- Update to Tomcat 10.1.44

apache-tomcat-10.1.44-src.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAmiQsokACgkQHPApP6U8
+pFgXgBAAiqI8kGmeyVtr0mqgwHibJK8EnjUBcsiFzV2PdTSsGKX7Xk5GBkR7xJ5i
+3MZJw44irpJmaQdkcMVfB5IlUx/xNqEXsAd1Ac1xrJFSxA8xqgPD7Wsec1bruR6s
+Wac3c5d1uqasq8Scu95NsSjWvXc4kr3fkUk9dTCAyUcrtXwQffibXN1MZwuKvG+5
+/49h8IbVTxutj0mp45WnyxTa5yiITkX1homdXv5L1Y+TqdGaR7gagKGQAoTUeGL+
+UR3pmDP2720SleMbmTWjSZqykOxpnBgsOL7UNoGzzu/wMW4HKGZAfvjxWPq8oyPq
+mPGQbHPtDkOzak/Eb+CBkrYE78KO9Iv9qgJ1JhTRzuGncLvNZ1RMmxxhGJr0uR9+
+qHdKHsGAIJI9Mj8dZLWoBkpKJq/OjxXBnKu1U+ax5nocOegvk7xK9TZ6YbxoSBmW
+JtDRE0GLSA9CfL22xhFSfQMG/l+WMdQi5vwrHPTB9GW2HxS0Oc+L8rKfxovM5rUb
+17rMa+wyJgPfc2efSaJwMPz+8AZEV7IrMwiqDx5cUegdgCG5z8n9EOVyL+iJgZp5
+EdUpQxNWnLil9YP4zkqHauJXNCBwcXZyUiNhuQRLBGT/hkBk6SD2WKC1qz42dGK6
+8zyulJBo/ninEQPnXzIDysHFd+/lXuo7vknKC3DAQtDESGF6MHY=
+=h0AE
+-----END PGP SIGNATURE-----

apache-tomcat-10.1.48-src.tar.gz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAmjqaQcACgkQHPApP6U8
-pFg4nA/9GL9PMb0aac03wBzfo6pXcg1NtcGNO7engbG00WhfLvFfmyBCtg3YWwYq
-os87O5OuzpF8TJQtxLWqqWDoJXA7FFqbhrIgJHJMYKrwgXJEMGgraekYov+oY84U
-GPf0stsyF8HdLaXaCfofQ6L3lPzybMku6ZDhwGPabXtanNVhOci77gCzt4rep8yT
-5SbNkqF+g3rPKbO4N1F5CC74eIYqS4gZhr8OOWLcGoEssQR2SeScudMeFjqX0Bml
-a5kK6fa7ffEaoyYol1G3UygL6PcL5PeeNw8QC96HjKeSLfEuFiUKNucRICy8DjOu
-qiOlZcUmKDev8vTxTqZOnzWgmTi428VRV2DoaP8LxOvpzycQdk3oBH/ZnzawFChw
-Hw1XcwjX3aV9pzwg9BSt1sYa9mv1ByaliN2UspqWwB2dfr9XHu4J8JMIa+7hZpZl
-5kenrlcrK9woa+Ke/z/XIk9274Fvfark6Bs6VpANXvTprfUYf/9iLuDNRMsmSzGy
-qHaEbb3ob5IWf1TwpRgMEeQplBZzjjD1/62eTJVfkkgTS6vWtF9Ay0Ex9cVtBgAK
-N0qO9biWQ9JIgxNFwUutLzpwthfJE4BaKpQa/sRaJLEvL3zon/aHm5WcCYWX8q44
-mKwBAXda2sXxiHypt7aH3NwEe+S03vwQ4Sp8++5aQPf+2FgqkOM=
-=BqQ+
------END PGP SIGNATURE-----

tomcat10.changes

@@ -1,119 +1,3 @@
--------------------------------------------------------------------
-Tue Nov 18 18:38:06 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
-
-- make catalina.sh %config(noreplace) (bsc#1253460)
-
--------------------------------------------------------------------
-Thu Nov  6 15:44:46 UTC 2025 - Ricardo Mestre <ricardo.mestre@suse.com>
-
-- Update to Tomcat 10.1.48
-  * Fixed CVEs:
-    + CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT
-      is enabled (bsc#1252753)
-    + CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control 
-      Sequences vulnerability in Apache Tomcat (bsc#1252905)
-    + CVE-2025-61795: temporary copies during the processing of multipart 
-      upload can lead to a denial of service (bsc#1252756)
-  * Catalina
-    + Fix: Log warnings when the SSO configuration does not comply with the
-      documentation. (remm)
-    + Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the
-      RemoteCIDRFilter and RemoteCIDRValve. (markt)
-    + Fix: 69837: Fix corruption of the class path generated by the Loader when
-      running on Windows. (markt)
-    + Fix: Reject requests that map to invalid Windows file names earlier.
-      (markt)
-    + Fix: 69839: Ensure that changes to session IDs (typically after
-      authentication) are promulgated to the SSO Valve to ensure that SSO
-      entries are fully clean-up on session expiration. Patch provided by Kim
-      Johan Andersson. (markt)
-    + Fix: Fix a race condition in the creation of the storage location for the
-      FileStore. (markt)
-    + Fix: HTTP methods are case-sensitive so always use case sensitive
-      comparisons when comparing HTTP methods. (markt)
-    + Fix: 69814: Ensure that HttpSession.isNew() returns false once the client
-      has joined the session. (markt)
-    + Fix: Further performance improvements for ParameterMap. (jengebr/markt)
-    + Code: Refactor access log time stamps to be based on the Instant request
-      processing starts. (markt)
-    + Fix: Fix a case-sensitivity issue in the trailer header allow list.
-      (markt)
-    + Fix: Be proactive in cleaning up temporary files after a failed multi-part
-      upload rather than waiting for GC to do it. (markt)
-    + Update: Change the digest used to calculate strong ETags (if enabled) for
-      the default Servlet from SHA-1 to SHA-256 to align with the recommendation
-      in RFC 9110 that hash functions used to generate strong ETags should be
-      collision resistant. (markt)
-    + Fix: Correct a regression in the fix for 69781 that broke FileStore.
-      (markt)
-    + Code: Remove a number of unnecessary packages from the
-      catalina-deployer.jar. (markt)
-    + Fix: 69781: Fix concurrent access issues in the session FileStore
-      implementation that were causing lost sessions when the store was used
-      with the PersistentValve. Based on pull request #882 by Aaron Ogburn.
-      (markt)
-    + Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)
-  * Cluster
-    + Fix: Prevent the channel configuration (sender, receiver, membership
-      service) from being changed unless the channel is fully stopped. (markt)
-    + Fix: Handle spurious wake-ups during leader election for
-      NonBlockingCoordinator. (markt)
-    + Fix: Handle spurious wake-ups during sending of messages by RpcChannel.
-      (markt)
-  * Coyote
-    + Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests
-      received via the AJP connector were processed as OPTIONS requests and
-      PROPFIND requests were processed as TRACE. (markt)
-    + Update: Add specific certificate selection code for TLS 1.3 supporting
-      post quantum cryptography. Certificates defined with type MLDSA will be
-      selected depending on the TLS client hello. (remm)
-    + Update: Add groups attribute on SSLHostConfig allowing to restrict which
-      groups can be enabled on the SSL engine. (remm)
-    + Add: Optimize the conversion of HTTP method from byte form to String form.
-      (markt)
-    + Fix: Store HTTP request headers using the original case for the header
-      name rather than forcing it to lower case. (markt)
-    + Update: Add hybrid PQC support to OpenSSL, based on code from mod_ssl.
-      Using this OpenSSL specific code path, additional PQC certificates defined
-      with type MLDSA are added to contexts which use classic certificates.
-      (jfclere/remm)
-    + Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to
-      process it, with appropriate logging. (remm)
-    + Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when
-      reading a key fails. (remm)
-    + Fix: Fix possible early timeouts for network operations caused by a
-      spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)
-  * Web applications
-    + Fix: Documentation. Clarify the purpose of the maxPostSize attribute of
-      the Connector element. (markt)
-    + Fix: Avoid NPE in manager webapp displaying certificate information.
-      (remm)
-  * Websocket
-    + Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the
-      underlying Inflater and/or Deflater throwing IllegalStateException when
-      closed rather than NullPointerException as they do in Java 24 and earlier.
-      (markt)
-  * Other
-    + Update: Update Byte Buddy to 1.17.7. (markt)
-    + Update: Update Checkstyle to 11.1.0. (markt)
-    + Update: Update SpotBugs to 4.9.6. (markt)
-    + Update: Update Jsign to 7.2. (markt)
-    + Add: Improvements to Russian translations provided by usmazat. (markt)
-    + Add: Improvements to French translations. (remm)
-    + Add: Improvements to Japanese translations provided by tak7iji. (markt)
-    + Update: Minor refactoring in JULI loggers. Patch provided by minjund.
-      (schultz)
-    + Code: Review logging and include the full stack trace and exception
-      message by default rather then just the exception message when logging an
-      error or warning in response to an exception. (markt)
-    + Add: Add escaping to log formatters to align with JSON formatter. (markt)
-    + Update: Update Checkstyle to 11.0.0. (markt)
-
--------------------------------------------------------------------
-Wed Oct  1 12:23:38 UTC 2025 - Fridrich Strba <fstrba@suse.com>
-
-- Do not use update-alternatives
-
 -------------------------------------------------------------------
 Mon Aug 25 13:28:00 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
 

tomcat10.spec

@@ -29,7 +29,7 @@
 %define elspec %{elspec_major}.%{elspec_minor}
 %define major_version 10
 %define minor_version 1
-%define micro_version 48
+%define micro_version 44
 %define java_major 1
 %define java_minor 11
 %define java_version %{java_major}.%{java_minor}
@@ -191,11 +191,15 @@ The documentation of web application for Apache Tomcat.
 %package el-%{elspec_major}_%{elspec_minor}-api
 Summary:        Expression Language v%{elspec} API
 Group:          Development/Libraries/Java
+Requires(post): update-alternatives
+Requires(preun): update-alternatives
 Conflicts:      %{app_name}-implementation-el-api
 Provides:       %{app_name}-el-%{elspec}-api = %{version}-%{release}
 Provides:       %{app_name}-implementation-el-api = %{version}
 Provides:       el_%{elspec_major}_%{elspec_minor}_api = %{version}-%{release}
+Provides:       el_api = %{elspec}
 Obsoletes:      %{app_name}-el-2_2-api < %{version}
+Obsoletes:      el_api < %{elspec}
 
 %description el-%{elspec_major}_%{elspec_minor}-api
 Expression Language API version %{elspec}.
@@ -213,11 +217,15 @@ Javadoc generated documentation files for Apache Tomcat.
 %package jsp-%{jspspec_major}_%{jspspec_minor}-api
 Summary:        Apache Tomcat JSP API implementation classes
 Group:          Productivity/Networking/Web/Servers
+Requires(post): update-alternatives
+Requires(postun): update-alternatives
 Conflicts:      %{app_name}-implementation-jsp-api
 Provides:       %{app_name}-implementation-jsp-api = %{version}
 Provides:       %{app_name}-jsp-%{jspspec}-api
+Provides:       jsp = %{jspspec}
 Provides:       jsp%{jspspec_major}%{jspspec_minor}
 Obsoletes:      %{app_name}-jsp-2_2-api < %{version}
+Obsoletes:      jsp < %{jspspec}
 
 %description jsp-%{jspspec_major}_%{jspspec_minor}-api
 Apache Tomcat JSP API implementation classes version %{jspspec}
@@ -256,13 +264,17 @@ Libraries required to successfully run the Tomcat Web container
 %package servlet-%{servletspec_major}_%{servletspec_minor}-api
 Summary:        Apache Tomcat Servlet API implementation classes
 Group:          Productivity/Networking/Web/Servers
+Requires(post): update-alternatives
+Requires(postun): update-alternatives
 Conflicts:      %{app_name}-implementation-servlet-api
 Provides:       %{app_name}-implementation-servlet-api = %{version}
 Provides:       %{app_name}-servlet-%{servletspec}-api = %{version}-%{release}
+Provides:       servlet = %{servletspec}
 Provides:       servlet11
 Provides:       servlet60
 Obsoletes:      %{app_name}-servlet-3_0-api < %{version}
 Obsoletes:      %{app_name}-servlet-3_1-api < %{version}
+Obsoletes:      servlet < %{servletspec}
 
 %description servlet-%{servletspec_major}_%{servletspec_minor}-api
 Apache Tomcat Servlet API implementation classes version %{servletspec}
@@ -586,6 +598,14 @@ echo "tomcat/catalina-ant" > %{buildroot}/%{_sysconfdir}/ant.d/catalina-ant
 #bnc#565901
 ln -sf %{_sbindir}/%{app_name} %{buildroot}/%{bindir}/catalina.sh
 
+# Install update-alternatives content
+mkdir -p %{buildroot}%{_sysconfdir}/alternatives
+ln -s -f %{_sysconfdir}/alternatives/el_api %{buildroot}%{_javadir}/%{app_name}-el_api.jar
+ln -s -f %{_sysconfdir}/alternatives/jsp %{buildroot}%{_javadir}/%{app_name}-jsp.jar
+# To avoid conflicts with servletapi4 and servletapi5 create a link to incorrect /etc/alternatives/servlet.jar.
+# It will be changed anyways to the correct symlink by update-alternatives.
+ln -s -f %{_sysconfdir}/alternatives/servlet.jar %{buildroot}%{_javadir}/servlet.jar
+
 %pre
 # add the tomcat user and group
 getent group tomcat >/dev/null || %{_sbindir}/groupadd -r tomcat
@@ -617,6 +637,49 @@ runuser -u tomcat -g tomcat -- xsltproc --output %{confdir}/server.xml %{confdir
 %postun jsvc
 %service_del_postun %{app_name}-jsvc.service
 
+%post el-%{elspec_major}_%{elspec_minor}-api
+update-alternatives --install %{_javadir}/%{app_name}-el_api.jar el_api %{_javadir}/%{app_name}-el-%{elspec}-api.jar 20300
+
+%postun el-%{elspec_major}_%{elspec_minor}-api
+if [ $1 -eq 0 ] ; then
+    update-alternatives --remove el_api %{_javadir}/%{app_name}-el-%{elspec}-api.jar
+fi
+
+%post jsp-%{jspspec_major}_%{jspspec_minor}-api
+update-alternatives --install %{_javadir}/%{app_name}-jsp.jar jsp \
+    %{_javadir}/%{app_name}-jsp-%{jspspec}-api.jar 20200
+
+%postun jsp-%{jspspec_major}_%{jspspec_minor}-api
+if [ $1 -eq 0 ] ; then
+    update-alternatives --remove jsp \
+        %{_javadir}/%{app_name}-jsp-%{jspspec}-api.jar
+fi
+
+%post servlet-%{servletspec_major}_%{servletspec_minor}-api
+update-alternatives --install %{_javadir}/servlet.jar servlet \
+    %{_javadir}/%{app_name}-servlet-%{servletspec}-api.jar 30000
+# Fix for bsc#1092163.
+# Keep the /usr/share/java/tomcat-servlet.jar symlink for compatibility.
+# In case of update from an older version where /usr/share/java/tomcat-servlet.jar is an alternatives symlink
+# the update-alternatives in the new version will cause a rename tomcat-servlet.jar -> servlet.jar.
+# This makes sure the %{app_name}-servlet.jar is recreated if it's missing because of the rename.
+if [ ! -f %{_javadir}/%{app_name}-servlet.jar ]; then
+    echo "Recreating symlink %{_javadir}/%{app_name}-servlet.jar"
+    ln -s %{_javadir}/%{app_name}-servlet-%{servletspec}-api.jar %{_javadir}/%{app_name}-servlet.jar
+fi
+
+%postun servlet-%{servletspec_major}_%{servletspec_minor}-api
+if [ $1 -eq 0 ] ; then
+    if [ ! -f %{_sysconfdir}/alternatives/servlet ]; then
+        # servlet was removed on uninstall.
+        # Create a broken symlink to make sure update-alternatives works correctly and falls back
+        # to servletapi5 or servletapi4 if they're installed.
+        ln -s %{_javadir}/%{app_name}-servlet-%{servletspec}-api.jar %{_sysconfdir}/alternatives/servlet
+    fi
+    update-alternatives --remove servlet \
+        %{_javadir}/%{app_name}-servlet-%{servletspec}-api.jar
+fi
+
 %post lib
 # those links are no longer needed
 rm -f \
@@ -685,8 +748,8 @@ fi
 %{_libexecdir}/%{app_name}/functions
 %{_libexecdir}/%{app_name}/preamble
 %{_libexecdir}/%{app_name}/server
-#bnc#565901 and bsc#1253460
-%config(noreplace) %{bindir}/catalina.sh
+#bnc#565901
+%{bindir}/catalina.sh
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{app_name}10
 %dir %{basedir}
 %dir %{confdir}
@@ -740,6 +803,11 @@ fi
 %{_javadir}/%{app_name}-el-%{elspec}-api.jar
 %{_javadir}/%{app_name}-el-api.jar
 %{libdir}/%{app_name}-el-%{elspec}-api.jar
+%ghost %{_javadir}/%{app_name}-el_1_0_api.jar
+%ghost %{_javadir}/%{app_name}-el_api.jar
+%ghost %{_sysconfdir}/alternatives/%{app_name}-el_api.jar
+%ghost %{_sysconfdir}/alternatives/el_1_0_api
+%ghost %{_sysconfdir}/alternatives/el_api
 
 %files doc
 %doc %{_javadocdir}/%{app_name}
@@ -747,6 +815,9 @@ fi
 %files jsp-%{jspspec_major}_%{jspspec_minor}-api -f output/dist/src/res/maven/.mfiles-jsp-api
 %{_javadir}/%{app_name}-jsp-%{jspspec}-api.jar
 %{_javadir}/%{app_name}-jsp-api.jar
+%ghost %{_javadir}/%{app_name}-jsp.jar
+%ghost %{_sysconfdir}/alternatives/%{app_name}-jsp.jar
+%ghost %{_sysconfdir}/alternatives/jsp
 
 %files lib -f output/dist/src/res/maven/.mfiles
 %{libdir}
@@ -766,6 +837,10 @@ fi
 %{_javadir}/%{app_name}-servlet-%{servletspec}-api.jar
 %{_javadir}/%{app_name}-servlet-api.jar
 %{_javadir}/%{app_name}-servlet.jar
+%{_javadir}/servlet.jar
+%ghost %{_sysconfdir}/alternatives/tomcat-servlet.jar
+%ghost %attr(-,root,root) %{_sysconfdir}/alternatives/servlet.jar
+%ghost %attr(-,root,root) %{_sysconfdir}/alternatives/servlet
 
 %files webapps
 %defattr(0644,root,tomcat,0755)