Skip to content

Commit a6755b9

Browse files
committed
Forbid features that include non-project content
#54
1 parent 9e5d5f3 commit a6755b9

File tree

1 file changed

+49
-42
lines changed

1 file changed

+49
-42
lines changed

wiki/SimRel/Simultaneous_Release_Requirements.md

Lines changed: 49 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -245,48 +245,55 @@ on the CI instance provide details about duplicates:
245245

246246
[https://ci.eclipse.org/simrel/](https://ci.eclipse.org/simrel/)
247247

248-
### Provide optimized p2 repository
249-
250-
Projects must provide their own project p2 repository for their own project and updates.
251-
Projects must [optimize their p2 repositories](https://github.com/eclipse-equinox/p2/blob/master/docs/p2_index.md)
252-
to reduce bandwidth utilization and provide a better install and update experience for users.
253-
254-
In addition, they must provide their artifacts and metadata in a specified format
255-
and method to allow at least parts of their repository to be aggregated and mirrored to a common repository.
256-
The [current process](Contributing_to_Simrel_Aggregation_Build.md) may be modified throughout the year, if improvements can be made.
257-
258-
Feature "includes" must be strict,
259-
that is "include" an exact version of that other feature.
260-
This is required so installs and builds can be repeatable independent of the exact day of the install or the exact repos enabled.
261-
This is the way things are,
262-
and have been for years,
263-
and this statement is just making it explicit since technically it is possible for people to use some p2 publishers that don't have this predictability or repeatability
264-
(which can certainly be appropriate in some contexts, just not the Simultaneous Release repository).
265-
While there may, in the future, be new mechanisms that allow some "line up collection" to be specified,
266-
it will be something new, not changing the meaning of feature "includes" element via p2 metadata.
267-
268-
For similar reasons, the repositories produced and contributed must use p2 publishers that produce greedy='false' in the content metadata for runtime-optional dependencies.
269-
See and the [p2 Installable Units](https://github.com/eclipse-equinox/p2/blob/master/docs/Installable_Units.md) for some history and details on this issue of greedy versus non-greedy requirements.
270-
But in brief, to have a runtime-optional dependency be non-greedy is important for several reasons,
271-
especially in an IDE environment.
272-
First it gives ultimate control over what is installed to the user,
273-
based on their feature selection,
274-
instead of depending on what happens to be available from the repositories they are pointing to at that moment it time.
275-
It also makes it much easier for adopters to be able to predict (and maintain) what their users have installed.
276-
In fact, if something is runtime-optional,
277-
but pulled into an install because someone did not specify greedy='false' meta-data,
278-
there is no way an adopter can provide a patch feature to one of their customers if that optional bundle causes a bug.
279-
280-
Everyone's p2 repositories must make use the of p2.mirrorsURL property.
281-
For "how to" information, see [p2.mirrorsURL](https://github.com/eclipse-equinox/p2/blob/master/docs/p2_index.md).
282-
Note: this is not really a "Simultaneous Release Requirement" but is required of any p2 repository on Eclipse Foundation infrastructure,x
283-
and is just documented here to help spread the word and educate newcomers.
284-
285-
Similar to p2.mirrorsURL attribute, a well-behaved, well-optimized p2 repository should contain a p2.index file.
286-
This is especially important for "composite repos" and prevents unnecessary "round trips" to server looking for files.
287-
For how-to instructions, see the [p2.index](https://github.com/eclipse-equinox/p2/blob/master/docs/p2_index.md).
288-
Again, this is not so much a "Simultaneous Release Requirement" but is recommended of any p2 repository on Eclipse Foundation infrastructure,
289-
and is just documented here to help spread the word and educate newcomers.
248+
### Do not include non-project content in features
249+
250+
It's been common practice to include third-party bundles in a `feature.xml`:
251+
```
252+
<plugin id="org.apache.commons.commons-codec" version="0.0.0"/>
253+
```
254+
The p2 metadata induced from an include has, by design, a very restricted version range:
255+
```
256+
<required namespace='org.eclipse.equinox.p2.iu' name='org.apache.commons.commons-codec' range='[1.16.0,1.16.0]'/>
257+
```
258+
This restricts the requirement to match exactly and only the one, specific version available during the build.
259+
This approach is appropriate for the project's own provided content,
260+
but when many projects do this for a third-party dependency
261+
and are building against different versions of that third-party dependency,
262+
we end up with duplicates in SimRel.
263+
Not only are duplicates generally redundant,
264+
sometimes when the duplicates are actually installed simultaneously,
265+
they cause wiring problems at runtime that breaks the provided functionality.
266+
267+
Even worse,
268+
if a CVE is discovered for a third-party bundle,
269+
it's not possible to update an installation to remove the old bundle and replace it with a newer version
270+
without the feature provider also building a newer feature version that includes the newer bundle version.
271+
The inability to respond quickly to a security vulnerability is something that we must strive to avoid
272+
by ensuring that the version-range constraints on every third-party bundle is as wide as is semantically sensible.
273+
274+
It is significant to note too that bundle includes are generally redundant,
275+
i.e., if something (a bundle) actually requires the third-party bundle,
276+
it will declare that requirement in the `MANIFEST.MF`
277+
with an appropriate semantic version-range constraint.
278+
So the third-party bundle will be installed as required regardless of what the feature specifies,
279+
and with the necessary flexibility to update to a newer version without also updating the bundle that requires it.
280+
281+
As such, including non-project bundles in features is not just discouraged, it is forbidden.
282+
Projects will be given time to adapt,
283+
but the Planning Council may choose to disable a project for violating this rule at its discretion.
284+
285+
Often includes are specified to ensure that the bundle is aggregated by Tycho into the p2 update site.
286+
In order to ensure the project's p2 site is sufficiently complete with respect to transitive requirements,
287+
a project can take one of the following approaches:
288+
1. Specify additional bundles directly in the `category.xml`, uncategorized.
289+
2. Define a `dependencies` feature,
290+
include the bundle in that feature,
291+
specify that feature in the `category.xml`, uncategorized,
292+
and **do not** contribute the feature to SimRel nor use it for any other purpose than in the `category.xml`.
293+
3. Use advanced features of Tycho to include all transitive dependencies while filtering out the ones provided by other sites.
294+
- [tycho-p2-repository:assemble-repository](https://tycho.eclipseprojects.io/doc/main/tycho-p2-repository-plugin/assemble-repository-mojo.html)
295+
- [filter added repository](https://github.com/eclipse-tycho/tycho/blob/tycho-4.0.x/RELEASE_NOTES.md#new-option-to-filter-added-repository-references-when-assembling-a-p2-repository)
296+
- [m2e-core example](https://github.com/eclipse-m2e/m2e-core/blob/db6dd23d3ee8d781b0238896324f0e09bb60a874/org.eclipse.m2e.repository/pom.xml#L53-L66)
290297

291298
### Branding
292299

0 commit comments

Comments
 (0)