-
Notifications
You must be signed in to change notification settings - Fork 11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Snakeyml is unsigned in the latest cdt-lsp repo (rc1) #332
Comments
@ghentschke I will try to resolve this before release as I don't think we can release like this. If you happen to know what may have caused this, do let me know. |
The problem turned out to be rather straightforward - I never turned on the gpg signing of the p2 repo. PR about to be merged. |
Applies signing fix for missing gpg signature See eclipse-cdt/cdt-lsp#332
The reason I didn't notice before is that it depends on where p2 decides to pull bundles from which can depend on which available sites are listed. The snakeyaml in the cdt-lsp repo was never signed, but it was often pulled from CDT's repo coincidentally (where it was always signed) |
Applies signing fix for missing gpg signature See eclipse-cdt/cdt-lsp#332
I don't know yet why it regressed, but the rc1 build of CDT-LSP 2.0.0 (https://download.eclipse.org/tools/cdt/builds/cdt-lsp-2.0/cdt-lsp-2.0.0-rc1/) has unsigned content.
There is a secondary problem that the source bundle of snakeyml is being installed
Here is the trust dialog when just using cdt-lsp:
This wasn't a problem in m2 https://download.eclipse.org/tools/cdt/builds/cdt-lsp-2.0/cdt-lsp-2.0.0-m2/ so I don't know what changed yet between these versions.
I don't think this shows up in simrel because the source bundle is resigned in simrel, and the main bundle comes from CDT instead which is signed already.
Here is the trust dialog when using staging
fyi @merks
The text was updated successfully, but these errors were encountered: