diff --git a/wiki/Planning_Council.md b/wiki/Planning_Council.md index 07a157c..ad4e692 100644 --- a/wiki/Planning_Council.md +++ b/wiki/Planning_Council.md @@ -63,6 +63,7 @@ Telephone Dial in (for higher quality, dial a number based on your curr ### Meeting Minutes + - [2026-11-04](Planning_Council/2026-11-04.md) - [2026-10-07](Planning_Council/2026-10-07.md) - [2026-09-02](Planning_Council/2026-09-02.md) - [2026-08-05](Planning_Council/2026-08-05.md) diff --git a/wiki/Planning_Council/2026-11-04.md b/wiki/Planning_Council/2026-11-04.md new file mode 100644 index 0000000..6d0a5d8 --- /dev/null +++ b/wiki/Planning_Council/2026-11-04.md @@ -0,0 +1,57 @@ +# 2026-11-04 Meeting Notes + +## Agenda + +- Planning council chair +- Status 2026-12 +- Priority board proposal: [A Sustainable Next Generation OSGi Resolver](https://gitlab.eclipse.org/eclipse-wg/ide-wg/ide-wg-dev-funded-efforts/ide-wg-dev-funded-program-planning-council-top-issues/-/work_items/49) +- Invalid signatures of Eclipse executables on Windows + + +## Minutes + +### Planning Council Chair +- Checked whether the current chair should continue serving, from both perspectives: + - Chair: willing to continue + - Members: in favor of the chair continuing +- No objections; Heiko continues as chair for now + +### Status 2026-12 +- Shape is considered good +- SPI replacement is in place, so ASM issues are mitigated +- CVEs + - SimRel/EPP SBOMs: https://sbom.eclipse.org/projects/e1ac111b-8567-403c-8df7-950588c102e9/collectionprojects + - Orbit SBOMs: https://sbom.eclipse.org/projects/a598db3e-3857-4ef2-a8ad-c75db18cdd35/collectionprojects + - Current Platform SDK has no CVEs, SimRel has few + - CVEs for older releases grow over time + - Goal for SimRel: keep dependency versions up to date, but do not require a release to be free of (critical) CVEs on release day + +### Priority Board Proposal: A Sustainable Next Generation OSGi Resolver +- https://gitlab.eclipse.org/eclipse-wg/ide-wg/ide-wg-dev-funded-efforts/ide-wg-dev-funded-program-planning-council-top-issues/-/work_items/49 +- General agreement that improvements on the resolver would be good: different issues with existing resolver in the community +- Raised questions / concerns + - Previous implementations (Felix, p2, Equinox) were hard to get right (NP-complete problem); it is unclear how much effort a new approach would need beyond the common 90% case + - Why not improve existing resolver / Felix? Is the new approach so fundamentally different? (Incremental) improvements would be less risky than a completely new implementation +- Funding would require a commitment to fix follow-up issues over an extended period +- Follow-up + - Ed will bring it to the PMC meeting, also to get Thomas Watson's opinion + - Discuss in the next meeting again with further input (Heiko will also invite Stefan Bischof) + +### Invalid Signatures of Eclipse Executables on Windows +- Signature of Oomph installer executable was invalid after an update on Windows + - Update process takes executable from p2 repository with a broken signature (see process below) +- Default signing / branding process: + - Signed executable comes from Equinox + - Branding with icon breaks signature + - Executable is then deployed to p2 repository (with broken signature) + - Building a product signs the executable again, so a product's executable has one broken signature from Equinox and one valid signature from product build +- Resulting requirement: + - When building products with branding and shipping the artifacts to p2, signing in the build must happen early enough to have the signed artifact in the p2 repository as well + - Currently not possible with Tycho out of the box + - Sebastian will propose a PR embedding signing at the right point in the build process of Oomph to have artifact already signed for p2 deployment + - _Editorial remark_: Sebastian already improved Oomph build (https://github.com/eclipse-oomph/oomph/pull/211) and proposed an enhancement to CBI (https://github.com/eclipse-cbi/org.eclipse.cbi/pull/990) + + +## Next Meeting + +Next meeting will be on December 2nd, 2026.