenkins. Student: Pham Vu Tuan from Nanyang Technological University, Singapore Mentors: Oleg Nenashev and Supun Wanniarachchi Simple Pull-Request Job Plugin - add ability to define Jenkins jobs as YAML files stored in SCM, integrate it with existing plugin ecosystem. Student: Abhishek Gautam from Visvesvaraya National Institute of Technology, Nagpur, India Mentors: Jeff Knurek, Kristin Whetstone and Willy Aguirre During next 4 weeks project teams will be reaching out to potential stakeholders in order to establish connections and to get comments regarding their project designs. If you are interested in the projects, please join discussions in the Developer mailing lists and project meetings once they get scheduled. Please also expect expect more detailed blogposts about the projects soon. If you are interested to know more about GSoC in Jenkins, you can find information, timeline and communication channels here.

Last year, news of compromised passwords being used for accounts able to distribute NPM packages made the rounds. Their system looks similar to how publishing of plugins works in the Jenkins project: Accounts are protected by passwords chosen by users. Individual contributors have permission to release the components they maintain. The components they release are used by millions of developers around the world to deliver their software. In other words, weak passwords are a problem for us just as much as for NPM, and what happened to them could happen to us. To address this problem, the Jenkins security and infra teams have recently collaborated on a password audit. The audit covered all accounts with permissions to upload plugins and components, and on accounts with other levels of privileged infrastructure access. We ran brute force tools on salted password hashes of those accounts looking for "weak" passwords — passwords present in a set of publicly available password lists we chose for this audit. We checked the password of every qualifying account for every unsafe password rather than trying to match them to any previous password leaks' email/password pairs. Users with weak account passwords were notified via email a few weeks ago and were asked to change their password to something stronger. We performed the same checks over the previous weekend, but this time we only checked the passwords of accounts whose passwords were deemed weak during our first check. We then invalidated the password of any account whose password was still not considered "strong" (i.e. their password was unchanged or had been changed to another weak password). Users of those accounts will need to request a password reset before signing in again. We plan to implement further safeguards, including improving the account management app at https://accounts.jenkins.io to reject weak passwords. If you’re interested in helping the security team make Jenkins more secure, let us know on the jenkinsci-dev mailing list, or request to join the security team.

We are happy to announce that Jenkins project has been accepted to Google Summer of Code 2018. This year we invite students and mentors to join the Jenkins community and work together on various initiatives: core, plugins, development tools and infrastructure. Our mentors have already created some project ideas. For example, you are welcome to work on the new Configuration-as-Code initiative or to help creating standard API for Code Coverage plugins. If you like test automation, there is a proposal to Jenkins Acceptance Test Harness. Over the next weeks we plan to extend this list by new even more project ideas. All information about the Jenkins GSoC is available on its subproject page. I am a student. How do I apply? See Information for students for application guidelines. First step is to join discussions in the mailing lists in order to introduce yourself, establish connections with the community and potential mentors. The application period starts on March 12 and ends on March 27, but don’t let it misguide you! Use time before application to discuss project ideas/proposals with mentors and to process their feedback. To create a better proposal, we also recommend to study Jenkins and to do some contributions in the area of your project proposal. Not satisfied by the current project ideas? You can propose your own idea in the developer mailing list. I want to be a mentor. Is it too late? It’s not! If you are passionate about open-source and Jenkins, we invite you to join the mentors team. You can either propose a new project idea or join an existing one. See Call for Mentors and Information for mentors for details. This year mentorship does NOT require strong expertise in Jenkins development. The objective is to guide students and to get involved into the Jenkins community. GSoC org admins will help to find advisers if special expertise is required. Important dates Mar 05 - deadline for new GSoC project idea proposals Mar 12 - student application period starts Mar 27 - deadline for student applications Apr 23 - accepted projects announced, community bonding starts May 14 - coding period starts Aug 06 - end of the coding period See the GSoC Timeline for more info. In the Jenkins project we will also organize special events during and after GSoC (e.g. at Jenkins world). P.S: I am going to create a special GSoC 2018 edition of swags for mentors and students. Do not miss them ;)

This year the Jenkins project is interested in participating in Google Summer of Code (GSoC). As in 2016/2017, we are looking for mentors. So yes, we are looking for you :) What is GSoC? GSoC is an annual international program which encourages college-aged students to participate with open source projects during the summer break between classes. Students accepted into the program receive a stipend, paid by Google, to work on well-defined projects to improve or enhance the Jenkins project. In exchange, numerous Jenkins community members volunteer as mentors for students to help integrate them into the open source community and succeed in completing their summer projects. What do mentors get? A student who works full-time in the area of your interest for several months Joint projects with Jenkins experts, lots of fun and ability to study something together Limited-edition of swags from Google and Jenkins project Maybe: Participation in GSoC Mentor Summit and other GSoC events/meetups Conditions Mentors are expected to…​ Be passionate about Jenkins Lead the project in the area of their interest Actively participate in the project during student selection, community bonding and coding phases (March - August) Work in teams of 2+ mentors per 1 each student Dedicate a consistent and significant amount of time, especially during the coding phase ( ~5 hours per week in a team of two mentors) Mentorship does NOT require strong expertise in Jenkins plugin development. The main objective is to guide students and to get them involved into the Jenkins community. GSoC org admins will help to find advisors if a special expertise is needed. Disclaimer: We cannot guarantee that the Jenkins organization gets accepted to GSoC. Even if it gets accepted, we may need to select projects depending on student applications and the number of allocated project slots. Timeline Dec 2017 - started collecting project ideas Jan 17 - Status review at the Jenkins Governance Meeting. Outcome: decision whether we apply to GSoC in 2018. Jan 21 - Application to GSoC (deadline - Jan 23) Feb 12 - List of accepted mentoring organizations published Mar 05 - Deadline for project idea proposals Next - GSoC Timeline How to apply? If you are interested in proposing a project or joining an existing one, please respond to this thread in the Jenkins Developer mailing list. We aggregate/review proposals in this document where you just need to describe the idea and introduce yourself. Please propose new project ideas for discussion until March 05. You can join an existing project at any time, including community bonding and coding periods. Project requirements GSoC is about code (though it may and likely should include some documentation and testing work) Projects should be about Jenkins (plugins, core, infrastructure, integrations, etc.) Projects should be potentially doable by a student in 3-4 months You can find more information about requirements and practices in the GSoC Mentor Guide. Links Jenkins GSoC subproject page Information for mentors Google Summer of Code page GSoC Mentor Guide GSoC Timeline

FOSDEM 2018 is a free event for software developers to meet, share ideas and collaborate. It is an annual event that brings open source contributors from around the world for two days of presentations, discussions, and learning. Jenkins will be well-represented at FOSDEM 2018. Happy Hour before FOSDEM We’ll have a happy hour Friday evening before FOSDEM at Cafe Le Roy d’Espagne. See the meetup page for details. Jenkins table at FOSDEM A Jenkins table will be staffed by volunteers at FOSDEM to answer questions, discuss topics, and help users. See the meetup page for details. Presentations at FOSDEM Automated Linux Containers deployment for fun and profit by David Negreira Advanced testing in action on a Java project by Vincent Massol Deployment vs Provisioning vs Orchestration vs Configuration Management by Peter Souter Jenkins Hackfest after FOSDEM A Jenkins Hackfest will be held the day after FOSDEM 2018. Those who would like to join us for the hackfest 5 Feb 2018 should register for the meetup. Meals, snacks, and beverages will be provided for the hackfest. Come join us, and let’s write some code! Questions? feel free to contact Alyssa Tong or Mark Waite.

Jenkins project congratulates all users and contributors with the New Year! Let’s take a look at some changes this year. Highlights We released major features like BlueOcean and Declarative Pipeline These features offer a new user experience in Jenkins Web UI, powered by Jenkins Pipeline. In Jenkins 2.54 we updated the Java minimal requirement to Java 8 ( announcement). Plugin CI has been moved to our Jenkins-on-Jenkins instance. All plugins are being built by Jenkins Pipeline with a special pipeline library We adopted the Jenkins Enhancement Proposal (JEP) process for major changes in Jenkins. There are already JEPs under review: JEP-2: Criteria for selecting "Suggested Plugins" JEP-200: Switch Remoting/XStream blacklist to a whitelist JEP-201: Jenkins Configuration as Code Some stats In 2017 we had 60 weekly and 13 LTS releases with 305 fixes/enhancements only in the core. Next week Jenkins is going to hit the 2.100 version, and the core changed greatly since the 2.0 release in April 2016. Jenkins Security was one of the hottest areas this year, there were 7 security advisories for the core and 15 - for plugins. For comparison, in 2016 there were only 6 security releases in total. There were 2605 plugin releases, and 215 NEW plugins have been hosted in the Update Center. In particular Jenkins ecosystem has greatly expanded into the Cloud space by offering dozens of new plugins (e.g. for Azure and Kubernetes). We also got many new plugins providing integrations with various Development and DevOps tools. Other subprojects and Jenkins components also got major updates. For example, Jenkins Remoting got 15 releases with stability improvements. Stapler Framework also got 6 releases. Keep updating, Jenkins 2 is not only about Pipeline as Code! Events This year we got many new Jenkins Area Meetups. Currently there are 77 meetups with more than 20,000 members in total ( full map). More than 100 meetups have been organized around the globe. There were also several Jenkins-focused conferences including the following ones: Jenkins World in San-Francisco Jenkins User Conferences in Israel and Shanghai Days Of Jenkins in Gothenburg and Oslo Jenkins Community Day in Paris Jenkins Days in Amsterdam CloudBees | Jenkins Automotive and Embedded Day in Stuttgart What’s next? Next year we will have traditional contributor meeting at FOSDEM and at Jenkins World 2018. If you are interested in Jenkins, stop by at our community booths and join the contributor summits/hackathons. We also want to participate in Google Summer of Code 2018, and currently we are looking for mentors. Stay tuned, there is much more to come next year!

Once again it’s October in our calendars. It means that the regular Hacktoberfest event is back! During this one-month hackathon you can support open source and earn a limited edition T-shirt. Jenkins project offers an opportunity to participate in the project and to get reviews and help from Jenkins contributors. How do I sign up? Sign-up to Hacktoberfest on the event website. Everything is set, just start coding! What can I do? There are lots of ways to contribute to Jenkins during Hacktoberfest. You can…​ Write code Improve documentation, write blogposts Automate Tests Translate and internationalize components Design - artwork and UI improvements also count! See the Contribute and Participate page for for information. Where can I contribute? The project is located in several organizations in GitHub. Core and plugins are located in the jenkinsci org, infrastructure - in jenkins-infra. You can contribute to any component within these organizations. For example, you could contribute to the following components: Jenkins Core ( contributing) Project Website ( contributing) Packaging ( Docker, native packages) Plugins ( existing plugins, plugin tutorial) You can also create new Jenkins plugins and get them hosted in the organization. What can I do? Our issue tracker contains lots of issues you could work on. If you are new to Jenkins, you could start by fixing some easier issues. In the issue tracker we mark such issues with the newbie-friendly label ( search query). You can also submit your own issue and propose a fix. How do I label issues and pull requests? Hacktoberfest project requires issues and/or pull requests to be labeled with the hacktoberfest label. You may have no permissions to set labels on your own, but do not worry! Just mention @jenkinsci/hacktoberfest or @jenkins-infra/hacktoberfest in the repository, and we will set the labels for you. How do I get reviews? All examples above are being monitored by the Jenkins contributors, and you will likely get a review within few days. Reviews in other repositories and plugins may take longer. In the case of delays, ping @jenkinsci/code-reviewers in your pull request or send a message to the mailing list. Where can I find info? Jenkins project contains lots of materials about contributing to the project. Here are some entry links: Participate and Contribute Plugin Development Tutorials Developer Documentation Need help? You can reach out to us using IRC Channels and the Jenkins Developer Mailing List. In the case of mailing lists it is recommended to mention Hacktoberfest in the email subject.