Liquibase Plugin and INFRA-2622

[Robert Reeves]

Hi!

 

Regarding the blocker on releasing the fixed Liquibase Plugin, I wanted to start a conversation on releasing the plugin.

 

https://issues.jenkins-ci.org/browse/INFRA-2622

 

Please let me know your thoughts.

 

Thanks!

 

Robert

[Oleg Nenashev]

Hi Robert,

I confirm that there is a problem with the current library distribution, and that we could not distribute it as is according to the current Governance document. I am happy to bring up this topic at the today's governance meeting, but my personal recommendation is to consider technical solutions which would prevent bundling of the proprietary library in the plugin.

Did you consider suggestions by Daniel in the Infra ticket?

 Flyway is implemented as a tool installer, so the Jenkins project only distributes pure OSS:

https://github.com/jenkinsci/flyway-runner-plugin/blob/master/src/main/java/sp/sd/flywayrunner/installation/FlywayInstaller.java

Similar approaches were done in the past; a popular one for a while was to have an "installer" plugin, like https://github.com/jenkinsci/cloudbees-enterprise-plugins-plugin – then the only bits actually distributed by the Jenkins project are under an open source license.

Best regards,

Oleg 

[Robert Reeves]

We absolutely have! Thanks!

I would love for you to bring it up at the Governance meeting today. Would it be possible to resolve this at an agreed upon date and release it as is in the interim? If it isn't resolved by the agreed date, I would expect the plugin to be unpublished.

Please let me know the team's toughts!

Robert

[Oleg Nenashev]

Hello Robert,

Unfortunately we did not get to this topic today at the meeting. The consensus is that we would be doing it in the mailing list. Unfortunately the meeting was already in progress when your response arrived, and we did not consider the interim solution. So let's keep discussing it here.

My IMHO: To be published on an interim basis, it would need an explicit sign-off from the Governance Board, Jenkins Security Officer, and a general consensus among participants of this thread. It would also need to comply with other criteria defined for hosting plugins.

Best regards,

Oleg

--
You received this message because you are subscribed to a topic in the Google Groups "Jenkins Developers" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/jenkinsci-dev/dRz1QP_ndPo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to jenkinsci-de...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/7c34dd49-fe46-4e54-83ef-f69b74d5de75%40googlegroups.com.

[Oleg Nenashev]

Hi,

I forgot to update this thread, sorry. On June 17, 2020 we discussed this topic at the Governance meeting, meeting notes are available here.

The decision reflects the previous state: "private-source dependencies may not be bundled in Jenkins plugins hosted on Jenkins UC, use alternative solutions like on-demand download"

Best regards,

Oleg

To unsubscribe from this group and all its topics, send an email to jenkinsci-dev+unsubscribe@googlegroups.com.