From 777b3f3bec95a24adbe15541e330210220ce3ddb Mon Sep 17 00:00:00 2001 From: Ed Merks Date: Thu, 30 Jul 2026 15:56:24 +0200 Subject: [PATCH] Back to staging - Use https://download.eclipse.org/staging/2026-09/ - Prepare versions for M3. - Update CHANGELOG.md with updated details about Java 25 support. - Update SECURITY.md with reference to baseline. Part of https://github.com/eclipse-packaging/packages/issues/456 --- CHANGELOG.md | 3 +- RELEASING.md | 10 ++-- SECURITY.md | 50 +------------------ .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../epp.website.xml | 2 +- .../eclipse/epp/releng/updater/Updater.java | 2 +- releng/org.eclipse.epp.config/parent/pom.xml | 6 +-- .../tools/upload-to-staging.sh | 4 +- 16 files changed, 25 insertions(+), 70 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d8d1bdc9e..3cd344a78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,8 @@ The [Eclipse IDE New & Noteworthy](https://eclipseide.org/release/noteworthy/) p ## 2026-09 - Eclipse IDE now ships with Java 25 by default and the individual downloads now require Java 25. -- Current there is no Temurin JDK for Windows aarch64 so those packages have no embedded JRE, see [https://github.com/adoptium/aqa-tests/issues/6623](https://github.com/adoptium/aqa-tests/issues/6623). +- Currently there is no Temurin JDK for Windows aarch64, see [https://github.com/adoptium/aqa-tests/issues/6623](https://github.com/adoptium/aqa-tests/issues/6623); + a [Microsoft Open JDK](https://learn.microsoft.com/en-us/java/openjdk/download) is used for this case. ## 2025-09 diff --git a/RELEASING.md b/RELEASING.md index 76a29e207..84c4a926b 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -3,7 +3,7 @@ This guide contains the step-by-step process to complete an EPP release and assumes that you have an IDE provisioned using the [Oomph setup]( https://github.com/eclipse-packaging/packages/blob/master/CONTRIBUTING.md#create-an-eclipse-development-environment). -**Before** copying this file to create a new issue titled `EPP 2026-09 M2` with label `endgame`, update the names and versions, including those in this document. +**Before** copying this file to create a new issue titled `EPP 2026-09 M3` with label `endgame`, update the names and versions, including those in this document. - [ ] To update names and versions, edit [org.eclipse.epp.releng.updater.Updater]( releng/org.eclipse.epp.config/org.eclipse.epp.releng.updater/src/org/eclipse/epp/releng/updater/Updater.java ) to set the values of `MILESTONE`, `PLATFORM_VERSION`, and possibly `EXECUTION_ENVIRONMENT` to the current appropriate values. @@ -112,9 +112,9 @@ Scroll down for the per-milestone/RC steps. - [ ] Use the `External Tools` toolbar button drop-down menu to launch the `Prepare Staging Sanity Check` launch configuration. This will automatically download the packages specified in the launch configuration to subfolders in `/org.eclipse.epp.packages/sanity-check` to make the follow steps easier. - [ ] Download a package from the build's [staging output](https://download.eclipse.org/technology/epp/staging/). - - [ ] Make sure filenames contain expected build name and milestone, e.g., `2026-09-M2`. + - [ ] Make sure filenames contain expected build name and milestone, e.g., `2026-09-M3`. - [ ] Splash screen says the expected release name with no milestone, e.g., `2026-09`. - - [ ] `Help -> About` says the expected build name and milestone, e.g., `2026-09-M2`. + - [ ] `Help -> About` says the expected build name and milestone, e.g., `2026-09-M3`. - [ ] From the `Console`, open the `Host OSGi console` and use `ss -s INSTALLED` to verify that there are no bundles failing to resolve. - [ ] The `org.eclipse.epp.package.*` features and bundles have the timestamp of the forced qualifier update or later. - [ ] Upgrade from previous release works. @@ -132,7 +132,7 @@ Scroll down for the per-milestone/RC steps. (especially justj, update [remove-justj-from-p2.xml](https://github.com/eclipse-packaging/packages/blob/master/releng/org.eclipse.epp.config/tools/remove-justj-from-p2.xml) if needed). - [ ] Edit the [Jenkins build](https://ci.eclipse.org/packaging/job/epp/job/master/lastBuild/). - [ ] Mark build as Keep forever. - - [ ] Edit Jenkins Build Information and name it, e.g., `2026-09 M2`. + - [ ] Edit Jenkins Build Information and name it, e.g., `2026-09 M3`. - [ ] Run the [Promote a Build]( https://ci.eclipse.org/packaging/job/promote-a-build/ ) CI job to prepare build artifacts and copy them to download.eclipse.org. @@ -166,7 +166,7 @@ This applies to all releases, i.e. M1, M2, M3, RC1 and R. Everything except R is typically the Friday around 9:30am Ottawa time and the R is the following Wednesday sometime before 10am in coordination with the SimRel release engineer. - [ ] Check that this worked: - copy the composite\*M2.jar files over the composite\*.jar files in https://download.eclipse.org/technology/epp/packages/2026-09/ - + copy the composite\*M3.jar files over the composite\*.jar files in https://download.eclipse.org/technology/epp/packages/2026-09/ - this is done automatically with the [EPP Make Visible job](https://ci.eclipse.org/packaging/job/epp-makeVisible/) which is automatically triggered by SimRel's diff --git a/SECURITY.md b/SECURITY.md index 4200f14b2..17314fc44 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,49 +1,3 @@ - -_ISO 27005 defines vulnerability as: - "A weakness of an asset or group of assets that can be exploited by one or more threats."_ +# Security -## The Eclipse Security Team - -The Eclipse Security Team provides help and advice to Eclipse projects -on vulnerability issues and is the first point of contact -for handling security vulnerabilities. -Members of the Security Team are committers on Eclipse Projects -and members of the Eclipse Architecture Council. - -Contact the [Eclipse Security Team](mailto:security@eclipse.org). - -**Note that, as a matter of policy, the security team does not open attachments.** - -## Reporting a Security Vulnerability - -Vulnerabilities can be reported either via email to the Eclipse Security Team -or directly with a project via the Eclipse Foundation's Bugzilla instance. - -The general security mailing list address is security@eclipse.org. -Members of the Eclipse Security Team will receive messages sent to this address. -This address should be used only for reporting undisclosed vulnerabilities; -regular issue reports and questions unrelated to vulnerabilities in Eclipse software -will be ignored. -Note that this email address is not encrypted. - -The community is also encouraged to report vulnerabilities using the -[Eclipse Foundation's Bugzilla instance](https://bugs.eclipse.org/bugs/enter_bug.cgi?product=Community&component=Vulnerability%20Reports&keywords=security&groups=Security_Advisories). -Note that you will require an Eclipse Foundation account to create an issue report, -but by doing so you will be able to participate directly in the resolution of the issue. - -Issue reports related to vulnerabilities must be marked as "committers-only", -either automatically by clicking the provided link, by the reporter, -or by a committer during the triage process. -Note that issues marked "committers-only" are visible to all Eclipse committers. -By default, a "committers-only" issue is also accessible to the reporter -and individuals explicitly indicated in the "cc" list. - -## Disclosure - -Disclosure is initially limited to the reporter and all Eclipse Committers, -but is expanded to include other individuals, and the general public. -The timing and manner of disclosure is governed by the -[Eclipse Security Policy](https://www.eclipse.org/security/policy.php). - -Publicly disclosed issues are listed on the -[Disclosed Vulnerabilities Page](https://www.eclipse.org/security/known.php). +The Eclipse Packaging Project follows the [Eclipse Foundation Baseline Security Policy](https://www.eclipse.org/security/baseline/). diff --git a/packages/org.eclipse.epp.package.committers.feature/epp.website.xml b/packages/org.eclipse.epp.package.committers.feature/epp.website.xml index bf200b233..ab9f6692d 100644 --- a/packages/org.eclipse.epp.package.committers.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.committers.feature/epp.website.xml @@ -34,6 +34,6 @@ Click here to open a b - + diff --git a/packages/org.eclipse.epp.package.cpp.feature/epp.website.xml b/packages/org.eclipse.epp.package.cpp.feature/epp.website.xml index 1b4ae7c45..0d78961e7 100644 --- a/packages/org.eclipse.epp.package.cpp.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.cpp.feature/epp.website.xml @@ -22,6 +22,6 @@ - + diff --git a/packages/org.eclipse.epp.package.dsl.feature/epp.website.xml b/packages/org.eclipse.epp.package.dsl.feature/epp.website.xml index 7ca7553ea..82a2f6636 100644 --- a/packages/org.eclipse.epp.package.dsl.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.dsl.feature/epp.website.xml @@ -27,6 +27,6 @@ - + diff --git a/packages/org.eclipse.epp.package.embedcpp.feature/epp.website.xml b/packages/org.eclipse.epp.package.embedcpp.feature/epp.website.xml index 44f5d2b60..00273c034 100644 --- a/packages/org.eclipse.epp.package.embedcpp.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.embedcpp.feature/epp.website.xml @@ -29,6 +29,6 @@ To avoid compatibility issues with pre 6.x plug-ins, it is recommended to cre - + diff --git a/packages/org.eclipse.epp.package.java.feature/epp.website.xml b/packages/org.eclipse.epp.package.java.feature/epp.website.xml index ac3365d27..854d10322 100644 --- a/packages/org.eclipse.epp.package.java.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.java.feature/epp.website.xml @@ -28,6 +28,6 @@ - + diff --git a/packages/org.eclipse.epp.package.jee.feature/epp.website.xml b/packages/org.eclipse.epp.package.jee.feature/epp.website.xml index 95454a14b..262166414 100644 --- a/packages/org.eclipse.epp.package.jee.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.jee.feature/epp.website.xml @@ -34,6 +34,6 @@ Click + diff --git a/packages/org.eclipse.epp.package.modeling.feature/epp.website.xml b/packages/org.eclipse.epp.package.modeling.feature/epp.website.xml index a0825539f..143dac0be 100644 --- a/packages/org.eclipse.epp.package.modeling.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.modeling.feature/epp.website.xml @@ -24,6 +24,6 @@ - + diff --git a/packages/org.eclipse.epp.package.php.feature/epp.website.xml b/packages/org.eclipse.epp.package.php.feature/epp.website.xml index 3488e5a80..1401cefc6 100644 --- a/packages/org.eclipse.epp.package.php.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.php.feature/epp.website.xml @@ -32,6 +32,6 @@ Click + diff --git a/packages/org.eclipse.epp.package.rcp.feature/epp.website.xml b/packages/org.eclipse.epp.package.rcp.feature/epp.website.xml index 3c71cd4d1..21294e7f7 100644 --- a/packages/org.eclipse.epp.package.rcp.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.rcp.feature/epp.website.xml @@ -27,6 +27,6 @@ - + diff --git a/packages/org.eclipse.epp.package.scout.feature/epp.website.xml b/packages/org.eclipse.epp.package.scout.feature/epp.website.xml index da37ce411..98ab77432 100644 --- a/packages/org.eclipse.epp.package.scout.feature/epp.website.xml +++ b/packages/org.eclipse.epp.package.scout.feature/epp.website.xml @@ -31,6 +31,6 @@ - + diff --git a/releng/org.eclipse.epp.config/org.eclipse.epp.releng.updater/src/org/eclipse/epp/releng/updater/Updater.java b/releng/org.eclipse.epp.config/org.eclipse.epp.releng.updater/src/org/eclipse/epp/releng/updater/Updater.java index d2cff8c85..e1d402ae1 100644 --- a/releng/org.eclipse.epp.config/org.eclipse.epp.releng.updater/src/org/eclipse/epp/releng/updater/Updater.java +++ b/releng/org.eclipse.epp.config/org.eclipse.epp.releng.updater/src/org/eclipse/epp/releng/updater/Updater.java @@ -39,7 +39,7 @@ public class Updater { /** * M1, M2, M3, RC1, RC2 */ - private static final String MILESTONE = "M2"; + private static final String MILESTONE = "M3"; private static final String PLATFORM_VERSION = "4.41"; diff --git a/releng/org.eclipse.epp.config/parent/pom.xml b/releng/org.eclipse.epp.config/parent/pom.xml index adf65e95a..120f3a481 100644 --- a/releng/org.eclipse.epp.config/parent/pom.xml +++ b/releng/org.eclipse.epp.config/parent/pom.xml @@ -35,13 +35,13 @@ 2026-06 2026-12 - M2 + M3 4.41.0 - 202607301000 + 202608201000 - https://download.eclipse.org/releases/2026-09/202607311000/ + https://download.eclipse.org/staging/2026-09/ ${RELEASE_NAME}-${RELEASE_MILESTONE} diff --git a/releng/org.eclipse.epp.config/tools/upload-to-staging.sh b/releng/org.eclipse.epp.config/tools/upload-to-staging.sh index 449306132..473a786eb 100755 --- a/releng/org.eclipse.epp.config/tools/upload-to-staging.sh +++ b/releng/org.eclipse.epp.config/tools/upload-to-staging.sh @@ -63,7 +63,7 @@ dsl - 2026-06 RC1 embedcpp - 2026-03 M2 java - 2025-06 RC1 jee - 2026-06 RC2 -modeling - 2026-09 M1 +modeling - 2026-09 M2 php - 2025-12 RC1 rcp - 2025-06 RC2 scout - 2026-03 M3 @@ -72,7 +72,7 @@ Platforms: Linux x86_64 - 2026-06 RC1 Linux aarch64 - 2023-09 RC2 Linux riscv64 - 2025-12 M1 -Windows x86_64 - 2026-09 M1 +Windows x86_64 - 2026-09 M2 Windows on Arm - 2026-06 RC2 macOS x86_64 - 2026-03 M1 macOS aarch64 - 2026-06- RC1