JKNS-859: Replace jbcrypt with Spring Security BCryptPasswordEncoder by kunalmemane · Pull Request #2338 · openshift/jenkins

kunalmemane · 2026-02-27T08:34:36Z

Jenkins LTS 2.516.1 removed the jbcrypt library from the WAR, breaking password hashing in OpenShift Jenkins. Updated password encoding to use Spring Security's BCryptPasswordEncoder instead.

Added Java source files for PasswordEncoder and PasswordChecker under jenkins-bcrypt-util/ (replaces the prebuilt password-encoder.jar)
Build password-encoder.jar at container startup from these sources using spring-security-crypto from the Jenkins WAR
Update classpath in jenkins-common.sh to use WAR lib jars for runtime dependencies

Ref:

openshift-ci-robot · 2026-02-27T08:34:40Z

@kunalmemane: This pull request references JKNS-859 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Jenkins 2.509 removed the jbcrypt library from the WAR. Updated password-encoder.jar to use Spring Security's BCryptPasswordEncoder and adjust the classpath in jenkins-common.sh to resolve dependencies from the WAR lib directory.

ref:

https://github.com/jenkinsci/jenkins/issues/?q=%22JENKINS-75533%22

https://issues.jenkins.io/browse/JENKINS-75533

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-02-27T08:39:00Z

@kunalmemane: This pull request references JKNS-859 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Jenkins 2.509 removed the jbcrypt library from the WAR. Updated password-encoder.jar to use Spring Security's BCryptPasswordEncoder and adjust the classpath in jenkins-common.sh to resolve dependencies from the WAR lib directory.

ref:

https://github.com/jenkinsci/jenkins/issues/?q=%22JENKINS-75533%22

https://issues.jenkins.io/browse/JENKINS-75533

Also see:

https://github.com/kunalmemane/jenkins-bcrypt-util

This is the codebase for password-encoder.jar to use Spring Security's BCryptPasswordEncoder

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-02-27T08:41:51Z

@kunalmemane: This pull request references JKNS-859 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Jenkins 2.509 removed the jbcrypt library from the WAR. Updated password-encoder.jar to use Spring Security's BCryptPasswordEncoder and adjust the classpath in jenkins-common.sh to resolve dependencies from the WAR lib directory.

ref:

https://github.com/jenkinsci/jenkins/issues/?q=%22JENKINS-75533%22

https://issues.jenkins.io/browse/JENKINS-75533

Also see:

https://github.com/kunalmemane/jenkins-bcrypt-util
This repository contains the source code for password-encoder.jar, leveraging Spring Security's BCryptPasswordEncoder.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-09T14:16:02Z

@kunalmemane: This pull request references JKNS-859 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Jenkins LTS 2.516.1 removed the jbcrypt library from the WAR, breaking password hashing in OpenShift Jenkins. Updated password encoding to use Spring Security's BCryptPasswordEncoder instead.

Added Java source files for PasswordEncoder and PasswordChecker under jenkins-bcrypt-util/ (replaces the prebuilt password-encoder.jar)

Build password-encoder.jar at container startup from these sources using spring-security-crypto from the Jenkins WAR

Update classpath in jenkins-common.sh to use WAR lib jars for runtime dependencies

Ref:

https://github.com/jenkinsci/jenkins/issues/?q=%22JENKINS-75533%22

https://issues.jenkins.io/browse/JENKINS-75533

https://www.jenkins.io/changelog/2.516.1/

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

kunalmemane · 2026-03-09T14:47:46Z

/test images

kunalmemane · 2026-03-09T14:52:35Z

/retest

kunalmemane · 2026-03-09T15:10:33Z

/test images

kunalmemane · 2026-03-09T15:18:43Z

/test images

kunalmemane · 2026-03-09T17:39:03Z

/retest

kunalmemane · 2026-03-10T04:44:13Z

/retest

kunalmemane · 2026-03-11T15:01:51Z

/retest

Jenkins LTS 2.516.1 removed the jbcrypt library from the WAR, breaking password hashing in OpenShift Jenkins. Updated password encoding to use Spring Security's BCryptPasswordEncoder instead. - Added Java source files for PasswordEncoder and PasswordChecker under jenkins-bcrypt-util/ (replaces the prebuilt password-encoder.jar) - Build password-encoder.jar at container startup from these sources using spring-security-crypto from the Jenkins WAR - Update classpath in jenkins-common.sh to use WAR lib jars for runtime dependencies

openshift-ci · 2026-03-11T19:24:53Z

@kunalmemane: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`ecedb03`	link	false	`/test security`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

prdhamdh · 2026-03-20T12:06:32Z

/lgtm
/approve
/label backport-risk-assessed
/label px-approved
/label docs-approved
/label qe-approved

openshift-ci-robot · 2026-03-20T12:06:44Z

@kunalmemane: This pull request references JKNS-859 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Jenkins LTS 2.516.1 removed the jbcrypt library from the WAR, breaking password hashing in OpenShift Jenkins. Updated password encoding to use Spring Security's BCryptPasswordEncoder instead.

Added Java source files for PasswordEncoder and PasswordChecker under jenkins-bcrypt-util/ (replaces the prebuilt password-encoder.jar)

Build password-encoder.jar at container startup from these sources using spring-security-crypto from the Jenkins WAR

Update classpath in jenkins-common.sh to use WAR lib jars for runtime dependencies

Ref:

https://github.com/jenkinsci/jenkins/issues/?q=%22JENKINS-75533%22

https://issues.jenkins.io/browse/JENKINS-75533

https://www.jenkins.io/changelog/2.516.1/

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-03-20T12:07:16Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kunalmemane, prdhamdh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [prdhamdh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

prdhamdh · 2026-03-20T12:14:24Z

/verified by @prdhamdh

openshift-ci-robot · 2026-03-20T12:14:37Z

@prdhamdh: This PR has been marked as verified by @prdhamdh.

Details

In response to this:

/verified by @prdhamdh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 27, 2026

openshift-ci bot requested review from avinal and prdhamdh February 27, 2026 08:34

kunalmemane force-pushed the JKNS-859-fix-jbcrypt-with-spring-security branch 3 times, most recently from e05344a to e52acb3 Compare February 27, 2026 10:22

prdhamdh reviewed Feb 27, 2026

View reviewed changes

Comment thread 2/contrib/jenkins/jenkins-common.sh Outdated

Comment thread 2/contrib/jenkins/jenkins-common.sh Outdated

kunalmemane force-pushed the JKNS-859-fix-jbcrypt-with-spring-security branch 2 times, most recently from fcb1c9d to 327b633 Compare February 27, 2026 12:29

kunalmemane force-pushed the JKNS-859-fix-jbcrypt-with-spring-security branch from 327b633 to 1d2d719 Compare March 9, 2026 14:10

kunalmemane force-pushed the JKNS-859-fix-jbcrypt-with-spring-security branch from 1d2d719 to 0f9aff6 Compare March 9, 2026 14:19

kunalmemane force-pushed the JKNS-859-fix-jbcrypt-with-spring-security branch 4 times, most recently from 724dfa6 to 0f9aff6 Compare March 10, 2026 09:19

kunalmemane force-pushed the JKNS-859-fix-jbcrypt-with-spring-security branch from 0f9aff6 to ecedb03 Compare March 11, 2026 15:04

openshift-ci bot assigned prdhamdh Mar 20, 2026

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 20, 2026

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 20, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 20, 2026

openshift-merge-bot bot merged commit 94557ed into openshift:master Mar 20, 2026
7 of 8 checks passed

Conversation

kunalmemane commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 27, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 27, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 27, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 9, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kunalmemane commented Mar 9, 2026

Uh oh!

kunalmemane commented Mar 9, 2026

Uh oh!

kunalmemane commented Mar 9, 2026

Uh oh!

kunalmemane commented Mar 9, 2026

Uh oh!

kunalmemane commented Mar 9, 2026

Uh oh!

kunalmemane commented Mar 10, 2026

Uh oh!

kunalmemane commented Mar 11, 2026

Uh oh!

openshift-ci bot commented Mar 11, 2026

Uh oh!

prdhamdh commented Mar 20, 2026

Uh oh!

openshift-ci-robot commented Mar 20, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Mar 20, 2026

Uh oh!

prdhamdh commented Mar 20, 2026

Uh oh!

openshift-ci-robot commented Mar 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kunalmemane commented Feb 27, 2026 •

edited

Loading

openshift-ci-robot commented Feb 27, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Feb 27, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Feb 27, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Mar 9, 2026 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Mar 20, 2026 •

edited by openshift-ci bot

Loading