Bug 1154978 - Tomcat 7 needs to be upgraded to 7.0.56
Summary: Tomcat 7 needs to be upgraded to 7.0.56
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: tomcat
Version: el6
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: Ivan Afonichev
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: fst_owner=dcafaro, fst_ping=1
Keywords:
Depends On:
Blocks: 1140317 1222577
TreeView+ depends on / blocked
 
Reported: 2014-10-21 07:55 UTC by j2ro
Modified: 2016-06-02 03:50 UTC (History)
13 users (show)

(edit)
Clone Of:
: 1337940 (view as bug list)
(edit)
Last Closed: 2016-02-07 01:25:05 UTC


Attachments (Terms of Use)
Proposed spec file with patches added (31.33 KB, text/plain)
2014-10-30 14:33 UTC, Stefan Hecker
no flags Details
JDTCompiler patch (1.98 KB, patch)
2014-10-30 14:34 UTC, Stefan Hecker
no flags Details | Diff
build xml patch (1.85 KB, patch)
2014-10-30 14:35 UTC, Stefan Hecker
no flags Details | Diff
build.properties for java.7.home (45 bytes, text/plain)
2014-11-06 10:13 UTC, Stefan Hecker
no flags Details
Tomcat spec patch (3.10 KB, patch)
2014-11-07 09:10 UTC, Vlad Slepukhin
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Apache Bugzilla 57016 None None None Never

Description j2ro 2014-10-21 07:55:20 UTC
Description of problem:

Tomcat 7.0.56 contains an important fix for session management (https://www.mail-archive.com/dev@tomcat.apache.org/msg88807.html).


Version-Release number of selected component (if applicable):

Affects EPEL 6.8.
Current version of Tomcat supported is 7.0.33.
Requires version 7.0.56 of Tomcat

How reproducible:

Always


Actual results:

Tomcat 7.0.33 is available via EPEL 6.

Expected results:

Tomcat 7.0.56 is available via EPEL 6.

Additional info:

Comment 1 Ivan Afonichev 2014-10-21 08:09:21 UTC
Even fedora20 has too old version of ecj for tomcat>7.0.52.
EL6's version of ecj is sufficient only for tomcat<=7.0.33.


Note: EL7 shipped with newer version of tomcat having all sucurity patches backported by RedHat team. Feel free to upgrade your systems to EL7.

Comment 2 j2ro 2014-10-21 11:42:14 UTC
So, are you saying that it is impossible to get Tomcat 7.0.56 on to EL6?

Isn't it possible to upgrade the version of ecj too?

Comment 3 Ivan Afonichev 2014-10-22 19:25:37 UTC
ecj is shipped within EL6. It is redhat team who supports it.
I don't think they update something in EL6

Comment 4 Stefan Hecker 2014-10-30 14:32:52 UTC
I have created two patches for Tomcat 7.0.56 so together with a modified specs file from the 7.0.33 SRPM it builds on CentOS 6.6.
First smoke tests with custom web application and psi-probe seem to work.
Not being a package maintainer or into tomcat internals, I am not sure if the patches are feasible and could actually be used here or if there's probably something I am not yet aware of.

Comment 5 Stefan Hecker 2014-10-30 14:33:53 UTC
Created attachment 952164 [details]
Proposed spec file with patches added

Comment 6 Stefan Hecker 2014-10-30 14:34:35 UTC
Created attachment 952165 [details]
JDTCompiler patch

Comment 7 Stefan Hecker 2014-10-30 14:35:26 UTC
Created attachment 952167 [details]
build xml patch

Comment 8 Vlad Slepukhin 2014-11-04 16:57:29 UTC
Stephan, I've applied your patches, though build fails on the javadoc step: /root/rpmbuild/BUILD/apache-tomcat-7.0.56-src/build.xml:1817: The java.7.home property must be set for javadoc build

If I step java.7.home property like in ant script in spec file, builder runs into compile-java7 step and fails due to unknown symbol. Seems, the problem with old ecj still persists.

Comment 9 Vlad Slepukhin 2014-11-05 19:08:15 UTC
Here is the long with numerous unknown symbols: http://pastebin.com/6YqzVShL

Comment 10 Ivan Afonichev 2014-11-05 20:58:36 UTC
Seems to be java6 related, try to switch to java7

Comment 11 Stefan Hecker 2014-11-06 10:13:11 UTC
Created attachment 954378 [details]
build.properties for java.7.home

Thanks a lot for looking into this issue.

java.7.home can be set via build.properties file (put into home directory of the build user for example):

java.7.home=/etc/alternatives/java_sdk_1.7.0

Comment 12 Vlad Slepukhin 2014-11-06 10:18:56 UTC
Ivan and me have both came to the conclusion of using Java 7 for building. Today I've tried to build RPM with Java 7 and faced the following error. I added the next line:

BuildRequires: java-devel >= 1:1.7.0

Response:

[root@localhost SOURCES]# rpmbuild -ba tomcat.spec
error: Failed build dependencies:
java-devel >= 1:1.7.0 is needed by tomcat-0:7.0.56-1.el6.noarch

What is java-devel? It was installed with ant

[root@localhost SOURCES]# yum install java-devel
Failed to set locale, defaulting to C
Loaded plugins: fastestmirror
Setting up Install Process
Loading mirror speeds from cached hostfile
 * base: mirrors-ru.go-parts.com
 * extras: mirrors-ru.go-parts.com
 * updates: mirrors-ru.go-parts.com
Package 1:java-1.6.0-openjdk-devel-1.6.0.33-1.13.5.1.el6_6.x86_64 already installed and latest version
Nothing to do

However:  

[root@localhost SOURCES]# yum search java | grep devel | grep 1.7
Failed to set locale, defaulting to C
java-1.7.0-openjdk-devel.x86_64 : OpenJDK Development Environment

How can I point it to 1.7 version?

Comment 13 Vlad Slepukhin 2014-11-07 09:10:03 UTC
I updated tomcat.spec to use java-1.7.0-openjdk-devel.x86_64. I pushed all the changes by you, Stefan and me to ka2m/tomcat-centos to el6-proposed branch. 

I add tomcat.spec.patch here which joins our changes into one file.

ANYONE WHO WANTS TO BUILD THIS VERSION:

1. Checkout ka2m/tomcat on el6 branch or el6-proposed
2. If you checked out el6 branch, download JDTCompiler patch, build xml patch and tomcat spec patch.
3. rpmbuild it. 

If Ivan agrees to use OpenJDK 7 as a must for building Tomcat, we can merge it

Comment 14 Vlad Slepukhin 2014-11-07 09:10:43 UTC
Created attachment 954835 [details]
Tomcat spec patch

Comment 15 Ivan Afonichev 2014-11-07 09:17:40 UTC
It is ok to build with java 7 but we should check if tomcat still works well on java 6.

According to http://tomcat.apache.org/whichversion.html "WebSocket 1.1 requires 7 or later". We should check if it is inside our package, check if it is really not working with java 6. And in this case we should make separate subpackage for it like for jsp-api and servlet-api, and require java7 only for this subpackage

Comment 16 Vlad Slepukhin 2014-11-07 09:27:42 UTC
Strangely, compiling fails on [javadoc] section if use Java 6.

Comment 17 Vlad Slepukhin 2014-11-11 15:13:00 UTC
Well. My research.

I've compiled Tomcat with Java 7, current package with all the patches. Next, I set JAVA_HOME to JDK 6:

[root@localhost ~]# java -version
java version "1.6.0_33"
OpenJDK Runtime Environment (IcedTea6 1.13.5) (rhel-1.13.5.1.el6_6-x86_64)
OpenJDK 64-Bit Server VM (build 23.25-b01, mixed mode)


I've checked out this application to test WebScoket https://github.com/rstoyanchev/spring-websocket-test

Installed maven 3.2.1, run mvn tomcat7:run and it seems to work fine even with Java 6. However, Tomcat site mentions that WebSockets 1.1 requires 7 or later. If you find more suitable example for WS, please check it. The only strange thing is initial output:

NFO: Initializing ProtocolHandler ["http-bio-8080"]
Nov 11, 2014 3:01:14 PM org.apache.catalina.core.StandardService startInternal
INFO: Starting service Tomcat
Nov 11, 2014 3:01:14 PM org.apache.catalina.core.StandardEngine startInternal
INFO: Starting Servlet Engine: Apache Tomcat/7.0.47
Nov 11, 2014 3:01:21 PM org.apache.catalina.core.ApplicationContext log

7.0.47? Why?

My conclusion so far: Java 7 is required for building and _not_ required for running. 

P.S. IMHO, dividing package into several subpackages is not really right thing to do. WebSockets are quite deeply integrated into Tomcat 7.0.56. Java 7 is not a problem now, I even have a solution for batch installation (if you're instrested, you can check it out at http://fau.im/automated-java-installation-with-docker-on-mac-and-ansible/) of Oracle Java. It's even more simple for OpenJDK.

Comment 18 Vlad Slepukhin 2014-11-13 08:40:52 UTC
Ok, tested everything for now. looks fine. In catalina.out, running OpenJDK 6:

INFO: JSR 356 WebSocket (Java WebSocket 1.0) support is not available when running on Java 6. To suppress this message, run Tomcat on Java 7, remove the WebSocket JARs from $CATALINA_HOME/lib or add the WebSocket JARs to the tomcat.util.scan.DefaultJarScanner.jarsToSkip property in $CATALINA_BASE/conf/catalina.properties. Note that the deprecated Tomcat 7 WebSocket API will be available.

So, Tomcat has some sort of solution, using Java 6 restricts functionality, but doesn't block it. 

I merged el6-proposed intro el6, so you can take it from my repository.

Comment 19 Ivan Afonichev 2014-11-13 08:48:56 UTC
ok in that case websockets should be cutted out to subpackage.
And check my inline comments to your commit https://github.com/ka2m/tomcat-centos/commit/cb35a943c6abf80645b76a572215c35167e6a0c5

Comment 20 Vlad Slepukhin 2014-11-13 09:00:05 UTC
It doesn't block functionality. Actually, I have no idea how to cut it.

Comment 21 Ivan Afonichev 2014-11-13 09:15:24 UTC
The same way how jsp-api servlet-api el-api is cutted

Comment 22 Rahul Sundaram 2014-12-04 21:45:48 UTC
ping

Comment 23 j2ro 2014-12-10 12:24:44 UTC
Hi guys,

Thanks for all your hard work on getting this into EPEL!

What is the current status on this?

Comment 24 Aaron Russo 2015-07-22 22:57:46 UTC
Any update on if this will ever make it into EPEL6?

Comment 25 David A. Cafaro 2015-10-11 02:44:47 UTC
There are several security vulnerabilities waiting on this update.  Can we get an update?

Comment 26 David A. Cafaro 2015-11-02 01:46:10 UTC
Looking over this page:

https://tomcat.apache.org/security-7.html

The Tomcat update should be focusing in on version 7.0.59 as a minimum, if not the current 7.0.65 version.

There are several security issues left open with out this update.

Comment 27 David A. Cafaro 2015-11-26 03:53:16 UTC
There are severity=high security bugs dependent on this update.

Comment 28 Coty Sutherland 2015-11-30 20:17:36 UTC
Hi all,

I am presently working on getting an update to 7.0.65 (current latest) into EPEL. I've hit a few problems with ant dependencies in el6 not meeting the build.xml requirements, but I'm hoping that Ivan can help me through those. 

I'll try and keep you all posted on progress :) I'm clearing the needinfo request for now, but please add it back if you need more clarification.

Comment 29 David A. Cafaro 2015-12-03 02:46:28 UTC
Thank you I appreciate the status update.

Comment 30 Coty Sutherland 2015-12-21 13:07:53 UTC
> Thank you I appreciate the status update.

No problem!

In addition, I just noticed bz-1222577. It is blocked by this issue. Updating the bz to reflect that.

Comment 31 Fedora Update System 2016-01-06 19:06:33 UTC
tomcat-7.0.65-1.el6 has been submitted as an update to Fedora EPEL 6. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-819f6356ea

Comment 32 Fedora Update System 2016-01-08 21:19:29 UTC
tomcat-7.0.65-1.el6 has been pushed to the Fedora EPEL 6 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-819f6356ea

Comment 33 Fedora Update System 2016-02-07 01:24:47 UTC
tomcat-7.0.65-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.