Build with tycho deletes proxy user credentials in Eclipse

[SebasHein]

I have a weird problem I was not able to solve (nor am I be near to find the root cause of this)

Every time I start a build with maven tycho - tycho shows an error message (see below for full stack tracke
"Unable to locate secure storage module".
Afterwards it compiles without error (with downloading target platform stuff from internet).
The problem is: afterwards every eclipse instance I have has a deleted secure storage.

I use maven 3.8.6, tycho 3.0.4, Java 17 and an different eclipse versions (ranging from somewhat 2022 to 2023-09).
Yes I know these are not the latest releases but changeing the environment for several projekts is a rather huge task.
I am behind a company proxy - that's the main reason why I need the proxy settings to be set within the eclipse.
It's not located to something I specifically did - my colleagues suffer of the same issue.

I tried to search with google (of course) and had a rough look at the issues contained in this project - but I found nothing helpful.

What is also maybe worth to mention is, that during a maven build without usage of tycho everything runs fine (maven per se should not be aware of eclipse stuff so thats in general no surprise).

First question is if this is a known problem that is solved in later versions of tycho?
If so please just mention it, take my appologies for bothering you and close the issue.
If not: maybe we can dig further and find the root cause of this. I am willing to help and to provide any information you maybe need.

[�[1;31mERROR�[m] [8291c992-bae0-45c3-870c-c853460a03b2][extension>org.eclipse.tycho:tycho-maven-plugin:3.0.4] Unable to locate secure storage module (org.eclipse.equinox.security.windowspasswordprovider64bit). �[1;31morg.eclipse.equinox.security.storage.StorageException�[m: �[1;31mUnable to locate secure storage module (org.eclipse.equinox.security.windowspasswordprovider64bit).�[m �[1mat�[m org.eclipse.equinox.internal.security.storage.PasswordProviderSelector.findStorageModule (�[1mPasswordProviderSelector.java:215�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferencesRoot.getModulePassword (�[1mSecurePreferencesRoot.java:227�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferencesRoot.getPassword (�[1mSecurePreferencesRoot.java:220�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferences.get (�[1mSecurePreferences.java:267�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferencesWrapper.get (�[1mSecurePreferencesWrapper.java:123�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyType.loadProxyAuth (�[1mProxyType.java:559�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyType.createProxyData (�[1mProxyType.java:145�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyType.getProxyData (�[1mProxyType.java:134�[m) �[1mat�[m org.eclipse.core.internal.net.PreferenceManager.migrateInstanceScopePreferences (�[1mPreferenceManager.java:287�[m) �[1mat�[m org.eclipse.core.internal.net.PreferenceManager.migrate (�[1mPreferenceManager.java:256�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyManager.checkMigrated (�[1mProxyManager.java:386�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyManager.initialize (�[1mProxyManager.java:258�[m) �[1mat�[m org.eclipse.core.internal.net.Activator.start (�[1mActivator.java:177�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl$2.run (�[1mBundleContextImpl.java:818�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl$2.run (�[1mBundleContextImpl.java:1�[m) �[1mat�[m java.security.AccessController.doPrivileged (�[1mAccessController.java:569�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl.startActivator (�[1mBundleContextImpl.java:810�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl.start (�[1mBundleContextImpl.java:767�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle.startWorker0 (�[1mEquinoxBundle.java:1032�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle$EquinoxModule.startWorker (�[1mEquinoxBundle.java:371�[m) �[1mat�[m org.eclipse.osgi.container.Module.doStart (�[1mModule.java:605�[m) �[1mat�[m org.eclipse.osgi.container.Module.start (�[1mModule.java:468�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel$2.run (�[1mModuleContainer.java:1852�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxContainerAdaptor$1$1.execute (�[1mEquinoxContainerAdaptor.java:136�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.incStartLevel (�[1mModuleContainer.java:1845�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.incStartLevel (�[1mModuleContainer.java:1788�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.doContainerStartLevel (�[1mModuleContainer.java:1750�[m) �[1mat�[m org.eclipse.osgi.container.SystemModule.startWorker (�[1mSystemModule.java:269�[m) �[1mat�[m org.eclipse.osgi.container.Module.doStart (�[1mModule.java:605�[m) �[1mat�[m org.eclipse.osgi.container.Module.start (�[1mModule.java:468�[m) �[1mat�[m org.eclipse.osgi.container.SystemModule.start (�[1mSystemModule.java:193�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle.start (�[1mEquinoxBundle.java:445�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle.start (�[1mEquinoxBundle.java:464�[m) �[1mat�[m org.eclipse.osgi.launch.Equinox.start (�[1mEquinox.java:139�[m) �[1mat�[m org.eclipse.sisu.osgi.connect.PlexusFrameworkConnectServiceFactory.getFramework (�[1mPlexusFrameworkConnectServiceFactory.java:150�[m) �[1mat�[m org.eclipse.sisu.osgi.connect.PlexusFrameworkConnectServiceFactory.locateClass (�[1mPlexusFrameworkConnectServiceFactory.java:368�[m) �[1mat�[m org.eclipse.sisu.osgi.connect.PlexusFrameworkConnectServiceFactory.getService (�[1mPlexusFrameworkConnectServiceFactory.java:352�[m) �[1mat�[m org.eclipse.tycho.osgi.TychoServiceFactory.getService (�[1mTychoServiceFactory.java:32�[m) �[1mat�[m org.eclipse.tycho.p2.resolver.P2DependencyResolver.initialize (�[1mP2DependencyResolver.java:497�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusLifecycleManager.initialize (�[1mPlexusLifecycleManager.java:303�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusLifecycleManager.activate (�[1mPlexusLifecycleManager.java:207�[m) �[1mat�[m org.eclipse.sisu.bean.BeanScheduler.schedule (�[1mBeanScheduler.java:151�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusLifecycleManager.manage (�[1mPlexusLifecycleManager.java:147�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusBeanBinder.afterInjection (�[1mPlexusBeanBinder.java:72�[m) �[1mat�[m com.google.inject.internal.MembersInjectorImpl.notifyListeners (�[1mMembersInjectorImpl.java:131�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector.provision (�[1mConstructorInjector.java:125�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector.access$000 (�[1mConstructorInjector.java:32�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector$1.call (�[1mConstructorInjector.java:98�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:112�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:127�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback.provision (�[1mProvisionListenerStackCallback.java:66�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector.construct (�[1mConstructorInjector.java:93�[m) �[1mat�[m com.google.inject.internal.ConstructorBindingImpl$Factory.get (�[1mConstructorBindingImpl.java:306�[m) �[1mat�[m com.google.inject.internal.InjectorImpl$1.get (�[1mInjectorImpl.java:1050�[m) �[1mat�[m com.google.inject.internal.InjectorImpl.getInstance (�[1mInjectorImpl.java:1086�[m) �[1mat�[m org.eclipse.sisu.space.AbstractDeferredClass.get (�[1mAbstractDeferredClass.java:48�[m) �[1mat�[m com.google.inject.internal.ProviderInternalFactory.provision (�[1mProviderInternalFactory.java:85�[m) �[1mat�[m com.google.inject.internal.InternalFactoryToInitializableAdapter.provision (�[1mInternalFactoryToInitializableAdapter.java:57�[m) �[1mat�[m com.google.inject.internal.ProviderInternalFactory$1.call (�[1mProviderInternalFactory.java:66�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:112�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:127�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback.provision (�[1mProvisionListenerStackCallback.java:66�[m) �[1mat�[m com.google.inject.internal.ProviderInternalFactory.circularGet (�[1mProviderInternalFactory.java:61�[m) �[1mat�[m com.google.inject.internal.InternalFactoryToInitializableAdapter.get (�[1mInternalFactoryToInitializableAdapter.java:47�[m) �[1mat�[m com.google.inject.internal.InjectorImpl$1.get (�[1mInjectorImpl.java:1050�[m) �[1mat�[m org.eclipse.sisu.inject.Guice4$1.get (�[1mGuice4.java:162�[m) �[1mat�[m org.eclipse.sisu.inject.LazyBeanEntry.getValue (�[1mLazyBeanEntry.java:81�[m) �[1mat�[m org.eclipse.sisu.plexus.LazyPlexusBean.getValue (�[1mLazyPlexusBean.java:51�[m) �[1mat�[m org.codehaus.plexus.DefaultPlexusContainer.lookup (�[1mDefaultPlexusContainer.java:263�[m) �[1mat�[m org.codehaus.plexus.DefaultPlexusContainer.lookup (�[1mDefaultPlexusContainer.java:255�[m) �[1mat�[m org.eclipse.tycho.core.resolver.DefaultDependencyResolverFactory.lookupDependencyResolver (�[1mDefaultDependencyResolverFactory.java:66�[m) �[1mat�[m org.eclipse.tycho.core.resolver.DefaultDependencyResolverFactory.lookupDependencyResolver (�[1mDefaultDependencyResolverFactory.java:43�[m) �[1mat�[m org.eclipse.tycho.core.resolver.DefaultTychoResolver.setupProject (�[1mDefaultTychoResolver.java:109�[m) �[1mat�[m org.eclipse.tycho.core.maven.TychoMavenLifecycleParticipant.afterProjectsRead (�[1mTychoMavenLifecycleParticipant.java:139�[m) �[1mat�[m org.apache.maven.DefaultMaven.doExecute (�[1mDefaultMaven.java:253�[m) �[1mat�[m org.apache.maven.DefaultMaven.doExecute (�[1mDefaultMaven.java:192�[m) �[1mat�[m org.apache.maven.DefaultMaven.execute (�[1mDefaultMaven.java:105�[m) �[1mat�[m org.apache.maven.cli.MavenCli.execute (�[1mMavenCli.java:960�[m) �[1mat�[m org.apache.maven.cli.MavenCli.doMain (�[1mMavenCli.java:293�[m) �[1mat�[m org.apache.maven.cli.MavenCli.main (�[1mMavenCli.java:196�[m) �[1mat�[m jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (�[1mNative Method�[m) �[1mat�[m jdk.internal.reflect.NativeMethodAccessorImpl.invoke (�[1mNativeMethodAccessorImpl.java:77�[m) �[1mat�[m jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (�[1mDelegatingMethodAccessorImpl.java:43�[m) �[1mat�[m java.lang.reflect.Method.invoke (�[1mMethod.java:568�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (�[1mLauncher.java:282�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.launch (�[1mLauncher.java:225�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (�[1mLauncher.java:406�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.main (�[1mLauncher.java:347�[m)

[laeubi]

Tycho 3 is EOL, so unless you plan to contribute/fund a fix and release I suggest you update to Tycho 4 that no longer uses Eclipse Proxy Service anymore.

[SebasHein]

I tried to do so and used tycho 4.0.9 together with maven 3.9.8.

Within settings.xml I created both a http and https proxy section.
Downloads from central are working fine - e.g.:

[INFO] Tycho Version: 4.0.9 (e901909)
[INFO] Tycho Mode: extension
[INFO] Tycho Builder: maven
[INFO] Build Threads: 1
Downloading from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/maven-metadata.xml (946 B at 13 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/eclipse/tycho/tycho-compiler-plugin/4.0.9/tycho-compiler-plugin-4.0.9.pom

But as resolving target definition file starts
[INFO] ### Using TychoRepositoryTransport for remote P2 access ###
[INFO] Cache location: C:\Users\user.m2\repository.cache\tycho
[INFO] Transport mode: online
[INFO] Http Transport type: Java11Client
[INFO] Update mode: forced
[INFO] Minimum cache duration: 60 minutes
[INFO] (you can configure this with -Dtycho.p2.transport.min-cache-minutes=)
[INFO] Downloading from p2: http://download.eclipse.org/releases/2021-12/p2.index

I get an exception
[ERROR] Failed to resolve target definition file: ... Failed to load p2 metadata repository from location http://download.eclipse.org/releases/2021-12: Unable to read repository at http://download.eclipse.org/releases/2021-12. AuthenticationFailedException

Can you suggest where to start investigations why I get this error?
I can upload the debug messages (-X -e maven cli parameter output) but since this is a lot of text I wanted to ask first whether that would be helpful.

I looks like it is working in principle - 10 minutes ago with tycho 3.0.5 everything was fine and resolving of target platform without issue.

[SebasHein]

With -X -e maven shows an authentication failed exception.

I found within release notes (https://github.com/eclipse-tycho/tycho/blob/main/RELEASE_NOTES.md) that it is possible to switch back to old custom P2 transport (with -Dtycho.p2.httptransport.type=JavaUrl).
It it is working again with this - so the problem is assumed to be somewhere located within new http11 client usage.

It looks like that the username and password given in settings.xml for proxy authentification is read out correct. At least the content within org.eclipse.tycho.p2maven.helper.ProxyHelper at debugging tycho looks good.

Than I found that with -Djdk.http.auth.tunneling.disabledSchemes="" attached the connection through proxy to resolve target definition is working. (see https://stackoverflow.com/questions/53333556/proxy-authentication-with-jdk-11-httpclient or https://www.oracle.com/java/technologies/javase/8u111-relnotes.html)

That means setting environment variable (on windows) JAVA_TOOL_OPTIONS with value -Djdk.http.auth.tunneling.disabledSchemes="" leads to an environment with which tycho 4.0.9 (or 5.0.0-SNAPSHOT) is working again in my environment.
Obviously our company proxy requires basic authentication which is disabled per default - see link above.
I have not that much experience in implementing the proxy stuff - therefore I cannot tell whether this is a bug or expected behaviour (although it looks much like the latter). Maybe someone can comment on this?

Or is it possible in to add a somehow configurable header in Java11HttpTransportFactory at creating the HttpRequest (line 127)?

[Bananeweizen]

We also have a company proxy requiring NTLM authentication, and we simply use gontlm or px as local proxy to automatically authenticate any connection, without any passwords being stored. You should try that first before doing any other configuration, as it works for Eclipse, Maven and other tools. And Tycho 4 works better for that, as it doesn't touch the secure store anymore, so don't go back to Tycho 3.

[SebasHein]

Thanks for your reply but as I answered already above I did manage tycho 4 to work. There is no intention to go back to tycho 3. I am aware of px proxy but it is not allowed to install per It department rules.

But as I said above: It was basically not a tycho problem. It was a Java 11 http client issue with the configuration of allowed authentication schemes.

For me the problem is solved as Tycho 4 is now able to authenticate at proxy and doesn't delete secure store any more.

Slight drawback is as you mentioned, that the password needs to be stored somewhere but I think this discussion is out of topic for this issue.

In anyways: @laeubi : From my point of view this issue can safely be closed, and I am sorry I didn't earlier. I tried to summarize what I learned above in case somebody has the same problem.