I update my jenkins Update Site to `https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/current/update-center.json`, but it always download from domain `http://updates.jenkins-ci.org`.

I want change ci from hudson to jenkins, but this make me very disappointed.

The code is https://github.com/jenkinsci/jenkins/blob/master/core/src/main/java/hudson/model/UpdateCenter.java#L1100

Related comments in JENKINS-32796 as well, but not adding anything new.

JENKINS-32796 and JENKINS-8028 are not actually related issues, but comments have been posted to those issues about this particular problem.

I currently ran into this issue becaue the maschine I want to install does not allow connections via http at all.

So even if the urls redirect from http to https the proxy will refuse the connection.

Is there any chance that the update-center.json will return urls in https when requesting the file via https?

asbachb No, see INFRA-266 etc.

The osuosl mirrors no longer support http. Attempting to update plugins results in:

java.io.IOException: Server returned HTTP response code: 503 for URL: http://ftp-chi.osuosl.org/pub/jenkins/plugins/subversion/2.9/subversion.hpi

reattempting the same URL in a browser using https works fine.

bondolo: HTTP 503 is a temporary failure. That http:// URL from OSUOSL currently works fine for me. Do you have any sources mentioning that they are revoking http:// service?

Link works for me too.

Also, would be an infra issue, not a Jenkins issue.

hmmm, working for me as well from a different network.

The non-infra part of this issue would be that using an https update server should use https in the update results it provides. I was tempted to retrieve the update file, edit the urls with sed and then host that update file with the amended urls. Perhaps the urls in the update file should be absolute path only without protocol or host and resolved relative to the update url?

bondolo: That's not possible as the download URLs redirect to various mirrors outside of our control, so we can't do anything unless they all provide https:// access all the time; see INFRA-266.