These changes were suggested by Extra Hints for NetBeans IDE:
http://plugins.netbeans.org/plugin/73447/

Pulls in fixes for: JENKINS-48133, JENKINS-48055, JENKINS-37566, JENKINS-48309, JENKINS-47965, JENKINS-48130, JENKINS-37670, JENKINS-37566, JENKINS-46724 

This change also adds some missing null/closing channel checks in the core.
In some cases the change prevents spawning threads if the channel is in the invalid state.

* Use "Files.createTempDirectory" to create temp directory instead
See SonarQube critical vulnerability squid:S2976 (tag: owasp-a9)
https://next.sonarqube.com/sonarqube/coding_rules#rule_key=squid%3AS2976

* [JENKINS-48227]
Creating a utility "static Path toPath(File file) throws IOException" method,
which wraps InvalidPathException to IOException so that it will be checked.
- also fixed public static final reference
- fixed broken test cases
- added new test cases for toPath() and createTempDir()

* Revert back to public static int

* adjustments due to merges

* Add posix check to determine if Posix FileAttributes should be included
in call to Files.createTempDirectory()

* Remove reference to private element

* Updated to use explicit imports

* Deprecate Jenkins.getInstance in favor of (usually) getActiveInstance.

* Introduced get() as a concise non-null accessor.

* May as well suggest rewrites of getActiveInstance too.

* Add getSystemProperty(key) to fix hudson.consoleTailKB system property

* Add Javadoc, @Restricted and delegate to SystemProperties

These changes were requested by @daniel-beck.

* PR was not merged in time for 2.96

* Changes as requested by @oleg-nenashev

This reverts commit eb77e5f2.

* [JENKINS-22474] API Token does not require CSRF token
- in order to ease the use of the api, we are not requiring the request to have a crumb
- in terms of security it's not a problem normally since the CSRF attacks use the cookies and in case of API Token, it's session-less / cookie-less

* - adjust the license header

* - add test for basic authentication
- add test for login process

* - add test for form submission using ui (htmlunit), not just login form

* - modification requested by Jesse

* - pom.xml update to use the last version of jenkins-test-harness (with the token helper methods)
- beginning of the simplification of tests

* - using the try-with-resource approach to ease readability

* - using closure method now

* - add missing login transformation

* - add unit test

* - use withToken
- remove useless crumb for GET method
- add fail (otherwise the assert in catch is not as useful as it could be)

* another bunch of test cases

* - for HudsonTestCase, some additional modifications are required: changing the view / different type of management for the variable inside the views

* - small other tests

* - last batch for the login method

* - crumb is not more required since we are using API Token

* - converting auth to ApiToken to avoid crumb method

* - converting auth to ApiToken to avoid crumb method (second)

* - remove usage of closure aware methods

* - update the pom using the snapshot as adviced by Jesse
- modifications on other class to adapt to the last modifications in JTH

* - modifications requested during code review

* - also put back my changes to the conflicted file

* - correction of the merge :)

* Use NIO in tryOnceDeleteFile and makeWritable

* Don't try to set PosixFileAttributes on Windows

* Do not create arbitrary exceptions in makeWritable to fix test failures on Windows

* Remove unhelpful layer of exception wrapping

* Add test exercising Util#makeWritable in Util#tryOnceDeleteFile

* Add test for deleting a non-existant file

* Return early if changing permissions with NIO succeeds

* Move an instance of renameTo() to Files.move()

* Replace an instance of File.toURI() with an instance of Path.toUri()

* Replace mkdirs() with Files.createDirectories()
Replace mkdir() with Files.createTempDirectory()

* Undo addition of createTempDirectory() as per review comments

* Return to use of FilePath#mkdirs(File) and instead modify it to use the new API.

* Undo addition of toPath() in a URI conversion as it brings no benefits.

* Replace new uses of toPath() with Util.fileToPath() to pre-handle runtime exceptions

* Remove * import.
move mkdirs() to using FilePath method instead of File method.

* Make IOUtils.mkdirs(File) use Java7 API calls

* Add back accidentally removed imports.

* Fixed use of wildcard import

* Use utility method fileToPath() to handle potential exception thrown

* Introduce UserIdCause constructor, which accepts userId as an argument.

* [JENKINS-48467] - UserIdCuase: Add issue link in the TODO comment

* [JENKINS-27026] Notify the SecurityListener in case of Token based authentication success
- due the current version of the method, the UserDetails required for the event was not accessible. In order to stay with the same API in SecurityListener, two "protected" methods were created to split the job and let the UserDetails accessible

* - add test to ensure the SecurityListener is called for REST Token but also for regular basic auth

* - remove the comment about the split, will be put in GitHub comment instead

* - add check for anonymous call instead of just putting a comment
- remove the constructor in the dummy
- add link to PR from Daniel to simplify a call

* - separate the before/after to save one clear and be more explicit
- put more meaning in the assertLastEventIs method by explicitly say we will remove the last event

* - add comment about why we do not fire the "failedToAuthenticated" in the case of an invalid token (tips: it's because it could be a valid password)

* - also add the authenticated trigger on legacy filter as pointed by Ivan

* - add support of event on CLI remoting authentication
- adjust tests by moving the helper class used to spy on events

* - as mentioned Yvan, the code had some problems with null checking, so the approach is changed in order to encapsulate all that internal mechanism

* - add javadoc
- open the getUserDetailsForImpersonation from the User (will let the SSHD module to retrieve UserDetails from that)

* - remove single quote in log messages

* - basic corrections requested by Jesse

* - just another typo

* - adjust the javadoc for SecurityListener events

* - add the link to Jenkins#Anonymous

* - add link (not using see)

* - update comment on the isAnonymous as we (me + Oleg) do not find a best place at the moment

* - put the new method isAnonymous in ACL instead of Functions

* - little typo
- add requirement about the SecurityContext authentication

* [JENKINS-47439] Add a failing test

On first startup, the setup wizard goes into state NEW and the filter to
force display the setup wizard is installed.

On second startup, the setup wizard goes into state RESTART (which
assumes the setup wizard is done), and the setup wizard is skipped
completely.

This test expects that state NEW is retained upon restart when nothing
is done.

* [JENKINS-47439] Persist InstallState

In some cases, the heuristics to determine the current setup wizard state are
fragile. It is safer to persist the install state so that upon restart,
the setup wizard can resume where it was left off.

* Missing javadoc and since for new public methods

* s/XXX/FIXME/

* Missed that one

* Setup wizard filter should be removed when entering a state where setup is complete

* Use parameterized logging

* Improvements over previous impl

* Removed static isUsingSecurityToken. Now only determined from install
state.
* Call onInstallStateUpdate before InstallState#initializeState as the
latter can update state.

* Triggering a new build

[JENKINS-20474] Optimize away ACL construction and AuthorizationStrategy calls when checking permissions for SYSTEM.

* Use NIO for FilePath#chmod and IOUtils#mode

* Add tests for NIO mode and chmod implementations

* Add test, remove new method, and update JavaDoc

* Provide system property to use native implementations of chmod and mode

* Revert unrelated whitespace modification

* Don't remove exception from throws and put imports in original location

* Fix broken JavaDoc links

* Ignore file type bits (above 0o7777) in Util#modeToPermission

* Use octal for constants and don't include file type bits

* Revert unnecessary changes to TarArchiverTest

* Add assertion that non-permission bits are ignored by chmod

* Use NIO copy with StandardCopyOption.COPY_ATTRIBUTES in copyToWithPermissions where possible

* Catch InvalidPathException and convert it to IOException

* Create utility method for File#toPath and use File#createDirectories after review

* Remove useless calls to toAbsolutePath and getAbsoluteFile

* Fix typos and use octal for constant after review

* Add test for behavior of copyToWithPermission with special bits

* Add default implementations to deprecated methods of BuilableItem and Item.

Currently the interface requires the API user to implement already deprecated methods.
It does not make much sense, and the API could be simplified.

* Address comments from @jglick

[JENKINS-47909] Handle false hex escapes

(cherry picked from commit 7c06a9ba)

The path could already exist, *but* not be a directory.
Nice catch James.

Associated tests.

Not that critical, but still can keep them as we should
generally be on FS that support atomic moves. Hence not
enter that catch.

If proved otherwise, we'll reconsider adjusting this verbosity.

* Introducing ItemGroup.allItems and similar default methods.

* Do not get me started.

It might be preferrable from a consistency standpoint,
but many CLI tests start failing when you force this.

So, as the previous behaviour was not forcing the sync, this seems
to show there could be unintended behavioural changes in effect.

Possibly, we'll want to address this later, but as the main goal
here was to make commit() atomic as much as possible, fixing
this is probably another story anyway.

Note: I was *never* able to reproduce those failures on my machine in
a normal env dev. It was only visible in CI.
I finally managed to make it reproducible (but still a bit randomly) by
using Docker resource constraints, using something like this:

* cd to jenkins local clone
* `docker run -ti -v m2repo:/root/.m2/repository -v $PWD:/work -v ~/.m2/settings.xml:/root/.m2/settings.xml:ro -v ~/.m2/settings-security.xml:/root/.m2/settings-security.xml:ro --device-write-iops /dev/mapper/fedora-home:40 --device-read-iops /dev/mapper/fedora-home:40  --device-write-bps /dev/mapper/fedora-home:10m --device-read-bps /dev/mapper/fedora-home:10m maven:3.5.2-jdk-8 bash`
* cd /work
* `mvn clean install -Dtest=WaitNodeOfflineCommandTest,RunRangeCommandTest -Dfindbugs.skip=true  -DfailIfNoTests=false -Dskip.npm=true`

Failure example:

```
ERROR] Tests run: 6, Failures: 2, Errors: 0, Skipped: 0, Time elapsed: 55.68OfflineCommandTest
[ERROR] waitNodeOfflineShouldSucceedOnDisconnectingNode(hudson.cli.WaitNodeOf  <<< FAILURE!
java.lang.AssertionError:

Expected: <true>
     but: was <false>
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:8)
        at hudson.cli.WaitNodeOfflineCommandTest.waitNodeOfflineShouldSucceedndTest.java:128)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorIm
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAc
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(Framew
        at org.junit.internal.runners.model.ReflectiveCallable.run(Reflective
        at org.junit.runners.model.FrameworkMethod.invokeExplosively(Framewor
        at org.junit.internal.runners.statements.InvokeMethod.evaluate(Invoke
        at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefor
        at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:542)
        at org.junit.internal.runners.statements.FailOnTimeout$CallableStatem
        at org.junit.internal.runners.statements.FailOnTimeout$CallableStatem
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.lang.Thread.run(Thread.java:748)

[ERROR] waitNodeOfflineShouldSucceedOnDisconnectedNode(hudson.cli.WaitNodeOff <<< FAILURE!
java.lang.AssertionError
```

* [JENKINS-48157] - Reproduce the issue in test

* [JENKINS-48157] - Annotate and document nullness conditions in MyViewsProperty and ViewGroupMixIn

* [FIXED JENKINS-48157] - Prevent NPEs when using public API and when using null primaryViewName

* [JENKINS-48157] - Fix typo in Javadoc

I see we enter that catch, and the `else` in a failing test.
But I'm somewhat stuck since I miss both the stack, and even at
least the exception being thrown and not being an
`AtomicMoveNotSupportedException`.

It's possibly an `IOException` or some subclass. But still having the
stack could help understand why the test fails, and provide more
data for diagnosis in the future in production use.

```
=== Starting hudson.cli.RunRangeCommandTest
   0.007 [id=96]	WARNING	o.jvnet.hudson.test.JenkinsRule#before: Jenkins.theInstance was not cleared by a previous test, doing that now
   0.018 [id=96]	INFO	o.jvnet.hudson.test.JenkinsRule#createWebServer: Running on http://localhost:45833/jenkins/
   0.037 [id=15]	WARNING	jenkins.model.Jenkins#cleanUp: This instance is no longer the singleton, ignoring cleanUp()
   0.345 [id=96]	WARNING	hudson.util.AtomicFileWriter#commit: Unable to move atomically, falling back to non-atomic move.
   0.345 [id=96]	SEVERE	hudson.util.AtomicFileWriter#commit: Unable to move /home/jenkins/workspace/Core_jenkins_PR-2548-5VRJ4BBBSEGVOZEA7OVAL2YLTLCBL55RB4LDQIZN56WJZD4M6ZKA/test/target/jenkinsTests.tmp/jenkins333129509690162870test/atomic9184049448662376708tmp to /home/jenkins/workspace/Core_jenkins_PR-2548-5VRJ4BBBSEGVOZEA7OVAL2YLTLCBL55RB4LDQIZN56WJZD4M6ZKA/test/target/jenkinsTests.tmp/jenkins333129509690162870test/secret.key. Attempting to delete /home/jenkins/workspace/Core_jenkins_PR-2548-5VRJ4BBBSEGVOZEA7OVAL2YLTLCBL55RB4LDQIZN56WJZD4M6ZKA/test/target/jenkinsTests.tmp/jenkins333129509690162870test/atomic9184049448662376708tmp and abandoning.
```

Currently Jenkins to fire WorkflowJob re-calculates the ConstistentHash
for entire cluster even if there is no nodes were updated. If cluster is
big enough (>100 nodes), it becomes a problem, because MD5 is quite
expensive itself plus all this logic comes with high memory footprint.

Using the knowledge that WorkflowJob can be executed only on Jenkins master,
we can create a shortcut that does not do expensive calculation and just
returns Runnable or `null`.

Files.createDirectories(dir) is said to not fail if directory already
exists.
*But* this will still fail if `dir` is actually a symlink to a
directory...
This is documented in the Javadoc indeed, even if probably not really
one would expect...

See https://bugs.openjdk.java.net/browse/JDK-8130464

Without this fix:
```
[INFO] Running hudson.util.SecretRewriterTest
Cycle detected: /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/c/symlink
Scanning /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/c/foo.xml
Rewritten /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/c/foo.xml
Rewritten /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/c/d/foo.xml
Rewritten /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/c/d/e/foo.xml
ERROR: Failed to rewrite /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/a/symlink/foo.xml
java.nio.file.FileAlreadyExistsException: /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/a/symlink
        at sun.nio.fs.UnixException.translateToIOException(UnixException.java:88)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
        at sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:384)
        at java.nio.file.Files.createDirectory(Files.java:674)
        at java.nio.file.Files.createAndCheckIsDirectory(Files.java:781)
        at java.nio.file.Files.createDirectories(Files.java:727)
        at hudson.util.AtomicFileWriter.<init>(AtomicFileWriter.java:103)
Caused: java.io.IOException: Failed to create a temporary file in /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/a/symlink
        at hudson.util.AtomicFileWriter.<init>(AtomicFileWriter.java:106)
        at hudson.util.AtomicFileWriter.<init>(AtomicFileWriter.java:73)
        at hudson.util.SecretRewriter.rewrite(SecretRewriter.java:85)
        at hudson.util.SecretRewriter.rewriteRecursive(SecretRewriter.java:166)
        at hudson.util.SecretRewriter.rewriteRecursive(SecretRewriter.java:176)
        at hudson.util.SecretRewriter.rewriteRecursive(SecretRewriter.java:176)
        at hudson.util.SecretRewriter.rewriteRecursive(SecretRewriter.java:141)
        at hudson.util.SecretRewriter$rewriteRecursive$0.call(Unknown Source)
        at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:113)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:133)
        at hudson.util.SecretRewriterTest.recursionDetection(SecretRewriterTest.groovy:110)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
        at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
        at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
        at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
        at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
        at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
        at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
        at org.junit.rules.RunRules.evaluate(RunRules.java:20)
        at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
        at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
        at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
        at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
        at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
        at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
        at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
        at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
        at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
        at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:365)
        at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:272)
        at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:236)
        at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:159)
        at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:386)
        at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:323)
        at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:143)
Rewritten /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/a/foo.xml
Cycle detected: /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/b/symlink
Rewritten /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t/b/foo.xml
[ERROR] Tests run: 2, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 1.097 s <<< FAILURE! - in hudson.util.SecretRewriterTest
[ERROR] recursionDetection(hudson.util.SecretRewriterTest)  Time elapsed: 0.176 s  <<< FAILURE!
Assertion failed:

assert 6==sw.rewriteRecursive(t, st)
        | |  |                |  |
        | |  5                |  hudson.util.StreamTaskListener@34a2d6e0
        | |                   /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t
        | hudson.util.SecretRewriter@2525a5b8
        false

        at org.codehaus.groovy.runtime.InvokerHelper.assertFailed(InvokerHelper.java:404)
        at org.codehaus.groovy.runtime.ScriptBytecodeAdapter.assertFailed(ScriptBytecodeAdapter.java:650)
        at hudson.util.SecretRewriterTest.recursionDetection(SecretRewriterTest.groovy:110)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
        at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
        at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
        at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
        at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
        at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
        at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
        at org.junit.rules.RunRules.evaluate(RunRules.java:20)
        at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
        at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
        at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
        at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
        at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
        at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
        at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
        at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
        at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
        at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:365)
        at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:272)
        at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:236)
        at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:159)
        at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:386)
        at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:323)
        at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:143)

[INFO]
[INFO] Results:
[INFO]
[ERROR] Failures:
[ERROR]   SecretRewriterTest.recursionDetection:110 assert 6==sw.rewriteRecursive(t, st)
        | |  |                |  |
        | |  5                |  hudson.util.StreamTaskListener@34a2d6e0
        | |                   /home/tiste/dev/JENKINS/jenkins/core/target/junit7537647214741745549/t
        | hudson.util.SecretRewriter@2525a5b8
        false
[INFO]
[ERROR] Tests run: 2, Failures: 1, Errors: 0, Skipped: 0
```