chore: download war from mirrors unless we are publishing a release

Jenkinsfile

@@ -81,7 +81,11 @@ stage('Build') {
                             if (env.TAG_NAME && (env.PUBLISH == 'true')) {
                                 // Split to ensure any suffix is not taken in account (but allow suffix tags to trigger rebuilds)
                                 jenkins_version = env.TAG_NAME.split('-')[0]
-                                withEnv(["JENKINS_VERSION=${jenkins_version}"]) {
+                                // Setting WAR_URL to download war from Artifactory instead of mirrors on publication from trusted.ci.jenkins.io
+                                withEnv([
+                                    "JENKINS_VERSION=${jenkins_version}",
+                                    "WAR_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${jenkins_version}/jenkins-war-${jenkins_version}.war"
+                                ]) {
                                     stage('Publish') {
                                         infra.withDockerCredentials {
                                             withEnv(['DOCKERHUB_ORGANISATION=jenkins', 'DOCKERHUB_REPO=jenkins']) {
@@ -171,7 +175,11 @@ stage('Build') {
                 // Split to ensure any suffix is not taken in account (but allow suffix tags to trigger rebuilds)
                 jenkins_version = env.TAG_NAME.split('-')[0]
                 builds['linux'] = {
-                    withEnv(["JENKINS_VERSION=${jenkins_version}"]) {
+                    // Setting WAR_URL to download war from Artifactory instead of mirrors on publication from trusted.ci.jenkins.io
+                    withEnv([
+                        "JENKINS_VERSION=${jenkins_version}",
+                        "WAR_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${jenkins_version}/jenkins-war-${jenkins_version}.war"
+                    ]) {
                         nodeWithTimeout('docker') {
                             stage('Checkout') {
                                 checkout scm

alpine/hotspot/Dockerfile

@@ -96,11 +96,11 @@ ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
 ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG WAR_URL="https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war"
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
-RUN curl -fsSL ${JENKINS_URL} -o /usr/share/jenkins/jenkins.war \
+RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
   && echo "${JENKINS_SHA}  /usr/share/jenkins/jenkins.war" >/tmp/jenkins_sha \
   && sha256sum -c --strict /tmp/jenkins_sha \
   && rm -f /tmp/jenkins_sha

debian/bookworm-slim/hotspot/Dockerfile

@@ -107,11 +107,11 @@ ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
 ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG WAR_URL="https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war"
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
-RUN curl -fsSL ${JENKINS_URL} -o /usr/share/jenkins/jenkins.war \
+RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
   && echo "${JENKINS_SHA}  /usr/share/jenkins/jenkins.war" >/tmp/jenkins_sha \
   && sha256sum -c --strict /tmp/jenkins_sha \
   && rm -f /tmp/jenkins_sha

debian/bookworm/hotspot/Dockerfile

@@ -107,11 +107,11 @@ ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
 ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG WAR_URL="https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war"
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
-RUN curl -fsSL ${JENKINS_URL} -o /usr/share/jenkins/jenkins.war \
+RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
   && echo "${JENKINS_SHA}  /usr/share/jenkins/jenkins.war" >/tmp/jenkins_sha \
   && sha256sum -c --strict /tmp/jenkins_sha \
   && rm -f /tmp/jenkins_sha

docker-bake.hcl

@@ -50,6 +50,10 @@ variable "JENKINS_SHA" {
   default = "efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32"
 }
 
+variable "WAR_URL" {
+  default = ""
+}
+
 variable "REGISTRY" {
   default = "docker.io"
 }
@@ -120,6 +124,19 @@ function "tag_lts" {
   result = equal(LATEST_LTS, "true") ? tag(prepend_jenkins_version, tag) : ""
 }
 
+# return WAR_URL if not empty, get.jenkins.io URL depending on JENKINS_VERSION release line otherwise
+function "war_url" {
+  # If JENKINS_VERSION has more than one sequence of digits with a trailing literal '.', this is LTS
+  # 2.523 has only one sequence of digits with a trailing literal '.'
+  # 2.516.1 has two sequences of digits with a trailing literal '.'
+  params = []
+  result = (notequal(WAR_URL, "")
+    ? WAR_URL
+    : (length(regexall("[0-9]+[.]", JENKINS_VERSION)) < 2
+      ? "https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war"
+      : "https://get.jenkins.io/war-stable/${JENKINS_VERSION}/jenkins.war"))
+}
+
 # ---- targets ----
 
 target "alpine_jdk17" {
@@ -132,6 +149,7 @@ target "alpine_jdk17" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     ALPINE_TAG         = ALPINE_FULL_TAG
     JAVA_VERSION       = JAVA17_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "alpine-jdk17"),
@@ -152,6 +170,7 @@ target "alpine_jdk21" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     ALPINE_TAG         = ALPINE_FULL_TAG
     JAVA_VERSION       = JAVA21_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "alpine"),
@@ -176,6 +195,7 @@ target "debian_jdk17" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA17_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "jdk17"),
@@ -197,6 +217,7 @@ target "debian_jdk21" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA21_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, ""),
@@ -222,6 +243,7 @@ target "debian_slim_jdk17" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA17_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "slim-jdk17"),
@@ -241,6 +263,7 @@ target "debian_slim_jdk21" {
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     BOOKWORM_TAG       = BOOKWORM_TAG
     JAVA_VERSION       = JAVA21_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "slim"),
@@ -263,6 +286,7 @@ target "rhel_ubi9_jdk17" {
     COMMIT_SHA         = COMMIT_SHA
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     JAVA_VERSION       = JAVA17_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "rhel-ubi9-jdk17"),
@@ -282,6 +306,7 @@ target "rhel_ubi9_jdk21" {
     COMMIT_SHA         = COMMIT_SHA
     PLUGIN_CLI_VERSION = PLUGIN_CLI_VERSION
     JAVA_VERSION       = JAVA21_VERSION
+    WAR_URL            = war_url()
   }
   tags = [
     tag(true, "rhel-ubi9-jdk21"),

make.ps1

@@ -37,8 +37,15 @@ $env:JENKINS_VERSION = "$JenkinsVersion"
 # Compared to weekly releases, LTS releases include an additional build number in their version
 # Note: the ':' separator is included as trying to set an environment variable to empty on Windows unset it.
 $env:SEPARATOR_LTS_PREFIX = ':'
+$releaseLine = 'war'
 if ($JenkinsVersion.Split('.').Count -eq 3) {
     $env:SEPARATOR_LTS_PREFIX = ':lts-'
+    $releaseLine = 'war-stable'
+}
+
+# If there is no WAR_URL set, using get.jenkins.io URL depending on the release line
+if(![String]::IsNullOrWhiteSpace($env:WAR_URL)) {
+    $env:WAR_URL = 'https://get.jenkins.io/{0}/{1}/jenkins.war' -f $releaseLine, $env:JENKINS_VERSION
 }
 
 $items = $ImageType.Split('-')
@@ -50,8 +57,8 @@ if ($items[1] -eq 'ltsc2019') {
     $env:TOOLS_WINDOWS_VERSION = '1809'
 }
 
-# Retrieve the sha256 corresponding to the JENKINS_VERSION
-$jenkinsShaURL = 'https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/{0}/jenkins-war-{0}.war.sha256' -f $env:JENKINS_VERSION
+# Retrieve the sha256 corresponding to the war file
+$jenkinsShaURL = '{0}.sha256' -f $env:WAR_URL
 $webClient = New-Object System.Net.WebClient
 $env:JENKINS_SHA = $webClient.DownloadString($jenkinsShaURL).ToUpper()
 

rhel/ubi9/hotspot/Dockerfile

@@ -98,11 +98,11 @@ ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
 ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG WAR_URL="https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war"
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
-RUN curl -fsSL ${JENKINS_URL} -o /usr/share/jenkins/jenkins.war \
+RUN curl -fsSL ${WAR_URL} -o /usr/share/jenkins/jenkins.war \
   && echo "${JENKINS_SHA}  /usr/share/jenkins/jenkins.war" >/tmp/jenkins_sha \
   && sha256sum -c --strict /tmp/jenkins_sha \
   && rm -f /tmp/jenkins_sha

windows/windowsservercore/hotspot/Dockerfile

@@ -100,11 +100,11 @@ ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
 ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
 
 # Can be used to customize where jenkins.war get downloaded from
-ARG JENKINS_URL=https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war
+ARG WAR_URL="https://get.jenkins.io/war/${JENKINS_VERSION}/jenkins.war"
 
 # could use ADD but this one does not check Last-Modified header neither does it allow to control checksum
 # see https://github.com/docker/docker/issues/8331
-RUN Invoke-WebRequest -Uri "$env:JENKINS_URL" -OutFile C:/ProgramData/Jenkins/jenkins.war ; `
+RUN Invoke-WebRequest -Uri "$env:WAR_URL" -OutFile C:/ProgramData/Jenkins/jenkins.war ; `
     if ((Get-FileHash C:/ProgramData/Jenkins/jenkins.war -Algorithm SHA256).Hash -ne $env:JENKINS_SHA) {exit 1}
 
 ENV JENKINS_UC=https://updates.jenkins.io