Skip to content

Fix: Persist service credentials during silent install (JENKINS-71643)#725

Open
viru0909-dev wants to merge 4 commits intojenkinsci:masterfrom
viru0909-dev:fix/jenkins-71643-secure-properties
Open

Fix: Persist service credentials during silent install (JENKINS-71643)#725
viru0909-dev wants to merge 4 commits intojenkinsci:masterfrom
viru0909-dev:fix/jenkins-71643-secure-properties

Conversation

@viru0909-dev
Copy link
Contributor

@viru0909-dev viru0909-dev commented Jan 1, 2026

Fixes #703

The Issue
During a silent installation (e.g., msiexec /i jenkins.msi /quiet), the SERVICE_USERNAME and SERVICE_PASSWORD properties were being stripped when the Windows Installer switched from the client process (UI sequence) to the elevated system process (Execute sequence). This caused the service to fail to start or default to LocalSystem.

The Fix
SERVICE_USERNAME: Added the Secure="yes" attribute to the property definition.

SERVICE_PASSWORD: Used SetProperty elements (scheduled After="AppSearch") to dynamically add this property to the SecureCustomProperties and MsiHiddenProperties lists at runtime.

Note: This approach was chosen over adding attributes directly to SERVICE_PASSWORD because that property is defined in an imported WiX library, which caused "Duplicate Symbol" errors during compilation when redefined.

Verification
Verified on Windows 10.

I built the MSI locally from this branch and performed a silent installation with verbose logging: msiexec /i "bin\Release\en-US\jenkins-2.544.msi" /quiet /lv! install.log SERVICE_USERNAME="TestUser" SERVICE_PASSWORD="Password123"

Result:

The log confirms SERVICE_USERNAME was successfully passed to the server process.

The log confirms SERVICE_PASSWORD was successfully masked (**********).

Adding Secure="yes" prevents the Windows Installer from dropping these properties during the UI-to-Execute sequence transition.
@viru0909-dev viru0909-dev requested a review from a team as a code owner January 1, 2026 15:07
@viru0909-dev viru0909-dev force-pushed the fix/jenkins-71643-secure-properties branch from c30c32e to ae68f20 Compare January 2, 2026 05:35
@viru0909-dev
Copy link
Contributor Author

@MarkEWaite I have verified the fix on a Windows machine.

Verification Results: I built the MSI locally and ran a silent install:
msiexec /i "bin\Release\en-US\jenkins-2.544.msi" /quiet /lv! install.log SERVICE_USERNAME="TestUser" SERVICE_PASSWORD="Password123"

image

As shown in the attached screenshot of the verbose log, the SERVICE_USERNAME is successfully passed to the Server (s) execution sequence, and the SERVICE_PASSWORD is correctly masked.

**

I also updated the implementation to use SetProperty elements scheduled After="AppSearch", which avoids the "Duplicate Symbol" error I encountered with the previous approach.

@viru0909-dev viru0909-dev force-pushed the fix/jenkins-71643-secure-properties branch from ae68f20 to 8d6e0dc Compare January 2, 2026 05:58
@viru0909-dev viru0909-dev force-pushed the fix/jenkins-71643-secure-properties branch from 8d6e0dc to dcba942 Compare January 2, 2026 06:09
@slide slide self-assigned this Feb 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[JENKINS-71643] Windows silent install behaves different than graphical install

2 participants