Add verified Jenkins deployment source

[BenCodez]

Summary

• allow direct VotingPlugin JAR uploads over HTTP only when the actual client socket is loopback, link-local, private IPv4, or IPv6 ULA
• permit reverse-proxied uploads only for explicitly trusted proxies configured for secure cookies and an HTTPS forwarded request
• add a server-defined, allowlisted bencodez.com Jenkins source for the latest successful VotingPlugin development build
• compute and display SHA-256 after download, then reuse the existing verified artifact and per-node deployment pipeline

Security and compatibility

• HTTPS remains recommended and continues to work everywhere
• browsers cannot supply an arbitrary download URL; the Jenkins origin, job, artifact path, and filename pattern are fixed server-side
• redirects are rejected, metadata and artifact transfers are bounded, and stalled metadata body reads have an independent deadline
• downloaded and uploaded files pass the existing bounded JAR/plugin.yml validation
• Control computes a content-addressed SHA-256; each VotingPlugin node independently verifies the exact size and SHA-256 before staging
• older connectors remain connected but are shown as ineligible until they advertise plugin.deploy.v1

Validation

• node --test src/test/web/*.test.cjs: 115 passed
• mvn -B clean verify: 281 passed
• focused JenkinsVotingPluginSourceTest,ControlHttpServerTest: 32 passed
• git diff --check: clean
• fresh independent read-only review: No findings

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f5c37fc6-3783-4a12-9e21-f381c4985ab2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T04:48:17.887763Z	dd736bd	New commits
🔒 Security Review	✅ Completed 2026-09-29T03:06:11.278478Z	61512fd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 61512fd589

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd736bdba3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.