Spark plugins repositiry is empty

stokito · August 31, 2024, 9:26am

The Spark tries to check for plugin updates by downloading their descriptions from the http://www.igniterealtime.org/updater/plugins.jsp

It would be really good if anyone can fix it.

akrherz · August 31, 2024, 1:04pm

I am unsure what is happening. On the server I verified

<Parameter name="spark-plugins-path"         value="/staticfiles/builds/spark/plugins"/>
$ ls /staticfiles/builds/spark/plugins
sparkphone.jar	transferguard.jar  translator.jar

Probably need @guus help here.

stokito · August 31, 2024, 5:16pm

ok, I created a ticket [SPARK-2345] - Ignite Realtime Jira to not forget about this.

guus · September 17, 2024, 12:44pm

Err, I wonder if downloadable plugins for Spark were ever a thing? We do not have them listed on the website, for example. As far as I know, Spark bundles plugins in its installation, but doesn’t download them separately.

Do Spark instances in the wild already perform these update checks? Upon a successful check, what do clients do? Automatically install things? Pop up a confirmation dialog?

I worry about accidentally breaking every Spark client out there by re-enabling (or possibly enabling for the first time) this feature again.

stokito · September 17, 2024, 2:03pm

Yes, it will show a confirmation dialog with the Install button that will download a plugin.

github.com

igniterealtime/Spark/blob/master/core/src/main/java/org/jivesoftware/sparkimpl/plugin/viewer/PluginViewer.java

/**
 * Copyright (C) 2004-2011 Jive Software. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.jivesoftware.sparkimpl.plugin.viewer;

import org.apache.hc.client5.http.classic.methods.HttpGet;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClients;

This file has been truncated. show original

If we fix the directory then yes, it may be a lot of clients will show the message.
We can limit their amount by rising the minimal required version, and it’s better to do given how many plugins wasn’t re-tested in a while.
There is also a security risk because the plugin updater doesn’t verify TLS cert. So it may be better to fix the updater and release a now version of the Spark itself.

stokito · September 17, 2024, 2:32pm

BTW the default plugin URL also can be changed for new versions. This may be another way to prevent unexpected plugin updates in old clients