Attending:
- Salman
- Leo Cheng
- Kris Stern
- Bruno Verachten
Agenda
- Windows (MSI) installer signing certificate expires in May - Mark Waite
- [pkg.jenkins.io/release.jenkins.io] Certificate signing the MSI Jenkins package expires on 16 May 2026
- Needs a combined effort of platform SIG, infrastructure, and MSI installer maintainers
- Last renewal required 2-3 months to satisfy all the requirements from the certificate issuers
- Mark started something, and will be back at it after his holiday
- Discussion on jenkinsci-dev about switching from WiX/MSI to NSIS/EXE is still open, no decision yet
- Java 17 and 21: status update
- Java 17 end-of-life proposal
- March 31, 2026, is the warning date in the admin monitor - three weeks away
- Jenkins Core 2.545+ requires JDK21, LTS 2.541.x still supports Java 17
- Remove JDK17 from controller images is still open
- Latest JDK versions in Docker images
- JDK 17: 17.0.18+8
- JDK 21: 21.0.10+7
- JDK 25: 25.0.2+10
- No JDK version bumps since the last meeting
- Java 17 end-of-life proposal
- Java 25
- Released Sep 16, 2025
- Jenkins core itself is compatible with JDK 25 since 2.534
- Plugins are moving to JDK25
- More than 300 plugins are already compiling with JDK 25 as a target
- Mark’s checks show 220+ of 250 repositories already testing with Java 25
- https://github.com/orgs/jenkinsci/projects/41 is a GitHub project to see how we progress with JDK25
- Beginning in March 2029, users will be warned that Java 25 will be reaching its end of support in the Jenkins project.
- LTS updates
- LTS 2.541.2 was released Feb 18, 2026 (security release)
- LTS 2.541.3 RC released Mar 7, 2026
- Final release scheduled for March 18, 2026
- Prepare release, packaging and docker backports for LTS 2.541.3
- Docker Hub 429 rate limit errors (infra topic) - update
- 429 rate limit errors from Docker Hub since January 2026 - still open
- Docker support case #00193277 opened, escalated to Docker infra/hub team
- Key finding: docker-agents builds on ci.jenkins.io were not using infra.withDockerCredentials, hitting unauthenticated rate limits
- Docker Hub investigation revealed the Jenkins account is also used from other IPs (ACR pull-through cache, ATH testcontainers)
- Workaround in place: batching Linux images publication by distribution
- Related infra work:
- Move docker controller images publication job from trusted.ci to release.ci - on hold, using enable/disable workaround for now
- Clarification for Dockerhub publishing of controller containers - process being documented
- 429 rate limit errors from Docker Hub since January 2026 - still open
- Container image updates for the Jenkins controller
- Three weekly releases: 2.552, 2.553, and 2.554
Bug fixes
- fix: restore JENKINS_VERSION env var in images (#2261) - was missing from images
- fix(windows): restore infra.withDockerCredentials in publish stage (#2270)
Maintenance
- Remove unused retry_command from jenkins-support (#2268, closing issue #2266)
- chore(pipeline): use infra.withDockerCredentials only on publication (#2265)
Dependency updates
- Bump RHEL version to 9.7-1771346757
- Bump updatecli/updatecli-action from 2.99.0 to 2.100.0
- Three weekly releases: 2.552, 2.553, and 2.554
- One new release for the SSH agent: 7.15.0 (Mar 3)
- Dependency updates
- Bump Debian Trixie Linux version to trixie-20260223
- Maintenance
- chore(updatecli): add a manifest for pester
- Bump pester version to 5.7.1
- One new release for the Docker agent/inbound-agent: 3355.v388858a_47b_33-15 (Mar 5)
- Dependency updates
- Bump Debian trixie Linux version to trixie-20260223
- Bump UBI9 version to 9.7-1771346757
- RISC-V 64-bit image support requested
- riscv64 docker image - new issue opened Mar 2 by @yuzibo
- Bruno has been running Jenkins on riscv64 for three years. The prerequisites are now in place (Debian Trixie riscv64, Docker Engine, Adoptium JDK)
- @timja and @dduportal agree to start with QEMU emulation (like ppc64le), with native hardware testing as a bonus
- Discussion around CI (public) vs CD (private) agent security requirements for new architectures
- Work in progress on images:
- Controller:
- Docker-agent:
- Docker-ssh-agent:
- Deprecation and archival of jenkinsci/docker-inbound-agents
- Accepted in Jan 13 meeting. Repository still not archived.
- Support for Windows 2025 agents
- Helpdesk ticket is now closed
- Windows 1809 images have been dropped across all three repos