diff --git a/.gitignore b/.gitignore index c364ab4..13bbb64 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ +results_tomcat9 +*.rpm /tomcat-9.0.87.redhat-00005-src.zip /tomcat-9.0.87.redhat-00006-src.zip /tomcat-9.0.87.redhat-00008-src.zip @@ -5,3 +7,4 @@ /tomcat-9.0.87.redhat-00011-src.zip /tomcat-9.0.87.redhat-00012-src.zip /tomcat-9.0.87.redhat-00013-src.zip +/apache-tomcat-9.0.110-src.tar.gz diff --git a/JmxRemoteLifecycleListener.patch b/JmxRemoteLifecycleListener.patch deleted file mode 100644 index 3145a54..0000000 --- a/JmxRemoteLifecycleListener.patch +++ /dev/null @@ -1,40 +0,0 @@ -diff --git a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -index f62f8d1..db19960 100644 ---- a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -+++ b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -@@ -611,34 +611,28 @@ public class JmxRemoteLifecycleListener extends SSLHostConfig implements Lifecyc - * Better to use the internal API than re-invent the wheel. - */ - @SuppressWarnings("restriction") -- private static class JmxRegistry extends sun.rmi.registry.RegistryImpl { -+ private static class JmxRegistry { - private static final long serialVersionUID = -3772054804656428217L; - private final String jmxName; - private final Remote jmxServer; - public JmxRegistry(int port, RMIClientSocketFactory csf, - RMIServerSocketFactory ssf, String jmxName, Remote jmxServer) throws RemoteException { -- super(port, csf, ssf); - this.jmxName = jmxName; - this.jmxServer = jmxServer; - } -- @Override - public Remote lookup(String name) - throws RemoteException, NotBoundException { - return (jmxName.equals(name)) ? jmxServer : null; - } -- @Override - public void bind(String name, Remote obj) - throws RemoteException, AlreadyBoundException, AccessException { - } -- @Override - public void unbind(String name) - throws RemoteException, NotBoundException, AccessException { - } -- @Override - public void rebind(String name, Remote obj) - throws RemoteException, AccessException { - } -- @Override - public String[] list() throws RemoteException { - return new String[] { jmxName }; - } diff --git a/build-with-java-25.patch b/build-with-java-25.patch new file mode 100644 index 0000000..cb7c5eb --- /dev/null +++ b/build-with-java-25.patch @@ -0,0 +1,76 @@ +--- build.xml.orig 2026-02-12 14:28:31.466893106 -0500 ++++ build.xml 2026-02-12 14:28:44.320933346 -0500 +@@ -968,7 +968,7 @@ + + ++ addOSGi="false" /> + + + + addOSGi="false" /> @@ -130,7 +137,7 @@ diff -up ./build.xml.orig ./build.xml = 1:4.10 BuildRequires: findutils -BuildRequires: java-devel BuildRequires: javapackages-local BuildRequires: aqute-bnd BuildRequires: aqute-bndlib BuildRequires: systemd +BuildRequires: java-25-devel -Requires: java-headless +Requires: (java-headless or java-25-headless) Requires: javapackages-tools Requires: %{name}-lib = %{epoch}:%{version}-%{release} @@ -201,7 +201,7 @@ Obsoletes: tomcat-webapps < 1:10.0.0-1 The ROOT web application for Apache Tomcat. %prep -%setup -q -n apache-%{packdname} +%setup -q -n %{packdname} # remove pre-built binaries and windows files find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "*.gz" -o \ -name "*.jar" -o -name "*.war" -o -name "*.zip" \) -delete @@ -211,7 +211,7 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name " %patch -P3 -p0 %patch -P4 -p0 %patch -P6 -p0 -%patch -P7 -p1 +%patch -P7 -p0 # Remove webservices naming resources as it's generally unused %{__rm} -rf java/org/apache/naming/factory/webservices @@ -231,8 +231,12 @@ export OPT_JAR_LIST="xalan-j2-serializer" # so just create a dummy file for later removal touch HACK +# Adding JAVA_HOME to always compile with java-25 instead of autodetecting +export JAVA_HOME=%{_jvmdir}/java-25-openjdk +export PATH=$JAVA_HOME/bin:$PATH + # who needs a build.properties file anyway -%{ant} -Dbase.path="." \ +ant -Dbase.path="." \ -Dbuild.compiler="modern" \ -Dcommons-daemon.jar="HACK" \ -Dcommons-daemon.native.src.tgz="HACK" \ @@ -251,6 +255,9 @@ touch HACK # remove some jars that we'll replace with symlinks later %{__rm} output/build/lib/ecj.jar +# Cleanup commons-daemon.jar that somehow appeared since last build, but is unnecessary +%{__rm} -rf output/build/bin/commons-daemon.jar + # Remove the example webapps per Apache Tomcat Security Considerations # see https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html %{__rm} -rf output/build/webapps/examples @@ -398,6 +405,9 @@ popd %mvn_file org.apache.tomcat:tomcat-coyote tomcat/tomcat-coyote %mvn_artifact res/maven/tomcat-coyote.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-coyote.jar +%mvn_file org.apache.tomcat:tomcat-coyote-ffm tomcat/tomcat-coyote-ffm +%mvn_artifact res/maven/tomcat-coyote-ffm.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-coyote-ffm.jar + %mvn_file org.apache.tomcat:tomcat-dbcp tomcat/tomcat-dbcp %mvn_artifact res/maven/tomcat-dbcp.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-dbcp.jar @@ -624,9 +634,13 @@ fi %{appdir}/ROOT %changelog -* Tue Feb 10 2026 Eduard Abdullin - 1:9.0.87-9.alma.1 +* Sat Feb 21 2026 Eduard Abdullin - 1:9.0.110-1.alma.1 - Exclude i686 architecture from build +* Wed Feb 11 2026 Coty Sutherland - 1:9.0.110-1 +- Resolves: RHEL-148687 + Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support + * Fri Jan 23 2026 Pietro Meloni - 1:9.0.87-9 - Resolves: RHEL-124496 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)