Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [jetty-users] Looking for update site with all Jetty bundles with same version as the one installed in current Eclipse release

You need to reach out to the Eclipse Tycho project.
It's their tooling that creates that `jetty-p2` zip / artifact / xmls...

$ curl -O https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/11.0.7/jetty-io-11.0.7.jar.asc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   801  100   801    0     0   6022      0 --:--:-- --:--:-- --:--:--  6022

$ curl -O https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/11.0.7/jetty-io-11.0.7.jar
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  196k  100  196k    0     0  1525k      0 --:--:-- --:--:-- --:--:-- 1525k

$ gpg --keyserver-options auto-key-retrieve --verify jetty-io-11.0.7.jar.asc
gpg: assuming signed data in 'jetty-io-11.0.7.jar'
gpg: Signature made Wed 06 Oct 2021 03:00:14 PM CDT
gpg:                using RSA key 2D0E1FB8FE4B68B4
gpg: Good signature from "Joakim Erdfelt <joakim.erdfelt@xxxxxxxxx>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5989 BAF7 6217 B843 D66B  E55B 2D0E 1FB8 FE4B 68B4

We can check the signature with https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/KEYS.txt

$ curl -o - https://raw.githubusercontent.com/eclipse/jetty.project/jetty-10.0.x/KEYS.txt | grep joakim.erdfelt@xxxxxxxxx
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   791  100   791    0     0   1243      0 --:--:-- --:--:-- --:--:--  1241
Joakim Erdfelt  <joakim.erdfelt@xxxxxxxxx>  5989 BAF7 6217 B843 D66B  E55B 2D0E 1FB8 FE4B 68B4


Now let's take a look at the p2site.zip ...

$ curl -O https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-p2/11.0.7/jetty-p2-11.0.7-p2site.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 72281  100 72281    0     0   412k      0 --:--:-- --:--:-- --:--:--  410k

$ unzip jetty-p2-11.0.7-p2site.zip
Archive:  jetty-p2-11.0.7-p2site.zip
  inflating: content.xml            
  inflating: artifacts.xml          

$ xmllint --xpath "string(//artifact[@id='org.eclipse.jetty.io']/properties/property[@name='pgp.signatures']/@value)" artifacts.xml
-----BEGIN PGP SIGNATURE-----

iQIcBAABAgAGBQJhXgBOAAoJEC0OH7j+S2i0gGIP/iqRlIH3Xeq0raOZeY2fK+WF
S2m4NB5wcoIsc0cVLVyM50RIdhsuWSitgucTCw6YuNNI1G1hLl9/FYiqe07YYc9k
2nE8/8wtgKHoioesWAITs6ai97w9CuOig9zlDT90zWX6/ZfWR4JL+Q4jlsJU8Z+i
Mx6ax9yjRiZkAD1tvvkpNVriDWwwRYCXWwtIU/kU+LX3NX2Qn2Y1kveboZgEUnMP
gT8yaTpGSvvy5euvxH55cxLQ+18nppcYvcpdv8KwfpUtpoA4iFOorxShDgZrSPkw
fA0VwWVRYY4C0fu6GkDWV8TxZD1EPTYEfrvkbwQS/FgJlIzFDXXBRm6sXD5mXv5w
KNVb3vt7yuOdsswY5pD9GcKcmvewTrP0nCrsFT24eW0lf4WksGT7deoj3WrKwKlm
BY5kThMlP2XXFWpK5CZ4spY4FzH9kGq4+iDxz1xU3h0elsDSqhh8pq6jPVGXxz9/
EJcR70cHW1y5M2qMZ1f+M8hpZlqutKtQDF5/sILfZZON6JAVZ0i3tMTlhGIhazCu
1oA/xGmzcXg2/HSN66ReoTa+mxeXvotffElEsHv3OnMYwWCIlk4YNuUJ5Qm86Uvj
nvM6WM6CyT3y+uPz4yLYtMPIaTo3ZbQKOTKnARIhHPGIWRjv5MmBsUtFzwWytoq3
lh/uTkMfy5hZ9HhI+E6Z
=fN9N
-----END PGP SIGNATURE-----

I have no idea what artifact this signature is for.
It's my gpg key, RSA key 2D0E1FB8FE4B68B4 "Joakim Erdfelt <joakim.erdfelt@xxxxxxxxx>"
But I have no idea what it signed.
The Eclipse Tycho folks will know, they wrote the entire tool suite that does this.

Reminder: all of the bundle repositories you used to find at eclipse.org were for other Eclipse Projects.
They were not meant to be consumed by projects outside of Eclipse.
Eclipse Jetty never produced P2 repositories.
If you find P2 repositories with Eclipse artifacts, those were created by other Eclipse Projects that wanted to use Eclipse Jetty.
It's been like this forever.
All we do is review / merge Eclipse Tycho PRs into our build tree.

Joakim Erdfelt / joakim@xxxxxxxxxxx


On Fri, Mar 25, 2022 at 7:23 AM Didier Vojtisek <didier.vojtisek@xxxxxxxx> wrote:
the asc for 10.0.7 and not 11.0.7
https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/10.0.7/jetty-io-10.0.7.jar.asc

but still different from the one in p2site


On 25/03/2022 13:20, Didier Vojtisek wrote:
I can try ...  :-/
however, even if I'm not signature specialist, I suspect an issue in the pgp signatures declared  in the artefacts.xml (in the https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-p2/10.0.7/jetty-p2-10.0.7-p2site.zip )
versus the signature associated to the target jar in maven


for example , in the above zip, I find the following signature in the artefacts.xml  (I took the first one  in order to avoid ctrl+F in the long file):

<artifact classifier='osgi.bundle' id='org.eclipse.jetty.io' version='10.0.7'>
      <properties size='10'>
        <property name='artifact.size' value='201509'/>
        <property name='download.size' value='201509'/>
        <property name='download.md5' value='390f758950eb984a7d014de459fb4c39'/>
        <property name='download.checksum.md5' value='390f758950eb984a7d014de459fb4c39'/>
        <property name='download.checksum.sha-256' value='525975f6de0868ee66a34096186ea20d844ae9f884c6e170add912d4f19ede31'/>
        <property name='maven.artifactId' value='jetty-io'/>
        <property name='maven.extension' value='jar'/>
        <property name='maven.version' value='10.0.7'/>
        <property name='maven.groupId' value='org.eclipse.jetty'/>
        <property name='pgp.signatures' value='-----BEGIN PGP SIGNATURE-----&#xA;&#xA;iQIcBAABAgAGBQJhXfpjAAoJEC0OH7j+S2i0nKkP/A6AAbSMV7LDd/9rcc5UVZ+N&#xA;a5ka6w9cilDSjjjp0d2KPoDsdsVNfJG04kr64Q/Z87QcuxIhYnybPjAOtuPR1SMU&#xA;I1RBqG6auJj6KN9F9y5hxxk+zzRL7EnV6OlIGS1EIBS5yh1L03AiYGPgar7JulKS&#xA;G2wcTcbVaVVC7dGZ3sNIrzyf5aEmt0DE/4GYdnmbit11BiI6HIOci7WMIYVID/AD&#xA;3+KlTB+nStUPd+6RXc8wOBeEg9UFifJ9QCBaXAV+3PCuXbrQ+43awC94N0QBQ7Ge&#xA;2JxCaynmvnK0roQB3yMN21c7Qj5YwTw48/NNkcv0ifphFW2nvqN9dces5mjpXO34&#xA;SXjbmRbpHITRjfgKy2WIwobRFGbUkz4AOtNYvbQHcZ/4zz6CC5pTWNKeukp2dj+z&#xA;oCKe1iPMmnWHQmxtTFVG4RjJkstMJI5EHG6ArFGR1VVas0xhQmyqkUI1fLTEBIev&#xA;Y0xRmtKAookp2xFY+x1DIM9p99MZOsqbn36+qf1nDBbkER/jULtGPgPFGAQC+a03&#xA;0zRAJ+YcVCH30WTp7x5gVXSpO2TD+txxs4YNQskBR5ZYJb5t2uUEBlZClP+k4z5W&#xA;nXo9oUrneSUqg8CvUdTKYXblCMkDsq43xRBm++W1IKtOivJOKzqVQMKp6IGAtYcR&#xA;6yW2cfW/Uj4M1m9a1sml&#xA;=B+xb&#xA;-----END PGP SIGNATURE-----'/>
      </properties>
    </artifact>


but the corresponding asc in maven looks differrent: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/11.0.7/jetty-io-11.0.7.jar.asc (even considering the &#  xml char convertion)


Additionally, I don't think this is tycho specific, because I also got the same error directly trying to use the url mvn:org.eclipse.jetty:jetty-p2:10.0.7:zip:p2site in eclipse"install new software" user interface (need m2e installed to support such url)

Didier


On 25/03/2022 11:58, Joakim Erdfelt wrote:
The content in maven is most definitely valid.
That content specifically is used by Eclipse IDE to build the help system present in the IDE.

I do not know what "Signature is invalid" means in this context.

I would suggest reaching out to the Eclipse Tycho folks and asking them how to resolve this issue.
Start with sending an email to their tycho-user mailing list.

Joakim Erdfelt / joakim@xxxxxxxxxxx


On Fri, Mar 25, 2022 at 5:42 AM Didier Vojtisek <didier.vojtisek@xxxxxxxx> wrote:
Hi thanks for your answer

I tried to use the site you propose but none of my install works.  The main error is that it fails with a   "Signature is invalid for current content." error.

I used the following urls mvn:org.eclipse.jetty:jetty-p2:10.0.7:zip:p2site   (as stated in https://www.eclipse.org/tycho/sitedocs/tycho-p2/tycho-p2-repository-plugin/plugin-info.html)
I first tried directly with the eclipse installer (after having manually installed a bundle containing the package javax.websocket that isn't present )

I also tried a maven tycho build to produce my own update site by requiring jetty jar

Unfortunately both strategies failed with the "Signature is invalid"  message ...

I put a small project illustrating the problem here: https://github.com/dvojtise/jetty-eclipse-p2/tree/main/jetty-eclipse-p2-repo (you can directly look at the associated github action log)

Any idea ?

Didier

On 24/03/2022 20:27, Joakim Erdfelt wrote:
The Eclipse Tycho project is the source for bundles from maven repositories now.

It will use the references found in https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-p2/ to create a local P2 build for you.

Joakim Erdfelt / joakim@xxxxxxxxxxx


On Thu, Mar 24, 2022 at 12:13 PM Didier Vojtisek <didier.vojtisek@xxxxxxxx> wrote:
Hi

In eclipse some  Jetty components was bundled in the standard eclipse update site. (
only a subset of jetty bundles. (cf. http://download.eclipse.org/releases/xxx content))

In our project, we need some extra features for websocket management to be used directly from eclipse ( we typically  need org.eclipse.jetty.websocket.javax.websocket and org.eclipse.jetty.websocket.javax.websocket.server plugins)

With older version of Eclipse, I was using the following update site (https://download.eclipse.org/jetty/updates/jetty-bundles-9.x/) to complete the installation with compatible jetty bundles.

In more recent Eclipse, Jetty is now in version 10.x.x

I tried to install the older one on top of the new one, but the installation isn't functional (conflict, and mixing versions )
I also tried to create my own P2 site from jetty jar in maven using https://github.com/reficio/p2-maven-plugin . But again, get strange conflicts or degraded classloader performances making the OSGI platform not usable.
 
-> Does anyone know where to find a p2 update site with the other jetty bundles that would be compatible with the current Eclipse release ?

thanks

Didier
-- 
Didier Vojtisek
SED Rennes - DiverSE Team - LogicA Team
Inria, Univ Rennes, CNRS, IRISA
_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

-- 
Didier Vojtisek
SED Rennes - DiverSE Team - LogicA Team
Inria, Univ Rennes, CNRS, IRISA
Campus de beaulieu
35042 Rennes
02 99 84 75 07
_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

-- 
Didier Vojtisek
SED Rennes - DiverSE Team - LogicA Team
Inria, Univ Rennes, CNRS, IRISA
Campus de beaulieu
35042 Rennes
02 99 84 75 07

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

-- 
Didier Vojtisek
SED Rennes - DiverSE Team - LogicA Team
Inria, Univ Rennes, CNRS, IRISA
Campus de beaulieu
35042 Rennes
02 99 84 75 07
_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

Back to the top