You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-user@axis.apache.org by "Chea Sovanreach (NCS)" <so...@ncs.com.sg> on 2021/09/29 03:53:21 UTC
[Axis2] Migration Issues
Hi Axis2 Team,
We have been trying to upgrade from Axis1 -> Axis2 for our project due to security vulnerability (CVE-2019-0227 : A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2 (cvedetails.com)<https://www.cvedetails.com/cve/CVE-2019-0227/>. However, there are so many APIs that have changed and ways to implement those are not straightforward.
For example, org.apache.axis.message.MessageElement is totally removed. There is no clear guideline or documentation on how to implement similar APIs in Axis2.
Please help to advise on how we can improve our migration process and places where we can the reference to look for the changes.
Note: have checked out the official migration guide on your website https://axis.apache.org/axis2/java/core/docs/migration.html , but this is far from enough for us to do the migration.
Thank you.
Kind Regards,
Reach
RE: [Axis2] Migration Issues
Posted by "Chea Sovanreach (NCS)" <so...@ncs.com.sg>.
Hi Robert,
Please ignore the previous email.
I have managed to successfully build the jar files using Maven.
Have a good weekend.
Cheers,
Kind Regards,
Reach
From: Chea Sovanreach (NCS)
Sent: Friday, 1 October 2021 2:06 pm
To: java-user@axis.apache.org
Subject: RE: [Axis2] Migration Issues
Hi Robert,
Great to hear that and appreciate your prompt response.
Currently, I am having issues with building axis jar files from the source code which I downloaded from the Github link (https://github.com/apache/axis-axis1-java ) you shared with us.
What I have tried:
* Import projects into Eclipse 2020
* Let Maven and Project build complete
* Change Jave JDK to my local computer (JDK 1.8)
* Run /axis-axis1-java-master/build.xml -> compile
I got issues as below
Buildfile: D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml
axis-clover-setenv:
axis-clover-setup:
axis-xmlbeans-setenv:
axis-xmlbeans-setup:
setenv:
check-javadoc-needed:
printEnv:
[echo] -----------------------------------------------------------------
[echo] Build environment for Axis 1.4 [2005]
[echo] -----------------------------------------------------------------
[echo] Building with Apache Ant(TM) version 1.10.8 compiled on May 10 2020
[echo] using build file D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml
[echo] Java 1.8.0_301 located at C:\Program Files\Java\jdk1.8.0_301\jre
[echo] -----------------------------------------------------------------
[echo] --- Flags (Note: If the {property name} is displayed,
[echo] then the component is not present)
[echo] basedir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master
[echo] axis.home = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master
[echo] build.dir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build
[echo] build.dest = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\classes
[echo] lib.dir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib
[echo] === Required Libraries (for building code) ===
[echo] activation.present=true
[echo] commons-discovery.present=true
[echo] commons-logging.present=true
[echo] wsdl4j.present=true
[echo] --- Optional Libraries (for building code) ---
[echo] attachments.present=${attachments.present}
[echo] bsf.present=${bsf.present}
[echo] castor.present=${castor.present}
[echo] commons-httpclient.present=true
[echo] commons-net.present=${commons-net.present}
[echo] ibm.jsse.present=${ibm.jsse.present}
[echo] jimi.present=${jimi.present}
[echo] jms.present=${jms.present}
[echo] jetty.present=${jetty.present}
[echo] jdk14.jsse.present=true
[echo] mailapi.present=${mailapi.present}
[echo] regexp.present=true
[echo] security.present=${security.present}
[echo] servlet.present=${servlet.present}
[echo] sun.jsse.present=true
[echo] xmlbeans.present=${xmlbeans.present}
[echo] --- Miscellaneous (for running tests) ---
[echo] axis-ant.present=${axis-ant.present}
[echo] clover.present=${clover.present}
[echo] httpunit.present=${httpunit.present}
[echo] junit.present=${junit.present}
[echo] log4j.present=true
[echo] --- Property values ---
[echo] debug=on
[echo] nowarn=off
[echo] source=1.3
[echo] target=1.3
[echo] deprecation=true
[echo] build.compiler=${build.compiler}
[echo] javac.fork=no
[echo] axis_nojavadocs=${env.axis_nojavadocs}
[echo] javax.xml.parsers.DocumentBuilderFactory=org.apache.xerces.jaxp.DocumentBuilderFactoryImpl
[echo] javax.xml.parsers.SAXParserFactory=org.apache.xerces.jaxp.SAXParserFactoryImpl
[echo] sun.boot.class.path=C:\Program Files\Java\jdk1.8.0_301\jre\lib\resources.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\rt.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\sunrsasign.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\jsse.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\jce.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\charsets.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\jfr.jar;C:\Program Files\Java\jdk1.8.0_301\jre\classes
[echo] jikes.class.path=${jikes.class.path}
[echo] -- Network Settings ---
[echo] http.proxyHost =
[echo] http.proxyPort =
[echo] http.nonProxyHosts = localhost
[echo] http.proxyUser =
[echo] http.proxyPassword =
[echo] -- Test Environment for AXIS ---
[echo] test.functional.remote = no
[echo] test.functional.local = yes
[echo] test.functional.both = no
[echo] test.functional.reportdir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test-reports
[echo] test.functional.SimpleAxisPort = 8080
[echo] test.functional.TCPListenerPort = 8088
[echo] test.functional.fail = yes
[echo] classpath: D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xercesImpl.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xmlParserAPIs.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test\lib\xalan-2.6.0.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xml-apis.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xerces.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test\lib\jakarta-oro-2.0.5.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test\lib\xmlunit1.0.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\jsse.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\JimiProClasses.zip;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\activation.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\mailapi.jar;C:\Program Files\Java\jdk1.8.0_301\lib\tools.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${j2ee.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\junit.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${servlet.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\commons-discovery-0.2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\commons-httpclient-3.0-rc2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\commons-logging-1.0.4.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\endorsed\xercesImpl-2.6.2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\endorsed\xml-apis-2.6.2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\log4j-1.2.8.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\wsdl4j-1.5.1.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-antlr.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-bcel.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-bsf.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-log4j.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-oro.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-regexp.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-resolver.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-xalan2.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-commons-logging.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-commons-net.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-imageio.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jai.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-javamail.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jdepend.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jmf.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jsch.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-junit.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-junit4.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-junitlauncher.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-launcher.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-netrexx.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-swing.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-testutil.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-xz.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant.jar;C:\eclipse-jee-2020-06-R\eclipse\configuration\org.eclipse.osgi\91\0\.cp\lib\antdebug.jar;C:\eclipse-jee-2020-06-R\eclipse\configuration\org.eclipse.osgi\91\0\.cp\lib\remote.jar;C:\eclipse-jee-2020-06-R\eclipse\configuration\org.eclipse.osgi\92\0\.cp\lib\remoteAnt.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.eclipse.swt.win32.win32.x86_64_3.114.100.v20200604-0951.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\classes;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\tools;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\lib\axis-ant.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\lib\axis-schema.jar
compile:
[javac] D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml:99: warning: 'includeantruntime' was not set, defaulting to build.sysclasspath=last; set to false for repeatable builds
BUILD FAILED
D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml:169: Warning: Could not find file D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\src\org\apache\axis\server\server-config.wsdd to copy.
Not sure if my above steps are correct.
Please help to advise on how we can build the jar file from the source code.
Much thanks,
Kind Regards,
Reach
From: robertlazarski <ro...@gmail.com>>
Sent: Thursday, 30 September 2021 8:18 pm
To: java-user@axis.apache.org<ma...@axis.apache.org>
Subject: Re: [Axis2] Migration Issues
[External email] Please be cautious when clicking on any links or attachments.
________________________________
I actually also help maintain axis 1, if you check out the project from GitHub and do "git log --" you will notice that
I have been the most active committer there recently.
The way Apache foundation projects work, is that there is a VP who is elected to be responsible for security issues of all subprojects.
That's me currently. To keep Axis2 active, I am also required to be responsible for Axis 1.x too. I used it back in the day and know the architecture to a certain extent, but claim no deep knowledge without some effort.
The way Apache projects also works though is the community
contributes with patches and testing when necessary.
That all being said, Axis PMC member Andreas Veithen was the committer that through his gracious contributions over many years made it possible to keep the axis 1 git repo up to date in a modern way.
Andreas occasionally still responds to these types of mailing list threads - sometimes he does and sometimes he doesn't.
Robert
On Wed, Sep 29, 2021, 21:32 Chea Sovanreach (NCS) <so...@ncs.com.sg>> wrote:
Hi Robert,
Appreciate the quick response on your end.
As mentioned there is one member who keeps the Axis1.x updated throughout the years, is it possible to share his/her contact here? We would like to reach out to him/her to understand more about current Axis1.x latest build.
Thank you.
Kind Regards,
Reach
From: robertlazarski <ro...@gmail.com>>
Sent: Wednesday, 29 September 2021 6:00 pm
To: java-user@axis.apache.org<ma...@axis.apache.org>
Subject: Re: [Axis2] Migration Issues
[External email] Please be cautious when clicking on any links or attachments.
________________________________
Concerning help for a migration to Axis2, I don't have much to add unfortunately.
I myself wrote part of the migration guide 15 years ago and without being a recent user I would have to dive deep into the source code of both projects - something you and your team would be better suited for.
There is possiblity someone else can respond. Frankly, there isn't that many of us left here after twenty years.
Apache requires a minimum of three active members and we have that - but the Axis 1.x people mostly.are lurkers at this point. They do respond occasionally.
On Wed, Sep 29, 2021, 05:48 robertlazarski <ro...@gmail.com>> wrote:
While there has not been an official axis 1 release since 1.4 in 2006, there has been hundreds of commits to the project in git since then.
https://github.com/apache/axis-axis1-java<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Faxis-axis1-java&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cb360280b563641e2a2c708d9840c5c7d%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637686010890981157%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=36RBQXFmOnUGYgH7bkMVk9%2F8orfQ5UtmKA03%2FEK%2B5%2FE%3D&reserved=0>
The Apache security team requires all active repos to have vulnerabilities fixed. There are no open CVE's in the project that I am aware of.
I am not personally an axis 1.x user and there has been very little recent traffic for the project in Jira and the mailing list. Therefore there is little motivation for a release from our team.
There was one member of our project that kept Axis 1.x updated for many years by adding maven support and a lot of other commits, making it easier to maintain.
Challenges for the project include newer JDK support - JDK 11 for example has a minimum source compatibility requirement of JDK 6 however there are hundreds of compile errors at that level.
Because of all this, a release would require community help to push it forward.
I suggest building from source. A release would require contributions and testing. The "Apache way" encourages becoming a committer to projects to get involved in such a complicated situation.
Robert
On Tue, Sep 28, 2021, 23:53 Chea Sovanreach (NCS) <so...@ncs.com.sg>> wrote:
Hi Axis2 Team,
We have been trying to upgrade from Axis1 -> Axis2 for our project due to security vulnerability (CVE-2019-0227 : A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2 (cvedetails.com)<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cvedetails.com%2Fcve%2FCVE-2019-0227%2F&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cb360280b563641e2a2c708d9840c5c7d%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637686010890991152%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XM9hRtltgEq8gqd9TP27YHbjPEH7h9TwfDxkUvXyVSg%3D&reserved=0>. However, there are so many APIs that have changed and ways to implement those are not straightforward.
For example, org.apache.axis.message.MessageElement is totally removed. There is no clear guideline or documentation on how to implement similar APIs in Axis2.
Please help to advise on how we can improve our migration process and places where we can the reference to look for the changes.
Note: have checked out the official migration guide on your website https://axis.apache.org/axis2/java/core/docs/migration.html<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faxis.apache.org%2Faxis2%2Fjava%2Fcore%2Fdocs%2Fmigration.html&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cb360280b563641e2a2c708d9840c5c7d%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637686010890991152%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Xy3%2FK2rbrmSeb1Iei%2FXxG79k6P7BIUQ%2BxNmFqaA6Aak%3D&reserved=0> , but this is far from enough for us to do the migration.
Thank you.
Kind Regards,
Reach
RE: [Axis2] Migration Issues
Posted by "Chea Sovanreach (NCS)" <so...@ncs.com.sg>.
Hi Robert,
Great to hear that and appreciate your prompt response.
Currently, I am having issues with building axis jar files from the source code which I downloaded from the Github link (https://github.com/apache/axis-axis1-java ) you shared with us.
What I have tried:
* Import projects into Eclipse 2020
* Let Maven and Project build complete
* Change Jave JDK to my local computer (JDK 1.8)
* Run /axis-axis1-java-master/build.xml -> compile
I got issues as below
Buildfile: D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml
axis-clover-setenv:
axis-clover-setup:
axis-xmlbeans-setenv:
axis-xmlbeans-setup:
setenv:
check-javadoc-needed:
printEnv:
[echo] -----------------------------------------------------------------
[echo] Build environment for Axis 1.4 [2005]
[echo] -----------------------------------------------------------------
[echo] Building with Apache Ant(TM) version 1.10.8 compiled on May 10 2020
[echo] using build file D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml
[echo] Java 1.8.0_301 located at C:\Program Files\Java\jdk1.8.0_301\jre
[echo] -----------------------------------------------------------------
[echo] --- Flags (Note: If the {property name} is displayed,
[echo] then the component is not present)
[echo] basedir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master
[echo] axis.home = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master
[echo] build.dir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build
[echo] build.dest = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\classes
[echo] lib.dir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib
[echo] === Required Libraries (for building code) ===
[echo] activation.present=true
[echo] commons-discovery.present=true
[echo] commons-logging.present=true
[echo] wsdl4j.present=true
[echo] --- Optional Libraries (for building code) ---
[echo] attachments.present=${attachments.present}
[echo] bsf.present=${bsf.present}
[echo] castor.present=${castor.present}
[echo] commons-httpclient.present=true
[echo] commons-net.present=${commons-net.present}
[echo] ibm.jsse.present=${ibm.jsse.present}
[echo] jimi.present=${jimi.present}
[echo] jms.present=${jms.present}
[echo] jetty.present=${jetty.present}
[echo] jdk14.jsse.present=true
[echo] mailapi.present=${mailapi.present}
[echo] regexp.present=true
[echo] security.present=${security.present}
[echo] servlet.present=${servlet.present}
[echo] sun.jsse.present=true
[echo] xmlbeans.present=${xmlbeans.present}
[echo] --- Miscellaneous (for running tests) ---
[echo] axis-ant.present=${axis-ant.present}
[echo] clover.present=${clover.present}
[echo] httpunit.present=${httpunit.present}
[echo] junit.present=${junit.present}
[echo] log4j.present=true
[echo] --- Property values ---
[echo] debug=on
[echo] nowarn=off
[echo] source=1.3
[echo] target=1.3
[echo] deprecation=true
[echo] build.compiler=${build.compiler}
[echo] javac.fork=no
[echo] axis_nojavadocs=${env.axis_nojavadocs}
[echo] javax.xml.parsers.DocumentBuilderFactory=org.apache.xerces.jaxp.DocumentBuilderFactoryImpl
[echo] javax.xml.parsers.SAXParserFactory=org.apache.xerces.jaxp.SAXParserFactoryImpl
[echo] sun.boot.class.path=C:\Program Files\Java\jdk1.8.0_301\jre\lib\resources.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\rt.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\sunrsasign.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\jsse.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\jce.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\charsets.jar;C:\Program Files\Java\jdk1.8.0_301\jre\lib\jfr.jar;C:\Program Files\Java\jdk1.8.0_301\jre\classes
[echo] jikes.class.path=${jikes.class.path}
[echo] -- Network Settings ---
[echo] http.proxyHost =
[echo] http.proxyPort =
[echo] http.nonProxyHosts = localhost
[echo] http.proxyUser =
[echo] http.proxyPassword =
[echo] -- Test Environment for AXIS ---
[echo] test.functional.remote = no
[echo] test.functional.local = yes
[echo] test.functional.both = no
[echo] test.functional.reportdir = D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test-reports
[echo] test.functional.SimpleAxisPort = 8080
[echo] test.functional.TCPListenerPort = 8088
[echo] test.functional.fail = yes
[echo] classpath: D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xercesImpl.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xmlParserAPIs.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test\lib\xalan-2.6.0.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xml-apis.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${xerces.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test\lib\jakarta-oro-2.0.5.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\test\lib\xmlunit1.0.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\jsse.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\JimiProClasses.zip;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\activation.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\mailapi.jar;C:\Program Files\Java\jdk1.8.0_301\lib\tools.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${j2ee.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\junit.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\${servlet.jar};D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\commons-discovery-0.2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\commons-httpclient-3.0-rc2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\commons-logging-1.0.4.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\endorsed\xercesImpl-2.6.2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\endorsed\xml-apis-2.6.2.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\log4j-1.2.8.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\lib\wsdl4j-1.5.1.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-antlr.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-bcel.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-bsf.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-log4j.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-oro.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-regexp.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-resolver.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-apache-xalan2.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-commons-logging.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-commons-net.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-imageio.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jai.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-javamail.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jdepend.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jmf.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-jsch.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-junit.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-junit4.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-junitlauncher.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-launcher.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-netrexx.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-swing.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-testutil.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant-xz.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.apache.ant_1.10.8.v20200515-1239\lib\ant.jar;C:\eclipse-jee-2020-06-R\eclipse\configuration\org.eclipse.osgi\91\0\.cp\lib\antdebug.jar;C:\eclipse-jee-2020-06-R\eclipse\configuration\org.eclipse.osgi\91\0\.cp\lib\remote.jar;C:\eclipse-jee-2020-06-R\eclipse\configuration\org.eclipse.osgi\92\0\.cp\lib\remoteAnt.jar;C:\eclipse-jee-2020-06-R\eclipse\plugins\org.eclipse.swt.win32.win32.x86_64_3.114.100.v20200604-0951.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\classes;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\tools;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\lib\axis-ant.jar;D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build\lib\axis-schema.jar
compile:
[javac] D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml:99: warning: 'includeantruntime' was not set, defaulting to build.sysclasspath=last; set to false for repeatable builds
BUILD FAILED
D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\build.xml:169: Warning: Could not find file D:\Working Dir\axis-axis1-java-master\axis-axis1-java-master\src\org\apache\axis\server\server-config.wsdd to copy.
Not sure if my above steps are correct.
Please help to advise on how we can build the jar file from the source code.
Much thanks,
Kind Regards,
Reach
From: robertlazarski <ro...@gmail.com>
Sent: Thursday, 30 September 2021 8:18 pm
To: java-user@axis.apache.org
Subject: Re: [Axis2] Migration Issues
[External email] Please be cautious when clicking on any links or attachments.
________________________________
I actually also help maintain axis 1, if you check out the project from GitHub and do "git log --" you will notice that
I have been the most active committer there recently.
The way Apache foundation projects work, is that there is a VP who is elected to be responsible for security issues of all subprojects.
That's me currently. To keep Axis2 active, I am also required to be responsible for Axis 1.x too. I used it back in the day and know the architecture to a certain extent, but claim no deep knowledge without some effort.
The way Apache projects also works though is the community
contributes with patches and testing when necessary.
That all being said, Axis PMC member Andreas Veithen was the committer that through his gracious contributions over many years made it possible to keep the axis 1 git repo up to date in a modern way.
Andreas occasionally still responds to these types of mailing list threads - sometimes he does and sometimes he doesn't.
Robert
On Wed, Sep 29, 2021, 21:32 Chea Sovanreach (NCS) <so...@ncs.com.sg>> wrote:
Hi Robert,
Appreciate the quick response on your end.
As mentioned there is one member who keeps the Axis1.x updated throughout the years, is it possible to share his/her contact here? We would like to reach out to him/her to understand more about current Axis1.x latest build.
Thank you.
Kind Regards,
Reach
From: robertlazarski <ro...@gmail.com>>
Sent: Wednesday, 29 September 2021 6:00 pm
To: java-user@axis.apache.org<ma...@axis.apache.org>
Subject: Re: [Axis2] Migration Issues
[External email] Please be cautious when clicking on any links or attachments.
________________________________
Concerning help for a migration to Axis2, I don't have much to add unfortunately.
I myself wrote part of the migration guide 15 years ago and without being a recent user I would have to dive deep into the source code of both projects - something you and your team would be better suited for.
There is possiblity someone else can respond. Frankly, there isn't that many of us left here after twenty years.
Apache requires a minimum of three active members and we have that - but the Axis 1.x people mostly.are lurkers at this point. They do respond occasionally.
On Wed, Sep 29, 2021, 05:48 robertlazarski <ro...@gmail.com>> wrote:
While there has not been an official axis 1 release since 1.4 in 2006, there has been hundreds of commits to the project in git since then.
https://github.com/apache/axis-axis1-java<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Faxis-axis1-java&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cb360280b563641e2a2c708d9840c5c7d%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637686010890981157%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=36RBQXFmOnUGYgH7bkMVk9%2F8orfQ5UtmKA03%2FEK%2B5%2FE%3D&reserved=0>
The Apache security team requires all active repos to have vulnerabilities fixed. There are no open CVE's in the project that I am aware of.
I am not personally an axis 1.x user and there has been very little recent traffic for the project in Jira and the mailing list. Therefore there is little motivation for a release from our team.
There was one member of our project that kept Axis 1.x updated for many years by adding maven support and a lot of other commits, making it easier to maintain.
Challenges for the project include newer JDK support - JDK 11 for example has a minimum source compatibility requirement of JDK 6 however there are hundreds of compile errors at that level.
Because of all this, a release would require community help to push it forward.
I suggest building from source. A release would require contributions and testing. The "Apache way" encourages becoming a committer to projects to get involved in such a complicated situation.
Robert
On Tue, Sep 28, 2021, 23:53 Chea Sovanreach (NCS) <so...@ncs.com.sg>> wrote:
Hi Axis2 Team,
We have been trying to upgrade from Axis1 -> Axis2 for our project due to security vulnerability (CVE-2019-0227 : A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2 (cvedetails.com)<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cvedetails.com%2Fcve%2FCVE-2019-0227%2F&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cb360280b563641e2a2c708d9840c5c7d%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637686010890991152%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XM9hRtltgEq8gqd9TP27YHbjPEH7h9TwfDxkUvXyVSg%3D&reserved=0>. However, there are so many APIs that have changed and ways to implement those are not straightforward.
For example, org.apache.axis.message.MessageElement is totally removed. There is no clear guideline or documentation on how to implement similar APIs in Axis2.
Please help to advise on how we can improve our migration process and places where we can the reference to look for the changes.
Note: have checked out the official migration guide on your website https://axis.apache.org/axis2/java/core/docs/migration.html<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faxis.apache.org%2Faxis2%2Fjava%2Fcore%2Fdocs%2Fmigration.html&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cb360280b563641e2a2c708d9840c5c7d%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637686010890991152%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Xy3%2FK2rbrmSeb1Iei%2FXxG79k6P7BIUQ%2BxNmFqaA6Aak%3D&reserved=0> , but this is far from enough for us to do the migration.
Thank you.
Kind Regards,
Reach
Re: [Axis2] Migration Issues
Posted by robertlazarski <ro...@gmail.com>.
I actually also help maintain axis 1, if you check out the project from
GitHub and do "git log --" you will notice that
I have been the most active committer there recently.
The way Apache foundation projects work, is that there is a VP who is
elected to be responsible for security issues of all subprojects.
That's me currently. To keep Axis2 active, I am also required to be
responsible for Axis 1.x too. I used it back in the day and know the
architecture to a certain extent, but claim no deep knowledge without some
effort.
The way Apache projects also works though is the community
contributes with patches and testing when necessary.
That all being said, Axis PMC member Andreas Veithen was the committer that
through his gracious contributions over many years made it possible to keep
the axis 1 git repo up to date in a modern way.
Andreas occasionally still responds to these types of mailing list threads
- sometimes he does and sometimes he doesn't.
Robert
On Wed, Sep 29, 2021, 21:32 Chea Sovanreach (NCS) <
sovanreach.chea@ncs.com.sg> wrote:
> Hi Robert,
>
>
>
> Appreciate the quick response on your end.
>
>
>
> As mentioned there is one member who keeps the Axis1.x updated throughout
> the years, is it possible to share his/her contact here? We would like to
> reach out to him/her to understand more about current Axis1.x latest build.
>
>
>
> Thank you.
>
>
>
>
>
> Kind Regards,
>
> *Reach*
>
>
>
>
>
>
>
> *From:* robertlazarski <ro...@gmail.com>
> *Sent:* Wednesday, 29 September 2021 6:00 pm
> *To:* java-user@axis.apache.org
> *Subject:* Re: [Axis2] Migration Issues
>
>
>
> [External email] Please be cautious when clicking on any links or
> attachments.
> ------------------------------
>
> Concerning help for a migration to Axis2, I don't have much to add
> unfortunately.
>
>
>
> I myself wrote part of the migration guide 15 years ago and without being
> a recent user I would have to dive deep into the source code of both
> projects - something you and your team would be better suited for.
>
>
>
> There is possiblity someone else can respond. Frankly, there isn't that
> many of us left here after twenty years.
>
>
>
> Apache requires a minimum of three active members and we have that - but
> the Axis 1.x people mostly.are lurkers at this point. They do respond
> occasionally.
>
>
>
> On Wed, Sep 29, 2021, 05:48 robertlazarski <ro...@gmail.com>
> wrote:
>
> While there has not been an official axis 1 release since 1.4 in 2006,
> there has been hundreds of commits to the project in git since then.
>
>
>
> https://github.com/apache/axis-axis1-java
> <https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Faxis-axis1-java&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cd66a2b8bb7fe41f8f73e08d9832ffe23%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637685064412906897%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=p14hq3oCkvpvATFG7rAsSLMkapucOycm0XOk8Fn1q0E%3D&reserved=0>
>
>
>
> The Apache security team requires all active repos to have vulnerabilities
> fixed. There are no open CVE's in the project that I am aware of.
>
>
>
> I am not personally an axis 1.x user and there has been very little recent
> traffic for the project in Jira and the mailing list. Therefore there is
> little motivation for a release from our team.
>
>
>
> There was one member of our project that kept Axis 1.x updated for many
> years by adding maven support and a lot of other commits, making it easier
> to maintain.
>
>
>
> Challenges for the project include newer JDK support - JDK 11 for example
> has a minimum source compatibility requirement of JDK 6 however there are
> hundreds of compile errors at that level.
>
>
>
> Because of all this, a release would require community help to push it
> forward.
>
>
>
> I suggest building from source. A release would require contributions and
> testing. The "Apache way" encourages becoming a committer to projects to
> get involved in such a complicated situation.
>
>
>
> Robert
>
>
>
> On Tue, Sep 28, 2021, 23:53 Chea Sovanreach (NCS) <
> sovanreach.chea@ncs.com.sg> wrote:
>
> Hi Axis2 Team,
>
>
>
> We have been trying to upgrade from Axis1 -> Axis2 for our project due to
> security vulnerability (CVE-2019-0227 : A Server Side Request Forgery
> (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was
> last released in 2 (cvedetails.com)
> <https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cvedetails.com%2Fcve%2FCVE-2019-0227%2F&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cd66a2b8bb7fe41f8f73e08d9832ffe23%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637685064412916892%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WSTaiz9ILq26Ic%2B40Pk%2BT77sNsO7eWQQfDnOAzCvsQQ%3D&reserved=0>.
> However, there are so many APIs that have changed and ways to implement
> those are not straightforward.
>
> For example, *org.apache.axis.message.MessageElement* is totally removed.
> There is no clear guideline or documentation on how to implement similar
> APIs in Axis2.
>
>
>
> Please help to advise on how we can improve our migration process and
> places where we can the reference to look for the changes.
>
>
>
> *Note*: have checked out the official migration guide on your website
> https://axis.apache.org/axis2/java/core/docs/migration.html
> <https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faxis.apache.org%2Faxis2%2Fjava%2Fcore%2Fdocs%2Fmigration.html&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cd66a2b8bb7fe41f8f73e08d9832ffe23%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637685064412926887%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=pUlFxq9cOCBG%2FO2y3LbAsedB%2FJAiAm2%2BrjqnmkM3QxE%3D&reserved=0>
> , but this is far from enough for us to do the migration.
>
>
>
> Thank you.
>
>
>
>
>
> Kind Regards,
>
> *Reach*
>
>
>
>
RE: [Axis2] Migration Issues
Posted by "Chea Sovanreach (NCS)" <so...@ncs.com.sg>.
Hi Robert,
Appreciate the quick response on your end.
As mentioned there is one member who keeps the Axis1.x updated throughout the years, is it possible to share his/her contact here? We would like to reach out to him/her to understand more about current Axis1.x latest build.
Thank you.
Kind Regards,
Reach
From: robertlazarski <ro...@gmail.com>
Sent: Wednesday, 29 September 2021 6:00 pm
To: java-user@axis.apache.org
Subject: Re: [Axis2] Migration Issues
[External email] Please be cautious when clicking on any links or attachments.
________________________________
Concerning help for a migration to Axis2, I don't have much to add unfortunately.
I myself wrote part of the migration guide 15 years ago and without being a recent user I would have to dive deep into the source code of both projects - something you and your team would be better suited for.
There is possiblity someone else can respond. Frankly, there isn't that many of us left here after twenty years.
Apache requires a minimum of three active members and we have that - but the Axis 1.x people mostly.are lurkers at this point. They do respond occasionally.
On Wed, Sep 29, 2021, 05:48 robertlazarski <ro...@gmail.com>> wrote:
While there has not been an official axis 1 release since 1.4 in 2006, there has been hundreds of commits to the project in git since then.
https://github.com/apache/axis-axis1-java<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Faxis-axis1-java&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cd66a2b8bb7fe41f8f73e08d9832ffe23%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637685064412906897%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=p14hq3oCkvpvATFG7rAsSLMkapucOycm0XOk8Fn1q0E%3D&reserved=0>
The Apache security team requires all active repos to have vulnerabilities fixed. There are no open CVE's in the project that I am aware of.
I am not personally an axis 1.x user and there has been very little recent traffic for the project in Jira and the mailing list. Therefore there is little motivation for a release from our team.
There was one member of our project that kept Axis 1.x updated for many years by adding maven support and a lot of other commits, making it easier to maintain.
Challenges for the project include newer JDK support - JDK 11 for example has a minimum source compatibility requirement of JDK 6 however there are hundreds of compile errors at that level.
Because of all this, a release would require community help to push it forward.
I suggest building from source. A release would require contributions and testing. The "Apache way" encourages becoming a committer to projects to get involved in such a complicated situation.
Robert
On Tue, Sep 28, 2021, 23:53 Chea Sovanreach (NCS) <so...@ncs.com.sg>> wrote:
Hi Axis2 Team,
We have been trying to upgrade from Axis1 -> Axis2 for our project due to security vulnerability (CVE-2019-0227 : A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2 (cvedetails.com)<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cvedetails.com%2Fcve%2FCVE-2019-0227%2F&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cd66a2b8bb7fe41f8f73e08d9832ffe23%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637685064412916892%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WSTaiz9ILq26Ic%2B40Pk%2BT77sNsO7eWQQfDnOAzCvsQQ%3D&reserved=0>. However, there are so many APIs that have changed and ways to implement those are not straightforward.
For example, org.apache.axis.message.MessageElement is totally removed. There is no clear guideline or documentation on how to implement similar APIs in Axis2.
Please help to advise on how we can improve our migration process and places where we can the reference to look for the changes.
Note: have checked out the official migration guide on your website https://axis.apache.org/axis2/java/core/docs/migration.html<https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faxis.apache.org%2Faxis2%2Fjava%2Fcore%2Fdocs%2Fmigration.html&data=04%7C01%7Csovanreach.chea%40ncs.com.sg%7Cd66a2b8bb7fe41f8f73e08d9832ffe23%7Cca90d8f589634b6ebca99ac468bcc7a8%7C1%7C0%7C637685064412926887%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=pUlFxq9cOCBG%2FO2y3LbAsedB%2FJAiAm2%2BrjqnmkM3QxE%3D&reserved=0> , but this is far from enough for us to do the migration.
Thank you.
Kind Regards,
Reach
Re: [Axis2] Migration Issues
Posted by robertlazarski <ro...@gmail.com>.
Concerning help for a migration to Axis2, I don't have much to add
unfortunately.
I myself wrote part of the migration guide 15 years ago and without being a
recent user I would have to dive deep into the source code of both projects
- something you and your team would be better suited for.
There is possiblity someone else can respond. Frankly, there isn't that
many of us left here after twenty years.
Apache requires a minimum of three active members and we have that - but
the Axis 1.x people mostly.are lurkers at this point. They do respond
occasionally.
On Wed, Sep 29, 2021, 05:48 robertlazarski <ro...@gmail.com> wrote:
> While there has not been an official axis 1 release since 1.4 in 2006,
> there has been hundreds of commits to the project in git since then.
>
> https://github.com/apache/axis-axis1-java
>
> The Apache security team requires all active repos to have vulnerabilities
> fixed. There are no open CVE's in the project that I am aware of.
>
> I am not personally an axis 1.x user and there has been very little recent
> traffic for the project in Jira and the mailing list. Therefore there is
> little motivation for a release from our team.
>
> There was one member of our project that kept Axis 1.x updated for many
> years by adding maven support and a lot of other commits, making it easier
> to maintain.
>
> Challenges for the project include newer JDK support - JDK 11 for example
> has a minimum source compatibility requirement of JDK 6 however there are
> hundreds of compile errors at that level.
>
> Because of all this, a release would require community help to push it
> forward.
>
> I suggest building from source. A release would require contributions and
> testing. The "Apache way" encourages becoming a committer to projects to
> get involved in such a complicated situation.
>
> Robert
>
> On Tue, Sep 28, 2021, 23:53 Chea Sovanreach (NCS) <
> sovanreach.chea@ncs.com.sg> wrote:
>
>> Hi Axis2 Team,
>>
>>
>>
>> We have been trying to upgrade from Axis1 -> Axis2 for our project due to
>> security vulnerability (CVE-2019-0227 : A Server Side Request Forgery
>> (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was
>> last released in 2 (cvedetails.com)
>> <https://www.cvedetails.com/cve/CVE-2019-0227/>. However, there are so
>> many APIs that have changed and ways to implement those are not
>> straightforward.
>>
>> For example, *org.apache.axis.message.MessageElement* is totally
>> removed. There is no clear guideline or documentation on how to implement
>> similar APIs in Axis2.
>>
>>
>>
>> Please help to advise on how we can improve our migration process and
>> places where we can the reference to look for the changes.
>>
>>
>>
>> *Note*: have checked out the official migration guide on your website
>> https://axis.apache.org/axis2/java/core/docs/migration.html , but this
>> is far from enough for us to do the migration.
>>
>>
>>
>> Thank you.
>>
>>
>>
>>
>>
>> Kind Regards,
>>
>> *Reach*
>>
>>
>>
>
Re: [Axis2] Migration Issues
Posted by robertlazarski <ro...@gmail.com>.
While there has not been an official axis 1 release since 1.4 in 2006,
there has been hundreds of commits to the project in git since then.
https://github.com/apache/axis-axis1-java
The Apache security team requires all active repos to have vulnerabilities
fixed. There are no open CVE's in the project that I am aware of.
I am not personally an axis 1.x user and there has been very little recent
traffic for the project in Jira and the mailing list. Therefore there is
little motivation for a release from our team.
There was one member of our project that kept Axis 1.x updated for many
years by adding maven support and a lot of other commits, making it easier
to maintain.
Challenges for the project include newer JDK support - JDK 11 for example
has a minimum source compatibility requirement of JDK 6 however there are
hundreds of compile errors at that level.
Because of all this, a release would require community help to push it
forward.
I suggest building from source. A release would require contributions and
testing. The "Apache way" encourages becoming a committer to projects to
get involved in such a complicated situation.
Robert
On Tue, Sep 28, 2021, 23:53 Chea Sovanreach (NCS) <
sovanreach.chea@ncs.com.sg> wrote:
> Hi Axis2 Team,
>
>
>
> We have been trying to upgrade from Axis1 -> Axis2 for our project due to
> security vulnerability (CVE-2019-0227 : A Server Side Request Forgery
> (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was
> last released in 2 (cvedetails.com)
> <https://www.cvedetails.com/cve/CVE-2019-0227/>. However, there are so
> many APIs that have changed and ways to implement those are not
> straightforward.
>
> For example, *org.apache.axis.message.MessageElement* is totally removed.
> There is no clear guideline or documentation on how to implement similar
> APIs in Axis2.
>
>
>
> Please help to advise on how we can improve our migration process and
> places where we can the reference to look for the changes.
>
>
>
> *Note*: have checked out the official migration guide on your website
> https://axis.apache.org/axis2/java/core/docs/migration.html , but this is
> far from enough for us to do the migration.
>
>
>
> Thank you.
>
>
>
>
>
> Kind Regards,
>
> *Reach*
>
>
>