Re: [theia-dev] Release of vscode built-ins 1.77.0 - wait for IP check t

[Marc Dumais <marc.dumais@xxxxxxxxxxxx>]

Hi Thomas, see below.

---

From: Thomas Mäder <t.s.maeder@xxxxxxxxx>
Sent: Thursday, May 25, 2023 8:43 AM
To: theia developer discussions <theia-dev@xxxxxxxxxxx>; theia-dev@xxxxxxxxxxx <theia-dev@xxxxxxxxxxx>
Cc: Marc Dumais <marc.dumais@xxxxxxxxxxxx>; Wayne Beaton <wayne.beaton@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [theia-dev] Release of vscode built-ins 1.77.0 - wait for IP check tickets resolution?

 

------ Original Message ------

From "Marc Dumais via theia-dev" <theia-dev@xxxxxxxxxxx>

• To me it looks like the cgmanifest.json files are describing licensing for components. Shouldn't they be excluded from the check, since they are essentially metadata, not code?
  

Possibly. The Foundation encourages us to remove "test/build" content that's not published, to make the check less likely to report false positives, on files that are not relevant. If we discuss it with the IP team and they agree, we could try this suggestion and remove these files from the source archive we provide. Alternatively, the automated license check made using scancode could be made smarter, detecting only changes "since last approved" in these files, or such. This way, we would not stumble on the same entries each time we open such a ticket but could still catch new such entries that might be interesting. 

In consequence, I propose we go ahead with releasing the vscode built-ins 1.77.0 and start using them. What do you think? Objections? 

• Can we do that under the Eclipse Foundation rules? What happens if something _does_ turn up? Do we "unpublish" the extensions? 
  

I think/hope so. Using logic and the tools at our disposal, like the scancode results, we can tell that this looks unlikely to happen, but if it does, we correct the course ASAP. In many cases I think this would mean that the 3PP in question would be approved for our project as "works with" or through a board exception. If this can't happen, we'll need to see what can be done instead. 

• What happens if we publish the community release without having the 1.77.0 built-ins released?
  

Then applications based on the community release would pull the latest built-ins that we published; I think 1.70.2. These were not tested nearly as well as 1.77.0 and probably have extra flaws. Also, when we eventually publish 1.77.0, these applications would start "silently" pulling these instead, potentially changing some behaviors, e.g. requiring the applications to suddenly have to pin some built-ins to an earlier version to keep things working the same. 

/Thomas