Options on upgrading JIRA and plugins with strict firewall and restricted outside network access?

Philip Haynes

Hi,

I am operating in an environment with strict firewall and outside network access (read none).

The current JIRA and hence other Atlassian plugin architecture is causing significant dramas in that
essentially they require direct outgoing access to the Internet to upgrade and enhance the products. This conflicts with security protocols in place (i.e. no Internet access from production machines). I have attempted manual updates, but this is both time consuming and highly error prone. We need another solution.

The key issue here is that with Jira et al. requiring directly Internet access it bypasses, virus checking / packet inspection and many other security measures of what is downloaded. Further, plugins and other components come from a range of changing URI's making creating URI whitelists impractical.

I have trying to think of a solution that allows my customer to keep their software up to date whilst
sitting within their security policies.

My thinking is that we need a cache of the various updates / plugins where we can do all the
security stuff - prior's to loading the plugins into the secure applications.

Now it turns out that we already have such a thing - it is our Maven / Nexus repo.
This already connects to Atlassian's maven repo to update code during our plugin development cycles.

My question is, what would it take to make it possible to upgrade the Atlassian products and plugins via our Nexus repo or some other means, rather than having to lift up our firewalls to upgrade Atlassian Products directly (which looks doubtful at this stage).

Help greatly appreciated.

Kind Regards,

Philip Haynes

ChrisA_2hjdfz

Hi Philip,

Two options that I can suggest for this setup are:

1. Installing plugins via the command line using the Atlassian Plugin SDK.

Assuming you have already downloaded/generated/acquired the plugins needed to install, you can use the atlas-install-plugin command to directly install plugins rather than going through the mess of clicking through the browser and manually uploading them.

Please be aware that you may need to make some configuration changes to run commands:

Running Behind a Corporate Firewall

To run the SDK commands where your Java programs don't have direct access to the Internet, your atlas commands should be run with the -DallowGoogleTracking=false flag. This disables Google web requests during the build process. Equally where authenticated access is available, it is handy to run a local authenticating proxy server such as cntlm and then set the Java http{s} environment variables to point to the proxy (for example, -Dhttp.proxyHost=localhost -Dhttp.proxyPort=3128 -Dhttps.proxyHost=localhost -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts=localhost|127.0.0.*).

2. One of our devs has created a pom.xml file which would potentially allow you to build a new bundled-plugins zip which will update JIRA's existing bundled-plugins. One thing to note is that this will only be able to handle plugins in your maven respository, and will require your Maven repository to be connected to Atlassian Maven Repositories (either by proxy, directly connecting, etc). Also this method is only suitable for jar file and not obr file plugins.

Below is the modified pom.xml -

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>com.atlassian.jira</groupId>
        <artifactId>jira-bundled-plugins</artifactId>
        <version>5.1.8</version>
    </parent>
    
    <artifactId>jira-plugin-alternative-updater</artifactId>
    <groupId>com.atlassian.labs.jira</groupId>
    <name>Atlassian JIRA Plugin Alternative Updater</name>
    <version>1.0-SNAPSHOT</version>

    <description>
        Provides an augmented bundled plugins jar that can replace the default JIRA bundled plugins jar.
        Run "mvn package" to generate the bundled plugins zip.
    </description>


    <build>
        <plugins>
            <plugin>
                <!-- com.luuuis:smartass-maven-plugin is used in the normal JIRA build process for this artifact -->
                <groupId>com.luuuis</groupId>
                <artifactId>smartass-maven-plugin</artifactId>
                <version>1.2.1</version>
                <executions>
                    <execution>
                        <id>create-bundled-plugins-zip</id>
                        <phase>package</phase>
                        <goals>
                            <goal>archive-dependencies</goal>
                        </goals>
                        <configuration>
                            <includeScope>runtime</includeScope>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
    
    <dependencies>
        <!-- Add dependencies here to include them in the bundled plugins zip. They should have scope runtime-->
        <!-- Using GreenHopper as an example: -->
        <!--
        <dependency>
            <groupId>com.atlassian.jira.plugins</groupId>
            <artifactId>jira-greenhopper-plugin</artifactId>
            <version>5.10.5.2</version>
            <scope>runtime</scope>
        </dependency>
        -->
    </dependencies>

</project>

To use this, set it up as if it was a regular maven2 project. We use 2.1.0. I expect it to work on later versions. What that means is:

1. Create a directory named "jira-plugin-alternative-updater"
2. Put that pom.xml into that directory
3. Add any dependencies to it that you want as bundled plugins
4. Set the JIRA version to the one you are using (e.g. 5.1.8, 5.2)
5. In that directory run "mvn clean package"
   1. This will generate an atlassian-bundled-plugins.zip in the target directory
   2. Verify the zip contains the additional files
   3. Verify no plugins in the original atlassian-bundled-plugins.zip bundled with JIRA are missing from the new atlassian-bundled-plugins.zip in the target directory
6. Replace the atlassian-bundled-plugins.zip that is in JIRA with the atlassian-bundled-plugins.zip that was generated
7. Start JIRA

This does not grant any additional ability to upgrade plugins through the UPM.

I hope you find this information helpful.

Cheers,

Chris