Openvsx dropped some extensions

[benoitf]

Describe the bug

Eclipse Che plug-in registry is referencing some extensions that have been dropped from OpenVsx registry

example: bash-debug
it was on openvsx/ google referenced it

but today https://open-vsx.org/extension/rogalmic/bash-debug is returning 404 error

Should be related to the final date of "publishing agreement deadline of January 29, 2021"
It makes impossible to build plugin registry without cache and workspaces using these plug-ins will fail

Che version

• latest
• nightly
• other: please specify

Steps to reproduce

Expected behavior

Working VS Code extensions

[sunix]

Sounds blocker to me:

• new builds are failing
• workspaces may fail to start if devfile using one of the missing extensions

[sunix]

from what I have tested, the ones that are failing:

• https://open-vsx.org/api/castwide/solargraph/0.22.0/file/castwide.solargraph-0.22.0.vsix
• https://open-vsx.org/api/rogalmic/bash-debug/0.3.9/file/rogalmic.bash-debug-0.3.9.vsix
• https://open-vsx.org/api/gattytto/phoityne-vscode/0.0.28/file/gattytto.phoityne-vscode-0.0.28.vsix

[sunix]

To prevent the problem for the user at runtime, we could make the plugins available "offline" in the registry.
Could not be done for all plugins so we would need to have a denylist for those the license don't authorize to redistribute.

Currently the gh action build is not failing thanks to gh-action cache

[brianking]

This was just discussed on the community call. Can someone summarize the proposed solution?

[ericwill]

This was just discussed on the community call. Can someone summarize the proposed solution?

I believe the way forward is:

• Remove the problematic devfiles/plugins for now
• Find replacement links to update the plugin registry
• Enable offline builds in the plugin registry by default so that all vsix files are downloaded at build time
• Re-introduce the devfiles that were removed

[tsmaeder]

@ericwill how about we contact the authors of the plugins in question and get them to sign? Has this been explored?

Enable offline builds in the plugin registry by default so that all vsix files are downloaded at build time

We need to be aware that we're crossing a line between referencing and distributing here. Not saying it's a problem, but the licensing requirements are different.

[sunix]

@tsmaeder about contacting them.

• for the ruby plugin: Open VSX Listing: Signing the Publisher Agreement castwide/vscode-solargraph#204
• I have pinged @gattytto in mattermost but not answer: https://mattermost.eclipse.org/eclipse/pl/scxqr9p61jb1mpmnnd3cozwhie

[sunix]

@tsmaeder about offline mode: #18933 (comment)

To prevent the problem for the user at runtime, we could make the plugins available "offline" in the registry.
Could not be done for all plugins so we would need to have a denylist for those the license don't authorize to redistribute.

[ibuziuk]

@sunix @ericwill could you please cherry-pick relevants PRs for fixing bash devfile for 7.25.x ? we would like to have a fix in the 7.25.2 that is planned for tomorrow.

[ericwill]

@sunix @ericwill could you please cherry-pick relevants PRs for fixing bash devfile for 7.25.x ? we would like to have a fix in the 7.25.2 that is planned for tomorrow.

All relevant PRs have been cherry-picked.

[sunix]

I am closing this one as it looks like everything has been merged/cherry-picked