Re: [orbit-dev] Orbit artefacts in Maven repository

[Tom Schindl <tom.schindl@xxxxxxxxxxxxxxx>]

On 20.03.18 19:24, Roland Grunberg wrote:
> This has come up in the past and it was determined it would be out of
> scope for Orbit.
> 
> https://bugs.eclipse.org/bugs/show_bug.cgi?id=484631
> (particularly comment 8)
> 
> https://bugs.eclipse.org/bugs/show_bug.cgi?id=484633
> 
> New Orbit bundles (built with EBR) can all be mapped to the original
> maven coordinates that were used to generate them. In some cases the
> artifacts can't be found on Maven Central, so we host the content
> ourselves at 'orbit-approved-artifacts', as those bugs describe.
> 
> As has been mentioned, it's possible for the final generated bundle to
> differ from the original artifact in more than just the manifest data.
> Certain classes might need to be excluded for legal reasons, and in
> some cases, additional modifications may be needed to resolve
> vulnerabilities/bugs where updating is not feasible.
> 

That's exactly why we at e(fx)clipse follows the route to publish all
upstream artifacts (platform, orbit, ...) we depend on as well to maven.

We want to make sure that no matter how people consume our artifacts
p2/r5/maven that they get exactly the same bits.

The publishing process is automated but we currently don't publish to
maven central because we've not been sure we do everything correct.

Currently everything we publish as part of the e(fx)clipse framework is
at
http://maven.bestsolution.at/efxclipse-releases/at/bestsolution/efxclipse/eclipse/
but starting with 4.0 (due sometimes end of summer) we'll switch
everything to maven-central.

Tom