Support Mirror Selection in Update Center

[tangruixun]

Service(s)

Update center (updates.jenkins.io)

Summary

Jenkins currently retrieves update metadata from https://updates.jenkins.io/update-center.json, after which plugin downloads are automatically directed to a mirror selected by the Jenkins update infrastructure.

For users in regions where the automatically selected mirror has high latency, limited connectivity, or unreliable access, the ability to select another geographically hosted mirror would significantly improve the reliability and speed of plugin management.

Proposed Feature

Add support for explicitly selecting the mirror used by the Jenkins Update Center.

For example:

Update Center
  ├── Update site: https://updates.jenkins.io/update-center.json
  │       └── Download mirror:
  │         ○ Automatically select mirror (existing behavior)
  │         ○ Select a specific mirror (new option)  
  └── Custom mirror URL (existing functionality)

Expected Behavior

Automatic mirror selection does not always result in the most suitable download source for a particular network environment. Explicit mirror selection would provide administrators with better control over download routing and could improve download reliability and performance. Providing explicit mirror selection would make this behavior more transparent and configurable for Jenkins administrators.

Reproduction steps

No response

[MarkEWaite]

This is an enhancement request for Jenkins core, not for the Jenkins infrastructure. Please submit the enhancement request to the Jenkins core issue tracker. Please follow the guidelines in "How to report an issue" when submitting the enhancement request.

[lemeurherve]

Please submit the enhancement request to the Jenkins core issue tracker

@MarkEWaite: ICYMI, that's what @tangruixun already did, they've been told to open an issue here: jenkinsci/jenkins#27253 (comment)

[MarkEWaite]

Please submit the enhancement request to the Jenkins core issue tracker

@MarkEWaite: ICYMI, that's what @tangruixun already did, and been told to open an issue here: jenkinsci/jenkins#27253 (comment)

I don't see what the Jenkins infrastructure team can do to implement a checkbox in the Jenkins plugin manager user interface. I believe that @tangruixun provided an ASCII art version of the Jenkins user interface that looks like this:

Just in case I'm wrong, I've reopened the issue

[MarkEWaite]

The request from @timja in the Jenkins core issue was:

Best raised on the helpdesk with information on your specific issue: http://github.com/jenkins-infra/helpdesk

This enhancement request does not describe the specific issue. It requests a general enhancement to give the administrator more control over the mirrors that are used by Jenkins.

If a Jenkins mirror is misbehaving, we want administrators to report the misbehavior, not reconfigure their Jenkins controller to override the mirror system.

[dduportal]

Hi @tangruixun , this feature request would totally defeat the purpose of using mirrors. Given the costs incurred by updates.jenkins.io only sponsored by individuals or companies giving to the Jenkins project, it does not seem something we will implement.

Besides as underlined by @MarkEWaite the mirroring feature is infrastructure only, changes over time and is not a Jenkins feature so technically it's only doable at a really high cost.

Could you be more precise on the problem you are facing exactly please? What region of the world are your server facing high latency are located? Could you share a screenshot of your webbrowser of the URL https://mirrors.updates.jenkins.io/current/update-center.actual.json?mirrorlist from this location please? Same for https://get.jenkins.io/windows-stable/2.568.2/jenkins.msi?mirrorlist ?

=> I'm asking because, unlike https://get.jenkins.io which hosts the heavy binaries based on sponsored mirrors, the update center at https://updates.jenkins.io os something we fully control (except Russia / Bielorussia for a few months). So we can either exclude a mirror from countries where traffic is jammed/slow to force using others or work towards adding a mirror where needed if we can find sponsors/technical solutions.

[tangruixun]

@dduportal Thank you for the clarification.

The specific mirror causing problems is Tsinghua TUNA. Their access control and blocking policies are quite aggressive, and requests from users outside the CERNET (China Education and Research Network) to have access restrictions removed are generally not handled proactively. As a result, the automatically selected TUNA mirror can be inaccessible or unreliable from our servers.

The affected servers are headless Linux servers, so I cannot provide a web browser screenshot from those systems at the moment.

There is also a separate privacy concern. Users should have an option to prefer not to have their Jenkins plugin downloads routed through mirrors operated in certain jurisdictions. In such cases, being able to explicitly choose a mirror, or at least exclude certain mirrors, would give administrators meaningful control over where their server connects to.

Therefore, I think there is still value in providing some mechanism for users to opt out of specific mirrors or regions.

For this particular case, excluding the TUNA mirror for servers outside the China Education and Research Network would resolve the immediate connectivity issue.

[dduportal]

Thanks for the first wave of details.

Let's split step by step:

The affected servers are headless Linux servers, so I cannot provide a web browser screenshot from those systems at the moment.

You should use curl/wget and share the body output (ideally with also the response headers) with us.
Also, as per my other points below, you should do the same (run curl/wget in verbose to get timing and headers, following all redirections, without the binary output) a second time but without the ?mirrorlist query string so we can see how the "slow/blockers" are behaving from your servers.

---

"update center" (aka "Update Site" section in Mark's screenshot above) specified in Jenkins setting only retrieves metadata from updates.jenkins.io. It is NOT part of your request as far as I can tell: it only has mirrors which we (Jenkins project) fully control. It does not serve any binaries, only signed metadata (which only Jenkins can decode). This part won't be changed but we can provide mirrors in the future closer to your location but only if you are able to provide data showing the current mirrors are too slow serving the JSON metadata (see my link above) or blocked.

---

TUNA mirror. This is a sponsored mirror which mirrors get.jenkins.io. As you underlined, For this particular case, excluding the TUNA mirror for servers outside the China Education and Research Network would resolve the immediate connectivity issue.. Before proceeding to block/suspend it, we need data from your headless servers for downloads (curl or wget verbose with all redirections and timings on a particular binary such as Jenkins MSI installer I linked above). We'll contact them with this data so we can ask them to relax their constraint or we stop using it.

---

There is also a separate privacy concern. Users should have an option to prefer not to have their Jenkins plugin downloads routed through mirrors operated in certain jurisdictions. In such cases, being able to explicitly choose a mirror, or at least exclude certain mirrors, would give administrators meaningful control over where their server connects to.

Therefore, I think there is still value in providing some mechanism for users to opt out of specific mirrors or regions.

I fail to understand the point:

• If the problem is around the risks of having the downloads "transformed", since Jenkins verifies the plugins downloads (ping @daniel-beck can you confirm), the content can't be changed unless you set up your Jenkins with weird Update Site settings.
• And if you really need to anonymize, I suggest running your Linux headless server through an encrypted channel. If you have privacy concerns over authorities/entities able to decode TLS traffic, I don't see how using another mirror could change that?