A plugin is downloaded from a url based on the following logic: 

      if a url is entered, download from that url 

      if "latest" version and there's a jenkins specific update center, download from cfg.getJenkinsUc()/jenkinsVersion/latest

      if experimental or incremental, download from experimental update center or incrementals mirror  repo 

      else: download from cfg.getJenkinsUc()/download/plugins/pluginName/pluginVersion/pluginName

 

Previously, a plugin's dependencies would be resolved after a plugin was downloaded and the dependencies were determined from the manifest. 

Now, a plugin's dependences are resolved by getting the update center json from cfg.getJenkinsUc() + "/update-center.actual.json" and parsing this. 

However, this may not always result in the correct dependencies for the requested/downloaded plugin. 

Example: 

Suppose the Jenkins Version is 2.121 and the requested plugin is artifact-manager-s3:latest. 

The plugin would be downloaded from: 

https://updates.jenkins.io/2.121/latest/artifact-manager-s3.hpi

 

The correct dependencies could be found from the version specific update center json: 

https://updates.jenkins.io/2.121/update-center.actual.json

However, instead the code would get the dependencies from the update center listed in the configuration file, ignoring the version specific update center json: 

https://updates.jenkins.io/current/update-center.actual.json

 

See attached picture. 

The same issue could occur when there is no Jenkins specific update center and the user specifies the version of the plugin directly.

Suppose the user wants to download artifact-manager-s3, version 1.3 and they are directed to https://updates.jenkins.io/download/plugins/artifact-manager-s3/1.3/artifact-manager-s3.hpi

The dependencies it appears this version is dependent on are: 

aws-global-configuration:1.2,workflow-api:2.33,ap
ache-httpcomponents-client-4-api:4.5.5-3.0,aws-credentials:1.23,struc
ts:1.17

Currently the code would find the dependencies from the current update center json (https://updates.jenkins.io/current/update-center.actual.json), which has the following dependencies: aws-global-configuration:1.3, jaxb:2.3.0.1,workflow-api:2.33,apache-httpcomponents-client-4-api, 4.5.5-3.0, aws-credentials:1.26, structs:1.17