Build with tycho deletes proxy user credentials in Eclipse

[SebasHein]

I have a weird problem I was not able to solve (nor am I be near to find the root cause of this)

Every time I start a build with maven tycho - tycho shows an error message (see below for full stack tracke
"Unable to locate secure storage module".
Afterwards it compiles without error (with downloading target platform stuff from internet).
The problem is: afterwards every eclipse instance I have has a deleted secure storage.

I use maven 3.8.6, tycho 3.0.4, Java 17 and an different eclipse versions (ranging from somewhat 2022 to 2023-09).
Yes I know these are not the latest releases but changeing the environment for several projekts is a rather huge task.
I am behind a company proxy - that's the main reason why I need the proxy settings to be set within the eclipse.
It's not located to something I specifically did - my colleagues suffer of the same issue.

I tried to search with google (of course) and had a rough look at the issues contained in this project - but I found nothing helpful.

What is also maybe worth to mention is, that during a maven build without usage of tycho everything runs fine (maven per se should not be aware of eclipse stuff so thats in general no surprise).

First question is if this is a known problem that is solved in later versions of tycho?
If so please just mention it, take my appologies for bothering you and close the issue.
If not: maybe we can dig further and find the root cause of this. I am willing to help and to provide any information you maybe need.

[�[1;31mERROR�[m] [8291c992-bae0-45c3-870c-c853460a03b2][extension>org.eclipse.tycho:tycho-maven-plugin:3.0.4] Unable to locate secure storage module (org.eclipse.equinox.security.windowspasswordprovider64bit). �[1;31morg.eclipse.equinox.security.storage.StorageException�[m: �[1;31mUnable to locate secure storage module (org.eclipse.equinox.security.windowspasswordprovider64bit).�[m �[1mat�[m org.eclipse.equinox.internal.security.storage.PasswordProviderSelector.findStorageModule (�[1mPasswordProviderSelector.java:215�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferencesRoot.getModulePassword (�[1mSecurePreferencesRoot.java:227�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferencesRoot.getPassword (�[1mSecurePreferencesRoot.java:220�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferences.get (�[1mSecurePreferences.java:267�[m) �[1mat�[m org.eclipse.equinox.internal.security.storage.SecurePreferencesWrapper.get (�[1mSecurePreferencesWrapper.java:123�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyType.loadProxyAuth (�[1mProxyType.java:559�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyType.createProxyData (�[1mProxyType.java:145�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyType.getProxyData (�[1mProxyType.java:134�[m) �[1mat�[m org.eclipse.core.internal.net.PreferenceManager.migrateInstanceScopePreferences (�[1mPreferenceManager.java:287�[m) �[1mat�[m org.eclipse.core.internal.net.PreferenceManager.migrate (�[1mPreferenceManager.java:256�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyManager.checkMigrated (�[1mProxyManager.java:386�[m) �[1mat�[m org.eclipse.core.internal.net.ProxyManager.initialize (�[1mProxyManager.java:258�[m) �[1mat�[m org.eclipse.core.internal.net.Activator.start (�[1mActivator.java:177�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl$2.run (�[1mBundleContextImpl.java:818�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl$2.run (�[1mBundleContextImpl.java:1�[m) �[1mat�[m java.security.AccessController.doPrivileged (�[1mAccessController.java:569�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl.startActivator (�[1mBundleContextImpl.java:810�[m) �[1mat�[m org.eclipse.osgi.internal.framework.BundleContextImpl.start (�[1mBundleContextImpl.java:767�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle.startWorker0 (�[1mEquinoxBundle.java:1032�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle$EquinoxModule.startWorker (�[1mEquinoxBundle.java:371�[m) �[1mat�[m org.eclipse.osgi.container.Module.doStart (�[1mModule.java:605�[m) �[1mat�[m org.eclipse.osgi.container.Module.start (�[1mModule.java:468�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel$2.run (�[1mModuleContainer.java:1852�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxContainerAdaptor$1$1.execute (�[1mEquinoxContainerAdaptor.java:136�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.incStartLevel (�[1mModuleContainer.java:1845�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.incStartLevel (�[1mModuleContainer.java:1788�[m) �[1mat�[m org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.doContainerStartLevel (�[1mModuleContainer.java:1750�[m) �[1mat�[m org.eclipse.osgi.container.SystemModule.startWorker (�[1mSystemModule.java:269�[m) �[1mat�[m org.eclipse.osgi.container.Module.doStart (�[1mModule.java:605�[m) �[1mat�[m org.eclipse.osgi.container.Module.start (�[1mModule.java:468�[m) �[1mat�[m org.eclipse.osgi.container.SystemModule.start (�[1mSystemModule.java:193�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle.start (�[1mEquinoxBundle.java:445�[m) �[1mat�[m org.eclipse.osgi.internal.framework.EquinoxBundle.start (�[1mEquinoxBundle.java:464�[m) �[1mat�[m org.eclipse.osgi.launch.Equinox.start (�[1mEquinox.java:139�[m) �[1mat�[m org.eclipse.sisu.osgi.connect.PlexusFrameworkConnectServiceFactory.getFramework (�[1mPlexusFrameworkConnectServiceFactory.java:150�[m) �[1mat�[m org.eclipse.sisu.osgi.connect.PlexusFrameworkConnectServiceFactory.locateClass (�[1mPlexusFrameworkConnectServiceFactory.java:368�[m) �[1mat�[m org.eclipse.sisu.osgi.connect.PlexusFrameworkConnectServiceFactory.getService (�[1mPlexusFrameworkConnectServiceFactory.java:352�[m) �[1mat�[m org.eclipse.tycho.osgi.TychoServiceFactory.getService (�[1mTychoServiceFactory.java:32�[m) �[1mat�[m org.eclipse.tycho.p2.resolver.P2DependencyResolver.initialize (�[1mP2DependencyResolver.java:497�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusLifecycleManager.initialize (�[1mPlexusLifecycleManager.java:303�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusLifecycleManager.activate (�[1mPlexusLifecycleManager.java:207�[m) �[1mat�[m org.eclipse.sisu.bean.BeanScheduler.schedule (�[1mBeanScheduler.java:151�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusLifecycleManager.manage (�[1mPlexusLifecycleManager.java:147�[m) �[1mat�[m org.eclipse.sisu.plexus.PlexusBeanBinder.afterInjection (�[1mPlexusBeanBinder.java:72�[m) �[1mat�[m com.google.inject.internal.MembersInjectorImpl.notifyListeners (�[1mMembersInjectorImpl.java:131�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector.provision (�[1mConstructorInjector.java:125�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector.access$000 (�[1mConstructorInjector.java:32�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector$1.call (�[1mConstructorInjector.java:98�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:112�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:127�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback.provision (�[1mProvisionListenerStackCallback.java:66�[m) �[1mat�[m com.google.inject.internal.ConstructorInjector.construct (�[1mConstructorInjector.java:93�[m) �[1mat�[m com.google.inject.internal.ConstructorBindingImpl$Factory.get (�[1mConstructorBindingImpl.java:306�[m) �[1mat�[m com.google.inject.internal.InjectorImpl$1.get (�[1mInjectorImpl.java:1050�[m) �[1mat�[m com.google.inject.internal.InjectorImpl.getInstance (�[1mInjectorImpl.java:1086�[m) �[1mat�[m org.eclipse.sisu.space.AbstractDeferredClass.get (�[1mAbstractDeferredClass.java:48�[m) �[1mat�[m com.google.inject.internal.ProviderInternalFactory.provision (�[1mProviderInternalFactory.java:85�[m) �[1mat�[m com.google.inject.internal.InternalFactoryToInitializableAdapter.provision (�[1mInternalFactoryToInitializableAdapter.java:57�[m) �[1mat�[m com.google.inject.internal.ProviderInternalFactory$1.call (�[1mProviderInternalFactory.java:66�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:112�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (�[1mProvisionListenerStackCallback.java:127�[m) �[1mat�[m com.google.inject.internal.ProvisionListenerStackCallback.provision (�[1mProvisionListenerStackCallback.java:66�[m) �[1mat�[m com.google.inject.internal.ProviderInternalFactory.circularGet (�[1mProviderInternalFactory.java:61�[m) �[1mat�[m com.google.inject.internal.InternalFactoryToInitializableAdapter.get (�[1mInternalFactoryToInitializableAdapter.java:47�[m) �[1mat�[m com.google.inject.internal.InjectorImpl$1.get (�[1mInjectorImpl.java:1050�[m) �[1mat�[m org.eclipse.sisu.inject.Guice4$1.get (�[1mGuice4.java:162�[m) �[1mat�[m org.eclipse.sisu.inject.LazyBeanEntry.getValue (�[1mLazyBeanEntry.java:81�[m) �[1mat�[m org.eclipse.sisu.plexus.LazyPlexusBean.getValue (�[1mLazyPlexusBean.java:51�[m) �[1mat�[m org.codehaus.plexus.DefaultPlexusContainer.lookup (�[1mDefaultPlexusContainer.java:263�[m) �[1mat�[m org.codehaus.plexus.DefaultPlexusContainer.lookup (�[1mDefaultPlexusContainer.java:255�[m) �[1mat�[m org.eclipse.tycho.core.resolver.DefaultDependencyResolverFactory.lookupDependencyResolver (�[1mDefaultDependencyResolverFactory.java:66�[m) �[1mat�[m org.eclipse.tycho.core.resolver.DefaultDependencyResolverFactory.lookupDependencyResolver (�[1mDefaultDependencyResolverFactory.java:43�[m) �[1mat�[m org.eclipse.tycho.core.resolver.DefaultTychoResolver.setupProject (�[1mDefaultTychoResolver.java:109�[m) �[1mat�[m org.eclipse.tycho.core.maven.TychoMavenLifecycleParticipant.afterProjectsRead (�[1mTychoMavenLifecycleParticipant.java:139�[m) �[1mat�[m org.apache.maven.DefaultMaven.doExecute (�[1mDefaultMaven.java:253�[m) �[1mat�[m org.apache.maven.DefaultMaven.doExecute (�[1mDefaultMaven.java:192�[m) �[1mat�[m org.apache.maven.DefaultMaven.execute (�[1mDefaultMaven.java:105�[m) �[1mat�[m org.apache.maven.cli.MavenCli.execute (�[1mMavenCli.java:960�[m) �[1mat�[m org.apache.maven.cli.MavenCli.doMain (�[1mMavenCli.java:293�[m) �[1mat�[m org.apache.maven.cli.MavenCli.main (�[1mMavenCli.java:196�[m) �[1mat�[m jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (�[1mNative Method�[m) �[1mat�[m jdk.internal.reflect.NativeMethodAccessorImpl.invoke (�[1mNativeMethodAccessorImpl.java:77�[m) �[1mat�[m jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (�[1mDelegatingMethodAccessorImpl.java:43�[m) �[1mat�[m java.lang.reflect.Method.invoke (�[1mMethod.java:568�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (�[1mLauncher.java:282�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.launch (�[1mLauncher.java:225�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (�[1mLauncher.java:406�[m) �[1mat�[m org.codehaus.plexus.classworlds.launcher.Launcher.main (�[1mLauncher.java:347�[m)

[laeubi]

Tycho 3 is EOL, so unless you plan to contribute/fund a fix and release I suggest you update to Tycho 4 that no longer uses Eclipse Proxy Service anymore.

[SebasHein]

I tried to do so and used tycho 4.0.9 together with maven 3.9.8.

Within settings.xml I created both a http and https proxy section.
Downloads from central are working fine - e.g.:

[INFO] Tycho Version: 4.0.9 (e901909)
[INFO] Tycho Mode: extension
[INFO] Tycho Builder: maven
[INFO] Build Threads: 1
Downloading from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/maven-metadata.xml (946 B at 13 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/eclipse/tycho/tycho-compiler-plugin/4.0.9/tycho-compiler-plugin-4.0.9.pom

But as resolving target definition file starts
[INFO] ### Using TychoRepositoryTransport for remote P2 access ###
[INFO] Cache location: C:\Users\user.m2\repository.cache\tycho
[INFO] Transport mode: online
[INFO] Http Transport type: Java11Client
[INFO] Update mode: forced
[INFO] Minimum cache duration: 60 minutes
[INFO] (you can configure this with -Dtycho.p2.transport.min-cache-minutes=)
[INFO] Downloading from p2: http://download.eclipse.org/releases/2021-12/p2.index

I get an exception
[ERROR] Failed to resolve target definition file: ... Failed to load p2 metadata repository from location http://download.eclipse.org/releases/2021-12: Unable to read repository at http://download.eclipse.org/releases/2021-12. AuthenticationFailedException

Can you suggest where to start investigations why I get this error?
I can upload the debug messages (-X -e maven cli parameter output) but since this is a lot of text I wanted to ask first whether that would be helpful.

I looks like it is working in principle - 10 minutes ago with tycho 3.0.5 everything was fine and resolving of target platform without issue.

[SebasHein]

With -X -e maven shows an authentication failed exception.

I found within release notes (https://github.com/eclipse-tycho/tycho/blob/main/RELEASE_NOTES.md) that it is possible to switch back to old custom P2 transport (with -Dtycho.p2.httptransport.type=JavaUrl).
It it is working again with this - so the problem is assumed to be somewhere located within new http11 client usage.

It looks like that the username and password given in settings.xml for proxy authentification is read out correct. At least the content within org.eclipse.tycho.p2maven.helper.ProxyHelper at debugging tycho looks good.

Than I found that with -Djdk.http.auth.tunneling.disabledSchemes="" attached the connection through proxy to resolve target definition is working. (see https://stackoverflow.com/questions/53333556/proxy-authentication-with-jdk-11-httpclient or https://www.oracle.com/java/technologies/javase/8u111-relnotes.html)

That means setting environment variable (on windows) JAVA_TOOL_OPTIONS with value -Djdk.http.auth.tunneling.disabledSchemes="" leads to an environment with which tycho 4.0.9 (or 5.0.0-SNAPSHOT) is working again in my environment.
Obviously our company proxy requires basic authentication which is disabled per default - see link above.
I have not that much experience in implementing the proxy stuff - therefore I cannot tell whether this is a bug or expected behaviour (although it looks much like the latter). Maybe someone can comment on this?

Or is it possible in to add a somehow configurable header in Java11HttpTransportFactory at creating the HttpRequest (line 127)?