Eliminate 3rd party includes from features

[merks]

Including third party bundles is not permitted for SimRel projects:

https://eclipse.dev/simrel/?file=wiki/SimRel/Simultaneous_Release_Requirements.md#do-not-include-non-project-content-in-features

There is a new generated report that lists violations:

https://eclipse.dev/simrel/?file=report/third-party-include-report.md

We collectively need to eliminate these to ensure that we can respond to CVEs quickly and easily in the future without projects needing to repin their content. Fortunately the list is quite short.

For the Platform, this activities removed the remaining problems:

eclipse-platform/eclipse.platform.releng.aggregator#3585

These are pending someone pushing the green button:

• Remove 3rd party includes from features. eclipse-cdo/cdo#155
• Move all 3rd party includes to o.e.rap.tools.dependencies.feature eclipse-rap/org.eclipse.rap.tools#130

[ewillink]

I attempted to respond to earlier guidance but seemingly not adequately. Perhaps clarification of my misunderstandings may help others.

I extracted lpg.runtime.java to the org.eclipse.ocl.tools feature as recommended. But to keep things working I included the new feature in org.eclipse.ocl.all.sdk. I guess this means that it is still transitively in simrel.

Presumably I should remoive the transitive feature include and replace
Require-Bundle: lpg.runtime.java;bundle-version="[2.0.17,3.0.0)";visibility:=reexport
by
Import-Package: lpg.runtime;version="[2.0.17,3.0.0)"
so that the installer looks for lpg.runtime somewhere.

For SimRel I should add to ocl.aggrcon
<features name="org.eclipse.ocl.tools.feature.group" versionRange="[3.23.0,3.24.0)"/>
omitting a category so that it goes in the uncategorized communal bin from which the best solution can be resolved for the package import,.

For ZIP-based install, the user must make sure to select the org.eclipse.ocl.tools feature. To support the traditional install-the-SDK-to -get-a-complete-install a new spelling of the SDK feature must be invented for this new feature that is not transitively visible to SimRel.

[merks]

@ewillink

As long as this feature is aggregated and that feature includes the bundle, the problem will persist.

Remove this feature from any other feature that is directly or transitively contributed to SimRel;

https://github.com/eclipse-ocl/org.eclipse.ocl/blob/master/features/org.eclipse.ocl.tools-feature/feature.xml

The site already mentions the feature directly:

https://github.com/eclipse-ocl/org.eclipse.ocl/blob/94bd7a53f1c74ddbf731fbea3a5c65e6542a0aa9/releng/org.eclipse.ocl.releng.build-site/category.xml#L59-L61

So I think it's sufficient not to use that tools feature anywhere.

I'm not sure why you believe you need to include that bundle in any feature. What is a "zip-based install"? A zip of an update site? In that case, as long as your update site includes that bundle, anyone installing whatever bundle that requires this lpg runtime will necessarily also install the lpg runtime as well feature not being of relevance.

---

My sense is that you are over-complicating the problem with concerns that are based purely on assumptions.

Perhaps open an issue in OCL and we can discussion the OCL-specific concern that you have in that issue.

At this point I think you just need to remove this feature include and then you're doing.

https://github.com/eclipse-ocl/org.eclipse.ocl/blob/94bd7a53f1c74ddbf731fbea3a5c65e6542a0aa9/features/org.eclipse.ocl-feature/feature.xml#L38-L40

[merks]

Making progress. OCL and Passage are off the list now. 🥳

[merks]

More progress. RAP is off the list.

[merks]

More progress. CDO is off the list. But ECF was missing from the list, so that's added.