Christoph Läubrich

> would you please rebase it on top of master Will do this ... > and guide whether and how I can publish extra commit to this PR with an...

I plan to merge this once CI passes, we can enhance / add tests afterwards.

At that stage where maven dependencies are injected we already have the artifact downloaded (or request its download see) https://github.com/eclipse/tycho/blob/de42d8e6797581299f495066ed0ecb85aec75a17/tycho-core/src/main/java/org/eclipse/tycho/core/maven/MavenDependencyInjector.java#L101-L103

> Perfect! What is "not so perfect" is that orbit seems to ship bad meta-data here. But thanks to the Workspace resolver, we *might* just use that info anyways and...

The recent added support for resolving maven dependencies in the consumer pom phase seems more valuable than in the injection phase.

Thats valid I think, even though platform is not going that path, but I have seen that they use [version ranges in their depdendecies](https://repo1.maven.org/maven2/org/eclipse/platform/org.eclipse.equinox.p2.core/2.8.100/org.eclipse.equinox.p2.core-2.8.100.pom). So maybe we should use that...

Strange enough a version in an artifact means "recommended version" see [here](https://maven.apache.org/ref/3.3.9/maven-artifact/apidocs/org/apache/maven/artifact/versioning/VersionRange.html#createFromVersionSpec(java.lang.String)). So maven is free to choose *any* version, that's quite strange. So for a local build maven might...

There are now other ways to accomplish that (e.g. Tycho CI friendly versions)

@mickaelistria can you take a look at this?

@mickaelistria can you take a look here? I'd like to spin a service release next week (what will include a PGP fix as well) so it would be great if...