Update to 9.0.83

Resolves: rhbz#2243613 [Major Incident] CVE-2023-44487 tomcat
Resolves: rhbz#2244343 Wrong dbcp class in tomcat 9

sources

@@ -1 +1 @@
-SHA512 (apache-tomcat-9.0.71-src.tar.gz) = 0c62a5e526178e39c68717223ce2cb4a31096e5765b718639e4ba4bbf3d70ba28238cd1bb5cf74747f718b35baf98de32c7ee8a7ebd445c6191700070c1ca930
+SHA512 (apache-tomcat-9.0.83-src.tar.gz) = 28e112a9d01918434ad03c414058275bbc4e34be408c2cfe2d819c3a08cadc3c31920e279c5312529aa2f5abf1e002537012c5f06d43ba8894448afd5585c231

tomcat-9.0.conf

@@ -35,7 +35,7 @@ CATALINA_TMPDIR="/var/cache/tomcat/temp"
 #JAVA_OPTS="-Djava.library.path=/usr/lib"
 
 # Set default javax.sql.DataSource factory to apache commons one. See rhbz#1214381
-JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory"
+JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory"
 
 # You can change your tomcat locale here
 #LANG="en_US"

tomcat-build.patch

@@ -1,12 +1,19 @@
 diff -up ./res/bnd/build-defaults.bnd.orig ./res/bnd/build-defaults.bnd
---- ./res/bnd/build-defaults.bnd.orig	2020-07-13 13:47:01.229077747 -0400
-+++ ./res/bnd/build-defaults.bnd	2020-07-13 13:47:12.923095618 -0400
+--- res/bnd/build-defaults.bnd.orig     2023-10-16 11:23:04.752754202 +0800
++++ res/bnd/build-defaults.bnd  2023-10-16 11:23:29.931876910 +0800
 @@ -13,7 +13,7 @@
  # See the License for the specific language governing permissions and
  # limitations under the License.
 
 -Bundle-Version: ${version_cleanup;${version}}
 +Bundle-Version: ${version}
+ Bundle-License: https://www.apache.org/licenses/LICENSE-2.0.txt
 
  Specification-Title: Apache Tomcat
- Specification-Version: ${version.major.minor}
+@@ -36,4 +36,4 @@ X-Compile-Target-JDK: ${compile.release}
+
+ -removeheaders: DSTAMP,TODAY,TSTAMP
+
+-module.name: org.apache.${replace;${Bundle-Name};-;.}
+\ No newline at end of file
++module.name: org.apache.${replace;${Bundle-Name};-;.}

tomcat.spec

@@ -31,7 +31,7 @@
 %global jspspec 2.3
 %global major_version 9
 %global minor_version 0
-%global micro_version 71
+%global micro_version 83
 %global packdname apache-tomcat-%{version}-src
 %global servletspec 4.0
 %global elspec 3.0
@@ -80,7 +80,6 @@ Patch1:        %{name}-%{major_version}.%{minor_version}-tomcat-users-webapp.pat
 Patch2:        %{name}-build.patch
 Patch3:        %{name}-%{major_version}.%{minor_version}-catalina-policy.patch
 Patch4:        rhbz-1857043.patch
-Patch5:        %{name}-%{major_version}.%{minor_version}-JDTCompiler.patch
 Patch6:        %{name}-%{major_version}.%{minor_version}-bnd-annotation.patch
 
 BuildArch:     noarch
@@ -95,7 +94,7 @@ BuildRequires: aqute-bnd
 BuildRequires: aqute-bndlib
 BuildRequires: systemd
 
-Requires:      java-headless >= 1:1.8.0
+Requires:      (java-headless >= 1:1.8 or java-1.8.0-headless or java-11-headless or java-17-headless or java >= 1:1.8)
 Requires:      javapackages-tools
 Requires:      %{name}-lib = %{epoch}:%{version}-%{release}
 %if 0%{?fedora} || 0%{?rhel} > 7
@@ -185,13 +184,12 @@ The ROOT web application for Apache Tomcat.
 find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "*.gz" -o \
    -name "*.jar" -o -name "*.war" -o -name "*.zip" \) -delete
 
-%patch0 -p0
-%patch1 -p0
-%patch2 -p0
-%patch3 -p0
-%patch4 -p0
-%patch5 -p0
-%patch6 -p0
+%patch 0 -p0
+%patch 1 -p0
+%patch 2 -p0
+%patch 3 -p0
+%patch 4 -p0
+%patch 6 -p0
 
 # Remove webservices naming resources as it's generally unused
 %{__rm} -rf java/org/apache/naming/factory/webservices
@@ -328,6 +326,8 @@ pushd ${RPM_BUILD_ROOT}%{libdir}
     %{__ln_s} ../../java/%{name}-servlet-%{servletspec}-api.jar .
     %{__ln_s} ../../java/%{name}-el-%{elspec}-api.jar .
     %{__ln_s} $(build-classpath ecj/ecj) jasper-jdt.jar
+
+    %{__cp} -a ../../%{name}/bin/tomcat-juli.jar .
 popd
 
 # symlink to the FHS locations where we've installed things
@@ -343,7 +343,7 @@ popd
 # Install the maven metadata for the spec impl artifacts as other projects use them
 #%{__install} -d -m 0755 ${RPM_BUILD_ROOT}%{_mavenpomdir}
 pushd res/maven
-    for pom in tomcat-el-api.pom tomcat-jsp-api.pom tomcat-servlet-api.pom; do
+    for pom in *.pom; do
         # fix-up version in all pom files
         sed -i 's/@MAVEN.DEPLOY.VERSION@/%{version}/g' $pom
     done
@@ -353,6 +353,49 @@ popd
 %mvn_artifact res/maven/tomcat-el-api.pom output/build/lib/el-api.jar
 %mvn_artifact res/maven/tomcat-jsp-api.pom output/build/lib/jsp-api.jar
 %mvn_artifact res/maven/tomcat-servlet-api.pom output/build/lib/servlet-api.jar
+
+%mvn_file org.apache.tomcat:tomcat-annotations-api tomcat/annotations-api
+%mvn_artifact res/maven/tomcat-annotations-api.pom ${RPM_BUILD_ROOT}%{libdir}/annotations-api.jar
+%mvn_artifact res/maven/tomcat-api.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-api.jar
+%mvn_file org.apache.tomcat:tomcat-catalina-ant tomcat/catalina-ant
+%mvn_artifact res/maven/tomcat-catalina-ant.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-ant.jar
+%mvn_file org.apache.tomcat:tomcat-catalina-ha tomcat/catalina-ha
+%mvn_artifact res/maven/tomcat-catalina-ha.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-ha.jar
+%mvn_file org.apache.tomcat:tomcat-catalina tomcat/catalina
+%mvn_artifact res/maven/tomcat-catalina.pom ${RPM_BUILD_ROOT}%{libdir}/catalina.jar
+%mvn_artifact res/maven/tomcat-coyote.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-coyote.jar
+%mvn_artifact res/maven/tomcat-dbcp.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-dbcp.jar
+%mvn_artifact res/maven/tomcat-i18n-cs.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-cs.jar
+%mvn_artifact res/maven/tomcat-i18n-de.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-de.jar
+%mvn_artifact res/maven/tomcat-i18n-es.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-es.jar
+%mvn_artifact res/maven/tomcat-i18n-fr.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-fr.jar
+%mvn_artifact res/maven/tomcat-i18n-ja.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-ja.jar
+%mvn_artifact res/maven/tomcat-i18n-ko.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-ko.jar
+%mvn_artifact res/maven/tomcat-i18n-pt-BR.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-pt-BR.jar
+%mvn_artifact res/maven/tomcat-i18n-ru.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-ru.jar
+%mvn_artifact res/maven/tomcat-i18n-zh-CN.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-i18n-zh-CN.jar
+%mvn_file org.apache.tomcat:tomcat-jasper-el tomcat/jasper-el
+%mvn_artifact res/maven/tomcat-jasper-el.pom ${RPM_BUILD_ROOT}%{libdir}/jasper-el.jar
+%mvn_file org.apache.tomcat:tomcat-jasper tomcat/jasper
+%mvn_artifact res/maven/tomcat-jasper.pom ${RPM_BUILD_ROOT}%{libdir}/jasper.jar
+%mvn_file org.apache.tomcat:tomcat-jaspic-api tomcat/jaspic-api
+%mvn_artifact res/maven/tomcat-jaspic-api.pom ${RPM_BUILD_ROOT}%{libdir}/jaspic-api.jar
+%mvn_artifact res/maven/tomcat-jdbc.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-jdbc.jar
+%mvn_artifact res/maven/tomcat-jni.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-jni.jar
+%mvn_artifact res/maven/tomcat-juli.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-juli.jar
+%mvn_file org.apache.tomcat:tomcat-ssi tomcat/catalina-ssi
+%mvn_artifact res/maven/tomcat-ssi.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-ssi.jar
+%mvn_file org.apache.tomcat:tomcat-storeconfig tomcat/catalina-storeconfig
+%mvn_artifact res/maven/tomcat-storeconfig.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-storeconfig.jar
+%mvn_file org.apache.tomcat:tomcat-tribes tomcat/catalina-tribes
+%mvn_artifact res/maven/tomcat-tribes.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-tribes.jar
+%mvn_artifact res/maven/tomcat-util-scan.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-util-scan.jar
+%mvn_artifact res/maven/tomcat-util.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-util.jar
+%mvn_file org.apache.tomcat:tomcat-websocket-api tomcat/websocket-api
+%mvn_artifact res/maven/tomcat-websocket-api.pom ${RPM_BUILD_ROOT}%{libdir}/websocket-api.jar
+%mvn_artifact res/maven/tomcat-websocket.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-websocket.jar
+%mvn_artifact res/maven/tomcat.pom
+
 %mvn_install
 
 %pre
@@ -469,33 +512,75 @@ fi
 %files docs-webapp
 %{appdir}/docs
 
-%files lib
+%files lib -f .mfiles 
 %dir %{libdir}
 %{libdir}/*.jar
 %{_javadir}/*.jar
 %{bindir}/tomcat-juli.jar
 %exclude %{libdir}/%{name}-el-%{elspec}-api.jar
+%exclude %{libdir}/%{name}-servlet-%{servletspec}*.jar
+%exclude %{libdir}/%{name}-jsp-%{jspspec}*.jar
 %exclude %{_javadir}/%{name}-servlet-%{servletspec}*.jar
 %exclude %{_javadir}/%{name}-el-%{elspec}-api.jar
 %exclude %{_javadir}/%{name}-jsp-%{jspspec}*.jar
+%exclude %{_javadir}/%{name}-servlet-api.jar
+%exclude %{_javadir}/%{name}-el-api.jar
+%exclude %{_javadir}/%{name}-jsp-api.jar
+%exclude %{_jnidir}/*
 
 %files jsp-%{jspspec}-api -f .mfiles-tomcat-jsp-api
 %{_javadir}/%{name}-jsp-%{jspspec}*.jar
+%{libdir}/%{name}-jsp-%{jspspec}*.jar
+%{_javadir}/%{name}-jsp-api.jar
 
 %files servlet-%{servletspec}-api -f .mfiles-tomcat-servlet-api
 %doc LICENSE
 %{_javadir}/%{name}-servlet-%{servletspec}*.jar
+%{libdir}/%{name}-servlet-%{servletspec}*.jar
+%{_javadir}/%{name}-servlet-api.jar
 
 %files el-%{elspec}-api -f .mfiles-tomcat-el-api
 %doc LICENSE
 %{_javadir}/%{name}-el-%{elspec}-api.jar
 %{libdir}/%{name}-el-%{elspec}-api.jar
+%{_javadir}/%{name}-el-api.jar
 
 %files webapps
 %defattr(0644,tomcat,tomcat,0755)
 %{appdir}/ROOT
 
 %changelog
+* Fri Dec 01 2023 Hui Wang <huwang@redhat.com> - 1:9.0.83-1
+- Update to 9.0.83
+
+* Mon Oct 16 2023 Hui Wang <huwang@redhat.com> - 1:9.0.82-2
+- Update tomcat-9.0.conf
+
+* Mon Oct 16 2023 Hui Wang <huwang@redhat.com> - 1:9.0.82-1
+- Update to 9.0.82
+- Resolves: rhbz#2243613 [Major Incident] CVE-2023-44487 tomcat
+- Resolves: rhbz#2244343 Wrong dbcp class in tomcat 9
+
+* Wed Sep 13 2023 Hui Wang <huwang@redhat.com> - 1:9.0.80-1
+- Update to 9.0.80
+- Fix java version
+
+* Wed Jul 26 2023 Hui Wang <huwang@redhat.com> - 1:9.0.78-1
+- Fix duplicated jars in the tomcat lib subpackage
+
+* Tue Jun 20 2023 Hui Wang <huwang@redhat.com> - 1:9.0.76-2
+- Resolves: rhbz#2210322 - CVE-2023-28709 tomcat: Fix for CVE-2023-24998 was incomplete
+- Install missing poms
+
+* Wed Jun 14 2023 Hui Wang <huwang@redhat.com> - 1:9.0.76-1
+- Update to 9.0.76
+- Resolves: rhbz#2188218 Link bin/tomcat-juli.jar to /usr/share/java
+- Move tomcat-jsp-2.3-api.jar,tomcat-servlet-4.0-api.jar and tomcat-el-api.jar to the subpackages
+
+* Fri Jun 09 2023 Hui Wang <huwang@redhat.com> - 1:9.0.75-1
+- Update to 9.0.75
+- Remove JDTCompiler.patch because ecj has been updated
+
 * Sun Jan 29 2023 Hui Wang <huwang@redhat.com> - 1:9.0.71-1
 - Update to 9.0.71
 - Remove osgi-annotations patch