You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Christopher Schultz <ch...@christopherschultz.net> on 2025/02/04 22:10:42 UTC
[VOTE] Release Apache Tomcat 10.1.35
The proposed Apache Tomcat 10.1.35 release is now available for
voting.
All committers and PMC members are kindly requested to provide a vote if
possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
binding. We welcome non-committer votes or comments on release builds.
The notable changes compared to 10.1.34 are:
- Allow readOnly attribute configuration on the Resources element and
allow configuration of the readOnly attribute value of the main
resources. The attribute value will also be used by the default and
WebDAV Servlets.
- Correct a regression in the fix for bug 69382 that broke JSP
include actions if both the page attribute and the body contained
parameters. Pull request #803 provided by Chenjp.
- Expand the options for handling encoded '/' and '\' characters in
URLs both in the Connector and when using a RequestDispatcher.
For full details, see the change log:
https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
without changes. Java EE applications designed for Tomcat 9 and earlier
may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
will automatically convert them to Jakarta EE and copy them to the
webapps directory.
It can be obtained from:
https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
The Maven staging repo is:
https://repository.apache.org/content/repositories/orgapachetomcat-1530
The tag is:
https://github.com/apache/tomcat/tree/10.1.35
https://github.com/apache/tomcat/commit/9636e5188311f30c1e46c94191d2145998778bf4
Please reply with a +1 for release or +0/-0/-1 with an explanation.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 10.1.35
Posted by Mark Thomas <ma...@apache.org>.
On 04/02/2025 22:10, Christopher Schultz wrote:
> Please reply with a +1 for release or +0/-0/-1 with an explanation.
+1
Build is cross platform (OSX/Linux/Windows) reproducible.
Tests pass on:
- Linux (OpenSSL 3.0.13 from Ubuntu 24.04)
- Windows (OpenSSL 3.0.14 - Native 2.0.8 binaries)
- MacOS (Intel) (OpenSSL 3.4.0)
- MacOS (M1 (OpenSSL 3.4.0)
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE][OT] Release Apache Tomcat 10.1.35
Posted by Rainer Jung <ra...@kippdata.de>.
Am 07.02.25 um 22:36 schrieb Rainer Jung:
> Am 07.02.25 um 22:21 schrieb Rainer Jung:
>> Am 07.02.25 um 21:50 schrieb Rainer Jung:
>>> Hi Chris,
>>>
>>> Am 07.02.25 um 20:44 schrieb Christopher Schultz:
>>>> Rainer,
>>>>
>>>> On 2/7/25 2:38 PM, Rainer Jung wrote:
>>>>> Am 04.02.25 um 23:10 schrieb Christopher Schultz:
>>>>>> The proposed Apache Tomcat 10.1.35 release is now available for
>>>>>> voting.
>>>>>>
>>>>>> All committers and PMC members are kindly requested to provide a
>>>>>> vote if possible. ANY TOMCAT USER MAY VOTE, though only PMC
>>>>>> members votes are binding. We welcome non-committer votes or
>>>>>> comments on release builds.
>>>>>>
>>>>>> The notable changes compared to 10.1.34 are:
>>>>>>
>>>>>> - Allow readOnly attribute configuration on the Resources element and
>>>>>> allow configuration of the readOnly attribute value of the main
>>>>>> resources. The attribute value will also be used by the default
>>>>>> and
>>>>>> WebDAV Servlets.
>>>>>>
>>>>>> - Correct a regression in the fix for bug 69382 that broke JSP
>>>>>> include actions if both the page attribute and the body contained
>>>>>> parameters. Pull request #803 provided by Chenjp.
>>>>>>
>>>>>> - Expand the options for handling encoded '/' and '\' characters in
>>>>>> URLs both in the Connector and when using a RequestDispatcher.
>>>>>>
>>>>>> For full details, see the change log:
>>>>>> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>>>>>>
>>>>>> Applications that run on Tomcat 9 and earlier will not run on
>>>>>> Tomcat 10 without changes. Java EE applications designed for
>>>>>> Tomcat 9 and earlier may be placed in the $CATALINA_BASE/webapps-
>>>>>> javaee directory and Tomcat will automatically convert them to
>>>>>> Jakarta EE and copy them to the webapps directory.
>>>>>>
>>>>>> It can be obtained from:
>>>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>>>>>>
>>>>>> The Maven staging repo is:
>>>>>> https://repository.apache.org/content/repositories/
>>>>>> orgapachetomcat-1530
>>>>>>
>>>>>> The tag is:
>>>>>> https://github.com/apache/tomcat/tree/10.1.35
>>>>>> https://github.com/apache/tomcat/
>>>>>> commit/9636e5188311f30c1e46c94191d2145998778bf4
>>>>>>
>>>>>> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>>>>>
>>>>> +1
>>>>>
>>>>> Reproducibility of the build checked (except for Windows installer
>>>>> and signing) on Linux Mint 22.1. OK after setting LANG.
>>>>
>>>> I'd still like to look-in on this. For the installer, are you
>>>> willing to install Wine?
>>>
>>> I could but I'm not so eager putting wine on my laptop.
>>>
>>> Interestingly I use NSIS to build windows installers completely on
>>> Linux. That is one of the nice features of NSIS. Currently the only
>>> reason I see, why wine is really used, is the tempinstaller.exe which
>>> is created and then executed to create the uninstaller. When I use
>>> NSIS, it can create the uninstaller directly, but I have not yet
>>> investigated why we need this indirection.
>>
>> It seems it has to do with how we do code signing, but I haven't fully
>> understood the details. When building an installer myself, I use
>>
>> !finalize 'mysignscript myinstaller.exe'
>> !uninstfinalize 'mysignscript myuninstaller.exe'
>>
>> inside the nsi script file.
>>
>> I do not know, whether this would be feasible with how we use jsign
>> and the cloud signing service, but it should be doable. I haven't
>> understood though, how the detached signatures are used. I don't seem
>> to use detached signatures when doing my installer.
>>
>> Without code signing (do.codesigning=false), the following changes at
>> least run on Linux without wine and produce an installer. But I still
>> have to check, whether the intsaller actually works:
>>
>> --- build.xml 2025-02-04 18:40:20.000000000 +0100
>> +++ build.xml 2025-02-07 22:12:14.418108524 +0100
...
>
> Sorry, one more:
>
> --- res/install-win/tomcat.nsi 2024-10-07 15:58:21.790187079 +0200
> +++ res/install-win/tomcat.nsi 2025-02-07 21:55:58.716342021 +0100
> @@ -18,7 +18,7 @@
> Unicode true
>
> !ifdef UNINSTALLONLY
> - OutFile "tempinstaller.exe"
> + OutFile "Uninstall.exe"
> !else
> OutFile tomcat-installer.exe
> !endif
The installer looks good function wise and it installs a file
Uninstall.exe, But Uninstall.exe created that way and bundled in the
installer does not actually work as an uninstaller. It actually seems to
run only very shortly not showing a GUI or any noticable effect.
>> BUT: IMHO without using the official signing service, the installer
>> will never be reproduced by me. So even if I make some sort of code-
>> signing work, building the installer would just show, that the file is
>> produced. Plus, if I am willing to try it on Windows, whether it looks
>> OK.
>>
>>> The other wine calls used to execure makensis.exe can be replaced by
>>> directly calling makensis on Linux using -X flags instead of /X flags.
>>>
>>> > Also, which artifacts are not byte-for-byte identical when >
>>> performing the build verification -- when LANG=de? All of them, or only
>>>> some of them?
>>>
>>> Just the fulldocs tarball. The HTML pages contains german text
>>> instead of the english one. We tried fixing it using java means
>>> (sysprops, flags) to no avail.
>>>
>>>>> Tested on platforms
>>>>>
>>>>> - RHEL 6, 7, 8 and 9, SLES 11, 12 and 15, Solaris 11 Sparc
>>>>>
>>>>> using
>>>>>
>>>>> - current patch versions of JDK 11, 17 and not yet done 21, 23 and
>>>>> 24+25 (current EAs)
>>>>>
>>>>> from
>>>>>
>>>>> - Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
>>>>> OpenJDK (for the EA)
>>>>>
>>>>> where available.
>>>>>
>>>>> Also tested with
>>>>>
>>>>> - tcnative 1.3.1, tcnative 2.0.8 and panama
>>>>>
>>>>> based on
>>>>>
>>>>> - OpenSSL 3.0.15, 3.1.7, 3.2.3, 3.3.2 and 3.4.0.
>>>>>
>>>>> All fine, except for the usual sporadic crashes with tcnative
>>>>> during shutdown. Also manually changed the max memory size for the
>>>>> unit tests from 256m to 512m (already fixed in git).
>>>>>
>>>>> Thanks for RM!
>>>> ;)
>>>>
>>>> -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE][OT] Release Apache Tomcat 10.1.35
Posted by Rainer Jung <ra...@kippdata.de>.
Am 07.02.25 um 22:21 schrieb Rainer Jung:
> Am 07.02.25 um 21:50 schrieb Rainer Jung:
>> Hi Chris,
>>
>> Am 07.02.25 um 20:44 schrieb Christopher Schultz:
>>> Rainer,
>>>
>>> On 2/7/25 2:38 PM, Rainer Jung wrote:
>>>> Am 04.02.25 um 23:10 schrieb Christopher Schultz:
>>>>> The proposed Apache Tomcat 10.1.35 release is now available for
>>>>> voting.
>>>>>
>>>>> All committers and PMC members are kindly requested to provide a
>>>>> vote if possible. ANY TOMCAT USER MAY VOTE, though only PMC members
>>>>> votes are binding. We welcome non-committer votes or comments on
>>>>> release builds.
>>>>>
>>>>> The notable changes compared to 10.1.34 are:
>>>>>
>>>>> - Allow readOnly attribute configuration on the Resources element and
>>>>> allow configuration of the readOnly attribute value of the main
>>>>> resources. The attribute value will also be used by the default and
>>>>> WebDAV Servlets.
>>>>>
>>>>> - Correct a regression in the fix for bug 69382 that broke JSP
>>>>> include actions if both the page attribute and the body contained
>>>>> parameters. Pull request #803 provided by Chenjp.
>>>>>
>>>>> - Expand the options for handling encoded '/' and '\' characters in
>>>>> URLs both in the Connector and when using a RequestDispatcher.
>>>>>
>>>>> For full details, see the change log:
>>>>> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>>>>>
>>>>> Applications that run on Tomcat 9 and earlier will not run on
>>>>> Tomcat 10 without changes. Java EE applications designed for Tomcat
>>>>> 9 and earlier may be placed in the $CATALINA_BASE/webapps-javaee
>>>>> directory and Tomcat will automatically convert them to Jakarta EE
>>>>> and copy them to the webapps directory.
>>>>>
>>>>> It can be obtained from:
>>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>>>>>
>>>>> The Maven staging repo is:
>>>>> https://repository.apache.org/content/repositories/
>>>>> orgapachetomcat-1530
>>>>>
>>>>> The tag is:
>>>>> https://github.com/apache/tomcat/tree/10.1.35
>>>>> https://github.com/apache/tomcat/
>>>>> commit/9636e5188311f30c1e46c94191d2145998778bf4
>>>>>
>>>>> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>>>>
>>>> +1
>>>>
>>>> Reproducibility of the build checked (except for Windows installer
>>>> and signing) on Linux Mint 22.1. OK after setting LANG.
>>>
>>> I'd still like to look-in on this. For the installer, are you willing
>>> to install Wine?
>>
>> I could but I'm not so eager putting wine on my laptop.
>>
>> Interestingly I use NSIS to build windows installers completely on
>> Linux. That is one of the nice features of NSIS. Currently the only
>> reason I see, why wine is really used, is the tempinstaller.exe which
>> is created and then executed to create the uninstaller. When I use
>> NSIS, it can create the uninstaller directly, but I have not yet
>> investigated why we need this indirection.
>
> It seems it has to do with how we do code signing, but I haven't fully
> understood the details. When building an installer myself, I use
>
> !finalize 'mysignscript myinstaller.exe'
> !uninstfinalize 'mysignscript myuninstaller.exe'
>
> inside the nsi script file.
>
> I do not know, whether this would be feasible with how we use jsign and
> the cloud signing service, but it should be doable. I haven't understood
> though, how the detached signatures are used. I don't seem to use
> detached signatures when doing my installer.
>
> Without code signing (do.codesigning=false), the following changes at
> least run on Linux without wine and produce an installer. But I still
> have to check, whether the intsaller actually works:
>
> --- build.xml.kpdt_orig 2025-02-04 18:40:20.000000000 +0100
> +++ build.xml 2025-02-07 22:12:14.418108524 +0100
> @@ -2565,6 +2565,7 @@
> <or>
> <os family="windows" />
> <available file="wine" filepath="${env.PATH}" />
> + <available file="makensis" filepath="${env.PATH}" />
> <isset property="skip.installer"/>
> </or>
> </condition>
> @@ -2618,11 +2619,10 @@
> <arg value="/V2" />
> <arg value="tomcat.nsi" />
> </exec>
> - <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
> - <arg value="${nsis.exe}" />
> - <arg value="/DUNINSTALLONLY" />
> - <arg value="/DNSISDIR=${nsis.home}" />
> - <arg value="/V2" />
> + <exec dir="${tomcat.dist}" executable="makensis" osfamily="unix">
> + <arg value="-DUNINSTALLONLY" />
> + <arg value="-DNSISDIR=${nsis.home}" />
> + <arg value="-V2" />
> <arg value="tomcat.nsi" />
> </exec>
> </target>
> @@ -2632,9 +2632,11 @@
> <!-- Execute the temporary installer to create the uninstaller -->
> <exec dir="${tomcat.dist}" executable="${tomcat.dist}/
> tempinstaller.exe"
> osfamily="windows" />
> + <!--
> <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
> <arg value="${tomcat.dist}/tempinstaller.exe" />
> </exec>
> + -->
> <!-- Reproducible builds: consistent timestamps for installer
> files -->
> <touch datetime="${tstamp.file}" pattern="yyyy-MM-dd HH:mm:ss">
> <fileset dir="${tomcat.dist}"/>
> @@ -2671,10 +2673,9 @@
> <arg value="/V2" />
> <arg value="tomcat.nsi" />
> </exec>
> - <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
> - <arg value="${nsis.exe}" />
> - <arg value="/DNSISDIR=${nsis.home}" />
> - <arg value="/V2" />
> + <exec dir="${tomcat.dist}" executable="makensis" osfamily="unix">
> + <arg value="-DNSISDIR=${nsis.home}" />
> + <arg value="-V2" />
> <arg value="tomcat.nsi" />
> </exec>
> <move file="${tomcat.dist}/tomcat-installer.exe"
> tofile="${tomcat.release}/v${version}/bin/${final.name}.exe" />
Sorry, one more:
--- res/install-win/tomcat.nsi 2024-10-07 15:58:21.790187079 +0200
+++ res/install-win/tomcat.nsi 2025-02-07 21:55:58.716342021 +0100
@@ -18,7 +18,7 @@
Unicode true
!ifdef UNINSTALLONLY
- OutFile "tempinstaller.exe"
+ OutFile "Uninstall.exe"
!else
OutFile tomcat-installer.exe
!endif
> BUT: IMHO without using the official signing service, the installer will
> never be reproduced by me. So even if I make some sort of code-signing
> work, building the installer would just show, that the file is produced.
> Plus, if I am willing to try it on Windows, whether it looks OK.
>
>> The other wine calls used to execure makensis.exe can be replaced by
>> directly calling makensis on Linux using -X flags instead of /X flags.
>>
>> > Also, which artifacts are not byte-for-byte identical when >
>> performing the build verification -- when LANG=de? All of them, or only
>>> some of them?
>>
>> Just the fulldocs tarball. The HTML pages contains german text instead
>> of the english one. We tried fixing it using java means (sysprops,
>> flags) to no avail.
>>
>>>> Tested on platforms
>>>>
>>>> - RHEL 6, 7, 8 and 9, SLES 11, 12 and 15, Solaris 11 Sparc
>>>>
>>>> using
>>>>
>>>> - current patch versions of JDK 11, 17 and not yet done 21, 23 and
>>>> 24+25 (current EAs)
>>>>
>>>> from
>>>>
>>>> - Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
>>>> OpenJDK (for the EA)
>>>>
>>>> where available.
>>>>
>>>> Also tested with
>>>>
>>>> - tcnative 1.3.1, tcnative 2.0.8 and panama
>>>>
>>>> based on
>>>>
>>>> - OpenSSL 3.0.15, 3.1.7, 3.2.3, 3.3.2 and 3.4.0.
>>>>
>>>> All fine, except for the usual sporadic crashes with tcnative during
>>>> shutdown. Also manually changed the max memory size for the unit
>>>> tests from 256m to 512m (already fixed in git).
>>>>
>>>> Thanks for RM!
>>> ;)
>>>
>>> -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE][OT] Release Apache Tomcat 10.1.35
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Rainer,
On 2/7/25 4:21 PM, Rainer Jung wrote:
> Am 07.02.25 um 21:50 schrieb Rainer Jung:
>> Hi Chris,
>>
>> Am 07.02.25 um 20:44 schrieb Christopher Schultz:
>>> Rainer,
>>>
>>> On 2/7/25 2:38 PM, Rainer Jung wrote:
>>>> Am 04.02.25 um 23:10 schrieb Christopher Schultz:
>>>>> The proposed Apache Tomcat 10.1.35 release is now available for
>>>>> voting.
>>>>>
>>>>> All committers and PMC members are kindly requested to provide a
>>>>> vote if possible. ANY TOMCAT USER MAY VOTE, though only PMC members
>>>>> votes are binding. We welcome non-committer votes or comments on
>>>>> release builds.
>>>>>
>>>>> The notable changes compared to 10.1.34 are:
>>>>>
>>>>> - Allow readOnly attribute configuration on the Resources element and
>>>>> allow configuration of the readOnly attribute value of the main
>>>>> resources. The attribute value will also be used by the default and
>>>>> WebDAV Servlets.
>>>>>
>>>>> - Correct a regression in the fix for bug 69382 that broke JSP
>>>>> include actions if both the page attribute and the body contained
>>>>> parameters. Pull request #803 provided by Chenjp.
>>>>>
>>>>> - Expand the options for handling encoded '/' and '\' characters in
>>>>> URLs both in the Connector and when using a RequestDispatcher.
>>>>>
>>>>> For full details, see the change log:
>>>>> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>>>>>
>>>>> Applications that run on Tomcat 9 and earlier will not run on
>>>>> Tomcat 10 without changes. Java EE applications designed for Tomcat
>>>>> 9 and earlier may be placed in the $CATALINA_BASE/webapps-javaee
>>>>> directory and Tomcat will automatically convert them to Jakarta EE
>>>>> and copy them to the webapps directory.
>>>>>
>>>>> It can be obtained from:
>>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>>>>>
>>>>> The Maven staging repo is:
>>>>> https://repository.apache.org/content/repositories/
>>>>> orgapachetomcat-1530
>>>>>
>>>>> The tag is:
>>>>> https://github.com/apache/tomcat/tree/10.1.35
>>>>> https://github.com/apache/tomcat/
>>>>> commit/9636e5188311f30c1e46c94191d2145998778bf4
>>>>>
>>>>> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>>>>
>>>> +1
>>>>
>>>> Reproducibility of the build checked (except for Windows installer
>>>> and signing) on Linux Mint 22.1. OK after setting LANG.
>>>
>>> I'd still like to look-in on this. For the installer, are you willing
>>> to install Wine?
>>
>> I could but I'm not so eager putting wine on my laptop.
>>
>> Interestingly I use NSIS to build windows installers completely on
>> Linux. That is one of the nice features of NSIS. Currently the only
>> reason I see, why wine is really used, is the tempinstaller.exe which
>> is created and then executed to create the uninstaller. When I use
>> NSIS, it can create the uninstaller directly, but I have not yet
>> investigated why we need this indirection.
>
> It seems it has to do with how we do code signing, but I haven't fully
> understood the details. When building an installer myself, I use
>
> !finalize 'mysignscript myinstaller.exe'
> !uninstfinalize 'mysignscript myuninstaller.exe'
>
> inside the nsi script file.
>
> I do not know, whether this would be feasible with how we use jsign and
> the cloud signing service, but it should be doable. I haven't understood
> though, how the detached signatures are used. I don't seem to use
> detached signatures when doing my installer.
NSIS isn't responsible for signing the installer and uninstaller. We use
jsign for that, so swapping makensis for nsis.exe should not interfere.
> Without code signing (do.codesigning=false), the following changes at
> least run on Linux without wine and produce an installer. But I still
> have to check, whether the intsaller actually works:
>
> --- build.xml.kpdt_orig 2025-02-04 18:40:20.000000000 +0100
> +++ build.xml 2025-02-07 22:12:14.418108524 +0100
> @@ -2565,6 +2565,7 @@
> <or>
> <os family="windows" />
> <available file="wine" filepath="${env.PATH}" />
> + <available file="makensis" filepath="${env.PATH}" />
> <isset property="skip.installer"/>
> </or>
> </condition>
> @@ -2618,11 +2619,10 @@
> <arg value="/V2" />
> <arg value="tomcat.nsi" />
> </exec>
> - <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
> - <arg value="${nsis.exe}" />
> - <arg value="/DUNINSTALLONLY" />
> - <arg value="/DNSISDIR=${nsis.home}" />
> - <arg value="/V2" />
> + <exec dir="${tomcat.dist}" executable="makensis" osfamily="unix">
> + <arg value="-DUNINSTALLONLY" />
> + <arg value="-DNSISDIR=${nsis.home}" />
> + <arg value="-V2" />
> <arg value="tomcat.nsi" />
> </exec>
> </target>
> @@ -2632,9 +2632,11 @@
> <!-- Execute the temporary installer to create the uninstaller -->
> <exec dir="${tomcat.dist}" executable="${tomcat.dist}/
> tempinstaller.exe"
> osfamily="windows" />
> + <!--
> <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
> <arg value="${tomcat.dist}/tempinstaller.exe" />
> </exec>
> + -->
> <!-- Reproducible builds: consistent timestamps for installer
> files -->
> <touch datetime="${tstamp.file}" pattern="yyyy-MM-dd HH:mm:ss">
> <fileset dir="${tomcat.dist}"/>
> @@ -2671,10 +2673,9 @@
> <arg value="/V2" />
> <arg value="tomcat.nsi" />
> </exec>
> - <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
> - <arg value="${nsis.exe}" />
> - <arg value="/DNSISDIR=${nsis.home}" />
> - <arg value="/V2" />
> + <exec dir="${tomcat.dist}" executable="makensis" osfamily="unix">
> + <arg value="-DNSISDIR=${nsis.home}" />
> + <arg value="-V2" />
> <arg value="tomcat.nsi" />
> </exec>
> <move file="${tomcat.dist}/tomcat-installer.exe"
> tofile="${tomcat.release}/v${version}/bin/${final.name}.exe" />
>
>
> BUT: IMHO without using the official signing service, the installer will
> never be reproduced by me. So even if I make some sort of code-signing
> work, building the installer would just show, that the file is produced.
When the build "does code-signing" there are two paths:
1. No local detached signature file exists. This is what the release
manager encounters. Jsign takes the binary, sends it to the code-signing
service and requests a signature using the user's credentials. Our build
then saves the signature to a separate file (e.g.
res/install-win/tomcat-installer.exe.sig), and also adds the signature
to the .exe file itself.
2. A local detached signature file exists. This is what everybody
receives from the release manager in the source tarball. Jsign takes the
detached signature and attaches it to the installer file you built yourself.
If the source is identical (it ought to be!) and both makensis and
nsis.exe produce byte-for-byte identical outputs given the same input
(not sure about this one), then the resulting .exe file ought to be
verifiable in a number of ways:
a. On Linux and other platforms, use osslsigncode (I use this as part of
my suite of tests on MacOS)
b. On Windows, just right-click on the file and look at the security
properties to verify that it's properly-signed
In order for you to test this, you must set codesigning=true in your
build. Note that given all the various signatures bundled with the
source release artifacts, you won't actually sign anything yourself.
> Plus, if I am willing to try it on Windows, whether it looks OK.
>
>> The other wine calls used to execure makensis.exe can be replaced by
>> directly calling makensis on Linux using -X flags instead of /X flags.
>>
>> > Also, which artifacts are not byte-for-byte identical when >
>> performing the build verification -- when LANG=de? All of them, or only
>>> some of them?
>>
>> Just the fulldocs tarball. The HTML pages contains german text instead
>> of the english one. We tried fixing it using java means (sysprops,
>> flags) to no avail.
It turns out that the fulldocs tarball appears to be different for
various reasons even for us release managers operating in the "en"
locale. Depending upon the JDK used to build, we have seen issues with
the LICENSE and COPYING and other files due to linked files on Windows.
We've seen issues where the javadoc sometimes points to to the
Jre17Compat class instead of the Jre19Compat class and vice-versa.
My "verify-release" ant target will tell you if the fulldocs package
isn't identical, but will still tell you that the release should be
considered reproducible.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE][OT] Release Apache Tomcat 10.1.35
Posted by Rainer Jung <ra...@kippdata.de>.
Am 07.02.25 um 21:50 schrieb Rainer Jung:
> Hi Chris,
>
> Am 07.02.25 um 20:44 schrieb Christopher Schultz:
>> Rainer,
>>
>> On 2/7/25 2:38 PM, Rainer Jung wrote:
>>> Am 04.02.25 um 23:10 schrieb Christopher Schultz:
>>>> The proposed Apache Tomcat 10.1.35 release is now available for
>>>> voting.
>>>>
>>>> All committers and PMC members are kindly requested to provide a
>>>> vote if possible. ANY TOMCAT USER MAY VOTE, though only PMC members
>>>> votes are binding. We welcome non-committer votes or comments on
>>>> release builds.
>>>>
>>>> The notable changes compared to 10.1.34 are:
>>>>
>>>> - Allow readOnly attribute configuration on the Resources element and
>>>> allow configuration of the readOnly attribute value of the main
>>>> resources. The attribute value will also be used by the default and
>>>> WebDAV Servlets.
>>>>
>>>> - Correct a regression in the fix for bug 69382 that broke JSP
>>>> include actions if both the page attribute and the body contained
>>>> parameters. Pull request #803 provided by Chenjp.
>>>>
>>>> - Expand the options for handling encoded '/' and '\' characters in
>>>> URLs both in the Connector and when using a RequestDispatcher.
>>>>
>>>> For full details, see the change log:
>>>> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>>>>
>>>> Applications that run on Tomcat 9 and earlier will not run on Tomcat
>>>> 10 without changes. Java EE applications designed for Tomcat 9 and
>>>> earlier may be placed in the $CATALINA_BASE/webapps-javaee directory
>>>> and Tomcat will automatically convert them to Jakarta EE and copy
>>>> them to the webapps directory.
>>>>
>>>> It can be obtained from:
>>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>>>>
>>>> The Maven staging repo is:
>>>> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>>>>
>>>> The tag is:
>>>> https://github.com/apache/tomcat/tree/10.1.35
>>>> https://github.com/apache/tomcat/
>>>> commit/9636e5188311f30c1e46c94191d2145998778bf4
>>>>
>>>> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>>>
>>> +1
>>>
>>> Reproducibility of the build checked (except for Windows installer
>>> and signing) on Linux Mint 22.1. OK after setting LANG.
>>
>> I'd still like to look-in on this. For the installer, are you willing
>> to install Wine?
>
> I could but I'm not so eager putting wine on my laptop.
>
> Interestingly I use NSIS to build windows installers completely on
> Linux. That is one of the nice features of NSIS. Currently the only
> reason I see, why wine is really used, is the tempinstaller.exe which is
> created and then executed to create the uninstaller. When I use NSIS, it
> can create the uninstaller directly, but I have not yet investigated why
> we need this indirection.
It seems it has to do with how we do code signing, but I haven't fully
understood the details. When building an installer myself, I use
!finalize 'mysignscript myinstaller.exe'
!uninstfinalize 'mysignscript myuninstaller.exe'
inside the nsi script file.
I do not know, whether this would be feasible with how we use jsign and
the cloud signing service, but it should be doable. I haven't understood
though, how the detached signatures are used. I don't seem to use
detached signatures when doing my installer.
Without code signing (do.codesigning=false), the following changes at
least run on Linux without wine and produce an installer. But I still
have to check, whether the intsaller actually works:
--- build.xml.kpdt_orig 2025-02-04 18:40:20.000000000 +0100
+++ build.xml 2025-02-07 22:12:14.418108524 +0100
@@ -2565,6 +2565,7 @@
<or>
<os family="windows" />
<available file="wine" filepath="${env.PATH}" />
+ <available file="makensis" filepath="${env.PATH}" />
<isset property="skip.installer"/>
</or>
</condition>
@@ -2618,11 +2619,10 @@
<arg value="/V2" />
<arg value="tomcat.nsi" />
</exec>
- <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
- <arg value="${nsis.exe}" />
- <arg value="/DUNINSTALLONLY" />
- <arg value="/DNSISDIR=${nsis.home}" />
- <arg value="/V2" />
+ <exec dir="${tomcat.dist}" executable="makensis" osfamily="unix">
+ <arg value="-DUNINSTALLONLY" />
+ <arg value="-DNSISDIR=${nsis.home}" />
+ <arg value="-V2" />
<arg value="tomcat.nsi" />
</exec>
</target>
@@ -2632,9 +2632,11 @@
<!-- Execute the temporary installer to create the uninstaller -->
<exec dir="${tomcat.dist}"
executable="${tomcat.dist}/tempinstaller.exe"
osfamily="windows" />
+ <!--
<exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
<arg value="${tomcat.dist}/tempinstaller.exe" />
</exec>
+ -->
<!-- Reproducible builds: consistent timestamps for installer
files -->
<touch datetime="${tstamp.file}" pattern="yyyy-MM-dd HH:mm:ss">
<fileset dir="${tomcat.dist}"/>
@@ -2671,10 +2673,9 @@
<arg value="/V2" />
<arg value="tomcat.nsi" />
</exec>
- <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
- <arg value="${nsis.exe}" />
- <arg value="/DNSISDIR=${nsis.home}" />
- <arg value="/V2" />
+ <exec dir="${tomcat.dist}" executable="makensis" osfamily="unix">
+ <arg value="-DNSISDIR=${nsis.home}" />
+ <arg value="-V2" />
<arg value="tomcat.nsi" />
</exec>
<move file="${tomcat.dist}/tomcat-installer.exe"
tofile="${tomcat.release}/v${version}/bin/${final.name}.exe" />
BUT: IMHO without using the official signing service, the installer will
never be reproduced by me. So even if I make some sort of code-signing
work, building the installer would just show, that the file is produced.
Plus, if I am willing to try it on Windows, whether it looks OK.
> The other wine calls used to execure makensis.exe can be replaced by
> directly calling makensis on Linux using -X flags instead of /X flags.
>
> > Also, which artifacts are not byte-for-byte identical when >
> performing the build verification -- when LANG=de? All of them, or only
>> some of them?
>
> Just the fulldocs tarball. The HTML pages contains german text instead
> of the english one. We tried fixing it using java means (sysprops,
> flags) to no avail.
>
>>> Tested on platforms
>>>
>>> - RHEL 6, 7, 8 and 9, SLES 11, 12 and 15, Solaris 11 Sparc
>>>
>>> using
>>>
>>> - current patch versions of JDK 11, 17 and not yet done 21, 23 and
>>> 24+25 (current EAs)
>>>
>>> from
>>>
>>> - Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
>>> OpenJDK (for the EA)
>>>
>>> where available.
>>>
>>> Also tested with
>>>
>>> - tcnative 1.3.1, tcnative 2.0.8 and panama
>>>
>>> based on
>>>
>>> - OpenSSL 3.0.15, 3.1.7, 3.2.3, 3.3.2 and 3.4.0.
>>>
>>> All fine, except for the usual sporadic crashes with tcnative during
>>> shutdown. Also manually changed the max memory size for the unit
>>> tests from 256m to 512m (already fixed in git).
>>>
>>> Thanks for RM!
>> ;)
>>
>> -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE][OT] Release Apache Tomcat 10.1.35
Posted by Rainer Jung <ra...@kippdata.de>.
Hi Chris,
Am 07.02.25 um 20:44 schrieb Christopher Schultz:
> Rainer,
>
> On 2/7/25 2:38 PM, Rainer Jung wrote:
>> Am 04.02.25 um 23:10 schrieb Christopher Schultz:
>>> The proposed Apache Tomcat 10.1.35 release is now available for
>>> voting.
>>>
>>> All committers and PMC members are kindly requested to provide a vote
>>> if possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes
>>> are binding. We welcome non-committer votes or comments on release
>>> builds.
>>>
>>> The notable changes compared to 10.1.34 are:
>>>
>>> - Allow readOnly attribute configuration on the Resources element and
>>> allow configuration of the readOnly attribute value of the main
>>> resources. The attribute value will also be used by the default and
>>> WebDAV Servlets.
>>>
>>> - Correct a regression in the fix for bug 69382 that broke JSP
>>> include actions if both the page attribute and the body contained
>>> parameters. Pull request #803 provided by Chenjp.
>>>
>>> - Expand the options for handling encoded '/' and '\' characters in
>>> URLs both in the Connector and when using a RequestDispatcher.
>>>
>>> For full details, see the change log:
>>> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>>>
>>> Applications that run on Tomcat 9 and earlier will not run on Tomcat
>>> 10 without changes. Java EE applications designed for Tomcat 9 and
>>> earlier may be placed in the $CATALINA_BASE/webapps-javaee directory
>>> and Tomcat will automatically convert them to Jakarta EE and copy
>>> them to the webapps directory.
>>>
>>> It can be obtained from:
>>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>>>
>>> The Maven staging repo is:
>>> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>>>
>>> The tag is:
>>> https://github.com/apache/tomcat/tree/10.1.35
>>> https://github.com/apache/tomcat/
>>> commit/9636e5188311f30c1e46c94191d2145998778bf4
>>>
>>> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>>
>> +1
>>
>> Reproducibility of the build checked (except for Windows installer and
>> signing) on Linux Mint 22.1. OK after setting LANG.
>
> I'd still like to look-in on this. For the installer, are you willing to
> install Wine?
I could but I'm not so eager putting wine on my laptop.
Interestingly I use NSIS to build windows installers completely on
Linux. That is one of the nice features of NSIS. Currently the only
reason I see, why wine is really used, is the tempinstaller.exe which is
created and then executed to create the uninstaller. When I use NSIS, it
can create the uninstaller directly, but I have not yet investigated why
we need this indirection.
The other wine calls used to execure makensis.exe can be replaced by
directly calling makensis on Linux using -X flags instead of /X flags.
> Also, which artifacts are not byte-for-byte identical when >
performing the build verification -- when LANG=de? All of them, or only
> some of them?
Just the fulldocs tarball. The HTML pages contains german text instead
of the english one. We tried fixing it using java means (sysprops,
flags) to no avail.
>> Tested on platforms
>>
>> - RHEL 6, 7, 8 and 9, SLES 11, 12 and 15, Solaris 11 Sparc
>>
>> using
>>
>> - current patch versions of JDK 11, 17 and not yet done 21, 23 and
>> 24+25 (current EAs)
>>
>> from
>>
>> - Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
>> OpenJDK (for the EA)
>>
>> where available.
>>
>> Also tested with
>>
>> - tcnative 1.3.1, tcnative 2.0.8 and panama
>>
>> based on
>>
>> - OpenSSL 3.0.15, 3.1.7, 3.2.3, 3.3.2 and 3.4.0.
>>
>> All fine, except for the usual sporadic crashes with tcnative during
>> shutdown. Also manually changed the max memory size for the unit tests
>> from 256m to 512m (already fixed in git).
>>
>> Thanks for RM!
> ;)
>
> -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE][OT] Release Apache Tomcat 10.1.35
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Rainer,
On 2/7/25 2:38 PM, Rainer Jung wrote:
> Am 04.02.25 um 23:10 schrieb Christopher Schultz:
>> The proposed Apache Tomcat 10.1.35 release is now available for
>> voting.
>>
>> All committers and PMC members are kindly requested to provide a vote
>> if possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes
>> are binding. We welcome non-committer votes or comments on release
>> builds.
>>
>> The notable changes compared to 10.1.34 are:
>>
>> - Allow readOnly attribute configuration on the Resources element and
>> allow configuration of the readOnly attribute value of the main
>> resources. The attribute value will also be used by the default and
>> WebDAV Servlets.
>>
>> - Correct a regression in the fix for bug 69382 that broke JSP
>> include actions if both the page attribute and the body contained
>> parameters. Pull request #803 provided by Chenjp.
>>
>> - Expand the options for handling encoded '/' and '\' characters in
>> URLs both in the Connector and when using a RequestDispatcher.
>>
>> For full details, see the change log:
>> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>>
>> Applications that run on Tomcat 9 and earlier will not run on Tomcat
>> 10 without changes. Java EE applications designed for Tomcat 9 and
>> earlier may be placed in the $CATALINA_BASE/webapps-javaee directory
>> and Tomcat will automatically convert them to Jakarta EE and copy them
>> to the webapps directory.
>>
>> It can be obtained from:
>> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>>
>> The Maven staging repo is:
>> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>>
>> The tag is:
>> https://github.com/apache/tomcat/tree/10.1.35
>> https://github.com/apache/tomcat/
>> commit/9636e5188311f30c1e46c94191d2145998778bf4
>>
>> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>
> +1
>
> Reproducibility of the build checked (except for Windows installer and
> signing) on Linux Mint 22.1. OK after setting LANG.
I'd still like to look-in on this. For the installer, are you willing to
install Wine? Also, which artifacts are not byte-for-byte identical when
performing the build verification -- when LANG=de? All of them, or only
some of them?
> Tested on platforms
>
> - RHEL 6, 7, 8 and 9, SLES 11, 12 and 15, Solaris 11 Sparc
>
> using
>
> - current patch versions of JDK 11, 17 and not yet done 21, 23 and 24+25
> (current EAs)
>
> from
>
> - Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
> OpenJDK (for the EA)
>
> where available.
>
> Also tested with
>
> - tcnative 1.3.1, tcnative 2.0.8 and panama
>
> based on
>
> - OpenSSL 3.0.15, 3.1.7, 3.2.3, 3.3.2 and 3.4.0.
>
> All fine, except for the usual sporadic crashes with tcnative during
> shutdown. Also manually changed the max memory size for the unit tests
> from 256m to 512m (already fixed in git).
>
> Thanks for RM!
;)
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 10.1.35
Posted by Rainer Jung <ra...@kippdata.de>.
Am 04.02.25 um 23:10 schrieb Christopher Schultz:
> The proposed Apache Tomcat 10.1.35 release is now available for
> voting.
>
> All committers and PMC members are kindly requested to provide a vote if
> possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
> binding. We welcome non-committer votes or comments on release builds.
>
> The notable changes compared to 10.1.34 are:
>
> - Allow readOnly attribute configuration on the Resources element and
> allow configuration of the readOnly attribute value of the main
> resources. The attribute value will also be used by the default and
> WebDAV Servlets.
>
> - Correct a regression in the fix for bug 69382 that broke JSP
> include actions if both the page attribute and the body contained
> parameters. Pull request #803 provided by Chenjp.
>
> - Expand the options for handling encoded '/' and '\' characters in
> URLs both in the Connector and when using a RequestDispatcher.
>
> For full details, see the change log:
> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>
> Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
> without changes. Java EE applications designed for Tomcat 9 and earlier
> may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
> will automatically convert them to Jakarta EE and copy them to the
> webapps directory.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>
> The tag is:
> https://github.com/apache/tomcat/tree/10.1.35
> https://github.com/apache/tomcat/
> commit/9636e5188311f30c1e46c94191d2145998778bf4
>
> Please reply with a +1 for release or +0/-0/-1 with an explanation.
+1
Reproducibility of the build checked (except for Windows installer and
signing) on Linux Mint 22.1. OK after setting LANG.
Tested on platforms
- RHEL 6, 7, 8 and 9, SLES 11, 12 and 15, Solaris 11 Sparc
using
- current patch versions of JDK 11, 17 and not yet done 21, 23 and 24+25
(current EAs)
from
- Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and
OpenJDK (for the EA)
where available.
Also tested with
- tcnative 1.3.1, tcnative 2.0.8 and panama
based on
- OpenSSL 3.0.15, 3.1.7, 3.2.3, 3.3.2 and 3.4.0.
All fine, except for the usual sporadic crashes with tcnative during
shutdown. Also manually changed the max memory size for the unit tests
from 256m to 512m (already fixed in git).
Thanks for RM!
Best regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 10.1.35
Posted by Dimitris Soumis <ds...@apache.org>.
+1 Build is reproducible and all tests pass on Fedora 41 with Java 21,
tcnative-2.0.8, apr-1.7.4, openssl-3.0.14.
On Wed, Feb 5, 2025 at 3:54 PM Rémy Maucherat <re...@apache.org> wrote:
> On Tue, Feb 4, 2025 at 11:10 PM Christopher Schultz
> <ch...@christopherschultz.net> wrote:
> >
> > The proposed Apache Tomcat 10.1.35 release is now available for
> > voting.
> >
> > All committers and PMC members are kindly requested to provide a vote if
> > possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
> > binding. We welcome non-committer votes or comments on release builds.
> >
> > The notable changes compared to 10.1.34 are:
> >
> > - Allow readOnly attribute configuration on the Resources element and
> > allow configuration of the readOnly attribute value of the main
> > resources. The attribute value will also be used by the default and
> > WebDAV Servlets.
> >
> > - Correct a regression in the fix for bug 69382 that broke JSP
> > include actions if both the page attribute and the body contained
> > parameters. Pull request #803 provided by Chenjp.
> >
> > - Expand the options for handling encoded '/' and '\' characters in
> > URLs both in the Connector and when using a RequestDispatcher.
> >
> > For full details, see the change log:
> > https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
> >
> > Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
> > without changes. Java EE applications designed for Tomcat 9 and earlier
> > may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
> > will automatically convert them to Jakarta EE and copy them to the
> > webapps directory.
> >
> > It can be obtained from:
> > https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
> >
> > The Maven staging repo is:
> > https://repository.apache.org/content/repositories/orgapachetomcat-1530
> >
> > The tag is:
> > https://github.com/apache/tomcat/tree/10.1.35
> >
> https://github.com/apache/tomcat/commit/9636e5188311f30c1e46c94191d2145998778bf4
> >
> > Please reply with a +1 for release or +0/-0/-1 with an explanation.
>
> +1
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
Re: [VOTE] Release Apache Tomcat 10.1.35
Posted by Rémy Maucherat <re...@apache.org>.
On Tue, Feb 4, 2025 at 11:10 PM Christopher Schultz
<ch...@christopherschultz.net> wrote:
>
> The proposed Apache Tomcat 10.1.35 release is now available for
> voting.
>
> All committers and PMC members are kindly requested to provide a vote if
> possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
> binding. We welcome non-committer votes or comments on release builds.
>
> The notable changes compared to 10.1.34 are:
>
> - Allow readOnly attribute configuration on the Resources element and
> allow configuration of the readOnly attribute value of the main
> resources. The attribute value will also be used by the default and
> WebDAV Servlets.
>
> - Correct a regression in the fix for bug 69382 that broke JSP
> include actions if both the page attribute and the body contained
> parameters. Pull request #803 provided by Chenjp.
>
> - Expand the options for handling encoded '/' and '\' characters in
> URLs both in the Connector and when using a RequestDispatcher.
>
> For full details, see the change log:
> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>
> Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
> without changes. Java EE applications designed for Tomcat 9 and earlier
> may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
> will automatically convert them to Jakarta EE and copy them to the
> webapps directory.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>
> The tag is:
> https://github.com/apache/tomcat/tree/10.1.35
> https://github.com/apache/tomcat/commit/9636e5188311f30c1e46c94191d2145998778bf4
>
> Please reply with a +1 for release or +0/-0/-1 with an explanation.
+1
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[VOTE][RESULT] Release Apache Tomcat 10.1.35
Posted by Christopher Schultz <ch...@christopherschultz.net>.
All,
The following votes were cast:
Binding:
+1: isapir, markt, remm, schultz, rjung
Non-binding:
+1: dsoumis
There were no other votes, therefore the vote passes.
Thanks to everyone who contributed towards this release.
-chris
On 2/4/25 5:10 PM, Christopher Schultz wrote:
> The proposed Apache Tomcat 10.1.35 release is now available for
> voting.
>
> All committers and PMC members are kindly requested to provide a vote if
> possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
> binding. We welcome non-committer votes or comments on release builds.
>
> The notable changes compared to 10.1.34 are:
>
> - Allow readOnly attribute configuration on the Resources element and
> allow configuration of the readOnly attribute value of the main
> resources. The attribute value will also be used by the default and
> WebDAV Servlets.
>
> - Correct a regression in the fix for bug 69382 that broke JSP
> include actions if both the page attribute and the body contained
> parameters. Pull request #803 provided by Chenjp.
>
> - Expand the options for handling encoded '/' and '\' characters in
> URLs both in the Connector and when using a RequestDispatcher.
>
> For full details, see the change log:
> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>
> Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
> without changes. Java EE applications designed for Tomcat 9 and earlier
> may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
> will automatically convert them to Jakarta EE and copy them to the
> webapps directory.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>
> The tag is:
> https://github.com/apache/tomcat/tree/10.1.35
> https://github.com/apache/tomcat/
> commit/9636e5188311f30c1e46c94191d2145998778bf4
>
> Please reply with a +1 for release or +0/-0/-1 with an explanation.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 10.1.35
Posted by Christopher Schultz <ch...@christopherschultz.net>.
All,
On 2/4/25 5:10 PM, Christopher Schultz wrote:
> The proposed Apache Tomcat 10.1.35 release is now available for
> voting.
>
> All committers and PMC members are kindly requested to provide a vote if
> possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
> binding. We welcome non-committer votes or comments on release builds.
>
> The notable changes compared to 10.1.34 are:
>
> - Allow readOnly attribute configuration on the Resources element and
> allow configuration of the readOnly attribute value of the main
> resources. The attribute value will also be used by the default and
> WebDAV Servlets.
>
> - Correct a regression in the fix for bug 69382 that broke JSP
> include actions if both the page attribute and the body contained
> parameters. Pull request #803 provided by Chenjp.
>
> - Expand the options for handling encoded '/' and '\' characters in
> URLs both in the Connector and when using a RequestDispatcher.
>
> For full details, see the change log:
> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>
> Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
> without changes. Java EE applications designed for Tomcat 9 and earlier
> may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
> will automatically convert them to Jakarta EE and copy them to the
> webapps directory.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>
> The tag is:
> https://github.com/apache/tomcat/tree/10.1.35
> https://github.com/apache/tomcat/
> commit/9636e5188311f30c1e46c94191d2145998778bf4
>
> Please reply with a +1 for release or +0/-0/-1 with an explanation.
+1 for stable release
Build is 100% reproducible (LOL) on MacOS aarch64 and all the unit tests
pass.
I had to run the unit tests 3 times to get them to all pass. Once I had
a variety of random tests fail. I think my computer may have gone to
sleep during that time period, though. The second time was a JVM error
with zero explanation at all. The third time, all tests ran cleanly.
Details:
* Environment
* Java (build): openjdk version "23.0.2" 2025-01-21 OpenJDK Runtime
Environment Temurin-23.0.2+7 (build 23.0.2+7) OpenJDK 64-Bit Server VM
Temurin-23.0.2+7 (build 23.0.2+7, mixed mode, sharing)
* Java (test): openjdk version "23.0.2" 2025-01-21 OpenJDK Runtime
Environment Temurin-23.0.2+7 (build 23.0.2+7) OpenJDK 64-Bit Server VM
Temurin-23.0.2+7 (build 23.0.2+7, mixed mode, sharing)
* Ant: Apache Ant(TM) version 1.10.15 compiled on August 25
2024
* OS: Darwin 24.1.0 arm64
* cc: Apple clang version 16.0.0 (clang-1600.0.26.4)
* make: GNU Make 3.81
* OpenSSL: OpenSSL 3.4.0 22 Oct 2024 (Library: OpenSSL 3.4.0 22
Oct 2024)
* APR: 1.7.5
*
* Valid SHA-512 signature for apache-tomcat-10.1.35.zip
* Valid GPG signature for apache-tomcat-10.1.35.zip
* Valid SHA-512 signature for apache-tomcat-10.1.35.tar.gz
* Valid GPG signature for apache-tomcat-10.1.35.tar.gz
* Valid SHA-512 signature for apache-tomcat-10.1.35.exe
* Valid GPG signature for apache-tomcat-10.1.35.exe
* Valid SHA512 signature for apache-tomcat-10.1.35-src.zip
* Valid GPG signature for apache-tomcat-10.1.35-src.zip
* Valid SHA512 signature for apache-tomcat-10.1.35-src.tar.gz
* Valid GPG signature for apache-tomcat-10.1.35-src.tar.gz
*
* Binary Zip and tarball: Same
* Source Zip and tarball: Same
*
* Building dependencies returned: 0
* Tomcat builds cleanly
* tcnative builds cleanly
* Junit Tests: FAILED
*
* Tests that failed:
* org.apache.catalina.valves.TestStuckThreadDetectionValve.NIO.txt
* org.apache.coyote.TestIoTimeouts.NIO.txt
* org.apache.coyote.http11.TestHttp11InputBuffer.NIO.txt
* org.apache.coyote.http11.TestHttp11Processor.NIO.txt
* org.apache.coyote.http11.filters.TestChunkedInputFilter.NIO.txt
* org.apache.coyote.http2.TestAsyncReadListener.NIO.txt
* org.apache.coyote.http2.TestHttp2Limits.NIO.txt
* org.apache.tomcat.websocket.TestWsWebSocketContainerTimeoutClient.NIO.txt
* org.apache.tomcat.websocket.TestWsWebSocketContainerTimeoutServer.NIO.txt
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 10.1.35
Posted by Igal Sapir <is...@apache.org>.
On Tue, Feb 4, 2025 at 2:11 PM Christopher Schultz <
chris@christopherschultz.net> wrote:
> The proposed Apache Tomcat 10.1.35 release is now available for
> voting.
>
> All committers and PMC members are kindly requested to provide a vote if
> possible. ANY TOMCAT USER MAY VOTE, though only PMC members votes are
> binding. We welcome non-committer votes or comments on release builds.
>
> The notable changes compared to 10.1.34 are:
>
> - Allow readOnly attribute configuration on the Resources element and
> allow configuration of the readOnly attribute value of the main
> resources. The attribute value will also be used by the default and
> WebDAV Servlets.
>
> - Correct a regression in the fix for bug 69382 that broke JSP
> include actions if both the page attribute and the body contained
> parameters. Pull request #803 provided by Chenjp.
>
> - Expand the options for handling encoded '/' and '\' characters in
> URLs both in the Connector and when using a RequestDispatcher.
>
> For full details, see the change log:
> https://nightlies.apache.org/tomcat/tomcat-10.1.x/docs/changelog.html
>
> Applications that run on Tomcat 9 and earlier will not run on Tomcat 10
> without changes. Java EE applications designed for Tomcat 9 and earlier
> may be placed in the $CATALINA_BASE/webapps-javaee directory and Tomcat
> will automatically convert them to Jakarta EE and copy them to the
> webapps directory.
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-10/v10.1.35/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1530
>
> The tag is:
> https://github.com/apache/tomcat/tree/10.1.35
>
> https://github.com/apache/tomcat/commit/9636e5188311f30c1e46c94191d2145998778bf4
>
> Please reply with a +1 for release or +0/-0/-1 with an explanation.
>
+1
Build is reproducible and unit tests pass on Ubuntu 22 with Java 21
Igal
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>