Fedora 28 Mass Merge into rhel-8.0 - fed_hash: 2664e1c9a9d9d99fcf4131975b39f483788af336

.gitignore

@@ -1 +1,2 @@
-/apache-tomcat-8.0.47-src.tar.gz
+apache-tomcat-*-src.tar.gz
+

disableJavadocFailOnWarning.patch

@@ -0,0 +1,47 @@
+--- build.xml.orig	2018-03-15 13:49:03.366863009 -0400
++++ build.xml	2018-03-15 13:49:29.690870139 -0400
+@@ -1777,7 +1777,7 @@ Apache Tomcat ${version} native binaries
+       additionalparam="-breakiterator -notimestamp"
+       maxmemory="512m"
+       failonerror="true"
+-      failonwarning="true">
++      failonwarning="false">
+       <classpath>
+         <path refid="compile.classpath"/>
+         <path refid="tomcat.webservices.classpath"/>
+@@ -1798,7 +1798,7 @@ Apache Tomcat ${version} native binaries
+       additionalparam="-breakiterator -notimestamp"
+       maxmemory="512m"
+       failonerror="true"
+-      failonwarning="true">
++      failonwarning="false">
+       <classpath>
+         <path refid="compile.classpath"/>
+         <path refid="tomcat.webservices.classpath"/>
+@@ -1819,7 +1819,7 @@ Apache Tomcat ${version} native binaries
+       additionalparam="-breakiterator -notimestamp"
+       maxmemory="512m"
+       failonerror="true"
+-      failonwarning="true">
++      failonwarning="false">
+       <classpath>
+         <path refid="compile.classpath"/>
+         <path refid="tomcat.webservices.classpath"/>
+@@ -1840,7 +1840,7 @@ Apache Tomcat ${version} native binaries
+       additionalparam="-breakiterator -notimestamp"
+       maxmemory="512m"
+       failonerror="true"
+-      failonwarning="true">
++      failonwarning="false">
+       <classpath>
+         <path refid="compile.classpath"/>
+         <path refid="tomcat.webservices.classpath"/>
+@@ -1860,7 +1860,7 @@ Apache Tomcat ${version} native binaries
+       additionalparam="-breakiterator -notimestamp ${java9.add.modules}"
+       maxmemory="512m"
+       failonerror="true"
+-      failonwarning="true">
++      failonwarning="false">
+       <classpath>
+         <path refid="compile.classpath"/>
+         <path refid="tomcat.webservices.classpath"/>

sources

@@ -1 +1 @@
-9f28b75bcb96ebf3b9fe118aab0df6f6  apache-tomcat-8.0.47-src.tar.gz
+SHA512 (apache-tomcat-8.5.30-src.tar.gz) = 53729cfd1859872109f816df2642e3cd776a7faf8c55b1d50df0459f12958aacbf36debe6e8f10c19ab0a5bb2973fa63a2fec57f83ecaf19f4cf9d82e4a20265

tomcat.spec

@@ -30,14 +30,14 @@
 
 %global jspspec 2.3
 %global major_version 8
-%global minor_version 0
+%global minor_version 5
-%global micro_version 47
+%global micro_version 30
 %global packdname apache-tomcat-%{version}-src
 %global servletspec 3.1
 %global elspec 3.0
 %global tcuid 91
-#Recommended version is specified in java/org/apache/catalina/core/AprLifecycleListener.java
+# Recommended version is specified in java/org/apache/catalina/core/AprLifecycleListener.java
-%global native_version 1.1.33
+%global native_version 1.2.8
 
 
 # FHS 2.3 compliant tree structure - http://www.pathname.com/fhs/2.3/
@@ -54,10 +54,16 @@
 %global _initrddir %{_sysconfdir}/init.d
 %global _systemddir /lib/systemd/system
 
+# Fedora doesn't seem to have this macro, so we define it if it doesn't exist
+%{!?_mavendepmapfragdir: %global _mavendepmapfragdir /usr/share/maven-metadata}
+# Fedora 24 erroneously uses %%{_datadir}/maven-fragments instead of /maven-metadata for some reason...
+# Override the mavendepmapfragdir var on fc24
+%{?fc24: %global _mavendepmapfragdir /usr/share/maven-metadata}
+
 Name:          tomcat
 Epoch:         1
 Version:       %{major_version}.%{minor_version}.%{micro_version}
-Release:       3%{?dist}
+Release:       1%{?dist}
 Summary:       Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
 
 Group:         System Environment/Daemons
@@ -87,6 +93,7 @@ Source32:      tomcat-named.service
 Patch0:        %{name}-%{major_version}.%{minor_version}-bootstrap-MANIFEST.MF.patch
 Patch1:        %{name}-%{major_version}.%{minor_version}-tomcat-users-webapp.patch
 Patch2:        %{name}-8.0.36-CompilerOptionsV9.patch
+Patch3:        disableJavadocFailOnWarning.patch
 
 BuildArch:     noarch
 
@@ -109,8 +116,8 @@ BuildRequires: junit
 BuildRequires: geronimo-jaxrpc
 BuildRequires: wsdl4j
 BuildRequires: systemd-units
+
 Requires:      apache-commons-daemon
-Requires:      apache-commons-logging
 Requires:      apache-commons-collections
 Requires:      apache-commons-dbcp
 Requires:      apache-commons-pool
@@ -176,7 +183,7 @@ which allows tomcat to perform some privileged operations
 
 %package jsp-%{jspspec}-api
 Group: Development/Libraries
-Summary: Apache Tomcat JSP API implementation classes
+Summary: Apache Tomcat JavaServer Pages v%{jspspec} API Implementation Classes
 Provides: jsp = %{jspspec}
 Obsoletes: %{name}-jsp-2.2-api
 Requires: %{name}-servlet-%{servletspec}-api = %{epoch}:%{version}-%{release}
@@ -185,7 +192,7 @@ Requires(post): chkconfig
 Requires(postun): chkconfig
 
 %description jsp-%{jspspec}-api
-Apache Tomcat JSP API implementation classes.
+Apache Tomcat JSP API Implementation Classes.
 
 %package lib
 Group: Development/Libraries
@@ -204,7 +211,7 @@ Libraries needed to run the Tomcat Web container.
 
 %package servlet-%{servletspec}-api
 Group: Development/Libraries
-Summary: Apache Tomcat Servlet API implementation classes
+Summary: Apache Tomcat Java Servlet v%{servletspec} API Implementation Classes
 Provides: servlet = %{servletspec}
 Provides: servlet6
 Provides: servlet3
@@ -213,18 +220,18 @@ Requires(post): chkconfig
 Requires(postun): chkconfig
 
 %description servlet-%{servletspec}-api
-Apache Tomcat Servlet API implementation classes.
+Apache Tomcat Servlet API Implementation Classes.
 
 %package el-%{elspec}-api
 Group: Development/Libraries
-Summary: Expression Language v%{elspec} API
+Summary: Apache Tomcat Expression Language v%{elspec} API Implementation Classes
 Provides: el_api = %{elspec}
 Obsoletes: %{name}-el-2.2-api
 Requires(post): chkconfig
 Requires(postun): chkconfig
 
 %description el-%{elspec}-api
-Expression Language %{elspec}.
+Apache Tomcat EL API Implementation Classes.
 
 %package webapps
 Group: Applications/Internet
@@ -244,6 +251,7 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "
 %patch0 -p0
 %patch1 -p0
 %patch2 -p0
+%patch3 -p0
 
 %{__ln_s} $(build-classpath tomcat-taglibs-standard/taglibs-standard-impl) webapps/examples/WEB-INF/lib/jstl.jar
 %{__ln_s} $(build-classpath tomcat-taglibs-standard/taglibs-standard-compat) webapps/examples/WEB-INF/lib/standard.jar
@@ -254,9 +262,6 @@ export OPT_JAR_LIST="xalan-j2-serializer"
    # tomcat-dbcp.jar with apache-commons-{collections,dbcp,pool}-tomcat5.jar
    # so just create a dummy file for later removal
    touch HACK
-   %{__mkdir_p} HACKDIR
-   touch HACKDIR/build.xml
-   touch HACKDIR/LICENSE
 
    # who needs a build.properties file anyway
    %{ant} -Dbase.path="." \
@@ -264,29 +269,22 @@ export OPT_JAR_LIST="xalan-j2-serializer"
       -Dcommons-collections.jar="$(build-classpath apache-commons-collections)" \
       -Dcommons-daemon.jar="$(build-classpath apache-commons-daemon)" \
       -Dcommons-daemon.native.src.tgz="HACK" \
-      -Djasper-jdt.jar="$(build-classpath ecj)" \
       -Djdt.jar="$(build-classpath ecj)" \
       -Dtomcat-native.tar.gz="HACK" \
       -Dtomcat-native.home="." \
-      -Dtomcat-native.win.path="HACKDIR" \
       -Dcommons-daemon.native.win.mgr.exe="HACK" \
       -Dnsis.exe="HACK" \
       -Djaxrpc-lib.jar="$(build-classpath jaxrpc)" \
       -Dwsdl4j-lib.jar="$(build-classpath wsdl4j)" \
-      -Dcommons-pool.home="HACKDIR" \
-      -Dcommons-dbcp.home="HACKDIR" \
       -Dno.build.dbcp=true \
       -Dversion="%{version}" \
       -Dversion.build="%{micro_version}" \
       -Djava.7.home=%{java_home} \
+      -Dexecute.validate=false \
       deploy dist-prepare dist-source javadoc
 
     # remove some jars that we'll replace with symlinks later
-   %{__rm} output/build/bin/commons-daemon.jar \
+    %{__rm} output/build/bin/commons-daemon.jar output/build/lib/ecj.jar
-           output/build/lib/ecj.jar
-
-    # remove the cruft we created
-   %{__rm} output/build/bin/tomcat-native.tar.gz
 pushd output/dist/src/webapps/docs/appdev/sample/src
 %{__mkdir_p} ../web/WEB-INF/classes
 %{javac} -cp ../../../../../../../../output/build/lib/servlet-api.jar -d ../web/WEB-INF/classes mypackage/Hello.java
@@ -348,7 +346,7 @@ zip output/build/bin/tomcat-juli.jar META-INF/MANIFEST.MF
 # First copy supporting libs to tomcat lib
 pushd output/build
     %{__cp} -a bin/*.{jar,xml} ${RPM_BUILD_ROOT}%{bindir}
-    %{__cp} -a conf/*.{policy,properties,xml} ${RPM_BUILD_ROOT}%{confdir}
+    %{__cp} -a conf/*.{policy,properties,xml,xsd} ${RPM_BUILD_ROOT}%{confdir}
     %{__cp} -a lib/*.jar ${RPM_BUILD_ROOT}%{libdir}
     %{__cp} -a webapps/* ${RPM_BUILD_ROOT}%{appdir}
 popd
@@ -526,6 +524,10 @@ done
 %{__cp} -a tomcat-websocket.pom ${RPM_BUILD_ROOT}%{_mavenpomdir}/JPP.%{name}-tomcat-websocket.pom
 %add_maven_depmap JPP.%{name}-tomcat-websocket.pom %{name}/tomcat-websocket.jar
 
+# tomcat-jaspic-api
+%{__cp} -a tomcat-jaspic-api.pom ${RPM_BUILD_ROOT}%{_mavenpomdir}/JPP.%{name}-jaspic-api.pom
+%add_maven_depmap JPP.%{name}-jaspic-api.pom %{name}/jaspic-api.jar
+
 
 %pre
 # add the tomcat user and group
@@ -618,6 +620,9 @@ fi
 %config(noreplace) %{confdir}/context.xml
 %config(noreplace) %{confdir}/server.xml
 %attr(0640,root,tomcat) %config(noreplace) %{confdir}/tomcat-users.xml
+%attr(0664,root,tomcat) %{confdir}/tomcat-users.xsd
+%attr(0664,root,tomcat) %config(noreplace) %{confdir}/jaspic-providers.xml
+%attr(0664,root,tomcat) %{confdir}/jaspic-providers.xsd
 %config(noreplace) %{confdir}/web.xml
 %dir %{homedir}
 %{bindir}/bootstrap.jar
@@ -648,7 +653,9 @@ fi
 
 %files lib -f output/dist/src/res/maven/.mfiles-tomcat-lib
 %defattr(-,root,root,-)
-%{libdir}
+%dir %{libdir}
+%{libdir}/*.jar
+%{_javadir}/*.jar
 %{bindir}/tomcat-juli.jar
 %{_mavenpomdir}/JPP.%{name}-annotations-api.pom
 %{_mavenpomdir}/JPP.%{name}-catalina-ha.pom
@@ -663,8 +670,12 @@ fi
 %{_mavenpomdir}/JPP.%{name}-tomcat-jdbc.pom
 %{_mavenpomdir}/JPP.%{name}-websocket-api.pom
 %{_mavenpomdir}/JPP.%{name}-tomcat-websocket.pom
+%{_mavenpomdir}/JPP.%{name}-jaspic-api.pom
 %{_datadir}/maven-metadata/tomcat.xml
 %exclude %{libdir}/%{name}-el-%{elspec}-api.jar
+%exclude %{_javadir}/%{name}-servlet-%{servletspec}*.jar
+%exclude %{_javadir}/%{name}-el-%{elspec}-api.jar
+%exclude %{_javadir}/%{name}-jsp-%{jspspec}*.jar
 
 %files servlet-%{servletspec}-api -f output/dist/src/res/maven/.mfiles-tomcat-servlet-api
 %defattr(-,root,root,-)
@@ -690,6 +701,20 @@ fi
 %attr(0660,tomcat,tomcat) %verify(not size md5 mtime) %{logdir}/catalina.out
 
 %changelog
+* Tue May 01 2018 Coty Sutherland <csutherl@redhat.com> - 1:8.5.30-1
+- Update to 8.5.30
+
+* Thu Mar 15 2018 Coty Sutherland <csutherl@redhat.com> - 1:8.5.29-1
+- Update to 8.5.29
+- Resolves: rhbz#1548290 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources
+- Resolves: rhbz#1548284 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
+
+* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1:8.0.49-2
+- Escape macros in %%changelog
+
+* Thu Feb 01 2018 Coty Sutherland <csutherl@redhat.com> - 1:8.0.49-1
+- Update to 8.0.49
+
 * Tue Dec 12 2017 Merlin Mathesius <mmathesi@redhat.com> - 1:8.0.47-3
 - Cleanup spec file conditionals
 
@@ -840,7 +865,7 @@ fi
 - Updated to 7.0.52
 - Rewrite jsvc implementation, resolves: rhbz#1051743
 - Switch to java-headless R, resolves: rhbz#1068566
-- Create and own %{_localstatedir}/lib/tomcats, resolves: rhbz#1026741
+- Create and own %%{_localstatedir}/lib/tomcats, resolves: rhbz#1026741
 - Add pom for tomcat-jdbc, resolves: rhbz#1011003 
 
 * Tue Jan 21 2014 Mikolaj Izdebski <mizdebsk@redhat.com> - 0:7.0.47-3
@@ -919,7 +944,7 @@ fi
 - Updated to 7.0.28
 - Resolves: rhbz 820119 Remove bundled apache-commons-dbcp
 - Resolves: rhbz 814900 Added tomcat-coyote POM
-- Resolves: rhbz 810775 Remove systemv stuff from %post scriptlet
+- Resolves: rhbz 810775 Remove systemv stuff from %%post scriptlet
 - Remove redhat-lsb R 
 
 * Mon Apr 9 2012 Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.27-2
@@ -1039,7 +1064,7 @@ fi
 
 * Thu Apr 28 2011 Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.12-2
 - Package now named just tomcat instead of tomcat7
-- Removed Provides:  %{name}-log4j
+- Removed Provides:  %%{name}-log4j
 - Switched to apache-commons-* names instead of jakarta-commons-* .
 - Remove the old changelog
 - BR/R java >= 1:1.6.0 , same for java-devel