Enforce https one marketplace.eclipse.org

In an effort to protect the Eclipse Marketplace users, we will enforce HTTPS for all solutions in a 4 steps process:

• On September 20th; we will display a banner on the marketplace website to start notifying people about this process. No change and no breakage at this point. Mikael will publish a blog post at the same time to elaborate on the reasoning and value.
• On October 14th October 20th; validation rules will be added to the marketplace website: solutions cannot be added or edited with plain http links; only https will be accepted.
• On December 15th, we will un-publish all solutions having plain http links. We will reach out to owners one last about the unpublishing of their solutions, giving them 45 days (until January 30th) to fix them. After this date, solutions that don't match the new requirements will be permanently removed.
• On January 30th, we delete all non compliances solutions.

Here is the communication plan with plain HTTP solutions owners:

• Oct 4: first announcement to solutions owners, asking them to update their listings.
• Oct 14 Oct 20: reminder + notification of the new validation rule
• Nov 15: reminder about unpublishing in 1 month
• Dec 5: reminder about unpublishing in 10 days
• Dec 15: notification about unpublishing + reminder about deletion EOF January
• Jan 17: last reminder about deletion in 2 weeks
• Jan 31: notification about deletion

added statetodo label

marked this issue as related to eclipsefdn/it/websites/marketplace.eclipse.org#84 (closed)

removed the relation with eclipsefdn/it/websites/marketplace.eclipse.org#84 (closed)

marked this issue as related to eclipsefdn/it/websites/marketplace.eclipse.org#84 (closed)

marked this issue as related to eclipsefdn/it/websites/marketplace.eclipse.org#85 (closed)

marked this issue as related to eclipsefdn/it/websites/marketplace.eclipse.org#86 (closed)

removed the relation with eclipsefdn/it/websites/marketplace.eclipse.org#86 (closed)

marked this issue as related to eclipsefdn/it/websites/marketplace.eclipse.org#86 (closed)

changed title from Forbid https from marketplace to Enforce https one marketplace.eclipse.org

changed the description

changed the description

assigned to @mbarbero

/cc @pbuckd40

added statewip label and removed statetodo label

changed the description

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#85 (closed)

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#86 (closed)

marked the checklist item On September 20th; we will display a banner on the marketplace website to start notifying people about this process. No change and no breakage at this point. Mikael will publish a blog post at the same time to elaborate on the reasoning and value. as completed

marked the checklist item Oct 4: first announcement to solutions owners, asking them to update their listings. as completed

@mbarbero all blockers are now closed, I'll let you close this one if you're satisfied with everything else.

Thanks.

Thanks, we still have a couple of reminders to send before closing this one. I'll open tickets accordingly.

changed the description

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#112 (closed)

marked this issue as blocked by eclipsefdn/it/websites/marketplace.eclipse.org#112 (closed)

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#113 (closed)

marked this issue as blocked by eclipsefdn/it/websites/marketplace.eclipse.org#113 (closed)

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#114 (closed)

marked this issue as blocked by eclipsefdn/it/websites/marketplace.eclipse.org#114 (closed)

marked this issue as blocked by eclipsefdn/it/websites/marketplace.eclipse.org#115 (closed)

changed the description

marked the checklist item Oct 14 Oct 20: reminder + notification of the new validation rule as completed

marked the checklist item Nov 15: reminder about unpublishing in 1 month as completed

@mbarbero - At the Sept 20th Eclipse IDE WG call we discussed having the existing listings changed to https automatically (by a script kindly authored by someone at EF ). Is this still a possibility before Dec 15th? I have dozens of links that are quite painful to update by hand and I imagine others are in the same situation.

PS. If not, I will probably delete old entries rather update them, looking more closely now I can hardly see any value of maintaining entries to install features into versions of Eclipse from years ago.

@epoirier, can you provide me with a listing of all http only url from listing? I can then scan them and check if https would work.

Ok i'll get that for you

Hi @mbarbero, here is a dump of the urls that do not start with http://.

[... removed ...]

Let me know if you need anything else.

Thanks, got it. I've removed the list until it's actually fixed ;)

A quick review say that 347 over 741 links can be fixed automatically by changing the http scheme to https.

@epoirier, if I provide you with the sites to be updated, could you do a mass update of the DB?

Yes, provide me the links and I'll see what I can do.

Done, I've sent you a file with the listings' urls that can be updated to https://.

Thanks

Thanks, I'll have a look.

is there a way if our entries are ok or not: https://marketplace.eclipse.org/content/eclipse-xtend https://marketplace.eclipse.org/content/eclipse-xtext

You're good to go. See

❯ curl -sSL http://marketplace.eclipse.org/content/eclipse-xtend/api/p | xml sel -t -v '//updateurl'
https://download.eclipse.org/modeling/tmf/xtext/updates/composite/marketplace/

❯ curl -sSL http://marketplace.eclipse.org/content/eclipse-xtext/api/p | xml sel -t -v '//updateurl'
https://download.eclipse.org/modeling/tmf/xtext/updates/composite/marketplace/

marked the checklist item Dec 5: reminder about unpublishing in 10 days as completed

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#115 (closed)

@mbarbero I found out today our entry (sigasi) has been unlisted. Reminder emails probably were sent only to a now-defunct email address. What is the procedure to get our entry back? Currently can't see it in my account on https://marketplace.eclipse.org.

@epoirier, would you mind helping @bbrosens wit this? Thanks!

Actual @bbrosens, please open a ticket at https://gitlab.eclipse.org/eclipsefdn/it/websites/marketplace.eclipse.org/-/issues with details about the solution to be re-published/fixed.

Thank you @mbarbero

I've created issue eclipsefdn/it/websites/marketplace.eclipse.org#123 (closed)

Hi @mbarbero our solution (P4Eclipse) was unpublished from the marketplace. Can you please guide us on the process of republishing that again. What part of the listing needs to change and who do we contact for this? Would appreciate your support! Thank you

Please open a ticket at https://gitlab.eclipse.org/eclipsefdn/it/websites/marketplace.eclipse.org/-/issues with details about the solution to be re-published/fixed.

If your solution has been depublished and you want it to be reinstated, please open a ticket at https://gitlab.eclipse.org/eclipsefdn/it/websites/marketplace.eclipse.org/-/issues with details about the solution to be re-published/fixed. You should probably also update your contact email for the solution, as there has been a couple of reminders sent to those before the depublishing date. Thanks!

@mbarbero quick question about the yellow warning message on the marketplace website.

I removed it for now since the message was mentioning dates from last week but should we keep it and update the message? Or should I have just kept it as is on the site?

Thanks.

Good catch. I guess we should provide an info (blue?) message stating something like:

Please be aware that some listings have been temporarily from our marketplace in order to improve the security of the platform. We apologize for any inconvenience this may caused.

For more information on this matter, please visit #1 (closed).

If you are a listing owner and would like to have your listing(s) reinstated, please open a ticket at https://gitlab.eclipse.org/eclipsefdn/it/websites/marketplace.eclipse.org/-/issues.

Thank you for your understanding and cooperation.

Sounds good, I'll make that change.

thank you

I updated the block:

https://marketplace.eclipse.org/

Let me know if there's anything else.

mentioned in issue eclipsefdn/it/websites/marketplace.eclipse.org#125 (closed)

marked the checklist item Dec 15: notification about unpublishing + reminder about deletion EOF January as completed

marked the checklist item On December 15th, we will un-publish all solutions having plain http links. We will reach out to owners one last about the unpublishing of their solutions, giving them 45 days (until January 30th) to fix them. After this date, solutions that don't match the new requirements will be permanently removed. as completed