`tr '-' '.'` conflates semver and build number in `versionLT()` of `jenkins-support` script

[lemeurherve]

(Extracted from #2328)
(See also #2328 (comment), which mentions that asm-api also suffers the same versioning issue)

tr '-' '.' conflates semver and build number

Lines 14–15 normalise - to . in both inputs:

normalized_version1=$(echo "$1" | tr '-' '.')
normalized_version2=$(echo "$2" | tr '-' '.')

For plugins versioned as X.Y-<buildnum>.v<sha> (e.g. apache-httpcomponents-client-5-api), this fuses the semver and the build number into a single dotted string. A release moving from 5.6-191.vb_47e2b_41c698 to 5.6.1-195.v65ffe15189a_d becomes a comparison of 5.6.191.vb_47e2b_41c698 vs. 5.6.1.195.v65ffe15189a_d. The older 5.6 line carries a high build number, so sort --version-sort ranks it after the newer 5.6.1 line.

Suggested fix

A fix purely in shell heuristics is harder, since - carries semantic meaning in some plugin versioning schemes (separating a semver from a build identifier) and not in others. The most robust fix is probably to delegate to Jenkins's own hudson.util.VersionNumber, or at minimum to split the string on a richer delimiter set before comparing segment-wise. Open to suggestions on which direction is preferred before sending a patch.

[lemeurherve]

@lauraseidler: as suggestion and as not sure what amount of work the delegation would imply, maybe have a different comparison/split/replacement in case the pattern ^\d\.\d- is recognised?

[rrjjvv]

For asm-api at least, it's not related to the plugin doing a one-time change in versioning scheme. It's simply following the version of what it's packaging verbatim (which appears to omit patch version on minor version bumps):

Most recent version is 9.10.1-216.va_9256d3b_844b_ and says:

Update dependency org.ow2.asm:asm-bom to v9.10.1

and previous to that is 9.10-211.v7d13903b_a_d89 and says:

Update dependency org.ow2.asm:asm-bom to v9.10