tycho-p2-repository-plugin:2.7.5:verify-repository where does that verify against?

[jcompagner]

i have with 2.7.5 this when i create my p2 site (of some 3rd party libs)

[INFO] --- maven-jarsigner-plugin:1.4:sign (sign) @ shiplibs ---
[INFO] 35 archive(s) processed
[INFO]
[INFO] --- tycho-p2-repository-plugin:2.7.5:fix-artifacts-metadata (update) @ shiplibs ---
[INFO]
[INFO] --- tycho-p2-repository-plugin:2.7.5:archive-repository (default-archive-repository) @ shiplibs ---
[INFO] Building zip: C:\Users\jcomp\git\servoy_master\servoy-eclipse\shipplugins\target\shiplibs-2022.3.0.3740_rc.zip
[INFO]
[INFO] --- tycho-p2-plugin:2.7.5:p2-metadata (p2-metadata) @ shiplibs ---
[INFO]
[INFO] --- maven-jarsigner-plugin:1.4:verify (verify) @ shiplibs ---
[INFO] 35 archive(s) processed
[INFO]
[INFO] --- tycho-p2-repository-plugin:2.7.5:verify-repository (verify) @ shiplibs ---
[INFO] Verifying p2 repositories in C:\Users\jcomp\git\servoy_master\servoy-eclipse\shipplugins\target\repository
[ERROR] Problems downloading artifact: osgi.bundle,org.apache.commons.commons-fileupload,1.4.0.
[ERROR]   The signature is invalid for current content

it does sign everything and then the mvn jar signer plugin does verify them all, but then the tycho-p2 verify fails because of the signature. Now i wonder what signature that is?

also if you google for tycho-p2-repository-plugin and so on you get all kinds of hits pointing to this location:

https://www.eclipse.org/tycho/sitedocs/tycho-p2/tycho-p2-repository-plugin/assemble-repository-mojo.html

but that is now all 404, did all that documenation move? is it now in github? (maybe then the wiki https://github.com/eclipse-tycho/tycho/wiki should point to that?)

[jcompagner]

hmm if i then by pass that verify (turn it off for a moment)

then the plugin that depends on stuff that should be in that p2 target:

Failed to execute goal on project com.servoy.eclipse.ngclient: Could not resolve dependencies for project com.servoy:com.servoy.eclipse.ngclient:eclipse-plugin:2022.12.0.3820_rc: The following artifacts could not be resolved: com.github.ua-parser:uap-java:jar:1.5.3.SERVOY, com.servoy:javax.transaction:jar:1.1.0, com.servoy:javax.websocket:jar:1.1.0: com.github.ua-parser:uap-java:jar:1.5.3.SERVOY

fails because it can't find it.

If i then regenerate that p2 site with tycho 2.6.0 (with verify on and that passes) then the build works fine.

So for some reason i can't generate my 3rd party jars p2 site (like orbit) with Tycho 2.7.5