You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Mark Thomas <ma...@apache.org> on 2019/04/10 13:44:03 UTC
[VOTE] Release Apache Tomcat 9.0.18
The proposed Apache Tomcat 9.0.18 release is now available for voting.
The major changes compared to the 9.0.17 release are:
- Fix for CVE-2019-0232 a RCE vulnerability on Windows
- Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
now supported if used with a ECJ version with support for those Java
versions
- Various NIO2 stability improvements
Along with lots of other bug fixes and improvements.
For full details, see the changelog:
https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
It can be obtained from:
https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
The Maven staging repo is:
https://repository.apache.org/content/repositories/orgapachetomcat-1207/
The tag is:
https://github.com/apache/tomcat/tree/9.0.18
0862607e5da91a7c476a6350288d8d8a9380f556
The proposed 9.0.18 release is:
[ ] Broken - do not release
[ ] Stable - go ahead and release as 9.0.18
Due to the security fix contained in this release, the voting period may
be shortened once sufficient votes are cast to enable a faster release.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Coty Sutherland <cs...@redhat.com>.
On Wed, Apr 10, 2019 at 9:44 AM Mark Thomas <ma...@apache.org> wrote:
> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>
> The major changes compared to the 9.0.17 release are:
>
> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>
> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
> now supported if used with a ECJ version with support for those Java
> versions
>
> - Various NIO2 stability improvements
>
> Along with lots of other bug fixes and improvements.
>
> For full details, see the changelog:
> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.18
> 0862607e5da91a7c476a6350288d8d8a9380f556
>
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [x] Stable - go ahead and release as 9.0.18
>
+1
>
>
> Due to the security fix contained in this release, the voting period may
> be shortened once sufficient votes are cast to enable a faster release.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Violeta Georgieva <vi...@apache.org>.
На ср, 10.04.2019 г. в 16:44 ч. Mark Thomas <ma...@apache.org> написа:
>
> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>
> The major changes compared to the 9.0.17 release are:
>
> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>
> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
> now supported if used with a ECJ version with support for those Java
> versions
>
> - Various NIO2 stability improvements
>
> Along with lots of other bug fixes and improvements.
>
> For full details, see the changelog:
> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.18
> 0862607e5da91a7c476a6350288d8d8a9380f556
>
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [X] Stable - go ahead and release as 9.0.18
Regards,
Violeta
>
> Due to the security fix contained in this release, the voting period may
> be shortened once sufficient votes are cast to enable a faster release.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 10/04/2019 14:44, Mark Thomas wrote:
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [X] Stable - go ahead and release as 9.0.18
Unit tests pass for NIO, NIO2 and APR/Native on Windows, Linux and MacOS
with Tomcat-Native 1.2.21
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Keiichi Fujino <kf...@apache.org>.
2019年4月10日(水) 22:44 Mark Thomas <ma...@apache.org>:
> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>
> The major changes compared to the 9.0.17 release are:
>
> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>
> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
> now supported if used with a ECJ version with support for those Java
> versions
>
> - Various NIO2 stability improvements
>
> Along with lots of other bug fixes and improvements.
>
> For full details, see the changelog:
> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.18
> 0862607e5da91a7c476a6350288d8d8a9380f556
>
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [X] Stable - go ahead and release as 9.0.18
>
>
+1
Tested on simple hand-made app.(enable session replication).
> Due to the security fix contained in this release, the voting period may
> be shortened once sufficient votes are cast to enable a faster release.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
--
Keiichi.Fujino
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Igal Sapir <is...@apache.org>.
On 4/10/2019 6:44 AM, Mark Thomas wrote:
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [X] Stable - go ahead and release as 9.0.18
Unit tests pass for NIO, NIO2, and APR on Ubuntu 18.04 with Java 1.8u202
and TC-Native 1.2.21
Igal
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Wed, Apr 10, 2019 at 3:44 PM Mark Thomas <ma...@apache.org> wrote:
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [X] Stable - go ahead and release as 9.0.18
>
> Rémy
Re: [VOTE][CANCELLED] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Fri, Apr 12, 2019 at 3:02 PM Mark Thomas <ma...@apache.org> wrote:
> This vote is cancelled due to the regression with missing JMX MBean
> attributes.
>
The object name (as a String) was registered in JMX, rather than the object
itself, so everything is 100% wrong (except the object name of the
registration, which allowed passing mbeansTestRegistration). This was done
while looking at the Graal support (JMX was supposed to be the main issue
so I looked at that), and it's a good thing I didn't port it.
Rémy
Re: [VOTE][CANCELLED] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
This vote is cancelled due to the regression with missing JMX MBean
attributes.
I'll re-tag shortly.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Thu, Apr 11, 2019 at 3:38 PM Mark Thomas <ma...@apache.org> wrote:
> On 11/04/2019 12:59, Rainer Jung wrote:
>
> <snip/>
>
> >> Due to the security fix contained in this release, the voting period may
> >> be shortened once sufficient votes are cast to enable a faster release.
> >
> > The MBeans for beans with j2eeType seem to be not filled with data. I
> > have not checked since 9.0.12, so I don't know when that happened. Just
> > wanted to give a heads up before investigating more.
>
> It works correctly in 9.0.17 so this appears to be a regression between
> 9.0.17 and 9.0.18.
>
> Nothing jumps out at me in the changelog. I'm starting the binary search
> to find the commit where this started.
>
I have no idea what's going on, the attribute infos seem to be generated
correctly, and the only modeler commits is the intern add.
Rémy
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 12:59, Rainer Jung wrote:
<snip/>
>> Due to the security fix contained in this release, the voting period may
>> be shortened once sufficient votes are cast to enable a faster release.
>
> The MBeans for beans with j2eeType seem to be not filled with data. I
> have not checked since 9.0.12, so I don't know when that happened. Just
> wanted to give a heads up before investigating more.
It works correctly in 9.0.17 so this appears to be a regression between
9.0.17 and 9.0.18.
Nothing jumps out at me in the changelog. I'm starting the binary search
to find the commit where this started.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Konstantin Kolinko <kn...@gmail.com>.
чт, 11 апр. 2019 г. в 17:15, Mark Thomas <ma...@apache.org>:
>
> What other things do we need to take care of before the 9.0.19 tag?
>
I just ran org.apache.catalina.core.TestSwallowAbortedUploads test
(the one failing with Java 7) with Tomcat 9 + Java 8
1. The test ran successfully with Tomcat 9 + Java 8u202 (64-bit) + All
connectors. On Windows 10.
2. I see the following strange error in
TEST-org.apache.catalina.core.TestSwallowAbortedUploads.NIO.txt
11-Apr-2019 18:44:22.065 SEVERE [http-nio-127.0.0.1-auto-3-exec-10]
org.apache.coyote.http11.Http11Processor.endRequest Error finishing
request
java.nio.InvalidMarkException
at java.nio.Buffer.reset(Buffer.java:306)
at org.apache.coyote.http11.Http11InputBuffer.fill(Http11InputBuffer.java:732)
at org.apache.coyote.http11.Http11InputBuffer.access$300(Http11InputBuffer.java:40)
at org.apache.coyote.http11.Http11InputBuffer$SocketInputBuffer.doRead(Http11InputBuffer.java:1063)
at org.apache.coyote.http11.filters.ChunkedInputFilter.readBytes(ChunkedInputFilter.java:301)
at org.apache.coyote.http11.filters.ChunkedInputFilter.doRead(ChunkedInputFilter.java:176)
at org.apache.coyote.http11.filters.ChunkedInputFilter.end(ChunkedInputFilter.java:229)
at org.apache.coyote.http11.Http11InputBuffer.endRequest(Http11InputBuffer.java:599)
at org.apache.coyote.http11.Http11Processor.endRequest(Http11Processor.java:1098)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:448)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:836)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
in TEST-org.apache.catalina.core.TestSwallowAbortedUploads.NIO.txt.
The test case was [testChunkedPUTNoLimit]
It is odd.
https://docs.oracle.com/javase/7/docs/api/java/nio/InvalidMarkException.html
There is a "byteBuffer.mark()" call at Http11InputBuffer.java:726,
several lines above the reset() call that fails.
This does not cause a test case failure.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 15:22, Rainer Jung wrote:
> Am 11.04.2019 um 16:15 schrieb Mark Thomas:
>> On 11/04/2019 15:11, Rémy Maucherat wrote:
>>
>>> I already made the fix but the commit emails is stuck.
>>> https://github.com/apache/tomcat/commit/4c6c3e9f434ca1a5cecf04f1b9148fb221b3af37
>>>
>>
>> Great. Thanks.
>>
>> What other things do we need to take care of before the 9.0.19 tag?
>>
>> JSONParser.jj vs JSONParser.jjt
.jj is the correct line-ending.
I've modified the build script to ensure it is included in the source
bundle with the correct line endings.
> - file only in git but not in src distribution:
> res/ide-support/idea/tomcat.iml
That file appears in the src distro when I built it on my dev machine.
I've modified the build script to set the correct line endings.
> - files res/tomcat-maven/Dockerfile and res/tomcat-maven/tomcat.yaml
> have DOS line ends in Unix src tar.gz.
I've modified the build script to set the correct line endings.
I think we are ready for 9.0.19. Any objections? I'm planning to tag etc
in an hour or two.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rainer Jung <ra...@kippdata.de>.
Am 11.04.2019 um 16:15 schrieb Mark Thomas:
> On 11/04/2019 15:11, Rémy Maucherat wrote:
>
>> I already made the fix but the commit emails is stuck.
>> https://github.com/apache/tomcat/commit/4c6c3e9f434ca1a5cecf04f1b9148fb221b3af37
>
> Great. Thanks.
>
> What other things do we need to take care of before the 9.0.19 tag?
>
> JSONParser.jj vs JSONParser.jjt
>
> Flip the useAsyncIO default
>
> Anything else?
I also saw the following minor points:
- file only in git but not in src distribution:
res/ide-support/idea/tomcat.iml
- files res/tomcat-maven/Dockerfile and res/tomcat-maven/tomcat.yaml
have DOS line ends in Unix src tar.gz.
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Thu, Apr 11, 2019 at 4:15 PM Mark Thomas <ma...@apache.org> wrote:
> On 11/04/2019 15:11, Rémy Maucherat wrote:
>
> > I already made the fix but the commit emails is stuck.
> >
> https://github.com/apache/tomcat/commit/4c6c3e9f434ca1a5cecf04f1b9148fb221b3af37
>
> Great. Thanks.
>
> What other things do we need to take care of before the 9.0.19 tag?
>
> JSONParser.jj vs JSONParser.jjt
>
> Flip the useAsyncIO default
>
Done already as well. Again, my apologies.
The TestRegistration JMX test only checks object names, so that's how this
fell though the crack ... I'll improve it later to check at least one known
attribute.
Beyond that, the rest is cosmetic non regressions, we can make the list
arbitrarily long but IMO now is not the right time for that.
Rémy
>
> Anything else?
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 16:20, Mark Thomas wrote:
> On 11/04/2019 16:14, Rémy Maucherat wrote:
>> On Thu, Apr 11, 2019 at 4:15 PM Mark Thomas <ma...@apache.org> wrote:
>>
>>> Anything else?
>>>
>>
>> Fix the gitbox <-> github sync.
>
> Fair point.
>
> I'll see what I can do.
It should be fixed now.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 16:14, Rémy Maucherat wrote:
> On Thu, Apr 11, 2019 at 4:15 PM Mark Thomas <ma...@apache.org> wrote:
>
>> Anything else?
>>
>
> Fix the gitbox <-> github sync.
Fair point.
I'll see what I can do.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Thu, Apr 11, 2019 at 4:15 PM Mark Thomas <ma...@apache.org> wrote:
> Anything else?
>
Fix the gitbox <-> github sync.
Rémy
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 15:11, Rémy Maucherat wrote:
> I already made the fix but the commit emails is stuck.
> https://github.com/apache/tomcat/commit/4c6c3e9f434ca1a5cecf04f1b9148fb221b3af37
Great. Thanks.
What other things do we need to take care of before the 9.0.19 tag?
JSONParser.jj vs JSONParser.jjt
Flip the useAsyncIO default
Anything else?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Thu, Apr 11, 2019 at 4:08 PM Mark Thomas <ma...@apache.org> wrote:
> On 11/04/2019 14:52, Mark Thomas wrote:
> > On 11/04/2019 14:31, Rainer Jung wrote:
> >> Am 11.04.2019 um 14:51 schrieb Rémy Maucherat:
> >>> On Thu, Apr 11, 2019 at 2:00 PM Rainer Jung <ra...@kippdata.de>
> >>> wrote:
> >>>
> >>>> Am 10.04.2019 um 15:44 schrieb Mark Thomas:
> >>>>> The proposed Apache Tomcat 9.0.18 release is now available for
> voting.
> >>>>>
> >>>>> The major changes compared to the 9.0.17 release are:
> >>>>>
> >>>>> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
> >>>>>
> >>>>> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are
> also
> >>>>> now supported if used with a ECJ version with support for those
> >>>>> Java
> >>>>> versions
> >>>>>
> >>>>> - Various NIO2 stability improvements
> >>>>>
> >>>>> Along with lots of other bug fixes and improvements.
> >>>>>
> >>>>> For full details, see the changelog:
> >>>>> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
> >>>>>
> >>>>> It can be obtained from:
> >>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
> >>>>> The Maven staging repo is:
> >>>>>
> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
> >>>>>
> >>>>> The tag is:
> >>>>> https://github.com/apache/tomcat/tree/9.0.18
> >>>>> 0862607e5da91a7c476a6350288d8d8a9380f556
> >>>>>
> >>>>> The proposed 9.0.18 release is:
> >>>>> [ ] Broken - do not release
> >>>>> [ ] Stable - go ahead and release as 9.0.18
> >>>>>
> >>>>>
> >>>>> Due to the security fix contained in this release, the voting period
> >>>>> may
> >>>>> be shortened once sufficient votes are cast to enable a faster
> release.
> >>>>
> >>>> The MBeans for beans with j2eeType seem to be not filled with data. I
> >>>> have not checked since 9.0.12, so I don't know when that heppaned.
> Just
> >>>> wantd to give a heads up before investigating more.
> >>>>
> >>>> Example diff for one bean:
> >>>>
> >>>> Name:
> >>>>
> >>>>
> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
> >>>>
> >>>> -modelerType: org.apache.catalina.mbeans.ContainerMBean
> >>>> -maxTime: 0
> >>>> -requestCount: 0
> >>>> -servletClass: org.apache.catalina.servlets.DefaultServlet
> >>>> -countAllocated: 0
> >>>> -available: 0
> >>>> -backgroundProcessorDelay: -1
> >>>> -processingTime: XXX
> >>>> -loadOnStartup: 1
> >>>> -singleThreadModel: false
> >>>> -loadTime: XXX
> >>>> -stateName: STARTED
> >>>> -minTime: XXX
> >>>> -classLoadTime: XXX
> >>>> -asyncSupported: false
> >>>> -objectName:
> >>>>
> >>>>
> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
> >>>>
> >>>> -maxInstances: 20
> >>>> -errorCount: 0
> >>>> +modelerType: org.apache.tomcat.util.modeler.BaseModelMBean
> >>>> +empty: false
> >>>>
> >>>> The modelerType has changed, all attributes missing.
> >>>>
> >>>
> >>> The good news is that 8.5 seems fine.
> >>>
> >>> I'll investigate. If we need to do a new release (IMO: yes), I'll flip
> >>> the
> >>> useAsyncIO default value ...
> >>
> >> I did some more checks:
> >>
> >> - as you said, 8.5.40 is fine
> >>
> >> - using the same scripts, 9.0.17 is also fine, so this looks like a real
> >> code regression
> >>
> >> Thus I would also be -1 for the 9.0.18 release.
>
>
> https://github.com/apache/tomcat/commit/8cbe4ba594dc41615faafb216fcb4ff3e0d8fafc
>
> seems to be the trigger. I haven't reviewed the commit yet.
>
Yes, sorry :( I already made the fix but the commit emails is stuck.
https://github.com/apache/tomcat/commit/4c6c3e9f434ca1a5cecf04f1b9148fb221b3af37
Rémy
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 14:52, Mark Thomas wrote:
> On 11/04/2019 14:31, Rainer Jung wrote:
>> Am 11.04.2019 um 14:51 schrieb Rémy Maucherat:
>>> On Thu, Apr 11, 2019 at 2:00 PM Rainer Jung <ra...@kippdata.de>
>>> wrote:
>>>
>>>> Am 10.04.2019 um 15:44 schrieb Mark Thomas:
>>>>> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>>>>>
>>>>> The major changes compared to the 9.0.17 release are:
>>>>>
>>>>> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>>>>>
>>>>> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
>>>>> now supported if used with a ECJ version with support for those
>>>>> Java
>>>>> versions
>>>>>
>>>>> - Various NIO2 stability improvements
>>>>>
>>>>> Along with lots of other bug fixes and improvements.
>>>>>
>>>>> For full details, see the changelog:
>>>>> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>>>>>
>>>>> It can be obtained from:
>>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
>>>>> The Maven staging repo is:
>>>>> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
>>>>>
>>>>> The tag is:
>>>>> https://github.com/apache/tomcat/tree/9.0.18
>>>>> 0862607e5da91a7c476a6350288d8d8a9380f556
>>>>>
>>>>> The proposed 9.0.18 release is:
>>>>> [ ] Broken - do not release
>>>>> [ ] Stable - go ahead and release as 9.0.18
>>>>>
>>>>>
>>>>> Due to the security fix contained in this release, the voting period
>>>>> may
>>>>> be shortened once sufficient votes are cast to enable a faster release.
>>>>
>>>> The MBeans for beans with j2eeType seem to be not filled with data. I
>>>> have not checked since 9.0.12, so I don't know when that heppaned. Just
>>>> wantd to give a heads up before investigating more.
>>>>
>>>> Example diff for one bean:
>>>>
>>>> Name:
>>>>
>>>> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
>>>>
>>>> -modelerType: org.apache.catalina.mbeans.ContainerMBean
>>>> -maxTime: 0
>>>> -requestCount: 0
>>>> -servletClass: org.apache.catalina.servlets.DefaultServlet
>>>> -countAllocated: 0
>>>> -available: 0
>>>> -backgroundProcessorDelay: -1
>>>> -processingTime: XXX
>>>> -loadOnStartup: 1
>>>> -singleThreadModel: false
>>>> -loadTime: XXX
>>>> -stateName: STARTED
>>>> -minTime: XXX
>>>> -classLoadTime: XXX
>>>> -asyncSupported: false
>>>> -objectName:
>>>>
>>>> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
>>>>
>>>> -maxInstances: 20
>>>> -errorCount: 0
>>>> +modelerType: org.apache.tomcat.util.modeler.BaseModelMBean
>>>> +empty: false
>>>>
>>>> The modelerType has changed, all attributes missing.
>>>>
>>>
>>> The good news is that 8.5 seems fine.
>>>
>>> I'll investigate. If we need to do a new release (IMO: yes), I'll flip
>>> the
>>> useAsyncIO default value ...
>>
>> I did some more checks:
>>
>> - as you said, 8.5.40 is fine
>>
>> - using the same scripts, 9.0.17 is also fine, so this looks like a real
>> code regression
>>
>> Thus I would also be -1 for the 9.0.18 release.
https://github.com/apache/tomcat/commit/8cbe4ba594dc41615faafb216fcb4ff3e0d8fafc
seems to be the trigger. I haven't reviewed the commit yet.
Mark
>>>> Another minor observation: file
>>>> java/org/apache/tomcat/util/json/JSONParser.jj is in git but missing
>>>> from the src distribution.
>>
>> There is an explicit .jj exclusion in build.xml. But that exclusion is
>> older than the jj file, so I'm not sure whether it should get bundloed
>> or not. At least the release build process does not generate it, so it
>> seems we should better bundle it.
>
> That file looks like a jjt file rather than a jj file. Maybe a rename is
> required?
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Mark Thomas <ma...@apache.org>.
On 11/04/2019 14:31, Rainer Jung wrote:
> Am 11.04.2019 um 14:51 schrieb Rémy Maucherat:
>> On Thu, Apr 11, 2019 at 2:00 PM Rainer Jung <ra...@kippdata.de>
>> wrote:
>>
>>> Am 10.04.2019 um 15:44 schrieb Mark Thomas:
>>>> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>>>>
>>>> The major changes compared to the 9.0.17 release are:
>>>>
>>>> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>>>>
>>>> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
>>>> now supported if used with a ECJ version with support for those
>>>> Java
>>>> versions
>>>>
>>>> - Various NIO2 stability improvements
>>>>
>>>> Along with lots of other bug fixes and improvements.
>>>>
>>>> For full details, see the changelog:
>>>> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>>>>
>>>> It can be obtained from:
>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
>>>> The Maven staging repo is:
>>>> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
>>>>
>>>> The tag is:
>>>> https://github.com/apache/tomcat/tree/9.0.18
>>>> 0862607e5da91a7c476a6350288d8d8a9380f556
>>>>
>>>> The proposed 9.0.18 release is:
>>>> [ ] Broken - do not release
>>>> [ ] Stable - go ahead and release as 9.0.18
>>>>
>>>>
>>>> Due to the security fix contained in this release, the voting period
>>>> may
>>>> be shortened once sufficient votes are cast to enable a faster release.
>>>
>>> The MBeans for beans with j2eeType seem to be not filled with data. I
>>> have not checked since 9.0.12, so I don't know when that heppaned. Just
>>> wantd to give a heads up before investigating more.
>>>
>>> Example diff for one bean:
>>>
>>> Name:
>>>
>>> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
>>>
>>> -modelerType: org.apache.catalina.mbeans.ContainerMBean
>>> -maxTime: 0
>>> -requestCount: 0
>>> -servletClass: org.apache.catalina.servlets.DefaultServlet
>>> -countAllocated: 0
>>> -available: 0
>>> -backgroundProcessorDelay: -1
>>> -processingTime: XXX
>>> -loadOnStartup: 1
>>> -singleThreadModel: false
>>> -loadTime: XXX
>>> -stateName: STARTED
>>> -minTime: XXX
>>> -classLoadTime: XXX
>>> -asyncSupported: false
>>> -objectName:
>>>
>>> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
>>>
>>> -maxInstances: 20
>>> -errorCount: 0
>>> +modelerType: org.apache.tomcat.util.modeler.BaseModelMBean
>>> +empty: false
>>>
>>> The modelerType has changed, all attributes missing.
>>>
>>
>> The good news is that 8.5 seems fine.
>>
>> I'll investigate. If we need to do a new release (IMO: yes), I'll flip
>> the
>> useAsyncIO default value ...
>
> I did some more checks:
>
> - as you said, 8.5.40 is fine
>
> - using the same scripts, 9.0.17 is also fine, so this looks like a real
> code regression
>
> Thus I would also be -1 for the 9.0.18 release.
>
>>> Another minor observation: file
>>> java/org/apache/tomcat/util/json/JSONParser.jj is in git but missing
>>> from the src distribution.
>
> There is an explicit .jj exclusion in build.xml. But that exclusion is
> older than the jj file, so I'm not sure whether it should get bundloed
> or not. At least the release build process does not generate it, so it
> seems we should better bundle it.
That file looks like a jjt file rather than a jj file. Maybe a rename is
required?
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rainer Jung <ra...@kippdata.de>.
Am 11.04.2019 um 14:51 schrieb Rémy Maucherat:
> On Thu, Apr 11, 2019 at 2:00 PM Rainer Jung <ra...@kippdata.de> wrote:
>
>> Am 10.04.2019 um 15:44 schrieb Mark Thomas:
>>> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>>>
>>> The major changes compared to the 9.0.17 release are:
>>>
>>> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>>>
>>> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
>>> now supported if used with a ECJ version with support for those Java
>>> versions
>>>
>>> - Various NIO2 stability improvements
>>>
>>> Along with lots of other bug fixes and improvements.
>>>
>>> For full details, see the changelog:
>>> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>>>
>>> It can be obtained from:
>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
>>> The Maven staging repo is:
>>> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
>>> The tag is:
>>> https://github.com/apache/tomcat/tree/9.0.18
>>> 0862607e5da91a7c476a6350288d8d8a9380f556
>>>
>>> The proposed 9.0.18 release is:
>>> [ ] Broken - do not release
>>> [ ] Stable - go ahead and release as 9.0.18
>>>
>>>
>>> Due to the security fix contained in this release, the voting period may
>>> be shortened once sufficient votes are cast to enable a faster release.
>>
>> The MBeans for beans with j2eeType seem to be not filled with data. I
>> have not checked since 9.0.12, so I don't know when that heppaned. Just
>> wantd to give a heads up before investigating more.
>>
>> Example diff for one bean:
>>
>> Name:
>>
>> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
>> -modelerType: org.apache.catalina.mbeans.ContainerMBean
>> -maxTime: 0
>> -requestCount: 0
>> -servletClass: org.apache.catalina.servlets.DefaultServlet
>> -countAllocated: 0
>> -available: 0
>> -backgroundProcessorDelay: -1
>> -processingTime: XXX
>> -loadOnStartup: 1
>> -singleThreadModel: false
>> -loadTime: XXX
>> -stateName: STARTED
>> -minTime: XXX
>> -classLoadTime: XXX
>> -asyncSupported: false
>> -objectName:
>>
>> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
>> -maxInstances: 20
>> -errorCount: 0
>> +modelerType: org.apache.tomcat.util.modeler.BaseModelMBean
>> +empty: false
>>
>> The modelerType has changed, all attributes missing.
>>
>
> The good news is that 8.5 seems fine.
>
> I'll investigate. If we need to do a new release (IMO: yes), I'll flip the
> useAsyncIO default value ...
I did some more checks:
- as you said, 8.5.40 is fine
- using the same scripts, 9.0.17 is also fine, so this looks like a real
code regression
Thus I would also be -1 for the 9.0.18 release.
>> Another minor observation: file
>> java/org/apache/tomcat/util/json/JSONParser.jj is in git but missing
>> from the src distribution.
There is an explicit .jj exclusion in build.xml. But that exclusion is
older than the jj file, so I'm not sure whether it should get bundloed
or not. At least the release build process does not generate it, so it
seems we should better bundle it.
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rémy Maucherat <re...@apache.org>.
On Thu, Apr 11, 2019 at 2:00 PM Rainer Jung <ra...@kippdata.de> wrote:
> Am 10.04.2019 um 15:44 schrieb Mark Thomas:
> > The proposed Apache Tomcat 9.0.18 release is now available for voting.
> >
> > The major changes compared to the 9.0.17 release are:
> >
> > - Fix for CVE-2019-0232 a RCE vulnerability on Windows
> >
> > - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
> > now supported if used with a ECJ version with support for those Java
> > versions
> >
> > - Various NIO2 stability improvements
> >
> > Along with lots of other bug fixes and improvements.
> >
> > For full details, see the changelog:
> > https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
> >
> > It can be obtained from:
> > https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
> > The Maven staging repo is:
> > https://repository.apache.org/content/repositories/orgapachetomcat-1207/
> > The tag is:
> > https://github.com/apache/tomcat/tree/9.0.18
> > 0862607e5da91a7c476a6350288d8d8a9380f556
> >
> > The proposed 9.0.18 release is:
> > [ ] Broken - do not release
> > [ ] Stable - go ahead and release as 9.0.18
> >
> >
> > Due to the security fix contained in this release, the voting period may
> > be shortened once sufficient votes are cast to enable a faster release.
>
> The MBeans for beans with j2eeType seem to be not filled with data. I
> have not checked since 9.0.12, so I don't know when that heppaned. Just
> wantd to give a heads up before investigating more.
>
> Example diff for one bean:
>
> Name:
>
> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
> -modelerType: org.apache.catalina.mbeans.ContainerMBean
> -maxTime: 0
> -requestCount: 0
> -servletClass: org.apache.catalina.servlets.DefaultServlet
> -countAllocated: 0
> -available: 0
> -backgroundProcessorDelay: -1
> -processingTime: XXX
> -loadOnStartup: 1
> -singleThreadModel: false
> -loadTime: XXX
> -stateName: STARTED
> -minTime: XXX
> -classLoadTime: XXX
> -asyncSupported: false
> -objectName:
>
> Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
> -maxInstances: 20
> -errorCount: 0
> +modelerType: org.apache.tomcat.util.modeler.BaseModelMBean
> +empty: false
>
> The modelerType has changed, all attributes missing.
>
The good news is that 8.5 seems fine.
I'll investigate. If we need to do a new release (IMO: yes), I'll flip the
useAsyncIO default value ...
Rémy
>
> Another minor observation: file
> java/org/apache/tomcat/util/json/JSONParser.jj is in git but missing
> from the src distribution.
>
> Regards,
>
> Rainer
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 9.0.18
Posted by Rainer Jung <ra...@kippdata.de>.
Am 10.04.2019 um 15:44 schrieb Mark Thomas:
> The proposed Apache Tomcat 9.0.18 release is now available for voting.
>
> The major changes compared to the 9.0.17 release are:
>
> - Fix for CVE-2019-0232 a RCE vulnerability on Windows
>
> - Add support for Java 11 to the JSP compiler. Java 12 and 13 are also
> now supported if used with a ECJ version with support for those Java
> versions
>
> - Various NIO2 stability improvements
>
> Along with lots of other bug fixes and improvements.
>
> For full details, see the changelog:
> https://ci.apache.org/projects/tomcat/tomcat9/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.18/
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1207/
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.18
> 0862607e5da91a7c476a6350288d8d8a9380f556
>
> The proposed 9.0.18 release is:
> [ ] Broken - do not release
> [ ] Stable - go ahead and release as 9.0.18
>
>
> Due to the security fix contained in this release, the voting period may
> be shortened once sufficient votes are cast to enable a faster release.
The MBeans for beans with j2eeType seem to be not filled with data. I
have not checked since 9.0.12, so I don't know when that heppaned. Just
wantd to give a heads up before investigating more.
Example diff for one bean:
Name:
Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
-modelerType: org.apache.catalina.mbeans.ContainerMBean
-maxTime: 0
-requestCount: 0
-servletClass: org.apache.catalina.servlets.DefaultServlet
-countAllocated: 0
-available: 0
-backgroundProcessorDelay: -1
-processingTime: XXX
-loadOnStartup: 1
-singleThreadModel: false
-loadTime: XXX
-stateName: STARTED
-minTime: XXX
-classLoadTime: XXX
-asyncSupported: false
-objectName:
Catalina:j2eeType=Servlet,WebModule=//localhost/,name=default,J2EEApplication=none,J2EEServer=none
-maxInstances: 20
-errorCount: 0
+modelerType: org.apache.tomcat.util.modeler.BaseModelMBean
+empty: false
The modelerType has changed, all attributes missing.
Another minor observation: file
java/org/apache/tomcat/util/json/JSONParser.jj is in git but missing
from the src distribution.
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org