github-oauth vs. opscode-cookbooks/jenkins about jenkins-chef-dsl

[erichelgeson]

This may work for you sous-chefs/jenkins#258 But yes, it does break currently.

[martinb3]

I already used OpenSSL::PKey::RSA to read the keys every time, so I think the extra \n was already being appended. I guess I just can't use github-oauth with the CLI :(

Looks like mocleiri/github-oauth-plugin#12 is the same issue. jenkinsci/github-oauth-plugin#19 should have been a fix, but doesn't appear to work for everyone.

[erichelgeson]

Actually are you on Jenkins 1.555 or below? SSH auth has been broken for a while unless you pin to 1.555 (and it only works on yum or war, apt doesnt have old packages)

[martinb3]

Unfortunately, yes, I've already pinned that back, or I couldn't get the CLI to repeat-ably work at all.

[schisamo]

This appears to be working as expected with the latest version of Jenkins (1.590). I wanted to share the snippet of recipe code that make all the magic happen:
https://gist.github.com/schisamo/a82cdc42af74baa0cedb

The chef-jenkins user we create is added to the Github Admin usernames BUT is not actually a GitHub account.

[martinb3]

@schisamo I think the solution you posted requires (a) giving Jenkins admin access to whatever Github user owns the chef-jenkins account? (It's currently unregistered) and (b) anonymous read and any authenticated github user read access to the Jenkins instance. Aren't those big security holes?

I know the whole point of our group using github-oauth is to ensure anonymous read and all-github read are denied. I had a solution just like yours, but those two items were deal breakers (basically opening up the repo to all github users plus whoever registers chef-jenkins first).

[schisamo]

@martinb3 Good points. Our Jenkins instances are currently internal, accessed by VPN only. I've yet to deploy the GitHub OAuth code but will revisit this implementation before things go live.

[schisamo]

I also grabbed the chef-jenkins user! ;)