dogtagpki

#205 Branch 'tomcatjss' and port it from using Tomcat 6 to using Tomcat 7 . . .
Closed: Fixed Opened by mharmsen.

Closed: Fixed
Reopen Issue

While attempting to move from Tomcat 6 (pki-setup) to Tomcat 7 (pki-deploy), it was discovered that Tomcat 7 would die as a result of the 'tomcatjss' JSSE module.

From the stack trace, the following comment in the 'public java.util.Map getDependants()' method in'java/org/apache/jasper/servlet/JspServletWrapper.java' led to this discovery:

       } catch (AbstractMethodError ame) {
            // Almost certainly a pre Tomcat 7.0.17 compiled JSP using the old
            // version of the interface. Force a re-compile.
            return ALWAYS_OUTDATED_DEPENDENCIES;
       }...

Upon further investigation, it was discovered that the following Tomcat 6 "Abstract" class has been changed in Tomcat 7 to an "Interface":

  • java/org/apache/tomcat/util/net/ServerSocketFactory.java

The 'tomcatjss' module "extend"s this class rather than "implementing" it; however, more work is involved in this porting effort, as 'tomcatjss' also relied upon other values that were previously defined in the abstract version of this class.

As a first step, I have suggested branching 'tomcatjss' to create a maintenace branch for 'tomcatjss' as used by Tomcat 6, and continue 'tomcatjss' development for Tomcat 7 on the TIP.

The 'tomcatjss' 7.0 module is ONLY scheduled to be built for Fedora 18 in Koji (developers using older platforms will need to install this module manually on their Fedora 16/17 platforms. Additionally, since 'pki-setup' depends upon Tomcat 6 which utilizes 'tomcatjss' 6.0, and 'pki-deploy' depends upon Tomcat 7 which utilizes 'tomcatjss' 7.0, it will probably not be possible to run the Java subsystem installation of both packages, as there is a strong desire to NOT rename either package as "tomcat6jss" and/or "tomcat7jss" (although I would have preference to renaming the older 'tomcatjss' to 'tomcat6jss' and leaving the Tomcat 7 version as simply 'tomcatjss' if it is deemed absolutely necesssary).

I am marking this bug as a 'blocker' because:

  • it prevents on-going development of 'pki-deploy', and
  • it has been labelled as a blocker for Fedora 18 which
    wants to move from Tomcat 6 to Tomcat 7

Additional information:

Even following a successful port of 'tomcatjss', the following 'server.xml' Secure Connector key/values may continue to produce WARNINGs in the PKI instance's 'catalina.out' log file since they are related to key/value pairs required exclusively by 'tomcatjss':

'enableOCSP'
'ocspResponderURL'
'ocspResponderCertNickname'
'ocspCacheSize'
'ocspMinCacheEntryDuration'
'ocspMaxCacheEntryDuration'
'ocspTimeout'
'strictCiphers'
'sslOptions'
'ssl2Ciphers'
'ssl3Ciphers'
'tlsCiphers'
'serverCertNickFile'
'passwordFile'
'passwordClass'
'certdbDir'

It is not currently known what causes the following 'server.xml' virtual host key/values to also produce WARNINGs (and whether or not this entry is even still useable):

      <!-- Define the default virtual host
           Note: XML Schema validation will not work with Xerces 2.2.
      -->
      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="false"
            xmlValidation="false" xmlNamespaceAware="false">

After receiving verbal ACK from cfu:

# svn info
Path: .
URL: svn+ssh://svn.fedorahosted.org/svn/tomcatjss/trunk/tomcatjss
Repository Root: svn+ssh://svn.fedorahosted.org/svn/tomcatjss
Repository UUID: f36ecbbf-7b2a-0410-ae9c-ff217db25f9c
Revision: 229
Node Kind: directory
Schedule: normal
Last Changed Author: mharmsen
Last Changed Rev: 195
Last Changed Date: 2011-09-29 18:28:18 -0700 (Thu, 29 Sep 2011)
# svn update
At revision 229.
# svn commit
Sending        README
Sending        build.xml
Sending        src/org/apache/tomcat/util/net/jss/IJSSFactory.java
Sending        src/org/apache/tomcat/util/net/jss/JSSFactory.java
Sending        src/org/apache/tomcat/util/net/jss/JSSImplementation.java
Sending        src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java
Sending        tomcatjss.spec
Transmitting file data .......
Committed revision 230.

Tomcatjss 7.0.0 for Tomcat 7:

    # svn list svn+ssh://svn.fedorahosted.org/svn/tomcatjss/trunk 
    tomcatjss/

Tomcatjss 6.0.2 for Tomcat 6:

    # svn list svn+ssh://svn.fedorahosted.org/svn/tomcatjss/tags
    ...
    TOMCATJSS_FOR_TOMCAT_6_20120607
    # svn list svn+ssh://svn.fedorahosted.org/svn/tomcatjss/branches
    ...
    TOMCAT6JSS_FOR_DOGTAG_10_BRANCH/       (NOTE: THIS BRANCH MAY NEVER BE USED)
    TOMCATJSS_FOR_TOMCAT_6_ERRATA_BRANCH/

Metadata Update from @mharmsen:
- Issue assigned to mharmsen
- Issue set to the milestone: Dogtag 10.0 Alpha

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/776

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Lowest
defect
Installation/Configuration
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.