You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tomee.apache.org by ju...@apache.org on 2026/09/25 19:15:19 UTC
(tomee) branch main updated: TOMEE-4710 - drop tomee-patch-plugin from apache-tomee
This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new 9c8f8103a8 TOMEE-4710 - drop tomee-patch-plugin from apache-tomee
9c8f8103a8 is described below
commit 9c8f8103a8ad48c38ca965c2c455e2a4c7d94cc0
Author: Markus Jung <ju...@apache.org>
AuthorDate: Fri Sep 25 21:13:32 2026 +0200
TOMEE-4710 - drop tomee-patch-plugin from apache-tomee
It only repacked the bundled jars (stripping signatures and zip metadata) and regenerated the tar.gz the assembly already builds.
---
SECURITY.md | 2 +-
tomee/apache-tomee/pom.xml | 48 ----------------------------------------------
2 files changed, 1 insertion(+), 49 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md
index e7b95dd6dc..32b403b572 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -108,7 +108,7 @@ TomEE owns only its **integration code** — the wiring that exposes these libra
Reports of vulnerabilities in TomEE's integration code are accepted. Reports of vulnerabilities in the upstream library itself — independent of how TomEE wires it in — are out of scope; they should be reported to the upstream project's security contact.
-**TomEE-modified library code is in scope.** TomEE does not ship all bundled libraries unmodified. Where TomEE forks an upstream class (e.g. the BCEL `ConstantPool`/`ConstantPoolGen` fork under `openejb.shade.*`, the patched Tomcat `ServerInfo`), plants a class in an upstream package to reach internals (e.g. `org.apache.bval.jsr.job.ConstraintValidators`, `org.apache.catalina.startup.OpenEJBContextConfig`), shades or relocates a library under TomEE coordinates (e.g. `commons-dbcp2-shade` [...]
+**TomEE-modified library code is in scope.** TomEE does not ship all bundled libraries unmodified. Where TomEE forks an upstream class (e.g. the BCEL `ConstantPool`/`ConstantPoolGen` fork under `openejb.shade.*`), plants a class in an upstream package to reach internals (e.g. `org.apache.bval.jsr.job.ConstraintValidators`, `org.apache.catalina.startup.OpenEJBContextConfig`), shades or relocates a library under TomEE coordinates (e.g. `commons-dbcp2-shade`, `taglibs-shade`), or transforms [...]
If you are unsure whether a finding is in TomEE's integration code or in the upstream library, send it to **security@apache.org** and the team will route it.
diff --git a/tomee/apache-tomee/pom.xml b/tomee/apache-tomee/pom.xml
index 7074ee322c..d104f4503f 100644
--- a/tomee/apache-tomee/pom.xml
+++ b/tomee/apache-tomee/pom.xml
@@ -586,30 +586,6 @@
</execution>
</executions>
</plugin>
- <plugin>
- <groupId>org.apache.tomee.patch</groupId>
- <artifactId>tomee-patch-plugin</artifactId>
- <configuration>
- <select>apache-tomee-(plus|plume|webprofile|microprofile).*\.zip</select>
- <skipTransform>true</skipTransform>
- <createTarGz>true</createTarGz>
- <skips>
- <jars>
- <bcpkix-jdk18on-1.84.jar>org.bouncycastle:bcpkix-jdk18on:jar:1.85</bcpkix-jdk18on-1.84.jar>
- <bcprov-jdk18on-1.84.jar>org.bouncycastle:bcprov-jdk18on:jar:1.85</bcprov-jdk18on-1.84.jar>
- <bcutil-jdk18on-1.84.jar>org.bouncycastle:bcutil-jdk18on:jar:1.85</bcutil-jdk18on-1.84.jar>
- </jars>
- </skips>
- </configuration>
- <executions>
- <execution>
- <goals>
- <goal>run</goal>
- </goals>
- <phase>package</phase>
- </execution>
- </executions>
- </plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
@@ -819,30 +795,6 @@
</execution>
</executions>
</plugin>
- <plugin>
- <groupId>org.apache.tomee.patch</groupId>
- <artifactId>tomee-patch-plugin</artifactId>
- <configuration>
- <select>apache-tomee-(plus|plume|webprofile|microprofile).*\.zip</select>
- <skipTransform>true</skipTransform>
- <createTarGz>true</createTarGz>
- <skips>
- <jars>
- <bcpkix-jdk18on-1.84.jar>org.bouncycastle:bcpkix-jdk18on:jar:1.84</bcpkix-jdk18on-1.84.jar>
- <bcprov-jdk18on-1.84.jar>org.bouncycastle:bcprov-jdk18on:jar:1.84</bcprov-jdk18on-1.84.jar>
- <bcutil-jdk18on-1.84.jar>org.bouncycastle:bcutil-jdk18on:jar:1.84</bcutil-jdk18on-1.84.jar>
- </jars>
- </skips>
- </configuration>
- <executions>
- <execution>
- <goals>
- <goal>run</goal>
- </goals>
- <phase>package</phase>
- </execution>
- </executions>
- </plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>