Merge with develop branch

scm-webapp/src/main/java/sonia/scm/plugin/DefaultPluginManager.java

@@ -42,6 +42,7 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
 import java.util.Set;
+import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
 
@@ -68,17 +69,30 @@ public class DefaultPluginManager implements PluginManager {
   private final Collection<PendingPluginUninstallation> pendingUninstallQueue = new ArrayList<>();
   private final PluginDependencyTracker dependencyTracker = new PluginDependencyTracker();
 
+  private final Function<List<AvailablePlugin>, PluginInstallationContext> contextFactory;
+
   @Inject
   public DefaultPluginManager(PluginLoader loader, PluginCenter center, PluginInstaller installer, Restarter restarter, ScmEventBus eventBus) {
+    this(loader, center, installer, restarter, eventBus, null);
+  }
+
+  DefaultPluginManager(PluginLoader loader, PluginCenter center, PluginInstaller installer, Restarter restarter, ScmEventBus eventBus, Function<List<AvailablePlugin>, PluginInstallationContext> contextFactory) {
     this.loader = loader;
     this.center = center;
     this.installer = installer;
     this.restarter = restarter;
     this.eventBus = eventBus;
 
+    if (contextFactory != null) {
+      this.contextFactory = contextFactory;
+    } else {
+      this.contextFactory = (availablePlugins -> PluginInstallationContext.from(getInstalled(), availablePlugins));
+    }
+
     this.computeInstallationDependencies();
   }
 
+
   @VisibleForTesting
   synchronized void computeInstallationDependencies() {
     loader.getInstalledPlugins()
@@ -167,9 +181,10 @@ public class DefaultPluginManager implements PluginManager {
 
     List<AvailablePlugin> plugins = collectPluginsToInstall(name);
     List<PendingPluginInstallation> pendingInstallations = new ArrayList<>();
+
     for (AvailablePlugin plugin : plugins) {
       try {
-        PendingPluginInstallation pending = installer.install(plugin);
+        PendingPluginInstallation pending = installer.install(contextFactory.apply(plugins), plugin);
         dependencyTracker.addInstalled(plugin.getDescriptor());
         pendingInstallations.add(pending);
         eventBus.post(new PluginEvent(PluginEvent.PluginEventType.INSTALLED, plugin));

scm-webapp/src/main/java/sonia/scm/plugin/DependencyNotFoundException.java

@@ -0,0 +1,62 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.plugin;
+
+import static sonia.scm.ContextEntry.ContextBuilder.entity;
+
+@SuppressWarnings("squid:MaximumInheritanceDepth") // exceptions have a deep inheritance depth themselves; therefore we accept this here
+public class DependencyNotFoundException extends PluginInstallException {
+
+  private final String plugin;
+  private final String missingDependency;
+
+  public DependencyNotFoundException(String plugin, String missingDependency) {
+    super(
+      entity("Dependency", missingDependency)
+        .in("Plugin", plugin)
+        .build(),
+      String.format(
+        "missing dependency %s of plugin %s",
+        missingDependency,
+        plugin
+      )
+    );
+    this.plugin = plugin;
+    this.missingDependency = missingDependency;
+  }
+
+  public String getPlugin() {
+    return plugin;
+  }
+
+  public String getMissingDependency() {
+    return missingDependency;
+  }
+
+  @Override
+  public String getCode() {
+    return "5GS6lwvWF1";
+  }
+}

scm-webapp/src/main/java/sonia/scm/plugin/DependencyVersionMismatchException.java

@@ -0,0 +1,60 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.plugin;
+
+import lombok.Getter;
+
+import static sonia.scm.ContextEntry.ContextBuilder.entity;
+
+@Getter
+@SuppressWarnings("squid:MaximumInheritanceDepth") // exceptions have a deep inheritance depth themselves; therefore we accept this here
+public class DependencyVersionMismatchException extends PluginInstallException {
+
+  private final String plugin;
+  private final String dependency;
+  private final String minVersion;
+  private final String currentVersion;
+
+  public DependencyVersionMismatchException(String plugin, String dependency, String minVersion, String currentVersion) {
+    super(
+      entity("Dependency", dependency)
+        .in("Plugin", plugin)
+        .build(),
+      String.format(
+        "%s requires dependency %s at least in version %s, but it is installed in version %s",
+        plugin, dependency, minVersion, currentVersion
+      )
+    );
+    this.plugin = plugin;
+    this.dependency = dependency;
+    this.minVersion = minVersion;
+    this.currentVersion = currentVersion;
+  }
+
+  @Override
+  public String getCode() {
+    return "E5S6niWwi1";
+  }
+}

scm-webapp/src/main/java/sonia/scm/plugin/ExplodedSmp.java

@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-    
+
 package sonia.scm.plugin;
 
 //~--- non-JDK imports --------------------------------------------------------
@@ -30,11 +30,10 @@ import com.google.common.base.Function;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-//~--- JDK imports ------------------------------------------------------------
-
 import java.nio.file.Path;
+import java.util.Objects;
 
-import java.util.Set;
+//~--- JDK imports ------------------------------------------------------------
 
 /**
  * The ExplodedSmp object represents an extracted SCM-Manager plugin. The object
@@ -107,6 +106,25 @@ public final class ExplodedSmp
     return plugin;
   }
 
+  @Override
+  public boolean equals(Object o) {
+    if (this == o) return true;
+    if (o == null || getClass() != o.getClass()) return false;
+    ExplodedSmp that = (ExplodedSmp) o;
+    return path.equals(that.path);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(path);
+  }
+
+  @Override
+  public String toString() {
+    PluginInformation information = plugin.getInformation();
+    return information.getName() + "@" + information.getVersion() + " (" + path + ")";
+  }
+
   //~--- inner classes --------------------------------------------------------
 
   /**

scm-webapp/src/main/java/sonia/scm/plugin/PluginChecksumMismatchException.java

@@ -26,6 +26,7 @@ package sonia.scm.plugin;
 
 import static sonia.scm.ContextEntry.ContextBuilder.entity;
 
+@SuppressWarnings("squid:MaximumInheritanceDepth") // exceptions have a deep inheritance depth themselves; therefore we accept this here
 public class PluginChecksumMismatchException extends PluginInstallException {
   public PluginChecksumMismatchException(AvailablePlugin plugin, String calculatedChecksum, String expectedChecksum) {
     super(

scm-webapp/src/main/java/sonia/scm/plugin/PluginInformationMismatchException.java

@@ -0,0 +1,51 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.plugin;
+
+import lombok.Getter;
+
+import static sonia.scm.ContextEntry.ContextBuilder.entity;
+
+@Getter
+@SuppressWarnings("squid:MaximumInheritanceDepth") // exceptions have a deep inheritance depth themselves; therefore we accept this here
+public class PluginInformationMismatchException extends PluginInstallException {
+
+  private final PluginInformation api;
+  private final PluginInformation downloaded;
+
+  public PluginInformationMismatchException(PluginInformation api, PluginInformation downloaded, String message) {
+    super(
+      entity("Plugin", api.getName()).build(),
+      message
+    );
+    this.api = api;
+    this.downloaded = downloaded;
+  }
+
+  @Override
+  public String getCode() {
+    return "4RS6niPRX1";
+  }
+}

scm-webapp/src/main/java/sonia/scm/plugin/PluginInstallationContext.java

@@ -0,0 +1,73 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.plugin;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
+public final class PluginInstallationContext {
+
+  private final Map<String, NameAndVersion> dependencies;
+
+  private PluginInstallationContext(Map<String, NameAndVersion> dependencies) {
+    this.dependencies = dependencies;
+  }
+
+  public static PluginInstallationContext empty() {
+    return new PluginInstallationContext(Collections.emptyMap());
+  }
+
+  public static PluginInstallationContext fromDescriptors(Iterable<? extends PluginDescriptor> installed, Iterable<? extends PluginDescriptor> pending) {
+    Map<String, NameAndVersion> dependencies = new HashMap<>();
+    appendDescriptors(dependencies, installed);
+    appendDescriptors(dependencies, pending);
+    return new PluginInstallationContext(dependencies);
+  }
+
+  public static PluginInstallationContext from(Iterable<? extends Plugin> installed, Iterable<? extends Plugin> pending) {
+    Map<String, NameAndVersion> dependencies = new HashMap<>();
+    appendPlugins(dependencies, installed);
+    appendPlugins(dependencies, pending);
+    return new PluginInstallationContext(dependencies);
+  }
+
+  private static <P extends PluginDescriptor> void appendDescriptors(Map<String, NameAndVersion> dependencies, Iterable<P> descriptors) {
+    descriptors.forEach(desc -> appendPlugins(dependencies, desc.getInformation()));
+  }
+
+  private static <P extends Plugin> void appendPlugins(Map<String, NameAndVersion> dependencies, Iterable<P> plugins) {
+    plugins.forEach(plugin -> appendPlugins(dependencies, plugin.getDescriptor().getInformation()));
+  }
+
+  private static void appendPlugins(Map<String, NameAndVersion> dependencies, PluginInformation information) {
+    dependencies.put(information.getName(), new NameAndVersion(information.getName(), information.getVersion()));
+  }
+
+  public Optional<NameAndVersion> find(String name) {
+    return Optional.ofNullable(dependencies.get(name));
+  }
+}

scm-webapp/src/main/java/sonia/scm/plugin/PluginInstallationVerifier.java

@@ -0,0 +1,104 @@
+/*
+ * MIT License
+ *
+ * Copyright (c) 2020-present Cloudogu GmbH and Contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package sonia.scm.plugin;
+
+import sonia.scm.version.Version;
+
+import java.util.Optional;
+import java.util.Set;
+
+public final class PluginInstallationVerifier {
+
+  private final PluginInstallationContext context;
+  private final InstalledPluginDescriptor descriptor;
+
+  private PluginInstallationVerifier(PluginInstallationContext context, InstalledPluginDescriptor descriptor) {
+    this.context = context;
+    this.descriptor = descriptor;
+  }
+
+  public static void verify(PluginInstallationContext context, InstalledPlugin plugin) {
+    verify(context, plugin.getDescriptor());
+  }
+
+  public static void verify(PluginInstallationContext context, InstalledPluginDescriptor descriptor) {
+    new PluginInstallationVerifier(context, descriptor).doVerification();
+  }
+
+  private void doVerification() {
+    verifyConditions();
+    verifyDependencies();
+    verifyOptionalDependencies();
+  }
+
+  private void verifyConditions() {
+    // TODO we should provide more details here, which condition has failed
+    if (!descriptor.getCondition().isSupported()) {
+      throw new PluginConditionFailedException(
+        descriptor.getCondition(),
+        String.format(
+          "could not load plugin %s, the plugin condition does not match",
+          descriptor.getInformation().getName()
+        )
+      );
+    }
+  }
+
+  private void verifyDependencies() {
+    Set<NameAndVersion> dependencies = descriptor.getDependenciesWithVersion();
+    for (NameAndVersion dependency : dependencies) {
+      NameAndVersion installed = context.find(dependency.getName())
+        .orElseThrow(
+          () -> new DependencyNotFoundException(descriptor.getInformation().getName(), dependency.getName())
+        );
+
+      dependency.getVersion().ifPresent(requiredVersion -> verifyDependencyVersion(dependency, installed));
+    }
+  }
+
+  private void verifyOptionalDependencies() {
+    Set<NameAndVersion> dependencies = descriptor.getOptionalDependenciesWithVersion();
+    for (NameAndVersion dependency : dependencies) {
+      Optional<Version> version = dependency.getVersion();
+      if (version.isPresent()) {
+        Optional<NameAndVersion> installed = context.find(dependency.getName());
+        installed.ifPresent(nameAndVersion -> verifyDependencyVersion(dependency, nameAndVersion));
+      }
+    }
+  }
+
+  private void verifyDependencyVersion(NameAndVersion required, NameAndVersion installed) {
+    Version requiredVersion = required.mustGetVersion();
+    Version installedVersion = installed.mustGetVersion();
+    if (installedVersion.isOlder(requiredVersion)) {
+      throw new DependencyVersionMismatchException(
+        descriptor.getInformation().getName(),
+        required.getName(),
+        requiredVersion.getUnparsedVersion(),
+        installedVersion.getUnparsedVersion()
+      );
+    }
+  }
+}

scm-webapp/src/main/java/sonia/scm/plugin/PluginInstaller.java

@@ -38,36 +38,72 @@ import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.Optional;
 
-@SuppressWarnings("UnstableApiUsage") // guava hash is marked as unstable
+@SuppressWarnings("UnstableApiUsage")
+  // guava hash is marked as unstable
 class PluginInstaller {
 
-  private final SCMContextProvider context;
+  private final SCMContextProvider scmContext;
   private final AdvancedHttpClient client;
   private final SmpDescriptorExtractor smpDescriptorExtractor;
 
   @Inject
-  public PluginInstaller(SCMContextProvider context, AdvancedHttpClient client, SmpDescriptorExtractor smpDescriptorExtractor) {
-    this.context = context;
+  public PluginInstaller(SCMContextProvider scmContext, AdvancedHttpClient client, SmpDescriptorExtractor smpDescriptorExtractor) {
+    this.scmContext = scmContext;
     this.client = client;
     this.smpDescriptorExtractor = smpDescriptorExtractor;
   }
 
   @SuppressWarnings("squid:S4790") // hashing should be safe
-  public PendingPluginInstallation install(AvailablePlugin plugin) {
+  public PendingPluginInstallation install(PluginInstallationContext context, AvailablePlugin plugin) {
     Path file = null;
     try (HashingInputStream input = new HashingInputStream(Hashing.sha256(), download(plugin))) {
       file = createFile(plugin);
       Files.copy(input, file);
 
       verifyChecksum(plugin, input.hash(), file);
-      verifyConditions(plugin, file);
+
+      InstalledPluginDescriptor descriptor = smpDescriptorExtractor.extractPluginDescriptor(file);
+      verifyInformation(plugin.getDescriptor(), descriptor);
+
+      PluginInstallationVerifier.verify(context, descriptor);
+
       return new PendingPluginInstallation(plugin.install(), file);
+    } catch (PluginException ex) {
+      cleanup(file);
+      throw ex;
     } catch (IOException ex) {
       cleanup(file);
       throw new PluginDownloadException(plugin, ex);
     }
   }
 
+  private void verifyInformation(AvailablePluginDescriptor descriptorFromPluginCenter, InstalledPluginDescriptor downloadedDescriptor) {
+    verifyInformation(descriptorFromPluginCenter.getInformation(), downloadedDescriptor.getInformation());
+  }
+
+  private void verifyInformation(PluginInformation informationFromPluginCenter, PluginInformation downloadedInformation) {
+    if (!informationFromPluginCenter.getName().equals(downloadedInformation.getName())) {
+      throw new PluginInformationMismatchException(
+        informationFromPluginCenter, downloadedInformation,
+        String.format(
+          "downloaded plugin name \"%s\" does not match the expected name \"%s\" from plugin-center",
+          downloadedInformation.getName(),
+          informationFromPluginCenter.getName()
+        )
+      );
+    }
+    if (!informationFromPluginCenter.getVersion().equals(downloadedInformation.getVersion())) {
+      throw new PluginInformationMismatchException(
+        informationFromPluginCenter, downloadedInformation,
+        String.format(
+          "downloaded plugin version \"%s\" does not match the expected version \"%s\" from plugin-center",
+          downloadedInformation.getVersion(),
+          informationFromPluginCenter.getVersion()
+        )
+      );
+    }
+  }
+
   private void cleanup(Path file) {
     try {
       if (file != null) {
@@ -89,26 +125,12 @@ class PluginInstaller {
     }
   }
 
-  private void verifyConditions(AvailablePlugin plugin, Path file) throws IOException {
-    InstalledPluginDescriptor pluginDescriptor = smpDescriptorExtractor.extractPluginDescriptor(file);
-    if (!pluginDescriptor.getCondition().isSupported()) {
-      cleanup(file);
-      throw new PluginConditionFailedException(
-        pluginDescriptor.getCondition(),
-        String.format(
-          "could not load plugin %s, the plugin condition does not match",
-          plugin.getDescriptor().getInformation().getName()
-        )
-      );
-    }
-  }
-
   private InputStream download(AvailablePlugin plugin) throws IOException {
     return client.get(plugin.getDescriptor().getUrl()).request().contentAsStream();
   }
 
   private Path createFile(AvailablePlugin plugin) throws IOException {
-    Path directory = context.resolve(Paths.get("plugins"));
+    Path directory = scmContext.resolve(Paths.get("plugins"));
     Files.createDirectories(directory);
     return directory.resolve(plugin.getDescriptor().getInformation().getName() + ".smp");
   }

scm-webapp/src/main/java/sonia/scm/plugin/PluginProcessor.java

@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-    
+
 package sonia.scm.plugin;
 
 //~--- non-JDK imports --------------------------------------------------------
@@ -35,7 +35,6 @@ import com.google.common.hash.Hashing;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import sonia.scm.lifecycle.classloading.ClassLoaderLifeCycle;
-import sonia.scm.plugin.ExplodedSmp.PathTransformer;
 
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
@@ -50,11 +49,14 @@ import java.nio.file.Path;
 import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Date;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import java.util.function.Predicate;
+import java.util.stream.Collectors;
 
-import static java.util.stream.Collectors.toList;
+import static java.util.stream.Collectors.toSet;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -103,6 +105,8 @@ public final class PluginProcessor
 
   //~--- constructors ---------------------------------------------------------
 
+  private final SmpDescriptorExtractor extractor = new SmpDescriptorExtractor();
+
   private ClassLoaderLifeCycle classLoaderLifeCycle;
 
   /**
@@ -162,25 +166,16 @@ public final class PluginProcessor
   {
     logger.info("collect plugins");
 
-    Set<Path> archives = collect(pluginDirectory, new PluginArchiveFilter());
+    Set<ExplodedSmp> installedPlugins = findInstalledPlugins();
+    logger.debug("found {} installed plugins", installedPlugins.size());
 
-    logger.debug("extract {} archives", archives.size());
+    Set<ExplodedSmp> newlyInstalledPlugins = installPending(installedPlugins);
+    logger.debug("finished installation of {} plugins", newlyInstalledPlugins.size());
 
-    extract(archives);
-
-    List<Path> dirs =
-      collectPluginDirectories(pluginDirectory)
-      .stream()
-      .filter(isPluginDirectory())
-      .collect(toList());
-
-    logger.debug("process {} directories: {}", dirs.size(), dirs);
-
-    List<ExplodedSmp> smps = Lists.transform(dirs, new PathTransformer());
+    Set<ExplodedSmp> plugins = concat(installedPlugins, newlyInstalledPlugins);
 
     logger.trace("start building plugin tree");
-
-    PluginTree pluginTree = new PluginTree(smps);
+    PluginTree pluginTree = new PluginTree(plugins);
 
     logger.info("install plugin tree:\n{}", pluginTree);
 
@@ -195,6 +190,52 @@ public final class PluginProcessor
     return ImmutableSet.copyOf(wrappers);
   }
 
+  private Set<ExplodedSmp> concat(Set<ExplodedSmp> installedPlugins, Set<ExplodedSmp> newlyInstalledPlugins) {
+    // We first add all newly installed plugins,
+    // after that we add the missing plugins, which are already installed.
+    // ExplodedSmp is equal by its path, so duplicates (updates) are not in the result.
+    return ImmutableSet.<ExplodedSmp>builder()
+      .addAll(newlyInstalledPlugins)
+      .addAll(installedPlugins)
+      .build();
+  }
+
+  private Set<ExplodedSmp> installPending(Set<ExplodedSmp> installedPlugins) throws IOException {
+    Set<Path> archives = collect(pluginDirectory, new PluginArchiveFilter());
+    logger.debug("start installation of {} pending archives", archives.size());
+
+    Map<Path, InstalledPluginDescriptor> pending = new HashMap<>();
+    for (Path archive : archives) {
+      pending.put(archive, extractor.extractPluginDescriptor(archive));
+    }
+
+    PluginInstallationContext installationContext = PluginInstallationContext.fromDescriptors(
+      installedPlugins.stream().map(ExplodedSmp::getPlugin).collect(toSet()),
+      pending.values()
+    );
+
+    for (Map.Entry<Path, InstalledPluginDescriptor> entry : pending.entrySet()) {
+      try {
+        PluginInstallationVerifier.verify(installationContext, entry.getValue());
+      } catch (PluginException ex) {
+        Path path = entry.getKey();
+        logger.error("failed to install smp {}, because it could not be verified", path);
+        logger.error("to restore scm-manager functionality remove the smp file {} from the plugin directory", path);
+        throw ex;
+      }
+    }
+
+    return extract(archives);
+  }
+
+  private Set<ExplodedSmp> findInstalledPlugins() throws IOException {
+    return collectPluginDirectories(pluginDirectory)
+      .stream()
+      .filter(isPluginDirectory())
+      .map(ExplodedSmp::create)
+      .collect(Collectors.toSet());
+  }
+
   private Predicate<Path> isPluginDirectory() {
     return dir -> Files.exists(dir.resolve(DIRECTORY_METAINF).resolve("scm").resolve("plugin.xml"));
   }
@@ -505,10 +546,12 @@ public final class PluginProcessor
    *
    * @throws IOException
    */
-  private void extract(Iterable<Path> archives) throws IOException
+  private Set<ExplodedSmp> extract(Iterable<Path> archives) throws IOException
   {
     logger.debug("extract archives");
 
+    ImmutableSet.Builder<ExplodedSmp> extracted = ImmutableSet.builder();
+
     for (Path archive : archives)
     {
       File archiveFile = archive.toFile();
@@ -519,17 +562,18 @@ public final class PluginProcessor
 
       logger.debug("extract plugin {}", smp.getPlugin());
 
-      File directory =
-        PluginsInternal.createPluginDirectory(pluginDirectory.toFile(),
-          smp.getPlugin());
+      File directory = PluginsInternal.createPluginDirectory(pluginDirectory.toFile(), smp.getPlugin());
 
-      String checksum = com.google.common.io.Files.hash(archiveFile,
-                          Hashing.sha256()).toString();
+      String checksum = com.google.common.io.Files.hash(archiveFile, Hashing.sha256()).toString();
       File checksumFile = PluginsInternal.getChecksumFile(directory);
 
       PluginsInternal.extract(smp, checksum, directory, checksumFile, false);
       moveArchive(archive);
+
+      extracted.add(ExplodedSmp.create(directory.toPath()));
     }
+
+    return extracted.build();
   }
 
   /**

scm-webapp/src/main/java/sonia/scm/plugin/PluginTree.java

@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-    
+
 package sonia.scm.plugin;
 
 //~--- non-JDK imports --------------------------------------------------------
@@ -30,6 +30,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.LinkedHashSet;
 import java.util.LinkedList;
 import java.util.List;
@@ -71,7 +72,7 @@ public final class PluginTree
    *
    * @param smps
    */
-  public PluginTree(List<ExplodedSmp> smps)
+  public PluginTree(Collection<ExplodedSmp> smps)
   {
 
     smps.forEach(s -> {
@@ -155,7 +156,8 @@ public final class PluginTree
   }
 
   private void append(StringBuilder buffer, String indent, PluginNode node) {
-    buffer.append(indent).append("+- ").append(node.getId()).append("\n");
+    PluginInformation information = node.getPlugin().getPlugin().getInformation();
+    buffer.append(indent).append("+- ").append(node.getId()).append("@").append(information.getVersion()).append("\n");
     for (PluginNode child : node.getChildren()) {
       append(buffer, indent + "   ", child);
     }

scm-webapp/src/main/java/sonia/scm/plugin/SmpDescriptorExtractor.java

@@ -21,7 +21,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-    
+
 package sonia.scm.plugin;
 
 import javax.xml.bind.JAXBContext;
@@ -36,7 +36,7 @@ import java.util.zip.ZipInputStream;
 class SmpDescriptorExtractor {
 
   InstalledPluginDescriptor extractPluginDescriptor(Path file) throws IOException {
-    try (ZipInputStream zipInputStream = new ZipInputStream(Files.newInputStream(file), StandardCharsets.UTF_8))    {
+    try (ZipInputStream zipInputStream = new ZipInputStream(Files.newInputStream(file), StandardCharsets.UTF_8)) {
       ZipEntry nextEntry;
       while ((nextEntry = zipInputStream.getNextEntry()) != null) {
         if ("META-INF/scm/plugin.xml".equals(nextEntry.getName())) {