Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 357130

Summary:	signing bundle should use p2 APIs
Product:	[Technology] Dash	Reporter:	David Williams <david_williams>
Component:	Maven	Assignee:	Project Dash Incoming bugs <dash-inbox>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	enhancement
Priority:	P3	CC:	jesse.mcconnell, thanh.ha
Version:	unspecified
Target Milestone:	---
Hardware:	PC
OS:	Linux
Whiteboard:

Description David Williams

2011-09-08 13:48:52 EDT

This is a continuation of bug 356931. 

From the way it sounds, the maven based "signing bundle" uses some "raw" manipulation of artifacts.jar/xml files, to correct checksums and add "mapping" rules. 

It would be better to use "p2 APIs" since a) all that work as been done already :) and b) future changes or subtle variations in "input" repositories should be handled correctly. 

P2 provides a number of ant tasks, see 
http://help.eclipse.org/indigo/index.jsp?topic=/org.eclipse.platform.doc.isv/guide/p2_repositorytasks.htm 

and the p2.process.artifacts task works quite well for doing the "pack" and correcting the checksums, and is pretty easy to use ... 
        <p2.process.artifacts
            pack="true"
            repositoryPath="file:/${repoDirLocation}"/>

(where repoDirLocation is absolute path on files system to the repo)

This assume, of course, you are "running eclipse" or have p2 on classpath (or, something). There are eclipse applications that offer similar functionality, if that'd be easier ... but there is not a one-one equality of ant tasks and applications, so you'd have to check to see if there was one that did "process artifacts".

Comment 1 Jesse McConnell

2011-09-08 14:02:49 EDT

well, I don't want to use ant tasks particularly, but if there is some actual java api's for doing this sort of thing I am all ears

my understanding is tycho is starting to try and address this issue more so we might just hold off on this level of integration and just fix issues as they show up with this hackish approach until their solution lands

Comment 2 Thanh Ha

2014-04-29 09:51:47 EDT

maven.eclipse.org was decommissioned via bug 405750 and replaced with
repo.eclipse.org.

See: https://wiki.eclipse.org/Services/Nexus


The CBI project also provides a signing plugin in the form of the eclipse-jarsigner-plugin.

See: http://git.eclipse.org/c/cbi/org.eclipse.cbi.maven.plugins.git/about/