RE: Upgrading to 5.5.25 web-app_2_3.dtd not found--thanks to all

[George Payne <gp...@virginia.edu>]

Just wanted to say thanks very much for all the very helpful replies on
this.

I now have several avenues to pursue and I assume now that the problem was
my upgrade method, and not a bug in 5.5.25.

There is a general issue this brings up--not really a question anymore, just
a point to ponder (for anyone who just likes pondering :)), which is what
the best way to do security upgrades on tomcat on linux is.

The problem is, for the security conscious, how to practically keep up with
minor revisions of tomcat which may contain security enhancements we
shouldn't really be operating without.

This could be cast as a "laziness" problem, but really, for busy admins,
doing manual point upgrades for lots of apps on lots of machines can be a
very time-consuming task.  I think most of us maintain sanity by skipping a
lot of them, which is not the safest route.  Some distros are starting to
have workable update schemes (EL5 has a good but complex system, though it's
been a bit buggy for me), but this is at the distro level.  I suspect there
are general-purpose things already out there--scripts, etc?



-----Original Message-----
From: Konstantin Kolinko [mailto:knst.kolinko@gmail.com] 
Sent: Friday, February 01, 2008 9:11 AM
To: Tomcat Users List
Subject: Re: Upgrading to 5.5.25 causes File
/javax/servlet/resources/web-app_2_3.dtd not found

The file /javax/servlet/resources/web-app_2_3.dtd is in
servlet-api.jar in common/lib, both in 5.5.25 and 5.5.20.

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: Upgrading to 5.5.25 web-app_2_3.dtd not found--thanks to all

[David Smith <dn...@cornell.edu>]

Your method of jar replacement would have worked better if you were 
doing a point upgrade paying attention to the third number, keeping the 
first two the same.  For example, upgrading from 5.5.16 to 5.5.25 is a 
reasonably safe upgrade without significant breaking changes.  At worst, 
such an upgrade may fix an error your webapp was depending on and then 
the webapp breaks -- it's happened before. :-) 

5.0.x to 5.5.25 is a bit more significant with a lot of internal 
refactoring and some breaking changes in how context .xml files and 
resource definitions are handled.  Think of the 5.0.x to 5.5.x migration 
in the same manner you'd think of a 5.x.x upgrade to 6.x.x.

--David

George Payne wrote:

>Just wanted to say thanks very much for all the very helpful replies on
>this.
>
>I now have several avenues to pursue and I assume now that the problem was
>my upgrade method, and not a bug in 5.5.25.
>
>There is a general issue this brings up--not really a question anymore, just
>a point to ponder (for anyone who just likes pondering :)), which is what
>the best way to do security upgrades on tomcat on linux is.
>
>The problem is, for the security conscious, how to practically keep up with
>minor revisions of tomcat which may contain security enhancements we
>shouldn't really be operating without.
>
>This could be cast as a "laziness" problem, but really, for busy admins,
>doing manual point upgrades for lots of apps on lots of machines can be a
>very time-consuming task.  I think most of us maintain sanity by skipping a
>lot of them, which is not the safest route.  Some distros are starting to
>have workable update schemes (EL5 has a good but complex system, though it's
>been a bit buggy for me), but this is at the distro level.  I suspect there
>are general-purpose things already out there--scripts, etc?
>
>
>
>-----Original Message-----
>From: Konstantin Kolinko [mailto:knst.kolinko@gmail.com] 
>Sent: Friday, February 01, 2008 9:11 AM
>To: Tomcat Users List
>Subject: Re: Upgrading to 5.5.25 causes File
>/javax/servlet/resources/web-app_2_3.dtd not found
>
>The file /javax/servlet/resources/web-app_2_3.dtd is in
>servlet-api.jar in common/lib, both in 5.5.25 and 5.5.20.
>
>---------------------------------------------------------------------
>To start a new topic, e-mail: users@tomcat.apache.org
>To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>---------------------------------------------------------------------
>To start a new topic, e-mail: users@tomcat.apache.org
>To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>For additional commands, e-mail: users-help@tomcat.apache.org
>
>  
>


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org