Unable to see scoverage report on Jenkins 2.6

[deepujain]

<scoverage.plugin.version>1.2.0-SNAPSHOT</scoverage.plugin.version>

org.scoverage scoverage-maven-plugin ${scoverage.plugin.version} true ${minimumCoverage} true ${scala.version} true

Versions tried
1.1.1
1.1.0
1.2.0-SNAP

Jenkins Version: 2.6 Is it a problem with Jenkins plugin or maven plugin ?

[deepujain]

I am able to see code coverage reports on local machine (via index.html) but it does not show up on Jenkins. click no Scoverage HTML Report shows up a blank page.

[kasper-f]

I had a similar problem. By loading the Development tool in my browser i found that the content was disabled due to the Content-Security-Policy header sent by Jenkins. See Jenkins wiki for details.
https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy

I got it working with the following header:
upgrade-insecure-requests; default-src 'self' http://ajax.googleapis.com 'sha256-mp+EOTi7PD8ouIeZyvVpn8Wh8g+tBzyRxDcSIUbYHO8=' https://cdnjs.cloudflare.com http://cdnjs.cloudflare.com http://netdna.bootstrapcdn.com http://yui.yahooapis.com; img-src 'self' data: ; style-src 'self' 'unsafe-inline' http://yui.yahooapis.com https://cdnjs.cloudflare.com http://netdna.bootstrapcdn.com

[gslowikowski]

Can you check with your browser's developer tools (e.g. Firebug in Firefox) what kind of errors it shows?

[deepujain]

[deepujain]

Chrome - Developer Tools - JS Console

[deepujain]

When you say got it working with header , what exactly did you do ? (steps are appreciated) and does this needs to be done by every client browser ?

[shanbin]

It looks like the quickest fix would be setting the property as @kasper-f mentioned along with Jenkins start.

[deepujain]

Where do i set that header ?

[shanbin]

In the Jenkins start script, set properties like java -Dhudson.model.DirectoryBrowserSupport.CSP= -jar jenkins.war, it's also documented in https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy.

[deepujain]

java -Dhudson.model.DirectoryBrowserSupport.CSP=upgrade-insecure-requests;
default-src 'self' http://ajax.googleapis.com
'sha256-mp+EOTi7PD8ouIeZyvVpn8Wh8g+tBzyRxDcSIUbYHO8='
https://cdnjs.cloudflare.com http://cdnjs.cloudflare.com
http://netdna.bootstrapcdn.com http://yui.yahooapis.com; img-src 'self'
data: ; style-src 'self' 'unsafe-inline'http://yui.yahooapis.com
https://cdnjs.cloudflare.com http://netdna.bootstrapcdn.com -jar
jenkins.war

Is this correct ?

On Tue, Jun 7, 2016 at 3:18 PM, Shanbin Wang notifications@github.com
wrote:

In the Jenkins start script, set properties like java
-Dhudson.model.DirectoryBrowserSupport.CSP= -jar jenkins.war, it's also
documented in
https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy
.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#15 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAY0-Z3l-tWF-7mxh-gItp8t79QFf1stks5qJe5JgaJpZM4IoB3V
.

Deepak

[deepujain]

Works but

1. Line Highlighting is lost
2. CSS bars are lost.

[deepujain]

Command:

nohup java -Dhudson.model.DirectoryBrowserSupport.CSP="upgrade-insecure-requests; default-src 'self' http://ajax.googleapis.com 'sha256-mp+EOTi7PD8ouIeZyvVpn8Wh8g+tBzyRxDcSIUbYHO8=' https://cdnjs.cloudflare.com http://cdnjs.cloudflare.com http://netdna.bootstrapcdn.com http://yui.yahooapis.com; img-src 'self' data: ; style-src 'self' 'unsafe-inline'http://yui.yahooapis.com https://cdnjs.cloudflare.com http://netdna.bootstrapcdn.com" -jar jenkins.war &

[gslowikowski]

In version 1.2.0-SNAPSHOT all external css and js files are accessed using https protocol (see this PR and this commit).

Can you try with 1.2.0-SNAPSHOT?
@deepujain wrote, it fails for him too, but I'm curious, if it's better, than 1.1.1 (how many and what exactly errors left).

[gslowikowski]

I've tested this problem myself. My conclusions:

1. There should be some info about this problem and how to properly configure server in Scoverage Jenkins plugin documentation or here in Making Plugins Work section.
2. Simplest, working hudson.model.DirectoryBrowserSupport.CSP property values:
   a) -Dhudson.model.DirectoryBrowserSupport.CSP= - disables all security restrictions
   b) -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self' 'unsafe-inline' https: data:" - reasonable simple and secure value (all possible options here).

[deepujain]

Are you suggesting to move to 1.2.0-SNAPSHOT with Jenkins 2.8 and then i do
not have to

1. Add those headers at the start of jenkins.war
2. I will start seeing code highlights and other CSS again ?

Basically get all the older features to work again ?

On Wed, Jun 8, 2016 at 4:10 AM, Grzegorz Slowikowski <
notifications@github.com> wrote:

I've tested this problem myself. My conclusions:

There should be some info about this problem and how to properly
configure server in Scoverage Jenkins plugin documentation or here
https://wiki.jenkins-ci.org/display/JENKINS/Configuring+Content+Security+Policy
in Making Plugins Work section.
2.

Simplest, working hudson.model.DirectoryBrowserSupport.CSP property
values:
a) -Dhudson.model.DirectoryBrowserSupport.CSP= - disables all security
restrictions
b) -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'
'unsafe-inline' https: data:" - reasonable simple and secure value
(all possible options here http://content-security-policy.com/).

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#15 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAY0-Xp2eWT5lXXZ0uwSCicXxe6RcFnTks5qJqMYgaJpZM4IoB3V
.

Deepak