tycho 4.0.1 build is broken since April 9th #3738

MarcelRueedi · 2024-04-09T09:05:33Z

MarcelRueedi
Apr 9, 2024

Hi,

we run a tycho 4.0.1 to build a eclipse rcp application. Since monday 9th of April the build fails with the error :
java.lang.IllegalStateException: bundle org.eclipse.equinox.p2.repository is not started

. The cause seams to be :

[ERROR] [362f2f9b-e6e2-44eb-ad2b-65804f3d6797][extension>org.eclipse.tycho:tycho-maven-plugin:4.0.1] FrameworkEvent ERROR
org.osgi.framework.BundleException: Could not resolve module: org.eclipse.equinox.p2.repository.tools [26]
  Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.artifact.processors.checksum
    -> Export-Package: org.eclipse.equinox.internal.p2.artifact.processors.checksum; bundle-symbolic-name="org.eclipse.equinox.p2.artifact.repository"; bundle-version="1.5.0.v20230509-1332"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.publisher"
       org.eclipse.equinox.p2.artifact.repository [5]
         Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.persistence
           -> Export-Package: org.eclipse.equinox.internal.p2.persistence; bundle-symbolic-name="org.eclipse.equinox.p2.repository"; bundle-version="2.7.0.v20230507-1427"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.artifact.repository,  org.eclipse.equinox.p2.engine,  org.eclipse.equinox.p2.metadata.repository,  org.eclipse.equinox.p2.ui,  org.eclipse.equinox.p2.ui.importexport,  org.eclipse.equinox.p2.repository.tools"
              org.eclipse.equinox.p2.repository [12]
                Unresolved requirement: Import-Package: org.bouncycastle.bcpg; version="1.72.0"
         Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.repository
           -> Export-Package: org.eclipse.equinox.internal.p2.repository; bundle-symbolic-name="org.eclipse.equinox.p2.repository"; bundle-version="2.7.0.v20230507-1427"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.artifact.repository,  org.eclipse.equinox.p2.metadata.repository,  org.eclipse.equinox.p2.updatesite,  org.eclipse.equinox.p2.repository.tools,  org.eclipse.equinox.p2.transport.ecf,  org.eclipse.equinox.p2.engine,  org.eclipse.equinox.p2.discovery.compatibility,  org.eclipse.equinox.p2.publisher,  org.eclipse.equinox.p2.ui.sdk"
  Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.artifact.repository
    -> Export-Package: org.eclipse.equinox.internal.p2.artifact.repository; bundle-symbolic-name="org.eclipse.equinox.p2.artifact.repository"; bundle-version="1.5.0.v20230509-1332"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.publisher,  org.eclipse.equinox.p2.reconciler.dropins,  org.eclipse.equinox.p2.ui,  org.eclipse.equinox.p2.directorywatcher,  org.eclipse.equinox.p2.repository.tools,  org.eclipse.equinox.p2.publisher.eclipse"

How can this happen ?

Kummallinen · 2024-04-09T12:11:22Z

Kummallinen
Apr 9, 2024

I noticed 4.0.2 also broke with a slightly different error on the 6th (from my projects build logs). 4.0.6 still works but I've not checked any versions between them.

I'm guessing the cause is one of Tycho's dependencies, probably an indirect one, updating in maven central. Not all the dependencies in the dependency tree have specific versions set so incompatible versions published in maven central may still be picked up and used.

0 replies

ingomohr · 2024-04-09T15:15:03Z

ingomohr
Apr 9, 2024

We have the same problem with all our Eclipse feature/product projects that use Tycho 4.0.1 and 4.0.2. Since we couldn't find what the root cause was (yet), we are working around this by migrating to a newer tycho version.
However, that actually feels like a workaround because whatever broke for 4.0.1/4.0.2 can - in theory - break later Tycho versions, as well. That's why I very much would like to learn what caused this.

Thanks in advance for any information on the topic. :)

0 replies

Kummallinen · 2024-04-10T10:29:09Z

Kummallinen
Apr 10, 2024

I can't see any new version that matches the date it broke.

However tycho-core does not seem to fix the version of org.eclipse.core.runtime, whereas p2-maven-plugin does restrict org.eclipse.equinox.p2.repository.tools which shares dependencies with org.eclipse.core.runtime.

0 replies

laeubi · 2024-04-14T17:24:30Z

laeubi
Apr 14, 2024
Maintainer

In general one should update to the latest release whenever possible it should always include any latest dependencies avaiable. Beside that the dependencies should usually be "fixed" is there an example that shows the problem for investigation.

0 replies

Kummallinen · 2024-04-15T00:24:49Z

Kummallinen
Apr 15, 2024

@laeubi as far as I can tell at least Tycho 4.0.1 & 4.0.2 will fail if the build includes a repository project, so any of the repository projects from the test suite should show the error.

4.0.1 will fail with the error in the initial post, 4.0.2 fails with a different error related to the same "org.eclipse.equinox.p2.repository" bundle not being started. Guessing that the latest org.eclipse.core.runtime version is incompatible with the org.eclipse.equinox.p2.repository version used by older Tycho versions.

8 replies

laeubi Apr 16, 2024
Maintainer

@sratz you can do dependency:tree on the Tycho project also maybe the maven enforcer plugin can be used to enforce not using version ranges?

sratz Apr 16, 2024
Collaborator

I looked into dependency:tree, but this only outputs the already-resolved-to-fixed-version dependencies :(

Even Maven's internal debug output with -X only shows the resolved dependency version, never the range it choses from, if so.

laeubi Apr 16, 2024
Maintainer

maybe @cstamas know a secret from the maven-resolver how to enable such output...

cstamas Apr 16, 2024

Just to understand correctly: you want to be able to tell does transitive hull contains ranges?

sratz Apr 16, 2024
Collaborator

Yes, essentially. We'd like to know if any (plug-in) dependency contains ranges in their (transitive) dependencies' <version> specification.

Such constellations would prevent reproducible builds and be susceptible to supply-chain attacks.

laeubi · 2024-04-17T14:11:14Z

laeubi
Apr 17, 2024
Maintainer

@cstamas wrote a cool utility to check for this and it shows that Tycho 4.0.7 no longer has any "version ranged" transitive dependencies 🥇

If one could have an enforcer rule that would of course be cool to make sure it not happens again but at least for the latest release it seems we are "safe" now.

0 replies

cstamas · 2024-04-17T14:13:32Z

cstamas
Apr 17, 2024

The change will be in latest Resolver 2.x (used by Maven 4), but both are still "far" in future. Hence, there is a bit of "skunk works" and this tool will support this: https://github.com/maveniverse/toolbox

The release 0.1.6 will support this feature. To invoke it (ranges will be shown only once 0.1.6 is get released):

$ mvn eu.maveniverse.maven.plugins:toolbox:tree -DverboseTree

0 replies

MarcelRueedi · 2024-04-17T14:14:46Z

MarcelRueedi
Apr 17, 2024
Author

I've updated to tycho 4.0.7. Thanks for your efforts to make sure this won't happen again. 👏 🙏

0 replies

cstamas · 2024-04-17T14:18:21Z

cstamas
Apr 17, 2024

For (maven) plugins there is dedicated command:

[cstamas@angeleyes tycho ((tycho-4.0.7) %)]$ mvn eu.maveniverse.maven.plugins:toolbox:0.1.6-SNAPSHOT:plugin-tree -DverboseTree -DpluginKey=maven-compiler-plugin -f tycho-api
[INFO] Scanning for projects...
[INFO] 
[INFO] --------------------< org.eclipse.tycho:tycho-api >---------------------
[INFO] Building Tycho Embedder API Maven/OSGi Shared Classes 4.0.7
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- toolbox:0.1.6-SNAPSHOT:plugin-tree (default-cli) @ tycho-api ---
[INFO] org.apache.maven.plugins:maven-compiler-plugin:jar:3.13.0
[INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2 [compile]
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36 [compile]
[INFO] |  \- commons-io:commons-io:jar:2.11.0 [compile]
[INFO] +- org.apache.maven.shared:maven-shared-incremental:jar:1.1 [compile]
[INFO] +- org.codehaus.plexus:plexus-java:jar:1.2.0 [compile]
[INFO] |  +- org.ow2.asm:asm:jar:9.6 [compile]
[INFO] |  \- com.thoughtworks.qdox:qdox:jar:2.0.3 [compile]
[INFO] +- org.codehaus.plexus:plexus-compiler-api:jar:2.15.0 [compile]
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:4.0.0 [compile] (nearer exists)
[INFO] |  \- org.slf4j:slf4j-api:jar:1.7.36 [compile] (nearer exists)
[INFO] +- org.codehaus.plexus:plexus-compiler-manager:jar:2.15.0 [compile]
[INFO] |  +- org.codehaus.plexus:plexus-compiler-api:jar:2.15.0 [compile] (nearer exists)
[INFO] |  +- javax.inject:javax.inject:jar:1 [compile] (nearer exists)
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36 [compile] (nearer exists)
[INFO] |  \- org.codehaus.plexus:plexus-xml:jar:3.0.0 [compile]
[INFO] +- org.codehaus.plexus:plexus-compiler-javac:jar:2.15.0 [runtime]
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:4.0.0 [runtime] (nearer exists)
[INFO] |  +- javax.inject:javax.inject:jar:1 [runtime] (nearer exists)
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36 [runtime] (nearer exists)
[INFO] |  \- org.codehaus.plexus:plexus-compiler-api:jar:2.15.0 [runtime] (nearer exists)
[INFO] \- org.codehaus.plexus:plexus-utils:jar:4.0.0 [compile]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.274 s
[INFO] Finished at: 2024-04-17T16:17:46+02:00
[INFO] ------------------------------------------------------------------------
[cstamas@angeleyes tycho ((tycho-4.0.7) %)]$

0 replies

cstamas · 2024-04-17T15:03:17Z

cstamas
Apr 17, 2024

Toolbox 0.1.6 released, sync to Central pending:
https://github.com/maveniverse/toolbox/releases/tag/release-0.1.6

Once lands in Central, to invoke it:

$ mvn eu.maveniverse.maven.plugins:toolbox:0.1.6:help

Once this happens, no need to specify version (this is only to force Maven pull latest, if you have it locally). Once you have 0.1.6 locally, you want to run this:

$ mvn eu.maveniverse.maven.plugins:toolbox:tree -DverboseTree

And grep for "range".

9 replies

cstamas Apr 17, 2024

So, what you want would be something like this (using another param):

mvn eu.maveniverse.maven.plugins:toolbox:plugin-tree -DverboseTree -DpluginMatcher="any()"

and it would just print out all the trees of all plugins.

cstamas Apr 17, 2024

Make a PR 😉

sratz Apr 22, 2024
Collaborator

maveniverse/toolbox#23

cstamas Apr 22, 2024

0.1.7 w/ changes released just now, sync to central pending...

sratz Apr 23, 2024
Collaborator

Awesome, thanks!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tycho 4.0.1 build is broken since April 9th #3738

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 10 comments 17 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

tycho 4.0.1 build is broken since April 9th #3738

Replies: 10 comments · 17 replies

laeubi Apr 14, 2024 Maintainer

laeubi Apr 16, 2024 Maintainer

sratz Apr 16, 2024 Collaborator

laeubi Apr 16, 2024 Maintainer

sratz Apr 16, 2024 Collaborator

laeubi Apr 17, 2024 Maintainer

MarcelRueedi Apr 17, 2024 Author

sratz Apr 22, 2024 Collaborator

sratz Apr 23, 2024 Collaborator

Replies: 10 comments 17 replies

laeubi
Apr 14, 2024
Maintainer

laeubi Apr 16, 2024
Maintainer

sratz Apr 16, 2024
Collaborator

laeubi Apr 16, 2024
Maintainer

sratz Apr 16, 2024
Collaborator

laeubi
Apr 17, 2024
Maintainer

MarcelRueedi
Apr 17, 2024
Author

sratz Apr 22, 2024
Collaborator

sratz Apr 23, 2024
Collaborator