Re: Vestige (once again)

[Mark Thomas <ma...@apache.org>]

If there are changes you'd like to see (or think are required) then best 
to open a BZ issue or a PR for each change. Things posted to the mailing 
list tend to get lost of they aren't addressed within a couple of days.

Mark


On 26/12/2021 10:02, Gaël Lalire wrote:
> Hello Tomcat developers,
> 
> I present to you Vestige (https://gaellalire.fr/vestige) once again, as it is now able to share dependencies between wars and I know which parts of Tomcat can be improved.
> 
> It is an installer and updater (like yum or apt-get) for Java server applications and also a launcher (like systemd) which limits permission per application and can share classloaders between applications.
> 
> You don’t need to create another assembly for Vestige, if your application is distributed only via Vestige you don’t need any assembly at all. The assembly is never created, it uses Maven repositories and its pom dependencies to create shared (or unshared) classloaders.
> 
> Tomcat is not using a lot of external dependencies, however it is loading war which can have a lot of dependencies. So I’ve created an API (https://github.com/vestige-java/vestige.spi.resolver.maven/blob/master/src/main/java/fr/gaellalire/vestige/spi/resolver/maven/VestigeMavenResolver.java) which allows Tomcat to load a war from a Maven repository and patched Tomcat (https://github.com/vestige-java-app/tomcat_vestige) to use this API.
> 
> To understand what it can do, you can deploy in a single JVM a Tomcat and a TomEE and use the same classes between one ear in TomEE and one war in Tomcat.
> 
> In addition to dependency sharing we also want to avoid downloading the war dependency twice, so we don’t want the real war but the war without its dependencies. To achieve that, I created a plugin (https://github.com/gaellalire/jar_exploder_plugin) which remove dependencies from the war and attach it with a classifier, a usage example can be found at https://github.com/vestige-java-app/mywar/blob/80ea641805cca8bd2b252baf77ae16f730e75c6d/pom.xml#L73.
> 
> The last step is to avoid that the Maven repository (Nexus, Artifactory) keeps both artifact (war with and without dependencies) in its storage. To achieve that, we can generate the war with dependencies from the war without dependencies. FYI, it is done in https://github.com/gaellalire/maven_jar_exploder, and should be integrated in Nexus and/or Artifactory, not in Tomcat.
> 
> Thanks to org.apache.catalina.WebResourceSet and org.apache.tomcat.Jar abstractions, the patching is almost perfect.
> In Vestige you can load a classloader hierarchy with or without a verification metadata. If a verification metadata is provided, all jars are verified against a sha512 before any action on the classloader can be performed. After that, the classloader actions will always return same content (even if the jar is deleted from the file system). Tomcat needs to perform scanning operations which cannot be done through classloader, that’s why     fr.gaellalire.vestige.spi.resolver.AttachableClassLoader.getVestigeJarEnumeration() is returning a list of VestigeJar whose content is immutable when attached with a verification metadata. Then I map your org.apache.tomcat.Jar abstraction with my VestigeJar abstraction, all is verified.
> 
> However org.apache.catalina.webresources.CachedResource.CachedResourceJarURLConnection is not using org.apache.tomcat.Jar but directly java.util.jar.JarFile so the file is reopened without being reverified.
> Also in org.apache.jasper.compiler.Compiler Tomcat creates URL from string which is also an unverified operation. Maybe change JspServletWrapper.getDependants to Map<URL, Long> ?
> 
> After these two, not blocking but leading to unverified deployment, issues are fixed ; you still could improve the integration in Vestige without depending on it.
> 
> Vestige provides 3 directory to its apps : conf, data and cache. You could introduce and use a CATALINA_BASE_DATA and CATALINA_BASE_CACHE. The work directory should go in CATALINA_BASE_DATA if defined CATALINA_BASE else.
> 
> In the pom of jar using translations, add tomcat-i18n-* as optional dependencies. So I will only need to add these dependencies to the root project and not for every jar depending on translations.
> 
> Stop using mutable static fields, this prevents reusability of class, if done instead of loading in ATTACHMENT scope (unshared) it could be loaded in PLATFORM scope (shared).
> 
> Ideally, someone from you is hyped enough by classloader sharing that he (or she) wants to maintain https://github.com/vestige-java-app/tomcat_vestige.
> 
> Regards,
> 
> —————
> 
> Descriptors for Tomcat : https://gaellalire.fr/vestige/repository/tomcat/
> Descriptor for a war : https://github.com/vestige-java-app/tomcat_vestige/blob/master/full_installer/src/main/resources/org/apache/tomcat/vestige/full_installer/mywar.vwar
> 
> Descriptors for TomEE Web profile (still in beta) : https://gaellalire.fr/vestige/repository/tomee-web/
> Descriptor for an ear : https://github.com/vestige-java-app/tomee_vestige/blob/master/installer/src/main/resources/org/apache/tomee/vestige/installer/myeeapps-ear1.vear
> 
> 
> 
> 

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org