In this organization, the new orbit-simrel repository is intended to replace (as much as possible) the use of EBR for the obit repository's recipes.
maven-osgi
Every Orbit recipe that corresponds to a Maven dependency that is available from Maven central as an OSGi artifact, will be removed from the orbit repository. Projects can instead directly specify such dependencies in their target platform. The following folder of the orbit-simrel repository shows how that's properly done, including the necessary Tycho infrastructure:
As a convenience for SimRel participants, the Orbit project provides the following p2 repository with PGP-signed artifacts that is effectively the "augmented union" of all the dependencies of all SimRel participants:
Note that often the direct-from-Maven OSGi-bundle will have a different bundle symbolic name than the legacy Orbit bundled version.
maven-bnd
Each remaining Orbit recipe will gradually be replaced (as much as possible) by a dependency specified in a PDE target platform using a "maven" location along with BND instructions. Here's an example:
Final build for 2023-09 (R-build) - approximately Sep 5:
This cycle will repeat.
SimRel Recommendations
It is highly recommended to use package imports to specify the dependencies of bundles, particularly dependencies on 3rd party libraries.
It is highly recommended that you stop including (or even importing) 3rd party libraries in your features, particularly in the features that you contribute to the SimRel aggregation.
In order to continue to include such libraries in your update site:
Include them directly in the category.xml.
Define a 3rd party libraries feature, include them there, and include that in your category.xml.
Following the above recommendations will allow your contribution to be aggregated without duplication and will allow your contributed bundles to resolve their requirements to newer updated versions (within the range constraints you specify) as those versions become available. Collectively, this will help us to simplify and streamline Orbit's management of 3rd party libraries, In addition, it will make it easier to be responsive to any CVEs that might be discovered in 3rd party libraries without you needing to lift a finger!
Orbit has moved to its own GitHub organization:
In this organization, the new orbit-simrel repository is intended to replace (as much as possible) the use of EBR for the obit repository's recipes.
maven-osgi
Every Orbit recipe that corresponds to a Maven dependency that is available from Maven central as an OSGi artifact, will be removed from the orbit repository. Projects can instead directly specify such dependencies in their target platform. The following folder of the orbit-simrel repository shows how that's properly done, including the necessary Tycho infrastructure:
As a convenience for SimRel participants, the Orbit project provides the following p2 repository with PGP-signed artifacts that is effectively the "augmented union" of all the dependencies of all SimRel participants:
The dependencies here are automatically updated to the latest minor version as such versions become available.
In addition, reports are generated to help SimRel participants keep their dependencies up-to-date:
Note that often the direct-from-Maven OSGi-bundle will have a different bundle symbolic name than the legacy Orbit bundled version.
maven-bnd
Each remaining Orbit recipe will gradually be replaced (as much as possible) by a dependency specified in a PDE target platform using a "maven" location along with BND instructions. Here's an example:
https://github.com/eclipse-orbit/orbit-simrel/blob/9a03cd1aba89351daccf1d69a7e3d6f4f268bf84/maven-bnd/tp/MavenBND.target#L6-L83
The Orbit project provides the following p2 repository with jar-signed bundled artifacts:
The dependencies here too are automatically updated to the latest minor version as such versions become available.
orbit-aggregation
To provide "one-stop-shopping", the Orbit project provides a p2 repository that is an aggregation of the following
I.e., the following aggregated repository is provided:
This is the general structure of all these new p2 repositories:
Legacy Links
The existing "legacy composites are planned to be updated as follows:
This cycle will repeat.
SimRel Recommendations
Following the above recommendations will allow your contribution to be aggregated without duplication and will allow your contributed bundles to resolve their requirements to newer updated versions (within the range constraints you specify) as those versions become available. Collectively, this will help us to simplify and streamline Orbit's management of 3rd party libraries, In addition, it will make it easier to be responsive to any CVEs that might be discovered in 3rd party libraries without you needing to lift a finger!