The attached patch fixes two problems:
1.) When a user does a "cave:create-repository cave-repo", where cave-repo existed as a previous repo but was removed from Karaf (cave:remove-repository) (or not listed due to new startup of Karaf) but not the filesystem, the Cave code presently loads in the repository.xml and populates the CaveRepositoryImpl's obrRepository structure with all the listed bundles--but it doesn't check whether those bundles are still in the Cave folder. The patch has the repository.xml always start empty on a create-repository, to be immediately populated after the scan() is called (which normally happens immediately afterwards unless you expressly do a --no-update with your create-repository call.) Making this change (which is the "-71,13 +71,8" part of the patch) is optional IMO – if you assume in most cases people will scan anyway when they do a create-repository, it's good to have this change in as it guarantees full accuracy. However, it will require scans whenever you restart Karaf and "create" already existing Cave repositories.
2.) If a person does a cave:update-repository presently new bundles in the repo will be added to the repository.xml file, but bundles that have been removed from the repo will not be removed from the repository.xml file. This change is required IMO – the patch again resets the obrRepository to a new empty object (unfortunately no ability to empty it out) each time scan() is called so nonexistent bundles will be removed from the XML file.