3. Marketplace Announcements

UPDATE: Marketplace Versioning

2013-02-20T23:10:29Z

All,

As we prepare for an upcoming update release of Liferay CE and EE, we have identified a need for more strict version specifications in Apps that you submit to the Marketplace, to ensure a better user experience on the Marketplace. Previously, we required apps that were compatible with both CE and EE to only specify the CE version in their properties files, using a + notation to signal that the app is compatible with Liferay 6.1 CE GA2 and greater.

In order to provide a better end user experience, we are slightly changing this policy and require that you now specify which CE and EE versions for your Apps. So, if you have submitted an app using liferay-versions=6.1.1+, but your app is compatible with CE and EE, you will now be required to specify this (for example, liferay-versions=6.1.1+,6.1.20+). This way, potential customers for your App will see that the app is compatible with both CE and EE (previously it would appear that your app only worked with CE, when it in fact worked with both). This is required for all apps, including those that have already been approved (although your app will continue to be available on the Marketplace even if you do nothing).

The documentation has been updated to reflect this change.

So, to summarize:

If your app is compatible with CE and EE, you should change the version specifier in your app's liferay-plugin-package.properties file to read liferay-versions=6.1.1+,6.1.20+
If you do not make this change, your app not be installable for EE customers.
If your app is compatible with CE only, no changes are required.

For apps that are already approved and on the Marketplace, follow this procedure:

Re-build your app using an updated liferay-versions specifier as specified above
Login to liferay.com
Navigate to Places -> User Profile -> App Manager -> Apps (tab)
Next to your app, click Actions -> Edit
Click Add New Version at the bottom
Advance to the Versions screen
Enter a new version, and include a note in the What's New section to indicate that you are updating the version specifier only
Advance to the Edit App Packages screen
Upload your modified .WAR files with the liferay-versions change
Advance to the Preview App screen and click Submit for Review
Your changes will be reviewed as usual

For apps you have submitted that are in the Pending or Pending QA state, follow this procedure:

Re-build your app using an updated liferay-versions specifier as specified above
Login to liferay.com
Navigate to Places -> User Profile -> App Manager -> Apps (tab)
Next to your app, click Actions -> Edit
Click Cancel Submission at the bottom
Click Edit at the bottom
Advance to the Edit App Packages screen
Click Delete next to the old .WAR file
Click Browse and add the modified .WAR file with the new version specification
Advance to the Preview App screen and click Submit for review
Your changes will be reviewed as usual

If you have any questions or need help in making this change, please let me know and I'll do my best to resolve any issues or concerns you may have.

Thank you for participating in the Marketplace!

RE: Liferay Marketplace Now Available!

2013-01-25T21:16:07Z

Victor Zorin:

Thanks James for the update.
It's probably reasonable to hold any Marketplace migrations until GA3 is up and PACL is confirmed to be usable.

... unless it can be allowed to be disabled, there was another post today asking for such measure. May be it is possible in the interim to have a big red warning label against Marketplace apps that do not support PACL, as long a portal admins are aware about it.

I do not remember that there were any security issues when we had an Open Comminity Plugins repository.
In current Java world, adding PACL would not guarantee significant increase in portal security, and this area is still gong to remain Portal Owner responsibility anyway.

In the old plugins repository, it wasn't really a repository of plugins, it was a directory of links to other websites. Anyone could list anything there, including malicious software, and we didn't ever check anything. In today's Marketplace, we are actually storing the bits on Liferay's servers and delivering them. While it doesn't make much difference to end user experience, legally it means we have to take reasonable measures to ensure their safety. This is PACL. Of course, no method is fullproof, there will always be security holes in software. We also have plans to offer "EE-certified" apps which will imply a greater level of trust, and PACL will help there too.

RE: Liferay Marketplace Now Available!

2013-01-25T20:13:46Z

RE: Liferay Marketplace Now Available!

2013-01-25T14:27:02Z

Victor Zorin:

James, can you give a summary update on the status of Security Manager/PACL.

Is it going to be fixed (or have already been fixed)?

Yep, all of the known PACL issues have been fixed and we are in the process of porting the fixes from master back to 6.1 in preparation for the GA3 release coming up in a few weeks.

If not fixed or too complicated to deal with by the developers, is it worthwhile to to work on transitioning custom-built apps to Markeplace without PACL enabled\ (as probably not many portal administrators would care about PACL if the supplier of the application is a known company).

Would the Marketplace application be approved by Liferay if it works only without PACL enabled?

That is an option, but not one we're ready to explore yet. The GA3 release should relieve all of us from the burden of generating PACL policies.

RE: Liferay Marketplace Now Available!

2013-01-25T10:39:14Z

James, can you give a summary update on the status of Security Manager/PACL.

Is it going to be fixed (or have already been fixed)?

If not fixed or too complicated to deal with by the developers, is it worthwhile to to work on transitioning custom-built apps to Markeplace without PACL enabled\ (as probably not many portal administrators would care about PACL if the supplier of the application is a known company).

Would the Marketplace application be approved by Liferay if it works only without PACL enabled?

RE: UPDATE: Marketplace App Approvals

2013-01-17T14:17:24Z

Mohamed Rizwanuzaman:

Thanks James, I just enabled the Security PACL. so i have added the set bean ,get bean service enable properties. while i accessing the portlet , i have getting below error

]
because i tried to use the Jaxb in my class

JAXBContext context = JAXBContext.newInstance("com.msat.xmlscheme.beans");

This is due to reflection being used by JAXB, and PACL not knowing how to deal with it. See this thread for details, but the short answer is it's broken and will be fixed in the upcoming GA3 release.

RE: UPDATE: Marketplace App Approvals

2013-01-16T10:01:22Z

Thanks James, I just enabled the Security PACL. so i have added the set bean ,get bean service enable properties. while i accessing the portlet , i have getting below error

1
2java.lang.SecurityException: Attempted to access declared members
3 at com.liferay.portal.security.pacl.checker.BaseChecker.throwSecurityException(BaseChecker.java:259)
4 at com.liferay.portal.security.pacl.checker.RuntimeChecker.checkPermission(RuntimeChecker.java:71)
5 at com.liferay.portal.security.pacl.ActivePACLPolicy.checkPermission(ActivePACLPolicy.java:55)
6 at com.liferay.portal.security.lang.PortalSecurityManager.checkPermission(PortalSecurityManager.java:103)
7 at com.liferay.portal.security.lang.PortalSecurityManager.checkPermission(PortalSecurityManager.java:74)
8 at java.lang.SecurityManager.checkMemberAccess(SecurityManager.java:1662)
9 at java.lang.Class.checkMemberAccess(Class.java:2157)
10 at java.lang.Class.getDeclaredField(Class.java:1879)
11 at com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator.getDeclaredField(ReflectionNavigator.java:243)
12 at com.sun.xml.internal.bind.v2.model.nav.ReflectionNavigator.getDeclaredField(ReflectionNavigator.java:47)
13 at com.sun.xml.internal.bind.v2.model.impl.RegistryInfoImpl.<init>(RegistryInfoImpl.java:70)
14 at com.sun.xml.internal.bind.v2.model.impl.ModelBuilder.addRegistry(ModelBuilder.java:346)
15 at com.sun.xml.internal.bind.v2.model.impl.ModelBuilder.getTypeInfo(ModelBuilder.java:316)
16 at com.sun.xml.internal.bind.v2.runtime.JAXBContextImpl.getTypeInfoSet(JAXBContextImpl.java:430)
17 at com.sun.xml.internal.bind.v2.runtime.JAXBContextImpl.<init>(JAXBContextImpl.java:277)
18 at com.sun.xml.internal.bind.v2.runtime.JAXBContextImpl$JAXBContextBuilder.build(JAXBContextImpl.java:1100)
19 at com.sun.xml.internal.bind.v2.ContextFactory.createContext(ContextFactory.java:143)
20 at com.sun.xml.internal.bind.v2.ContextFactory.createContext(ContextFactory.java:110)
21 at com.sun.xml.internal.bind.v2.ContextFactory.createContext(ContextFactory.java:191)
22 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
23 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
24 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
25 at java.lang.reflect.Method.invoke(Method.java:597)
26 at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:128)
27 at javax.xml.bind.ContextFinder.find(ContextFinder.java:290)
28 at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:372)
29 at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:337)
30 at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:244)
31 at com.msat.portlet.multilingual.MultilingualContent.addUpdateContent(MultilingualContent.java:240)

]
because i tried to use the Jaxb in my class

JAXBContext context = JAXBContext.newInstance("com.msat.xmlscheme.beans");

i have note those class in my properties
security-manager-set-bean-property=\
javax.xml.bind.JAXBContext,\
com.msat.xmlscheme.beans.Root,\
com.msat.xmlscheme.beans.Root.Language,\
com.msat.xmlscheme.beans.Root.Language.Content.Field
security-manager-get-bean-property=\
javax.xml.bind.JAXBContext,\
com.msat.xmlscheme.beans.Root,\
com.msat.xmlscheme.beans.Root.Language,\
com.msat.xmlscheme.beans.Root.Language.Content.Field

but i couldn't make it out. Please help me to sort out this.

Regards,
Rizwan

RE: UPDATE: Marketplace App Approvals

2013-01-15T15:08:56Z

Mohamed Rizwanuzaman:

HI james,
i tried to upload an app to market place. but its shows me a "No compatible liferay version found" error message.
i have added the below lines in liferay-plugin-package.properties file

name=multilingual
module-group-id=liferay
module-incremental-version=1
tags=
short-description=
change-log=
page-url=http://www.liferay.com
author=Mohamed Rizwan
licenses=LGPL
security-manager-enabled=true
liferay-versions=6.1.1+

Please let me know what could be the issue.

Regards,
Rizwan

Hmm.. everything looks correct. Make sure your WAR filename is correct. The documentation is in the process of being updated, but here are the WAR file requirements:

- WARs must contain a WEB-INF/liferay-plugin-package.properties file.

- WARs must not contain any WEB-INF/liferay-plugin-package.xml file.

- WAR file names must not contain any commas.

- WAR file names must conform to the following naming convention:

*context_name*-*plugin_type*-A.B.C.D.war

Where:

- *context_name* - Alpha-numeric (including `-` and `_`) short name of your app. This name will be used as the deployment context, and should not duplicate any other app's context (you will see a warning if you use a context name of any other app on the Marketplace).

- *plugin_type* - one of the following: `ext`, `hook`, `layouttpl`, `portlet`, `theme`, or `web`.

- A.B.C.D - The version of your WAR file. There must be 4 digits.

- Example: myapp-portlet-1.0.0.0.war

RE: UPDATE: Marketplace App Approvals

2013-01-15T12:47:43Z

RE: UPDATE: Marketplace App Approvals

2013-01-08T17:03:40Z

Florencia,

I am planning to commit another patches for Community Patcher's version:

http://www.liferay.com/community/forums/-/message_boards/message/18969121

And was thinking about including those involving PACL.

Just stay tunned...

RE: UPDATE: Marketplace App Approvals

2013-01-08T17:01:13Z

Great news!!

Could you please update this post or create new posts when a new app has been approved and uploaded in the Marketplace?
I would like to take a look at their PACL configuration.

What will happen with the bugs that the security manager has and require a core fix? Like this one: http://www.liferay.com/community/forums/-/message_boards/view_message/19023969#_19_message_19023969

Do we have to wait for the next Liferay's release?

Regards,

Flor.

RE: UPDATE: Marketplace App Approvals

2013-01-08T16:31:49Z

Wow that's great!

UPDATE: Marketplace App Approvals

2013-01-04T21:33:01Z

Hello Marketplace Developers!

Thanks to many of you for submitting your apps to the Liferay Marketplace. Back in November, when apps began rolling in, we noticed several unexpected things about them that would result in confusion in the future, and several things that could be improved in our internal workflow for approvals. We decided to stop the approval process for a while, and revise the policies and procedures to ensure a smooth transition. I'm happy to report that we have now sorted these issues out, and are actively reviewing (and hopefully approving) apps.

The following policies now apply to all app submissions going forward. You should familiarize yourself with the documentation for an overall guide to developing and submitting apps. This documentation is in the process of being revised to incorporate these new policies.

Your app must have at least an English description. If you click the "Localized" checkbox you can submit descriptions for the other supported languages on liferay.com. Descriptions with poor grammar or other problems will need to be revised. Note that if you are logged into liferay.com using some other supported language, then the description you enter will by default be assumed to be in that language. You will need to click the "Localized" checkbox and switch to English to supply an English description.
Your app must have at least one screenshot. If your app has no visible UI, you must still submit some kind of screenshot (for example, check out the screenshots for this app).
The version specification in each embedded WAR must be terminated with a version using the + symbol. This ensures that your app will be deployable onto future versions of Liferay (but does not guarantee your app will work in future versions). So, 6.1.1 will not work, but 6.1.1+ will work. In most cases, as of 6.1.1, it is best to specify liferay-versions=6.1.1+ . This will guarantee your app is deployable onto Liferay 6.1 CE GA2 and later (including EE).
You should not use overlapping version specifications, for example, do not use 6.1.1+,6.1.20+ . The documentation was not clear on this, and even used this as an example, but for consistency (and to reinforce the notion that apps developed for CE should be compatible with EE), you should simply use 6.1.1+ to capture all of those versions. In the future, if you discover that your app does not work with a particular version of Liferay, you can revise your versioning, but for now, we ask that you use 6.1.1+ for CE/EE apps, and 6.1.20+ for EE-only apps.
If you use something other than the above for your version specification, be sure to include a description of it in the description of your app, or email marketplace-dev@liferay.com with some justification of your unusual versioning scheme, to aid in the app's approval. If your app is designed for EE only, you can use something like 6.1.20+. However, this will restrict your app only to EE customers.
You must include a link for the following Metadata: "Website", "Support". These are currently "optional" in the Marketplace UI but will become required shortly.
If your app is to be professionally offered/supported, you must submit the app on behalf of a registered company. If the nature of the app implies it is authored/supported by a company or non-profit organization, but is submitted by an individual with no explanation, the app will likely be rejected. To register your company, visit the Marketplace homepage and click on "Become a Developer" on the left.
Be sure to choose a relatively short name for your app. "App that clears the database cache, expires web contents, and clears the in-memory cache" is not a good title. "ClearCache" is much better and catchier!
The use of the Liferay Security Manager (aka PACL) is required (by putting security-manager-enabled=true in your liferay-plugin-package.properties file). However, it is not enough to test your app with PACL disabled, then at the last minute, with no further testing, enable it and submit your app. We noticed many apps that were submitted in this way, and they have been rejected as most apps will not work without a tested access control list. See the Liferay Security Manager documentation for details on how to enable this properly. If you believe your app does indeed work with simply PACL turned on, with no other access control specifiers, be sure to email marketplace-dev@liferay.com and let us know this.
Be sure your screenshots and icons adhere to the requirements. Also, be sure you do not violate the copyright or trademark restrictions of other apps. For example, for a SharePoint-related app, do not use Microsoft's trademarked logo in your logo.

If you submit an app, and it is rejected/denied, here's the procedure to correct the app:

Navigate to your personal profile's "home" page (or your company's "home" page if you submitted on behalf of a company)
Click on "App Manager"
Click on the "Apps" tab
Click on the App in question, and you will be taken to the App Summary screen. At the bottom will be a note with the reason for rejection.
Click on "Edit", to step through the same screens you originally stepped through. This will allow you to make corrections on each screen.
If you need to revise the WAR files, skip to the screen listing the WAR files of your app. Delete the old ones by clicking "Delete" next to the ones you need to delete. Make revisions to your WAR files locally, then re-upload them. Proceed to the final screen and click "Submit for Review". Your app is now re-submitted.

We are very excited to see the Marketplace flourish with high quality apps, and to those that have submitted thus far, I'd like to personally thank you for being an early adopter, apologize for the rough start, and ask that you keep at it - your apps should begin appearing on the Marketplace as we ramp up the approvals pipeline!

RE: Liferay Marketplace Now Available!

2013-01-04T20:50:06Z

Thanks James for the quick response.

I already knew the link, because my company is already registered, but have not yet begun the process of submit our component.

And we have not begun, because we do not know when we can start downloading other components, and when the marketplace is actually operating for others.

We appreciate you submit improved process, and anyway, we will start our stuff up soon, though we would like to better understand the roadmap of the marketplace.

RE: Liferay Marketplace Now Available!

2013-01-04T19:01:25Z

Luis Álvarez:

This link appears broken:

http://www.liferay.com/marketplace/become-a-seller

Do we have a date to download plugins from the community?

Thanks in advance !!

Hey Luis,

The link is now http://www.liferay.com/marketplace/become-a-developer (sorry for changing it, we changed the title of the page to be more clear, since not everyone will "sell" , but that changed the friendly URL link too). You can also find this link in the lower-left of the Marketplace homepage.

We took some time late last month to solidify a couple of confusing policies related to Marketplace, which was holding up the app approval process. Several app developers were submitting apps with duplicate WAR files, and others with bad descriptions, no screenshots, etc. Still others had bad version specifiers (to be fair, they were misled by our documentation, which is in the process of being fixed). So we stopped the app approval pipeline for a couple of weeks over the holiday to sort out the mess. But everything is back in order now, and the pipeline is turned back on now. As we get better at the approval process, it is my hope that the time from submission to decision (approval or not) should be a couple of days.

RE: Liferay Marketplace Now Available!

2013-01-04T18:49:44Z

This link appears broken:

http://www.liferay.com/marketplace/become-a-seller

Do we have a date to download plugins from the community?

Thanks in advance !!

RE: Liferay Marketplace Now Available!

2012-10-30T09:22:40Z

Hi Aniceto,

Actually, we listened to the community in this case. We originally had thought about waiting until paid licensing was complete, but we realized that the community wanted to start submitting apps right away and so we opened up our marketplace to the community now to submit free apps. [Edit: We thought that this was important enough that we had our engineers spend a few weeks making changes in order to make this possible.] We've already got a stream of apps from developers and companies waiting to be approved. We wanted to wait to make the announcement at all of our symposiums, so you may not have been made aware.

You can find the link on our Marketplace home page now:
http://www.liferay.com/marketplace/become-a-seller

Thanks for the feedback. Keep them coming.

RE: Liferay Marketplace Now Available!

2012-10-30T01:31:40Z

wanted to let you know that you are not alone ...

and until the Marketplace is ready to accept Community-built plugins, may I suggest to self-organize and produce a reference site where all existing and upgraded to V6+ will be located from.

We also have a large number of portlets sitting in a pool and not upgrading to V6 until positive signs from Marketplace.

As it may take a while to get it ready we better collate an independent repository of Liferay Applications which will be migrated by authors to a Marketplace when it is appropriate and feasible. Until then everyone will be able to use what Liferay Community has at hand right now.

For independence reasons I have created a 'Liferay Community Applications' group on LinkedIn. This is an open group, so can be freely viewed.

Feel free to join and move on. This is the link.

RE: Liferay Marketplace Now Available!

2012-10-29T13:16:21Z

Aniceto,

I completely agree with you. I know this doesn't help you but at least i wanted to let you know that you are not alone.

Cheers,

RE: Liferay Marketplace Now Available!

2012-10-29T12:37:53Z

Brian

Of course there are lots of law and tax issues. But I think you are missing the point. The main issue is Liferay does not listen enough to community. This answer is two months after your message. Where are we now? We are with a marketplace where all the apps are only from Liferay. An those apps don't use the Security Manager. I would like to know what would had happened to Social Office, for instance, if it were deployed with Security Manager active. Do you know? No? I do know and I'll tell you: It wouldn't work because new services fail on deployment. And this is only a sample issue.
The main issue is Liferay wants to create a maketplace complex for developers, with a tight control of apps (of non Liferay apps, of course), instead of making the marketplace and apps work. Liferay point of view is not widely community shared. I want facts and not marketing vaporware. If selling is not possible for some time, OK. But at least let free apps work.

Regards