4

The Team Foundation Server plugin is not available in Jenkins. The Jenkins official page shows the message:

Distribution of this plugin has been suspended due to unresolved security vulnerabilities

Is there any alternative to this plugin using which I can integrate Team Foundation Server with Jenkins?

1 Answer 1

8

MS have effectively abandoned support for TFVC and for the plugin.

You can still grab the plugin from the GitHub TFS plugin releases page and upload manually. ({JENKINS_URL}/pluginManager/advanced ). You may have to reconcile any dependencies manually.

MS recommended alternative is the tf command line from a shell step (brutal), which they also silently abandoned support for TFS SDK/CLI.

ps: aside from the vulnerability ( SECURITY-1506 / CVE-2020-2249 ), it does not meet the OSI open source license requirements - INFRA-2751 to be made available via the plugins site.

2021-03-30: It appears the OSI licensing issue has been resolved. This Jenkins Community post suggests a fix to SECURITY-1506 / CVE-2020-2249 is available in a fork but additional security issues ( SECURITY-2283 / CVE-2021-21636, CVE-2021-21637 (permission check), CVE-2021-21638 (CSRF) ) are outstanding, need to be resolved and released, or someone steps up to adopt the plugin.

pss: M$ also announced (23 February, 2021) retirement for Azure plugins for Jenkins, effective February 29, 2024.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.