, Unit> normalizations = Maps.newConcurrentMap();
-diff -Naurp parfait-0.5.3.orig/parfait-core/src/main/java/io/pcp/parfait/timing/ThreadContext.java parfait-0.5.3/parfait-core/src/main/java/io/pcp/parfait/timing/ThreadContext.java
---- parfait-0.5.3.orig/parfait-core/src/main/java/io/pcp/parfait/timing/ThreadContext.java 2017-10-06 11:45:35.000000000 +1100
-+++ parfait-0.5.3/parfait-core/src/main/java/io/pcp/parfait/timing/ThreadContext.java 2017-10-06 11:56:57.571404704 +1100
-@@ -26,7 +26,7 @@ import java.util.concurrent.ConcurrentHa
- import com.google.common.cache.CacheBuilder;
- import com.google.common.cache.CacheLoader;
- import com.google.common.cache.LoadingCache;
--import net.jcip.annotations.ThreadSafe;
-+//import net.jcip.annotations.ThreadSafe;
-
- /**
- *
-@@ -45,7 +45,7 @@ import net.jcip.annotations.ThreadSafe;
- *
- * @author Cowan
- */
--@ThreadSafe
-+//@ThreadSafe
- public class ThreadContext {
- private static final CacheLoader> NEW_CONTEXT_CREATOR = new CacheLoader>() {
- @Override
-diff -Naurp parfait-0.5.3.orig/parfait-pcp/src/main/java/io/pcp/parfait/pcp/PcpMonitorBridge.java parfait-0.5.3/parfait-pcp/src/main/java/io/pcp/parfait/pcp/PcpMonitorBridge.java
---- parfait-0.5.3.orig/parfait-pcp/src/main/java/io/pcp/parfait/pcp/PcpMonitorBridge.java 2017-10-06 11:45:35.000000000 +1100
-+++ parfait-0.5.3/parfait-pcp/src/main/java/io/pcp/parfait/pcp/PcpMonitorBridge.java 2017-10-06 11:59:49.367827348 +1100
-@@ -25,7 +25,7 @@ import io.pcp.parfait.dxm.PcpWriter;
- import io.pcp.parfait.dxm.semantics.Semantics;
- import com.google.common.base.Preconditions;
- import com.google.common.collect.ImmutableMap;
--import net.jcip.annotations.NotThreadSafe;
-+//import net.jcip.annotations.NotThreadSafe;
- import org.slf4j.Logger;
- import org.slf4j.LoggerFactory;
-
-@@ -45,7 +45,7 @@ import java.util.concurrent.ArrayBlockin
- *
- * @see io.pcp.parfait.QuiescentRegistryListener
- */
--@NotThreadSafe
-+//@NotThreadSafe
- public class PcpMonitorBridge implements MonitoringView {
-
- private static final Logger LOG = LoggerFactory.getLogger(PcpMonitorBridge.class);
-diff -Naurp parfait-0.5.3.orig/pom.xml parfait-0.5.3/pom.xml
---- parfait-0.5.3.orig/pom.xml 2017-10-06 11:45:35.000000000 +1100
-+++ parfait-0.5.3/pom.xml 2017-10-06 11:56:57.571404704 +1100
-@@ -340,11 +340,6 @@
- 2.2.9
-
-
-- net.jcip
-- jcip-annotations
-- 1.0
--
--
- commons-io
- commons-io
- 1.4
diff --git a/no-more-objects.patch b/no-more-objects.patch
deleted file mode 100644
index f7fbe20..0000000
--- a/no-more-objects.patch
+++ /dev/null
@@ -1,322 +0,0 @@
-diff -Naurp parfait-0.5.3.orig/parfait-core/src/main/java/io/pcp/parfait/PollingMonitoredValue.java parfait-0.5.3/parfait-core/src/main/java/io/pcp/parfait/PollingMonitoredValue.java
---- parfait-0.5.3.orig/parfait-core/src/main/java/io/pcp/parfait/PollingMonitoredValue.java 2017-10-03 11:38:15.000000000 +1100
-+++ parfait-0.5.3/parfait-core/src/main/java/io/pcp/parfait/PollingMonitoredValue.java 2017-10-06 13:35:06.169481799 +1100
-@@ -29,7 +29,7 @@ import org.slf4j.Logger;
- import org.slf4j.LoggerFactory;
-
- import com.google.common.annotations.VisibleForTesting;
--import com.google.common.base.MoreObjects;
-+//import com.google.common.base.MoreObjects;
- import com.google.common.base.Preconditions;
- import com.google.common.base.Supplier;
-
-@@ -104,10 +104,10 @@ public class PollingMonitoredValue ex
- scheduler.schedule(new PollerTask(), updateInterval);
- }
-
-- @Override
-- public String toString() {
-- return MoreObjects.toStringHelper(this).add("name", getName()).add("description", getDescription()).add("poller", poller).toString();
-- }
-+// @Override
-+// public String toString() {
-+// return MoreObjects.toStringHelper(this).add("name", getName()).add("description", getDescription()).add("poller", poller).toString();
-+// }
-
-
- private class PollerTask extends TimerTask {
-diff -Naurp parfait-0.5.3.orig/parfait-jmx/src/main/java/io/pcp/parfait/jmx/JmxView.java parfait-0.5.3/parfait-jmx/src/main/java/io/pcp/parfait/jmx/JmxView.java
---- parfait-0.5.3.orig/parfait-jmx/src/main/java/io/pcp/parfait/jmx/JmxView.java 2017-10-03 11:44:14.000000000 +1100
-+++ parfait-0.5.3/parfait-jmx/src/main/java/io/pcp/parfait/jmx/JmxView.java 1970-01-01 10:00:00.000000000 +1000
-@@ -1,150 +0,0 @@
--/*
-- * Copyright 2009-2017 Aconex
-- *
-- * Licensed under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at:
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-- * implied. See the License for the specific language governing
-- * permissions and limitations under the License.
-- */
--
--package io.pcp.parfait.jmx;
--
--import io.pcp.parfait.Monitor;
--import io.pcp.parfait.Monitorable;
--import io.pcp.parfait.MonitoringView;
--import com.google.common.base.MoreObjects;
--import org.springframework.jmx.export.annotation.ManagedAttribute;
--import org.springframework.jmx.export.annotation.ManagedResource;
--
--import javax.management.openmbean.CompositeData;
--import javax.management.openmbean.CompositeDataSupport;
--import javax.management.openmbean.CompositeType;
--import javax.management.openmbean.OpenDataException;
--import javax.management.openmbean.OpenType;
--import javax.management.openmbean.SimpleType;
--import java.util.Collection;
--import java.util.HashMap;
--import java.util.Map;
--import java.util.concurrent.atomic.AtomicInteger;
--import java.util.concurrent.atomic.AtomicLong;
--
--@ManagedResource
--public class JmxView implements MonitoringView {
-- private String[] jmxMonitoredNames;
-- private Object[] jmxMonitoredValues;
-- private Map jmxArrayIndexMap;
-- private CompositeType monitoredType;
--
-- private final Monitor monitor = new JmxUpdatingMonitor();
-- private volatile boolean started;
--
--
-- @Override
-- public void startMonitoring(Collection> monitorables) {
-- setupJmxValues(monitorables);
-- for (Monitorable monitorable : monitorables) {
-- updateData(monitorable);
-- monitorable.attachMonitor(monitor);
-- }
-- this.started = true;
-- }
--
-- @Override
-- public void stopMonitoring(Collection> monitorables) {
-- for (Monitorable monitorable : monitorables) {
-- monitorable.removeMonitor(monitor);
-- }
-- this.started = false;
-- }
--
-- @Override
-- public boolean isRunning() {
-- return started;
-- }
--
-- private void setupJmxValues(Collection> monitorables) {
-- if (monitorables.isEmpty()) {
-- return;
-- }
-- try {
-- jmxMonitoredNames = new String[monitorables.size()];
-- String[] descriptions = new String[monitorables.size()];
-- jmxMonitoredValues = new Object[monitorables.size()];
-- OpenType[] types = new OpenType[monitorables.size()];
-- jmxArrayIndexMap = new HashMap(monitorables.size());
-- int index = 0;
--
-- for (Monitorable monitorable : monitorables) {
-- jmxMonitoredNames[index] = monitorable.getName();
-- descriptions[index] = MoreObjects.firstNonNull(monitorable.getDescription(),
-- "(unknown)");
-- types[index] = getJmxType(monitorable.getType());
-- jmxArrayIndexMap.put(monitorable.getName(), index);
-- index++;
-- }
--
-- monitoredType = new CompositeType("Exposed PCP metrics",
-- "Details of all exposed PCP metrics", jmxMonitoredNames, descriptions, types);
-- } catch (OpenDataException e) {
-- throw new UnsupportedOperationException("Unable to configure JMX types", e);
-- }
-- }
--
-- private OpenType getJmxType(Class type) {
-- if (type == Boolean.class) {
-- return SimpleType.BOOLEAN;
-- } else if (type == Integer.class || type == AtomicInteger.class) {
-- return SimpleType.INTEGER;
-- } else if (type == Long.class || type == AtomicLong.class) {
-- return SimpleType.LONG;
-- } else if (type == Double.class) {
-- return SimpleType.DOUBLE;
-- } else if (type == String.class) {
-- return SimpleType.STRING;
-- } else {
-- throw new UnsupportedOperationException(
-- "Don't know how to process Monitorable of type [" + type + "]");
-- }
-- }
--
-- @ManagedAttribute(description = "All exposed parfait metrics")
-- public CompositeData getExposedMetrics() {
-- try {
-- return new CompositeDataSupport(monitoredType, jmxMonitoredNames, jmxMonitoredValues);
-- } catch (OpenDataException e) {
-- throw new RuntimeException(e);
-- }
-- }
--
-- private void updateData(Monitorable monitorable) {
-- Class type = monitorable.getType();
-- Object jmxValue;
--
-- if (type == Boolean.class || type == Integer.class || type == Long.class
-- || type == Double.class || type == String.class) {
-- jmxValue = monitorable.get();
-- } else if (type == AtomicInteger.class) {
-- jmxValue = ((AtomicInteger) monitorable.get()).intValue();
-- } else if (type == AtomicLong.class) {
-- jmxValue = ((AtomicLong) monitorable.get()).longValue();
-- } else {
-- throw new UnsupportedOperationException(
-- "Don't know how to process Monitorable of type [" + type + "]");
-- }
--
-- jmxMonitoredValues[jmxArrayIndexMap.get(monitorable.getName())] = jmxValue;
-- }
--
-- public class JmxUpdatingMonitor implements Monitor {
-- public void valueChanged(Monitorable monitorable) {
-- updateData(monitorable);
-- }
-- }
--}
-diff -Naurp parfait-0.5.3.orig/parfait-jmx/src/test/java/io/pcp/parfait/jmx/JmxViewTest.java parfait-0.5.3/parfait-jmx/src/test/java/io/pcp/parfait/jmx/JmxViewTest.java
---- parfait-0.5.3.orig/parfait-jmx/src/test/java/io/pcp/parfait/jmx/JmxViewTest.java 2017-10-03 11:44:14.000000000 +1100
-+++ parfait-0.5.3/parfait-jmx/src/test/java/io/pcp/parfait/jmx/JmxViewTest.java 1970-01-01 10:00:00.000000000 +1000
-@@ -1,137 +0,0 @@
--/*
-- * Copyright 2009-2017 Aconex
-- *
-- * Licensed under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at:
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-- * implied. See the License for the specific language governing
-- * permissions and limitations under the License.
-- */
--
--package io.pcp.parfait.jmx;
--
--import io.pcp.parfait.MonitorableRegistry;
--import io.pcp.parfait.MonitoredValue;
--import junit.framework.TestCase;
--
--import javax.management.openmbean.CompositeData;
--import java.io.IOException;
--
--public class JmxViewTest extends TestCase {
-- private MonitoredValue booleanValue = null;
--
-- private MonitoredValue intValue = null;
--
-- private MonitoredValue longValue = null;
-- private MonitoredValue doubleValue = null;
-- private MonitoredValue stringValue = null;
--
-- private MonitorableRegistry registry = new MonitorableRegistry();
--
-- private JmxView jmx = null;
--
-- public JmxViewTest() {
-- }
--
-- public void setUp() {
-- booleanValue = new MonitoredValue("boolean.value", "boolean.value.desc", registry, true);
-- intValue = new MonitoredValue("int.value", "int.value.desc", registry, 1);
-- longValue = new MonitoredValue("long.value", "long.value.desc", registry, 1l);
-- doubleValue = new MonitoredValue("double.value", "double.value.desc", registry, 1d);
-- stringValue = new MonitoredValue("string.value", "string.value.desc", registry, "!");
--
-- jmx = new JmxView();
-- }
--
-- public void tearDown() {
-- jmx.stopMonitoring(registry.getMonitorables());
-- }
--
-- public void testSupportsAllTypes() throws IOException, InterruptedException {
-- jmx.startMonitoring(registry.getMonitorables());
--
-- checkDataValues();
--
-- booleanValue.set(false);
-- checkDataValues();
--
-- booleanValue.set(true);
-- checkDataValues();
--
-- intValue.set(0);
-- checkDataValues();
--
-- intValue.set(Integer.MAX_VALUE);
-- checkDataValues();
--
-- intValue.set(Integer.MIN_VALUE);
-- checkDataValues();
--
-- intValue.set(1234567890);
-- checkDataValues();
--
-- longValue.set(0l);
-- checkDataValues();
--
-- longValue.set(Long.MAX_VALUE);
-- checkDataValues();
--
-- longValue.set(Long.MIN_VALUE);
-- checkDataValues();
--
-- longValue.set(1234567891012345679l);
-- checkDataValues();
--
-- doubleValue.set(0d);
-- checkDataValues();
--
-- doubleValue.set(Double.MAX_VALUE);
-- checkDataValues();
--
-- doubleValue.set(Double.MIN_VALUE);
-- checkDataValues();
--
-- doubleValue.set(Double.NEGATIVE_INFINITY);
-- checkDataValues();
--
-- doubleValue.set(Double.POSITIVE_INFINITY);
-- checkDataValues();
--
-- doubleValue.set(Double.NaN);
-- checkDataValues();
--
-- doubleValue.set(1234567891.012345679d);
-- checkDataValues();
--
-- stringValue.set("");
-- checkDataValues();
--
-- stringValue.set(createString(500));
-- checkDataValues();
-- }
--
-- private String createString(int length) {
-- StringBuilder sb = new StringBuilder();
-- for (int i = 0; i < length; i++) {
-- sb.append(Math.max(1, i & 255));
-- }
-- return sb.toString();
-- }
--
-- private void checkDataValues() {
--
-- CompositeData data = jmx.getExposedMetrics();
--
-- assertEquals(booleanValue.get(), data.get("boolean.value"));
-- assertEquals(doubleValue.get(), data.get("double.value"));
-- assertEquals((int) intValue.get(), data.get("int.value"));
-- assertEquals((long) longValue.get(), data.get("long.value"));
-- assertEquals(stringValue.get(), data.get("string.value"));
-- }
--}
diff --git a/parfait.spec b/parfait.spec
index 31336c9..6e14fbf 100644
--- a/parfait.spec
+++ b/parfait.spec
@@ -1,6 +1,6 @@
Name: parfait
Version: 0.5.4
-Release: 3%{?dist}
+Release: 4%{?dist}
Summary: Java libraries for Performance Co-Pilot (PCP)
License: ASL 2.0
URL: https://github.com/performancecopilot/parfait
@@ -57,6 +57,13 @@ BuildRequires: mvn(tec.uom:uom-se)
BuildArch: noarch
+# parfait used to have a dependency on log4j12. Since parfait 0.5.4-3, log4j is no longer a dependency.
+# This line makes sure that the log4j12 package will be removed when upgrading
+# to parfait 0.5.4-4, to remove all vulnerable log4j12 versions (CVE-2021-4104).
+# Also matches NVR 1.2.17-22.module+el8+...
+Obsoletes: log4j12 < 1.2.17-23
+Obsoletes: log4j12-javadoc < 1.2.17-23
+
%description
Parfait is a Java performance monitoring library that exposes and
collects metrics through a variety of outputs. It provides APIs
@@ -177,6 +184,10 @@ done
%config(noreplace)%{_sysconfdir}/%{name}/jvm.json
%changelog
+* Tue Jan 18 2022 Andreas Gerstmayr - 0.5.4-4
+- Obsolete (remove) vulnerable versions of log4j12 (NVR < 1.2.17-23)
+ when upgrading to parfait 0.5.4-4 (CVE-2021-4104)
+
* Thu Dec 16 2021 Nathan Scott - 0.5.4-3
- Drop all code explicitly using Log4J (BZ 2031674)
diff --git a/sources b/sources
index e0aa8f9..c9bf0a0 100644
--- a/sources
+++ b/sources
@@ -1 +1,3 @@
SHA512 (parfait-0.5.4.tar.gz) = f79bc26161c6f6d71bfbe47c73b7d486d50ea9243f8888cb0a6a4a078d9c145cf4b21025dbcc3933437941f49b24cfc4cc0fe0212ee0d7e4344972e77b33c914
+SHA512 (no-jcip-annotations.patch) = c53225cc398e752874f74a72ed669e813e3d4808e3ded80ce645f3d21e45e9294a4aaf3b5a91ff354f0d7e1c71368d7ae0608533dbcea410ed1a641e92d121d5
+SHA512 (no-more-objects.patch) = 8c34b57a5e9fdad4d5554996ee7534208751468bcd0638d0d607d1531c10aba8779afe386916d3c8b359975bb54e8f0e805a15b5b8339c06f8b4d4d1a691da1c