From f090abc6c54e40c9549db959e1e12e6ecf5c5b1b Mon Sep 17 00:00:00 2001 From: James Nord Date: Mon, 1 Dec 2025 12:40:59 +0000 Subject: [PATCH 1/3] Start the removal of obsolete permissions disable obsolete permissions (UploadPlugins, ConfigureUpdateCenter and RunScripts). * disable the permissions * mark the permissions as DoNotUse so that plugins updating core will now fail to compile * retain API compatability for now (full removal can be done for a future LTS). --- core/src/main/java/hudson/PluginManager.java | 10 ++++++---- core/src/main/java/jenkins/model/Jenkins.java | 5 +++-- test/src/test/java/jenkins/model/JenkinsTest.java | 6 +----- 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java index c4dcaf1f2825..e9da0474abf5 100644 --- a/core/src/main/java/hudson/PluginManager.java +++ b/core/src/main/java/hudson/PluginManager.java @@ -2502,12 +2502,14 @@ public boolean isPluginJar(URL jarUrl) { public static boolean FAST_LOOKUP = !SystemProperties.getBoolean(PluginManager.class.getName() + ".noFastLookup"); /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ - @Deprecated - public static final Permission UPLOAD_PLUGINS = new Permission(Jenkins.PERMISSIONS, "UploadPlugins", Messages._PluginManager_UploadPluginsPermission_Description(), Jenkins.ADMINISTER, PermissionScope.JENKINS); + @Deprecated(forRemoval = true) + @Restricted(DoNotUse.class) + public static final Permission UPLOAD_PLUGINS = new Permission(Jenkins.PERMISSIONS, "UploadPlugins", Messages._PluginManager_UploadPluginsPermission_Description(), null, false, new PermissionScope[] { PermissionScope.JENKINS}); /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ - @Deprecated - public static final Permission CONFIGURE_UPDATECENTER = new Permission(Jenkins.PERMISSIONS, "ConfigureUpdateCenter", Messages._PluginManager_ConfigureUpdateCenterPermission_Description(), Jenkins.ADMINISTER, PermissionScope.JENKINS); + @Deprecated(forRemoval = true) + @Restricted(DoNotUse.class) + public static final Permission CONFIGURE_UPDATECENTER = new Permission(Jenkins.PERMISSIONS, "ConfigureUpdateCenter", Messages._PluginManager_ConfigureUpdateCenterPermission_Description(), null, false, new PermissionScope[] {PermissionScope.JENKINS}); /** * Remembers why a plugin failed to deploy. diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java index 29a685a3e276..3e3a957d62da 100644 --- a/core/src/main/java/jenkins/model/Jenkins.java +++ b/core/src/main/java/jenkins/model/Jenkins.java @@ -5891,8 +5891,9 @@ public boolean shouldShowStackTrace() { public static final Permission READ = new Permission(PERMISSIONS, "Read", Messages._Hudson_ReadPermission_Description(), Permission.READ, PermissionScope.JENKINS); /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ - @Deprecated - public static final Permission RUN_SCRIPTS = new Permission(PERMISSIONS, "RunScripts", Messages._Hudson_RunScriptsPermission_Description(), ADMINISTER, PermissionScope.JENKINS); + @Deprecated(forRemoval = true) + @Restricted(DoNotUse.class) + public static final Permission RUN_SCRIPTS = new Permission(PERMISSIONS, "RunScripts", Messages._Hudson_RunScriptsPermission_Description(), null, false, new PermissionScope[] {PermissionScope.JENKINS}); /** * Urls that are always visible without READ permission. diff --git a/test/src/test/java/jenkins/model/JenkinsTest.java b/test/src/test/java/jenkins/model/JenkinsTest.java index 6705323ad077..e2aead5d7a9a 100644 --- a/test/src/test/java/jenkins/model/JenkinsTest.java +++ b/test/src/test/java/jenkins/model/JenkinsTest.java @@ -392,8 +392,7 @@ void testDoScript() throws Exception { j.jenkins.setSecurityRealm(j.createDummySecurityRealm()); j.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy(). grant(Jenkins.ADMINISTER).everywhere().to("alice"). - grant(Jenkins.READ).everywhere().to("bob"). - grantWithoutImplication(Jenkins.RUN_SCRIPTS, Jenkins.READ).everywhere().to("charlie")); + grant(Jenkins.READ).everywhere().to("bob")); WebClient wc = j.createWebClient(); wc.withBasicApiToken(User.getById("alice", true)); @@ -411,9 +410,6 @@ void testDoScript() throws Exception { wc.withBasicApiToken(User.getById("bob", true)); wc.assertFails("script", HttpURLConnection.HTTP_FORBIDDEN); - //TODO: remove once RUN_SCRIPTS is finally retired - wc.withBasicApiToken(User.getById("charlie", true)); - wc.assertFails("script", HttpURLConnection.HTTP_FORBIDDEN); } @Test From d41b3e366d037cc64c8b1b3b3b484de4a8189690 Mon Sep 17 00:00:00 2001 From: James Nord Date: Mon, 1 Dec 2025 16:05:53 +0000 Subject: [PATCH 2/3] reformat for checkstyle --- core/src/main/java/hudson/PluginManager.java | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java index e9da0474abf5..fc93f8153447 100644 --- a/core/src/main/java/hudson/PluginManager.java +++ b/core/src/main/java/hudson/PluginManager.java @@ -2504,12 +2504,26 @@ public boolean isPluginJar(URL jarUrl) { /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ @Deprecated(forRemoval = true) @Restricted(DoNotUse.class) - public static final Permission UPLOAD_PLUGINS = new Permission(Jenkins.PERMISSIONS, "UploadPlugins", Messages._PluginManager_UploadPluginsPermission_Description(), null, false, new PermissionScope[] { PermissionScope.JENKINS}); + public static final Permission UPLOAD_PLUGINS = + new Permission(Jenkins.PERMISSIONS, + "UploadPlugins", + Messages._PluginManager_UploadPluginsPermission_Description(), + null, + false, + new PermissionScope[] { PermissionScope.JENKINS } + ); /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ @Deprecated(forRemoval = true) @Restricted(DoNotUse.class) - public static final Permission CONFIGURE_UPDATECENTER = new Permission(Jenkins.PERMISSIONS, "ConfigureUpdateCenter", Messages._PluginManager_ConfigureUpdateCenterPermission_Description(), null, false, new PermissionScope[] {PermissionScope.JENKINS}); + public static final Permission CONFIGURE_UPDATECENTER = + new Permission(Jenkins.PERMISSIONS, + "ConfigureUpdateCenter", + Messages._PluginManager_ConfigureUpdateCenterPermission_Description(), + null, + false, + new PermissionScope[] { PermissionScope.JENKINS } + ); /** * Remembers why a plugin failed to deploy. From 90d00cfbe9ef4a0df4ed94c525903a33b5005cfb Mon Sep 17 00:00:00 2001 From: James Nord Date: Tue, 2 Dec 2025 10:16:11 +0000 Subject: [PATCH 3/3] remove deprecation flag @jglick requested not to mix deprecation and restricted annotations What we want here is to break source compatability so keeping the Restricted annotation. Whilst some plugins may have disabled the annotation checker and no longer get any warnings about this that would be their issue for using this well after it was deprecated 5 years ago. --- core/src/main/java/hudson/PluginManager.java | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java index fc93f8153447..7e150290cba6 100644 --- a/core/src/main/java/hudson/PluginManager.java +++ b/core/src/main/java/hudson/PluginManager.java @@ -2501,8 +2501,7 @@ public boolean isPluginJar(URL jarUrl) { @SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console") public static boolean FAST_LOOKUP = !SystemProperties.getBoolean(PluginManager.class.getName() + ".noFastLookup"); - /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ - @Deprecated(forRemoval = true) + /** To be removed: use {@link Jenkins#ADMINISTER} instead */ @Restricted(DoNotUse.class) public static final Permission UPLOAD_PLUGINS = new Permission(Jenkins.PERMISSIONS, @@ -2513,8 +2512,7 @@ public boolean isPluginJar(URL jarUrl) { new PermissionScope[] { PermissionScope.JENKINS } ); - /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */ - @Deprecated(forRemoval = true) + /** To be removed: use {@link Jenkins#ADMINISTER} instead */ @Restricted(DoNotUse.class) public static final Permission CONFIGURE_UPDATECENTER = new Permission(Jenkins.PERMISSIONS,