{
  "schemaVersion": "0.11.0",
  "canonical": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/",
  "atlas": "https://www.pystone.net/?node=linux-cicd-server-svn-jenkins-gerrit#knowledge-atlas",
  "markdown": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit.md",
  "context": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit.context.json",
  "knowledgeVersion": "224c990773de.5fa8af6e39fa",
  "build": {
    "siteCommit": "224c990773de166d23a886306577dd90379529ce",
    "notesCommit": "5fa8af6e39fa3891d1b9b4832bfa6c4e0ecaaf0a",
    "builtAt": "1970-01-01T00:00:00.000Z",
    "version": "224c990773de.5fa8af6e39fa"
  },
  "id": "note:linux-cicd-server-svn-jenkins-gerrit",
  "slug": "linux-cicd-server-svn-jenkins-gerrit",
  "title": "Linux CI/CD 服务搭建实践：SVN、Review Board、Jenkins 与 Gerrit",
  "type": "note",
  "visibility": "public",
  "idStability": "rename-stable",
  "author": {
    "name": "Perrin Yong",
    "profile": "https://www.pystone.net/profile/"
  },
  "publisher": {
    "name": "Perrin Yong",
    "profile": "https://www.pystone.net/profile/"
  },
  "aliases": [],
  "summary": "Linux CI/CD 服务搭建实践：SVN、Review Board、Jenkins 与 Gerrit",
  "contentRole": "unspecified",
  "isMoc": false,
  "mocRecognition": "none",
  "generated": false,
  "attribution": "unspecified",
  "domain": "10-计算机、信息技术与工程",
  "tags": [],
  "mocs": [],
  "contentHash": "38169c6b3c9e0c67188f84f95f9f4b36b48800f39319ac249012a499441a9232",
  "assets": [],
  "headings": [
    {
      "depth": 1,
      "text": "Linux CI/CD 服务搭建实践：SVN、Review Board、Jenkins 与 Gerrit",
      "anchor": "linux-cicd-服务搭建实践svnreview-boardjenkins-与-gerrit",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#linux-cicd-%E6%9C%8D%E5%8A%A1%E6%90%AD%E5%BB%BA%E5%AE%9E%E8%B7%B5svnreview-boardjenkins-%E4%B8%8E-gerrit"
    },
    {
      "depth": 2,
      "text": "先确定部署边界",
      "anchor": "先确定部署边界",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#%E5%85%88%E7%A1%AE%E5%AE%9A%E9%83%A8%E7%BD%B2%E8%BE%B9%E7%95%8C"
    },
    {
      "depth": 2,
      "text": "安全基线",
      "anchor": "安全基线",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#%E5%AE%89%E5%85%A8%E5%9F%BA%E7%BA%BF"
    },
    {
      "depth": 2,
      "text": "SVN 与 Review Board",
      "anchor": "svn-与-review-board",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#svn-%E4%B8%8E-review-board"
    },
    {
      "depth": 3,
      "text": "SVN 服务",
      "anchor": "svn-服务",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#svn-%E6%9C%8D%E5%8A%A1"
    },
    {
      "depth": 3,
      "text": "Review Board",
      "anchor": "review-board",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#review-board"
    },
    {
      "depth": 2,
      "text": "Jenkins",
      "anchor": "jenkins",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#jenkins"
    },
    {
      "depth": 3,
      "text": "Controller 与 Agent",
      "anchor": "controller-与-agent",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#controller-%E4%B8%8E-agent"
    },
    {
      "depth": 3,
      "text": "凭据",
      "anchor": "凭据",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#%E5%87%AD%E6%8D%AE"
    },
    {
      "depth": 2,
      "text": "Gerrit",
      "anchor": "gerrit",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#gerrit"
    },
    {
      "depth": 2,
      "text": "故障排查顺序",
      "anchor": "故障排查顺序",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#%E6%95%85%E9%9A%9C%E6%8E%92%E6%9F%A5%E9%A1%BA%E5%BA%8F"
    },
    {
      "depth": 2,
      "text": "参考资料",
      "anchor": "参考资料",
      "citation": "https://www.pystone.net/notes/linux-cicd-server-svn-jenkins-gerrit/#%E5%8F%82%E8%80%83%E8%B5%84%E6%96%99"
    }
  ],
  "claims": [],
  "outgoing": [],
  "incoming": [
    {
      "id": "note:software-engineering-and-quality",
      "title": "软件工程与质量保障",
      "url": "https://www.pystone.net/notes/software-engineering-and-quality/",
      "atlas": "https://www.pystone.net/?node=software-engineering-and-quality#knowledge-atlas",
      "label": "软件工程与质量保障",
      "origin": "explicit",
      "humanReviewed": true,
      "context": "CI-CD与质量保障/CI-CD工具链中的“【DevOps】Linux服务器实践（ReviewBoard，Jenki”导航项",
      "citation": "https://www.pystone.net/notes/software-engineering-and-quality/#ci-cd%E4%B8%8E%E8%B4%A8%E9%87%8F%E4%BF%9D%E9%9A%9Cci-cd%E5%B7%A5%E5%85%B7%E9%93%BE"
    }
  ],
  "contentMarkdown": "# Linux CI/CD 服务搭建实践：SVN、Review Board、Jenkins 与 Gerrit\n\n> [!warning] 历史材料已通用化\n> 本文由早期服务器部署记录整理而来，已移除地址、账号、口令、密钥、域名、许可证和内部路径。原记录使用的 CentOS Linux 7 已于 2024 年 6 月 30 日停止维护，不应继续作为新部署的默认选择。\n\n## 先确定部署边界\n\n一套代码评审与持续集成环境通常包含：\n\n- 版本控制：SVN 或 Git。\n- 评审入口：Review Board（可连接 SVN/Git）或 Gerrit（以 Git 评审工作流为核心）。\n- 自动化执行：Jenkins Controller 与一个或多个 Agent。\n- 反向代理与 TLS：Nginx、Apache HTTP Server 或云负载均衡。\n- 持久化存储：数据库、制品库、备份存储。\n- 身份与密钥：Jenkins Credentials、系统密钥环或专用密钥管理服务。\n\n生产环境应优先选择仍在安全支持期内的发行版或容器基础镜像，并把系统版本、服务版本、插件版本和恢复步骤记录在基础设施代码中。\n\n## 安全基线\n\n1. **不在笔记、脚本和命令行中写入真实凭据。** 使用凭据 ID、环境变量名或 `<placeholder>`。\n2. **服务账号最小权限。** 构建账号只获得所需仓库、目录和发布目标的权限。\n3. **减少暴露面。** 数据库和管理端口默认仅在内网开放；公网入口通过 TLS 反向代理，并同时检查主机防火墙和云安全组。\n4. **凭据可轮换。** 不共享个人账号；撤销成员权限时不应影响其他流水线。\n5. **备份必须演练恢复。** 至少覆盖配置、数据库、插件清单、凭据密文所依赖的主密钥和制品索引。\n\n## SVN 与 Review Board\n\n### SVN 服务\n\n- 明确仓库根目录、认证方式、授权文件和备份策略。\n- 若通过 HTTP(S) 暴露 SVN，TLS 应在反向代理或 Web 服务器终止。\n- 自动化账号使用独立凭据，不复用开发者个人账号。\n- 升级前验证客户端兼容性，并在副本上测试仓库恢复。\n\n### Review Board\n\nReview Board 需要 Web 服务、数据库及仓库访问凭据。部署时应：\n\n- 为站点配置独立数据库用户；\n- 通过管理界面或密钥管理机制保存仓库凭据；\n- 限制管理界面来源并启用 TLS；\n- 将站点配置、数据库和上传文件纳入备份。\n\n具体安装命令会随发行版和 Review Board 版本变化，应以项目当前安装文档为准。\n\n## Jenkins\n\n### Controller 与 Agent\n\n- Controller 负责调度、配置和状态管理，不承担高风险或高负载构建。\n- 构建在隔离的 Agent 上执行；不同信任级别的项目不要共享高权限 Agent。\n- 插件数量保持最小，升级前导出插件清单并在测试实例验证。\n\n### 凭据\n\n把 SVN/Git、制品库、签名和部署凭据存入 Jenkins Credentials，以凭据 ID 在流水线中引用。日志中避免输出环境变量、调试转储或包含秘密的命令参数。即便使用 `withCredentials`，也要防止不受信任的构建步骤读取同一进程或工作区中的秘密。\n\n```groovy\nwithCredentials([usernamePassword(\n  credentialsId: 'scm-service-account',\n  usernameVariable: 'SCM_USER',\n  passwordVariable: 'SCM_PASSWORD'\n)]) {\n  sh 'run-build-with-secret-from-environment'\n}\n```\n\n示例只表达调用结构；实际脚本仍应关闭命令回显，并避免把秘密写入参数、文件或制品。\n\n## Gerrit\n\nGerrit 与普通 Git 托管的关键差异是变更通常先进入评审引用，再由评审结果决定是否合入目标分支。部署时重点检查：\n\n- SSH/HTTP Git 访问与 Web 入口的端口边界；\n- 反向代理是否正确传递主机名、协议和认证头；\n- 邮件、LDAP/OIDC 等外部集成是否使用独立服务账号；\n- 数据库、索引、插件、仓库目录和配置文件是否能一致恢复。\n\n## 故障排查顺序\n\n1. 确认 DNS、路由、云安全组和主机防火墙。\n2. 确认服务是否监听预期地址与端口。\n3. 检查反向代理上游、TLS 证书链和转发头。\n4. 用服务账号在 Agent 上独立验证仓库访问。\n5. 检查磁盘、inode、文件权限、SELinux/AppArmor 和系统日志。\n6. 最后检查 Jenkins 任务、插件与流水线配置，避免把网络或权限问题误判为插件故障。\n\n## 参考资料\n\n- [CentOS Linux 停止维护说明](https://www.centos.org/centos-linux/)\n- [Jenkins Credentials Binding 插件](https://plugins.jenkins.io/credentials-binding)\n- [Review Board 官方文档](https://www.reviewboard.org/docs/)\n- [Gerrit 官方文档](https://www.gerritcodereview.com/)\n"
}