Community
Participate
Working Groups
The topic of SBOMs was mentioned on the dev mailing list. I see various aspects and have at present no good idea about the solution, but would use the bug to keep the discussions / ideas. Removal of IP Logs - the changes introduced last year https://www.eclipse.org/projects/handbook/#ip-history projects are not required to submit IP Logs, but to provide SBOMs. AFAIU there is still no standard way for this. For our last release I used the https://github.com/eclipse/dash-licenses tool and manually checked the report that all listed dependencies are approved. Generating this information can be done as part of the build, and for me this would be the first step. I still wonder what to do with the information once it is generated. There is an option to fail the build. I haven't tried this one (we use only approved libs), but I intend to add a dependency to something not-approved and see what the effect is. So far I only did some checks that the plugins I find in the standalone MAT package are all part of the generated dependency list (they are indeed a subset of it, the generated list contains more). The second aspect is providing an SBOM as part of ... - well the first question for me is "as part of what?" The source repository? The downloadable packages? - in what format? The licensce tool generates a txt file, there is also the "mvn dependency:tree" described, and there are formats expected to be standardized. Here some references: - Wayne's blog on using dash-license in maven: https://blog.waynebeaton.ca/posts/ip/dash-license-tool-maven-reactor/ - CycloneDX maven plugin: https://github.com/CycloneDX/cyclonedx-maven-plugin I guess the best would be to find another Eclipse project which does this and mimic their setup. Any idea of a concrete project to look at?
One example is the dash-license-tool project itself. That has a ci build: https://ci.eclipse.org/dash/job/dash-license-tool/ It seems to build several bom.json files. E.g. [INFO] --- cyclonedx:2.7.9:makeAggregateBom (default) @ org.eclipse.dash.licenses --- [INFO] CycloneDX: Resolving Dependencies [INFO] CycloneDX: Creating BOM version 1.4 with 46 component(s) [INFO] CycloneDX: Writing and validating BOM (JSON): /home/jenkins/agent/workspace/dash-license-tool/core/target/bom.json [INFO] attaching as org.eclipse.dash.licenses-1.0.3-SNAPSHOT-cyclonedx.json and archives them [JENKINS] Archiving /home/jenkins/agent/workspace/dash-license-tool/core/target/bom.json to org.eclipse.dash/org.eclipse.dash.licenses/1.0.3-SNAPSHOT/org.eclipse.dash.licenses-1.0.3-SNAPSHOT-cyclonedx.json and they are visible on the CI build site.
Thanks for the hint to look at Dash. It was straightforward to add both dash-license and cyclonedx to the build and let them produce "some" results as part of the local snapshot build :) I have the changes in https://git.eclipse.org/r/c/mat/org.eclipse.mat/+/204643, which I marked as WIP for now. I added the parameter to make dash-license fail the build in case of an unapproved dependency. Testet it locally with an arbitrary lib and the build failed lile: [INFO] --- license-tool-plugin:1.0.2:license-check (license-check) @ parent --- [INFO] Querying Eclipse Foundation for license data for 322 items. [INFO] Found 283 items. [INFO] Querying ClearlyDefined for license data for 12 items. [INFO] Found 12 items. [INFO] License information could not be automatically verified for the following content: [INFO] [INFO] maven/mavencentral/com.rabbitmq/amqp-client/5.19.0 [INFO] [INFO] This content is either not correctly mapped by the system, or requires review. [INFO] Summary file was written to: /Users/d041376/git/org.eclipse.mat/parent/target/dash/summary [ERROR] Dependency license check failed. Some dependencies need to be vetted. ... [INFO] ------------------------------------------------------------------------ [INFO] BUILD FAILURE [INFO] ------------------------------------------------------------------------ [INFO] Total time: 27.592 s [INFO] Finished at: 2023-09-28T08:52:12+02:00 [INFO] ------------------------------------------------------------------------ [ERROR] Failed to execute goal org.eclipse.dash:license-tool-plugin:1.0.2:license-check (license-check) on project parent: Some dependencies must be vetted. -> [Help 1] I think this is understandable enough, and will keep the flag in. I believe this check alone is enough for us to go through the next release. Next step would be for both dash-license and cyclonedx to go through the results in detail and see if we are reporting too many results and try to tune the build to exclude some parts. Both tools support that. What still puzzles me a bit is what to do with the results. We offer for download an update side which contains only MAT bundles + birt. And we do offer also the standalone MAT which includes everything an eclipse RCP needs to run. Having the full bom for the standalone MAT is reasonable I thing, but if people are using only the update site, then the bom will contain many more entries than provided software. I can't say how much of an issue this is. I also see that the Dash project has the DEPENDENCIES file as part of their source repository. Same questions arise here too, plus we do support building against multiple targets/Eclipse versions. So, if I were to put a single file as part of the repository - 1) shall it contain the full bom (needed for the standalone MAT) or only what we need to build the plugins and 2) if we put the full list, shall it be for the target selected by default? Any thoughts on these would be helpful.
Ideally we would have a separate BOM for the update site. We could have a vulnerability in the standalone version due to an older level of Eclipse, and the work-around would be to install MAT into a newer Eclipse. However, do build/test artifacts also appear in the BOM? E.g. SWTBot. Do tools go into the SBOM, as they could have a vulnerability that causes problems in MAT? Should test tools / test platform go into the SBOM? If they could never affect the deliverable code, then maybe not, but our build might not be that protected against malicious test tools.
All examples I was were excluding test code, therefore tried it also for out build (still need to go through the results to see if this had effect). I also felt like having separate BOMs for the two use cases is the most reasonable approach, but I'll have to see if I can get setup this with the provided tools. I guess I'll need to spend some more time reading and understanding what are typical requirements for BOMs and what are Eclipse specific ones. If in doubt, I would probably reach out the the foundation staff to ask for some guidance. But I'll see first what I can find myself before bothering them.
See also https://gitlab.eclipse.org/eclipsefdn/emo-team/sbom/-/blob/main/docs/sbom.adoc The short version is that generating SBOMs directly as part of your build, and (at least in the case of Maven) sharing them to the software repository is relatively straightforward. To really leverage the the tools to generate SBOMs, however, we need your help to tighten up the metadata captured in your build scripts (e.g., capture license information as SPDX expressions in your pom.xml file) and update your builds to generate the SBOMs. We've started capturing information here. Merge requests, issues, and comments welcome. Date: October 12, 2023 Time: 1330h UTC https://eclipse.zoom.us/j/84638945339 See you then! Our office hours calendar, along with links to recordings is available here https://www.eclipse.org/projects/calendar/. Wayne
Thanks Andrew! I won't be able to attend tomorrow, but I got the links to the sbom repo already and promised Wayne to give some feedback... then got caught in various other activities :( Sorry for not updating the ticket with the info. There was one more useful info - https://gitlab.eclipse.org/eclipsefdn/emo-team/sbom/-/issues/3 . In this issue it is basically discussed, that having sboms for the plugins is not useful and that sboms would be rather suitable for the Eclipse packages (i.e. I read it that we need one for the standalone MAT application, but not for the update site). I still have a few questions, which I need to summarise.
I merged https://git.eclipse.org/r/c/mat/org.eclipse.mat/+/204643. I think it is a good-enough first step. The build now will use: - dash-license tool to generate the list of dependencies with the corresponding reason for approval at Eclise. It will also fail the build if a non-approved dependency appears - cyclonedx plugin to generate sbom. I had to explicitly exclude the test modules, not sure yet why setting test scope to fasle didn't exclude them I adapted the jenkins build config, so that these two files are archived and available as "latest results" in jenkins, as the dash project does. I believe we would need some fine-tuning as we learn more about what is required. Therefore I'll keep this bug open.
Bug 438844 added GZip processing of HPROF files, including a pure Jaza GZip reader via CQ 21570. This was MIT licensed. plugin: org.eclipse.mat.hprof package: io.nayuki.deflate The original code in this package was MIT licensed, I made updates for MAT under the same license. There is some copyright / license text in the package-info.java https://wiki.eclipse.org/About_files https://www.eclipse.org/legal/epl/about.php#long so I think I need to update the about.html to include this information. If the org.eclipse.mat.hprof plug-in binary is now under both licenses, then I think I also need to update pom.xml <licenses> but need to find how to specify both licenses (rather than a choice). https://gitlab.eclipse.org/eclipsefdn/emo-team/sbom/-/blob/main/docs/sbom.adoc
https://git.eclipse.org/r/c/mat/org.eclipse.mat/+/205139 https://git.eclipse.org/c/mat/org.eclipse.mat.git/commit/?id=e4ad7e21fabf3727388e9d8174bdff80ac904c86 I made those changes, including to the o.e.mat.hprof pom.xml, but that license report is still the same. I don't think this is very important though. >maven/mavencentral/org.eclipse.mat/org.eclipse.mat.hprof/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat The Help > About Eclipse Memory Analyzer > Installation Details > Plug-ins > org.eclipse.mat.hprof > Legal Info does show both licenses.
I've overlooked that, thanks for the updates! I think the expression is correct, I don't know why dash-license reports only one. Also in the cyclondex sbom.json there is no license information at all for MATs own bundles, and I can't yet figure out why. Looking at dash-license output - there it is included... I can't spot the difference in the configs :)
One more thing we should check is versioning. So far we always keep the -SNAPSHOT version for maven and use the plugins with auto-generated versions with timestamps. I see the tools now all report a 1.15.0-SNAPSHOT version for MAT, which doesn't feel right. I don't know hot to deal with this. I found some recent changes for jgit/egit which seem related: https://git.eclipse.org/r/c/jgit/jgit/+/204785/7 AFAIU they try to use the timestamp of the last commit ... I am not sure we need this, but it might be possible to use some parts of the change to influence the sbom results.
I was a bit confused about the licenses in the bom.json. There is one bom.json generated for each of the modules, and in there the license is correct, also the dual license for o.e.m.hprof: ... "component" : { "group" : "org.eclipse.mat", "name" : "org.eclipse.mat.hprof", "version" : "1.15.0-SNAPSHOT", "licenses" : [ { "license" : { "name" : "EPL-2.0 and MIT", ... It is the aggregated bom (the one linked from jenkins) the license info is missing for the referenced MAT plugins, but is present for "foreign" libraries. No idea why this is so, and if this is fine (I suppose this is not fine as long as the only thing we publish is the aggregated bom).
I added some metadata as recommended to the parent pom https://git.eclipse.org/r/c/mat/org.eclipse.mat/+/205144
The recording of the Open hours call about SBOMs on 12 October is now available: https://www.youtube.com/watch?v=VeGfHzfdep4
@Andrew, some questions about the o.e.m.hprof license - I can't open the CQ 21570, (don't know why) and I have no experience with dual licenses, so I was hoping to have some more details in the CQ. - I see that SPDX expressions allow combining licenses with OR or AND, and you chose the AND. Do you have some details what this means (and what an OR would mean)? - as the hprof plugins is dual licensed, I suppose this would apply to project as a whole too? I guess at least for someone using the standalone version of MAT, where the hprof plugin is included, they have to agree to both, don't they? Do you know how this works?
I don't know properly how it works but the top level Eclipse Foundation Software User Agreement has some lines: The terms and conditions governing Plug-ins and Fragments should be contained in files named "about.html" ("Abouts"). The terms and conditions governing Features and Included Features should be contained in files named "license.html" ("Feature Licenses"). Abouts and Feature Licenses may be located in any directory of a Download or Module including, but not limited to the following locations: The top-level (root) directory Plug-in and Fragment directories Inside Plug-ins and Fragments packaged as JARs Sub-directories of the directory named "src" of certain Plug-ins Feature directories then if you look in org.eclipse.mat.hprof there is an about.html and about_files/DEFLATE-mit.html with the extra information. That's basically a copyright statement and a no warranty term. The license is 'AND' as both EPL 2.0 and MIT need to be followed. 'OR' would mean the user could choose either license. The user can view the o.e.mat.hprof about.html with Help > About Eclipse Memory Analyzer > Installation Details > Plug-ins > Memory Analyzer - HPROF Adapter > Legal Info I don't think there is any need to change the top level Software User Agreement (and that might not be allowed anyway), and the user has agreed to follow all those sub level about.html files. If you go to some of the other plug-ins then they can have different terms. E.g. Apache Commons JXPath
https://docs.osgi.org/specification/osgi.core/8.0.0/framework.module.html#framework.module-bundle-license Perhaps for o.e.mat.hprof you could use: Bundle-License: EPL-2.0;link="https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt",MIT;link="https://opensource.org/license/mit/" or possibly https://spdx.org/licenses/MIT.html for the link.
Thanks! BTW, the last changes I made (add Bundle-License headers to the MANIFEST.MF files) might be unnecessary - I saw that in the manifest generated during the build the license headers were added. Nevertheless, I think I'll keep the explicit ones, so that we see these also in the source.
The latest build just has the o.e.mat bundles in bom.json and summary, whereas previous had a lot more. Is this due to the Tycho change? https://ci.eclipse.org/mat/job/tycho-mat-nightly/1508/artifact/parent/target/bom.json Build Artifacts bom.json 19.79 KB view summary 1.74 KB view https://ci.eclipse.org/mat/job/tycho-mat-nightly/1508/artifact/parent/target/dash/summary/*view*/ maven/mavencentral/org.eclipse.mat/org.eclipse.mat.api/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.chart.feature/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.chart.ui/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.chart/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.dtfj/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.feature/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.hprof/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ibmdumps/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.jdt/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.jruby.resolver/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.parser/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.product/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.report/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui.help/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui.rcp.feature/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui.rcp/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat but a previous build had a lot more: https://ci.eclipse.org/mat/job/tycho-mat-nightly/1505/artifact/parent/target/bom.json https://ci.eclipse.org/mat/job/tycho-mat-nightly/1508/artifact/parent/target/dash/summary/*view*/ maven/mavencentral/com.ibm.icu/icu4j/73.2, GPL-2.0-or-later AND GPL-3.0-or-later AND LicenseRef-scancode-autoconf-simple-exception AND LicenseRef-scancode-autoconf-simple-exception-2.0 AND LicenseRef-scancode-unicode AND LicenseRef-scancode-unicode-icu-58 AND NTP AND LicenseRef-scancode-unicode, approved, #9093 maven/mavencentral/jakarta.el/jakarta.el-api/3.0.3, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.el maven/mavencentral/jakarta.servlet/jakarta.servlet-api/4.0.4, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.servlet maven/mavencentral/javax.servlet.jsp/javax.servlet.jsp-api/2.3.3, Apache-2.0 or CDDL-1.0, approved, CQ7385 maven/mavencentral/net.java.dev.jna/jna-platform/5.13.0, Apache-2.0 OR LGPL-2.1-or-later, approved, #6707 maven/mavencentral/net.java.dev.jna/jna/5.13.0, Apache-2.0 AND LGPL-2.1-or-later, approved, #6709 maven/mavencentral/org.apache.felix/org.apache.felix.gogo.command/1.1.2, Apache-2.0, approved, clearlydefined maven/mavencentral/org.apache.felix/org.apache.felix.gogo.runtime/1.1.6, Apache-2.0 AND MIT, approved, CQ22929 maven/mavencentral/org.apache.felix/org.apache.felix.gogo.shell/1.1.4, Apache-2.0, approved, clearlydefined maven/mavencentral/org.apache.felix/org.apache.felix.scr/2.2.6, Apache-2.0 AND BSD-3-Clause AND MIT, approved, #798 maven/mavencentral/org.bouncycastle/bcpg-jdk18on/1.76, Apache-2.0, approved, #9824 maven/mavencentral/org.bouncycastle/bcprov-jdk18on/1.76, MIT AND CC0-1.0, approved, #9827 maven/mavencentral/org.codehaus.mojo/animal-sniffer-annotations/1.9, MIT, approved, clearlydefined maven/mavencentral/org.eclipse.jetty.toolchain/jetty-servlet-api/4.0.6, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-http/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-io/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-security/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-server/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-servlet/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-util-ajax/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.jetty/jetty-util/10.0.15, EPL-2.0 OR Apache-2.0, approved, rt.jetty maven/mavencentral/org.eclipse.mat/org.eclipse.mat.api/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.chart.feature/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.chart.ui/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.chart/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.dtfj/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.feature/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.hprof/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ibmdumps/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.jdt/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.jruby.resolver/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.parser/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.product/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.report/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui.help/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui.rcp.feature/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui.rcp/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.eclipse.mat/org.eclipse.mat.ui/1.15.0-SNAPSHOT, EPL-2.0, approved, tools.mat maven/mavencentral/org.glassfish/javax.el/3.0.0, , approved, CQ7384 maven/mavencentral/org.hamcrest/hamcrest/2.2, BSD-3-Clause, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.namespace.extender/1.0.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.namespace.implementation/1.0.0, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.service.cm/1.6.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.service.component/1.5.1, Apache-2.0, approved, #5389 maven/mavencentral/org.osgi/org.osgi.service.device/1.1.1, Apache-2.0, approved, #2418 maven/mavencentral/org.osgi/org.osgi.service.event/1.4.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.service.metatype/1.4.1, Apache-2.0, approved, #2419 maven/mavencentral/org.osgi/org.osgi.service.prefs/1.1.2, Apache-2.0, approved, #2451 maven/mavencentral/org.osgi/org.osgi.service.provisioning/1.2.0, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.service.upnp/1.2.1, Apache-2.0, approved, #2735 maven/mavencentral/org.osgi/org.osgi.service.useradmin/1.1.1, Apache-2.0, approved, #2437 maven/mavencentral/org.osgi/org.osgi.service.wireadmin/1.0.2, Apache-2.0, approved, #796 maven/mavencentral/org.osgi/org.osgi.util.function/1.2.0, Apache-2.0, approved, #6908 maven/mavencentral/org.osgi/org.osgi.util.measurement/1.0.2, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.util.position/1.0.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.osgi/org.osgi.util.promise/1.3.0, Apache-2.0, approved, #5266 maven/mavencentral/org.osgi/org.osgi.util.xml/1.0.2, Apache-2.0, approved, #799 maven/mavencentral/org.osgi/osgi.annotation/8.0.1, Apache-2.0, approved, #6909 maven/mavencentral/org.osgi/osgi.annotation/8.1.0, Apache-2.0, approved, #1985 maven/mavencentral/org.ow2.sat4j/org.ow2.sat4j.core/2.3.6, (EPL-1.0 OR LGPL-2.0-or-later) AND MIT, approved, #1929 maven/mavencentral/org.ow2.sat4j/org.ow2.sat4j.pb/2.3.6, (EPL-1.0 OR LGPL-2.1-or-later) AND MIT, approved, #1928 maven/mavencentral/org.slf4j/slf4j-api/2.0.5, MIT, approved, #5915 maven/mavencentral/org.tukaani/xz/1.9, LicenseRef-Public-Domain, approved, CQ23498 p2/orbit/p2.eclipse.feature/com.ibm.dtfj.feature/1.12.29003.202006111057, EPL-2.0 OR Apache-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 OR GPL-2.0-only WITH OpenJDK-assembly-exception-1.0, approved, technology.openj9 p2/orbit/p2.eclipse.feature/org.eclipse.e4.rcp/4.29.0.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.feature/org.eclipse.ecf.core.feature/1.6.1.v20230507-1923, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.feature/org.eclipse.ecf.core.ssl.feature/1.1.501.v20230507-1921, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.feature/org.eclipse.ecf.filetransfer.feature/3.14.1800.v20230422-0242, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.feature/org.eclipse.ecf.filetransfer.httpclient5.feature/1.1.701.v20230423-0417, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.feature/org.eclipse.ecf.filetransfer.ssl.feature/1.1.401.v20230422-0242, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.feature/org.eclipse.emf.common/2.30.0.v20230810-0713, EPL-1.0, approved, modeling.emf p2/orbit/p2.eclipse.feature/org.eclipse.emf.ecore/2.35.0.v20230829-0934, EPL-1.0, approved, modeling.emf p2/orbit/p2.eclipse.feature/org.eclipse.equinox.executable/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.feature/org.eclipse.equinox.p2.core.feature/1.6.1900.v20230814-2013, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.feature/org.eclipse.equinox.p2.extras.feature/1.4.2100.v20230814-2013, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.feature/org.eclipse.equinox.p2.rcp.feature/1.4.2100.v20230814-2013, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.feature/org.eclipse.equinox.p2.user.ui/2.4.2100.v20230814-2013, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.feature/org.eclipse.help/2.3.1500.v20230903-1000, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.feature/org.eclipse.rcp/4.29.0.v20230903-1000, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/com.ibm.dtfj.api/1.12.29003.202006111057, EPL-2.0 OR Apache-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 OR GPL-2.0-only WITH OpenJDK-assembly-exception-1.0, approved, technology.openj9 p2/orbit/p2.eclipse.plugin/com.ibm.dtfj.j9/1.12.29003.202006111057, EPL-2.0 OR Apache-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 OR GPL-2.0-only WITH OpenJDK-assembly-exception-1.0, approved, technology.openj9 p2/orbit/p2.eclipse.plugin/com.sun.jna/5.13.0.v20230812-1000, Apache-2.0 AND LGPL-2.1-or-later, approved, #9849 p2/orbit/p2.eclipse.plugin/javax.annotation/1.3.5.v20200909-1856, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.ca p2/orbit/p2.eclipse.plugin/javax.inject/1.0.0.v20220405-0441, Apache-2.0, approved, CQ3555 p2/orbit/p2.eclipse.plugin/org.apache.ant/1.10.12.v20211102-1452, Apache-2.0 AND EPL-2.0 AND W3C AND LicenseRef-Flora AND LicenseRef-Public-Domain, approved, CQ23806 p2/orbit/p2.eclipse.plugin/org.apache.batik.constants/1.16.0.v20221027-0840, Apache-2.0, approved, #4851 p2/orbit/p2.eclipse.plugin/org.apache.batik.css/1.16.0.v20221027-0840, Apache-2.0, approved, #4852 p2/orbit/p2.eclipse.plugin/org.apache.batik.i18n/1.16.0.v20221027-0840, Apache-2.0, approved, #4849 p2/orbit/p2.eclipse.plugin/org.apache.batik.util/1.16.0.v20221027-0840, Apache-2.0, approved, #4850 p2/orbit/p2.eclipse.plugin/org.apache.commons.codec/1.14.0.v20221112-0806, Apache-2.0 AND (Apache-2.0 AND BSD-3-Clause), approved, #3905 p2/orbit/p2.eclipse.plugin/org.apache.commons.io/2.8.0.v20210415-0900, Apache-2.0, approved, CQ23182 p2/orbit/p2.eclipse.plugin/org.apache.commons.jxpath/1.3.0.v200911051830, Apache-2.0, approved, CQ10790 p2/orbit/p2.eclipse.plugin/org.apache.commons.logging/1.2.0.v20180409-1502, Apache-2.0, approved, CQ10162 p2/orbit/p2.eclipse.plugin/org.apache.httpcomponents.client5.httpclient5-win/5.1.3.v20221013-1742, Apache-2.0 AND MIT, approved, #1828 p2/orbit/p2.eclipse.plugin/org.apache.httpcomponents.client5.httpclient5/5.1.3.v20221013-1742, Apache-2.0, approved, #6276 p2/orbit/p2.eclipse.plugin/org.apache.httpcomponents.core5.httpcore5-h2/5.1.4.v20221013-1742, Apache-2.0, approved, #3934 p2/orbit/p2.eclipse.plugin/org.apache.httpcomponents.core5.httpcore5/5.1.4.v20221013-1742, Apache-2.0, approved, #3945 p2/orbit/p2.eclipse.plugin/org.apache.jasper.glassfish/2.2.2.v201501141630, , approved, CQ4711 p2/orbit/p2.eclipse.plugin/org.apache.lucene.analysis-common/9.7.0.v20230703-0758, Apache-2.0 AND BSD-3-Clause AND BSD-2-Clause AND LicenseRef-Permission-Notice AND LicenseRef-Python AND MIT AND (GPL-2.0-only OR LGPL-2.1-only OR MPL-1.1 OR CC-BY-4.0 OR Apache-2.0), approved, #9227 p2/orbit/p2.eclipse.plugin/org.apache.lucene.analysis-smartcn/9.7.0.v20230703-0758, Apache-2.0, approved, #9222 p2/orbit/p2.eclipse.plugin/org.apache.lucene.core/9.7.0.v20230703-0758, Apache-2.0 AND BSD-3-Clause AND BSD-2-Clause AND LicenseRef-Permission-Notice AND LicenseRef-Python AND MIT AND (GPL-2.0-only OR LGPL-2.1-only OR MPL-1.1 OR CC-BY-4.0 OR Apache-2.0) AND (Apache-2.0 AND LicenseRef-Permission-Notice AND ICU), approved, #9226 p2/orbit/p2.eclipse.plugin/org.apache.xmlgraphics/2.7.0.v20221018-0736, Apache-2.0, approved, 3367 p2/orbit/p2.eclipse.plugin/org.eclipse.birt.chart.device.extension/4.12.0.v202211281949, EPL-2.0, approved, technology.birt p2/orbit/p2.eclipse.plugin/org.eclipse.birt.chart.device.swt/4.12.0.v202211281949, EPL-2.0, approved, technology.birt p2/orbit/p2.eclipse.plugin/org.eclipse.birt.chart.engine.extension/4.12.0.v202211281949, EPL-2.0, approved, technology.birt p2/orbit/p2.eclipse.plugin/org.eclipse.birt.chart.engine/4.12.0.v202211281949, EPL-2.0, approved, technology.birt p2/orbit/p2.eclipse.plugin/org.eclipse.birt.core/4.12.0.v202211281949, EPL-2.0, approved, technology.birt p2/orbit/p2.eclipse.plugin/org.eclipse.compare.core/3.8.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.compare/3.9.200.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.commands/3.11.100.v20230708-0916, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.contenttype/3.9.100.v20230630-1232, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.databinding.beans/1.10.100.v20230708-0916, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.databinding.observable/1.13.100.v20230708-0916, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.databinding.property/1.10.100.v20230708-0916, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.databinding/1.13.100.v20230708-0916, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.expressions/3.9.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.filebuffers/3.8.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.filesystem/1.10.100.v20230717-1727, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.jobs/3.15.0.v20230808-1403, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.net/1.5.100.v20230630-1232, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.resources/3.19.100.v20230814-1312, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.runtime/3.29.0.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.core.variables/3.6.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.debug.core/3.21.100.v20230731-1425, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.debug.ui/3.18.100.v20230802-1257, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.commands/1.1.100.v20230630-1554, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.contexts/1.12.100.v20230725-1354, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.di.annotations/1.8.100.v20230617-1158, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.di.extensions.supplier/0.17.100.v20230630-1232, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.di.extensions/0.18.0.v20230429-1914, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.di/1.9.100.v20230721-1753, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.core.services/2.4.100.v20230708-0809, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.emf.xpath/0.4.100.v20230801-1255, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.bindings/0.14.100.v20230630-1554, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.css.core/0.14.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.css.swt.theme/0.14.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.css.swt/0.15.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.di/1.5.100.v20230630-1554, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.dialogs/1.4.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.ide/3.17.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.model.workbench/2.4.100.v20230801-1255, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.progress/0.4.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.services/1.6.100.v20230630-1554, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.swt.gtk/1.2.0.v20230501-1823, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.swt.win32/1.2.0.v20230501-1823, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.widgets/1.4.0.v20230317-0802, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.workbench.addons.swt/1.5.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.workbench.renderers.swt.cocoa/0.14.100.v20230630-1554, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.workbench.renderers.swt/0.16.100.v20230801-1255, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.workbench.swt/0.17.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.workbench/1.15.100.v20230819-0347, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.e4.ui.workbench3/0.17.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.filetransfer/5.1.102.v20210409-2301, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.identity/3.10.0.v20230422-0242, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.provider.filetransfer.httpclient5.win32/1.1.0.v20230423-0417, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.provider.filetransfer.httpclient5/1.1.0.v20230423-0417, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.provider.filetransfer.ssl/1.1.0.v20230422-0242, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.provider.filetransfer/3.3.0.v20230422-0242, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf.ssl/1.3.0.v20230507-1921, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.ecf/3.11.0.v20230507-1923, EPL-1.0, approved, rt.ecf p2/orbit/p2.eclipse.plugin/org.eclipse.emf.common/2.29.0.v20230810-0713, EPL-1.0, approved, modeling.emf p2/orbit/p2.eclipse.plugin/org.eclipse.emf.ecore.change/2.15.0.v20230211-1150, EPL-1.0, approved, modeling.emf p2/orbit/p2.eclipse.plugin/org.eclipse.emf.ecore.xmi/2.35.0.v20230801-1141, EPL-1.0, approved, modeling.emf p2/orbit/p2.eclipse.plugin/org.eclipse.emf.ecore/2.35.0.v20230829-0934, EPL-2.0, approved, modeling.emf.emf p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.app/1.6.300.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.bidi/1.4.300.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.common/3.18.100.v20230730-1117, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.concurrent/1.2.100.v20211021-1418, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.console/1.4.500.v20211021-1418, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.event/1.6.200.v20230120-0604, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.frameworkadmin.equinox/1.2.400.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.frameworkadmin/2.2.200.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.http.jetty/3.8.300.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.http.registry/1.3.300.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.http.servlet/1.7.400.v20221006-1531, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.jsp.jasper.registry/1.2.100.v20211021-1418, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.jsp.jasper/1.1.700.v20220801-1124, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.cocoa.macosx.aarch64/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.cocoa.macosx.x86_64/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.cocoa.macosx/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.gtk.linux.aarch64/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.gtk.linux.ppc64le/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.gtk.linux.x86_64/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher.win32.win32.x86_64/1.2.700.v20221108-1024, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.launcher/1.6.500.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.artifact.repository/1.5.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.console/1.3.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.core/2.10.100.v20230814-2013, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.director.app/1.3.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.director/2.6.100.v20230718-0609, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.directorywatcher/1.4.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.engine/2.8.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.extensionlocation/1.5.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.garbagecollector/1.3.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.jarprocessor/1.3.200.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.metadata.repository/1.5.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.metadata/2.7.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.operations/2.7.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.publisher.eclipse/1.5.100.v20230814-2013, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.publisher/1.8.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.reconciler.dropins/1.5.100.v20230718-0611, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.repository.tools/2.4.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.repository/2.7.100.v20230710-0621, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.touchpoint.eclipse/2.4.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.touchpoint.natives/1.5.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.transport.ecf/1.4.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.ui.importexport/1.4.100.v20230728-2010, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.ui.sdk.scheduler/1.6.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.ui.sdk/1.3.100.v20230728-2010, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.ui/2.8.100.v20230728-2010, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.updatechecker/1.4.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.p2.updatesite/1.3.100.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.preferences/3.10.300.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.registry/3.11.300.v20230801-1826, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.security.linux/1.1.0.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.security.macosx/1.102.0.v20230616-1215, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.security.ui/1.4.0.v20230728-2008, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.security.win32.x86_64/1.2.0.v20230616-1215, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.security/1.4.0.v20230630-1303, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.simpleconfigurator.manipulator/2.2.200.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.equinox.simpleconfigurator/1.4.300.v20230630-1506, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.help.base/4.4.100.v20230903-1000, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.help.ui/4.6.0.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.help.webapp/3.11.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.help/3.10.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.jdt.core.compiler.batch/3.35.0.v20230814-2020, EPL-1.0, approved, eclipse.e4 p2/orbit/p2.eclipse.plugin/org.eclipse.jdt.core.manipulation/1.19.100.v20230811-2104, EPL-2.0, approved, eclipse.jdt p2/orbit/p2.eclipse.plugin/org.eclipse.jdt.core/3.35.0.v20230814-1356, EPL-1.0, approved, eclipse.e4 p2/orbit/p2.eclipse.plugin/org.eclipse.jdt.debug/3.21.100.v20230728-0612, EPL-2.0, approved, eclipse.jdt p2/orbit/p2.eclipse.plugin/org.eclipse.jdt.launching/3.20.100.v20230814-1810, EPL-2.0, approved, eclipse.jdt p2/orbit/p2.eclipse.plugin/org.eclipse.jdt.ui/3.30.0.v20230822-0733, EPL-2.0, approved, eclipse.jdt p2/orbit/p2.eclipse.plugin/org.eclipse.jface.databinding/1.15.100.v20230708-0916, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.jface.notifications/0.6.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.jface.text/3.24.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.jface/3.31.0.v20230821-1552, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ltk.core.refactoring/3.14.100.v20230728-0612, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ltk.ui.refactoring/3.13.100.v20230728-0612, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.osgi.compatibility.state/1.2.800.v20221116-1440, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.osgi.services/3.11.100.v20221006-1531, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.osgi.util/3.7.200.v20230103-1101, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.osgi/3.18.500.v20230801-1826, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.eclipse.plugin/org.eclipse.platform/4.29.0.v20230903-1000, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.rcp/4.29.0.v20230903-1000, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.search/3.15.200.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt.cocoa.macosx.aarch64/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt.cocoa.macosx.x86_64/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt.gtk.linux.aarch64/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt.gtk.linux.ppc64le/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt.gtk.linux.x86_64/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt.win32.win32.x86_64/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swt/3.124.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.swtbot.eclipse.finder/4.1.0.202306071420, EPL-2.0, approved, technology.swtbot p2/orbit/p2.eclipse.plugin/org.eclipse.swtbot.junit4_x/4.1.0.202306071420, EPL-2.0, approved, technology.swtbot p2/orbit/p2.eclipse.plugin/org.eclipse.swtbot.swt.finder/4.1.0.202306071420, EPL-2.0, approved, technology.swtbot p2/orbit/p2.eclipse.plugin/org.eclipse.team.core/3.10.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.team.ui/3.10.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.text/3.13.100.v20230801-1334, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.cheatsheets/3.8.100.v20230725-0936, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.cocoa/1.3.100.v20230214-1401, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.console/3.13.0.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.editors/3.17.0.v20230821-1342, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.forms/3.13.0.v20230807-1354, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.ide.application/1.5.100.v20230821-1342, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.ide/3.21.100.v20230825-1346, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.intro/3.7.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.navigator.resources/3.9.100.v20230821-1342, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.navigator/3.12.100.v20230821-1342, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.net/1.5.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.themes/1.2.2300.v20230807-1354, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.views.log/1.4.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.views.properties.tabbed/3.10.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.views/3.12.100.v20230821-1342, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.workbench.texteditor/3.17.100.v20230821-0745, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui.workbench/3.130.0.v20230822-0911, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.ui/3.204.0.v20230821-1342, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.update.configurator/3.5.100.v20230726-0617, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.eclipse.urischeme/1.3.100.v20230727-0604, EPL-2.0, approved, eclipse.platform p2/orbit/p2.eclipse.plugin/org.hamcrest.core/2.2.0.v20230809-1000, BSD-3-Clause, approved, #9982 p2/orbit/p2.eclipse.plugin/org.hamcrest.library/1.3.0.v20180524-2246, BSD-2-Clause, approved, CQ7219 p2/orbit/p2.eclipse.plugin/org.junit/4.13.2.v20230809-1000, EPL-1.0, approved, CQ21439 p2/orbit/p2.eclipse.plugin/org.mozilla.javascript/1.7.10.v20190430-1943, MPL-2.0 AND BSD-3-Clause AND ISC, approved, CQ19626 p2/orbit/p2.eclipse.plugin/org.slf4j.api/1.7.30.v20221112-0806, MIT, approved, CQ21574 p2/orbit/p2.eclipse.plugin/org.w3c.css.sac/1.3.1.v200903091627, Apache-2.0 OR LicenseRef-Public-Domain OR W3C, approved, CQ1448 p2/orbit/p2.eclipse.plugin/org.w3c.dom.events/3.0.0.draft20060413_v201105210656, Apache-2.0, approved, CQ208 p2/orbit/p2.eclipse.plugin/org.w3c.dom.smil/1.0.1.v200903091627, Apache-2.0 OR LicenseRef-Public-Domain OR W3C, approved, CQ1448 p2/orbit/p2.eclipse.plugin/org.w3c.dom.svg/1.1.0.v201011041433, Apache-2.0, approved, CQ208 p2/orbit/p2.p2.installable.unit/org.eclipse.equinox.executable_root.cocoa.macosx.aarch64/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.p2.installable.unit/org.eclipse.equinox.executable_root.cocoa.macosx.x86_64/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.p2.installable.unit/org.eclipse.equinox.executable_root.gtk.linux.aarch64/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.p2.installable.unit/org.eclipse.equinox.executable_root.gtk.linux.ppc64le/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.p2.installable.unit/org.eclipse.equinox.executable_root.gtk.linux.x86_64/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.p2.installable.unit/org.eclipse.equinox.executable_root.win32.win32.x86_64/3.8.2200.v20230717-2134, EPL-2.0, approved, eclipse.equinox p2/orbit/p2.p2.installable.unit/org.eclipse.rcp_root/4.29.0.v20230903-1000, EPL-2.0, approved, eclipse.platform
I added requireEagerResolve to the target platform configuration as suggested in https://github.com/eclipse/dash-licenses#eclipse-tycho. With this the bom.json and summary contain all dependencies again. I verified that the setting doesn't lead to having more plugins in the standalone version. I haven't verified however if the bom / dash summary contents are different than before the tycho upgrade.
This issue has been migrated to https://github.com/eclipse-mat/org.eclipse.mat/issues/40.
