You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tomee.apache.org by ju...@apache.org on 2026/07/19 12:25:50 UTC
(tomee-tck) branch ee11 updated (e855d83 -> f2a4dab)
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a change to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
from e855d83 Declare the invoker verification inside the existing exec plugin blocks
new a9e24b9 Set the EL variable.mapper porting property and clear the webprofile exclusions
new b8edfbe Run the Faces old-tck-selenium modules in the faces TCK suite
new 13b26ab Add a security-old runner for the Jakarta Security legacy JavaTest TCK
new 848420b Document the security-old baseline and its one product-gap exclusion
new 512aa8c Merge branch 'ee11' into claude/tck-module-setup-check-0c52f9
new b48237f Wire security-old into CI and document the faces browser constraint
new f2a4dab Run the faces TCK suite in CI inside a Chrome-bundling container
The 7 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
Jenkinsfile | 81 ++++++-
KNOWN_ISSUES.md | 73 +++---
environment/tck/ts.jte | 6 +
runner-standalone/README.md | 12 +-
runner-standalone/exclusions/README.md | 6 +-
runner-standalone/exclusions/faces.txt | 15 +-
runner-standalone/exclusions/security-old.txt | 18 ++
runner-standalone/faces/pom.xml | 25 +-
runner-standalone/pom.xml | 1 +
runner-standalone/run-standalone-suite.sh | 6 +-
.../{faces-old => security-old}/pom.xml | 267 +++++++++++++++------
.../security-old/src/test/resources/tomee.xml | 15 ++
runner-standalone/verify-invoker-result.sh | 26 +-
runner-webprofile/KNOWN_FAILURES.md | 1 -
.../exclusions/expression-language.txt | 25 +-
runner-webprofile/platform-suite.tsv | 2 +-
runner-webprofile/run/pom.xml | 6 +
17 files changed, 423 insertions(+), 162 deletions(-)
create mode 100644 runner-standalone/exclusions/security-old.txt
copy runner-standalone/{faces-old => security-old}/pom.xml (57%)
create mode 100644 runner-standalone/security-old/src/test/resources/tomee.xml
(tomee-tck) 04/07: Document the security-old baseline and its one product-gap exclusion
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit 848420b6610444fa5dc22dfb38e7697a6e90d8cf
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 10:53:10 2026 +0200
Document the security-old baseline and its one product-gap exclusion
---
KNOWN_ISSUES.md | 37 +++++++++++++++++++--------
runner-standalone/README.md | 10 +++++---
runner-standalone/exclusions/README.md | 6 ++---
runner-standalone/exclusions/security-old.txt | 18 +++++++++++++
4 files changed, 53 insertions(+), 18 deletions(-)
diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md
index f0e2d51..2f120fe 100644
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@ -38,6 +38,7 @@ Detail lives next to each runner:
| jsonb | 295 tests, 1 F + 1 E | 2 tests | 2 Johnzon 2.1.0 gaps |
| debugging | passes (4 SMAPs validated) | — | — |
| security | 132 tests, 5 F + 2 E; signature test passes | 7 tests | TomEE Jakarta Security |
+| security-old (JavaTest) | 83 tests, 82 pass, 1 F | 1 test | TomEE `SecurityContext.hasAccessToWebResource()` returns false for an authorized caller |
| authentication | 106 tests, 1 F; signature test passes | 1 method (spi `CheckMsgInfoKey`) | TCK challenge #219 (hard-codes a JACC requirement) |
| websocket | 737 tests, 3 E | 3 methods | Client container advertises permessage-deflate in the negotiated extension lists |
| faces (modern modules) | 327 tests, 45 F + 6 E (failsafe reruns inflate the counts; 10 distinct failing classes) | 10 classes | 1 TomEE faces-config gap + Mojarra/TomEE CDI-injection, whole-bean/method validation, and one Chrome ajax quirk |
@@ -114,20 +115,30 @@ Fixes belong in Apache TomEE (or Tomcat); each removes exclusion entries.
5. **Jakarta Security** — the BASIC mechanism answers 401 for valid
credentials in the decorated/custom-handler variants, and both OpenID
default modules fail token validation.
- [security.txt](runner-standalone/exclusions/security.txt). The runner drives
- the reactor's modern Arquillian app modules plus the signature test; the
- reactor's `old-tck` module (~68 legacy JavaTest tests) is not wired into
- the runner, so the recorded totals cover the modern suite only.
-6. **Persistence integration** — undeploy calls `close()` on an
+ [security.txt](runner-standalone/exclusions/security.txt). The `security`
+ runner drives the reactor's modern Arquillian app modules plus the signature
+ test; the reactor's `old-tck` module (legacy JavaTest suite,
+ `com.sun.ts.tests.securityapi`) is run by the separate `security-old` runner.
+6. **Jakarta Security `SecurityContext.hasAccessToWebResource()`** — the
+ programmatic access check returns `false` for a caller that is authorized
+ for the resource. The old-tck `securitycontext/callerdata` servlet reports
+ the correct caller and role membership, but `hasAccessToWebResource(
+ "/protectedServlet", "GET")` answers `false` where the spec requires `true`
+ for user `tom` (Manager role) against the `@HttpMethodConstraint("GET")`
+ resource; TomEE's `SecurityContext` is not wired to the servlet
+ authorization/`Policy` layer for this call. Excluded in
+ [security-old.txt](runner-standalone/exclusions/security-old.txt)
+ (`securitycontext/callerdata/Client.java#testSecurityContextHasAccessToWebResource`).
+7. **Persistence integration** — undeploy calls `close()` on an
already-closed `EntityManagerFactory` (fails the
`entityManagerFactoryCloseExceptions` vehicles), and the Jakarta
Persistence 3.2 CDI qualifier beans (`EntityManagerFactory`/
`EntityManager` etc. from `persistence.xml`) are not registered
(`ServletEMLookupTest`). Affects Plume and webprofile alike.
-7. **Jakarta Tags TLD registration** — the `jakarta.tags.*` URIs of the
+8. **Jakarta Tags TLD registration** — the `jakarta.tags.*` URIs of the
replacement Jakarta Tags 3.0 jar are not exposed to applications; all 50
Tags classes plus the EJB-Lite JSP vehicles fail as collateral.
-8. **Transactions — cross-request `UserTransaction` state leakage across
+9. **Transactions — cross-request `UserTransaction` state leakage across
pooled servlet requests.** A `UserTransaction` a servlet/jsp request leaves
in a non-clean state poisons the next request served on the same pooled
Tomcat exec thread; the victim sees an `IllegalStateException` that is not
@@ -148,14 +159,14 @@ Fixes belong in Apache TomEE (or Tomcat); each removes exclusion entries.
[transactions.txt](runner-standalone/exclusions/transactions.txt). The
Platform catalog additionally shows CDI `@Transactional` interceptors
failing propagation, rollback-rule, and `TransactionScoped` assertions.
-9. **Enterprise Beans** — timer callbacks expose incomplete/not-retried
+10. **Enterprise Beans** — timer callbacks expose incomplete/not-retried
transactions, `java:comp` is mutable where the spec requires
`OperationNotSupportedException`, and failed CDI/EJB deployments leak
deployment IDs (`DuplicateDeploymentIdException` in later apps).
-10. **webprofile ZIP signature leak** — the combined `jakartaee-api` jar
+11. **webprofile ZIP signature leak** — the combined `jakartaee-api` jar
exposes Jakarta Batch and Messaging packages although `javaee.level=web`
does not declare them; strip them or declare and certify them.
-11. **WebSocket 2.2 extension advertising (Tomcat)** — the server-side
+12. **WebSocket 2.2 extension advertising (Tomcat)** — the server-side
configurator reports the extensions the client requested and negotiated.
TomEE's client-side WebSocket container (Tomcat's `tomcat-websocket`)
always advertises its built-in `permessage-deflate` extension in the
@@ -168,7 +179,7 @@ Fixes belong in Apache TomEE (or Tomcat); each removes exclusion entries.
and pass: the runner's Arquillian extension tolerates the deployment
failure so each client probe still runs.
[websocket.txt](runner-standalone/exclusions/websocket.txt).
-12. **Bean Validation XML config broken on stock Plume** — the Plume
+13. **Bean Validation XML config broken on stock Plume** — the Plume
distribution ships EclipseLink MOXy (`eclipselink-5.0.1.jar`) and the JAXB
RI (`jaxb-runtime-4.0.4.jar`) side by side. EclipseLink registers a
`jakarta.xml.bind.JAXBContextFactory` service and wins ServiceLoader
@@ -256,6 +267,10 @@ Not product bugs — gaps in this repository's coverage.
ships an `old-tck-selenium` module (22 tests) that neither the `faces`
runner (which drives faces22/23/40/41 + faces-signaturetest) nor the
`faces-old` JavaTest runner executes; wire it into one of them.
+- **Security `security-old` not in CI**: the `security-old` runner (the
+ reactor's legacy JavaTest `com.sun.ts.tests.securityapi` suite) runs
+ locally via `run-standalone-suite.sh` and is green with the reviewed
+ exclusion; it joins the Jenkins branch list once its baseline has settled.
## What CI runs
diff --git a/runner-standalone/README.md b/runner-standalone/README.md
index 79f7fd7..243b163 100644
--- a/runner-standalone/README.md
+++ b/runner-standalone/README.md
@@ -13,10 +13,11 @@ runner-standalone/run-standalone-suite.sh concurrency
The Derby port is overridable everywhere through `-Dtck.derby.port`; the
`concurrency`, `data`, `servlet`, `pages`, `rest`, `websocket`,
-`transactions`, and `faces-old` runners additionally accept
+`transactions`, `faces-old`, and `security-old` runners additionally accept
`-Dtomee.http.port`, `-Dtomee.https.port`, and `-Dtomee.shutdown.port`
-(`transactions` and `faces-old` also `-Dtck.harness.log.port` for their
-JavaTest listeners), so they can run next to another harness instance. The
+(`transactions`, `faces-old`, and `security-old` also `-Dtck.harness.log.port`
+for their JavaTest listeners), so they can run next to another harness
+instance. The
`validation`, `cdi`, and `cdi-ee` runners parameterize only the HTTP and
shutdown ports (`-Dtomee.http.port`/`-Dtomee.shutdown.port`); their
arquillian.xml pins no `httpsPort`. The source-reactor runners security,
@@ -59,7 +60,8 @@ derived from; with the default exclusions applied these suites run green.
| Pages 4.0 | EFTL zip (installed as `jakarta.tck:jakarta-pages-tck:4.0.0`) | `pages` | **Passes 682/682 (0 failures, 0 errors, signature test included, no exclusions)** (2026-07-18). Needs the Central `jakarta.tck:common`/`signaturetest` support line at 11.1.1 with sigtest 2.6 (the TCK pom's own pins depend on the unpublished JavaTest harness), and the overlay removes TomEE's global UTF-8 default encodings from conf/web.xml because the TCK asserts the spec default ISO-8859-1. Its TomEE/ [...]
| Validation 3.1 | EFTL zip (installed as `jakarta.validation:validation-tck-tests:3.1.1`) | `validation` | **Runs: 1,049 tests, 0 failures, no exclusions; the mandatory API signature test runs and passes** against the `jakarta.validation` packages the Plume distribution ships. Needs AssertJ 3.7.0 pinned (the published TCK jar is compiled against its covariant signatures) and the JAXB RI pinned as `jakarta.xml.bind.JAXBContextFactory` in the server JVM (Plume ships both MOXy and the RI; [...]
| WebSocket 2.2 | EFTL zip (installed as `jakarta.tck:websocket-tck-spec-tests:2.2.0`) | `websocket` | **Runs: 737 tests, 0 failures, 3 errors** (2026-07-18) against Tomcat's WebSocket implementation, driven through the `tomcat-websocket` client container; the signature test passes. The negative-deployment classes run and pass: an invalid server endpoint aborts the whole webapp deployment as the spec requires, and the runner's Arquillian extension (`NegativeDeploymentToleranceObserver`) [...]
-| Security 4.0 | Source reactor zip 4.0.1 | `security` (Maven module) | **Runs: 26 app modules plus the signature test, 132 tests, 5 failures, 2 errors at baseline; green with the reviewed exclusions (all 27 invoker projects pass, verified end-to-end 2026-07-18)**. The runner downloads and patches the reactor, injects a tomee-remote profile (including the `trustStore.path`/`trustStore.password` properties the OpenID modules' keytool steps read), and drives every module through the Maven [...]
+| Security 4.0 | Source reactor zip 4.0.1 | `security` (Maven module) | **Runs: 26 app modules plus the signature test, 132 tests, 5 failures, 2 errors at baseline; green with the reviewed exclusions (all 27 invoker projects pass, verified end-to-end 2026-07-18)**. The runner downloads and patches the reactor, injects a tomee-remote profile (including the `trustStore.path`/`trustStore.password` properties the OpenID modules' keytool steps read), and drives every module through the Maven [...]
+| Security 4.0 (legacy old-tck) | Source reactor zip 4.0.1 (old-tck built from bundled sources) | `security-old` (Maven module) | **Baseline 83 tests, 82 pass, 1 failure (Plume, JDK 21, 2026-07-19); green with the reviewed exclusion.** The legacy JavaTest half exercises ~65 `com.sun.ts.tests.securityapi` Client classes across the idstore (in-war, database, LDAP), ham (HTTP authentication mechanism) and securitycontext trees. It deploys through the TCK's own `tomcat` handler (WAR copy int [...]
| Authentication 3.1 | Source reactor zip 3.1.2 | `authentication` (Maven module) | **Runs: 12 Web Profile modules plus the signature test; green with the reviewed exclusions (all 13 invoker projects pass, 0 failures, verified end-to-end 2026-07-18)**. The spi module registers the TCK's test `AuthConfigProvider` under Tomcat's JASPIC app-context naming (`Catalina/localhost /spitests_servlet_web`), so `ServletProfileSPITest` runs against Tomcat's `AuthConfigFactory` and passes 56 of its 5 [...]
| Faces 4.1 | Source reactor zip 4.1.2 | `faces` (Maven module) | **Runs: modern Arquillian modules (faces22/23/40/41) — 327 tests, 45 failures + 6 errors** (2026-07-18) on Plume's Mojarra; the failsafe rerun mechanism inflates those totals, covering 10 distinct failing classes, all in `exclusions/faces.txt`. One is a TomEE product gap (faces-config.xml unmarshaller rejecting the nonstandard *https* `xsi:schemaLocation`, `Spec1760IT`); the rest are Mojarra/TomEE integration behaviors — F [...]
| Faces 4.1 (legacy old-tck) | Source reactor zip 4.1.2 (old-tck built from bundled sources) | `faces-old` (Maven module) | **Passes 5,391/5,391 (standalone mode, no exclusions)** (2026-07-18). The recorded full run shows 5 failures in `htmloutcometargetbutton`, all from a foreign server answering port 8080 mid-run; they pass on re-run against TomEE. The JavaTest half deploys through the TCK's own `tomcat` handler (WAR copy into `webapps/`) against a TomEE instance the runner provisions [...]
diff --git a/runner-standalone/exclusions/README.md b/runner-standalone/exclusions/README.md
index f71ee3e..64644cc 100644
--- a/runner-standalone/exclusions/README.md
+++ b/runner-standalone/exclusions/README.md
@@ -24,9 +24,9 @@ Two formats, depending on how the runner executes tests:
both the declaring class and the concrete runtime class — several TCK
base classes contribute inherited test methods that only the subclass
name identifies.
-- **JavaTest-based runners** (`transactions`, `faces-old`): JavaTest jtx
- exclusion lines (`test/path/File.java#testid`), appended by the runner to
- the harness `ts.jtx` before the run.
+- **JavaTest-based runners** (`transactions`, `faces-old`, `security-old`):
+ JavaTest jtx exclusion lines (`test/path/File.java#testid`), appended by the
+ runner to the harness `ts.jtx` before the run.
To collect a full compatibility baseline without exclusions, run a suite with
`-Dtck.exclusions.file=$(pwd)/runner-standalone/exclusions/none.txt` (the
diff --git a/runner-standalone/exclusions/security-old.txt b/runner-standalone/exclusions/security-old.txt
new file mode 100644
index 0000000..50bb8a6
--- /dev/null
+++ b/runner-standalone/exclusions/security-old.txt
@@ -0,0 +1,18 @@
+# Reviewed known-gap exclusions for the legacy Jakarta Security 4.0 old-tck
+# (JavaTest) run against TomEE. Lines use the JavaTest jtx format
+# (test/dir/path#testid) and are appended to the mode's ts.jtx by the
+# runner-standalone-security-old module. See KNOWN_ISSUES.md for the
+# rationale behind each entry.
+#
+# Baseline 2026-07-19 (Plume, JDK 21): 83 tests, 82 passed, 1 failed,
+# 0 errors. The single failure below is a TomEE product gap.
+
+# TomEE product gap: SecurityContext.hasAccessToWebResource() returns false
+# for a caller that is authorized for the resource. The servlet reports the
+# correct caller ("context username: tom") and the authentication path works,
+# but the programmatic access check answers "has GET access ... : false" where
+# the spec requires true for user tom (Manager role) against the
+# @HttpMethodConstraint("GET") /protectedServlet. TomEE's SecurityContext is
+# not wired to the servlet authorization/Policy layer for
+# hasAccessToWebResource(). Assertions Security:JAVADOC:7/8, Security:SPEC:4.3-1.
+com/sun/ts/tests/securityapi/securitycontext/callerdata/Client.java#testSecurityContextHasAccessToWebResource
(tomee-tck) 02/07: Run the Faces old-tck-selenium modules in the faces TCK suite
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit b8edfbef591e0c35dc01e0e4941142653ba477b0
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 10:17:32 2026 +0200
Run the Faces old-tck-selenium modules in the faces TCK suite
Add old-tck-selenium (ajax, commandLink, protectedViews) to the faces
invoker run and the expected-module list. Clean each TCK reactor before
verify so the aggregating check never counts stale reports left by an
earlier run, and count only final surefire/failsafe outcomes so a
Chrome test that recovers on rerun no longer reads as an error.
With exclusions applied the suite runs 298 tests, 0 failures, 0 errors,
17 skipped; old-tck-selenium needs no exclusions.
---
KNOWN_ISSUES.md | 14 +++++---------
runner-standalone/README.md | 2 +-
runner-standalone/exclusions/faces.txt | 15 ++++++++-------
runner-standalone/faces/pom.xml | 25 +++++++++++++++++--------
runner-standalone/verify-invoker-result.sh | 26 +++++++++++++++++++++-----
5 files changed, 52 insertions(+), 30 deletions(-)
diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md
index f0e2d51..19d7236 100644
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@ -40,7 +40,7 @@ Detail lives next to each runner:
| security | 132 tests, 5 F + 2 E; signature test passes | 7 tests | TomEE Jakarta Security |
| authentication | 106 tests, 1 F; signature test passes | 1 method (spi `CheckMsgInfoKey`) | TCK challenge #219 (hard-codes a JACC requirement) |
| websocket | 737 tests, 3 E | 3 methods | Client container advertises permessage-deflate in the negotiated extension lists |
-| faces (modern modules) | 327 tests, 45 F + 6 E (failsafe reruns inflate the counts; 10 distinct failing classes) | 10 classes | 1 TomEE faces-config gap + Mojarra/TomEE CDI-injection, whole-bean/method validation, and one Chrome ajax quirk |
+| faces (modern modules + old-tck-selenium) | 298 tests, 0 F + 0 E, 17 skipped (with exclusions applied) | 10 classes | 1 TomEE faces-config gap + Mojarra/TomEE CDI-injection, whole-bean/method validation, and one Chrome ajax quirk |
| faces-old (JavaTest) | 5,391 tests, all pass (recorded run: 5 F from a foreign server answering :8080 mid-run; pass on re-run) | — | — (standalone mode, no exclusions) |
| faces-signaturetest | passes against Plume's Mojarra (org.glassfish:jakarta.faces 4.1.9) | — | — |
@@ -248,14 +248,10 @@ Need triage/fixes in the upstream projects TomEE ships.
Not product bugs — gaps in this repository's coverage.
- **Modern faces reactor not in CI**: the `faces` runner (modern Arquillian
- modules plus the signature test) runs locally via
- `run-standalone-suite.sh`; it joins the Jenkins branch list once its
- baseline and exclusion wiring have a verified green run. The `faces-old`
- JavaTest half runs in CI.
-- **Faces `old-tck-selenium` module uncovered**: the extracted TCK reactor
- ships an `old-tck-selenium` module (22 tests) that neither the `faces`
- runner (which drives faces22/23/40/41 + faces-signaturetest) nor the
- `faces-old` JavaTest runner executes; wire it into one of them.
+ modules, the Chrome/Selenium `old-tck-selenium` modules, and the signature
+ test) runs locally via `run-standalone-suite.sh`; it joins the Jenkins
+ branch list once its baseline and exclusion wiring have a verified green
+ run. The `faces-old` JavaTest half runs in CI.
## What CI runs
diff --git a/runner-standalone/README.md b/runner-standalone/README.md
index 79f7fd7..13017d0 100644
--- a/runner-standalone/README.md
+++ b/runner-standalone/README.md
@@ -61,7 +61,7 @@ derived from; with the default exclusions applied these suites run green.
| WebSocket 2.2 | EFTL zip (installed as `jakarta.tck:websocket-tck-spec-tests:2.2.0`) | `websocket` | **Runs: 737 tests, 0 failures, 3 errors** (2026-07-18) against Tomcat's WebSocket implementation, driven through the `tomcat-websocket` client container; the signature test passes. The negative-deployment classes run and pass: an invalid server endpoint aborts the whole webapp deployment as the spec requires, and the runner's Arquillian extension (`NegativeDeploymentToleranceObserver`) [...]
| Security 4.0 | Source reactor zip 4.0.1 | `security` (Maven module) | **Runs: 26 app modules plus the signature test, 132 tests, 5 failures, 2 errors at baseline; green with the reviewed exclusions (all 27 invoker projects pass, verified end-to-end 2026-07-18)**. The runner downloads and patches the reactor, injects a tomee-remote profile (including the `trustStore.path`/`trustStore.password` properties the OpenID modules' keytool steps read), and drives every module through the Maven [...]
| Authentication 3.1 | Source reactor zip 3.1.2 | `authentication` (Maven module) | **Runs: 12 Web Profile modules plus the signature test; green with the reviewed exclusions (all 13 invoker projects pass, 0 failures, verified end-to-end 2026-07-18)**. The spi module registers the TCK's test `AuthConfigProvider` under Tomcat's JASPIC app-context naming (`Catalina/localhost /spitests_servlet_web`), so `ServletProfileSPITest` runs against Tomcat's `AuthConfigFactory` and passes 56 of its 5 [...]
-| Faces 4.1 | Source reactor zip 4.1.2 | `faces` (Maven module) | **Runs: modern Arquillian modules (faces22/23/40/41) — 327 tests, 45 failures + 6 errors** (2026-07-18) on Plume's Mojarra; the failsafe rerun mechanism inflates those totals, covering 10 distinct failing classes, all in `exclusions/faces.txt`. One is a TomEE product gap (faces-config.xml unmarshaller rejecting the nonstandard *https* `xsi:schemaLocation`, `Spec1760IT`); the rest are Mojarra/TomEE integration behaviors — F [...]
+| Faces 4.1 | Source reactor zip 4.1.2 | `faces` (Maven module) | **Runs: modern Arquillian modules (faces22/23/40/41) plus the Chrome/Selenium `old-tck-selenium` modules (ajax, commandLink, protectedViews) — 298 tests, 0 failures, 0 errors, 17 skipped** on Plume's Mojarra, with `exclusions/faces.txt` applied. The 10 excluded classes are one TomEE product gap (faces-config.xml unmarshaller rejecting the nonstandard *https* `xsi:schemaLocation`, `Spec1760IT`) and Mojarra/TomEE integration [...]
| Faces 4.1 (legacy old-tck) | Source reactor zip 4.1.2 (old-tck built from bundled sources) | `faces-old` (Maven module) | **Passes 5,391/5,391 (standalone mode, no exclusions)** (2026-07-18). The recorded full run shows 5 failures in `htmloutcometargetbutton`, all from a foreign server answering port 8080 mid-run; they pass on re-run against TomEE. The JavaTest half deploys through the TCK's own `tomcat` handler (WAR copy into `webapps/`) against a TomEE instance the runner provisions [...]
| JSON Processing 2.1 | `jakarta.json:jakarta.json-tck-*:2.1.1` (Maven Central; byte-identical to the EFTL zip pinned in `environment/versions.env`) | `jsonp` | **Passes 197/197** (2026-07-18) against Apache Johnzon 2.1.0, the JSON-P provider bundled in the TomEE Plume snapshot: 179 functional + signature tests and 18 pluggability tests. The signature test checks the `jakarta.json` packages of the distribution's `jakartaee-api` jar |
| JSON Binding 3.0 | `jakarta.json.bind:jakarta.json.bind-tck:3.0.0` (Maven Central; byte-identical to the EFTL zip pinned in `environment/versions.env`) | `jsonb` | **Runs: 295 tests, 1 failure, 1 error, 5 skipped** against Apache Johnzon 2.1.0 with OpenWebBeans as the CDI SE container (the runner boots it because the TCK's own private `@BeforeAll` bootstrap is ignored by JUnit). The runner sets `johnzon.use-bigdecimal-stringadapter=false`/`johnzon.use-biginteger-stringadapter=false` (J [...]
diff --git a/runner-standalone/exclusions/faces.txt b/runner-standalone/exclusions/faces.txt
index 54efc8d..11f5944 100644
--- a/runner-standalone/exclusions/faces.txt
+++ b/runner-standalone/exclusions/faces.txt
@@ -1,10 +1,10 @@
# Jakarta Faces 4.1 TCK source reactor (4.1.2), modern Arquillian modules
-# (faces22/23/40/41 + faces-signaturetest) on TomEE Plume's Mojarra, Java 21,
-# 2026-07-18. Full baseline without this file: 327 tests, 45 failures + 6
-# errors, 5 skipped (the failsafe rerun mechanism counts each retried method
-# up to five times, so these totals cover 10 distinct failing test classes).
-# The excluded work splits into one TomEE product gap and four Mojarra/TomEE
-# integration behaviors:
+# (faces22/23/40/41), the Chrome/Selenium old-tck-selenium modules (ajax,
+# commandLink, protectedViews), and faces-signaturetest on TomEE Plume's
+# Mojarra, Java 21. With this file applied the suite runs 298 tests, 0
+# failures, 0 errors, 17 skipped. The 10 classes excluded below split into
+# one TomEE product gap and four Mojarra/TomEE integration behaviors;
+# old-tck-selenium runs unmodified and needs no exclusions:
# - faces-config xsi:schemaLocation on the nonstandard https XSI namespace:
# 1 class (Spec1760IT) whose faces-config carries child elements.
# - Faces CDI implicit-object injection (@Inject @RequestCookieMap /
@@ -15,7 +15,8 @@
# - Mojarra ajax re-init under Chrome (flagged in the TCK source itself): 1
# class.
# The signature test and the rest of the reactor pass. The legacy JavaTest
-# old-tck half lives in runner-standalone-faces-old and is not covered here.
+# old-tck half (a separate JavaTest harness) lives in
+# runner-standalone-faces-old and is not covered here.
#
# Format: maven-surefire/failsafe excludesFile patterns; the runner passes
# this file to every TCK module through the invoker as
diff --git a/runner-standalone/faces/pom.xml b/runner-standalone/faces/pom.xml
index a2daf43..47be7dd 100644
--- a/runner-standalone/faces/pom.xml
+++ b/runner-standalone/faces/pom.xml
@@ -18,15 +18,17 @@
<artifactId>runner-standalone-faces</artifactId>
<packaging>pom</packaging>
- <name>Jakarta Faces 4.1 TCK runner (modern modules + signature test)</name>
+ <name>Jakarta Faces 4.1 TCK runner (modern modules + old-tck-selenium + signature test)</name>
<description>
Runs the modern Arquillian modules of the Jakarta Faces 4.1 TCK
- (faces22/23/40/41 and util, roughly 319 tests) plus the
- faces-signaturetest module against TomEE Plume, which ships Mojarra.
- The signature test checks the Mojarra artifact TomEE bundles
- (faces.impl.version below must track the jakarta.faces jar in the
- distribution's lib directory). The legacy JavaTest old-tck half lives in
- runner-standalone-faces-old. Run with: run-standalone-suite.sh faces
+ (faces22/23/40/41 and util) plus the Chrome/Selenium old-tck-selenium
+ modules (ajax, commandLink, protectedViews) and the faces-signaturetest
+ module against TomEE Plume, which ships Mojarra. With exclusions applied
+ the suite runs 298 tests. The signature test checks the Mojarra artifact
+ TomEE bundles (faces.impl.version below must track the jakarta.faces jar
+ in the distribution's lib directory). The legacy JavaTest old-tck half
+ lives in runner-standalone-faces-old. Run with:
+ run-standalone-suite.sh faces
</description>
<properties>
@@ -147,6 +149,7 @@
<argument>faces23</argument>
<argument>faces40</argument>
<argument>faces41</argument>
+ <argument>old-tck-selenium</argument>
<argument>faces-signaturetest</argument>
</arguments>
</configuration>
@@ -173,7 +176,12 @@
<phase>integration-test</phase>
<goals><goal>run</goal></goals>
<configuration>
- <goals><goal>verify</goal></goals>
+ <!-- clean before verify so the aggregating verify step never
+ counts stale surefire/failsafe reports left in a module's
+ target/ by an earlier run (e.g. a full-baseline pass whose
+ now-excluded classes no longer re-run and overwrite their
+ reports). -->
+ <goals><goal>clean</goal><goal>verify</goal></goals>
<profiles><profile>tomee-remote</profile></profiles>
<!-- Each include is a multi-module reactor; collect the whole
baseline instead of stopping at the first failing module.
@@ -189,6 +197,7 @@
<pomInclude>faces23/pom.xml</pomInclude>
<pomInclude>faces40/pom.xml</pomInclude>
<pomInclude>faces41/pom.xml</pomInclude>
+ <pomInclude>old-tck-selenium/pom.xml</pomInclude>
<pomInclude>faces-signaturetest/pom.xml</pomInclude>
</pomIncludes>
</configuration>
diff --git a/runner-standalone/verify-invoker-result.sh b/runner-standalone/verify-invoker-result.sh
index eb7169e..c816023 100755
--- a/runner-standalone/verify-invoker-result.sh
+++ b/runner-standalone/verify-invoker-result.sh
@@ -43,18 +43,34 @@ fail() {
}
# --- Test failures and errors across every raw report under the reactor. ---
-# TEST-*.xml carries failures="" errors="" on the <testsuite> element;
-# failsafe-summary.xml carries <failures>/<errors> (and records deployment
-# errors the build log does not surface as a "Tests run" line).
+# Count only *final* outcomes. A <testcase> that failed but passed on a
+# failsafe/surefire rerun records its failed attempt as a <flakyError> or
+# <flakyFailure> (and the run reports <flakes> in failsafe-summary.xml); the
+# <testsuite> failures="" errors="" attributes still tally those recovered
+# attempts, so summing the attributes turns a green flaky test red. Count the
+# real <failure>/<error> elements that hang directly off a <testcase> instead,
+# which excludes the recovered flaky/rerun attempts.
report_failures=0
report_errors=0
for report in $(find "$reactor_root" -name 'TEST-*.xml' -path '*-reports/*' 2>/dev/null); do
- f=$(sed -n 's/.*<testsuite[^>]* failures="\([0-9]*\)".*/\1/p' "$report" | head -1)
- e=$(sed -n 's/.*<testsuite[^>]* errors="\([0-9]*\)".*/\1/p' "$report" | head -1)
+ # grep -c prints the count and exits non-zero on no match; strip any newline
+ # and default to 0 so the arithmetic stays single-line. <error and <failure
+ # do not match the recovered <flakyError>/<rerunError>/<flakyFailure>/
+ # <rerunFailure> attempts (their tag name is not preceded by '<error'/
+ # '<failure').
+ f=$(grep -c '<failure' "$report" 2>/dev/null | head -1)
+ e=$(grep -c '<error' "$report" 2>/dev/null | head -1)
report_failures=$((report_failures + ${f:-0}))
report_errors=$((report_errors + ${e:-0}))
done
+# failsafe-summary.xml records a deployment error the build log never surfaces
+# as a "Tests run" line and that writes no TEST-*.xml; count those summaries
+# only, so the per-testcase tally above is not double-counted.
for summary in $(find "$reactor_root" -name 'failsafe-summary.xml' 2>/dev/null); do
+ reports_dir=$(dirname "$summary")
+ if ls "$reports_dir"/TEST-*.xml >/dev/null 2>&1; then
+ continue
+ fi
f=$(sed -n 's/.*<failures>\([0-9]*\)<.*/\1/p' "$summary" | head -1)
e=$(sed -n 's/.*<errors>\([0-9]*\)<.*/\1/p' "$summary" | head -1)
report_failures=$((report_failures + ${f:-0}))
(tomee-tck) 06/07: Wire security-old into CI and document the faces browser constraint
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit b48237fd6087e2af99f9e6ca94bc3c81a4cce12d
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 12:13:34 2026 +0200
Wire security-old into CI and document the faces browser constraint
Add the security-old JavaTest runner to the standalone branch list on the
plain 240-minute default; its one-off old-tck source build plus ~83 tests
stay well under the faces-old sizing. Its report lands in
target/securityreport/**, already matched by the target/*report archive glob,
and it emits no TEST-*.xml, so no glob change is needed.
The modern faces reactor stays workstation-only: its old-tck-selenium modules
drive Chrome through Selenium, and the ASF ubuntu && ephemeral agents ship no
browser binary. Replace the vague "once its baseline is confirmed" wording
with the actual constraint.
---
Jenkinsfile | 22 ++++++++++++++++------
KNOWN_ISSUES.md | 44 ++++++++++++++++++++++++++------------------
2 files changed, 42 insertions(+), 24 deletions(-)
diff --git a/Jenkinsfile b/Jenkinsfile
index 4804a7c..a750ca6 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -148,11 +148,17 @@ from xml.etree import ElementTree
// reports live inside the extracted TCK module targets (one level
// deep for security/authentication, two for the faces reactor's
// per-submodule layout), which the recursive tck/** globs below
- // ingest. The faces-old runner drives the legacy
- // JavaTest half of the Faces TCK; its report lands in the
- // target/*report glob and a red JavaTest run fails the Maven build.
- // The modern faces reactor joins once its baseline is confirmed;
- // see runner-standalone/README.md and KNOWN_ISSUES.md.
+ // ingest. The faces-old and security-old runners drive the legacy
+ // JavaTest halves of the Faces and Security TCKs; each provisions and
+ // starts its own TomEE (security-old also a Derby network server and
+ // an in-process UnboundID LDAP server on 11389), builds its old-tck
+ // bundle from source on the first run, and lands its JavaTest report
+ // in the target/*report glob so a red run fails the Maven build.
+ // The modern faces reactor stays workstation-only: its
+ // old-tck-selenium modules drive Chrome through Selenium, and the ASF
+ // 'ubuntu && ephemeral' agents ship no browser binary (a JDK-tools
+ // agent, not a docker-image agent that could bundle one).
+ // See runner-standalone/README.md and KNOWN_ISSUES.md.
def standaloneBranch = { String id, int timeoutMinutes ->
{
stage("standalone - ${id}") {
@@ -182,7 +188,11 @@ from xml.etree import ElementTree
}
}
}
- for (id in ['annotations', 'di', 'el', 'concurrency', 'data', 'servlet', 'pages', 'rest', 'validation', 'websocket', 'jsonp', 'jsonb', 'debugging', 'persistence', 'transactions', 'cdi', 'cdi-ee', 'security', 'authentication']) {
+ // security-old shares the plain 240-minute default: even with the
+ // one-off old-tck source build it runs only ~83 JavaTest tests
+ // (~65 client classes), far below the faces-old sizing that earns
+ // the extended timeout below.
+ for (id in ['annotations', 'di', 'el', 'concurrency', 'data', 'servlet', 'pages', 'rest', 'validation', 'websocket', 'jsonp', 'jsonb', 'debugging', 'persistence', 'transactions', 'cdi', 'cdi-ee', 'security', 'security-old', 'authentication']) {
branches["standalone - ${id}"] = standaloneBranch(id, 240)
}
// ~5,400 JavaTest tests plus an old-tck source build and a
diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md
index 257c732..37ccc2c 100644
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@ -258,15 +258,20 @@ Need triage/fixes in the upstream projects TomEE ships.
Not product bugs — gaps in this repository's coverage.
-- **Modern faces reactor not in CI**: the `faces` runner (modern Arquillian
- modules, the Chrome/Selenium `old-tck-selenium` modules, and the signature
- test) runs locally via `run-standalone-suite.sh`; it joins the Jenkins
- branch list once its baseline and exclusion wiring have a verified green
- run. The `faces-old` JavaTest half runs in CI.
-- **Security `security-old` not in CI**: the `security-old` runner (the
- reactor's legacy JavaTest `com.sun.ts.tests.securityapi` suite) runs
- locally via `run-standalone-suite.sh` and is green with the reviewed
- exclusion; it joins the Jenkins branch list once its baseline has settled.
+- **Modern faces reactor stays workstation-only**: the `faces` runner (modern
+ Arquillian modules, the signature test, and the Chrome/Selenium
+ `old-tck-selenium` modules) is green with `exclusions/faces.txt`, but its
+ `old-tck-selenium` modules drive a real Chrome through Selenium. The TCK's
+ `BaseITNG`/`ChromeDevtoolsDriver` runs headless by default (`--headless=new`,
+ `--no-sandbox`) and lets Selenium Manager resolve `chromedriver`, but Selenium
+ Manager still needs a Chrome/Chromium browser binary on the machine. The ASF
+ `ubuntu && ephemeral` agents the Jenkinsfile targets are JDK-tools agents with
+ no browser installed; ASF's own pattern for browser-driven CI is to run inside
+ a Docker image that bundles the browser (e.g. `apache/incubator-kie-tools`),
+ which this pipeline does not use. So `faces` runs locally via
+ `run-standalone-suite.sh`; only a browser on the build agent (or a
+ browser-bundling container image) would let it join CI. The `faces-old`
+ JavaTest half needs no browser and runs in CI.
## What CI runs
@@ -275,14 +280,17 @@ Platform catalog on Plume plus `persistence-javatest` on the webprofile ZIP,
and the standalone suites `annotations`, `di`, `el`, `concurrency`, `data`,
`servlet`, `pages`, `rest`, `validation`, `websocket`, `jsonp`, `jsonb`,
`debugging`, `persistence`, `transactions`, `cdi`, `cdi-ee`, `security`,
-`authentication`, `faces-old` — all with default exclusions, all expected
-green. Each runner fails its own build on a red result through a
-`verify-tck-result` step: the JavaTest runners (`faces-old`, `transactions`)
-check the harness exit code, and the invoker-driven source reactors
-(`security`, `authentication`, `faces`) aggregate the inner surefire/failsafe
-reports and fail on any failure, error, or module that built but never ran
-its tests. The `junit`/archive globs also
+`security-old`, `authentication`, `faces-old` — all with default exclusions,
+all expected green. Each runner fails its own build on a red result through a
+`verify-tck-result` step: the JavaTest runners (`faces-old`, `security-old`,
+`transactions`) check the harness exit code, and the invoker-driven source
+reactors (`security`, `authentication`, `faces`) aggregate the inner
+surefire/failsafe reports and fail on any failure, error, or module that built
+but never ran its tests. The `junit`/archive globs also
ingest the surefire/failsafe reports inside the extracted TCK reactors that
the source-reactor runners drive through the Maven invoker, plus the
-JavaTest report directories. The modern `faces` reactor joins once its
-baseline has a verified green run.
+JavaTest report directories (`security-old` and `faces-old` write theirs to
+`target/securityreport/**` and `target/facesreport/**`, matched by the
+`target/*report/**` archive glob). The modern `faces` reactor stays
+workstation-only because its `old-tck-selenium` modules need a browser the ASF
+agents do not provide (see Harness work remaining).
(tomee-tck) 01/07: Set the EL variable.mapper porting property and clear the webprofile exclusions
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit a9e24b94359e3e625b79894364d618060a45b5da
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 09:25:08 2026 +0200
Set the EL variable.mapper porting property and clear the webprofile exclusions
---
environment/tck/ts.jte | 6 ++++++
runner-webprofile/KNOWN_FAILURES.md | 1 -
.../exclusions/expression-language.txt | 25 ++++++++++------------
runner-webprofile/platform-suite.tsv | 2 +-
runner-webprofile/run/pom.xml | 6 ++++++
5 files changed, 24 insertions(+), 16 deletions(-)
diff --git a/environment/tck/ts.jte b/environment/tck/ts.jte
index 9613a8a..7ac190e 100644
--- a/environment/tck/ts.jte
+++ b/environment/tck/ts.jte
@@ -17,6 +17,12 @@ webServerHost=localhost
webServerPort=8080
logical.hostname.servlet=localhost
+# Vendor VariableMapper implementation the expression-language TCK's
+# VarMapperELContext instantiates from the harness properties bag (testProps);
+# Tomcat's Jasper EL provides it. Reaches the JSP and servlet vehicle tests
+# that build the context inside the container.
+variable.mapper=org.apache.el.lang.VariableMapperImpl
+
user=j2ee
password=j2ee
authuser=javajoe
diff --git a/runner-webprofile/KNOWN_FAILURES.md b/runner-webprofile/KNOWN_FAILURES.md
index 2fc05a0..53d89be 100644
--- a/runner-webprofile/KNOWN_FAILURES.md
+++ b/runner-webprofile/KNOWN_FAILURES.md
@@ -32,7 +32,6 @@ them, but retaining one method would not constitute useful Tags coverage.
| `enterprise-beans-30` | Twelve lifecycle, managed-bean, and singleton-concurrency vehicle classes | Java 21, 2026-07-14 | A failed CDI/EJB deployment leaves deployment IDs registered in TomEE. Related applications then fail with `DuplicateDeploymentIdException` rather than reaching their assertions. |
| `enterprise-beans-30` | Twenty-one bean- and container-managed transaction vehicle classes | Java 21, 2026-07-14 | TomEE reports that an EJB started but did not complete a transaction while the tests exercise transaction-attribute semantics across singleton, stateful, and stateless beans. |
| `signature` | Both Web Profile signature vehicle wrappers | Java 21, 2026-07-14 | TomEE's `webprofile` distribution exposes Jakarta Batch and Jakarta Messaging packages through its combined `jakartaee-api` jar even though these optional technologies are not declared by `javaee.level=web`. The required Web Profile packages, including the corrected Jakarta Tags API, pass the signature check. Optional technologies must instead be removed from this distribution or declared and covered by t [...]
-| `expression-language` | Method-expression and method-reference tests in JSP and servlet vehicles, plus two client-side variable-mapper classes | Java 21, 2026-07-14 | Tomcat EL 6.0 fails Jakarta EL 6 overload-selection assertions for `MethodExpression`, while its `StandardELContext` supplies no `VariableMapper` to method-reference or variable-binding tests. The remaining 66 Platform EL classes stay enabled. |
| `json-binding` | Serializer customization CDI test in JSP and servlet vehicles | Java 21, 2026-07-14 | TomEE's Johnzon integration does not inject the CDI-managed field in the `@JsonbTypeDeserializer` used for a nested generic type. CDI adapter injection and provider-selection tests remain covered. |
| `transactions` | Four `jta.ee.transactional.ClientEjblite*Test` vehicle classes | Java 21, 2026-07-14 | TomEE's CDI transactional interceptors fail transaction propagation, rollback-rule, and `TransactionScoped` context assertions across the servlet, JSP, JSF, and filtered-servlet vehicles. A failed assertion can leave transaction state active and cascade into later methods, so the affected vehicle classes are excluded as a unit. |
| `transactions` | JSP and servlet vehicles for `UserTransaction` rollback, `setRollbackOnly`, and timeout (six classes) | Java 21, 2026-07-14 | TomEE misses required `IllegalStateException`/`RollbackException` outcomes, and timed-out transactions remain associated with request threads. The resulting `NotSupportedException` failures move between methods according to execution order, so method-level exclusions would be unstable. Begin, commit, and status classes remain covered. |
diff --git a/runner-webprofile/exclusions/expression-language.txt b/runner-webprofile/exclusions/expression-language.txt
index 3856635..9cc4d44 100644
--- a/runner-webprofile/exclusions/expression-language.txt
+++ b/runner-webprofile/exclusions/expression-language.txt
@@ -1,14 +1,11 @@
-# Java 21, 2026-07-14: Tomcat EL 6.0 does not satisfy the TCK's overload
-# selection assertions for MethodExpression, and its StandardELContext exposes
-# no VariableMapper to the MethodReference test. Both failures reproduce in JSP
-# and servlet vehicles; the other 68 Platform EL classes remain covered.
-**/methodexpression/ELClientJspTest.java
-**/methodexpression/ELClientServletTest.java
-**/methodreference/ELClientJspTest.java
-**/methodreference/ELClientServletTest.java
-
-# Tomcat's EL implementation is also used for the client-only mapper tests.
-# Its StandardELContext returns a null VariableMapper, so both classes fail
-# before their binding assertions can execute.
-**/api/jakarta_el/variablemapper/ELClientTest.java
-**/spec/mapper/ELClientTest.java
+# Jakarta EE Platform TCK expression-language partition against Tomcat's
+# Jasper EL, the implementation bundled in the TomEE distribution. The
+# partition runs green with no exclusions: all 72 classes pass. The runner
+# supplies the vendor VariableMapper implementation the TCK's
+# VarMapperELContext instantiates through the variable.mapper porting
+# property (org.apache.el.lang.VariableMapperImpl), set on the client JVM
+# (runner-webprofile/run/pom.xml) and in the harness properties bag the JSP
+# and servlet vehicle tests read (environment/tck/ts.jte).
+#
+# Format: maven-surefire excludesFile patterns, applied through
+# -Dtck.exclusions.file (see run-platform-suite.sh).
diff --git a/runner-webprofile/platform-suite.tsv b/runner-webprofile/platform-suite.tsv
index be8fa24..f72306c 100644
--- a/runner-webprofile/platform-suite.tsv
+++ b/runner-webprofile/platform-suite.tsv
@@ -5,7 +5,7 @@
jdbc jdbc-platform-tck javatest web & tck-javatest 152 152 **/*JSP.java,**/*Servlet.java
enterprise-beans-30 ejb30 javatest web & tck-javatest 282 170 **/*Test.java
enterprise-beans-32 ejb32 javatest web & tck-javatest 72 48 **/*Test.java
-expression-language el-platform-tck javatest web & tck-javatest 72 66 **/*Test.java
+expression-language el-platform-tck javatest web & tck-javatest 72 72 **/*Test.java
json-binding jsonb-platform-tck javatest web & tck-javatest 6 4 **/*Test.java
json-processing jsonp-platform-tck javatest web & tck-javatest 4 4 **/*Test.java
pages pages-platform-tck servlet web & !tck-javatest 2 2 **/*IT.java
diff --git a/runner-webprofile/run/pom.xml b/runner-webprofile/run/pom.xml
index 8a1a3e3..694f902 100644
--- a/runner-webprofile/run/pom.xml
+++ b/runner-webprofile/run/pom.xml
@@ -404,6 +404,12 @@
<openejb.jaxrs.fail-on-constrainedto>false</openejb.jaxrs.fail-on-constrainedto>
<ts_home>${project.build.directory}</ts_home>
<junit.log.traceflag>${tck.trace}</junit.log.traceflag>
+ <!-- Vendor VariableMapper implementation the expression-language
+ partition's TCK VarMapperELContext instantiates for the
+ client-side variablemapper and mapper tests; Tomcat's Jasper
+ EL provides it. The JSP and servlet vehicle tests read the
+ same property from the harness bag set in environment/tck/ts.jte. -->
+ <variable.mapper>org.apache.el.lang.VariableMapperImpl</variable.mapper>
</systemPropertyVariables>
</configuration>
<executions>
(tomee-tck) 03/07: Add a security-old runner for the Jakarta Security legacy JavaTest TCK
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit 13b26abe2ce3c350f7901af3478b1268f8062a38
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 10:53:04 2026 +0200
Add a security-old runner for the Jakarta Security legacy JavaTest TCK
---
runner-standalone/pom.xml | 1 +
runner-standalone/run-standalone-suite.sh | 6 +-
runner-standalone/security-old/pom.xml | 488 +++++++++++++++++++++
.../security-old/src/test/resources/tomee.xml | 15 +
4 files changed, 507 insertions(+), 3 deletions(-)
diff --git a/runner-standalone/pom.xml b/runner-standalone/pom.xml
index 925cf08..331101f 100644
--- a/runner-standalone/pom.xml
+++ b/runner-standalone/pom.xml
@@ -60,6 +60,7 @@
<module>authentication</module>
<module>faces</module>
<module>faces-old</module>
+ <module>security-old</module>
</modules>
<properties>
diff --git a/runner-standalone/run-standalone-suite.sh b/runner-standalone/run-standalone-suite.sh
index c5b28e6..c4393ff 100755
--- a/runner-standalone/run-standalone-suite.sh
+++ b/runner-standalone/run-standalone-suite.sh
@@ -33,8 +33,8 @@ usage() {
Usage: run-standalone-suite.sh <id> [extra mvn args]
Runners: annotations, concurrency, data, di, el, cdi, cdi-ee, servlet,
pages, rest, validation, websocket, jsonp, jsonb, debugging,
- persistence, transactions, security, authentication, faces,
- faces-old
+ persistence, transactions, security, security-old, authentication,
+ faces, faces-old
See runner-standalone/README.md for per-TCK status.
EOF
exit 2
@@ -47,7 +47,7 @@ EOF
GOAL=test
case "$ID" in
''|*-install|tck-common|exclusions|*/*|.*) usage ;;
- security|authentication|faces|faces-old|transactions)
+ security|security-old|authentication|faces|faces-old|transactions)
GOAL=verify ;;
esac
[ -f "$SCRIPT_DIR/$ID/pom.xml" ] || usage
diff --git a/runner-standalone/security-old/pom.xml b/runner-standalone/security-old/pom.xml
new file mode 100644
index 0000000..992eb8e
--- /dev/null
+++ b/runner-standalone/security-old/pom.xml
@@ -0,0 +1,488 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.apache.tomee.cts</groupId>
+ <artifactId>runner-standalone</artifactId>
+ <version>11.0.0-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>runner-standalone-security-old</artifactId>
+ <packaging>pom</packaging>
+ <name>Jakarta Security 4.0 TCK runner (legacy JavaTest old-tck)</name>
+ <description>
+ Runs the legacy JavaTest half of the Jakarta Security 4.0 TCK
+ (~65 com.sun.ts.tests.securityapi Client classes over the idstore, ham
+ and securitycontext trees) against TomEE. The old-tck is first built from
+ the sources bundled in the TCK distribution, then deployed through the
+ TCK's own "tomcat" deployment handler, which copies the test WARs into the
+ container's webapps directory - no GlassFish asadmin involvement. TomEE is
+ provisioned and started by this module, along with a Derby network server
+ (for the DatabaseIdentityStore tree) and an embedded UnboundID LDAP server
+ (for the LdapIdentityStore tree, started by the harness itself). The modern
+ Arquillian half lives in runner-standalone-security.
+ Run with: run-standalone-suite.sh security-old
+ Single test directory: -Dtck.test=com/sun/ts/tests/securityapi/securitycontext/authenticate
+ </description>
+
+ <properties>
+ <!-- This module provisions and starts its own TomEE and Derby; skip the
+ shared Arquillian-oriented container lifecycle. -->
+ <tck.standalone.container.skip>true</tck.standalone.container.skip>
+
+ <!-- The old-tck ships inside the same SHA-pinned Security TCK zip the
+ modern runner-standalone-security module drives; download and verify
+ it independently so the two modules stay decoupled. -->
+ <security.tck.version>4.0.1</security.tck.version>
+ <security.tck.url>https://download.eclipse.org/jakartaee/security/4.0/jakarta-security-tck-${security.tck.version}.zip</security.tck.url>
+ <security.tck.sha256>87172900057200e0a30a9f30cb3a75331fe428b9dac42153a093ee5c412b7d6d</security.tck.sha256>
+
+ <oldtck.source.dir>${project.build.directory}/security-tck-${security.tck.version}/tck/old-tck/source</oldtck.source.dir>
+ <oldtck.build.zip>${oldtck.source.dir}/release/SECURITYAPI_BUILD/latest/security-tck.zip</oldtck.build.zip>
+
+ <!-- Unpacked from the built old-tck bundle. -->
+ <tck.home>${project.build.directory}/security-tck</tck.home>
+ <tck.tests.home>${tck.home}/src/com/sun/ts/tests/securityapi</tck.tests.home>
+ <!-- standalone = web-container mode; the TCK's own GlassFish run uses the
+ same ts.jtx.standalone excludes. -->
+ <tck.mode>standalone</tck.mode>
+
+ <tomee.home>${project.build.directory}/tomee/apache-tomee-${tomee.classifier}-${tomee.version}</tomee.home>
+ <!-- JavaTest client-side log listener. -->
+ <tck.harness.log.port>2100</tck.harness.log.port>
+ <!-- Seconds per archive the tomcat deployment handler waits for the
+ container to expand a copied WAR (or remove an undeployed one). -->
+ <tck.deploy.timeout.multiplier>60</tck.deploy.timeout.multiplier>
+
+ <!-- Reviewed known-gap exclusions in JavaTest jtx line format
+ (test/path#testid); appended to the mode's ts.jtx. Point at
+ exclusions/none.txt for a full baseline run. -->
+ <tck.exclusions.file>${project.basedir}/../exclusions/security-old.txt</tck.exclusions.file>
+ </properties>
+
+ <dependencies>
+ <!-- Derby: the network server for the DatabaseIdentityStore tree plus the
+ client driver TomEE's jdbc/securityAPIDB datasource and the harness'
+ init.derby schema task use. Copied into the TomEE lib and onto the
+ Derby launcher classpath below. -->
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derbynet</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derbyclient</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derbyshared</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derbytools</artifactId>
+ </dependency>
+ </dependencies>
+
+ <build>
+ <plugins>
+ <!-- Stage the TomEE distribution this runner manages itself. -->
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-dependency-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>unpack-tomee-distribution</id>
+ <phase>generate-test-resources</phase>
+ <goals><goal>unpack</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <artifactItems>
+ <artifactItem>
+ <groupId>org.apache.tomee</groupId>
+ <artifactId>apache-tomee</artifactId>
+ <version>${tomee.version}</version>
+ <classifier>${tomee.classifier}</classifier>
+ <type>zip</type>
+ <outputDirectory>${project.build.directory}/tomee</outputDirectory>
+ </artifactItem>
+ </artifactItems>
+ </configuration>
+ </execution>
+ <!-- Copy the Derby jars where the antrun steps can find them: the
+ TomEE lib (so the jdbc/securityAPIDB datasource resolves) and a
+ dedicated dir the Derby network-server launcher uses. -->
+ <execution>
+ <id>copy-derby-jars</id>
+ <phase>process-test-resources</phase>
+ <goals><goal>copy-dependencies</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <includeGroupIds>org.apache.derby</includeGroupIds>
+ <outputDirectory>${project.build.directory}/derby-lib</outputDirectory>
+ <stripVersion>false</stripVersion>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-antrun-plugin</artifactId>
+ <executions>
+
+ <!-- Step 1: download and verify the TCK distribution and the Ant
+ version the JavaTest harness is driven with. -->
+ <execution>
+ <id>download-tck-and-ant</id>
+ <phase>generate-test-resources</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <target>
+ <get skipexisting="true" src="${security.tck.url}" dest="${project.build.directory}/jakarta-security-tck-${security.tck.version}.zip"/>
+ <checksum file="${project.build.directory}/jakarta-security-tck-${security.tck.version}.zip" algorithm="SHA-256" property="${security.tck.sha256}" verifyProperty="security.tck.checksum.matches"/>
+ <fail message="Checksum mismatch for the Jakarta Security TCK distribution">
+ <condition><isfalse value="${security.tck.checksum.matches}"/></condition>
+ </fail>
+ <unzip src="${project.build.directory}/jakarta-security-tck-${security.tck.version}.zip" dest="${project.build.directory}" overwrite="false"/>
+
+ <get skipexisting="true" src="${tck.ant.url}" dest="${project.build.directory}/apache-ant-${tck.ant.version}-bin.zip"/>
+ <checksum file="${project.build.directory}/apache-ant-${tck.ant.version}-bin.zip" algorithm="SHA-512" property="${tck.ant.sha512}" verifyProperty="tck.ant.checksum.matches"/>
+ <fail message="Checksum mismatch for the Apache Ant distribution">
+ <condition><isfalse value="${tck.ant.checksum.matches}"/></condition>
+ </fail>
+ <unzip src="${project.build.directory}/apache-ant-${tck.ant.version}-bin.zip" dest="${project.build.directory}" overwrite="false"/>
+ <chmod perm="ugo+x">
+ <fileset dir="${tck.ant.home}/bin" includes="ant,antRun"/>
+ </chmod>
+
+ <!-- The build script invokes a bare `mvn`; route it through
+ the repository's Maven wrapper instead. -->
+ <replace file="${oldtck.source.dir}/docker/build_oldtck.sh" token="mvn -f" value=""$MVNW" -f"/>
+ <!-- Anchor the wrapper's multi-module root inside the TCK
+ sources so its path properties resolve against the TCK,
+ not this repository. -->
+ <mkdir dir="${oldtck.source.dir}/.mvn"/>
+ </target>
+ </configuration>
+ </execution>
+
+ <!-- Step 2: build the old-tck bundle from source (the distribution
+ only ships sources for this half). Skipped when the bundle from
+ a previous run is still present. -->
+ <execution>
+ <id>build-old-tck</id>
+ <phase>process-test-resources</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <target xmlns:unless="ant:unless">
+ <available file="${oldtck.build.zip}" property="oldtck.already.built"/>
+ <exec executable="bash" dir="${oldtck.source.dir}" failonerror="true" unless:set="oldtck.already.built">
+ <arg value="-xe"/>
+ <arg value="${oldtck.source.dir}/docker/build_oldtck.sh"/>
+ <arg value="${oldtck.source.dir}"/>
+ <env key="ANT_HOME" value="${tck.ant.home}"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ <env key="MVNW" value="${maven.multiModuleProjectDirectory}/mvnw"/>
+ <env key="PATH" value="${tck.ant.home}/bin:${java.home}/bin:${env.PATH}"/>
+ </exec>
+ <unzip src="${oldtck.build.zip}" dest="${project.build.directory}" overwrite="false"/>
+ <!-- The release packaging only keeps the glassfish and none
+ deployment handlers; restore the tomcat handler from the
+ TCK sources - it is the one this runner drives. -->
+ <copy todir="${tck.home}/bin/xml/impl/tomcat">
+ <fileset dir="${oldtck.source.dir}/bin/xml/impl/tomcat"/>
+ </copy>
+ </target>
+ </configuration>
+ </execution>
+
+ <!-- Step 3: point the harness configuration at TomEE. -->
+ <execution>
+ <id>configure-tck</id>
+ <phase>pre-integration-test</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <target>
+ <macrodef name="tck-setting">
+ <attribute name="key"/><attribute name="value"/>
+ <sequential>
+ <replaceregexp file="${tck.home}/bin/ts.jte" byline="true"
+ match="@{key}=.*" replace="@{key}=@{value}"/>
+ </sequential>
+ </macrodef>
+
+ <!-- Web-container (standalone) versus platform exclusions. -->
+ <copy file="${tck.home}/bin/ts.jtx.${tck.mode}" tofile="${tck.home}/bin/ts.jtx" overwrite="true"/>
+ <!-- Reviewed TomEE known-gap exclusions on top. -->
+ <concat destfile="${tck.home}/bin/ts.jtx" append="true" fixlastline="true">
+ <file file="${tck.exclusions.file}"/>
+ </concat>
+
+ <!-- Classpath handed to the JavaTest client JVMs: the Jakarta
+ Security/Servlet/CDI/Faces API stack the tests compile
+ against, resolved from the TomEE distribution plus the
+ harness' own UnboundID jar. -->
+ <pathconvert property="tck.securityapi.classes" pathsep="${path.separator}">
+ <fileset dir="${tomee.home}/lib">
+ <include name="jakartaee-api-*.jar"/>
+ <include name="jakarta.faces-*.jar"/>
+ </fileset>
+ <fileset dir="${tck.home}/lib">
+ <include name="unboundid-ldapsdk.jar"/>
+ </fileset>
+ </pathconvert>
+
+ <tck-setting key="webServerHost" value="localhost"/>
+ <tck-setting key="webServerPort" value="${tomee.http.port}"/>
+ <tck-setting key="web.home" value="${tomee.home}"/>
+ <tck-setting key="webServerHome" value="${tomee.home}"/>
+ <tck-setting key="impl.vi" value="tomcat"/>
+ <tck-setting key="impl.vi.deploy.dir" value="${tomee.home}/webapps"/>
+ <tck-setting key="impl.deploy.timeout.multiplier" value="${tck.deploy.timeout.multiplier}"/>
+ <tck-setting key="securityapi.classes" value="${tck.securityapi.classes}"/>
+ <tck-setting key="harness.log.port" value="${tck.harness.log.port}"/>
+ <tck-setting key="report.dir" value="${project.build.directory}/securityreport/security"/>
+ <tck-setting key="work.dir" value="${project.build.directory}/securitywork/security"/>
+
+ <!-- Derby network server + client for the DatabaseIdentityStore
+ tree; the harness' init.derby task connects with these.
+ derby.classes (used as db.lib) must be a concrete driver
+ classpath, so resolve the staged Derby jars here. -->
+ <pathconvert property="tck.derby.classes" pathsep="${path.separator}">
+ <fileset dir="${project.build.directory}/derby-lib" includes="derby*.jar"/>
+ </pathconvert>
+ <tck-setting key="derby.server" value="localhost"/>
+ <tck-setting key="derby.port" value="${tck.derby.port}"/>
+ <tck-setting key="derby.classes" value="${tck.derby.classes}"/>
+
+ <mkdir dir="${project.build.directory}/securityreport/security"/>
+ <mkdir dir="${project.build.directory}/securitywork/security"/>
+ </target>
+ </configuration>
+ </execution>
+
+ <!-- Step 4: start Derby, provision and start TomEE, seed the DB
+ schema, start the embedded LDAP server, then deploy the test
+ WARs through the TCK's tomcat handler. -->
+ <execution>
+ <id>start-servers-and-deploy</id>
+ <phase>pre-integration-test</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <target xmlns:if="ant:if" xmlns:unless="ant:unless">
+ <!-- Derby jars into the TomEE lib so jdbc/securityAPIDB
+ resolves its client driver. -->
+ <copy todir="${tomee.home}/lib">
+ <fileset dir="${project.build.directory}/derby-lib" includes="derby*.jar"/>
+ </copy>
+
+ <!-- Shared harness configuration plus the security old-tck
+ tomee.xml that declares the jdbc/securityAPIDB datasource. -->
+ <copy todir="${tomee.home}/conf" overwrite="true">
+ <fileset dir="${maven.multiModuleProjectDirectory}/environment/tomee/conf"
+ includes="server.xml,system.properties,tomcat-users.xml"/>
+ </copy>
+ <copy file="${project.basedir}/src/test/resources/tomee.xml"
+ tofile="${tomee.home}/conf/tomee.xml" overwrite="true"/>
+ <replace file="${tomee.home}/conf/tomee.xml" token="@derby.port@" value="${tck.derby.port}"/>
+ <replace file="${tomee.home}/conf/server.xml" token="port="8005"" value="port="${tomee.shutdown.port}""/>
+ <replace file="${tomee.home}/conf/server.xml" token="port="8080"" value="port="${tomee.http.port}""/>
+ <replace file="${tomee.home}/conf/server.xml" token="8443" value="${tomee.https.port}"/>
+ <exec executable="sh" failonerror="true">
+ <arg value="${maven.multiModuleProjectDirectory}/environment/certificates/generate-test-certificates.sh"/>
+ <arg value="${tomee.home}/conf"/>
+ </exec>
+ <echo file="${tomee.home}/bin/setenv.sh">CATALINA_OPTS="-Xmx2g -XX:MaxMetaspaceSize=512m -Djava.awt.headless=true"
+</echo>
+ <chmod perm="ugo+x">
+ <fileset dir="${tomee.home}/bin" includes="*.sh"/>
+ </chmod>
+
+ <!-- Purge any securityapi_* test webapps left in the reused
+ TomEE by a previous run so the tomcat handler's deploy.all
+ starts from a clean estate (its undeploy step otherwise
+ waits on dozens of stale exploded dirs and times out). -->
+ <delete quiet="true" includeemptydirs="true">
+ <fileset dir="${tomee.home}/webapps" includes="securityapi_*/**"/>
+ <fileset dir="${tomee.home}/webapps" includes="securityapi_*"/>
+ <fileset dir="${tomee.home}/webapps" includes="securityapi_*.war"/>
+ </delete>
+
+ <!-- Full Derby classpath (the engine jar carries the classes
+ NetworkServerControl's ping/shutdown clients need). -->
+ <pathconvert property="derby.classpath" pathsep="${path.separator}">
+ <fileset dir="${project.build.directory}/derby-lib" includes="derby*.jar"/>
+ </pathconvert>
+
+ <!-- Fail fast if the Derby port is already bound. -->
+ <exec executable="sh" failonerror="true">
+ <arg value="${maven.multiModuleProjectDirectory}/environment/database/require-derby-port-free.sh"/>
+ <arg value="${java.home}/bin/java"/>
+ <arg value="${derby.classpath}"/>
+ <arg value="${tck.derby.port}"/>
+ </exec>
+ <!-- Start the Derby network server. -->
+ <java classname="org.apache.derby.drda.NetworkServerControl" fork="true" spawn="true">
+ <classpath>
+ <fileset dir="${project.build.directory}/derby-lib" includes="derby*.jar"/>
+ </classpath>
+ <sysproperty key="derby.system.home" value="${project.build.directory}/derby"/>
+ <sysproperty key="derby.drda.portNumber" value="${tck.derby.port}"/>
+ <arg value="start"/>
+ <arg value="-h"/><arg value="localhost"/>
+ <arg value="-noSecurityManager"/>
+ </java>
+ <exec executable="sh" failonerror="true">
+ <arg value="${maven.multiModuleProjectDirectory}/environment/database/wait-for-derby.sh"/>
+ <arg value="${java.home}/bin/java"/>
+ <arg value="${derby.classpath}"/>
+ <arg value="${tck.derby.port}"/>
+ </exec>
+
+ <!-- Fail fast if any container port is already bound. -->
+ <exec executable="sh" failonerror="true">
+ <arg value="${maven.multiModuleProjectDirectory}/environment/tomee/require-tomee-ports-free.sh"/>
+ <arg value="${tomee.http.port}"/>
+ <arg value="${tomee.https.port}"/>
+ <arg value="${tomee.shutdown.port}"/>
+ </exec>
+
+ <exec executable="${tomee.home}/bin/catalina.sh" failonerror="true">
+ <arg value="start"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ </exec>
+ <waitfor maxwait="180" maxwaitunit="second" timeoutproperty="tomee.start.timeout">
+ <socket server="localhost" port="${tomee.http.port}"/>
+ </waitfor>
+ <fail message="TomEE did not open port ${tomee.http.port} within 180s">
+ <condition><isset property="tomee.start.timeout"/></condition>
+ </fail>
+ <waitfor maxwait="60" maxwaitunit="second" timeoutproperty="tomee.connector.timeout">
+ <resourcecontains resource="${tomee.home}/logs/catalina.out"
+ substring="Starting ProtocolHandler ["http-nio-${tomee.http.port}"]"/>
+ </waitfor>
+ <fail message="Started TomEE did not report its HTTP connector on port ${tomee.http.port}; see ${tomee.home}/logs/catalina.out">
+ <condition><isset property="tomee.connector.timeout"/></condition>
+ </fail>
+
+ <!-- Seed the DatabaseIdentityStore schema and start the
+ harness' embedded UnboundID LDAP server (ldap://localhost:11389). -->
+ <exec executable="${tck.ant.home}/bin/ant" dir="${tck.home}/bin" failonerror="true">
+ <arg value="-Dutil.dir=${tck.home}"/>
+ <arg value="init.derby"/>
+ <env key="ANT_HOME" value="${tck.ant.home}"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ </exec>
+ <exec executable="${tck.ant.home}/bin/ant" dir="${tck.home}/bin" failonerror="true">
+ <arg value="-Dutil.dir=${tck.home}"/>
+ <arg value="init.ldap"/>
+ <env key="ANT_HOME" value="${tck.ant.home}"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ </exec>
+
+ <!-- Deploy a single test directory... -->
+ <sequential if:set="tck.test">
+ <exec executable="${tck.ant.home}/bin/ant" dir="${tck.home}/src/${tck.test}" failonerror="true">
+ <arg value="-Dutil.dir=${tck.home}"/>
+ <arg value="deploy"/>
+ <env key="ANT_HOME" value="${tck.ant.home}"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ </exec>
+ </sequential>
+ <!-- ...or everything. -->
+ <sequential unless:set="tck.test">
+ <exec executable="${tck.ant.home}/bin/ant" dir="${tck.tests.home}" failonerror="true">
+ <arg value="-Dutil.dir=${tck.home}"/>
+ <arg value="deploy.all"/>
+ <env key="ANT_HOME" value="${tck.ant.home}"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ </exec>
+ </sequential>
+ </target>
+ </configuration>
+ </execution>
+
+ <!-- Step 5: run JavaTest. The exit code is checked after the
+ containers have been stopped (verify phase). -->
+ <execution>
+ <id>run-tck</id>
+ <phase>integration-test</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <exportAntProperties>true</exportAntProperties>
+ <target xmlns:if="ant:if" xmlns:unless="ant:unless">
+ <exec executable="${tck.ant.home}/bin/ant" dir="${tck.home}/bin" resultproperty="tck.run.result">
+ <arg value="-Dutil.dir=${tck.home}"/>
+ <arg value="-Dmultiple.tests=${tck.test}" if:set="tck.test"/>
+ <arg value="runclient" if:set="tck.test"/>
+ <arg value="run.all" unless:set="tck.test"/>
+ <env key="ANT_HOME" value="${tck.ant.home}"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ <env key="LC_ALL" value="C"/>
+ </exec>
+ <echo message="JavaTest finished with exit code ${tck.run.result}"/>
+ <echo message="Report: ${project.build.directory}/securityreport/security"/>
+ </target>
+ </configuration>
+ </execution>
+
+ <!-- Step 6: always stop the containers. -->
+ <execution>
+ <id>stop-servers</id>
+ <phase>post-integration-test</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <target>
+ <exec executable="${tomee.home}/bin/catalina.sh" failonerror="false">
+ <arg value="stop"/>
+ <env key="JAVA_HOME" value="${java.home}"/>
+ </exec>
+ <java classname="org.apache.derby.drda.NetworkServerControl" fork="true" failonerror="false">
+ <classpath>
+ <fileset dir="${project.build.directory}/derby-lib" includes="derby*.jar"/>
+ </classpath>
+ <sysproperty key="derby.drda.portNumber" value="${tck.derby.port}"/>
+ <arg value="shutdown"/>
+ <arg value="-h"/><arg value="localhost"/>
+ </java>
+ </target>
+ </configuration>
+ </execution>
+
+ <!-- Step 7: a default run is expected green; surface a JavaTest
+ failure as a build failure. -->
+ <execution>
+ <id>verify-tck-result</id>
+ <phase>verify</phase>
+ <goals><goal>run</goal></goals>
+ <configuration>
+ <skip>${tck.standalone.skip}</skip>
+ <target>
+ <fail message="JavaTest finished with exit code ${tck.run.result}; see ${project.build.directory}/securityreport/security">
+ <condition>
+ <not><equals arg1="${tck.run.result}" arg2="0"/></not>
+ </condition>
+ </fail>
+ </target>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+</project>
diff --git a/runner-standalone/security-old/src/test/resources/tomee.xml b/runner-standalone/security-old/src/test/resources/tomee.xml
new file mode 100644
index 0000000..293c972
--- /dev/null
+++ b/runner-standalone/security-old/src/test/resources/tomee.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Test-only TomEE resources for the Jakarta Security 4.0 legacy JavaTest
+ old-tck. The DatabaseIdentityStore tree looks up jdbc/securityAPIDB; the
+ runner pom substitutes @derby.port@ while staging the overlay and the
+ harness' init.derby task seeds the caller/caller_groups schema into the
+ same derbyDB database. -->
+<openejb>
+ <Resource id="jdbc/securityAPIDB" type="DataSource">
+ JdbcDriver org.apache.derby.jdbc.ClientDriver
+ JdbcUrl jdbc:derby://localhost:@derby.port@/derbyDB;create=true
+ UserName cts1
+ Password cts1
+ JtaManaged false
+ </Resource>
+</openejb>
(tomee-tck) 05/07: Merge branch 'ee11' into claude/tck-module-setup-check-0c52f9
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit 512aa8c19f35fff8ad86b2b9605cb2e4e1cae855
Merge: b8edfbe 848420b
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 10:55:01 2026 +0200
Merge branch 'ee11' into claude/tck-module-setup-check-0c52f9
# Conflicts:
# KNOWN_ISSUES.md
KNOWN_ISSUES.md | 37 +-
runner-standalone/README.md | 10 +-
runner-standalone/exclusions/README.md | 6 +-
runner-standalone/exclusions/security-old.txt | 18 +
runner-standalone/pom.xml | 1 +
runner-standalone/run-standalone-suite.sh | 6 +-
runner-standalone/security-old/pom.xml | 488 +++++++++++++++++++++
.../security-old/src/test/resources/tomee.xml | 15 +
8 files changed, 560 insertions(+), 21 deletions(-)
diff --cc KNOWN_ISSUES.md
index 19d7236,2f120fe..257c732
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@@ -38,9 -38,10 +38,10 @@@ Detail lives next to each runner
| jsonb | 295 tests, 1 F + 1 E | 2 tests | 2 Johnzon 2.1.0 gaps |
| debugging | passes (4 SMAPs validated) | — | — |
| security | 132 tests, 5 F + 2 E; signature test passes | 7 tests | TomEE Jakarta Security |
+ | security-old (JavaTest) | 83 tests, 82 pass, 1 F | 1 test | TomEE `SecurityContext.hasAccessToWebResource()` returns false for an authorized caller |
| authentication | 106 tests, 1 F; signature test passes | 1 method (spi `CheckMsgInfoKey`) | TCK challenge #219 (hard-codes a JACC requirement) |
| websocket | 737 tests, 3 E | 3 methods | Client container advertises permessage-deflate in the negotiated extension lists |
-| faces (modern modules) | 327 tests, 45 F + 6 E (failsafe reruns inflate the counts; 10 distinct failing classes) | 10 classes | 1 TomEE faces-config gap + Mojarra/TomEE CDI-injection, whole-bean/method validation, and one Chrome ajax quirk |
+| faces (modern modules + old-tck-selenium) | 298 tests, 0 F + 0 E, 17 skipped (with exclusions applied) | 10 classes | 1 TomEE faces-config gap + Mojarra/TomEE CDI-injection, whole-bean/method validation, and one Chrome ajax quirk |
| faces-old (JavaTest) | 5,391 tests, all pass (recorded run: 5 F from a foreign server answering :8080 mid-run; pass on re-run) | — | — (standalone mode, no exclusions) |
| faces-signaturetest | passes against Plume's Mojarra (org.glassfish:jakarta.faces 4.1.9) | — | — |
@@@ -248,10 -259,18 +259,14 @@@ Need triage/fixes in the upstream proje
Not product bugs — gaps in this repository's coverage.
- **Modern faces reactor not in CI**: the `faces` runner (modern Arquillian
- modules plus the signature test) runs locally via
- `run-standalone-suite.sh`; it joins the Jenkins branch list once its
- baseline and exclusion wiring have a verified green run. The `faces-old`
- JavaTest half runs in CI.
-- **Faces `old-tck-selenium` module uncovered**: the extracted TCK reactor
- ships an `old-tck-selenium` module (22 tests) that neither the `faces`
- runner (which drives faces22/23/40/41 + faces-signaturetest) nor the
- `faces-old` JavaTest runner executes; wire it into one of them.
+ modules, the Chrome/Selenium `old-tck-selenium` modules, and the signature
+ test) runs locally via `run-standalone-suite.sh`; it joins the Jenkins
+ branch list once its baseline and exclusion wiring have a verified green
+ run. The `faces-old` JavaTest half runs in CI.
+ - **Security `security-old` not in CI**: the `security-old` runner (the
+ reactor's legacy JavaTest `com.sun.ts.tests.securityapi` suite) runs
+ locally via `run-standalone-suite.sh` and is green with the reviewed
+ exclusion; it joins the Jenkins branch list once its baseline has settled.
## What CI runs
diff --cc runner-standalone/README.md
index 13017d0,243b163..b920ec9
--- a/runner-standalone/README.md
+++ b/runner-standalone/README.md
@@@ -59,9 -60,10 +60,10 @@@ derived from; with the default exclusio
| Pages 4.0 | EFTL zip (installed as `jakarta.tck:jakarta-pages-tck:4.0.0`) | `pages` | **Passes 682/682 (0 failures, 0 errors, signature test included, no exclusions)** (2026-07-18). Needs the Central `jakarta.tck:common`/`signaturetest` support line at 11.1.1 with sigtest 2.6 (the TCK pom's own pins depend on the unpublished JavaTest harness), and the overlay removes TomEE's global UTF-8 default encodings from conf/web.xml because the TCK asserts the spec default ISO-8859-1. Its TomEE [...]
| Validation 3.1 | EFTL zip (installed as `jakarta.validation:validation-tck-tests:3.1.1`) | `validation` | **Runs: 1,049 tests, 0 failures, no exclusions; the mandatory API signature test runs and passes** against the `jakarta.validation` packages the Plume distribution ships. Needs AssertJ 3.7.0 pinned (the published TCK jar is compiled against its covariant signatures) and the JAXB RI pinned as `jakarta.xml.bind.JAXBContextFactory` in the server JVM (Plume ships both MOXy and the RI; [...]
| WebSocket 2.2 | EFTL zip (installed as `jakarta.tck:websocket-tck-spec-tests:2.2.0`) | `websocket` | **Runs: 737 tests, 0 failures, 3 errors** (2026-07-18) against Tomcat's WebSocket implementation, driven through the `tomcat-websocket` client container; the signature test passes. The negative-deployment classes run and pass: an invalid server endpoint aborts the whole webapp deployment as the spec requires, and the runner's Arquillian extension (`NegativeDeploymentToleranceObserver`) [...]
- | Security 4.0 | Source reactor zip 4.0.1 | `security` (Maven module) | **Runs: 26 app modules plus the signature test, 132 tests, 5 failures, 2 errors at baseline; green with the reviewed exclusions (all 27 invoker projects pass, verified end-to-end 2026-07-18)**. The runner downloads and patches the reactor, injects a tomee-remote profile (including the `trustStore.path`/`trustStore.password` properties the OpenID modules' keytool steps read), and drives every module through the Maven [...]
+ | Security 4.0 | Source reactor zip 4.0.1 | `security` (Maven module) | **Runs: 26 app modules plus the signature test, 132 tests, 5 failures, 2 errors at baseline; green with the reviewed exclusions (all 27 invoker projects pass, verified end-to-end 2026-07-18)**. The runner downloads and patches the reactor, injects a tomee-remote profile (including the `trustStore.path`/`trustStore.password` properties the OpenID modules' keytool steps read), and drives every module through the Maven [...]
+ | Security 4.0 (legacy old-tck) | Source reactor zip 4.0.1 (old-tck built from bundled sources) | `security-old` (Maven module) | **Baseline 83 tests, 82 pass, 1 failure (Plume, JDK 21, 2026-07-19); green with the reviewed exclusion.** The legacy JavaTest half exercises ~65 `com.sun.ts.tests.securityapi` Client classes across the idstore (in-war, database, LDAP), ham (HTTP authentication mechanism) and securitycontext trees. It deploys through the TCK's own `tomcat` handler (WAR copy in [...]
| Authentication 3.1 | Source reactor zip 3.1.2 | `authentication` (Maven module) | **Runs: 12 Web Profile modules plus the signature test; green with the reviewed exclusions (all 13 invoker projects pass, 0 failures, verified end-to-end 2026-07-18)**. The spi module registers the TCK's test `AuthConfigProvider` under Tomcat's JASPIC app-context naming (`Catalina/localhost /spitests_servlet_web`), so `ServletProfileSPITest` runs against Tomcat's `AuthConfigFactory` and passes 56 of its [...]
-| Faces 4.1 | Source reactor zip 4.1.2 | `faces` (Maven module) | **Runs: modern Arquillian modules (faces22/23/40/41) — 327 tests, 45 failures + 6 errors** (2026-07-18) on Plume's Mojarra; the failsafe rerun mechanism inflates those totals, covering 10 distinct failing classes, all in `exclusions/faces.txt`. One is a TomEE product gap (faces-config.xml unmarshaller rejecting the nonstandard *https* `xsi:schemaLocation`, `Spec1760IT`); the rest are Mojarra/TomEE integration behaviors — [...]
+| Faces 4.1 | Source reactor zip 4.1.2 | `faces` (Maven module) | **Runs: modern Arquillian modules (faces22/23/40/41) plus the Chrome/Selenium `old-tck-selenium` modules (ajax, commandLink, protectedViews) — 298 tests, 0 failures, 0 errors, 17 skipped** on Plume's Mojarra, with `exclusions/faces.txt` applied. The 10 excluded classes are one TomEE product gap (faces-config.xml unmarshaller rejecting the nonstandard *https* `xsi:schemaLocation`, `Spec1760IT`) and Mojarra/TomEE integratio [...]
| Faces 4.1 (legacy old-tck) | Source reactor zip 4.1.2 (old-tck built from bundled sources) | `faces-old` (Maven module) | **Passes 5,391/5,391 (standalone mode, no exclusions)** (2026-07-18). The recorded full run shows 5 failures in `htmloutcometargetbutton`, all from a foreign server answering port 8080 mid-run; they pass on re-run against TomEE. The JavaTest half deploys through the TCK's own `tomcat` handler (WAR copy into `webapps/`) against a TomEE instance the runner provisions [...]
| JSON Processing 2.1 | `jakarta.json:jakarta.json-tck-*:2.1.1` (Maven Central; byte-identical to the EFTL zip pinned in `environment/versions.env`) | `jsonp` | **Passes 197/197** (2026-07-18) against Apache Johnzon 2.1.0, the JSON-P provider bundled in the TomEE Plume snapshot: 179 functional + signature tests and 18 pluggability tests. The signature test checks the `jakarta.json` packages of the distribution's `jakartaee-api` jar |
| JSON Binding 3.0 | `jakarta.json.bind:jakarta.json.bind-tck:3.0.0` (Maven Central; byte-identical to the EFTL zip pinned in `environment/versions.env`) | `jsonb` | **Runs: 295 tests, 1 failure, 1 error, 5 skipped** against Apache Johnzon 2.1.0 with OpenWebBeans as the CDI SE container (the runner boots it because the TCK's own private `@BeforeAll` bootstrap is ignored by JUnit). The runner sets `johnzon.use-bigdecimal-stringadapter=false`/`johnzon.use-biginteger-stringadapter=false` ( [...]
(tomee-tck) 07/07: Run the faces TCK suite in CI inside a Chrome-bundling container
Posted by ju...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch ee11
in repository https://gitbox.apache.org/repos/asf/tomee-tck.git
commit f2a4dabcaa84d7850106365af11f1f688c4828b9
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Jul 19 13:11:09 2026 +0200
Run the faces TCK suite in CI inside a Chrome-bundling container
The modern faces suite drives a real Chrome through Selenium in its
old-tck-selenium modules, so it cannot run on the bare JDK-tools
'ubuntu && ephemeral' agents that ship no browser. Add a facesBranch that
runs run-standalone-suite.sh faces inside markhobson/maven-chrome:jdk-21
(JDK 21, Maven 3.9.15, Chrome + chromedriver 147 on Ubuntu 24.04), pinned
by digest like the repo's other inputs. checkout/archive/junit/deleteDir
stay on the node around the container; inside it the image's own JDK is
used, Maven's local repo is left at the container default (fresh per
build, torn down with the container), and --shm-size=2g gives headless
Chrome enough shared memory since the TCK driver does not set
--disable-dev-shm-usage. The faces branch gets a 300-minute timeout.
Verified: the suite runs green in the container (verify-invoker-result
OK, 6 modules, 0 failures, 0 errors), with the Selenium/Chrome ITs
executing and passing.
---
Jenkinsfile | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++----
KNOWN_ISSUES.md | 42 ++++++++++++++++--------------------
2 files changed, 81 insertions(+), 28 deletions(-)
diff --git a/Jenkinsfile b/Jenkinsfile
index a750ca6..33cf9e1 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -154,10 +154,11 @@ from xml.etree import ElementTree
// an in-process UnboundID LDAP server on 11389), builds its old-tck
// bundle from source on the first run, and lands its JavaTest report
// in the target/*report glob so a red run fails the Maven build.
- // The modern faces reactor stays workstation-only: its
- // old-tck-selenium modules drive Chrome through Selenium, and the ASF
- // 'ubuntu && ephemeral' agents ship no browser binary (a JDK-tools
- // agent, not a docker-image agent that could bundle one).
+ // The modern faces reactor's old-tck-selenium modules drive Chrome
+ // through Selenium, and the ASF 'ubuntu && ephemeral' agents ship no
+ // browser binary, so its branch runs the suite inside a
+ // Chrome-bundling container (see facesBranch below) instead of on the
+ // bare JDK-tools agent the other standalone suites use.
// See runner-standalone/README.md and KNOWN_ISSUES.md.
def standaloneBranch = { String id, int timeoutMinutes ->
{
@@ -188,6 +189,58 @@ from xml.etree import ElementTree
}
}
}
+ // The modern faces suite (298 tests) needs a Chrome binary its
+ // old-tck-selenium modules drive through Selenium, so its branch runs
+ // run-standalone-suite.sh inside a container that bundles JDK 21,
+ // Maven, and a matching Chrome/chromedriver pair. Pinned by digest
+ // like the rest of the repo's inputs: markhobson/maven-chrome:jdk-21
+ // ships Temurin JDK 21, Maven 3.9.15, and Chrome + chromedriver
+ // 147 on Ubuntu 24.04 (so Selenium Manager resolves the driver
+ // offline). checkout/archive/junit/deleteDir stay on the node, around
+ // the container. Inside the container we use the image's JDK (its own
+ // JAVA_HOME=/opt/java/openjdk), never the host tool(...) install. The
+ // runner leaves Maven's local repo at the container default: docker
+ // .inside() runs a fresh container per build, so ~/.m2 is populated
+ // from scratch and discarded with the container - the faces runner's
+ // nested install-tck-util/invoker steps must all share one repo, so an
+ // override would only split them apart. --shm-size=2g gives headless
+ // Chrome enough shared memory: the TCK's ChromeDevtoolsDriver sets
+ // --headless=new --no-sandbox --disable-gpu but not
+ // --disable-dev-shm-usage, so the default 64 MB /dev/shm would crash
+ // the renderer.
+ def facesImage =
+ 'markhobson/maven-chrome@sha256:90b0a104dd7236b5fcef71c342e4f6392fb204a4df030fad4bbf4c7990aaee00'
+ def facesBranch = { int timeoutMinutes ->
+ {
+ stage('standalone - faces') {
+ node('ubuntu && ephemeral') {
+ deleteDir()
+ checkout scm
+
+ try {
+ timeout(time: timeoutMinutes, unit: 'MINUTES') {
+ docker.image(facesImage).inside('--shm-size=2g') {
+ withEnv(['JAVA_HOME=/opt/java/openjdk',
+ 'PATH+JDK=/opt/java/openjdk/bin']) {
+ sh 'runner-standalone/run-standalone-suite.sh faces'
+ }
+ }
+ }
+ } finally {
+ archiveArtifacts(
+ artifacts: 'runner-standalone/*/target/surefire-reports/**/*,runner-standalone/*/target/failsafe-reports/**/*,runner-standalone/*/target/**/tck/**/surefire-reports/**/*,runner-standalone/*/target/**/tck/**/failsafe-reports/**/*,runner-standalone/*/target/**/logs/**/*,runner-standalone/*/target/*report/**/*',
+ allowEmptyArchive: true
+ )
+ junit(
+ testResults: 'runner-standalone/*/target/surefire-reports/TEST-*.xml,runner-standalone/*/target/failsafe-reports/TEST-*.xml,runner-standalone/*/target/**/tck/**/surefire-reports/TEST-*.xml,runner-standalone/*/target/**/tck/**/failsafe-reports/TEST-*.xml',
+ allowEmptyResults: true
+ )
+ deleteDir()
+ }
+ }
+ }
+ }
+ }
// security-old shares the plain 240-minute default: even with the
// one-off old-tck source build it runs only ~83 JavaTest tests
// (~65 client classes), far below the faces-old sizing that earns
@@ -199,6 +252,12 @@ from xml.etree import ElementTree
// 245-webapp deployment: a full run takes ~2.5 h on a warm
// workstation, so give it more headroom than the other suites.
branches['standalone - faces-old'] = standaloneBranch('faces-old', 420)
+ // The modern faces reactor takes ~45-60 min on a warm workstation
+ // (TCK download, provision, 298 Selenium/Arquillian/sigtest tests).
+ // A cold CI node also pulls the browser image and repopulates the
+ // container-local Maven repo from scratch, so 300 minutes leaves
+ // ample headroom over the observed runtime.
+ branches['standalone - faces'] = facesBranch(300)
parallel branches
}
diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md
index 37ccc2c..cb774ba 100644
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@ -258,20 +258,7 @@ Need triage/fixes in the upstream projects TomEE ships.
Not product bugs — gaps in this repository's coverage.
-- **Modern faces reactor stays workstation-only**: the `faces` runner (modern
- Arquillian modules, the signature test, and the Chrome/Selenium
- `old-tck-selenium` modules) is green with `exclusions/faces.txt`, but its
- `old-tck-selenium` modules drive a real Chrome through Selenium. The TCK's
- `BaseITNG`/`ChromeDevtoolsDriver` runs headless by default (`--headless=new`,
- `--no-sandbox`) and lets Selenium Manager resolve `chromedriver`, but Selenium
- Manager still needs a Chrome/Chromium browser binary on the machine. The ASF
- `ubuntu && ephemeral` agents the Jenkinsfile targets are JDK-tools agents with
- no browser installed; ASF's own pattern for browser-driven CI is to run inside
- a Docker image that bundles the browser (e.g. `apache/incubator-kie-tools`),
- which this pipeline does not use. So `faces` runs locally via
- `run-standalone-suite.sh`; only a browser on the build agent (or a
- browser-bundling container image) would let it join CI. The `faces-old`
- JavaTest half needs no browser and runs in CI.
+_None outstanding._
## What CI runs
@@ -280,17 +267,24 @@ Platform catalog on Plume plus `persistence-javatest` on the webprofile ZIP,
and the standalone suites `annotations`, `di`, `el`, `concurrency`, `data`,
`servlet`, `pages`, `rest`, `validation`, `websocket`, `jsonp`, `jsonb`,
`debugging`, `persistence`, `transactions`, `cdi`, `cdi-ee`, `security`,
-`security-old`, `authentication`, `faces-old` — all with default exclusions,
-all expected green. Each runner fails its own build on a red result through a
-`verify-tck-result` step: the JavaTest runners (`faces-old`, `security-old`,
-`transactions`) check the harness exit code, and the invoker-driven source
-reactors (`security`, `authentication`, `faces`) aggregate the inner
-surefire/failsafe reports and fail on any failure, error, or module that built
-but never ran its tests. The `junit`/archive globs also
+`security-old`, `authentication`, `faces`, `faces-old` — all with default
+exclusions, all expected green. Each runner fails its own build on a red result
+through a `verify-tck-result` step: the JavaTest runners (`faces-old`,
+`security-old`, `transactions`) check the harness exit code, and the
+invoker-driven source reactors (`security`, `authentication`, `faces`) aggregate
+the inner surefire/failsafe reports and fail on any failure, error, or module
+that built but never ran its tests. The `junit`/archive globs also
ingest the surefire/failsafe reports inside the extracted TCK reactors that
the source-reactor runners drive through the Maven invoker, plus the
JavaTest report directories (`security-old` and `faces-old` write theirs to
`target/securityreport/**` and `target/facesreport/**`, matched by the
-`target/*report/**` archive glob). The modern `faces` reactor stays
-workstation-only because its `old-tck-selenium` modules need a browser the ASF
-agents do not provide (see Harness work remaining).
+`target/*report/**` archive glob).
+
+The modern `faces` branch runs its suite inside a container that bundles JDK 21,
+Maven, and a matching Chrome/chromedriver pair
+(`markhobson/maven-chrome:jdk-21`, pinned by digest in the `Jenkinsfile`),
+because its `old-tck-selenium` modules drive a real Chrome through Selenium and
+the ASF `ubuntu && ephemeral` agents ship no browser binary. The container runs
+with `--shm-size=2g` so headless Chrome has enough shared memory. The
+`faces-old` JavaTest half needs no browser and runs on the bare JDK-tools agent
+like the other suites.