Team Foundation Server plugin is not available in Jenkins

Viewed 1495

The Team Foundation Server plugin is not available in Jenkins. The Jenkins official page shows the message:

Distribution of this plugin has been suspended due to unresolved security vulnerabilities

Is there any alternative to this plugin using which I can integrate Team Foundation Server with Jenkins?

1 Answers

MS have effectively abandoned support for TFVC and for the plugin.

You can still grab the plugin from the GitHub TFS plugin releases page and upload manually. ({JENKINS_URL}/pluginManager/advanced ). You may have to reconcile any dependencies manually.

MS recommended alternative is the tf command line from a shell step (brutal), which they also silently abandoned support for TFS SDK/CLI.

ps: aside from the vulnerability ( SECURITY-1506 / CVE-2020-2249 ), it does not meet the OSI open source license requirements - INFRA-2751 to be made available via the plugins site.

2021-03-30: It appears the OSI licensing issue has been resolved. This Jenkins Community post suggests a fix to SECURITY-1506 / CVE-2020-2249 is available in a fork but additional security issues ( SECURITY-2283 / CVE-2021-21636, CVE-2021-21637 (permission check), CVE-2021-21638 (CSRF) ) are outstanding, need to be resolved and released, or someone steps up to adopt the plugin.

pss: M$ also announced (23 February, 2021) retirement for Azure plugins for Jenkins, effective February 29, 2024.

Related