Using Non-Standard Maven Repositories for Plugin Builds on Jenkins Infrastructure

[Verachten Bruno]

Hello there 👋

I have a question regarding plugin builds on the Jenkins
infrastructure. Are we limited to using only official Maven
repositories?

I'm working on a plugin that compiles successfully on my local
machine. However, the build fails on the infrastructure because one of
its dependencies (which is quite exotic) cannot be found. The Maven
repository containing this dependency is actually a GitHub repository.

Is using this type of dependency download forbidden? I would
understand if it is, due to potential security concerns.

You can see the build failure here:
https://ci.jenkins.io/job/Plugins/job/open-stf-plugin/job/PR-27/6/console

Could you please clarify the policy on using non-standard Maven
repositories in plugin builds? If it's not allowed, could you suggest
any alternatives or workarounds?

Thank you for your time and assistance.

Best regards,

Bruno Verachten

[Daniel Beck]

On Wed, Jul 24, 2024 at 8:15 AM Verachten Bruno <goun...@gmail.com> wrote:

Is using this type of dependency download forbidden? I would
understand if it is, due to potential security concerns.

You can see the build failure here:
https://ci.jenkins.io/job/Plugins/job/open-stf-plugin/job/PR-27/6/console

It's not prohibited in that there's a rule against it, but I would discourage it due to concerns about long-term availability of some third party Maven repos.

GH specifically has the problem of not allowing anonymous access, so those don't really work in our setup.

[Verachten Bruno]

Thank you, Daniel.
I forked the original repo, and I am now in the process of publishing
a new package to Maven Central.

> --
> You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/CAMo7Pt%2BwL4Eozqt80Xbw-4LiX1qJE2Fb9at_qtzAp6gw5zXfpg%40mail.gmail.com.



--
Bruno Verachten