[JENKINS-3662] Plugins included in hudson.war may not be updated via "Update Manager" or even manually via direct download

[jenkins-infra-bot]

Even after upgrading SSH Slaves plugin to 0.5.1 it still reports in plugins as
0.5.1 being available for upgrading and 0.4 as installed.
This seems to be the source of trouble:

• META-INF/maven/org.jvnet.hudson.plugins/ssh-slaves/pom.xml (both in
  ~/.hudson/plugins/ssh-slaves and ssh-slaves.hpi file itself):

0.4

whereas in pom.properties:

#Generated by Maven
#Mon Feb 02 15:47:44 GMT 2009
version=0.4

groupId=org.jvnet.hudson.plugins
artifactId=ssh-slaves

The contents inside seems to be timestamped with 2.02.2009 too, but the file:
https://hudson.dev.java.net/servlets/ProjectDocumentList?folderID=9380&expandFolder=9380&folderID=5818
having 0.5.1 seems to be made on 7.05.2009

This is how it works from automatic upgrade from Hudson.
When downloading directly from
https://hudson.dev.java.net/servlets/ProjectDocumentList?folderID=9380&expandFolder=9380&folderID=5818
I get the correct version.

---

Originally reported by krystian_nowak, imported from: Plugins included in hudson.war may not be updated via "Update Manager" or even manually via direct download

• assignee: mindless
• status: Closed
• priority: Major
• component(s): core
• resolution: Fixed
• resolved: 2010-01-07T19:24:23+00:00
• votes: 5
• watchers: 3
• imported: 2025-11-24

Raw content of original issue

Even after upgrading SSH Slaves plugin to 0.5.1 it still reports in plugins as
0.5.1 being available for upgrading and 0.4 as installed.
This seems to be the source of trouble:

	
META-INF/maven/org.jvnet.hudson.plugins/ssh-slaves/pom.xml (both in
~/.hudson/plugins/ssh-slaves and ssh-slaves.hpi file itself):



<version>0.4</version>

whereas in pom.properties:

#Generated by Maven
#Mon Feb 02 15:47:44 GMT 2009
version=0.4                                                                    


groupId=org.jvnet.hudson.plugins
artifactId=ssh-slaves

The contents inside seems to be timestamped with 2.02.2009 too, but the file:
https://hudson.dev.java.net/servlets/ProjectDocumentList?folderID=9380&expandFolder=9380&folderID=5818
having 0.5.1 seems to be made on 7.05.2009

This is how it works from automatic upgrade from Hudson.
When downloading directly from
https://hudson.dev.java.net/servlets/ProjectDocumentList?folderID=9380&expandFolder=9380&folderID=5818
I get the correct version.

• environment: Platform: All, OS: All

[jenkins-infra-bot]

krystian_nowak:

• Original comment link
• Raw content of original comment:

  adding myself as CC
  

adding myself as CC

[jenkins-infra-bot]

krystian_nowak:

• Original comment link
• Raw content of original comment:

  It seems that the root cause of the problem is not the plugin update process
  itself, but the overwriting of the plugin contents by old plugin the included in
  hudson package as "embedded" into Hudson distribution itself.
  However it causes problems as I cannot force Hudson to use newer version of the
  plugin (e.g. 0.5.1) than the one in distribution (0.4).
  
  See "Hudson now started bundling ssh-slaves plugin out of the box." in 1.301:
  https://hudson.dev.java.net/changelog.html
  

It seems that the root cause of the problem is not the plugin update process
itself, but the overwriting of the plugin contents by old plugin the included in
hudson package as "embedded" into Hudson distribution itself.
However it causes problems as I cannot force Hudson to use newer version of the
plugin (e.g. 0.5.1) than the one in distribution (0.4).

See "Hudson now started bundling ssh-slaves plugin out of the box." in 1.301:
https://hudson.dev.java.net/changelog.html

[jenkins-infra-bot]

wittob:

• Original comment link
• Raw content of original comment:

  Workaround:
  Copy the latest "ssh-slaves.hpi" to the folder "C:\Program Files\Apache 
  Software Foundation\Tomcat 6.0\webapps\hudson\WEB-INF\plugins" and restart 
  the "Apache TomCat" service.
  

Workaround:
Copy the latest "ssh-slaves.hpi" to the folder "C:\Program Files\Apache
Software Foundation\Tomcat 6.0\webapps\hudson\WEB-INF\plugins" and restart
the "Apache TomCat" service.

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  changlog for Hudson 1.325 says:
  Update center wasn't capable of updating bundled plugins, such as subversion.
  
  so I'm marking this as resolved.. please reopen if this is a different problem that still exists on a current Hudson release, thanks.
  

changlog for Hudson 1.325 says:

Update center wasn't capable of updating bundled plugins, such as subversion.

so I'm marking this as resolved.. please reopen if this is a different problem that still exists on a current Hudson release, thanks.

[jenkins-infra-bot]

mfriedenhagen:

• Original comment link
• Raw content of original comment:

  Hello,
  
  I reopen this bug. I am running version 1.338 of the war and "Update Center" insists on offering me:
  
  SSH Slaves plugin in version 0.9 (installed is 0.8)
  
  Subversion Plugin in version 1.8 (installed is 1.7)
  
  Downloads from the Update Center keeps hanging forever in the the last millimeter of the progress bar. I tried the following procedure as well:
  
  	
  stop Hudson
  	
  remove ssh-slaves and subversion in the plugins directory under HUDSON_HOME
  	
  download hpis manually (I checked the correct new version by looking into the META-INF/MANIFEST.MF)
  	
  restart
  
  
  
  This does not work, Update Center offers new versions again.
  After restart the new versions are gone in the HUDSON_HOME/plugins directory.
  
  I did see the workaround (copy plugins to expanded WAR WEB-INF/plugins directory) but was under the impression that this should be fixed now, so plugins are not replaced from the ones in the WAR (I am running the debian-package btw, so this is winstone serving).
  
  @mindless: Would you be so kind to clarify wether the workaround is still the way to go or download from "Update Manager" should work.
  
  Best Regards
  Mirko 
  
  

Hello,

I reopen this bug. I am running version 1.338 of the war and "Update Center" insists on offering me:

SSH Slaves plugin in version 0.9 (installed is 0.8)

Subversion Plugin in version 1.8 (installed is 1.7)

Downloads from the Update Center keeps hanging forever in the the last millimeter of the progress bar. I tried the following procedure as well:

• stop Hudson
• remove ssh-slaves and subversion in the plugins directory under HUDSON_HOME
• download hpis manually (I checked the correct new version by looking into the META-INF/MANIFEST.MF)
• restart

This does not work, Update Center offers new versions again.
After restart the new versions are gone in the HUDSON_HOME/plugins directory.

I did see the workaround (copy plugins to expanded WAR WEB-INF/plugins directory) but was under the impression that this should be fixed now, so plugins are not replaced from the ones in the WAR (I am running the debian-package btw, so this is winstone serving).

@​mindless: Would you be so kind to clarify wether the workaround is still the way to go or download from "Update Manager" should work.

Best Regards
Mirko

[jenkins-infra-bot]

mfriedenhagen:

• Original comment link
• Raw content of original comment:

  After update to 1.339 the newer versions are included.
  

After update to 1.339 the newer versions are included.

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  Hm, I looked closer at the fix in 1.325.  I guess you're supposed to create a file in your plugins directory called 
  {plugin-file}
  .pinned to allow upgrade from the bundled version.  For example, when you were still on 1.338 you could create subversion.hpi.pinned and then it should allow you to upgrade to subversion plugin 1.9 using update center.  I've never seen an update hang, but I did see upgrade to 1.9 get switched back to 1.8 after restart.  Not sure how you're supposed to know about this ".pinned" thing though!
  
  

Hm, I looked closer at the fix in 1.325. I guess you're supposed to create a file in your plugins directory called

{plugin-file}

.pinned to allow upgrade from the bundled version. For example, when you were still on 1.338 you could create subversion.hpi.pinned and then it should allow you to upgrade to subversion plugin 1.9 using update center. I've never seen an update hang, but I did see upgrade to 1.9 get switched back to 1.8 after restart. Not sure how you're supposed to know about this ".pinned" thing though!

[jenkins-infra-bot]

mfriedenhagen:

• Original comment link
• Raw content of original comment:

  Hello, I wrote a wiki page (http://wiki.jenkins-ci.org/display/JENKINS/How+to+update+plugins+included+in+the+Hudson+war) and linked it to http://wiki.jenkins-ci.org/display/JENKINS/Plugins, so the information is at least available .
  

Hello, I wrote a wiki page (http://wiki.jenkins-ci.org/display/JENKINS/How+to+update+plugins+included+in+the+Hudson+war) and linked it to http://wiki.jenkins-ci.org/display/JENKINS/Plugins, so the information is at least available .

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  Ok, I did see an update hang now.. I tried an update with ssh-slaves and another non-bundled plugin.  The non-bundled one finished, but ssh-slaves progress bar never reached the end.. stopping just before the end, as you said.  Hudson restart went back to ssh-slaves 0.8 (bundled in Hudson 1.336 that I'm using).
  
  Thanks for the wiki update!
  

Ok, I did see an update hang now.. I tried an update with ssh-slaves and another non-bundled plugin. The non-bundled one finished, but ssh-slaves progress bar never reached the end.. stopping just before the end, as you said. Hudson restart went back to ssh-slaves 0.8 (bundled in Hudson 1.336 that I'm using).

Thanks for the wiki update!

[jenkins-infra-bot]

mfriedenhagen:

• Original comment link
• Raw content of original comment:

  This is a core problem.
  

This is a core problem.

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  Ok, I've started investigating this.. when the update "hangs" I found that no threads in Hudson are working on it anymore.  It downloads the plugin, moves the old file to ".bak" and puts the new file in place, then bails out.  I think there must be a RuntimeException that the ExecutorService is silently ignoring.  Still digging..
  

Ok, I've started investigating this.. when the update "hangs" I found that no threads in Hudson are working on it anymore. It downloads the plugin, moves the old file to ".bak" and puts the new file in place, then bails out. I think there must be a RuntimeException that the ExecutorService is silently ignoring. Still digging..

[jenkins-infra-bot]

scm_issue_link:

• Original comment link
• Raw content of original comment:

  Code changed in hudson
  User: : mindless
  Path:
   trunk/hudson/main/core/src/main/java/hudson/model/UpdateCenter.java
   trunk/www/changelog.html
  http://fisheye4.cenqua.com/changelog/hudson/?cs=25505
  Log:
  [FIXED JENKINS-3662] Fix ability to upgrade bundled plugins when security is enabled.
  

Code changed in hudson
User: : mindless
Path:
trunk/hudson/main/core/src/main/java/hudson/model/UpdateCenter.java
trunk/www/changelog.html
http://fisheye4.cenqua.com/changelog/hudson/?cs=25505
Log:
[FIXED JENKINS-3662] Fix ability to upgrade bundled plugins when security is enabled.

[jenkins-infra-bot]

mfriedenhagen:

• Original comment link
• Raw content of original comment:

  Worked for me as of 1.340.
  

Worked for me as of 1.340.