Skip to content

Explicitly use Atlassian repository#578

Closed
basil wants to merge 1 commit intojenkinsci:masterfrom
basil:repo
Closed

Explicitly use Atlassian repository#578
basil wants to merge 1 commit intojenkinsci:masterfrom
basil:repo

Conversation

@basil
Copy link
Member

@basil basil commented Dec 4, 2023

See jenkins-infra/helpdesk#3842. This plugin currently depends on JCenter for Atlassian libraries, but JFrog has asked us to stop caching JCenter dependencies. Based on this page, the dependencies we need are officially published at https://packages.atlassian.com/maven-public/ so fetch them from there directly. We choose maven-public rather than maven-external because Atlassian may one day go through a similar bandwidth reduction exercise as we are currently going through right now, and in such an event they would want us to rely on public repositories for third-party libraries, so proactively anticipate such an event by using the repository that contains just Atlassian libraries.

To test this, I verified that I could run mvn clean verify -DskipTests in a clean Docker container (without ~/.m2) and without the JCenter cache:

  <repositories>
    <repository>
      <releases>
        <enabled>true</enabled>
      </releases>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
      <id>repo.jenkins-ci.org</id>
      <url>https://repo.jenkins-ci.org/releases/</url>
    </repository>
    <repository>
      <releases>
        <enabled>true</enabled>
      </releases>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
      <id>orphans</id>
      <url>https://repo.jenkins-ci.org/artifactory/orphans/</url>
    </repository>
    <repository>
      <releases>
        <enabled>true</enabled>
      </releases>
      <snapshots>
        <enabled>false</enabled>
      </snapshots>
      <id>atlassian-maven-public</id>
      <url>https://packages.atlassian.com/maven-public/</url>
    </repository>
  </repositories>

Note that the orphans repository is needed for jbcrypt as explained in jenkins-infra/helpdesk#3842.

@basil basil requested a review from a team as a code owner December 4, 2023 21:54
@basil basil requested a review from MarkEWaite December 4, 2023 22:14
MarkEWaite
MarkEWaite approved these changes Dec 4, 2023
View reviewed changes
Copy link
Contributor

@MarkEWaite MarkEWaite left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@basil basil mentioned this pull request Dec 4, 2023
Closed
20 tasks
@basil basil marked this pull request as draft December 4, 2023 22:50
basil
basil commented Dec 4, 2023
View reviewed changes
Copy link
Member Author

@basil basil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In draft pending a decision as to whether we want to create a remote repository for https://packages.atlassian.com/maven-public/ and include it in the https://repo.jenkins-ci.org/public/ virtual repository as described in jenkins-infra/helpdesk#3842 (comment).

@rantoniuk
Copy link
Member

rantoniuk commented Dec 4, 2023 •
edited
Loading

I remembered this ringed a bell, we've been there before, @jglick any comments from you?

@basil basil closed this Dec 4, 2023
@MarkEWaite
Copy link
Contributor

MarkEWaite commented Dec 5, 2023

I think we should add the Atlassian repository to the pom.xml of this plugin rather than mirror the contents of the Atlassian repository in the Jenkins repository because we're trying to reduce the bandwidth used by the Jenkins repository. Adding another mirror seems like it will increase the bandwidth use rather than reduce it.

@rantoniuk
Copy link
Member

rantoniuk commented Dec 5, 2023

Well, #471

@jglick
Copy link
Member

jglick commented Dec 5, 2023

🤷 historically our policy as I understood it was to forbid use of other <repository>s from Jenkins plugins; and to ensure either that the Jenkins Artifactory aggregated foreign repositories that were needed, or that specific artifacts that rarely changed were directly uploaded. If that policy has changed, and the implications are well understood (generally I find the semantics of repository definitions in Maven to be rather confounding), then go ahead?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@MarkEWaite MarkEWaite MarkEWaite approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@basil @rantoniuk @MarkEWaite @jglick