Add marketplace.json

[filiptronicek]

This PR sets the URL for deprecated, malicious and other special extensions in product.json with values fit for https://open-vsx.org. It would be great to have it under Eclipse, but for now it's under https://github.com/gitpod-io/gitpod/blob/main/components/ide-proxy/static/code/marketplace.json.

This PR fixes gitpod-io/gitpod#10847.

How to test

1. Open this PR in Gitpod
2. Wait for the new window of VS Code to open
3. Search for KnisterPeter.vscode-github in the extensions tab
4. Make sure there is no install button

[jeanp413]

Great 🎉 but I have one question: Do we need to take into account selfhosted too or not? is it Ok to assume they have acces to Github? cc @filiptronicek @akosyakov

[filiptronicek]

Great 🎉 but I have one question: Do we need to take into account selfhosted too or not? is it Ok to assume they have acces to Github?

I think we should take them into account, @jeanp413, good point about the GitHub access. For them maybe we can (and do this for SaaS as well) just wget the file from Github so it ends up in the IDE image and we can request it through blobserve every time that image gets rebuilt, although maybe for critical updates (newly found malicious extensions) that's not fast enough :/. Or somehow proxy the file URL?

Also we should only include this for self-hosted if they don't self-host Open VSX, because otherwise there might be errors.

[akosyakov]

Why don't we put it IDE proxy as a static resource? Later IDE proxy can just forward connections to OpenVSX.

[filiptronicek]

Why don't we put it IDE proxy as a static resource? Later IDE proxy can just forward connections to OpenVSX.

If we did that, @akosyakov, would the file still point to the GitHub file (i.e. could we change the file after deployment by updating it on GitHub)? I think that is pretty important as I mentioned with self hosted who perhaps don't deploy so often when there are new malicious extensions.

[akosyakov]

If we did that, @akosyakov, would the file still point to the GitHub file (i.e. could we change the file after deployment by updating it on GitHub)? I think that is pretty important as I mentioned with self hosted who perhaps don't deploy so often when there are new malicious extensions.

I don't think posting on GitHub is good solution for Self-Hosted. It should be either within their network, since they can always can connect to it, i.e. on IDE proxy, or fetched from OpenVSX. GitHub is not necessary available to them. So for now putting it in IDE proxy directly is a step in right direction.

[filiptronicek]

@akosyakov or we could add this to Open VSX proxy as an endpoint 🤔 (this means we could afterwards also modify the GitHub URL to point to Eclipse instead of us)

[akosyakov]

@akosyakov or we could add this to Open VSX proxy as an endpoint 🤔 (this means we could afterwards also modify the GitHub URL to point to Eclipse instead of us)

IDE proxy is interface of IDE team to the world, OpenVSX proxy is behind IDE proxy as well to forward traffic. It does not have other responsibilities.

[filiptronicek]

For now, I agree we can just pull the file as a static asset with IDE Proxy. I will make a PR in https://github.com/gitpod-io/gitpod for that.

After and if we push EclipseFdn/open-vsx.org#1121 forward, Eclipse can maybe proxy the file via https://open-vsx.org so it will be available through Open VSX Proxy automatically.

[filiptronicek]

I have made gitpod-io/gitpod#11361 which adds this to our proxy. You can try this out in the preview environment: https://ft-add-ext649a97d67d.preview.gitpod-dev.com/workspaces and I have confirmed that the rewrite works correctly. Anything else you think we should do before merging and deploying, @akosyakov & @jeanp413?

[jeanp413]

Looks good need to wait for gitpod-io/gitpod#11361 to be merged and deployed

[filiptronicek]

@jeanp413 could you please merge? 🙏