You need to reach out to the Eclipse Tycho project. It's their tooling that creates that `jetty-p2` zip / artifact / xmls...
$ curl -O https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/11.0.7/jetty-io-11.0.7.jar.asc % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 801 100 801 0 0 6022 0 --:--:-- --:--:-- --:--:-- 6022 $ curl -O https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/11.0.7/jetty-io-11.0.7.jar % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 196k 100 196k 0 0 1525k 0 --:--:-- --:--:-- --:--:-- 1525k $ gpg --keyserver-options auto-key-retrieve --verify jetty-io-11.0.7.jar.asc gpg: assuming signed data in 'jetty-io-11.0.7.jar' gpg: Signature made Wed 06 Oct 2021 03:00:14 PM CDT gpg: using RSA key 2D0E1FB8FE4B68B4 gpg: Good signature from "Joakim Erdfelt <joakim.erdf...@gmail.com>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 5989 BAF7 6217 B843 D66B E55B 2D0E 1FB8 FE4B 68B4 We can check the signature with https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/KEYS.txt $ curl -o - https://raw.githubusercontent.com/eclipse/jetty.project/jetty-10.0.x/KEYS.txt | grep joakim.erdf...@gmail.com % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 791 100 791 0 0 1243 0 --:--:-- --:--:-- --:--:-- 1241 Joakim Erdfelt <joakim.erdf...@gmail.com> 5989 BAF7 6217 B843 D66B E55B 2D0E 1FB8 FE4B 68B4 Now let's take a look at the p2site.zip ... $ curl -O https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-p2/11.0.7/jetty-p2-11.0.7-p2site.zip % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 72281 100 72281 0 0 412k 0 --:--:-- --:--:-- --:--:-- 410k $ unzip jetty-p2-11.0.7-p2site.zip Archive: jetty-p2-11.0.7-p2site.zip inflating: content.xml inflating: artifacts.xml $ xmllint --xpath "string(//artifact[@id='org.eclipse.jetty.io']/properties/property[@name='pgp.signatures']/@value)" artifacts.xml -----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJhXgBOAAoJEC0OH7j+S2i0gGIP/iqRlIH3Xeq0raOZeY2fK+WF S2m4NB5wcoIsc0cVLVyM50RIdhsuWSitgucTCw6YuNNI1G1hLl9/FYiqe07YYc9k 2nE8/8wtgKHoioesWAITs6ai97w9CuOig9zlDT90zWX6/ZfWR4JL+Q4jlsJU8Z+i Mx6ax9yjRiZkAD1tvvkpNVriDWwwRYCXWwtIU/kU+LX3NX2Qn2Y1kveboZgEUnMP gT8yaTpGSvvy5euvxH55cxLQ+18nppcYvcpdv8KwfpUtpoA4iFOorxShDgZrSPkw fA0VwWVRYY4C0fu6GkDWV8TxZD1EPTYEfrvkbwQS/FgJlIzFDXXBRm6sXD5mXv5w KNVb3vt7yuOdsswY5pD9GcKcmvewTrP0nCrsFT24eW0lf4WksGT7deoj3WrKwKlm BY5kThMlP2XXFWpK5CZ4spY4FzH9kGq4+iDxz1xU3h0elsDSqhh8pq6jPVGXxz9/ EJcR70cHW1y5M2qMZ1f+M8hpZlqutKtQDF5/sILfZZON6JAVZ0i3tMTlhGIhazCu 1oA/xGmzcXg2/HSN66ReoTa+mxeXvotffElEsHv3OnMYwWCIlk4YNuUJ5Qm86Uvj nvM6WM6CyT3y+uPz4yLYtMPIaTo3ZbQKOTKnARIhHPGIWRjv5MmBsUtFzwWytoq3 lh/uTkMfy5hZ9HhI+E6Z =fN9N -----END PGP SIGNATURE----- I have no idea what artifact this signature is for. It's my gpg key, RSA key 2D0E1FB8FE4B68B4 "Joakim Erdfelt < joakim.erdf...@gmail.com>" But I have no idea what it signed. The Eclipse Tycho folks will know, they wrote the entire tool suite that does this. Reminder: all of the bundle repositories you used to find at eclipse.org were for other Eclipse Projects. They were not meant to be consumed by projects outside of Eclipse. Eclipse Jetty never produced P2 repositories. If you find P2 repositories with Eclipse artifacts, those were created by other Eclipse Projects that wanted to use Eclipse Jetty. It's been like this forever. All we do is review / merge Eclipse Tycho PRs into our build tree. Example: https://github.com/eclipse/jetty.project/pull/6404 and https://github.com/eclipse/jetty.project/pull/7669 Joakim Erdfelt / joa...@webtide.com On Fri, Mar 25, 2022 at 7:23 AM Didier Vojtisek <didier.vojti...@inria.fr> wrote: > the asc for 10.0.7 and not 11.0.7 > > https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/10.0.7/jetty-io-10.0.7.jar.asc > > but still different from the one in p2site > > > On 25/03/2022 13:20, Didier Vojtisek wrote: > > I can try ... :-/ > however, even if I'm not signature specialist, I suspect an issue in the > pgp signatures declared in the artefacts.xml (in the > https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-p2/10.0.7/jetty-p2-10.0.7-p2site.zip > ) > versus the signature associated to the target jar in maven > > > for example , in the above zip, I find the following signature in the > artefacts.xml (I took the first one in order to avoid ctrl+F in the long > file): > > <artifact classifier='osgi.bundle' id='org.eclipse.jetty.io' > version='10.0.7'> > <properties size='10'> > <property name='artifact.size' value='201509'/> > <property name='download.size' value='201509'/> > <property name='download.md5' > value='390f758950eb984a7d014de459fb4c39'/> > <property name='download.checksum.md5' > value='390f758950eb984a7d014de459fb4c39'/> > <property name='download.checksum.sha-256' > value='525975f6de0868ee66a34096186ea20d844ae9f884c6e170add912d4f19ede31'/> > <property name='maven.artifactId' value='*jetty-io*'/> > <property name='maven.extension' value='jar'/> > <property name='maven.version' value='*10.0.7*'/> > <property name='maven.groupId' value='*org.eclipse.jetty*'/> > <property name='pgp.signatures' value='-----BEGIN PGP > SIGNATURE-----

iQIcBAABAgAGBQJhXfpjAAoJEC0OH7j+S2i0nKkP/A6AAbSMV7LDd/9rcc5UVZ+N
a5ka6w9cilDSjjjp0d2KPoDsdsVNfJG04kr64Q/Z87QcuxIhYnybPjAOtuPR1SMU
I1RBqG6auJj6KN9F9y5hxxk+zzRL7EnV6OlIGS1EIBS5yh1L03AiYGPgar7JulKS
G2wcTcbVaVVC7dGZ3sNIrzyf5aEmt0DE/4GYdnmbit11BiI6HIOci7WMIYVID/AD
3+KlTB+nStUPd+6RXc8wOBeEg9UFifJ9QCBaXAV+3PCuXbrQ+43awC94N0QBQ7Ge
2JxCaynmvnK0roQB3yMN21c7Qj5YwTw48/NNkcv0ifphFW2nvqN9dces5mjpXO34
SXjbmRbpHITRjfgKy2WIwobRFGbUkz4AOtNYvbQHcZ/4zz6CC5pTWNKeukp2dj+z
oCKe1iPMmnWHQmxtTFVG4RjJkstMJI5EHG6ArFGR1VVas0xhQmyqkUI1fLTEBIev
Y0xRmtKAookp2xFY+x1DIM9p99MZOsqbn36+qf1nDBbkER/jULtGPgPFGAQC+a03
0zRAJ+YcVCH30WTp7x5gVXSpO2TD+txxs4YNQskBR5ZYJb5t2uUEBlZClP+k4z5W
nXo9oUrneSUqg8CvUdTKYXblCMkDsq43xRBm++W1IKtOivJOKzqVQMKp6IGAtYcR
6yW2cfW/Uj4M1m9a1sml
=B+xb
-----END > PGP SIGNATURE-----'/> > </properties> > </artifact> > > but the corresponding asc in maven looks differrent: > https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-io/11.0.7/jetty-io-11.0.7.jar.asc > (even considering the &# xml char convertion) > > > Additionally, I don't think this is tycho specific, because I also got the > same error directly trying to use the url > mvn:org.eclipse.jetty:jetty-p2:10.0.7:zip:p2site in eclipse"install new > software" user interface (need m2e installed to support such url) > > Didier > > > On 25/03/2022 11:58, Joakim Erdfelt wrote: > > The content in maven is most definitely valid. > That content specifically is used by Eclipse IDE to build the help system > present in the IDE. > > I do not know what "Signature is invalid" means in this context. > > I would suggest reaching out to the Eclipse Tycho folks and asking them > how to resolve this issue. > https://projects.eclipse.org/projects/technology.tycho > Start with sending an email to their tycho-user mailing list. > > Joakim Erdfelt / joa...@webtide.com > > > On Fri, Mar 25, 2022 at 5:42 AM Didier Vojtisek <didier.vojti...@inria.fr> > wrote: > >> Hi thanks for your answer >> >> I tried to use the site you propose but none of my install works. The >> main error is that it fails with a "Signature is invalid for current >> content." error. >> >> I used the following urls >> mvn:org.eclipse.jetty:jetty-p2:10.0.7:zip:p2site (as stated in >> https://www.eclipse.org/tycho/sitedocs/tycho-p2/tycho-p2-repository-plugin/plugin-info.html >> ) >> I first tried directly with the eclipse installer (after having manually >> installed a bundle containing the package javax.websocket that isn't >> present ) >> >> I also tried a maven tycho build to produce my own update site by >> requiring jetty jar >> >> Unfortunately both strategies failed with the "Signature is invalid" >> message ... >> >> I put a small project illustrating the problem here: >> https://github.com/dvojtise/jetty-eclipse-p2/tree/main/jetty-eclipse-p2-repo >> (you can directly look at the associated github action log) >> >> Any idea ? >> >> Didier >> >> On 24/03/2022 20:27, Joakim Erdfelt wrote: >> >> The Eclipse Tycho project is the source for bundles from maven >> repositories now. >> >> It will use the references found in >> https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-p2/ to create a >> local P2 build for you. >> >> Joakim Erdfelt / joa...@webtide.com >> >> >> On Thu, Mar 24, 2022 at 12:13 PM Didier Vojtisek < >> didier.vojti...@inria.fr> wrote: >> >>> Hi >>> >>> In eclipse some Jetty components was bundled in the standard eclipse >>> update site. (only a subset of jetty bundles. (cf. >>> http://download.eclipse.org/releases/xxx content)) >>> >>> In our project, we need some extra features for websocket management to >>> be used directly from eclipse ( we typically need >>> org.eclipse.jetty.websocket.javax.websocket and >>> org.eclipse.jetty.websocket.javax.websocket.server plugins) >>> >>> With older version of Eclipse, I was using the following update site ( >>> https://download.eclipse.org/jetty/updates/jetty-bundles-9.x/) to >>> complete the installation with compatible jetty bundles. >>> >>> In more recent Eclipse, Jetty is now in version 10.x.x >>> >>> I tried to install the older one on top of the new one, but the >>> installation isn't functional (conflict, and mixing versions ) >>> I also tried to create my own P2 site from jetty jar in maven using >>> https://github.com/reficio/p2-maven-plugin . But again, get strange >>> conflicts or degraded classloader performances making the OSGI platform not >>> usable. >>> >>> -> Does anyone know where to find a p2 update site with the other jetty >>> bundles that would be compatible with the current Eclipse release ? >>> >>> thanks >>> >>> Didier >>> >>> -- >>> Didier Vojtisek >>> SED Rennes - DiverSE Team - LogicA Team >>> Inria, Univ Rennes, CNRS, IRISA >>> >>> _______________________________________________ >>> jetty-users mailing list >>> jetty-users@eclipse.org >>> To unsubscribe from this list, visit >>> https://www.eclipse.org/mailman/listinfo/jetty-users >>> >> >> _______________________________________________ >> jetty-users mailing listjetty-us...@eclipse.org >> To unsubscribe from this list, visit >> https://www.eclipse.org/mailman/listinfo/jetty-users >> >> >> -- >> Didier Vojtisek >> SED Rennes - DiverSE Team - LogicA Team >> Inria, Univ Rennes, CNRS, IRISA >> Campus de beaulieu >> 35042 Rennes >> 02 99 84 75 07 >> >> _______________________________________________ >> jetty-users mailing list >> jetty-users@eclipse.org >> To unsubscribe from this list, visit >> https://www.eclipse.org/mailman/listinfo/jetty-users >> > > _______________________________________________ > jetty-users mailing listjetty-us...@eclipse.org > To unsubscribe from this list, visit > https://www.eclipse.org/mailman/listinfo/jetty-users > > > -- > Didier Vojtisek > SED Rennes - DiverSE Team - LogicA Team > Inria, Univ Rennes, CNRS, IRISA > Campus de beaulieu > 35042 Rennes > 02 99 84 75 07 > > > _______________________________________________ > jetty-users mailing listjetty-us...@eclipse.org > To unsubscribe from this list, visit > https://www.eclipse.org/mailman/listinfo/jetty-users > > > -- > Didier Vojtisek > SED Rennes - DiverSE Team - LogicA Team > Inria, Univ Rennes, CNRS, IRISA > Campus de beaulieu > 35042 Rennes > 02 99 84 75 07 > > _______________________________________________ > jetty-users mailing list > jetty-users@eclipse.org > To unsubscribe from this list, visit > https://www.eclipse.org/mailman/listinfo/jetty-users >
_______________________________________________ jetty-users mailing list jetty-users@eclipse.org To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users
