Bug 2338283
| Summary: | pki-tomcat (hence freeipa) fails to start with tomcat 10.x | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Adam Williamson <awilliam> |
| Component: | dogtag-pki | Assignee: | Jack Magne <jmagne> |
| Status: | ASSIGNED --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 42 | CC: | abokovoy, alee, cfu, csutherl, dsoumis, edewata, ftrivino, ipa-maint, jmagne, mfargett, mhjacks, rcritten, ssorce, twoerner |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | Bug | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2309206 | ||
|
Description
Adam Williamson
2025-01-15 17:48:41 UTC
note, we also need to make sure FreeIPA *upgrades* from F41 (hence tomcat 9) work. This is also a release-blocking requirement and the openQA tests test it, so updates will fail tests unless it works. Yes, this is something totally should be done on dogtag-pki side. I started a PR half a year ago but it needs to be taken over by the Dogtag folks: https://github.com/dogtagpki/pki/pull/4796. My understanding is that they plan to work on it soon. As the Tomcat maintainers and change owners for the Tomcat 10 update, we have taken the necessary steps outlined in the Change Proposal to ensure compatibility and functionality. However, as already noted, this update inherently affects applications relying on the deprecated Java EE namespace, requiring migration to the Jakarta EE namespace. This includes FreeIPA, as identified. We want to note that we’ve been in communication with the PKI team to address these migration challenges collaboratively. While we’ve made efforts to ensure Tomcat’s compatibility, certain application-specific updates fall outside the scope of the Tomcat maintainers' responsibilities. PKI team is currently completing the necessary migration to maintain compatibility with Tomcat 10. With the adoption of Tomcat 10 in RHEL 10, it is crucial to resolve these compatibility issues. As part of this effort, we are making a final coordinated push to address concerns and complete the migration tasks. Progress to date on this issue: - Created local builds of pki and jss, against the latest api. - Installed ca - The legacy UI of the CA works fine, but discovered that rest easy calls don't work. This is important because these calls are uses all over the place and are needed to install additional subsystems such as kra. - Modified our current older version of resteasy to compile against the latest tomcat-servlet-api. The rest calls are still not working. - Now working on either attempting to get the older resteasy working or upgrade to the earliest version that is compiled against the tomat 10 based api. The main change being the imports of jakarta.servlet instead of the older javax.servlet. -Will update any progress this is top priority. This bug appears to have been reported against 'rawhide' during the Fedora Linux 42 development cycle. Changing version to 42. |