This article describes how to install Eclipse plug-ins from an update site (p2 repository) that is hosted on an HTTP(s) server with a self-signed (SSL) certificate.

The Problem

If you try and connect to a p2 repository on a server with a self-signed cert, you will more than likely hit the following error.

Looking closely at the log, and you will see:

javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
 at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:397)
 at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
 at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:397)
 at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
 at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:150)
 at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
 at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:575)
 at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
 at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
 at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)
 at org.eclipse.ecf.provider.filetransfer.httpclient4.HttpClientFileSystemBrowser.runRequest(HttpClientFileSystemBrowser.java:263)
 at org.eclipse.ecf.provider.filetransfer.browse.AbstractFileSystemBrowser$DirectoryJob.run(AbstractFileSystemBrowser.java:69)
 at org.eclipse.core.internal.jobs.Worker.run(Worker:53)

Solution

While Eclipse and p2 doesn’t offer any nice support out-of-the-box, you can easily get around this problem by installing the root certificate (or the certificate itself) into a truststore on your machine, and then use that truststore when starting Eclipse.

To install a certificate into a custom trust store, simply:

keytool -import -alias custom-ssl -file my-custom-cert.cer -keystore ~/custom.truststore

Now, when you start Eclipse, add the following arguments to your eclipse.ini file.

-Djavax.net.ssl.trustStore=<path_to_custom.truststore>
-Djavax.net.ssl.trustStorePassword=<password>

When you connect to the update site (p2 repository), the transport layer will be able to validate the self-signed certificate. If the site requires authentication you will even be prompted for a username / password:

Pro-Tip

A common question is how do you get the certificate to add to the trust store. While you could contact your system administrator and ask for the cert, it’s actually much easier than that. The certificate is public, and you can fetch it directly from your web server:

echo -n | openssl s_client -connect HOST:PORTNUMBER | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > my-custom-cert.cert

Special thanks to Gunnar Wagenknecht, David Williams and Markus Knauer for the help they gave me with this problem.

If anybody has any other suggestions for how they deal with self-signed certificates in Eclipse or Java, please feel free to leave a comment (or ping me on twitter @irbull).

Let me give you a ‘real world’ situation where I badly needed to package p2 repos.  On an RCP Project that I coached last year we switched from PDE-build to Maven Tycho. In our target definition we had a folder where we happily dropped referenced third party bundles that were needed as our project evolved. Our bundles came partly from places like Orbit or from other projects in the same company. The only way I found to tell Maven to use our little collection of dependencies was to add the p2 metadata required to upgrade the folder to a real p2 repo as this can easily be registered in the POM.

So here is what you need to do:

1.  First you need to make sure that your features and bundles are placed in the folders required by p2: ‘features’ and ‘plugins’.
2.  Then you need to execute the headless Features and Bundles Publisher Application. The exact syntax is described here: FeaturesAndBundlesPublisher.

What comes out is a new folder containing your original bundles and features plus the generated p2 metadata stored in the files ‘artifacts.xml’ and ‘content.xml’. If you choose the -compress option, the repository files will of course be ‘artifacts.jar’ and ‘content.jar’.

And … as always: Enjoy!

There are only two hard things in Computer Science: cache invalidation, naming things and off by one errors. (reference)

I appears that P2 (em, p2) suffers from both of these things, but today I’m going to focus on the first one, caching problems.  No matter what we do regarding caching repositories, it seems that we get it wrong.  Some people argue that we don’t cache aggressively enough while others think that the out-of-date caches, even for a few minutes, is not acceptable. While I don’t want to start a political argument on a Friday, I did want to provide a technical tip to help.

If you find that p2 is caching your repositories too aggressively (or it seems to have remembered a bad repository which as since been fixed), you can instruct p2 to reload the cache.  Choose Preferences -> Install / Update -> Available Software Sites.  Select the site you want to reload, and press the Reload button.

Thanks Lars for reminding me to blog about this.

For more Eclipse Tips and Tricks (and the annual Top 10 List), why not follow me on twitter:

Follow @irbull

• Eclipse Europa (2007)
• Eclipse Galileo (2009)
• Eclipse Helios (2010)
• Eclipse Indigo (2011)

Eclipse Juno will be released on June 27th and will be comprised of 72 projects.  Over the next 10 days, I’ll count down the features / tools I’m most excited about.  These are mostly tools / technologies that I use on a regular basis, so if I missed your favorite tool — I’m sorry.  Without further ado, number 10 on my Eclipse Juno Top 10 list is Proper MacOS Installs.

Eclipse has emerged as the de facto standard for building cross platform, rich-client applications — especially if you wish to provide a native experience.  SWT has provided native widgets for over 10 years and Eclipse ships with a variety of native fragments that provide tight integration into things like application launching, security and networking. However, on MacOS, Eclipse (and by extension RCP Applications) never quite fit-in.  Apple has a suggested format (disk layout) for MacOS applications, and when this format is adhered to, tight integration with Finder, Spotlight and other MacOS utilities is easily achieved.  Unfortunately, Eclipse has always shipped with its own layout, which is essentially the same  across all platforms and doesn’t align with the MacOS layout.

With Eclipse Juno, p2, and Equinox, you can now develop true MacOS applications in Java with a native feel and a proper application install (with self-update support).

Simply use the director (or product export wizard) and install to a directory ending with a .app.

If you do this with the ‘simple mail‘ example that you can generate with Eclipse PDE templates, you’ll have a powerful mail app that rivals the native MacOS mail application .

In addition to MacOS support, p2 and Equinox have released a number of notable improvements.  As part of Juno, Equinox will ship a reference implementation of the OSGi Core Release 5.  This includes a number of new APIs such as the Resource API and  VersionRange.

A big thank-you goes out to Pascal Rapicault and Brian de Alwis for the work on native Mac installs.  Tom Watson deserves the credit for leading OSGi, Equinox and the Runtime effort at Eclipse.  Thanks guys!

There are three child repositories build-01 … build-03, each with its own metadata (content.jar and artifacts.jar). The composite repository itself has a compositeContent.jar and a compositeArtifacts.jar. But how do you create those composite repositories? There’s an ant task, but If you want to add child repos manually, ant is not the tool of choice. Therefore I came up with a little shell script comp-repo.sh that does the job. Maybe it’s helpful for you, too.

Here’s how can you use this script to create a composite repository with a single child repo:

$ comp-repo.sh /path/to/repo --name "Foo Updates" add build-01

And now, let’s assume we have a new build build-05, we want to add this one and remove the old builds build-01 and build-02 from the composite repository:

$ comp-repo.sh /path/to/repo add build-05 remove build-01 remove build-02

The script needs an eclipse installation (3.6 or newer), and it reads the location of the eclipse to use from the environment variable ECLIPSE_DIR. To use the script you have to create this variable:

$ export ECLIPSE_DIR=/path/to/your/eclipse

Alternatively, you can also use the parameter --eclipse to point the script to your eclipse installation directory.

Checking the generated metadata

The composite metadata have a simple xml format, that is zipped to a .jar. You can easily check the contents of the created metadata files by:

$ zless /path/to/repo/compositeContent.jar

The contents should look like this:

<xml version='1.0' encoding='UTF-8'?>
<?compositeMetadataRepository version='1.0.0'?>
<repository name='Foo Updates' type='org.eclipse.equinox.internal.p2.metadata.repository.CompositeMetadataRepository' version='1'>
  <properties size='2'>
    <property name='p2.timestamp' value='1339153450680'/>
    <property name='p2.compressed' value='true'/>
  </properties>
  <children size='2'>
    <child location='build-01'/>
    <child location='build-02'/>
  </children>
</repository>

Performance of composite repositories

By default, a client will first try to find a p2.index file in the repository, and then proceed to look for content.jar or content.xml, before it tries compositeContent.jar. To reduce the number of requests and speed up the lookup by the client, you should add a p2.index file with these contents:

version = 1
metadata.repository.factory.order=compositeContent.xml,\!
artifact.repository.factory.order=compositeArtifacts.xml,\!

Note that it’s indeed *.xml even though the files are compressed metadata (*.jar).

Even with the p2.index in place, the client has to request the metadata of all child repositories, so adding a lot of children will increase the number of requests a client has to make. Composite repositories delegate to their children, they do not aggregate them. I’m using composite repositories for the RAP update sites and with a small number of child repos, and compared to the real contents, I think this overhead is bearable.

However, if you know a tool that aggregates (merges) p2 metadata, but still provides the option to easily add and remove child repositories, I’d like to hear about it!

For those of you who attended the talk, thank-you.  I hope you learned something.  For those of you who could not attend, I’ve attached the slides here.

Ed Merks showed how to use EMF with the Google Web Toolkit. In about a click or two, he had an EMF-based GWT application (or an GWT-based EMF application) up and running. The famous library model application was not only available locally on his demo laptop but also hosted on Google Appspot. It is still available here. Unfortunately Ed did not refresh his running browser instance during the tutorial, although many model updates had been waiting on the server…;)

Ian Bull and Pascal Rapicault presented a bunch of donts concerning p2 in a very entertaining way. I hereby promise, I will no longer unzip features and plugins directly into an Eclipse instance, I will never release with the same version twice or try to edit the p2 metadata . Also throwing in 1000+ plugins into the dropin folder seems to be a discouraged practice, at least if you would like to have a speedy Eclipse startup. Seriously, this was a very informative presentation and it showed how to avoid “trouble” with p2, which is in many cases trouble that we caused ourselves.

In his keynote David Gondek explained the mission of Watson and how it works. Today keyword search is widely used, but it comes with the disadvantage of putting the burden of selecting “good” keywords on the user. In general adding more keywords to a search will decrease the quality of the results. Among many interesting statistics, I found the statistics on the top 10 “What is …?” searches in Google particularly interesting. On the first place is the question “What is love?”. Consequently the question “What is autism?” is on the 7th place . In contrast to keyword search, Watson uses a comprehensive analysis and reasoning to answer natural language questions. For example Watson has a geographic reasoner which can relate words in terms of the geographic distance. Thereby Watson can even find answers to tricky questions in Jeopardy. The many examples in the keynote provided a lively picture of the problems building the next generation search engine.

First we’ll have a chance to meet every morning. EclipseSource is the activity sponsor again this year. What does this mean? This means that the first 50 people will get a cool running shirt and everyone will get the opportunity to meet Eclipse committers away from the conference stress. After the jogging you won’t have to wait long to hear from us again.

The first event is on Tuesday at 2:00 pm. You can meet Ian Bull and listen to him speaking about growing an open source project. He will show you how easy it is to get in touch with your favorite open source project by contributing to it.  He will demo how to overcome the major hurdles to becoming a first class contributor.

If you can’t get enough of Ian you will have a second chance to listen to him after a short break. On Tuesday at 4:00 pm he will show you everything you need to know about p2 together with Kim Moir and Pascal Rapicault. They will show you how to get around the biggest pain points in p2 and pointers for best practices.

If p2 is not your favorite topic and you want to go deep into some hardcore stuff, then I recommend attending Johannes Eickhold’s talk. It’s in the same slot as the p2 talk and is entitled, “Sovereign: Migrating Java Threads to Improve Availability of Web Applications“.  Johannes will describe two technical strategies on how to improve availability in RAP, a very interesting problem with big implications for RAP.

Because EclipseCon is full of good talks, you don’t have to wait long for the next one. Take a look ahead at RAP together with Ralf Sternberg at 4:30 pm. He will take you on a tour inside our plans with RAP and show some really cool demos. This talk also marks the end of this packed Tuesday for us.

But luckily the Wednesday is not far away.  Meet Ian again at 5:30 pm . He will show you some really cool demos on the hot new products showcase reception. This is a great opportunity to go into detail together with Ian.

After meeting Ian again you can take a break from us. But, only until 7:30 pm. Ralf will moderate the RAP BoF and right after this you can join me on the RTP BoF.  The BoFs will give us a full hour to propose ideas and discuss concepts or internals. So, don’t miss them.

Because RTP is a hot new Eclipse Project , in addition to the BoF, you will also have the chance to attend a presentation by me on Thursday 2:30 pm.  As you might already know,  we created the RTP project to enable more developers to use EclipseRT. In my talk,  “Eclipse Runtimes out of the Box“, you can hearing everything there is to know about RTP in 20 minutes.

In addition to this schedule there is more. Of course, you will find all of us at the Hyatt every evening .  I’m really looking forward to meeting you there…

First of all, we made it to the creation review. The review is scheduled for January 12-19. The community gathering period was very successful. We reached 10 interested parties and 7 initial committers from three different companies. In this article, I’d like to focus on one very cool thing. It’s the effort made by SAP.

As you might have seen in the last months, SAP is involved in more than the half of the new Eclipse projects. Probably the main reason behind this is that SAP submitted the most project proposals . But reading about it and getting in touch with the guys behind this company are two different things as we learned in the RTP project. So, let’s review the SAP + RTP story:

In December a colleague of mine, Florian Waibel, made his way through closed airports and meters of snow to South Hampton, UK to have a face-to-face meeting with the Virgo guys. During this meeting he also talked about RTP and gained some interest from some of the people there. Back home he told me about SAP getting heavily involved in Virgo and also about their interest in RTP. Because we are an open Eclipse project we got in touch with a friendly SAP project manager (thanks Krassi) and had discussions about the RTP project and how an internal development project from SAP could fit into RTP. Well, the result was that SAP was so interested that we extended the scope of the project together and will now receive an initial contribution from SAP called the “p2 installer”. Of course, Eclipse is not a software dumping area. That’s why they will provide a maintainer for this contribution who will also be an initial committer.  Welcome Georgi Stanev .

The “p2 installer” is basically a command line interface for the official p2 installer to manage remote Eclipse runtime installations. The purpose of this tool was to enable automated scripts to install Eclipse runtime to remote systems. The cool thing about it is the ability to define the units that should be installed in a property file declaratively. Yesterday we had a short demo of the installer and I have to say that it looks very exciting.

To put it all in a nutshell it’s really good to see SAP working actively in and with the open source community. They are not shy about donating things and providing guidance. It’s very nice to see a really big player supporting open source in positive ways.

Marcus Baker wrote an article called “Install Me“, which was published in the book “97 things a programmer should know“. On two pages he shows the reader exactly how important the first minutes are when a new user tries to get familiar with your software. He argues that it is the responsibility of  the software developer, to make it as easy as possible for the user to see that your software is what he needs.

Currently we don’t do a good job with this at EclipseRT. There are several EclipseRT technologies out there and every one provides an individual starting point for new users. From my point of view, changing this would bring EclipseRT a big step further.

That’s the inspiration behind the RTP project.  All that a user should have to do is download – install – run. The idea is to create one or more common starting points that new users can use to get familiar with EclipseRT technology.  Once we have the installation accomplished, we’ll have to convince the user with good examples and documentation. Investigation shouldn’t take more than 5 minutes. If the user doesn’t see what he needs in his first five minutes, the software will not get a second chance. There is also the chance of course, that the annoyed user might spread the word that the software doesn’t do the job right.  So, its definitely worthwhile to invest in keeping new users happy.

And this is what RTP is all about:  working with as many EclipseRT projects as possible to provide a really good out-of-the box experience for new users. If you are interested in this project please let me know. We welcome all help towards succeeding with RTP. If you want to learn more about RTP there are also two EclipseCon 2011 submissions (submission 1, submission 2) you can read.