Decouple org.eclipse.oomph.setup.core from direct Apache HttpClient 5 package imports

[DmitryZagr]

Description:

Currently, org.eclipse.oomph.setup.core (v1.35.0+) has a hard dependency on org.apache.hc.client5.http.cookie via Import-Package. This forced dependency prevents the use of Oomph in lightweight or customized Eclipse distributions that prefer the native Java 11+ HttpClient (provided by org.eclipse.ecf.provider.filetransfer.httpclientjava) over the Apache implementation.

Reasons for Change:

1. Transport Agnosticism: Oomph should ideally rely on the ECF Filetransfer abstraction rather than a specific low-level HTTP client implementation. Hardcoding Apache HttpClient 5 packages breaks the pluggable nature of ECF providers.
2. Reduced Footprint: Environments aiming to minimize dependencies by using built-in JDK 11+ capabilities are currently forced to include the entire Apache HttpClient 5 stack solely to satisfy this Oomph requirement.
3. Flexibility: Users operating behind restrictive proxies or in specific enterprise environments often need to switch between httpclient5 and httpclientjava to resolve connectivity issues. A hard dependency on one makes this troubleshooting or optimization impossible.

Proposed Solution:

• Refactor Cookie Management: Move the specific cookie handling logic behind an interface or use ECF's internal cookie handling if possible.
• Optional Resolution: If direct access to HttpClient 5 features is necessary for specific use cases, consider marking the package import as optional (resolution:=optional) and implementing a graceful fallback or a service-based approach.

[merks]

The stupid thing is I don't think this even works anymore so I doubt anyone is using it. I used to use for logging in to access private GitHub repositories but that stopped working when GitHub enforce using a PAT.

So now I use this with my PAT:

https://eclipse.dev/oomph/?file=Authoring_Guide.md#accessing-setups-that-require-authentication

Maybe I should just remove it and see if anyone complains...

[merks]

Hmmm, it is used in places like this, but I don't know if that actually works anymore or if it's really needed because there is no bugzill and no git.eclipse.org where one might use such a password:

[merks]

In any case, this is quite some work to verify what if anything is really needed. ☹️

[merks]

I do suspect all of this is kind of bogus or kind of useless now, but I do need to review it more carefully that first appeared to be the case. So I'll need more time. Sorry.

[merks]

I've made the package imports optional and refactored to code to handle the missing packages gracefully. I did not test that everything works well with the packages actually missing. Given the 12 votes here, I am hopeful that someone will test the nightly build as soon as possible.

• https://download.eclipse.org/oomph/updates/nightly/latest/
• https://download.eclipse.org/oomph/drops/nightly/N20260428-083728/

Tomorrow I will be build an M2 milestone for contribution SimRel 2026-06 M2...

I'll mark this as revolved, but if there remain problem, please let me know immediately.

[DmitryZagr-1C]

Thank you for your great work!

[merks]

Thank you for your great work!

I can hope it's great in this case. 😁