Bump Maven to 3.9.9

[dduportal]

Previous issue for Maven 3.9.8: #4150

This issue tracks the work related to the upgrade of Maven to 3.9.9 (release notes: https://maven.apache.org/docs/3.9.9/release-notes.html)

Note

We need to discuss if ATH should be the "trigger" for Maven upgrade campaign (jenkinsci/acceptance-test-harness#1677)

Task list:

• Update Maven to 3.9.9 in the packer images (Linux containers, Linux VMs, Windows VMs)

  • PR: Bump Maven version to 3.9.9 packer-images#1351
  • Release: https://github.com/jenkins-infra/packer-images/releases/tag/1.89.0
  • Deployment: Bump Packer Agent Templates (All-In-One) Version to 1.88.0 jenkins-infra#3612 and Bump agent templates for infra.ci.jenkins.io (packer-image 1.89.0) kubernetes-management#5590

• Update Maven to 3.9.9 in the "Packaging" Docker image

  • PR: Bump Maven version to 3.9.9 docker-packaging#137
  • Release: https://github.com/jenkins-infra/docker-packaging/releases/tag/5.1.20
  • Deployment: Bump jenkinsciinfra/packaging Docker image version to 5.1.20 release#586

• Update Maven to 3.9.9 in the Windows container images

  • PR: Bump Maven version to 3.9.9 docker-inbound-agents#185
  • Deployment (no release): Bump non-packer container agent templates version on all controllers jenkins-infra#3614

• Update Maven to 3.9.9 in permanent agents (before merging the Jenkins tools upgrade)

  • Linux s390x (report the manual upgrade)

    linux1@jenkins01:~$ sudo su - jenkins
    jenkins@jenkins01:~$ cd tools/
    jenkins@jenkins01:~/tools$ curl -sSLO https://dlcdn.apache.org/maven/maven-3/3.9.9/binaries/apache-maven-3.9.9-bin.tar.gz
    jenkins@jenkins01:~/tools$ curl -sSLO https://downloads.apache.org/maven/maven-3/3.9.9/binaries/apache-maven-3.9.9-bin.tar.gz.sha512
    jenkins@jenkins01:~/tools$ curl -sSLO https://downloads.apache.org/maven/maven-3/3.9.9/binaries/apache-maven-3.9.9-bin.tar.gz.asc
    jenkins@jenkins01:~/tools$ gpg --verify ./apache-maven-3.9.9-bin.tar.gz.asc 
    gpg: assuming signed data in './apache-maven-3.9.9-bin.tar.gz'
    gpg: Signature made Wed 14 Aug 2024 08:51:43 AM UTC
    gpg:                using EDDSA key 88BE34F94BDB2B5357044E2E3A387D43964143E3
    gpg: Good signature from "Tamas Cservenak <[email protected]>" [unknown]
    gpg: WARNING: This key is not certified with a trusted signature!
    gpg:          There is no indication that the signature belongs to the owner.
    Primary key fingerprint: 88BE 34F9 4BDB 2B53 5704  4E2E 3A38 7D43 9641 43E3
    jenkins@jenkins01:~/tools$ tar xzf apache-maven-3.9.9-bin.tar.gz 
    jenkins@jenkins01:~/tools$ rm -f apache-maven-3.9.9-bin.tar.gz*
    jenkins@jenkins01:~/tools$ rm -rf apache-maven-3.9.8/
    jenkins@jenkins01:~/tools$ ls -ltr
    total 8
    drwxr-xr-x 6 jenkins jenkins 4096 Jan  4  2023 apache-ant-1.10.13
    lrwxrwxrwx 1 jenkins jenkins   11 Aug  8 08:02 jdk-11 -> /opt/jdk-11
    lrwxrwxrwx 1 jenkins jenkins   11 Aug  8 08:02 jdk-17 -> /opt/jdk-17
    lrwxrwxrwx 1 jenkins jenkins   11 Aug  8 08:02 jdk-21 -> /opt/jdk-21
    drwxrwxr-x 6 jenkins jenkins 4096 Aug 21 08:50 apache-maven-3.9.9
    # As per the ci.jenkins.io agent configuration
    jenkins@jenkins01:~/tools$ /home/jenkins/tools/apache-maven-3.9.9/bin/mvn -v
    Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
    Maven home: /home/jenkins/tools/apache-maven-3.9.9
    Java version: 21.0.4, vendor: Eclipse Adoptium, runtime: /opt/jdk-21
    Default locale: en_US, platform encoding: UTF-8
    OS name: "linux", version: "5.15.0-117-generic", arch: "s390x", family: "unix"

• Update Maven to 3.9.9 in the Jenkins tools

  • ci.jenkins.io, trusted.ci.jenkins.io and release.ci.jenkins.io: Bump Maven version (Jenkins tools) on all controllers to 3.9.9 jenkins-infra#3615
  • infra.ci.jenkins.io: Bump Maven version (Jenkins tools) on infra.ci.jenkins.io to 3.9.9 kubernetes-management#5591

• Communicate to developers on the jenkinsci-dev mailing list - https://groups.google.com/g/jenkinsci-dev/c/BN-wjjq-v9c

[dduportal]

As discussed during the last team meeting, using the ATH Maven upgrade as a "smoke test" could be an interesting trigger to start a new Maven upgrade campaign.

Today we only rely on the packer-image (such as jenkins-infra/packer-images#1351) and the experience (e.g. manual smoke test) of a contributor like @MarkEWaite .

Even if ATH is "unrelated" to the usual use cases such as Jenkins Core build, plugin builds, etc.), if it uses a new Maven version then it could be a great indicator for us.

Proposal: let's get the Maven version used by ATH instead of checking the latest version.

[dduportal]

Implemented in jenkins-infra/packer-images#1361