| Re: [platform-dev] Fwd: [eclipse-packaging/packages] Eclipse 2025-06 fails to start if CodeTogether's devstyle Darkest Dark theme is installed (Issue #310) |
|
Hi Jonah, hi everyone, Thank you for having an eye on this and for proposing multiple solution options, Jonah! I have no strong opinion on how to proceed with this, so just sharing my thoughts on it. I would be in favor of pushing as much responsibility as possible to the extension provider. Unfortunately, I don’t think we can easily,
safely, and necessarily fast achieve something regarding resilience of Eclipse against such abuse (point 2). So, I would be in favor of adding a negative p2 requirement if that’s feasible (point 4). If not, we should go with reverting the problematic
change for now and reapply it for 4.37 (point 1). Assuming that
this is the only problematic change, it should be easy to revert. I quickly tested a revert and it works fine for me. We would just need to check that just reverting this change actually fixes the issue with the extension and that there were no other changes
that break it. In addition to all that, I would also be in favor of doing some communication/marketing regarding the abuse of Genuitec. We may have
the IDE working group reach out to them and we might think about how to make people aware that this extension is doing really bad stuff. In my opinion, this kind of bytecode manipulation is not only questionable from a technical perspective and regarding how
extensions of a framework have to work (relying on official APIs), but (1) it also somehow shows how they think about open source in general and (2) it's a potential security leak as you have no clue what this bytecode manipulation actually affects. I would
never install a plugin if I knew that it is doing such weird things. Still, I see this communication part as something that probably needs to be done in a timeline that is independent from the upcoming
release. Best regards, Heiko From: platform-dev <platform-dev-bounces@xxxxxxxxxxx>
On Behalf Of Jonah Graham via platform-dev Hi folks, Please see below and let me know your thoughts. Thanks Jonah ~~~ ---------- Forwarded message ---------
This is a more suitable location to discuss the issues raised in
eclipse-cdt/cdt#1164 - here is just a summary. If you install
devstyle Darkest Dark theme in Eclipse IDE 2025-06 the IDE will fail to start due to some byte-code manipulation that the plug-in does that
breaks Eclipse startup. While this problem is not a bug in Eclipse or its projects, the theme is one of the most popular plug-ins on the Eclipse marketplace, with probably 10s of thousands of installs that will be broken if they updated to latest Eclipse release in June. Therefore
the damage to Eclipse's users will be large. Therefore we will need to figure out how to mitigate this for our users. I have reached out to genuitec (see emails in
eclipse-cdt/cdt#1164) but as of now they have not proposed a solution and there is very little time to resolve this. Possible ways forward are:
I solicit input from the community on what to do here. There is not much time to resolve this, if any change needs to be made in Eclipse Platform we have less than 1 week to come up with a solution. — |