Goal `publish-features-and-bundles` inherits metadata available in reactor

[mdaloia]

The goal publish-features-and-bundles reuses the metadata available in the reactor when source and destination repository are the same location and append is used, even if you, before calling this goal, delete the artifacts.* and content.* files in repository. If you do a modification that changes some metadata it keeps the old value.

This seems to be working as the Eclipse standalone application for 4.31 using the append with the same destination as the source. The difference is that it keeps old metadata only if you DON'T delete the artifacts.* and content.* files before calling it.

Previously, in Tycho 2.7.5, this goal recreated the metadata only with the size and checksums properties.

In Tycho 4.0.7, it seems that the metadata information present somewhere in the reactor context is being "leaked" to the new metadata.

Example:

1. Mirror some IUs from a repository
2. (Re)sign (or modify) some IUs .jar
3. Delete artifacts.* and content.* files
4. Enforce file don't exists
5. Execute publish-features-and-bundles goal

If you run those steps as part of the same Maven execution the issue surfaces. If 1,2,3 and 4 are run in one Maven execution and 5 in another (could be implemented via Maven profiles) then we get an output like 2.7.5.

Example pom.xml

Changing just the `tycho.version` property to `2.7.5` it works. ```xml 4.0.0 com.martindaloia.reports.tycho-issue-publish-features-and-bundles parent 1.0.0-SNAPSHOT pom Tycho Issue publish-features-and-bundles 4.0.7 ${project.build.directory}/repository ${project.build.directory}/repository ${repo.source}/plugins/com.google.guava.failureaccess_1.0.2.jar true true org.eclipse.tycho tycho-maven-plugin ${tycho.version} true org.eclipse.tycho.extras tycho-p2-extras-plugin ${tycho.version} mirror-plugin compile mirror https://download.eclipse.org/releases/2024-03/202403131000/ p2 ${repo.source} com.google.guava.failureaccess 1.0.2 create-p2-metadata prepare-package publish-features-and-bundles ${repo.source} ${repo.destination} ${repo.destination} true false org.apache.maven.plugins maven-antrun-plugin 3.1.0 touch-jar generate-test-resources run simulate change remove-incomplete-metadata test run org.apache.maven.plugins maven-enforcer-plugin 3.4.1 enforce-dont-exist test enforce ${repo.destination}/artifacts.jar ${repo.destination}/artifacts.xml ${repo.destination}/artifacts.xml.xz ${repo.destination}/content.jar ${repo.destination}/content.xml ${repo.destination}/content.xml.xz true ```

Example run

### Run the build  ### Compare the SHA-256 

[laeubi]

Can you provide an integration-test to demonstrate the issue from your example with proper assertions? Then it is easy to verify it worked (differently) in 2.7.x and we can make sure if there is a fix that it does not break in the future again.

[laeubi]

By the way is there a reason you are not using fix-artifacts-metadata instead of this quite complicated steps?

[mdaloia]

Can you provide an integration-test to demonstrate the issue from your example with proper assertions?

Sure, I will try to add an IT later.

By the way is there a reason you are not using fix-artifacts-metadata instead of this quite complicated steps?

We tried to use that goal, but we are impacted by this other issue https://github.com/eclipse-tycho/tycho/issues/2875 because we are using an standalone director which uses and old p2 director and it compares the MD5 and as we need to re-sign some .jar files it fails. Why we are using the standalone instead of the internal? because we have custom touchpoints and using the internal director fails when a product is being materialized as it seems it doesn't found it.