[JIRA] (JENKINS-59615) Hold back security advisories and update-center.json updates until updates are available

[db...@cloudbees.com (JIRA)]

Title: Message Title

Daniel Beck commented on JENKINS-59615   Re: Hold back security advisories and update-center.json updates until updates are available Tom Reynolds Thanks for the feedback! I'm scratching my head about this though, since this is already what we've doing for years – the security advisory is never even pushed to jenkins-infra/jenkins.io before plugins are available for download on at least one mirror. In fact, the order is (roughly): Push new bits through infra as quickly as possible Update ci.jenkins.io using the regular update center / Docker image Push advisory and rebuild site Once rebuilt, send emails If anything were not accessible to users, we'd notice in step 2, before we publish the advisory. We've also optimized the entire process to take less than an hour from publishing the bits in the first system to sending the email to minimize the potential for curious people reverse engineering the vulnerabilities before fixes are generally available for download. My guess is that your Jenkins instance does not use an HTTPS URL to obtain update center metadata in Manage Jenkins » Manage Plugins » Advanced, which delays the apparent availability of updates to what's on your local mirror. We've switched to obtaining this for all users in new installs via HTTPS two years ago: https://jenkins.io/changelog/#v2.77   Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.202256.1569958012000.9556.1570006860459%40Atlassian.JIRA.