tycho 4.0.1 build is broken since April 9th

[MarcelRueedi]

Hi,

we run a tycho 4.0.1 to build a eclipse rcp application. Since monday 9th of April the build fails with the error :
java.lang.IllegalStateException: bundle org.eclipse.equinox.p2.repository is not started

. The cause seams to be :

[ERROR] [362f2f9b-e6e2-44eb-ad2b-65804f3d6797][extension>org.eclipse.tycho:tycho-maven-plugin:4.0.1] FrameworkEvent ERROR
org.osgi.framework.BundleException: Could not resolve module: org.eclipse.equinox.p2.repository.tools [26]
  Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.artifact.processors.checksum
    -> Export-Package: org.eclipse.equinox.internal.p2.artifact.processors.checksum; bundle-symbolic-name="org.eclipse.equinox.p2.artifact.repository"; bundle-version="1.5.0.v20230509-1332"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.publisher"
       org.eclipse.equinox.p2.artifact.repository [5]
         Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.persistence
           -> Export-Package: org.eclipse.equinox.internal.p2.persistence; bundle-symbolic-name="org.eclipse.equinox.p2.repository"; bundle-version="2.7.0.v20230507-1427"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.artifact.repository,  org.eclipse.equinox.p2.engine,  org.eclipse.equinox.p2.metadata.repository,  org.eclipse.equinox.p2.ui,  org.eclipse.equinox.p2.ui.importexport,  org.eclipse.equinox.p2.repository.tools"
              org.eclipse.equinox.p2.repository [12]
                Unresolved requirement: Import-Package: org.bouncycastle.bcpg; version="1.72.0"
         Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.repository
           -> Export-Package: org.eclipse.equinox.internal.p2.repository; bundle-symbolic-name="org.eclipse.equinox.p2.repository"; bundle-version="2.7.0.v20230507-1427"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.artifact.repository,  org.eclipse.equinox.p2.metadata.repository,  org.eclipse.equinox.p2.updatesite,  org.eclipse.equinox.p2.repository.tools,  org.eclipse.equinox.p2.transport.ecf,  org.eclipse.equinox.p2.engine,  org.eclipse.equinox.p2.discovery.compatibility,  org.eclipse.equinox.p2.publisher,  org.eclipse.equinox.p2.ui.sdk"
  Unresolved requirement: Import-Package: org.eclipse.equinox.internal.p2.artifact.repository
    -> Export-Package: org.eclipse.equinox.internal.p2.artifact.repository; bundle-symbolic-name="org.eclipse.equinox.p2.artifact.repository"; bundle-version="1.5.0.v20230509-1332"; version="0.0.0"; x-friends:="org.eclipse.equinox.p2.publisher,  org.eclipse.equinox.p2.reconciler.dropins,  org.eclipse.equinox.p2.ui,  org.eclipse.equinox.p2.directorywatcher,  org.eclipse.equinox.p2.repository.tools,  org.eclipse.equinox.p2.publisher.eclipse"

How can this happen ?

[Kummallinen]

I noticed 4.0.2 also broke with a slightly different error on the 6th (from my projects build logs). 4.0.6 still works but I've not checked any versions between them.

I'm guessing the cause is one of Tycho's dependencies, probably an indirect one, updating in maven central. Not all the dependencies in the dependency tree have specific versions set so incompatible versions published in maven central may still be picked up and used.

[ingomohr]

We have the same problem with all our Eclipse feature/product projects that use Tycho 4.0.1 and 4.0.2. Since we couldn't find what the root cause was (yet), we are working around this by migrating to a newer tycho version.
However, that actually feels like a workaround because whatever broke for 4.0.1/4.0.2 can - in theory - break later Tycho versions, as well. That's why I very much would like to learn what caused this.

Thanks in advance for any information on the topic. :)

[Kummallinen]

I can't see any new version that matches the date it broke.

However tycho-core does not seem to fix the version of org.eclipse.core.runtime, whereas p2-maven-plugin does restrict org.eclipse.equinox.p2.repository.tools which shares dependencies with org.eclipse.core.runtime.

[laeubi]

In general one should update to the latest release whenever possible it should always include any latest dependencies avaiable. Beside that the dependencies should usually be "fixed" is there an example that shows the problem for investigation.

[Kummallinen]

@laeubi as far as I can tell at least Tycho 4.0.1 & 4.0.2 will fail if the build includes a repository project, so any of the repository projects from the test suite should show the error.

4.0.1 will fail with the error in the initial post, 4.0.2 fails with a different error related to the same "org.eclipse.equinox.p2.repository" bundle not being started. Guessing that the latest org.eclipse.core.runtime version is incompatible with the org.eclipse.equinox.p2.repository version used by older Tycho versions.

[laeubi]

@sratz you can do dependency:tree on the Tycho project also maybe the maven enforcer plugin can be used to enforce not using version ranges?

[sratz]

I looked into dependency:tree, but this only outputs the already-resolved-to-fixed-version dependencies :(

Even Maven's internal debug output with -X only shows the resolved dependency version, never the range it choses from, if so.

[laeubi]

maybe @cstamas know a secret from the maven-resolver how to enable such output...

[cstamas]

Just to understand correctly: you want to be able to tell does transitive hull contains ranges?

[sratz]

Yes, essentially. We'd like to know if any (plug-in) dependency contains ranges in their (transitive) dependencies' <version> specification.

Such constellations would prevent reproducible builds and be susceptible to supply-chain attacks.

[laeubi]

@cstamas wrote a cool utility to check for this and it shows that Tycho 4.0.7 no longer has any "version ranged" transitive dependencies 🥇

If one could have an enforcer rule that would of course be cool to make sure it not happens again but at least for the latest release it seems we are "safe" now.

[cstamas]

The change will be in latest Resolver 2.x (used by Maven 4), but both are still "far" in future. Hence, there is a bit of "skunk works" and this tool will support this: https://github.com/maveniverse/toolbox

The release 0.1.6 will support this feature. To invoke it (ranges will be shown only once 0.1.6 is get released):

$ mvn eu.maveniverse.maven.plugins:toolbox:tree -DverboseTree

[MarcelRueedi]

I've updated to tycho 4.0.7. Thanks for your efforts to make sure this won't happen again. 👏 🙏

[cstamas]

For (maven) plugins there is dedicated command:

[cstamas@angeleyes tycho ((tycho-4.0.7) %)]$ mvn eu.maveniverse.maven.plugins:toolbox:0.1.6-SNAPSHOT:plugin-tree -DverboseTree -DpluginKey=maven-compiler-plugin -f tycho-api
[INFO] Scanning for projects...
[INFO] 
[INFO] --------------------< org.eclipse.tycho:tycho-api >---------------------
[INFO] Building Tycho Embedder API Maven/OSGi Shared Classes 4.0.7
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- toolbox:0.1.6-SNAPSHOT:plugin-tree (default-cli) @ tycho-api ---
[INFO] org.apache.maven.plugins:maven-compiler-plugin:jar:3.13.0
[INFO] +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2 [compile]
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36 [compile]
[INFO] |  \- commons-io:commons-io:jar:2.11.0 [compile]
[INFO] +- org.apache.maven.shared:maven-shared-incremental:jar:1.1 [compile]
[INFO] +- org.codehaus.plexus:plexus-java:jar:1.2.0 [compile]
[INFO] |  +- org.ow2.asm:asm:jar:9.6 [compile]
[INFO] |  \- com.thoughtworks.qdox:qdox:jar:2.0.3 [compile]
[INFO] +- org.codehaus.plexus:plexus-compiler-api:jar:2.15.0 [compile]
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:4.0.0 [compile] (nearer exists)
[INFO] |  \- org.slf4j:slf4j-api:jar:1.7.36 [compile] (nearer exists)
[INFO] +- org.codehaus.plexus:plexus-compiler-manager:jar:2.15.0 [compile]
[INFO] |  +- org.codehaus.plexus:plexus-compiler-api:jar:2.15.0 [compile] (nearer exists)
[INFO] |  +- javax.inject:javax.inject:jar:1 [compile] (nearer exists)
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36 [compile] (nearer exists)
[INFO] |  \- org.codehaus.plexus:plexus-xml:jar:3.0.0 [compile]
[INFO] +- org.codehaus.plexus:plexus-compiler-javac:jar:2.15.0 [runtime]
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:4.0.0 [runtime] (nearer exists)
[INFO] |  +- javax.inject:javax.inject:jar:1 [runtime] (nearer exists)
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.36 [runtime] (nearer exists)
[INFO] |  \- org.codehaus.plexus:plexus-compiler-api:jar:2.15.0 [runtime] (nearer exists)
[INFO] \- org.codehaus.plexus:plexus-utils:jar:4.0.0 [compile]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.274 s
[INFO] Finished at: 2024-04-17T16:17:46+02:00
[INFO] ------------------------------------------------------------------------
[cstamas@angeleyes tycho ((tycho-4.0.7) %)]$ 

[cstamas]

Toolbox 0.1.6 released, sync to Central pending:
https://github.com/maveniverse/toolbox/releases/tag/release-0.1.6

Once lands in Central, to invoke it:

$ mvn eu.maveniverse.maven.plugins:toolbox:0.1.6:help

Once this happens, no need to specify version (this is only to force Maven pull latest, if you have it locally). Once you have 0.1.6 locally, you want to run this:

$ mvn eu.maveniverse.maven.plugins:toolbox:tree -DverboseTree

And grep for "range".

[cstamas]

So, what you want would be something like this (using another param):

mvn eu.maveniverse.maven.plugins:toolbox:plugin-tree -DverboseTree -DpluginMatcher="any()"

and it would just print out all the trees of all plugins.

[cstamas]

Make a PR 😉

[sratz]

maveniverse/toolbox#23

[cstamas]

0.1.7 w/ changes released just now, sync to central pending...

[sratz]

Awesome, thanks!