From 58291f87db2e7a3107639c058a6889d45ad3d970 Mon Sep 17 00:00:00 2001 From: Coty Sutherland Date: Thu, 12 Feb 2026 20:41:43 -0500 Subject: [PATCH] Resolves: RHEL-146482 Update to Apache Tomcat 9.0.110 for PQC support, and switched to compiling with Java 25 * Add java-25-headless to the BuildRequires & Requires lists & set JAVA_HOME to java-25 to always use it for compiling with java-25 * Add build-with-java-25.patch that replaces the attribute with explicit and attributes in javac tasks to support building with Java 25 JDK while generating appropriate bytecode versions. This enables the build to use Java 25 APIs while producing different bytecode targets, required for PQC support via FFM in Tomcat 9.0.110. * Drop the JmxRemoteLifecycleListener patch is it's no longer necessary * Use tar.gz instead of zip for the sources due to line ending issues * Add rm for commons-daemon.jar from bin --- .gitignore | 1 + JmxRemoteLifecycleListener.patch | 40 ----------------- build-with-java-25.patch | 76 ++++++++++++++++++++++++++++++++ rhbz-1857043.patch | 29 +++++++----- sources | 2 +- tomcat.spec | 30 +++++++++---- 6 files changed, 117 insertions(+), 61 deletions(-) delete mode 100644 JmxRemoteLifecycleListener.patch create mode 100644 build-with-java-25.patch diff --git a/.gitignore b/.gitignore index fd8738a..8bb47bf 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ apache-tomcat-*-src/ /tomcat-9.0.87.redhat-00011-src.zip /tomcat-9.0.87.redhat-00012-src.zip /tomcat-9.0.87.redhat-00013-src.zip +/apache-tomcat-9.0.110-src.tar.gz diff --git a/JmxRemoteLifecycleListener.patch b/JmxRemoteLifecycleListener.patch deleted file mode 100644 index 3145a54..0000000 --- a/JmxRemoteLifecycleListener.patch +++ /dev/null @@ -1,40 +0,0 @@ -diff --git a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -index f62f8d1..db19960 100644 ---- a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -+++ b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -@@ -611,34 +611,28 @@ public class JmxRemoteLifecycleListener extends SSLHostConfig implements Lifecyc - * Better to use the internal API than re-invent the wheel. - */ - @SuppressWarnings("restriction") -- private static class JmxRegistry extends sun.rmi.registry.RegistryImpl { -+ private static class JmxRegistry { - private static final long serialVersionUID = -3772054804656428217L; - private final String jmxName; - private final Remote jmxServer; - public JmxRegistry(int port, RMIClientSocketFactory csf, - RMIServerSocketFactory ssf, String jmxName, Remote jmxServer) throws RemoteException { -- super(port, csf, ssf); - this.jmxName = jmxName; - this.jmxServer = jmxServer; - } -- @Override - public Remote lookup(String name) - throws RemoteException, NotBoundException { - return (jmxName.equals(name)) ? jmxServer : null; - } -- @Override - public void bind(String name, Remote obj) - throws RemoteException, AlreadyBoundException, AccessException { - } -- @Override - public void unbind(String name) - throws RemoteException, NotBoundException, AccessException { - } -- @Override - public void rebind(String name, Remote obj) - throws RemoteException, AccessException { - } -- @Override - public String[] list() throws RemoteException { - return new String[] { jmxName }; - } diff --git a/build-with-java-25.patch b/build-with-java-25.patch new file mode 100644 index 0000000..cb7c5eb --- /dev/null +++ b/build-with-java-25.patch @@ -0,0 +1,76 @@ +--- build.xml.orig 2026-02-12 14:28:31.466893106 -0500 ++++ build.xml 2026-02-12 14:28:44.320933346 -0500 +@@ -968,7 +968,7 @@ + + ++ addOSGi="false" /> + + + + addOSGi="false" /> @@ -130,7 +137,7 @@ diff -up ./build.xml.orig ./build.xml = 1:1.8 or java-1.8.0-headless or java-11-headless or java-17-headless or java-21-headless or java >= 1:1.8) +Requires: (java-headless >= 1:1.8 or java-1.8.0-headless or java-11-headless or java-17-headless or java-21-headless or java-25-headless or java >= 1:1.8) Requires: javapackages-tools Requires: %{name}-lib = %{epoch}:%{version}-%{release} %if 0%{?fedora} || 0%{?rhel} > 7 @@ -186,7 +187,7 @@ Requires: %{name} = %{epoch}:%{version}-%{release} The ROOT web application for Apache Tomcat. %prep -%setup -q -n apache-%{packdname} +%setup -q -n %{packdname} # remove pre-built binaries and windows files find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "*.gz" -o \ -name "*.jar" -o -name "*.war" -o -name "*.zip" \) -delete @@ -197,7 +198,7 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name " %patch -P3 -p0 %patch -P4 -p0 %patch -P6 -p0 -%patch -P7 -p1 +%patch -P7 -p0 # Remove webservices naming resources as it's generally unused %{__rm} -rf java/org/apache/naming/factory/webservices @@ -217,8 +218,12 @@ export OPT_JAR_LIST="xalan-j2-serializer" # so just create a dummy file for later removal touch HACK +# Adding JAVA_HOME to always compile with java-25 instead of autodetecting +export JAVA_HOME=%{_jvmdir}/java-25-openjdk +export PATH=$JAVA_HOME/bin:$PATH + # who needs a build.properties file anyway -%{ant} -Dbase.path="." \ +ant -Dbase.path="." \ -Dbuild.compiler="modern" \ -Dcommons-daemon.jar="HACK" \ -Dcommons-daemon.native.src.tgz="HACK" \ @@ -237,6 +242,9 @@ touch HACK # remove some jars that we'll replace with symlinks later %{__rm} output/build/lib/ecj.jar +# Cleanup commons-daemon.jar that somehow appeared since last build, but is unnecessary +%{__rm} -rf output/build/bin/commons-daemon.jar + # Remove the example webapps per Apache Tomcat Security Considerations # see https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html %{__rm} -rf output/build/webapps/examples @@ -557,6 +565,10 @@ fi %changelog +* Wed Feb 11 2026 Coty Sutherland - 1:9.0.110-1 +- Resolves: RHEL-148687 + Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support + * Wed Jan 21 2026 Pietro Meloni - 1:9.0.87-7 - Resolves: RHEL-124516 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)