Overhaul update site generation

pom.xml

@@ -3,14 +3,26 @@
   <parent>
     <groupId>org.jenkins-ci</groupId>
     <artifactId>jenkins</artifactId>
-    <version>1.35</version>
+    <version>1.54</version>
   </parent>
+
   <artifactId>update-center2</artifactId>
 
-  <version>2.1-SNAPSHOT</version>
+  <version>3.0-SNAPSHOT</version>
   <name>Update center generator for jenkins-ci.org</name>
   <description>Generates update center script</description>
 
+  <properties>
+    <java.level>8</java.level>
+    <main.class>io.jenkins.update_center.Main</main.class>
+    <spotbugs.failOnError>false</spotbugs.failOnError>
+    <spotbugs.threshold>High</spotbugs.threshold>
+    <!-- TODO reduce threshold and resolve further issues -->
+    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+    <project.build.outputEncoding>UTF-8</project.build.outputEncoding>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
   <build>
     <plugins>
       <plugin>
@@ -31,12 +43,54 @@
           <target>1.8</target>
         </configuration>
       </plugin>
+      <plugin>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>display-info</id>
+            <phase>validate</phase>
+            <goals>
+              <goal>display-info</goal>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <enforceBytecodeVersion>
+                  <maxJdkVersion>1.${java.level}</maxJdkVersion>
+                  <ignoredScopes>
+                    <ignoredScope>test</ignoredScope>
+                  </ignoredScopes>
+                </enforceBytecodeVersion>
+              </rules>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>animal-sniffer-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <goals>
+              <goal>check</goal>
+            </goals>
+            <id>check</id>
+            <phase>test</phase>
+          </execution>
+        </executions>
+        <configuration>
+          <signature>
+            <groupId>org.codehaus.mojo.signature</groupId>
+            <artifactId>java1${java.level}</artifactId>
+          </signature>
+        </configuration>
+      </plugin>
       <plugin>
         <artifactId>maven-assembly-plugin</artifactId>
         <executions>
           <execution>
             <goals>
-              <goal>attached</goal>
+              <goal>single</goal>
             </goals>
             <phase>package</phase>
             <configuration>
@@ -47,7 +101,6 @@
           </execution>
         </executions>
       </plugin>
-
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>appassembler-maven-plugin</artifactId>
@@ -72,22 +125,21 @@
     </plugins>
   </build>
 
-  <properties>
-    <keyName>${project.basedir}/test</keyName>
-    <args4j.version>2.0.19</args4j.version>
-    <main.class>org.jvnet.hudson.update_center.Main</main.class>
-  </properties>
-
   <dependencies>
     <dependency>
       <groupId>org.jvnet.hudson</groupId>
       <artifactId>crypto-util</artifactId>
       <version>1.0</version>
     </dependency>
     <dependency>
-      <groupId>dom4j</groupId>
+      <groupId>com.alibaba</groupId>
+      <artifactId>fastjson</artifactId>
+      <version>1.2.61</version>
+    </dependency>
+    <dependency>
+      <groupId>org.dom4j</groupId>
       <artifactId>dom4j</artifactId>
-      <version>1.6.1</version>
+      <version>2.1.1</version>
     </dependency>
     <dependency>
       <groupId>org.hamcrest</groupId>
@@ -97,32 +149,23 @@
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>okhttp-urlconnection</artifactId>
-      <version>3.10.0</version>
+      <version>4.5.0</version>
     </dependency>
     <dependency>
       <groupId>jaxen</groupId>
       <artifactId>jaxen</artifactId>
-      <version>1.1.1</version>
-    </dependency>
-    <dependency>
-      <groupId>org.kohsuke</groupId>
-      <artifactId>github-api</artifactId>
-      <version>1.99</version>
-    </dependency>
-    <dependency>
-      <groupId>com.sun.xml.bind</groupId>
-      <artifactId>jaxb-impl</artifactId>
-      <version>2.1.6</version>
+      <version>1.2.0</version>
     </dependency>
     <dependency>
       <groupId>org.kohsuke.stapler</groupId>
       <artifactId>json-lib</artifactId>
       <version>2.1-rev7</version>
+      <!-- cannot update to newest version because that would change output -->
     </dependency>
     <dependency>
       <groupId>com.google.code.gson</groupId>
       <artifactId>gson</artifactId>
-      <version>2.8.5</version>
+      <version>2.8.6</version>
     </dependency>
     <dependency>
       <groupId>commons-io</groupId>
@@ -132,58 +175,27 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
-      <version>3.7</version>
+      <version>3.10</version>
     </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>
-      <version>1.11</version>
+      <version>1.14</version>
     </dependency>
     <dependency>
       <groupId>args4j</groupId>
       <artifactId>args4j</artifactId>
-      <version>${args4j.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>org.sonatype.nexus</groupId>
-      <artifactId>nexus-indexer</artifactId>
-      <version>2.0.0</version>
-      <exclusions>
-        <exclusion><!-- instead we pick this up from maven-compat -->
-          <groupId>org.apache.maven</groupId>
-          <artifactId>maven-artifact-manager</artifactId>
-        </exclusion>
-        <exclusion><!-- instead we pick this up from maven-compat -->
-          <groupId>org.apache.maven</groupId>
-          <artifactId>maven-artifact</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency><!-- this version doesn't have ugly snapshot Google collection dependency -->
-      <groupId>org.codehaus.plexus</groupId>
-      <artifactId>plexus-container-default</artifactId>
-      <version>1.5.5</version>
-      <exclusions>
-        <exclusion>
-          <groupId>com.google.collections</groupId>
-          <artifactId>google-collections</artifactId>
-        </exclusion>
-      </exclusions>
+      <version>2.33</version>
     </dependency>
     <dependency>
-      <groupId>org.apache.maven.wagon</groupId>
-      <artifactId>wagon-http</artifactId>
-      <version>1.0-beta-5</version>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.maven</groupId>
-      <artifactId>maven-compat</artifactId>
-      <version>3.0-alpha-2</version>
+      <groupId>io.jenkins.lib</groupId>
+      <artifactId>support-log-formatter</artifactId>
+      <version>1.0</version>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci</groupId>
       <artifactId>version-number</artifactId>
-      <version>1.4</version>
+      <version>1.7</version>
     </dependency>
     <dependency>
       <groupId>bouncycastle</groupId>
@@ -193,40 +205,37 @@
     <dependency>
       <groupId>org.apache.ant</groupId>
       <artifactId>ant</artifactId>
-      <version>1.8.1</version>
-    </dependency>
-    <dependency>
-      <groupId>jetty</groupId>
-      <artifactId>jetty-util</artifactId>
-      <version>6.0.0rc1</version>
+      <version>1.10.7</version>
     </dependency>
     <dependency>
       <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
       <artifactId>owasp-java-html-sanitizer</artifactId>
-      <version>20180219.1</version>
-    </dependency>
-    <dependency>
-      <groupId>org.mockito</groupId>
-      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
-      <scope>test</scope>
+      <version>20191001.1</version>
     </dependency>
     <dependency>
       <groupId>com.google.code.findbugs</groupId>
       <artifactId>annotations</artifactId>
       <version>3.0.0</version>
       <scope>compile</scope>
     </dependency>
+
+    <!-- test dependencies -->
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <version>3.3.3</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
-      <version>4.12</version>
+      <version>4.13</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>mockwebserver</artifactId>
-      <version>3.9.0</version>
+      <version>4.5.0</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
@@ -239,8 +248,8 @@
   </repositories>
 
   <scm>
-    <connection>scm:git:git://github.com/jenkinsci/backend-update-center2.git</connection>
-    <developerConnection>scm:git:ssh://git@github.com/jenkinsci/backend-update-center2.git</developerConnection>
+    <connection>scm:git:git://github.com/jenkins-infra/update-center2.git</connection>
+    <developerConnection>scm:git:ssh://git@github.com/jenkins-infra/update-center2.git</developerConnection>
     <tag>HEAD</tag>
   </scm>
 

src/main/resources/artifact-ignores.properties → resources/artifact-ignores.properties

@@ -404,6 +404,17 @@ ibm-security-appscanstandard-scanner-1.0
 # ambiguous version numbers - see https://repo.jenkins-ci.org/webapp/#/artifacts/browse/tree/General/releases/com/etas/jenkins/plugins/text-file-operations/1.2 (and 1.2.0)
 text-file-operations-1.2
 
+# ambiguous version numbers: 1.0-beta1 is preferred
+elastest-1.0.0-beta1
+
+# ambiguous version numbers: 0.1.0-alpha-1 is preferred
+git-forensics-0.1-alpha-1
+
+# Released with different groupIds
+contrast-continuous-application-security:1.0
+dependency-check-jenkins-plugin-1.0.1
+diskcheck:0.20
+
 # has both hpi and hpi and they're different (identical contents, different archive checksum)
 templating-engine-1.0
 
@@ -419,3 +430,36 @@ office-365-connector-1.1.2
 openshift-sync-1.0.32
 testfairy-2.2
 urltrigger-0.42
+uipath-automation-package-1.0
+node-iterator-api-1.5
+
+# Released with different groupIds
+aliyun-container-service-deploy-0.1.0
+aliyun-container-service-deploy-0.1.1
+
+# re-released with different groupId probably because of 'authentic Jenkins' behavior
+threadfix-1.4.3
+
+# The following releases have previously been dropped because we didn't allow releases with non-"jenkins" groupId after than the first release with "jenkins" groupId in the past.
+# This was to filter out plugin releases for Hudson that were newer than Jenkins.
+# Since we now limit the update center source to repo.jenkins-ci.org/releases, this is not a relevant problem anymore.
+# This list exists for consistency only, as these releases were never previously available.
+nerrvana-plugin-1.02.03
+nerrvana-plugin-1.02.04
+nerrvana-plugin-1.02.05
+docker-slaves-1.0
+docker-slaves-1.0.1
+docker-slaves-1.0.2
+docker-slaves-1.0.3
+job-dsl-1.6
+job-dsl-1.7
+play-autotest-plugin-0.0.7
+clearcase-ucm-plugin-1.4.0
+hp-application-automation-tools-plugin-1.1
+hp-application-automation-tools-plugin-1.2
+
+# broken link in plugin-versions.json since it's lowercase
+testfairy-2.2.5-beta
+
+# missing pom file
+lambdatest-automation-1.16