[JIRA] (JENKINS-59615) Hold back security advisories and update-center.json updates until updates are available

[tomr...@megaglest.org (JIRA)]

Title: Message Title

Tom Reynolds commented on JENKINS-59615   Re: Hold back security advisories and update-center.json updates until updates are available Thanks for your prompt reply. I just recollect the events which lead to this, and I think it went like this: I noticed the security advisory you posted to oss-security, referring to https://jenkins.io/security/advisory/2019-10-01/ I logged in to our Jenkins (LTS, via Ubuntu package, now at ver. 2.190.1) installation and made it check for plugin updates, it (always) uses this URL: https://updates.jenkins-ci.org/update-center.json It listed an update for the Script Security plugin I chose to download and install this update I got a download error (HTTP status 404) for the Script Security plugin. I discussed this on IRC and posted this issue I retried the update. The output then was weird - it looked as if our installation had attempted three plugins, but all of them were for the Script Security plugin. It was listing two failed Script Security plugin upgrades (again 404s with traces) and then a successful upgrade. After restarting Jenkins the plugin is properly upgraded, no pending upgrades are listed. If you need more information on our Jenkins installation I'm happy to provide it, including logs if you can provide specific instructions. Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.202256.1569958012000.9657.1570018140482%40Atlassian.JIRA.