Unsigned Content in 3.22/RC1 repository

[eclipse-rap]

Unsigned Content in 3.22/RC1 repository

[merks]

Note that the tools repository is similarly not in good shape:

https://download.eclipse.org/oomph/archive/reports-extra/rap-tools-3.22-rc1/download.eclipse.org/rt/rap/tools/3.22/RC1-20220831-0943/index.html

I'll investigate and update this comment...

[mknauer]

Hmm, could be the Tycho version, it used to be 2.1.0. All bundles in question are just redistributed by us and taken from Platform and from a WebTools (i.e. the Jetty bundles) p2 repository. That and the fact that the Simultaneous Release job didn't report any errors made me believe that there is no immediate need to upgrade Tycho. With only one day left for building RC2 (and no time to work on it...) it will be challenging to fix that in time. Thanks Markus

[merks]

@mknauer I think just rebuilding will do the trick.

One other bad thing I noticed, because I wondered why the Jetty bundles aren't causing the same type of problem. There I notice that someone has jar-signed the contents here:

https://download.eclipse.org/webtools/jetty/10.0.11/repository/plugins/

So now there are two versions of the "same" artifact floating around in the mix. The ones the platform provides are only PGP signed but the ones WTP produces are jar signed; I'm quite sure the jar signed one will not validate against the PGP signature of the one that is not jar signed, so there is a problem just waiting to happen.

If you produce a new build using Tycho 2.7.5 as in the PR, let me know and I'll rerun the test (or just look in the artifact.xml and check that the pgp.publicKeys property is present for org.apache.commons.commons-fileupload and org.apache.commons.commons-io.

I think this problem first cropped up from this commit:

488739d

[mknauer]

I was working through my inbox from the latest to the older messages, therefore saw your investigation and PR just now.

In the meantime I did exactly what you proposed, i.e. just updating Tycho locally and running a local test build. Because that was successful, I am going to move forward with this and will provide a preliminary "RC2" (or RC1a) this morning which we can use to check whether I am going into the right direction.

Regarding the Jetty bundles from the WTP p2 repository... I don't have a good idea yet how to solve that.

I'll keep you updated about my progress on this issue.

[mknauer]

• Tycho is now upgraded to 2.7.5 in both, Runtime and Tools
  • RAP Runtime with PR #51 and commit a6fc2d0
  • RAP Tools with commit eclipse-rap/org.eclipse.rap.tools@c8f7988
• Build is now "prepared" for RC2
• With Gerrit Change 195593: Publish RAP 3.22 RC2 for 2022-09 RC2 I contributed a first test-RC2 to the Simultaneous Release; the verification job succeeded and I merged the current status

@merks Can you please run your tests again? That would allow us to verify if and what problems are solved now.

[merks]

The RC2 versions both look good now

• https://download.eclipse.org/oomph/archive/reports-extra/rap-runtime-3.22-rc2/download.eclipse.org/rt/rap/3.22/RC2-20220906-0913/
• https://download.eclipse.org/oomph/archive/reports-extra/rap-tools-3.22-rc2/download.eclipse.org/rt/rap/tools/3.22/RC2-20220906-0913/

Thanks again for the ultra speedy fix!

[mknauer]

Always a pleasure!

Does your test cover the Jetty bundle issue that you mentioned in your comment above, too? Because if this would be magically resolved, it would be perfect.

[merks]

In the runtime repo there are these Jetty bundles:

These are PGP-signed:

While these are jar-signed:

Nothing will magically fix this. But in both cases other projects are producing the IUs that you are consuming, so you cannot fix this problem, except maybe to replicate the work of the other projects.

In any case, the 2022-06 release shipped this same/similar way with PGP-signed content for the Jetty stuff contributed by the platform and jar-signed content for the additional bundles contributed by WTP.

https://download.eclipse.org/oomph/archive/reports-extra/releases-2022-06-202206151000/download.eclipse.org/releases/2022-06/202206151000/

[mknauer]

Thank you for this analysis, that helped me a lot!
I am going to close this issue then, and will contact WTP in parallel. Maybe they can change their p2 repository with the Jetty bundles.