request verfication for a plugin makes the previous verified version not visible in the plugin catalog on the IDE

[priyanahata]

Apache NetBeans version

Apache NetBeans 28

What happened

Seem like when adding a new version of the plugin on the portal, makes the last previous verified version disappear from the list of plugins visible from the IDE

Language / Project Type / NetBeans Component

plugin portal

How to reproduce

steps to reproduce
add a plugin to the plugin portal
wait for verification
add a new version of the plugin and request verification
plugin disappears from the plugins list in the IDE

Or it may just be that adding a new version makes the last verified version invisible on netbeans

what is the expected behaviour?

Did this work correctly in an earlier version?

No / Don't know

Operating System

ubuntu 24.04

JDK

openjdk 25

Apache NetBeans packaging

Apache NetBeans Snap Package, Other

Anything else

tried it from a Snap installed netbeans and from a unzipped netbeans, same issue either way

Are you willing to submit a pull request?

Yes

[neilcsmith-net]

Moving to discussions for now as https://github.com/apache/netbeans-tools doesn't have issues enabled.

cc/ @matthiasblaesing @jkovalsky

[matthiasblaesing]

@priyanahata please stop highjacking every discussion. If your comments are not on topic, it is considered abuse.

[priyanahata]

@matthiasblaesing no highjaking, we dont see the plugin in the "available plugins" section even though it has one verified version

[matthiasblaesing]

This:

Thanks, have you tried our plugin? can you please try it, it is on NetBeans TV https://www.youtube.com/@anahata108

has nothing to do with the topic. It is just advertisement.

[matthiasblaesing]

@priyanahata you can request a new verification while another is active:

The screenshot shows that NB28, there is an active verification and another is being requested.

[priyanahata]

but can you see the Anahata plugin on your netbeans? I cant and we have a verified version in

[priyanahata]

Or i can open another issue: Verified plugin doesnt show on netbeans? i just want to know what the politically correct way is

[priyanahata]

and @matthiasblaesing @neilcsmith-net narayan tried yesterday on a freshly installed nb and he couldnt see it either, we installed it via manual plugin installation and the about panel was trashing with image loading errors, after manual installation it wasnt able to read files from disk but all good after a nb restart.
when i tried manual installation (after deleting the cache dir, a few times) it was throwing a TimeoutException (which narayan didnt get)

[matthiasblaesing]

@priyanahata there is no verified version. So of course it is not listed for installation.

[priyanahata]

I remember an email with Geertja and another guy verifying the plugin saying
name - GO
some other name - GO

[priyanahata]

so is there one or two manual process verification steps (visible and verified) or do both go together?

[matthiasblaesing]

For a new version of a plugin two verifiers need to cast a go vote so that a version becomes "verified".

[priyanahata]

[priyanahata]

[priyanahata]

so what is that email we got @matthiasblaesing ? can a verified plugin become unverified? i dont see it in the catalog.xml.gz, i just downloaded it

[priyanahata]

also, what is the usual turnaround time for verification? these things move fast and manual installation seems buggy

[matthiasblaesing]

@priyanahata I expect verification to take days to weeks. Depending on the time of the volunteers.

[priyanahata]

thanks @matthiasblaesing, so is there a glitch there because i got an email saying it was verified and it is not showing? can you confirm if this is a bug or wether requesting verification for a higher version makes the previous verified one invalid? or is the email that i got just related to the "visibility" of the plugin? also, is there a public api for installing nbm modules? i know from netbeans you cand do "install / reload in development IDE" (incredible feature, by the way) , can one do that programmatically?

[priyanahata]

I mean, is it possible to have an auto-update feature in the plugin itself that checks maven central for newer nbm versions and offer the user the possibility to install it in an "this version hasnt been verified by netbeans staff, are you sure you want to upgrade to the latest beta"? I am sure you are busy but with these LLM things, you can get daily quirks like this: https://discuss.ai.google.dev/t/gemini-responds-with-structured-json-like-output-only-when-function-calling-is-enabled/112993/52

This was the gemini api "out of the blue" responding with wired outputs, i saw on the web that some other IDE devs type of people rolled out an emergency patch to workaround this. The google guys took two days to fix it but you know, from our point of view, having the possibility of giving the user an "emergency patch" from the IDE itself would be good

Thank you thank you thank you.... Go NetBeans forever!

[priyanahata]

The other "negative" feedback i can give is that as a first time plugin developer, i got confused on the "how to update your plugin" at first, i thought i had to deploy a new plugin, then it told me that there was already a plugin with those maven groupid/artifact id, so i think i deleted it and recreated or later realised that clicking the "refresh" icon pulls metadata from maven and you dont have to "add a new plugin".

I´d love to do one contribution to netbeans @matthiasblaesing and @neilcsmith-net, let us know if we can help and proove our love for netbeans

[matthiasblaesing]

My final word on this:

• The most probable reason for the missing verification today is, that it was manually dropped:
  • by removing the corresponding NB-Version <-> Plugin Version association
  • by manually dropping the verification
• If the plugin is not stable enough to survive a few days without updates, it is a bad fit for the plugin portal.
• NetBeans allows users to register their own update center (Tools -> Plugins -> Settings). An update center is just an XML file, that holds a list of plugins and their metadata. You can create your own.
• All plugins that are associated with a NB version in the Plugin Portal, independent of their verification status, are available from the update center with the URL https://plugins.netbeans.apache.org/data/NBVERSION/catalog-experimental.xml.gz. The verified list is available as https://plugins.netbeans.apache.org/data/NBVERSION/catalog.xml.gz

[priyanahata]

The plugin is stable, what is not stable is the gemini api, like when you write a mysql driver or a mysql plugin and a database update breaks the workflow. you could still work with gemini flash 2.5 but you know, if you want to give nb users what they truly deserve (The best) you want to be able to address those pains on the fly. we are trying to beat intellij, vs code, j developer, eclipse, antigravity, open code, claude and everything else

i also thought about the "our own update center" and our own "NetBeans ASI" distro but with ai on the table, i wouldnt want to go down the "linux distro" road.

it has to be team work, it has to be a netbeans rave party and given the fact that we have fed our many children for many years using netbeans, we have to love you, there is no plan b, no other option, we have to surrender to nb

Not my final word though @matthiasblaesing, happy to change my position if needed be for as long as we keep the plugin a 50/50 balance between fun and productivity (the two categories requested in the plugin portal). Initally i thought i could create the "Super Intelligence" category or an "ASI" category by just putting that on Bundle.properties but that didnt fly through

Is there a possibility that a "malicious netbeans volunteer" could have removed the verification status or hacked the plugin portal to make it "not show" in the plugins popup? (the one available via Tools -> Plugins). We have several competitors like Jeddict AI and some chatgpt plugin, i would like to discard that as part of the issue triage

[priyanahata]

If the "malicious netbeans volunteer" thesis got traction, i would be happy to develop a "malicious nb volunteer" tracking databse CVE syle with a netbeans front end, just putting some ideas out there

[neilcsmith-net]

• If the plugin is not stable enough to survive a few days without updates, it is a bad fit for the plugin portal.

Totally agree with @matthiasblaesing here. This is not a good fit for the plugin portal or our resources to manage it. Consider a separate update centre, or even a separate (non-NetBeans branded) IDE distribution for this.

You could consider a plugin that wrapped your own update centre - eg. like https://plugins.netbeans.apache.org/catalogue/?id=77 Verifiers will need to take a careful look at that the security implications of that approach with your plugin.

... it is on NetBeans TV

I have no idea what that is, but note that NetBeans is an ASF trademark, and any usage should respect that.

If the "malicious netbeans volunteer" thesis got traction ...

It didn't! Closing and locking this.