Issue
The Team Foundation Server plugin is not available in Jenkins. The Jenkins official page shows the message:
Distribution of this plugin has been suspended due to unresolved security vulnerabilities
Is there any alternative to this plugin using which I can integrate Team Foundation Server with Jenkins?
Solution
MS have effectively abandoned support for TFVC and for the plugin.
You can still grab the plugin from the GitHub TFS plugin releases page and upload manually. ({JENKINS_URL}/pluginManager/advanced
). You may have to reconcile any dependencies manually.
MS recommended alternative is the tf
command line from a shell step (brutal), which they also silently abandoned support for TFS SDK/CLI.
ps: aside from the vulnerability ( SECURITY-1506 / CVE-2020-2249 ), it does not meet the OSI open source license requirements - INFRA-2751 to be made available via the plugins site.
2021-03-30: It appears the OSI licensing issue has been resolved. This Jenkins Community post suggests a fix to SECURITY-1506 / CVE-2020-2249 is available in a fork but additional security issues ( SECURITY-2283 / CVE-2021-21636, CVE-2021-21637 (permission check), CVE-2021-21638 (CSRF) ) are outstanding, need to be resolved and released, or someone steps up to adopt the plugin.
pss: M$ also announced (23 February, 2021) retirement for Azure plugins for Jenkins, effective February 29, 2024.
Answered By - Ian W
Answer Checked By - Pedro (JavaFixing Volunteer)