In keeping with PST policies of "build everything from source" so that if there's a CVE we can more easily patch and fix a problem, we need to:

• figure out how to build all the vsix files in the CRW plugin registry
• collect all the sources
• produce our own versions of the vsix files and use those in the plugin registry.

Work started in September on this as part of these upstream issues:

• https://github.com/eclipse/che/issues/14573
• https://github.com/eclipse/che/issues/14677

3rd Party Extensions

These are urgent because we don't have control over the upstream projects.

See https://docs.google.com/spreadsheets/d/1TllnofYIlA7yTn7hIa8-LojGpHR1ACk1hVP-7fg_wsY/edit#gid=1935159288

RH Extensions

For these, since RH controls/contributes to the extension projects, we just need to get sources that match the binaries we're using in the oplugin registry meta.yaml.

If that's impossible, we should build our own binary from a specific ctag/SHA so we can guarantee what we use has a matching source tarball.
See https://docs.google.com/spreadsheets/d/1TllnofYIlA7yTn7hIa8-LojGpHR1ACk1hVP-7fg_wsY/edit#gid=1935159288