You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Rémy Maucherat <re...@apache.org> on 2026/07/03 08:27:48 UTC
[VOTE] Release Apache Tomcat 9.0.120
The proposed Apache Tomcat 9.0.120 release is now available for voting.
The notable changes compared to 9.0.119 are:
- Correcting a regression that broke integration with jsvc
- Correcting a regression that broke re-use of tag files
- Align DIGEST authentication with RFC 7616 and require clients to
provide a valid qop parameter.
For full details, see the changelog:
https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
It can be obtained from:
https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.120/
The Maven staging repo is:
https://repository.apache.org/content/repositories/orgapachetomcat-1598
The tag is:
https://github.com/apache/tomcat/tree/9.0.120
8fc613dd46061308028b75ed99571db00b9db4e0
The proposed 9.0.120 release is:
[ ] -1, Broken - do not release
[ ] +1, Stable - go ahead and release as 9.0.120
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.120
Posted by Mark Thomas <ma...@apache.org>.
On 03/07/2026 09:27, Rémy Maucherat wrote:
> The proposed 9.0.120 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.120
The build is cross-platform reproducible for the binary artefacts.
The source bundles contain what look like leftover directories from a
merge conflict. That breaks reproducibility for the source bundles.
Tests pass with:
- Linux with OpenSSL 3.0.13 (Ubuntu 24.04 LTS latest) and Tomcat Native
1.3.8
- MacOS with OpenSSL 3.6.3 (Homebrew latest) and Tomcat Native 1.3.8
- Windows with Tomcat Native 1.3.8 (includes OpenSSL 3.0.21)
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.120
Posted by Rainer Jung <ra...@kippdata.de>.
Am 03.07.26 um 10:27 schrieb Rémy Maucherat:
> The proposed Apache Tomcat 9.0.120 release is now available for voting.
>
> The notable changes compared to 9.0.119 are:
>
> - Correcting a regression that broke integration with jsvc
>
> - Correcting a regression that broke re-use of tag files
>
> - Align DIGEST authentication with RFC 7616 and require clients to
> provide a valid qop parameter.
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.120/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1598
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.120
> 8fc613dd46061308028b75ed99571db00b9db4e0
>
> The proposed 9.0.120 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.120
+1 to release.
Reproducibility of the build checked (including the Windows installer)
using "ant verify-release" on Linux Mint 22.3. OK after setting LANG.
Original Windows installer signature verified with osslsigncode 2.10.
Unit tests ran on platforms
- RHEL 7, 8, 9 and 10 and SLES 12 and 15
using
- recent patch versions of JDK 1.8.0, 11, 17, 21, 25, 26 and 27+28 (EA)
from
- Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat and from
OpenJDK for 27
where available.
Also tested with
- tcnative 1.3.8, 2.0.15 and panama
based on
- OpenSSL 3.5.7, 3.6.3 and 4.0.1 (only for tcnative 2 and panama)
Each combination of platform, JVM and JSSE or tcnative or panama only
tested for NIO or NIO2 (randomized). Total number of test combinations:
91 nio2 jsse
98 nio2 panama
247 nio2 tcnative
165 nio2 tcnative-1.3.8
81 nio jsse
79 nio panama
267 nio tcnative
177 nio tcnative-1.3.8
SLES 12 ongoing due to a late start on that platform
Test observations:
- IMHO nothing critical
- in addition
- one crash failure with JSSE (1 in 172 runs)
- very few crashes with tcnative (5 in 514 runs)
- no crash failures with panama (177 runs)
- very few non-crash failures with jsse (9 in 172 runs)
- very few non-crash failures with tcnative (6 in 514 runs)
- no non-crash failures with panama (177 runs)
Thanks for RM!
Best regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.120
Posted by Igal Sapir <is...@apache.org>.
Rémy,
On Fri, Jul 3, 2026 at 1:28 AM Rémy Maucherat <re...@apache.org> wrote:
> The proposed Apache Tomcat 9.0.120 release is now available for voting.
>
> The notable changes compared to 9.0.119 are:
>
> - Correcting a regression that broke integration with jsvc
>
> - Correcting a regression that broke re-use of tag files
>
> - Align DIGEST authentication with RFC 7616 and require clients to
> provide a valid qop parameter.
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.120/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1598
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.120
> 8fc613dd46061308028b75ed99571db00b9db4e0
>
> The proposed 9.0.120 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.120
>
Build is reproducible and unit tests pass on Ubuntu 24.04 with Java 21
Igal
>
> Rémy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
[RESULT][VOTE] Release Apache Tomcat 9.0.120
Posted by Rémy Maucherat <re...@apache.org>.
The following votes were cast:
Binding:
+1: schultz, isapir, rjung, markt
The vote therefore passes.
Thanks to everyone who contributed to this release.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [VOTE] Release Apache Tomcat 9.0.120
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Rémy,
Thanks for RMing.
On 7/3/26 4:27 AM, Rémy Maucherat wrote:
> The proposed Apache Tomcat 9.0.120 release is now available for voting.
>
> The notable changes compared to 9.0.119 are:
>
> - Correcting a regression that broke integration with jsvc
>
> - Correcting a regression that broke re-use of tag files
>
> - Align DIGEST authentication with RFC 7616 and require clients to
> provide a valid qop parameter.
>
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
>
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.120/
>
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1598
>
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.120
> 8fc613dd46061308028b75ed99571db00b9db4e0
>
> The proposed 9.0.120 release is:
> [ ] -1, Broken - do not release
> [ ] +1, Stable - go ahead and release as 9.0.120
+1 for stable release.
The build is reproducible on MacOS aarch64 and all unit tests pass.
Details:
* Environment
* Java (build): openjdk version "25.0.3" 2026-04-21 LTS OpenJDK
Runtime Environment Temurin-25.0.3+9 (build 25.0.3+9-LTS) OpenJDK 64-Bit
Server VM Temurin-25.0.3+9 (build 25.0.3+9-LTS, mixed mode, sharing)
* Java (test): openjdk version "25.0.3" 2026-04-21 LTS OpenJDK
Runtime Environment Temurin-25.0.3+9 (build 25.0.3+9-LTS) OpenJDK 64-Bit
Server VM Temurin-25.0.3+9 (build 25.0.3+9-LTS, mixed mode, sharing)
* Ant: Apache Ant(TM) version 1.10.17 compiled on April 6 2026
* OS: Darwin 25.3.0 arm64
* cc: Apple clang version 21.0.0 (clang-2100.1.1.101)
* make: GNU Make 3.81
* OpenSSL: OpenSSL 3.6.2 7 Apr 2026 (Library: OpenSSL 3.6.2 7
Apr 2026)
* APR: 1.7.6
*
* Valid SHA-512 signature for apache-tomcat-9.0.120.zip
* Valid GPG signature for apache-tomcat-9.0.120.zip
* Valid SHA-512 signature for apache-tomcat-9.0.120.tar.gz
* Valid GPG signature for apache-tomcat-9.0.120.tar.gz
* Valid SHA-512 signature for apache-tomcat-9.0.120.exe
* Valid GPG signature for apache-tomcat-9.0.120.exe
* Valid Windows Digital Signature for apache-tomcat-9.0.120.exe
* Valid SHA512 signature for apache-tomcat-9.0.120-src.zip
* Valid GPG signature for apache-tomcat-9.0.120-src.zip
* Valid SHA512 signature for apache-tomcat-9.0.120-src.tar.gz
* Valid GPG signature for apache-tomcat-9.0.120-src.tar.gz
*
* Binary Zip and tarball: Same
* Source Zip and tarball: Same
*
* Building dependencies returned: 0
* Tomcat builds cleanly
* tcnative builds cleanly
* Junit Tests: PASSED
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org