Bugzilla – Full Text Bug Listing
| Summary: | Unsigned jars in Indigo ... | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Community | Reporter: | David Williams <david_williams> | ||||||
| Component: | Cross-Project | Assignee: | David Williams <david_williams> | ||||||
| Status: | RESOLVED FIXED | QA Contact: | |||||||
| Severity: | normal | ||||||||
| Priority: | P3 | CC: | igor, stepper | ||||||
| Version: | unspecified | ||||||||
| Target Milestone: | --- | ||||||||
| Hardware: | PC | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Bug Depends on: | |||||||||
| Bug Blocks: | 346976 | ||||||||
| Attachments: |
|
||||||||
|
Description
David Williams
Created attachment 196306 [details]
full listing of unsigned jars in Indigo RC1 repo
As an interesting reference ... I also analyzed Helios SR2 repository. There were about 50 jars there not signed, most from org.eclipse.mtj project. A few of the others look like repeats too ... antenna? jmunit.framework? What's those? There is only one case of "known to not be signable", that I know of, namely commonj.sdo. org.eclipse.mtj.* de.schlichtherle.truezip_6.6.0.201101310801.jar org.eclipse.net4j.spring.db_0.7.1.v200610271244.jar jmunit.framework_1.2.1.201101310801.jar antenna.preprocessor.v3_1.3.0.201101310801.jar org.eclipse.net4j.spring_0.7.1.v200610271244.jar javax.persistence_2.0.1.v201006031150.jar org.eclipse.jdt.core.compiler.batch.source_3.6.0.N20101020-2000.jar org.eclipse.jdt.core.compiler.batch_3.6.0.N20101020-2000.jar (In reply to comment #2) > org.eclipse.net4j.spring_0.7.1.v200610271244.jar That one is (was) strange. Neither our integration build (Indigo) nor our maintenance build (Helios) produces this plugin: https://hudson.eclipse.org/hudson/job/emf-cdo-integration/lastSuccessfulBuild/artifact/result/site.p2/index.html https://hudson.eclipse.org/hudson/job/emf-cdo-maintenance/lastSuccessfulBuild/artifact/result/site.p2/index.html fyi, signing m2e artifacts is tracked as Bug 339970 and we expect our contribution to be signed from rc2 on. (In reply to comment #3) > (In reply to comment #2) > > org.eclipse.net4j.spring_0.7.1.v200610271244.jar > > That one is (was) strange. Neither our integration build (Indigo) nor our > maintenance build (Helios) produces this plugin: > It does seem odd ... I checked a recent aggregation log and could not find it mentioned anywhere in the "mirroring ..." messages. The only explanation I can think of how something could "exist" in these signing checks, but not be in the mirroring messages if is it is, somehow, "embedded" inside another jar (because the signing test just works on the file system ... does not actually use p2 to 'get' things. (Even that doesn't really make sense ... just only hint of anything I could think of). In the past, we've had things that were inadvertently being "pulled in" to the common repo (by some other project, not the contributor, per se) but I think then they still showed up mirroring messages. So, we'll see ... maybe it'll magically disappear in this week's RC2 :) (In reply to comment #5) > (In reply to comment #3) > > (In reply to comment #2) > > > org.eclipse.net4j.spring_0.7.1.v200610271244.jar Please also note, how old it is! I remember that it used to be an integration with the Spring Framework which, itself, has never been approved for the release train, IIRC. I have no clue where it comes from or why... (In reply to comment #6) > (In reply to comment #5) > > (In reply to comment #3) > > > (In reply to comment #2) > > > > org.eclipse.net4j.spring_0.7.1.v200610271244.jar > > Please also note, how old it is! I remember that it used to be an integration > with the Spring Framework which, itself, has never been approved for the > release train, IIRC. I have no clue where it comes from or why... I see I was misunderstanding initially, this unsigned jar was in Helios ... and those logs are gone. I'm not so much worried about helios, except I was looking at projects that were unsigned then, and that are still unsigned in Indigo ... those are indicating a long term problem. (In reply to comment #7) > > > > > org.eclipse.net4j.spring_0.7.1.v200610271244.jar > > > > Please also note, how old it is! I remember that it used to be an integration > > with the Spring Framework which, itself, has never been approved for the > > release train, IIRC. I have no clue where it comes from or why... > > I see I was misunderstanding initially, this unsigned jar was in Helios ... and > those logs are gone. I'm not so much worried about helios, except I was looking > at projects that were unsigned then, and that are still unsigned in Indigo ... > those are indicating a long term problem. If you found this jar in Helios I would say there's definitely a long term problem. Not because it's unsigned but because it was there. The version and the build timestamp indicate that it's way older than Helios, probably from ancient times when CDO and Net4j have not been on the train at all. In addition it's name ("spring") indicates that it is not allowed to be on the train at all because the Spring Framework is not allowed to be on the train. Where exactly have you seen it?
> If you found this jar in Helios I would say there's definitely a long term
> problem. Not because it's unsigned but because it was there. The version and
> the build timestamp indicate that it's way older than Helios, probably from
> ancient times when CDO and Net4j have not been on the train at all. In addition
> it's name ("spring") indicates that it is not allowed to be on the train at all
> because the Spring Framework is not allowed to be on the train. Where exactly
> have you seen it?
I saw it on the file system, where Helios SR2 repository is stored:
~/downloads/releases/helios/201102250900/aggregate/plugins
-rw-rw-r-- 1 david_williams callistoadmin 499K 2011-02-23 10:24 org.eclipse.net4j.spring_0.7.1.v200610271244.jar
-rw-rw-r-- 1 david_williams callistoadmin 364K 2011-02-23 10:24 org.eclipse.net4j.spring.db_0.7.1.v200610271244.jar
But, honestly, I wouldn't see this as "a problem" ... at least not one worth spending any time on now. At least as long as it doesn't show up in some other way that impacts users.
(In reply to comment #8) > [...] because the Spring Framework is not allowed to be on the train. Just for completeness reasons: I found a lot of approved CQs for the Spring Framework now. But this year's train does not seem to ship it. Created attachment 196625 [details]
down to 226 for RC2 ...
Just noticed this bug was still open ... but, for Indigo SR1 there is only one showing up as "unsigned", and there is a reason for it, as documented in bug 356382 so I'll close this one, and say thanks to all! |