Remove bundles that have OSGi metadata upstream

[jonahgraham]

For a long time Orbit's re-bundling was the way to get third-party libraries from Maven into an Eclipse p2 consumable state.

For a while now there has been a better way for getting third-party dependencies that already contains OSGi metadata. That is to use the M2E's maven target locations and sign the bundles with PGP instead of jarsigning. There has been much communication on mailing lists and in issues on this topic in the the last couple of years.

The next step now is to stop maintaining the Orbit bundles that rewrite the OSGi metadata when the upstream bundle has the OSGi metadata in it correctly already.

The goal is to have the first step of this process done for 2023-09 M1 by removing the bundles. In addition @merks's work in https://github.com/eclipse-oomph/oomph.incubator will be migrated into the Orbit project so that Orbit provides p2 repos with the PGP signed third-party dependencies already in them.

Here are the bundles that have valid OSGi metadata in the upstream version that we plan to remove. This list will be added to as we vet additional bundles.

• Remove com.ibm.icu4j from Orbit #9 Remove ICU4J #26
• Remove EJML (v0.29) bundles from Orbit #19 Remove EJML (v0.29) bundles #24
• Remove org.apache.commons.fileupload #27
• Remove javax.annotation 1.3.5 #28
• Remove JNA 4.1.* and 5.* (all versions except 4.5.1) #29
• Remove org.apache.sshd.osgi and org.apache.sshd.sftp #30
• SLF4J
• logback
• commons-logging
• Remove com.github.oshi #33
• Remove org.yaml.snakeyaml #34
• Remove commons-lang aka org.apache.commons.lang 2.6.0 #35
• Remove bouncycastle (bcpg, bcpkix, bcprov, bcutil) #36
• jakarta.servlet-api and jakarta.el-api (Eclipse Platform ships direct from Maven version older than versions in Orbit)
• Remove mockito, bytebuddy, assertj and objenesis #38
• Remove ASM (org.objectweb.asm and analysis, commons, tree, util) #39
• jackson (Eclipse platform consumes direct from Maven, but does not re-publish, other projects are publishing Orbit version to SimRel)
• Remove JUnit5 / Jupiter #40
• apache commons-collections 3 (Eclipse platform consumes direct from Maven, but does not re-publish, other projects are publishing Orbit version to SimRel)
• Remove com.googlecode.javaewah #42
• Remove gson #43
• Remove org.kohsuke.args4j #44
• commons-codec
• commons-compress
• commons-io
• guava
• Remove commons-cli aka org.apache.commons.cli #45
• guice aka com.google.inject
• Remove joni and jcoding #46

[jonahgraham]

I will be adding to the description of this issue a check-list covering all the items we plan on removing.

[jonahgraham]

In the first instance I will be pruning out all the items listed in the target platforms for the projects consuming from maven central and contributing to simrel already, such as platform, tm4e, etc. See https://github.com/eclipse-oomph/oomph.incubator/tree/master/maven/org.eclipse.oomph.maven.generator/report for the source that I am using.

[jonahgraham]

• I have moved this work into a branch and reverted all the removals from main in Revert all the recent removals of orbit bundles #47
• This had caused some unexpected disruption due to some projects consuming I-builds that needs to be resolved first

[merks]

We can remove all of com.github.jrn.* from Orbit

See this for analysis:

eclipse-linuxtools/org.eclipse.linuxtools#213

The two that need wrapping are handled here:

https://github.com/eclipse-orbit/orbit-simrel/blob/93b4bc855b2881bd47f17032b99bfb2f2ed5c137/maven-bnd/tp/MavenBND.target#L148-L160

The rest that don't are here:

https://github.com/eclipse-orbit/orbit-simrel/blob/93b4bc855b2881bd47f17032b99bfb2f2ed5c137/maven-osgi/tp/Maven.target#L87-L130

[merks]

@jonahgraham

FYI, I am creating a rather long list of exclusion rules, which is still a work in progress:

[cdietrich]

Xtext uses classgraph
Also aopalliance (used by guice)
And junit 4.13.2
See eclipse-orbit/orbit-simrel#4

[merks]

What is "classgraph"?

[merks]

Maybe this?

[HannesWell]

Maybe this?

I believe that's the one, yes.

[cdietrich]

yes this is classgraph. it has osgi metadata as it looks like so we could update.
but i dont know when i can find time to work on it in Xtext side
if work is more than a bump

btw. with the guice 7 bump the guice thing is done. so is it about others depending on old guices?

[jonahgraham]

Rather than handling it by removing bundles from EBR style Orbit (this repo) the new Orbit aggregation repo is excluding old bundles as they are replaced - see https://github.com/eclipse-orbit/orbit-simrel/blob/main/orbit-aggregation/orbit.aggr