Question: why are some functions disallowed if called in a Jenkinsfile, but allowed if called in a shared library that is imported by that same Jenkinsfile?
This question is not specific to directory-creation, but I will use it as an example, since that is the context in which I discovered this behavior:
The following Jenkins pipeline succeeds in creating a directory:
@Library('my-shared-libs') _
pipeline {
agent any
stages {
stage( "1" ) {
steps {
script {
utils.MkDir("/home/user/workspace/prj/foo")
}
}
}
}
}
// vars/utils.groovy
import java.io.File
def MkDir(the_dir) {
def f = new File(the_dir)
if ( ! f.mkdirs() ) { echo "Failed creating ${the_dir}" }
else { echo "Succeeded creating ${the_dir}" }
}
But the following pipeline:
pipeline {
agent any
stages {
stage( "1" ) {
steps {
script {
def the_dir = "/home/user/workspace/prj/bar"
def f = new File(the_dir)
if ( ! f.mkdirs() ) { echo "Failed creating ${the_dir}" }
else { echo "Succeeded creating ${the_dir}" }
}
}
}
}
}
...fails with this error:
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use new java.io.File java.lang.String
Why is the directory-creation unsuccessful when called from the Jenkinsfile, but successful when called from the shared-library that is imported from that same Jenkinsfile?
The broader question this raises: what is the underlying "distinction" between a Jenkinsfile and shared libraries that it uses? There is some kind of "delineation" or "distinction" between Jenkinsfile declarative-syntax scripts and Groovy, and shared libraries, that isn't quite gelling in my mind. I'd be grateful if someone could help me understand.
Following @injecteer's suggestion, I tried the following modification to the second Jenkinsfile:
def the_dir = "/home/user/workspace/prj/bar"
def u = new URL( "file://${the_dir}" ).toURI()
def f = new File(u)
if ( ! f.mkdirs() ) { echo "Failed creating ${the_dir}" }
else { echo "Succeeded creating ${the_dir}" }
...which resulted in this error:
Scripts not permitted to use method java.net.URL toURI. Administrators can decide whether to approve or reject this signature.
It's not an option for me to do (or have done) this administrative approval, so this suggestion can't be an option for me, unfortunately.
