[JENKINS-71783] Configure aclApprovedSignatures with JCasC

[jenkins-infra-bot]

Currently it is possible to add approved signatures with JCasC as follows:

security:
  scriptApproval:
    approvedSignatures:            
    - "field hudson.model.UpdateSite$Entry version"
    - "method hudson.model.Run getCause java.lang.Class" 

I could not find a way to add signatures approved assuming permission check (using an ACL: access control list). I have tried the following but it did not work:

security:
  scriptApproval:
    aclApprovedSignatures:
    - "staticMethod jenkins.model.Jenkins getInstance"
    approvedSignatures:            
    - "field hudson.model.UpdateSite$Entry version"
    - "method hudson.model.Run getCause java.lang.Class"  

It would be great to have such improvement.

---

Originally reported by vittorio_c82, imported from: Configure aclApprovedSignatures with JCasC

• status: Open
• priority: Major
• component(s): script-security-plugin
• label(s): jenkins, plugin
• resolution: Unresolved
• votes: 1
• watchers: 2
• imported: 2025-12-09

Raw content of original issue

Currently it is possible to add approved signatures with JCasC as follows:

security:
  scriptApproval:
    approvedSignatures:            
    - "field hudson.model.UpdateSite$Entry version"
    - "method hudson.model.Run getCause java.lang.Class" 


I could not find a way to add signatures approved assuming permission check (using an ACL: access control list). I have tried the following but it did not work:

security:
  scriptApproval:
    aclApprovedSignatures:
    - "staticMethod jenkins.model.Jenkins getInstance"
    approvedSignatures:            
    - "field hudson.model.UpdateSite$Entry version"
    - "method hudson.model.Run getCause java.lang.Class"  

It would be great to have such improvement.

environment

- Jenkins 2.401.3<br/>
- Configuration as Code Plugin 1670.v564dc8b_982d0<br/>
- Script Security Plugin 1264.vecf66020eb_7d

[jenkins-infra-bot]

burninghelix123:

• Original comment link
• Raw content of original comment:

  This is particularly important because blanket approving is not secure.
  And right now standing up a new Jenkins server means either having to go through tons of errors / failed jobs approving one at a time with ACL's or blanket approving them. Being able to provision ACL signatures with JCasC would help make that process drastically easier and more secure.
  

This is particularly important because blanket approving is not secure.
And right now standing up a new Jenkins server means either having to go through tons of errors / failed jobs approving one at a time with ACL's or blanket approving them. Being able to provision ACL signatures with JCasC would help make that process drastically easier and more secure.