I ran a quick scan on the project build and discovered a
few dependencies that I believe must be taken through the IP
Due Diligence Process.
Specifically these three "external" libraries (which I
believe are otherwise unmodified "OSGi-ified" versions of
third-party content):
org.glassfish.external:antlr:jar:2.7.7:compile
org.glassfish.external:dbschema:jar:6.6:compile
org.glassfish.external:derby:zip:10.13.1.1:compile
The first one is problematic. The Eclipse IP Team has
rejected all versions of ANTLR before 3.0 due to
provenance issues. This particular library needs to be
updated. Note that the build scripts reference both
the "external" and canonical versions of Antlr 2.7.7
(though, the latter is marked "optional").
We've seen other versions of Derby, but not the one
specified. We either need a new CQ for that specific
version, or one of the already approved versions used
instead.
I'm continuing my investigation; I'll let you know if I
find anything else.
Wayne
--
Wayne Beaton
Director of Open Source Projects | Eclipse Foundation, Inc.