Availability of Maven Artifacts

[ebresie]

What is the status on the availability of maven artifacts for org.eclipse.tm4e related artifacts?

On the tm4e page there is indication that info on Maven is to be coming.

Looking at a number of the maven repos, I see a number of slightly dated versions (latest seems to be Feb/Mar 2021).

https://search.maven.org/search?q=org.eclipse.tm4e.core
https://mvnrepository.com/search?q=org.eclipse.tm4e.core

Is there an alternative maven repository for Eclipse dependencies?

[mickaelistria]

At the moment, TM4E artifacts are not pushed to any Maven repo. Is org.eclipse.tm4e.core the only one you need?

[ebresie]

When running org.owasp:dependency-check-maven:7.1.1:check (default) on my project, I received the following:

One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '8.0':

flexmark-ext-xwiki-macros-0.64.0.jar: CVE-2022-29161(9.8), CVE-2020-15252(8.8)
org.eclipse.tm4e.core-0.4.1-pack1.jar: CVE-2020-11987(8.2)

Not sure if this some kind of "false positive".

Should I leverage some alternative form of this artifact in my maven project dependencies ( https://mvnrepository.com/search?q=org.eclipse.tm4e.core or https://search.maven.org/search?q=org.eclipse.tm4e.core )?

[mickaelistria]

I don't know about the CVE, it wasn't reported to this project.

[ebresie]

Should I raise an issue for this?

[ebresie]

The CVE is here
https://nvd.nist.gov/vuln/detail/cve-2020-11987

Which seems related to Apache Batik and/or POI
https://lists.apache.org/thread/nclwkkrx2lmzdwocqomxob8q3boyc6mc and https://lists.apache.org/thread/nw1myvx0xy70n5mtknmtcc2qv23r048n

[laeubi]

@ebresie I'm currently working on some prototypes to improve and ease the deployment of Tycho build artifacts to maven repositories.
If this is crucial to your business and likes to speed up the development in that area a sponsoring would allow me to assign more time-slots particular issue. Of course you can also contact me directly if you like to fund dedicated development tasks.

[GliczDev]

Hi, any updates on that?

[sebthom]

No one is working on this. PRs are welcome.

[GliczDev]

What exactly needs to be done to publish tm4e to a maven repo? Running mvn install to publish it to maven local works fine.

[sebthom]

I actually have no idea. I haven't done this before neither for Eclipse plugins nor inside the Eclipse org. @mickaelistria do you have any hints?

[mickaelistria]

I think the following steps would be necessary

• Ask for creation of a TM4E maven repo on repo.eclipse.org and configuration of necessary credentials
• add the deployment blocks to pom.xml allowing to push to this repo from ci
• Change the Jenkinsfile so it calls mvn deploy

[GliczDev]

The second and the third step can be done in a PR, but what about the first one? Are you willing to do it or should I somehow contact Eclipse about that?

[mickaelistria]

Please openn a ticket to https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues to request creation of a dedicated space under repo.eclipse.org. A project lead will approve it and the Eclipse Foundation IT people will then create it.

[GliczDev]

Since TM4E dedicated space is now created on repo.eclipse.org, what should be done now?

[GliczDev]

Hi, any news? I'm working on a code editor component for Swing with TextMate support, and artifacts on the official repo would be useful.

[ebresie]

Maybe this may help: https://github.com/eclipse-cbi/cbi/wiki/Nexus

[sebthom]

Maven snapshot builds are here now https://repo.eclipse.org/content/repositories/tm4e-snapshots/org/eclipse/org.eclipse.tm4e.core/

I have no idea yet how to do this for release builds.