Jenkins not installing newer plugin version if user has update plugin manually

[torstenwalter]

Issue

By default, plugins will be upgraded if they haven't been upgraded manually

I'd like to have the possibility to override this behavior. In my case I am rolling out Jenkins instances with a docker image and certain versions of plugins. If a user now updates a plugin to a newer version I am no longer able to update it with a newer version of the image even if the plugin version the user has installed is older than the one we have now in the image.

The issue which arises with this is that if the image contains plugins which depend on each other one might be updated, but the other one is not which results in the situation that the plugin can be loaded.

More detailed example

To clarify on that let's assume plugin A depends on plugin B.

Initial roll out takes place with an image built with plugins.txt like this:

A: 2.70.1
B: 1.4.0

Now a user of that Jenkins instance updated plugin B to version 1.5.0 to fix a security vulnerability. Plugin A is not updated, but still works with the newer version of B.

In the meantime I build a new image with plugins.txt:

A: 2.80.5
B: 1.7.2

When the image starts the jenkins-support detects with the marker file that plugin B has been manually updated, but not plugin A. As a result the result would be:

A: 2.80.5 (updated to newer version)
B: 1.5.0 (that's the version manually updated by the user where no update happened)

If plugin A depends on a version of plugin B newer than 1.5.0 it would fail to start even if the newer version of that plugin was included within the docker image.

Expected behavior

Always update plugins if the version in the image is newer than the one installed. Or at least the option to do so if an environment variable is set.

I don't know the reason for the current behavior. It's apparently been introduced with #306 by @Vlatombe two years ago.

If there is no reason to not update plugins if they have been manually been updated before then the code in jenkins-support script could be simplified. Otherwise a switch could be introduced.

[lifeofguenter]

fully agree with this.

I rebuild the jenkins docker image weekly, which comes with a plugin update (managed by plugins.txt) unfortunately pull that image and restarting the container comes with all sorts of issues due to the current "copy-plugins-over" algorithm.

Ideally it should be very simple (switchable via a environment variable):

1. either force copy over plugins from the image to the jenkins-home
2. don't touch plugins in the jenkins-home

[carlossg]

see #741