Unable to install software using `Help > Install new software`

[fabioz]

Using the latest Eclipse SDK 4.34 RC2 -- (from: https://download.eclipse.org/eclipse/downloads/drops4/S-4.34RC2-202411201800/)
OS: Windows 11.

When trying to install plugins (tested with update sites below):

• https://download.eclipse.org/technology/m2e/releases/latest/
• https://download.eclipse.org/eclipse/updates/4.34/
• https://pydev.org/updates

I get the error below (all are similar, just changing the url shown):

org.eclipse.equinox.p2.core.ProvisionException: Error while reading from repository: https://download.eclipse.org/eclipse/updates/4.34/site.xml.
	at org.eclipse.equinox.internal.p2.updatesite.UpdateSite.loadActualSiteFile(UpdateSite.java:252)
	at org.eclipse.equinox.internal.p2.updatesite.UpdateSite.load(UpdateSite.java:152)
	at org.eclipse.equinox.internal.p2.updatesite.metadata.UpdateSiteMetadataRepositoryFactory.initializeRepository(UpdateSiteMetadataRepositoryFactory.java:108)
	at org.eclipse.equinox.internal.p2.updatesite.metadata.UpdateSiteMetadataRepositoryFactory.load(UpdateSiteMetadataRepositoryFactory.java:62)
	at org.eclipse.equinox.internal.p2.metadata.repository.MetadataRepositoryManager.factoryLoad(MetadataRepositoryManager.java:63)
	at org.eclipse.equinox.internal.p2.repository.helpers.AbstractRepositoryManager.loadRepository(AbstractRepositoryManager.java:799)
	at org.eclipse.equinox.internal.p2.repository.helpers.AbstractRepositoryManager.loadRepository(AbstractRepositoryManager.java:697)
	at org.eclipse.equinox.internal.p2.metadata.repository.MetadataRepositoryManager.loadRepository(MetadataRepositoryManager.java:110)
	at org.eclipse.equinox.internal.p2.metadata.repository.MetadataRepositoryManager.loadRepository(MetadataRepositoryManager.java:105)
	at org.eclipse.equinox.p2.ui.ProvisioningUI.loadMetadataRepository(ProvisioningUI.java:498)
	at org.eclipse.equinox.internal.p2.ui.model.MetadataRepositoryElement.getMetadataRepository(MetadataRepositoryElement.java:138)
	at org.eclipse.equinox.internal.p2.ui.model.MetadataRepositoryElement.getRepository(MetadataRepositoryElement.java:127)
	at org.eclipse.equinox.internal.p2.ui.model.MetadataRepositoryElement.getQueryable(MetadataRepositoryElement.java:120)
	at org.eclipse.equinox.internal.p2.ui.QueryProvider.getQueryDescriptor(QueryProvider.java:92)
	at org.eclipse.equinox.internal.p2.ui.model.QueriedElement.fetchChildren(QueriedElement.java:103)
	at org.eclipse.equinox.internal.p2.ui.model.MetadataRepositoryElement.fetchChildren(MetadataRepositoryElement.java:86)
	at org.eclipse.equinox.internal.p2.ui.model.RemoteQueriedElement.fetchDeferredChildren(RemoteQueriedElement.java:38)
	at org.eclipse.ui.progress.DeferredTreeContentManager$1.run(DeferredTreeContentManager.java:215)
	at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63)

-- Note: the site.xml isn't really available in those updates sites -- but as far as I know it's also not required and those update sites do work in previous versions of Eclipse!

-- Is this a release blocker for Eclipse SDK 4.34 RC2?

[merks]

This is a bit vague. Can you describe the actual steps that someone else can follow?

Note that the the 4.34 site is empty until December 4th so this is likely a network or server problem not a software bug.

[fabioz]

I'm posting a screenshot. Hopefully it's clearer that way...

Note: it's not a network issue as it does work with an older version of Eclipse.

i.e.: image below is from older version:

Note: I can reproduce it in Windows, but I tried it in Mac OS too and there it did work.

[merks]

I tried it and it works for me:

For the 4.34 release, the eclipse.ini includes these VM arguments:

-Djavax.net.ssl.trustStoreType=Windows-ROOT
-Djavax.net.ssl.trustStore=NONE

Maybe this is related to the issue you have, i.e., maybe the Windows trust store is faulty in some way. You could try to remove those options to see if that makes a difference.

[mickaelistria]

The site.xml is indeed not relevant and not produced. p2 should lookup (and find) some (artifacts|content).(xml.xz|jar) files. Can you please make sure you can first download those files from inside Eclipse internal web browser?

[merks]

Note that if you visit https://www.pydev.org/updates/ it says

Indeed those exist and point to :

https://github.com/fabioz/Pydev/releases/download/pydev_12_2_0

This yields 404:

https://www.pydev.org/updates/site.xml

The other site gives 404 in a browser, but it does load:

And this file does exist:

https://github.com/fabioz/Pydev/releases/download/pydev_12_2_0/content.jar

I would be good money on the options I mentioned causing the behavior difference between the latest release and older releases...

[fabioz]

I checked it here and removing:

-Djavax.net.ssl.trustStoreType=Windows-ROOT
-Djavax.net.ssl.trustStore=NONE

from eclipse.ini makes it work for me!

Not sure what that entails though...

[fabioz]

Note that I have to remove both lines (removing just one of those still makes the issue happen).

[merks]

This commit added those options:

eclipse-platform/eclipse.platform.releng.aggregator@b3ad094

Also for the EPP packages it was added:

eclipse-packaging/packages#224

Here is background information:

eclipse-platform/eclipse.platform.releng.aggregator#929

These options are particularly important in firewall environments where the firewall injects certificates into the traffic where those certificates are generally not rooted on the cacerts of the JDK being used, e.g., for EPP packages an embedded JustJ JRE.

I'm no sure what's going on with your windows root certificate store, but there is something missing or wrong there so disabling the use of it and using only the one from your JDK/JRE seems like a good thing, though specifically for you and not generally for most users. There is no security risks or any other concerns about making these changes. Generally one expects the OS's certificate store to be more-up-to-date than that of the JRE and hence be more permissive than the JRE...

I don't think there is anything we can do to fix this for you without undoing the fix for a large portion of the consumer base...

[fabioz]

The strange thing is that I do also use the Windows truststore in Python and it seems to work well there (i.e.: I use it in Python using https://pypi.org/project/truststore/), so, I'd be very surprised if this is some sort of misconfiguration in my machine (browsers themselves would probably have issues too, which is not the case).

I actually think it's more likely that it's some sort of issue with the module accessing the windows truststore -- which apparently is in the JVM itself...

I'm using the Adoptium OpenJDK Hotspot JRE Minimal Stripped version of of OpenJDK, so, maybe that makes a difference.

The details on my current JRE are:

java.class.version=64.0
java.runtime.name=OpenJDK Runtime Environment
java.runtime.version=20.0.1+9
java.specification.name=Java Platform API Specification
java.specification.vendor=Oracle Corporation
java.specification.version=20
java.vendor.url.bug=https\://github.com/adoptium/adoptium-support/issues
java.vendor.url=https\://adoptium.net/
java.vendor.version=Temurin-20.0.1+9
java.vendor=Eclipse Adoptium
java.version.date=2023-04-18
java.version=20.0.1
java.vm.compressedOopsMode=32-bit
java.vm.info=mixed mode
java.vm.name=OpenJDK 64-Bit Server VM
java.vm.specification.name=Java Virtual Machine Specification
java.vm.specification.vendor=Oracle Corporation
java.vm.specification.version=20
java.vm.vendor=Eclipse Adoptium
java.vm.version=20.0.1+9
org.eclipse.justj.description=Provides the minimal modules needed to satisfy all of the bundles of the simultaneous release, stripped of debug information.
org.eclipse.justj.jlink.args=--compress\=2 --vm\=server --strip-debug
org.eclipse.justj.label=Adoptium OpenJDK Hotspot JRE Minimal Stripped
org.eclipse.justj.modules=java.base,java.compiler,java.datatransfer,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.sql.rowset,java.transaction.xa,java.xml,jdk.attach,jdk.crypto.ec,jdk.jdi,jdk.management,jdk.unsupported,jdk.xml.dom,jdk.zipfs
org.eclipse.justj.name=openjdk.hotspot.jre.minimal.stripped
org.eclipse.justj.url.source=https\://github.com/adoptium/temurin20-binaries/releases/download/jdk-20.0.1+9/OpenJDK20U-jdk_x64_windows_hotspot_20.0.1_9.zip
org.eclipse.justj.url.vendor=https\://adoptium.net/
org.eclipse.justj.vm.arg=bin
org.osgi.framework.system.capabilities=osgi.ee; osgi.ee\="OSGi/Minimum"; version\:List<Version>\="1.0, 1.1, 1.2", osgi.ee; osgi.ee\="JRE"; version\:List<Version>\="1.0, 1.1", osgi.ee; osgi.ee\="JavaSE"; version\:List<Version>\="1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0, 17.0, 18.0, 19.0, 20.0",osgi.ee; osgi.ee\="JavaSE/compact1"; version\:List<Version>\="1.8, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0, 17.0, 18.0, 19.0, 20.0",osgi.ee; osgi.ee\="JavaSE/compact2"; version\:List<Version>\="1.8, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0, 17.0, 18.0, 19.0, 20.0",osgi.ee; osgi.ee\="JavaSE/compact3"; version\:List<Version>\="1.8, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0, 17.0, 18.0, 19.0, 20.0"
org.osgi.framework.system.packages=com.sun.jdi, com.sun.jdi.connect, com.sun.jdi.connect.spi, com.sun.jdi.event, com.sun.jdi.request, com.sun.management, com.sun.nio.file, com.sun.tools.attach, com.sun.tools.attach.spi, java.applet, java.awt, java.awt.color, java.awt.datatransfer, java.awt.desktop, java.awt.dnd, java.awt.event, java.awt.font, java.awt.geom, java.awt.im, java.awt.im.spi, java.awt.image, java.awt.image.renderable, java.awt.print, java.beans, java.beans.beancontext, java.io, java.lang, java.lang.annotation, java.lang.constant, java.lang.foreign, java.lang.instrument, java.lang.invoke, java.lang.management, java.lang.module, java.lang.ref, java.lang.reflect, java.lang.runtime, java.math, java.net, java.net.http, java.net.spi, java.nio, java.nio.channels, java.nio.channels.spi, java.nio.charset, java.nio.charset.spi, java.nio.file, java.nio.file.attribute, java.nio.file.spi, java.rmi, java.rmi.dgc, java.rmi.registry, java.rmi.server, java.security, java.security.cert, java.security.interfaces, java.security.spec, java.sql, java.text, java.text.spi, java.time, java.time.chrono, java.time.format, java.time.temporal, java.time.zone, java.util, java.util.concurrent, java.util.concurrent.atomic, java.util.concurrent.locks, java.util.function, java.util.jar, java.util.logging, java.util.prefs, java.util.random, java.util.regex, java.util.spi, java.util.stream, java.util.zip, javax.accessibility, javax.annotation.processing, javax.crypto, javax.crypto.interfaces, javax.crypto.spec, javax.imageio, javax.imageio.event, javax.imageio.metadata, javax.imageio.plugins.bmp, javax.imageio.plugins.jpeg, javax.imageio.plugins.tiff, javax.imageio.spi, javax.imageio.stream, javax.lang.model, javax.lang.model.element, javax.lang.model.type, javax.lang.model.util, javax.management, javax.management.loading, javax.management.modelmbean, javax.management.monitor, javax.management.openmbean, javax.management.relation, javax.management.remote, javax.management.timer, javax.naming, javax.naming.directory, javax.naming.event, javax.naming.ldap, javax.naming.ldap.spi, javax.naming.spi, javax.net, javax.net.ssl, javax.print, javax.print.attribute, javax.print.attribute.standard, javax.print.event, javax.rmi.ssl, javax.script, javax.security.auth, javax.security.auth.callback, javax.security.auth.kerberos, javax.security.auth.login, javax.security.auth.spi, javax.security.auth.x500, javax.security.cert, javax.security.sasl, javax.sound.midi, javax.sound.midi.spi, javax.sound.sampled, javax.sound.sampled.spi, javax.sql, javax.sql.rowset, javax.sql.rowset.serial, javax.sql.rowset.spi, javax.swing, javax.swing.border, javax.swing.colorchooser, javax.swing.event, javax.swing.filechooser, javax.swing.plaf, javax.swing.plaf.basic, javax.swing.plaf.metal, javax.swing.plaf.multi, javax.swing.plaf.nimbus, javax.swing.plaf.synth, javax.swing.table, javax.swing.text, javax.swing.text.html, javax.swing.text.html.parser, javax.swing.text.rtf, javax.swing.tree, javax.swing.undo, javax.tools, javax.transaction.xa, javax.xml, javax.xml.catalog, javax.xml.datatype, javax.xml.namespace, javax.xml.parsers, javax.xml.stream, javax.xml.stream.events, javax.xml.stream.util, javax.xml.transform, javax.xml.transform.dom, javax.xml.transform.sax, javax.xml.transform.stax, javax.xml.transform.stream, javax.xml.validation, javax.xml.xpath, org.ietf.jgss, org.w3c.dom, org.w3c.dom.bootstrap, org.w3c.dom.css, org.w3c.dom.events, org.w3c.dom.html, org.w3c.dom.ls, org.w3c.dom.ranges, org.w3c.dom.stylesheets, org.w3c.dom.traversal, org.w3c.dom.views, org.w3c.dom.xpath, org.xml.sax, org.xml.sax.ext, org.xml.sax.helpers, sun.misc, sun.reflect
org.osgi.framework.version=1.10.0
osgi.arch=x86_64
osgi.os=win32
osgi.ws=win32

Anyways, if it's just me I'll just close the issue and investigate more later on when I get the time since I now have a workaround.

I guess that if anyone else happens to also have the issue they can reopen.

[merks]

There's definitely something strange going on here, but how to pinpoint that problem. In any case, thanks for your understanding!

[sratz]

I added some more information here: eclipse-packaging/packages#224 (comment)