[JENKINS-54133] Document remote console note behavior in test

[jglick]

Studying JENKINS-54133. Safe to merge, but does not do anything at the moment.

[dwnusbaum]

Very helpful to have a test that demonstrates the crux of the issue, thanks!

[jglick]

The smart approach feels terribly hacky.

Perhaps. But consider the ant example, and suppose that we are generating a gigantic log from an Ant build (such as would happen when you type ant in the NetBeans monorepo, for example) and logs are being streamed from an agent to some external sink. Using solely a ConsoleAnnotatorFactory is not really practical because these apply globally to all parts of all builds, and this is matching a rather generic pattern like the three lines consisting of target names in

…
jar-ml:

netbeans:
  [genlist] Generating Auto Update information for org.openide.awt
   [repeat] 
   [repeat] all-api.progress:
     [echo] Building platform/api.progress...

init-tasks:
…

that is only identifiable as “Ant target names” due to the context that this is coming from a process running Ant and not something completely unrelated. So if we go the ConsoleNote route, we need to emit these notes from the agent side. But we cannot trust the agent JVM to sign notes in general, because they are often (though not in this case) written to render instance-supplied HTML or other XSS-oriented data, and we assume that any agent JVM might have been compromised.

So, unless a very different approach is taken, we need to have the master JVM create and sign the notes in advance, then serve them to the agent callable.

[dwnusbaum]

I agree that pre-generating the notes makes sense given the constraints, it just seems like the API was not really designed to support this use case cleanly. Given that it's the best option in some cases, I think updating the documentation like you did will be very helpful in case it comes up for anyone in the future.

[jglick]

[It] seems like the API was not really designed to support this use case cleanly

Indeed. It is a bit hard to say what the API was designed for. See jenkinsci/jenkins@2d7e0d9. There is a more detailed discussion in SECURITY-382.

[svanoort]

Looks fine to me, and I'm always happy to have more testcases -- especially when they include explanations and are easy to read like this one!