From f5d3a1825fec2b7da524a46ab0e36d360ab25795 Mon Sep 17 00:00:00 2001 From: Coty Sutherland Date: Thu, 12 Feb 2026 20:41:43 -0500 Subject: [PATCH] Resolves: RHEL-148687 Update to Apache Tomcat 9.0.110 for PQC support, and switched to compiling with Java 25 * Add java-25-headless to the BuildRequires & Requires lists & set JAVA_HOME to java-25 to always use it for compiling with java-25 * Add build-with-java-25.patch that replaces the attribute with explicit and attributes in javac tasks to support building with Java 25 JDK while generating appropriate bytecode versions. This enables the build to use Java 25 APIs while producing different bytecode targets, required for PQC support via FFM in Tomcat 9.0.110. * Drop the JmxRemoteLifecycleListener patch is it's no longer necessary * Use tar.gz instead of zip for the sources due to line ending issues * Add rm for commons-daemon.jar from bin --- .gitignore | 3 ++ JmxRemoteLifecycleListener.patch | 40 ----------------- build-with-java-25.patch | 76 ++++++++++++++++++++++++++++++++ rhbz-1857043.patch | 29 +++++++----- sources | 2 +- tomcat9.spec | 34 +++++++++----- 6 files changed, 122 insertions(+), 62 deletions(-) delete mode 100644 JmxRemoteLifecycleListener.patch create mode 100644 build-with-java-25.patch diff --git a/.gitignore b/.gitignore index c364ab4..13bbb64 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ +results_tomcat9 +*.rpm /tomcat-9.0.87.redhat-00005-src.zip /tomcat-9.0.87.redhat-00006-src.zip /tomcat-9.0.87.redhat-00008-src.zip @@ -5,3 +7,4 @@ /tomcat-9.0.87.redhat-00011-src.zip /tomcat-9.0.87.redhat-00012-src.zip /tomcat-9.0.87.redhat-00013-src.zip +/apache-tomcat-9.0.110-src.tar.gz diff --git a/JmxRemoteLifecycleListener.patch b/JmxRemoteLifecycleListener.patch deleted file mode 100644 index 3145a54..0000000 --- a/JmxRemoteLifecycleListener.patch +++ /dev/null @@ -1,40 +0,0 @@ -diff --git a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -index f62f8d1..db19960 100644 ---- a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -+++ b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -@@ -611,34 +611,28 @@ public class JmxRemoteLifecycleListener extends SSLHostConfig implements Lifecyc - * Better to use the internal API than re-invent the wheel. - */ - @SuppressWarnings("restriction") -- private static class JmxRegistry extends sun.rmi.registry.RegistryImpl { -+ private static class JmxRegistry { - private static final long serialVersionUID = -3772054804656428217L; - private final String jmxName; - private final Remote jmxServer; - public JmxRegistry(int port, RMIClientSocketFactory csf, - RMIServerSocketFactory ssf, String jmxName, Remote jmxServer) throws RemoteException { -- super(port, csf, ssf); - this.jmxName = jmxName; - this.jmxServer = jmxServer; - } -- @Override - public Remote lookup(String name) - throws RemoteException, NotBoundException { - return (jmxName.equals(name)) ? jmxServer : null; - } -- @Override - public void bind(String name, Remote obj) - throws RemoteException, AlreadyBoundException, AccessException { - } -- @Override - public void unbind(String name) - throws RemoteException, NotBoundException, AccessException { - } -- @Override - public void rebind(String name, Remote obj) - throws RemoteException, AccessException { - } -- @Override - public String[] list() throws RemoteException { - return new String[] { jmxName }; - } diff --git a/build-with-java-25.patch b/build-with-java-25.patch new file mode 100644 index 0000000..cb7c5eb --- /dev/null +++ b/build-with-java-25.patch @@ -0,0 +1,76 @@ +--- build.xml.orig 2026-02-12 14:28:31.466893106 -0500 ++++ build.xml 2026-02-12 14:28:44.320933346 -0500 +@@ -968,7 +968,7 @@ + + ++ addOSGi="false" /> + + + + addOSGi="false" /> @@ -130,7 +137,7 @@ diff -up ./build.xml.orig ./build.xml = 1:4.10 BuildRequires: findutils -BuildRequires: java-devel BuildRequires: javapackages-local BuildRequires: aqute-bnd BuildRequires: aqute-bndlib BuildRequires: systemd +BuildRequires: java-25-devel -Requires: java-headless +Requires: (java-headless or java-25-headless) Requires: javapackages-tools Requires: %{name}-lib = %{epoch}:%{version}-%{release} @@ -199,7 +199,7 @@ Obsoletes: tomcat-webapps < 1:10.0.0-1 The ROOT web application for Apache Tomcat. %prep -%setup -q -n apache-%{packdname} +%setup -q -n %{packdname} # remove pre-built binaries and windows files find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "*.gz" -o \ -name "*.jar" -o -name "*.war" -o -name "*.zip" \) -delete @@ -209,7 +209,7 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name " %patch -P3 -p0 %patch -P4 -p0 %patch -P6 -p0 -%patch -P7 -p1 +%patch -P7 -p0 # Remove webservices naming resources as it's generally unused %{__rm} -rf java/org/apache/naming/factory/webservices @@ -229,8 +229,12 @@ export OPT_JAR_LIST="xalan-j2-serializer" # so just create a dummy file for later removal touch HACK +# Adding JAVA_HOME to always compile with java-25 instead of autodetecting +export JAVA_HOME=%{_jvmdir}/java-25-openjdk +export PATH=$JAVA_HOME/bin:$PATH + # who needs a build.properties file anyway -%{ant} -Dbase.path="." \ +ant -Dbase.path="." \ -Dbuild.compiler="modern" \ -Dcommons-daemon.jar="HACK" \ -Dcommons-daemon.native.src.tgz="HACK" \ @@ -249,6 +253,9 @@ touch HACK # remove some jars that we'll replace with symlinks later %{__rm} output/build/lib/ecj.jar +# Cleanup commons-daemon.jar that somehow appeared since last build, but is unnecessary +%{__rm} -rf output/build/bin/commons-daemon.jar + # Remove the example webapps per Apache Tomcat Security Considerations # see https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html %{__rm} -rf output/build/webapps/examples @@ -396,6 +403,9 @@ popd %mvn_file org.apache.tomcat:tomcat-coyote tomcat/tomcat-coyote %mvn_artifact res/maven/tomcat-coyote.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-coyote.jar +%mvn_file org.apache.tomcat:tomcat-coyote-ffm tomcat/tomcat-coyote-ffm +%mvn_artifact res/maven/tomcat-coyote-ffm.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-coyote-ffm.jar + %mvn_file org.apache.tomcat:tomcat-dbcp tomcat/tomcat-dbcp %mvn_artifact res/maven/tomcat-dbcp.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-dbcp.jar @@ -622,6 +632,10 @@ fi %{appdir}/ROOT %changelog +* Wed Feb 11 2026 Coty Sutherland - 1:9.0.110-1 +- Resolves: RHEL-148687 + Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support + * Fri Jan 23 2026 Pietro Meloni - 1:9.0.87-9 - Resolves: RHEL-124496 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)