pool/jetty-minimal
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OBS-URL: https://build.opensuse.org/package/show/Java:packages/jetty-minimal?expand=0&rev=87

Browse Source
This commit is contained in:
Fridrich Strba 2024-10-17 12:27:55 +00:00 committed by Git OBS Bridge
commit fa009b665b
14 changed files with 2372 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
.gitattributes vendored Normal file
View File

@ -0,0 +1,23 @@
## Default LFS
*.7z filter=lfs diff=lfs merge=lfs -text
*.bsp filter=lfs diff=lfs merge=lfs -text
*.bz2 filter=lfs diff=lfs merge=lfs -text
*.gem filter=lfs diff=lfs merge=lfs -text
*.gz filter=lfs diff=lfs merge=lfs -text
*.jar filter=lfs diff=lfs merge=lfs -text
*.lz filter=lfs diff=lfs merge=lfs -text
*.lzma filter=lfs diff=lfs merge=lfs -text
*.obscpio filter=lfs diff=lfs merge=lfs -text
*.oxt filter=lfs diff=lfs merge=lfs -text
*.pdf filter=lfs diff=lfs merge=lfs -text
*.png filter=lfs diff=lfs merge=lfs -text
*.rpm filter=lfs diff=lfs merge=lfs -text
*.tbz filter=lfs diff=lfs merge=lfs -text
*.tbz2 filter=lfs diff=lfs merge=lfs -text
*.tgz filter=lfs diff=lfs merge=lfs -text
*.ttf filter=lfs diff=lfs merge=lfs -text
*.txz filter=lfs diff=lfs merge=lfs -text
*.whl filter=lfs diff=lfs merge=lfs -text
*.xz filter=lfs diff=lfs merge=lfs -text
*.zip filter=lfs diff=lfs merge=lfs -text
*.zst filter=lfs diff=lfs merge=lfs -text

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.osc

7
_multibuild Normal file
View File

@ -0,0 +1,7 @@
<multibuild>
<package>jetty-unixsocket</package>
<package>jetty-websocket</package>
<package>jetty-alpn</package>
<package>jetty-http2</package>
</multibuild>

19
jetty-alpn.changes Normal file
View File

@ -0,0 +1,19 @@
-------------------------------------------------------------------
Tue Oct 15 21:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.56.v20240826
* Security fixes:
+ CVE-2024-8184, bsc#1231651, ThreadLimitHandler.getRemote()
vulnerable to remote DoS attacks
* Changes:
+ #12201 backport ThreadLimitHandler improvements from Jetty 12
+ #11938 - Updating URL refs from eclipse.org/jetty and
eclipse.dev/jetty to jetty.org (including XML dtd references)
+ #10805 - Jetty response with an invalid HTTP2 packet if the
client set the hpack table size as 0
-------------------------------------------------------------------
Fri Oct 11 10:31:15 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Initial packaging of the alpn submodules of jetty
9.4.54.v20240208

283
jetty-alpn.spec Normal file
View File

@ -0,0 +1,283 @@
#
# spec file for package jetty-alpn
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2000-2007, JPackage Project
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global base_name jetty
%global addver .v20240826
%define src_name %{base_name}.project-%{base_name}-%{version}%{addver}
Name: %{base_name}-alpn
Version: 9.4.56
Release: 0
Summary: The alpn modules for Jetty
License: Apache-2.0 OR EPL-1.0
URL: https://www.eclipse.org/jetty/
Source0: https://github.com/eclipse/%{base_name}.project/archive/%{base_name}-%{version}%{addver}.tar.gz#/%{src_name}.tar.gz
BuildRequires: fdupes
BuildRequires: java-devel >= 1.8
BuildRequires: maven-local
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.conscrypt:conscrypt-openjdk-uber)
BuildRequires: mvn(org.eclipse.jetty.alpn:alpn-api)
BuildRequires: mvn(org.eclipse.jetty:jetty-io) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-server) >= %{version}
BuildArch: noarch
# missing gcc13 to build conscrypt's dependencies
%if 0%{?sle_version} && 0%{?sle_version} < 150400
ExclusiveArch: do-not-build
%endif
%description
%global desc \
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\
do not need to configure and run a separate web server (like Apache) in order\
to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\
featured web server for static and dynamic content. Unlike separate\
server/container solutions, this means that your web server and web\
application run in the same process, without interconnection overheads\
and complications. Furthermore, as a pure java component, Jetty can be simply\
included in your application for demonstration, distribution or deployment.\
Jetty is available on all Java supported platforms.
%global extdesc %{desc}\
\
This package contains
%{extdesc} %{summary}
%package client
Summary: The alpn modules for Jetty (client components)
%description client
%{extdesc} %{summary}
%package server
Summary: The alpn modules for Jetty (server components)
%description server
%{extdesc} %{summary}
%package javadoc
Summary: Javadoc for %{name}
%description javadoc
%{summary}.
%prep
%setup -q -n %{src_name}
find . -name "*.?ar" -exec rm {} \;
find . -name "*.class" -exec rm {} \;
%pom_remove_dep :::import
# Plugins irrelevant or harmful to building the package
%pom_remove_plugin -r :maven-checkstyle-plugin
%pom_remove_plugin -r :maven-enforcer-plugin
%pom_remove_plugin -r :maven-eclipse-plugin
%pom_remove_plugin -r :license-maven-plugin
%pom_remove_plugin -r :maven-site-plugin
%pom_remove_plugin -r :maven-source-plugin
%pom_remove_plugin -r :maven-deploy-plugin
%pom_remove_plugin -r :jacoco-maven-plugin
%pom_remove_plugin -r :maven-release-plugin
%pom_remove_plugin -r :buildnumber-maven-plugin
%pom_remove_plugin -r :h2spec-maven-plugin
# Unnecessary pom flattening can be skipped
%pom_remove_plugin -r :flatten-maven-plugin jetty-bom
%pom_disable_module aggregates/jetty-all
%pom_xpath_inject "pom:configuration/pom:instructions" \
"<Import-Package>sun.misc;resolution:=optional,com.sun.nio.file;resolution:=optional,*</Import-Package>"
%pom_remove_dep "com.sun.net.httpserver:http" jetty-http-spi
%pom_change_dep -r org.mortbay.jasper:apache-jsp org.apache.tomcat:tomcat-jasper
%pom_add_dep 'org.junit.jupiter:junit-jupiter-engine:${junit.version}' tests/test-sessions/test-sessions-common
# provided by glassfish-jsp-api that has newer version
%pom_change_dep -r javax.servlet.jsp:jsp-api javax.servlet.jsp:javax.servlet.jsp-api
# txt artifact - not installable
%pom_remove_plugin ":jetty-version-maven-plugin"
%pom_xpath_remove "pom:artifactItem[pom:classifier='version']" jetty-home
# Disable building source release
%pom_xpath_remove 'pom:execution[pom:id="sources"]' jetty-home
# Unwanted JS in javadoc
sed -i '/^\s*\*.*<script>/d' jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java
# only used for integration tests
%pom_remove_plugin :maven-invoker-plugin jetty-jspc-maven-plugin
# These bundles have a dep on Eclipse that is not available on every arch
%pom_disable_module jetty-osgi
# We don't have asciidoctor-maven-plugin
%pom_disable_module jetty-documentation
%pom_remove_dep -r :jetty-documentation
%pom_xpath_remove 'pom:execution[pom:id="unpack-documentation"]' jetty-distribution
%pom_xpath_remove 'pom:artifactItem[pom:artifactId="libsetuid-osx"]' jetty-home/pom.xml
# TODO remove when jetty-setuid is packaged
%pom_xpath_remove "pom:execution[pom:id='copy-setuid-deps']" jetty-home/pom.xml
# We don't have gcloud-java-datastore
%pom_disable_module jetty-gcloud
%pom_disable_module test-gcloud-sessions tests/test-sessions
%pom_remove_dep :jetty-gcloud-session-manager jetty-home
# we don't have com.googlecode.xmemcached:xmemcached yet
%pom_disable_module jetty-memcached
%pom_disable_module test-memcached-sessions tests/test-sessions
%pom_remove_dep :jetty-memcached-sessions jetty-home
# We don't have hazelcast
%pom_disable_module jetty-hazelcast
%pom_disable_module test-hazelcast-sessions tests/test-sessions
%pom_remove_dep :jetty-hazelcast jetty-home
# We don't have infinispan
%pom_disable_module jetty-infinispan
%pom_disable_module test-infinispan-sessions tests/test-sessions
%pom_remove_dep :infinispan-embedded jetty-home
%pom_remove_dep :infinispan-embedded-query jetty-home
%pom_remove_dep :infinispan-remote jetty-home
%pom_remove_dep :infinispan-remote-query jetty-home
%pom_xpath_remove "pom:execution[pom:id='unpack-infinispan-config']" jetty-home
# Not currently able to build tests, so can't build benchmarks
%pom_disable_module jetty-jmh
# Distribution tests require internet access, so disable
%pom_disable_module test-distribution tests
# the default location is not allowed by SELinux
sed -i '/<SystemProperty name="jetty.state"/d' \
jetty-home/src/main/resources%{_sysconfdir}/jetty-started.xml
# remote-resources only copies about.html
%pom_remove_plugin :maven-remote-resources-plugin
# packages module configs, we don't need those in minimal
%pom_remove_plugin -r :maven-assembly-plugin
# only useful when tests are enabled (copies test deps)
%pom_remove_plugin :maven-dependency-plugin jetty-client
# all modules besides the current jetty-alpn
%pom_disable_module jetty-ant
%pom_disable_module jetty-http2
%pom_disable_module jetty-fcgi
%pom_disable_module jetty-servlets
%pom_disable_module apache-jstl
%pom_disable_module jetty-maven-plugin
%pom_disable_module jetty-jspc-maven-plugin
%pom_disable_module jetty-deploy
%pom_disable_module jetty-start
%pom_disable_module jetty-cdi
%pom_disable_module jetty-spring
%pom_disable_module jetty-jaspi
%pom_disable_module jetty-rewrite
%pom_disable_module jetty-nosql
%pom_disable_module jetty-unixsocket
%pom_disable_module tests
%pom_disable_module examples
%pom_disable_module jetty-quickstart
%pom_disable_module jetty-distribution
%pom_disable_module jetty-runner
%pom_disable_module jetty-http-spi
%pom_disable_module jetty-home
%pom_disable_module jetty-websocket
# minimal modules built in jetty-minimal package
%pom_disable_module jetty-annotations
%pom_disable_module jetty-client
%pom_disable_module jetty-continuation
%pom_disable_module jetty-http
%pom_disable_module jetty-io
%pom_disable_module jetty-jaas
%pom_disable_module jetty-jmx
%pom_disable_module jetty-jndi
%pom_disable_module apache-jsp
%pom_disable_module jetty-openid
%pom_disable_module jetty-plus
%pom_disable_module jetty-proxy
%pom_disable_module jetty-security
%pom_disable_module jetty-server
%pom_disable_module jetty-servlet
%pom_disable_module jetty-util
%pom_disable_module jetty-util-ajax
%pom_disable_module jetty-xml
%pom_disable_module jetty-webapp
%pom_xpath_remove "pom:plugins/pom:plugin[pom:artifactId='maven-javadoc-plugin']/pom:configuration/pom:additionalJOption"
%{mvn_file} :{*} %{base_name}/@1
%build
%{mvn_package} :jetty-home __noinstall
%{mvn_package} :jetty-distribution __noinstall
# Separate package for POMs
%{mvn_package} ':*-project' __noinstall
%{mvn_package} ':*-parent' __noinstall
%{mvn_package} ':*-bom' __noinstall
# artifact used by demo
%{mvn_package} :test-mock-resources
%{mvn_package} ':test-*' __noinstall
%{mvn_package} ':*-tests' __noinstall
%{mvn_package} ':*-it' __noinstall
%{mvn_package} ':example-*' __noinstall
%{mvn_package} org.eclipse.jetty.tests: __noinstall
%{mvn_package} ::war: __noinstall
%{mvn_package} :jetty-runner __noinstall
%{mvn_package} :build-resources __noinstall
%{mvn_package} org.eclipse.jetty.cdi: jetty-cdi
%{mvn_package} ':jetty-alpn*-client' jetty-alpn-client
%{mvn_package} ':jetty-alpn*-server' jetty-alpn-server
%{mvn_package} :apache-jsp jetty-jsp
%{mvn_alias} :apache-jsp :jetty-jsp
%{mvn_build} -f -- \
-Dproject.build.outputTimestamp=$(date -u -d @${SOURCE_DATE_EPOCH:-$(date +%%s)} +%%Y-%%m-%%dT%%H:%%M:%%SZ) \
%if %{?pkg_vcmp:%pkg_vcmp java-devel >= 9}%{!?pkg_vcmp:0}
-Dmaven.compiler.release=8 \
%endif
-Dsource=8
%install
%mvn_install
%fdupes -s %{buildroot}%{_javadocdir}
%files client -f .mfiles-%{name}-client
%files server -f .mfiles-%{name}-server
%files javadoc -f .mfiles-javadoc
%license LICENSE NOTICE.txt
%changelog

18
jetty-http2.changes Normal file
View File

@ -0,0 +1,18 @@
-------------------------------------------------------------------
Tue Oct 15 21:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.56.v20240826
* Security fixes:
+ CVE-2024-8184, bsc#1231651, ThreadLimitHandler.getRemote()
vulnerable to remote DoS attacks
* Changes:
+ #12201 backport ThreadLimitHandler improvements from Jetty 12
+ #11938 - Updating URL refs from eclipse.org/jetty and
eclipse.dev/jetty to jetty.org (including XML dtd references)
+ #10805 - Jetty response with an invalid HTTP2 packet if the
client set the hpack table size as 0
-------------------------------------------------------------------
Fri Oct 11 17:30:25 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Initial packaging

312
jetty-http2.spec Normal file
View File

@ -0,0 +1,312 @@
#
# spec file for package jetty-http2
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2000-2007, JPackage Project
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global base_name jetty
%global addver .v20240826
%define src_name %{base_name}.project-%{base_name}-%{version}%{addver}
Name: %{base_name}-http2
Version: 9.4.56
Release: 0
Summary: The http2 modules for Jetty
License: Apache-2.0 OR EPL-1.0
URL: https://www.eclipse.org/jetty/
Source0: https://github.com/eclipse/%{base_name}.project/archive/%{base_name}-%{version}%{addver}.tar.gz#/%{src_name}.tar.gz
BuildRequires: fdupes
BuildRequires: java-devel >= 1.8
BuildRequires: maven-local
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.eclipse.jetty.alpn:alpn-api)
BuildRequires: mvn(org.eclipse.jetty:jetty-alpn-client) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-alpn-java-client) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-client) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-http) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-io) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-jmx) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-server) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-util) >= %{version}
BuildArch: noarch
# missing gcc13 to build conscrypt's (for jetty-alpn) dependencies
%if 0%{?sle_version} && 0%{?sle_version} < 150400
ExclusiveArch: do-not-build
%endif
%description
%global desc \
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\
do not need to configure and run a separate web server (like Apache) in order\
to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\
featured web server for static and dynamic content. Unlike separate\
server/container solutions, this means that your web server and web\
application run in the same process, without interconnection overheads\
and complications. Furthermore, as a pure java component, Jetty can be simply\
included in your application for demonstration, distribution or deployment.\
Jetty is available on all Java supported platforms.
%global extdesc %{desc}\
\
This package contains
%{extdesc} %{summary}
%package client
Summary: http2-client module for Jetty
%description client
%{extdesc} %{summary}.
%package common
Summary: http2-common module for Jetty
%description common
%{extdesc} %{summary}.
%package hpack
Summary: http2-hpack module for Jetty
%description hpack
%{extdesc} %{summary}.
%package http-client-transport
Summary: http2-http-client-transport module for Jetty
%description http-client-transport
%{extdesc} %{summary}.
%package server
Summary: http2-server module for Jetty
%description server
%{extdesc} %{summary}.
%package javadoc
Summary: Javadoc for %{name}
%description javadoc
%{summary}.
%prep
%setup -q -n %{src_name}
find . -name "*.?ar" -exec rm {} \;
find . -name "*.class" -exec rm {} \;
%pom_remove_dep :::import
# Plugins irrelevant or harmful to building the package
%pom_remove_plugin -r :maven-checkstyle-plugin
%pom_remove_plugin -r :maven-enforcer-plugin
%pom_remove_plugin -r :maven-eclipse-plugin
%pom_remove_plugin -r :license-maven-plugin
%pom_remove_plugin -r :maven-site-plugin
%pom_remove_plugin -r :maven-source-plugin
%pom_remove_plugin -r :maven-deploy-plugin
%pom_remove_plugin -r :jacoco-maven-plugin
%pom_remove_plugin -r :maven-release-plugin
%pom_remove_plugin -r :buildnumber-maven-plugin
%pom_remove_plugin -r :h2spec-maven-plugin
# Unnecessary pom flattening can be skipped
%pom_remove_plugin -r :flatten-maven-plugin jetty-bom
%pom_disable_module aggregates/jetty-all
%pom_xpath_inject "pom:configuration/pom:instructions" \
"<Import-Package>sun.misc;resolution:=optional,com.sun.nio.file;resolution:=optional,*</Import-Package>"
%pom_remove_dep "com.sun.net.httpserver:http" jetty-http-spi
%pom_change_dep -r org.mortbay.jasper:apache-jsp org.apache.tomcat:tomcat-jasper
%pom_add_dep 'org.junit.jupiter:junit-jupiter-engine:${junit.version}' tests/test-sessions/test-sessions-common
# provided by glassfish-jsp-api that has newer version
%pom_change_dep -r javax.servlet.jsp:jsp-api javax.servlet.jsp:javax.servlet.jsp-api
# txt artifact - not installable
%pom_remove_plugin ":jetty-version-maven-plugin"
%pom_xpath_remove "pom:artifactItem[pom:classifier='version']" jetty-home
# Disable building source release
%pom_xpath_remove 'pom:execution[pom:id="sources"]' jetty-home
# Unwanted JS in javadoc
sed -i '/^\s*\*.*<script>/d' jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java
# only used for integration tests
%pom_remove_plugin :maven-invoker-plugin jetty-jspc-maven-plugin
# These bundles have a dep on Eclipse that is not available on every arch
%pom_disable_module jetty-osgi
# We don't have asciidoctor-maven-plugin
%pom_disable_module jetty-documentation
%pom_remove_dep -r :jetty-documentation
%pom_xpath_remove 'pom:execution[pom:id="unpack-documentation"]' jetty-distribution
%pom_xpath_remove 'pom:artifactItem[pom:artifactId="libsetuid-osx"]' jetty-home/pom.xml
# TODO remove when jetty-setuid is packaged
%pom_xpath_remove "pom:execution[pom:id='copy-setuid-deps']" jetty-home/pom.xml
# We don't have gcloud-java-datastore
%pom_disable_module jetty-gcloud
%pom_disable_module test-gcloud-sessions tests/test-sessions
%pom_remove_dep :jetty-gcloud-session-manager jetty-home
# we don't have com.googlecode.xmemcached:xmemcached yet
%pom_disable_module jetty-memcached
%pom_disable_module test-memcached-sessions tests/test-sessions
%pom_remove_dep :jetty-memcached-sessions jetty-home
# We don't have hazelcast
%pom_disable_module jetty-hazelcast
%pom_disable_module test-hazelcast-sessions tests/test-sessions
%pom_remove_dep :jetty-hazelcast jetty-home
# We don't have infinispan
%pom_disable_module jetty-infinispan
%pom_disable_module test-infinispan-sessions tests/test-sessions
%pom_remove_dep :infinispan-embedded jetty-home
%pom_remove_dep :infinispan-embedded-query jetty-home
%pom_remove_dep :infinispan-remote jetty-home
%pom_remove_dep :infinispan-remote-query jetty-home
%pom_xpath_remove "pom:execution[pom:id='unpack-infinispan-config']" jetty-home
# Not currently able to build tests, so can't build benchmarks
%pom_disable_module jetty-jmh
# Distribution tests require internet access, so disable
%pom_disable_module test-distribution tests
# the default location is not allowed by SELinux
sed -i '/<SystemProperty name="jetty.state"/d' \
jetty-home/src/main/resources%{_sysconfdir}/jetty-started.xml
# remote-resources only copies about.html
%pom_remove_plugin :maven-remote-resources-plugin
# packages module configs, we don't need those in minimal
%pom_remove_plugin -r :maven-assembly-plugin
# only useful when tests are enabled (copies test deps)
%pom_remove_plugin :maven-dependency-plugin jetty-client
# all modules besides the current jetty-http2
%pom_disable_module jetty-ant
%pom_disable_module jetty-fcgi
%pom_disable_module jetty-servlets
%pom_disable_module apache-jstl
%pom_disable_module jetty-maven-plugin
%pom_disable_module jetty-jspc-maven-plugin
%pom_disable_module jetty-deploy
%pom_disable_module jetty-start
%pom_disable_module jetty-cdi
%pom_disable_module jetty-spring
%pom_disable_module jetty-jaspi
%pom_disable_module jetty-rewrite
%pom_disable_module jetty-nosql
%pom_disable_module jetty-unixsocket
%pom_disable_module tests
%pom_disable_module examples
%pom_disable_module jetty-quickstart
%pom_disable_module jetty-distribution
%pom_disable_module jetty-runner
%pom_disable_module jetty-http-spi
%pom_disable_module jetty-home
%pom_disable_module jetty-alpn
%pom_disable_module jetty-websocket
# minimal modules built in jetty-minimal package
%pom_disable_module jetty-annotations
%pom_disable_module jetty-client
%pom_disable_module jetty-continuation
%pom_disable_module jetty-http
%pom_disable_module jetty-io
%pom_disable_module jetty-jaas
%pom_disable_module jetty-jmx
%pom_disable_module jetty-jndi
%pom_disable_module apache-jsp
%pom_disable_module jetty-openid
%pom_disable_module jetty-plus
%pom_disable_module jetty-proxy
%pom_disable_module jetty-security
%pom_disable_module jetty-server
%pom_disable_module jetty-servlet
%pom_disable_module jetty-util
%pom_disable_module jetty-util-ajax
%pom_disable_module jetty-xml
%pom_disable_module jetty-webapp
%pom_xpath_remove "pom:plugins/pom:plugin[pom:artifactId='maven-javadoc-plugin']/pom:configuration/pom:additionalJOption"
%{mvn_file} :{*} %{base_name}/@1
%build
%{mvn_package} :jetty-home __noinstall
%{mvn_package} :jetty-distribution __noinstall
# Separate package for POMs
%{mvn_package} ':*-project' __noinstall
%{mvn_package} ':*-parent' __noinstall
%{mvn_package} ':*-bom' __noinstall
# artifact used by demo
%{mvn_package} :test-mock-resources
%{mvn_package} ':test-*' __noinstall
%{mvn_package} ':*-tests' __noinstall
%{mvn_package} ':*-it' __noinstall
%{mvn_package} ':example-*' __noinstall
%{mvn_package} org.eclipse.jetty.tests: __noinstall
%{mvn_package} ::war: __noinstall
%{mvn_package} :jetty-runner __noinstall
%{mvn_package} :build-resources __noinstall
%{mvn_package} org.eclipse.jetty.cdi: jetty-cdi
%{mvn_package} ':jetty-alpn*-client' jetty-alpn-client
%{mvn_package} ':jetty-alpn*-server' jetty-alpn-server
%{mvn_package} :apache-jsp jetty-jsp
%{mvn_alias} :apache-jsp :jetty-jsp
%{mvn_build} -f -s -- \
-Dproject.build.outputTimestamp=$(date -u -d @${SOURCE_DATE_EPOCH:-$(date +%%s)} +%%Y-%%m-%%dT%%H:%%M:%%SZ) \
%if %{?pkg_vcmp:%pkg_vcmp java-devel >= 9}%{!?pkg_vcmp:0}
-Dmaven.compiler.release=8 \
%endif
-Dsource=8
%install
%mvn_install
%fdupes -s %{buildroot}%{_javadocdir}
%files client -f .mfiles-http2-client
%files common -f .mfiles-http2-common
%files hpack -f .mfiles-http2-hpack
%files http-client-transport -f .mfiles-http2-http-client-transport
%files server -f .mfiles-http2-server
%files javadoc -f .mfiles-javadoc
%license LICENSE NOTICE.txt
%changelog

250
jetty-minimal.changes Normal file
View File

@ -0,0 +1,250 @@
-------------------------------------------------------------------
Thu Oct 17 12:27:25 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Package teh infrastructure pom artifacts too
-------------------------------------------------------------------
Thu Oct 17 09:47:04 UTC 2024 - Anton Shvetz <shvetz.anton@gmail.com>
- Fix the Group tag for jetty-server subpackage
- Clean up spec files
-------------------------------------------------------------------
Tue Oct 15 21:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.56.v20240826
* Security fixes:
+ CVE-2024-8184, bsc#1231651, ThreadLimitHandler.getRemote()
vulnerable to remote DoS attacks
* Changes:
+ #12201 backport ThreadLimitHandler improvements from Jetty 12
+ #11938 - Updating URL refs from eclipse.org/jetty and
eclipse.dev/jetty to jetty.org (including XML dtd references)
+ #10805 - Jetty response with an invalid HTTP2 packet if the
client set the hpack table size as 0
-------------------------------------------------------------------
Tue Feb 27 12:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.54.v20240208
* Security fixes
+ CVE-2024-22201, bsc#1220437: HTTP/2 connection not closed
after idle timeout when TCP congested
* Other changes
+ #1256 DoSFilter leaks USER_AUTH entries
+ #11389 Strip default ports on ws/wss scheme uris too
-------------------------------------------------------------------
Mon Oct 30 16:17:21 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Do not force Java 11 to build on i586
-------------------------------------------------------------------
Thu Oct 12 15:51:00 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.53.v20231009
* Fixes of 9.4.53.v20231009
+ CVE-2023-44487, bsc#1216169
+ CVE-2023-36478, bsc#1216162
+ #10679 - backport HTTP/2 rate control from Jetty 10.0.x
+ #10573 - backport hpack improvements from Jetty 10.0.x
+ #10546 - backport jetty-http Huffman encoders/decoders from
Jetty 10.0.x
* Fixes of 9.4.52.v20230823
+ #10352 - Jetty accepts "+" prefixed value in Content-Length
(CVE-2023-40167, bsc#1215417)
+ #10337 - SizeLimitHandler does not enforce 0 responseLimit
+ #10169 - make sure that a ServiceLoader is retrieved before
iterating
+ #10066 - Allow SAXParserFactory or SAXParser to be configured
in Jetty's XmlParser class - Allows for GHSA-58qw-p7qm-5rvh
workaround
+ #9887 - Deprecate CGI Servlet (CVE-2023-36479, bsc#1215415)
+ #9716 - Deprecate PushSessionCacheFilter
+ #9660 - OpenId Revoked authentication allows one request
(CVE-2023-41900, bsc#1215416)
+ #9476 - onCompleteFailure called multiple times
-------------------------------------------------------------------
Sat Sep 9 14:24:29 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp
-------------------------------------------------------------------
Sun May 21 05:09:16 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.51.v20230217
* Fixes of 9.4.49.v20220914:
+ #8578 - getRequestURL can append "null" if getRequestURI is
unspecified in an authority-form request-target
+ #8493 - Review HTTP client feature setRemoveIdleDestinations
* Fixes of 9.4.50.v20221201:
+ #8774 - Added SizeLimitHandler
+ #8678 - Jetty client is not responding to GO_AWAY packet
received from (Jetty) Server and continue to send traffic on
same connection
* Fixes of 9.4.51.v20230217:
+ #9352 - Update / Fix CookieCutter
+ #9345 - Backport Multipart Fix for CVE-2023-26048, bsc#1210620
+ #9352 - Backport Cookie Parsing Fix for CVE-2023-26049,
bsc#1210621
-------------------------------------------------------------------
Thu May 4 11:24:50 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>
- Add _multibuild to define 2nd spec file as additional flavor.
Eliminates the need for source package links in OBS.
-------------------------------------------------------------------
Thu Oct 13 11:21:47 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Force building with java 11 on ix86 in order to avoid random
build failures
-------------------------------------------------------------------
Fri Jul 8 15:15:05 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.48.v20220622
* Fixes
+ #8184 - All suffix globs except first fail to match if path
has "." character in prefix section
+ #8145 - RegexPathSpec backport of optional group name/info
lookup if regex fails
+ #8088 - Add option to configure exitVm on ShutdownMonitor from
System properties
+ #8067 - Wall time usage in DoSFilter RateTracker results in
false positive alert
+ #8014 - Review HttpRequest URI construction (Resolves
CVE-2022-2047, bsc#1201317)
+ #7976 - Add TRANSFER_ENCODING violation for MultiPart RFC7578
parser
+ #7947 - Improved PathSpec handling for servletName & pathInfo
+ #7935 - Review HTTP/2 error handling (Resolves CVE-2022-2048,
bsc#1201316)
+ #7918 - PathMappings.asPathSpec does not allow root
ServletPathSpec
+ #7863 - Default servlet drops first accept-encoding header if
there is more than one.
+ #7858 - GZipHandler does not play nice with other handlers in
HandlerCollection
+ #7837 - Fix StatisticsHandler in the case a Handler throws
exception
+ #7809 - Jetty 9.4.x 7801 duplicate set session cookies
+ #7748 - Allow overriding of url-pattern mapping in
ServletContextHandler to allow for regex or uri-template
matching
-------------------------------------------------------------------
Tue Mar 29 14:13:33 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.46.v20220328
* Changes
+ Option --write-module-graph produces wrong .dot file
+ ArrayTrie getBest fails to match the empty string entry in
certain cases
+ Interrupt flag is not always cleared in between requests
+ Gzip compression not working for multipart/form-data when
added to the allowed list using addIncludedMimeTypes.
+ Miconfigured headerCacheSize in can result in
IllegalArgumentException
+ HttpServletResponse.encodeURL not working for URLs starting
with ../
-------------------------------------------------------------------
Tue Mar 22 15:49:28 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Build with java source and target levels 8
- Fix javadoc generation on JDK >= 13
-------------------------------------------------------------------
Tue Oct 19 07:13:12 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Make importing of package sun.misc optional since not all jdk
versions export it
-------------------------------------------------------------------
Mon Jul 19 10:13:02 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Splitting the jetty-unixsocket artifact into a separate spec file
in order to avoid extra dependencies for the jetty-minimal
package.
-------------------------------------------------------------------
Mon Jul 19 06:58:23 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.43.v20210629
* Fix: bsc#1188438, CVE-2021-34429
* Changes:
+ Improve alias checking in PathResource
+ java.nio.ReadOnlyBufferException
+ Deprecate support for UTF16 encoding in URIs
+ Update to spifly 1.3.3
+ Update to asm 9.1
-------------------------------------------------------------------
Mon Jun 28 12:45:55 UTC 2021 - Anton Shvetz <shvetz.anton@gmail.com>
- Package modules: ant, cdi, deploy, fcgi, http-spi, quickstart,
rewrite, start, unixsocket
-------------------------------------------------------------------
Wed Jun 9 14:07:47 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.42.v20210604
* Fix: bsc#1187117, CVE-2021-28169
-------------------------------------------------------------------
Fri May 14 17:01:58 UTC 2021 - Ferdinand Thiessen <rpm@fthiessen.de>
- Update to version 9.4.40.v20210413
* Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when
client send data length > 17408
* Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
* Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory
from deployment scan
-------------------------------------------------------------------
Fri Mar 12 11:11:07 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.38.v20210224
* Fixes bsc#1182898, CVE-2020-27223
-------------------------------------------------------------------
Mon Dec 7 18:12:50 UTC 2020 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.35.v20201120
* Fixes bsc#1179727, CVE-2020-27218
-------------------------------------------------------------------
Thu Nov 19 13:05:09 UTC 2020 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.30.v20200611
-------------------------------------------------------------------
Thu Apr 2 09:25:19 UTC 2020 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.27.v20200227
-------------------------------------------------------------------
Thu Nov 28 09:02:29 UTC 2019 - Fridrich Strba <fstrba@suse.com>
- Removed patch:
* jetty-annotations-asm6.patch
+ not needed when building against ASM7
-------------------------------------------------------------------
Fri Nov 8 06:52:36 UTC 2019 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 2.9.22.v20191022
* new jetty-openid amd jetty-util-ajax sub-packages
- Modified patch:
* jetty-annotations-asm6.patch
+ adapt to changed context
+ build against asm6 instead of asm7 that we don't have
- Fix some rpmlint warnings and errors
-------------------------------------------------------------------
Tue Nov 5 15:39:31 UTC 2019 - Fridrich Strba <fstrba@suse.com>
- Initial packaging of a minimal version of jetty 9.4.19.v20190610
* This version is light on dependencies

519
jetty-minimal.spec Normal file
View File

@ -0,0 +1,519 @@
#
# spec file for package jetty-minimal
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2000-2007, JPackage Project
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global base_name jetty
%global addver .v20240826
%define src_name %{base_name}.project-%{base_name}-%{version}%{addver}
Name: %{base_name}-minimal
Version: 9.4.56
Release: 0
Summary: Java Webserver and Servlet Container
License: Apache-2.0 OR EPL-1.0
Group: Productivity/Networking/Web/Servers
URL: https://www.eclipse.org/jetty/
Source0: https://github.com/eclipse/%{base_name}.project/archive/%{base_name}-%{version}%{addver}.tar.gz#/%{src_name}.tar.gz
BuildRequires: fdupes
BuildRequires: java-devel >= 1.8
BuildRequires: maven-local
BuildRequires: mvn(javax.annotation:javax.annotation-api)
BuildRequires: mvn(javax.servlet:javax.servlet-api)
BuildRequires: mvn(javax.transaction:javax.transaction-api)
BuildRequires: mvn(org.apache.ant:ant)
BuildRequires: mvn(org.apache.ant:ant-launcher)
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.apache.maven.plugins:maven-dependency-plugin)
BuildRequires: mvn(org.apache.maven.plugins:maven-shade-plugin)
BuildRequires: mvn(org.apache.tomcat:tomcat-jasper)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.eclipse.jetty.orbit:javax.mail.glassfish)
BuildRequires: mvn(org.eclipse.jetty.toolchain:jetty-schemas)
BuildRequires: mvn(org.jboss.logging:jboss-logging)
BuildRequires: mvn(org.ow2.asm:asm)
BuildRequires: mvn(org.ow2.asm:asm-commons)
BuildRequires: mvn(org.slf4j:slf4j-api)
BuildArch: noarch
%description
%global desc \
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\
do not need to configure and run a separate web server (like Apache) in order\
to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\
featured web server for static and dynamic content. Unlike separate\
server/container solutions, this means that your web server and web\
application run in the same process, without interconnection overheads\
and complications. Furthermore, as a pure java component, Jetty can be simply\
included in your application for demonstration, distribution or deployment.\
Jetty is available on all Java supported platforms.
%global extdesc %{desc}\
\
This package contains
%{desc}
%package -n %{base_name}-annotations
Summary: The annotations module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-annotations
%{extdesc} %{summary}.
%package -n %{base_name}-ant
Summary: The ant module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-ant
%{extdesc} %{summary}.
%package -n %{base_name}-cdi
Summary: The cdi module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-cdi
%{extdesc} %{summary}.
%package -n %{base_name}-client
Summary: The client module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-client
%{extdesc} %{summary}.
%package -n %{base_name}-continuation
Summary: The continuation module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-continuation
%{extdesc} %{summary}.
%package -n %{base_name}-deploy
Summary: The deploy module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-deploy
%{extdesc} %{summary}.
%package -n %{base_name}-fcgi
Summary: The fcgi module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-fcgi
%{extdesc} %{summary}.
%package -n %{base_name}-http
Summary: The http module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-http
%{extdesc} %{summary}.
%package -n %{base_name}-http-spi
Summary: The http-spi module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-http-spi
%{extdesc} %{summary}.
%package -n %{base_name}-io
Summary: The io module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-io
%{extdesc} %{summary}.
%package -n %{base_name}-jaas
Summary: The jaas module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-jaas
%{extdesc} %{summary}.
%package -n %{base_name}-jmx
Summary: The jmx module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-jmx
%{extdesc} %{summary}.
%package -n %{base_name}-jndi
Summary: The jndi module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-jndi
%{extdesc} %{summary}.
%package -n %{base_name}-jsp
Summary: The jsp module for Jetty
Group: Productivity/Networking/Web/Servers
Requires: glassfish-el
%description -n %{base_name}-jsp
%{extdesc} %{summary}.
%package -n %{base_name}-openid
Summary: The openid module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-openid
%{extdesc} %{summary}.
%package -n %{base_name}-plus
Summary: The plus module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-plus
%{extdesc} %{summary}.
%package -n %{base_name}-proxy
Summary: The proxy module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-proxy
%{extdesc} %{summary}.
%package -n %{base_name}-quickstart
Summary: The quickstart module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-quickstart
%{extdesc} %{summary}.
%package -n %{base_name}-rewrite
Summary: The rewrite module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-rewrite
%{extdesc} %{summary}.
%package -n %{base_name}-security
Summary: The security module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-security
%{extdesc} %{summary}.
%package -n %{base_name}-server
Summary: The server module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-server
%{extdesc} %{summary}.
%package -n %{base_name}-servlet
Summary: The servlet module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-servlet
%{extdesc} %{summary}.
%package -n %{base_name}-servlets
Summary: The servlets module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-servlets
%{extdesc} %{summary}.
%package -n %{base_name}-start
Summary: The start module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-start
%{extdesc} %{summary}.
%package -n %{base_name}-util
Summary: The util module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-util
%{extdesc} %{summary}.
%package -n %{base_name}-util-ajax
Summary: The util-ajax module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-util-ajax
%{extdesc} %{summary}.
%package -n %{base_name}-webapp
Summary: The webapp module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-webapp
%{extdesc} %{summary}.
%package -n %{base_name}-xml
Summary: The xml module for Jetty
Group: Productivity/Networking/Web/Servers
%description -n %{base_name}-xml
%{extdesc} %{summary}.
%package -n %{base_name}-project
Summary: POM files for Jetty
%description -n %{base_name}-project
%{extdesc} %{summary}.
%package javadoc
Summary: Javadoc for %{name}
Group: Productivity/Networking/Web/Servers
%description javadoc
%{summary}.
%prep
%setup -q -n %{src_name}
find . -name "*.?ar" -exec rm {} \;
find . -name "*.class" -exec rm {} \;
%pom_remove_dep :::import
# Plugins irrelevant or harmful to building the package
%pom_remove_plugin -r :maven-checkstyle-plugin
%pom_remove_plugin -r :maven-enforcer-plugin
%pom_remove_plugin -r :maven-eclipse-plugin
%pom_remove_plugin -r :license-maven-plugin
%pom_remove_plugin -r :maven-site-plugin
%pom_remove_plugin -r :maven-source-plugin
%pom_remove_plugin -r :maven-deploy-plugin
%pom_remove_plugin -r :jacoco-maven-plugin
%pom_remove_plugin -r :maven-release-plugin
%pom_remove_plugin -r :buildnumber-maven-plugin
%pom_remove_plugin -r :h2spec-maven-plugin
# Unnecessary pom flattening can be skipped
%pom_remove_plugin -r :flatten-maven-plugin jetty-bom
%pom_disable_module aggregates/jetty-all
%pom_xpath_inject "pom:configuration/pom:instructions" \
"<Import-Package>sun.misc;resolution:=optional,com.sun.nio.file;resolution:=optional,*</Import-Package>"
%pom_remove_dep "com.sun.net.httpserver:http" jetty-http-spi
%pom_change_dep -r org.mortbay.jasper:apache-jsp org.apache.tomcat:tomcat-jasper
%pom_add_dep 'org.junit.jupiter:junit-jupiter-engine:${junit.version}' tests/test-sessions/test-sessions-common
# provided by glassfish-jsp-api that has newer version
%pom_change_dep -r javax.servlet.jsp:jsp-api javax.servlet.jsp:javax.servlet.jsp-api
# txt artifact - not installable
%pom_remove_plugin ":jetty-version-maven-plugin"
%pom_xpath_remove "pom:artifactItem[pom:classifier='version']" jetty-home
# Disable building source release
%pom_xpath_remove 'pom:execution[pom:id="sources"]' jetty-home
# Unwanted JS in javadoc
sed -i '/^\s*\*.*<script>/d' jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java
# only used for integration tests
%pom_remove_plugin :maven-invoker-plugin jetty-jspc-maven-plugin
# These bundles have a dep on Eclipse that is not available on every arch
%pom_disable_module jetty-osgi
# We don't have asciidoctor-maven-plugin
%pom_disable_module jetty-documentation
%pom_remove_dep -r :jetty-documentation
%pom_xpath_remove 'pom:execution[pom:id="unpack-documentation"]' jetty-distribution
%pom_xpath_remove 'pom:artifactItem[pom:artifactId="libsetuid-osx"]' jetty-home/pom.xml
# TODO remove when jetty-setuid is packaged
%pom_xpath_remove "pom:execution[pom:id='copy-setuid-deps']" jetty-home/pom.xml
# We don't have gcloud-java-datastore
%pom_disable_module jetty-gcloud
%pom_disable_module test-gcloud-sessions tests/test-sessions
%pom_remove_dep :jetty-gcloud-session-manager jetty-home
# we don't have com.googlecode.xmemcached:xmemcached yet
%pom_disable_module jetty-memcached
%pom_disable_module test-memcached-sessions tests/test-sessions
%pom_remove_dep :jetty-memcached-sessions jetty-home
# We don't have hazelcast
%pom_disable_module jetty-hazelcast
%pom_disable_module test-hazelcast-sessions tests/test-sessions
%pom_remove_dep :jetty-hazelcast jetty-home
# We don't have infinispan
%pom_disable_module jetty-infinispan
%pom_disable_module test-infinispan-sessions tests/test-sessions
%pom_remove_dep :infinispan-embedded jetty-home
%pom_remove_dep :infinispan-embedded-query jetty-home
%pom_remove_dep :infinispan-remote jetty-home
%pom_remove_dep :infinispan-remote-query jetty-home
%pom_xpath_remove "pom:execution[pom:id='unpack-infinispan-config']" jetty-home
# Not currently able to build tests, so can't build benchmarks
%pom_disable_module jetty-jmh
# Distribution tests require internet access, so disable
%pom_disable_module test-distribution tests
%pom_change_dep org.apache.directory.api: :::test jetty-jaas
# the default location is not allowed by SELinux
sed -i '/<SystemProperty name="jetty.state"/d' \
jetty-home/src/main/resources%{_sysconfdir}/jetty-started.xml
# remote-resources only copies about.html
%pom_remove_plugin :maven-remote-resources-plugin
# packages module configs, we don't need those in minimal
%pom_remove_plugin -r :maven-assembly-plugin
# only useful when tests are enabled (copies test deps)
%pom_remove_plugin :maven-dependency-plugin jetty-client
%pom_disable_module jetty-http2
%pom_disable_module jetty-websocket
%pom_disable_module apache-jstl
%pom_disable_module jetty-maven-plugin
%pom_disable_module jetty-jspc-maven-plugin
%pom_disable_module jetty-spring
%pom_disable_module jetty-jaspi
%pom_disable_module jetty-nosql
%pom_disable_module tests
%pom_disable_module examples
%pom_disable_module jetty-distribution
%pom_disable_module jetty-runner
%pom_disable_module jetty-unixsocket
%pom_disable_module jetty-alpn
%pom_disable_module jetty-home
%pom_xpath_remove "pom:plugins/pom:plugin[pom:artifactId='maven-javadoc-plugin']/pom:configuration/pom:additionalJOption"
%{mvn_file} :{*} %{base_name}/@1
%build
%{mvn_package} :jetty-home __noinstall
%{mvn_package} :jetty-distribution __noinstall
# Separate package for POMs
%{mvn_package} ':*-project' project
%{mvn_package} ':*-parent' project
%{mvn_package} ':*-bom' project
# artifact used by demo
%{mvn_package} :test-mock-resources
%{mvn_package} ':test-*' __noinstall
%{mvn_package} ':*-tests' __noinstall
%{mvn_package} ':*-it' __noinstall
%{mvn_package} ':example-*' __noinstall
%{mvn_package} org.eclipse.jetty.tests: __noinstall
%{mvn_package} ::war: __noinstall
%{mvn_package} :jetty-runner __noinstall
%{mvn_package} :build-resources __noinstall
%{mvn_package} org.eclipse.jetty.cdi: jetty-cdi
%{mvn_package} ':jetty-alpn*-client' jetty-alpn-client
%{mvn_package} ':jetty-alpn*-server' jetty-alpn-server
%{mvn_package} :apache-jsp jetty-jsp
%{mvn_alias} :apache-jsp :jetty-jsp
# we don't have all necessary dependencies to run tests
# missing test dep: org.eclipse.jetty.toolchain:jetty-perf-helper
%{mvn_build} -f -s -- \
-Dproject.build.outputTimestamp=$(date -u -d @${SOURCE_DATE_EPOCH:-$(date +%%s)} +%%Y-%%m-%%dT%%H:%%M:%%SZ) \
%if %{?pkg_vcmp:%pkg_vcmp java-devel >= 9}%{!?pkg_vcmp:0}
-Dmaven.compiler.release=8 \
%endif
-Dsource=8
%install
%mvn_install
%fdupes -s %{buildroot}%{_javadocdir}
# Apache Ant stuff
install -dm0755 %{buildroot}%{_sysconfdir}/ant.d
install -dm0755 %{buildroot}%{_datadir}/ant/lib
echo $(for jar in %{buildroot}%{_javadir}/%{base_name}/*.jar; do echo %{base_name}/$(basename $jar .jar); done) \
>%{buildroot}%{_sysconfdir}/ant.d/%{base_name}
ln -s %{_javadir}/%{base_name}/%{base_name}-ant.jar %{buildroot}%{_datadir}/ant/lib/
%files -n %{base_name}-annotations -f .mfiles-jetty-annotations
%files -n %{base_name}-ant -f .mfiles-jetty-ant
%config %{_sysconfdir}/ant.d/%{base_name}
%{_datadir}/ant/lib/%{base_name}-ant.jar
%files -n %{base_name}-cdi -f .mfiles-jetty-cdi
%files -n %{base_name}-client -f .mfiles-jetty-client
%files -n %{base_name}-continuation -f .mfiles-jetty-continuation
%files -n %{base_name}-deploy -f .mfiles-jetty-deploy
%files -n %{base_name}-fcgi -f .mfiles-fcgi-server -f .mfiles-fcgi-client
%files -n %{base_name}-http-spi -f .mfiles-jetty-http-spi
%files -n %{base_name}-jaas -f .mfiles-jetty-jaas
%files -n %{base_name}-jndi -f .mfiles-jetty-jndi
%files -n %{base_name}-jsp -f .mfiles-jetty-jsp
%files -n %{base_name}-io -f .mfiles-jetty-io
%files -n %{base_name}-openid -f .mfiles-jetty-openid
%files -n %{base_name}-server -f .mfiles-jetty-server
%files -n %{base_name}-servlet -f .mfiles-jetty-servlet
%files -n %{base_name}-start -f .mfiles-jetty-start
%files -n %{base_name}-util -f .mfiles-jetty-util
%files -n %{base_name}-util-ajax -f .mfiles-jetty-util-ajax
%files -n %{base_name}-webapp -f .mfiles-jetty-webapp
%files -n %{base_name}-jmx -f .mfiles-jetty-jmx
%files -n %{base_name}-xml -f .mfiles-jetty-xml
%files -n %{base_name}-http -f .mfiles-jetty-http
%files -n %{base_name}-proxy -f .mfiles-jetty-proxy
%files -n %{base_name}-plus -f .mfiles-jetty-plus
%files -n %{base_name}-project -f .mfiles-project
%files -n %{base_name}-quickstart -f .mfiles-jetty-quickstart
%files -n %{base_name}-rewrite -f .mfiles-jetty-rewrite
%files -n %{base_name}-security -f .mfiles-jetty-security
%files -n %{base_name}-servlets -f .mfiles-jetty-servlets
%files javadoc -f .mfiles-javadoc
%license LICENSE NOTICE.txt
%changelog

141
jetty-unixsocket.changes Normal file
View File

@ -0,0 +1,141 @@
-------------------------------------------------------------------
Tue Oct 15 21:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.56.v20240826
* Security fixes:
+ CVE-2024-8184, bsc#1231651, ThreadLimitHandler.getRemote()
vulnerable to remote DoS attacks
* Changes:
+ #12201 backport ThreadLimitHandler improvements from Jetty 12
+ #11938 - Updating URL refs from eclipse.org/jetty and
eclipse.dev/jetty to jetty.org (including XML dtd references)
+ #10805 - Jetty response with an invalid HTTP2 packet if the
client set the hpack table size as 0
-------------------------------------------------------------------
Tue Feb 27 12:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.54.v20240208
* Security fixes
+ CVE-2024-22201, bsc#1220437: HTTP/2 connection not closed
after idle timeout when TCP congested
* Other changes
+ #1256 DoSFilter leaks USER_AUTH entries
+ #11389 Strip default ports on ws/wss scheme uris too
-------------------------------------------------------------------
Thu Oct 12 15:51:00 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.53.v20231009
* Fixes of 9.4.53.v20231009
+ CVE-2023-44487, bsc#1216169
+ CVE-2023-36478, bsc#1216162
+ #10679 - backport HTTP/2 rate control from Jetty 10.0.x
+ #10573 - backport hpack improvements from Jetty 10.0.x
+ #10546 - backport jetty-http Huffman encoders/decoders from
Jetty 10.0.x
* Fixes of 9.4.52.v20230823
+ #10352 - Jetty accepts "+" prefixed value in Content-Length
(CVE-2023-40167, bsc#1215417)
+ #10337 - SizeLimitHandler does not enforce 0 responseLimit
+ #10169 - make sure that a ServiceLoader is retrieved before
iterating
+ #10066 - Allow SAXParserFactory or SAXParser to be configured
in Jetty's XmlParser class - Allows for GHSA-58qw-p7qm-5rvh
workaround
+ #9887 - Deprecate CGI Servlet (CVE-2023-36479, bsc#1215415)
+ #9716 - Deprecate PushSessionCacheFilter
+ #9660 - OpenId Revoked authentication allows one request
(CVE-2023-41900, bsc#1215416)
+ #9476 - onCompleteFailure called multiple times
-------------------------------------------------------------------
Sat Sep 9 14:24:30 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp
-------------------------------------------------------------------
Sun May 21 05:09:16 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.51.v20230217
* Fixes of 9.4.49.v20220914:
+ #8578 - getRequestURL can append "null" if getRequestURI is
unspecified in an authority-form request-target
+ #8493 - Review HTTP client feature setRemoveIdleDestinations
* Fixes of 9.4.50.v20221201:
+ #8774 - Added SizeLimitHandler
+ #8678 - Jetty client is not responding to GO_AWAY packet
received from (Jetty) Server and continue to send traffic on
same connection
* Fixes of 9.4.51.v20230217:
+ #9352 - Update / Fix CookieCutter
+ #9345 - Backport Multipart Fix for CVE-2023-26048, bsc#1210620
+ #9352 - Backport Cookie Parsing Fix for CVE-2023-26049,
bsc#1210621
-------------------------------------------------------------------
Fri Jul 8 15:15:05 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.48.v20220622
* Fixes
+ #8184 - All suffix globs except first fail to match if path
has "." character in prefix section
+ #8145 - RegexPathSpec backport of optional group name/info
lookup if regex fails
+ #8088 - Add option to configure exitVm on ShutdownMonitor from
System properties
+ #8067 - Wall time usage in DoSFilter RateTracker results in
false positive alert
+ #8014 - Review HttpRequest URI construction (Resolves
CVE-2022-2047, bsc#1201317)
+ #7976 - Add TRANSFER_ENCODING violation for MultiPart RFC7578
parser
+ #7947 - Improved PathSpec handling for servletName & pathInfo
+ #7935 - Review HTTP/2 error handling (Resolves CVE-2022-2048,
bsc#1201316)
+ #7918 - PathMappings.asPathSpec does not allow root
ServletPathSpec
+ #7863 - Default servlet drops first accept-encoding header if
there is more than one.
+ #7858 - GZipHandler does not play nice with other handlers in
HandlerCollection
+ #7837 - Fix StatisticsHandler in the case a Handler throws
exception
+ #7809 - Jetty 9.4.x 7801 duplicate set session cookies
+ #7748 - Allow overriding of url-pattern mapping in
ServletContextHandler to allow for regex or uri-template
matching
-------------------------------------------------------------------
Tue Mar 29 14:13:33 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.46.v20220328
* Changes
+ Option --write-module-graph produces wrong .dot file
+ ArrayTrie getBest fails to match the empty string entry in
certain cases
+ Interrupt flag is not always cleared in between requests
+ Gzip compression not working for multipart/form-data when
added to the allowed list using addIncludedMimeTypes.
+ Miconfigured headerCacheSize in can result in
IllegalArgumentException
+ HttpServletResponse.encodeURL not working for URLs starting
with ../
-------------------------------------------------------------------
Tue Mar 22 15:49:28 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Build with java source and target levels 8
- Fix javadoc generation on JDK >= 13
-------------------------------------------------------------------
Tue Oct 19 07:13:12 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Make importing of package sun.misc optional since not all jdk
versions export it
-------------------------------------------------------------------
Mon Jul 19 10:11:08 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Splitting jetty-unixsocket 9.4.43.v20210629 into a separate spec
file

263
jetty-unixsocket.spec Normal file
View File

@ -0,0 +1,263 @@
#
# spec file for package jetty-unixsocket
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2000-2007, JPackage Project
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global base_name jetty
%global addver .v20240826
%define src_name %{base_name}.project-%{base_name}-%{version}%{addver}
Name: %{base_name}-unixsocket
Version: 9.4.56
Release: 0
Summary: The unixsocket modules for Jetty
License: Apache-2.0 OR EPL-1.0
URL: https://www.eclipse.org/jetty/
Source0: https://github.com/eclipse/%{base_name}.project/archive/%{base_name}-%{version}%{addver}.tar.gz#/%{src_name}.tar.gz
BuildRequires: fdupes
BuildRequires: java-devel >= 1.8
BuildRequires: maven-local
BuildRequires: mvn(com.github.jnr:jnr-unixsocket)
BuildRequires: mvn(org.apache.ant:ant)
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.apache.maven.plugins:maven-antrun-plugin)
BuildRequires: mvn(org.apache.maven.plugins:maven-dependency-plugin)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.eclipse.jetty:jetty-client) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-server) >= %{version}
BuildArch: noarch
%description
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\
do not need to configure and run a separate web server (like Apache) in order\
to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\
featured web server for static and dynamic content. Unlike separate\
server/container solutions, this means that your web server and web\
application run in the same process, without interconnection overheads\
and complications. Furthermore, as a pure java component, Jetty can be simply\
included in your application for demonstration, distribution or deployment.\
Jetty is available on all Java supported platforms.
This package contains the unixsocket module for Jetty
%package javadoc
Summary: Javadoc for %{name}
%description javadoc
%{summary}.
%prep
%setup -q -n %{src_name}
find . -name "*.?ar" -exec rm {} \;
find . -name "*.class" -exec rm {} \;
%pom_remove_dep :::import
# Plugins irrelevant or harmful to building the package
%pom_remove_plugin -r :maven-checkstyle-plugin
%pom_remove_plugin -r :maven-enforcer-plugin
%pom_remove_plugin -r :maven-eclipse-plugin
%pom_remove_plugin -r :license-maven-plugin
%pom_remove_plugin -r :maven-site-plugin
%pom_remove_plugin -r :maven-source-plugin
%pom_remove_plugin -r :maven-deploy-plugin
%pom_remove_plugin -r :jacoco-maven-plugin
%pom_remove_plugin -r :maven-release-plugin
%pom_remove_plugin -r :buildnumber-maven-plugin
%pom_remove_plugin -r :h2spec-maven-plugin
# Unnecessary pom flattening can be skipped
%pom_remove_plugin -r :flatten-maven-plugin jetty-bom
%pom_disable_module aggregates/jetty-all
%pom_xpath_inject "pom:configuration/pom:instructions" \
"<Import-Package>sun.misc;resolution:=optional,com.sun.nio.file;resolution:=optional,*</Import-Package>"
%pom_remove_dep "com.sun.net.httpserver:http" jetty-http-spi
%pom_change_dep -r org.mortbay.jasper:apache-jsp org.apache.tomcat:tomcat-jasper
%pom_add_dep 'org.junit.jupiter:junit-jupiter-engine:${junit.version}' tests/test-sessions/test-sessions-common
# provided by glassfish-jsp-api that has newer version
%pom_change_dep -r javax.servlet.jsp:jsp-api javax.servlet.jsp:javax.servlet.jsp-api
# txt artifact - not installable
%pom_remove_plugin ":jetty-version-maven-plugin"
%pom_xpath_remove "pom:artifactItem[pom:classifier='version']" jetty-home
# Disable building source release
%pom_xpath_remove 'pom:execution[pom:id="sources"]' jetty-home
# Unwanted JS in javadoc
sed -i '/^\s*\*.*<script>/d' jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java
# only used for integration tests
%pom_remove_plugin :maven-invoker-plugin jetty-jspc-maven-plugin
# These bundles have a dep on Eclipse that is not available on every arch
%pom_disable_module jetty-osgi
# We don't have asciidoctor-maven-plugin
%pom_disable_module jetty-documentation
%pom_remove_dep -r :jetty-documentation
%pom_xpath_remove 'pom:execution[pom:id="unpack-documentation"]' jetty-distribution
%pom_xpath_remove 'pom:artifactItem[pom:artifactId="libsetuid-osx"]' jetty-home/pom.xml
# TODO remove when jetty-setuid is packaged
%pom_xpath_remove "pom:execution[pom:id='copy-setuid-deps']" jetty-home/pom.xml
# We don't have gcloud-java-datastore
%pom_disable_module jetty-gcloud
%pom_disable_module test-gcloud-sessions tests/test-sessions
%pom_remove_dep :jetty-gcloud-session-manager jetty-home
# we don't have com.googlecode.xmemcached:xmemcached yet
%pom_disable_module jetty-memcached
%pom_disable_module test-memcached-sessions tests/test-sessions
%pom_remove_dep :jetty-memcached-sessions jetty-home
# We don't have hazelcast
%pom_disable_module jetty-hazelcast
%pom_disable_module test-hazelcast-sessions tests/test-sessions
%pom_remove_dep :jetty-hazelcast jetty-home
# We don't have infinispan
%pom_disable_module jetty-infinispan
%pom_disable_module test-infinispan-sessions tests/test-sessions
%pom_remove_dep :infinispan-embedded jetty-home
%pom_remove_dep :infinispan-embedded-query jetty-home
%pom_remove_dep :infinispan-remote jetty-home
%pom_remove_dep :infinispan-remote-query jetty-home
%pom_xpath_remove "pom:execution[pom:id='unpack-infinispan-config']" jetty-home
# Not currently able to build tests, so can't build benchmarks
%pom_disable_module jetty-jmh
# Distribution tests require internet access, so disable
%pom_disable_module test-distribution tests
# the default location is not allowed by SELinux
sed -i '/<SystemProperty name="jetty.state"/d' \
jetty-home/src/main/resources%{_sysconfdir}/jetty-started.xml
# remote-resources only copies about.html
%pom_remove_plugin :maven-remote-resources-plugin
# packages module configs, we don't need those in minimal
%pom_remove_plugin -r :maven-assembly-plugin
# only useful when tests are enabled (copies test deps)
%pom_remove_plugin :maven-dependency-plugin jetty-client
# all modules besides the current jetty-unixsocket
%pom_disable_module jetty-ant
%pom_disable_module jetty-http2
%pom_disable_module jetty-fcgi
%pom_disable_module jetty-servlets
%pom_disable_module apache-jstl
%pom_disable_module jetty-maven-plugin
%pom_disable_module jetty-jspc-maven-plugin
%pom_disable_module jetty-deploy
%pom_disable_module jetty-start
%pom_disable_module jetty-cdi
%pom_disable_module jetty-spring
%pom_disable_module jetty-jaspi
%pom_disable_module jetty-rewrite
%pom_disable_module jetty-nosql
%pom_disable_module tests
%pom_disable_module examples
%pom_disable_module jetty-quickstart
%pom_disable_module jetty-distribution
%pom_disable_module jetty-runner
%pom_disable_module jetty-http-spi
%pom_disable_module jetty-alpn
%pom_disable_module jetty-home
%pom_disable_module jetty-websocket
# minimal modules built in jetty-minimal package
%pom_disable_module jetty-annotations
%pom_disable_module jetty-client
%pom_disable_module jetty-continuation
%pom_disable_module jetty-http
%pom_disable_module jetty-io
%pom_disable_module jetty-jaas
%pom_disable_module jetty-jmx
%pom_disable_module jetty-jndi
%pom_disable_module apache-jsp
%pom_disable_module jetty-openid
%pom_disable_module jetty-plus
%pom_disable_module jetty-proxy
%pom_disable_module jetty-security
%pom_disable_module jetty-server
%pom_disable_module jetty-servlet
%pom_disable_module jetty-util
%pom_disable_module jetty-util-ajax
%pom_disable_module jetty-xml
%pom_disable_module jetty-webapp
%pom_xpath_remove "pom:plugins/pom:plugin[pom:artifactId='maven-javadoc-plugin']/pom:configuration/pom:additionalJOption"
%{mvn_file} :{*} %{base_name}/@1
%build
%{mvn_package} :jetty-home __noinstall
%{mvn_package} :jetty-distribution __noinstall
# Separate package for POMs
%{mvn_package} ':*-project' __noinstall
%{mvn_package} ':*-parent' __noinstall
%{mvn_package} ':*-bom' __noinstall
# artifact used by demo
%{mvn_package} :test-mock-resources
%{mvn_package} ':test-*' __noinstall
%{mvn_package} ':*-tests' __noinstall
%{mvn_package} ':*-it' __noinstall
%{mvn_package} ':example-*' __noinstall
%{mvn_package} org.eclipse.jetty.tests: __noinstall
%{mvn_package} ::war: __noinstall
%{mvn_package} :jetty-runner __noinstall
%{mvn_package} :build-resources __noinstall
%{mvn_package} org.eclipse.jetty.cdi: jetty-cdi
%{mvn_package} ':jetty-alpn*-client' jetty-alpn-client
%{mvn_package} ':jetty-alpn*-server' jetty-alpn-server
%{mvn_package} :apache-jsp jetty-jsp
%{mvn_alias} :apache-jsp :jetty-jsp
%{mvn_build} -f -- \
-Dproject.build.outputTimestamp=$(date -u -d @${SOURCE_DATE_EPOCH:-$(date +%%s)} +%%Y-%%m-%%dT%%H:%%M:%%SZ) \
%if %{?pkg_vcmp:%pkg_vcmp java-devel >= 9}%{!?pkg_vcmp:0}
-Dmaven.compiler.release=8 \
%endif
-Dsource=8
%install
%mvn_install
%fdupes -s %{buildroot}%{_javadocdir}
%files -f .mfiles
%files javadoc -f .mfiles-javadoc
%license LICENSE NOTICE.txt
%changelog

203
jetty-websocket.changes Normal file
View File

@ -0,0 +1,203 @@
-------------------------------------------------------------------
Tue Oct 15 21:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.56.v20240826
* Security fixes:
+ CVE-2024-8184, bsc#1231651, ThreadLimitHandler.getRemote()
vulnerable to remote DoS attacks
* Changes:
+ #12201 backport ThreadLimitHandler improvements from Jetty 12
+ #11938 - Updating URL refs from eclipse.org/jetty and
eclipse.dev/jetty to jetty.org (including XML dtd references)
+ #10805 - Jetty response with an invalid HTTP2 packet if the
client set the hpack table size as 0
-------------------------------------------------------------------
Tue Feb 27 12:27:27 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.54.v20240208
* Security fixes
+ CVE-2024-22201, bsc#1220437: HTTP/2 connection not closed
after idle timeout when TCP congested
* Other changes
+ #1256 DoSFilter leaks USER_AUTH entries
+ #11389 Strip default ports on ws/wss scheme uris too
-------------------------------------------------------------------
Thu Oct 12 15:51:00 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.53.v20231009
* Fixes of 9.4.53.v20231009
+ CVE-2023-44487, bsc#1216169
+ CVE-2023-36478, bsc#1216162
+ #10679 - backport HTTP/2 rate control from Jetty 10.0.x
+ #10573 - backport hpack improvements from Jetty 10.0.x
+ #10546 - backport jetty-http Huffman encoders/decoders from
Jetty 10.0.x
* Fixes of 9.4.52.v20230823
+ #10352 - Jetty accepts "+" prefixed value in Content-Length
(CVE-2023-40167, bsc#1215417)
+ #10337 - SizeLimitHandler does not enforce 0 responseLimit
+ #10169 - make sure that a ServiceLoader is retrieved before
iterating
+ #10066 - Allow SAXParserFactory or SAXParser to be configured
in Jetty's XmlParser class - Allows for GHSA-58qw-p7qm-5rvh
workaround
+ #9887 - Deprecate CGI Servlet (CVE-2023-36479, bsc#1215415)
+ #9716 - Deprecate PushSessionCacheFilter
+ #9660 - OpenId Revoked authentication allows one request
(CVE-2023-41900, bsc#1215416)
+ #9476 - onCompleteFailure called multiple times
-------------------------------------------------------------------
Sat Sep 9 14:24:30 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp
-------------------------------------------------------------------
Sun May 21 05:09:16 UTC 2023 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.51.v20230217
* Fixes of 9.4.49.v20220914:
+ #8578 - getRequestURL can append "null" if getRequestURI is
unspecified in an authority-form request-target
+ #8493 - Review HTTP client feature setRemoveIdleDestinations
* Fixes of 9.4.50.v20221201:
+ #8774 - Added SizeLimitHandler
+ #8678 - Jetty client is not responding to GO_AWAY packet
received from (Jetty) Server and continue to send traffic on
same connection
* Fixes of 9.4.51.v20230217:
+ #9352 - Update / Fix CookieCutter
+ #9345 - Backport Multipart Fix for CVE-2023-26048, bsc#1210620
+ #9352 - Backport Cookie Parsing Fix for CVE-2023-26049,
bsc#1210621
-------------------------------------------------------------------
Fri Jul 8 15:15:05 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.48.v20220622
* Fixes
+ #8184 - All suffix globs except first fail to match if path
has "." character in prefix section
+ #8145 - RegexPathSpec backport of optional group name/info
lookup if regex fails
+ #8088 - Add option to configure exitVm on ShutdownMonitor from
System properties
+ #8067 - Wall time usage in DoSFilter RateTracker results in
false positive alert
+ #8014 - Review HttpRequest URI construction (Resolves
CVE-2022-2047, bsc#1201317)
+ #7976 - Add TRANSFER_ENCODING violation for MultiPart RFC7578
parser
+ #7947 - Improved PathSpec handling for servletName & pathInfo
+ #7935 - Review HTTP/2 error handling (Resolves CVE-2022-2048,
bsc#1201316)
+ #7918 - PathMappings.asPathSpec does not allow root
ServletPathSpec
+ #7863 - Default servlet drops first accept-encoding header if
there is more than one.
+ #7858 - GZipHandler does not play nice with other handlers in
HandlerCollection
+ #7837 - Fix StatisticsHandler in the case a Handler throws
exception
+ #7809 - Jetty 9.4.x 7801 duplicate set session cookies
+ #7748 - Allow overriding of url-pattern mapping in
ServletContextHandler to allow for regex or uri-template
matching
-------------------------------------------------------------------
Tue Mar 29 14:13:33 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Upgrade to version 9.4.46.v20220328
* Changes
+ Option --write-module-graph produces wrong .dot file
+ ArrayTrie getBest fails to match the empty string entry in
certain cases
+ Interrupt flag is not always cleared in between requests
+ Gzip compression not working for multipart/form-data when
added to the allowed list using addIncludedMimeTypes.
+ Miconfigured headerCacheSize in can result in
IllegalArgumentException
+ HttpServletResponse.encodeURL not working for URLs starting
with ../
-------------------------------------------------------------------
Tue Mar 22 15:49:28 UTC 2022 - Fridrich Strba <fstrba@suse.com>
- Build with java source and target levels 8
- Fix javadoc generation on JDK >= 13
-------------------------------------------------------------------
Tue Oct 19 07:13:12 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Make importing of package sun.misc optional since not all jdk
versions export it
-------------------------------------------------------------------
Mon Jul 19 06:58:23 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.43.v20210629
* Fix: bsc#1188438, CVE-2021-34429
* Changes:
+ Improve alias checking in PathResource
+ java.nio.ReadOnlyBufferException
+ Deprecate support for UTF16 encoding in URIs
+ Update to spifly 1.3.3
+ Update to asm 9.1
-------------------------------------------------------------------
Wed Jun 9 14:07:47 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Update to version 9.4.42.v20210604
* Fix: bsc#1187117, CVE-2021-28169
-------------------------------------------------------------------
Fri May 14 16:57:01 UTC 2021 - Ferdinand Thiessen <rpm@fthiessen.de>
- Update to version 9.4.40.v20210413
* Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when
client send data length > 17408
* Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
* Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory
from deployment scan
* Improve handling of unconsumed content
* Jetty start.jar always reports jetty.tag.version as master
* HttpConnection.getBytesIn() incorrect for requests with chunked
content
* SslConnection compacting
-------------------------------------------------------------------
Fri Mar 12 11:11:07 UTC 2021 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.38.v20210224
* Fixes bsc#1182898, CVE-2020-27223
-------------------------------------------------------------------
Mon Dec 7 18:12:50 UTC 2020 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.35.v20201120
* Fixes bsc#1179727, CVE-2020-27218
-------------------------------------------------------------------
Thu Nov 19 13:05:09 UTC 2020 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.30.v20200611
-------------------------------------------------------------------
Thu Apr 2 09:25:19 UTC 2020 - Fridrich Strba <fstrba@suse.com>
- Upgrade to upstream version 9.4.27.v20200227
-------------------------------------------------------------------
Thu Nov 28 09:02:29 UTC 2019 - Fridrich Strba <fstrba@suse.com>
- Removed patch:
* jetty-annotations-asm6.patch
+ not needed when building against ASM7
-------------------------------------------------------------------
Fri Nov 8 10:42:50 UTC 2019 - Fridrich Strba <fstrba@suse.com>
- Initial packaging of the websocket submodules of jetty
9.4.22.v20191022

330
jetty-websocket.spec Normal file
View File

@ -0,0 +1,330 @@
#
# spec file for package jetty-websocket
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2000-2007, JPackage Project
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global base_name jetty
%global addver .v20240826
%define src_name %{base_name}.project-%{base_name}-%{version}%{addver}
Name: %{base_name}-websocket
Version: 9.4.56
Release: 0
Summary: The websocket modules for Jetty
License: Apache-2.0 OR EPL-1.0
URL: https://www.eclipse.org/jetty/
Source0: https://github.com/eclipse/%{base_name}.project/archive/%{base_name}-%{version}%{addver}.tar.gz#/%{src_name}.tar.gz
BuildRequires: fdupes
BuildRequires: java-devel >= 1.8
# Multiple providers, chose the 1.0 one over 1.1, since
# the relevant artifacts assume the API version 1.0
BuildRequires: jboss-websocket-1.0-api
BuildRequires: maven-local
BuildRequires: mvn(javax.servlet:javax.servlet-api)
BuildRequires: mvn(javax.websocket:javax.websocket-api)
BuildRequires: mvn(javax.websocket:javax.websocket-client-api)
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.apache.maven.plugins:maven-shade-plugin)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.eclipse.jetty:jetty-annotations) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-client) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-http) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-io) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-server) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-servlet) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-util) >= %{version}
BuildRequires: mvn(org.eclipse.jetty:jetty-xml) >= %{version}
Requires: jboss-websocket-1.0-api
BuildArch: noarch
# jp_minimal doesn't have main package
%description
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\
do not need to configure and run a separate web server (like Apache) in order\
to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\
featured web server for static and dynamic content. Unlike separate\
server/container solutions, this means that your web server and web\
application run in the same process, without interconnection overheads\
and complications. Furthermore, as a pure java component, Jetty can be simply\
included in your application for demonstration, distribution or deployment.\
Jetty is available on all Java supported platforms.
This package contains the websocket modules for Jetty
%package -n %{base_name}-websocket-api
Summary: The websocket-api module for Jetty
%description -n %{base_name}-websocket-api
%{extdesc} %{summary}.
%package -n %{base_name}-websocket-client
Summary: The The websocket-client module for Jetty
%description -n %{base_name}-websocket-client
%{extdesc} %{summary}.
%package -n %{base_name}-websocket-common
Summary: The websocket-common module for Jetty
%description -n %{base_name}-websocket-common
%{extdesc} %{summary}.
%package -n %{base_name}-websocket-server
Summary: The websocket-server module for Jetty
%description -n %{base_name}-websocket-server
%{extdesc} %{summary}.
%package -n %{base_name}-websocket-servlet
Summary: The websocket-servlet module for Jetty
%description -n %{base_name}-websocket-servlet
%{extdesc} %{summary}.
%package -n %{base_name}-javax-websocket-client-impl
Summary: The javax-websocket-client-impl module for Jetty
%description -n %{base_name}-javax-websocket-client-impl
%{extdesc} %{summary}.
%package -n %{base_name}-javax-websocket-server-impl
Summary: The javax-websocket-server-impl module for Jetty
%description -n %{base_name}-javax-websocket-server-impl
%{extdesc} %{summary}.
%package javadoc
Summary: Javadoc for %{name}
%description javadoc
%{summary}.
%prep
%setup -q -n %{src_name}
find . -name "*.?ar" -exec rm {} \;
find . -name "*.class" -exec rm {} \;
%pom_remove_dep :::import
# Plugins irrelevant or harmful to building the package
%pom_remove_plugin -r :maven-checkstyle-plugin
%pom_remove_plugin -r :maven-enforcer-plugin
%pom_remove_plugin -r :maven-eclipse-plugin
%pom_remove_plugin -r :license-maven-plugin
%pom_remove_plugin -r :maven-site-plugin
%pom_remove_plugin -r :maven-source-plugin
%pom_remove_plugin -r :maven-deploy-plugin
%pom_remove_plugin -r :jacoco-maven-plugin
%pom_remove_plugin -r :maven-release-plugin
%pom_remove_plugin -r :buildnumber-maven-plugin
%pom_remove_plugin -r :h2spec-maven-plugin
# Unnecessary pom flattening can be skipped
%pom_remove_plugin -r :flatten-maven-plugin jetty-bom
%pom_disable_module aggregates/jetty-all
%pom_xpath_inject "pom:configuration/pom:instructions" \
"<Import-Package>sun.misc;resolution:=optional,com.sun.nio.file;resolution:=optional,*</Import-Package>"
%pom_remove_dep "com.sun.net.httpserver:http" jetty-http-spi
%pom_change_dep -r org.mortbay.jasper:apache-jsp org.apache.tomcat:tomcat-jasper
%pom_add_dep 'org.junit.jupiter:junit-jupiter-engine:${junit.version}' tests/test-sessions/test-sessions-common
# provided by glassfish-jsp-api that has newer version
%pom_change_dep -r javax.servlet.jsp:jsp-api javax.servlet.jsp:javax.servlet.jsp-api
# txt artifact - not installable
%pom_remove_plugin ":jetty-version-maven-plugin"
%pom_xpath_remove "pom:artifactItem[pom:classifier='version']" jetty-home
# Disable building source release
%pom_xpath_remove 'pom:execution[pom:id="sources"]' jetty-home
# Unwanted JS in javadoc
sed -i '/^\s*\*.*<script>/d' jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java
# only used for integration tests
%pom_remove_plugin :maven-invoker-plugin jetty-jspc-maven-plugin
# These bundles have a dep on Eclipse that is not available on every arch
%pom_disable_module jetty-osgi
# We don't have asciidoctor-maven-plugin
%pom_disable_module jetty-documentation
%pom_remove_dep -r :jetty-documentation
%pom_xpath_remove 'pom:execution[pom:id="unpack-documentation"]' jetty-distribution
%pom_xpath_remove 'pom:artifactItem[pom:artifactId="libsetuid-osx"]' jetty-home/pom.xml
# TODO remove when jetty-setuid is packaged
%pom_xpath_remove "pom:execution[pom:id='copy-setuid-deps']" jetty-home/pom.xml
# We don't have gcloud-java-datastore
%pom_disable_module jetty-gcloud
%pom_disable_module test-gcloud-sessions tests/test-sessions
%pom_remove_dep :jetty-gcloud-session-manager jetty-home
# we don't have com.googlecode.xmemcached:xmemcached yet
%pom_disable_module jetty-memcached
%pom_disable_module test-memcached-sessions tests/test-sessions
%pom_remove_dep :jetty-memcached-sessions jetty-home
# We don't have hazelcast
%pom_disable_module jetty-hazelcast
%pom_disable_module test-hazelcast-sessions tests/test-sessions
%pom_remove_dep :jetty-hazelcast jetty-home
# We don't have infinispan
%pom_disable_module jetty-infinispan
%pom_disable_module test-infinispan-sessions tests/test-sessions
%pom_remove_dep :infinispan-embedded jetty-home
%pom_remove_dep :infinispan-embedded-query jetty-home
%pom_remove_dep :infinispan-remote jetty-home
%pom_remove_dep :infinispan-remote-query jetty-home
%pom_xpath_remove "pom:execution[pom:id='unpack-infinispan-config']" jetty-home
# Not currently able to build tests, so can't build benchmarks
%pom_disable_module jetty-jmh
# Distribution tests require internet access, so disable
%pom_disable_module test-distribution tests
# the default location is not allowed by SELinux
sed -i '/<SystemProperty name="jetty.state"/d' \
jetty-home/src/main/resources%{_sysconfdir}/jetty-started.xml
# remote-resources only copies about.html
%pom_remove_plugin :maven-remote-resources-plugin
# packages module configs, we don't need those in minimal
%pom_remove_plugin -r :maven-assembly-plugin
# only useful when tests are enabled (copies test deps)
%pom_remove_plugin :maven-dependency-plugin jetty-client
# all modules besides the current jetty-websocket
%pom_disable_module jetty-ant
%pom_disable_module jetty-http2
%pom_disable_module jetty-fcgi
%pom_disable_module jetty-servlets
%pom_disable_module apache-jstl
%pom_disable_module jetty-maven-plugin
%pom_disable_module jetty-jspc-maven-plugin
%pom_disable_module jetty-deploy
%pom_disable_module jetty-start
%pom_disable_module jetty-cdi
%pom_disable_module jetty-spring
%pom_disable_module jetty-jaspi
%pom_disable_module jetty-rewrite
%pom_disable_module jetty-nosql
%pom_disable_module jetty-unixsocket
%pom_disable_module tests
%pom_disable_module examples
%pom_disable_module jetty-quickstart
%pom_disable_module jetty-distribution
%pom_disable_module jetty-runner
%pom_disable_module jetty-http-spi
%pom_disable_module jetty-alpn
%pom_disable_module jetty-home
# minimal modules built in jetty-minimal package
%pom_disable_module jetty-annotations
%pom_disable_module jetty-client
%pom_disable_module jetty-continuation
%pom_disable_module jetty-http
%pom_disable_module jetty-io
%pom_disable_module jetty-jaas
%pom_disable_module jetty-jmx
%pom_disable_module jetty-jndi
%pom_disable_module apache-jsp
%pom_disable_module jetty-openid
%pom_disable_module jetty-plus
%pom_disable_module jetty-proxy
%pom_disable_module jetty-security
%pom_disable_module jetty-server
%pom_disable_module jetty-servlet
%pom_disable_module jetty-util
%pom_disable_module jetty-util-ajax
%pom_disable_module jetty-xml
%pom_disable_module jetty-webapp
%pom_xpath_remove "pom:plugins/pom:plugin[pom:artifactId='maven-javadoc-plugin']/pom:configuration/pom:additionalJOption"
%{mvn_file} :{*} %{base_name}/@1
%build
%{mvn_package} :jetty-home __noinstall
%{mvn_package} :jetty-distribution __noinstall
# Separate package for POMs
%{mvn_package} ':*-project' __noinstall
%{mvn_package} ':*-parent' __noinstall
%{mvn_package} ':*-bom' __noinstall
# artifact used by demo
%{mvn_package} :test-mock-resources
%{mvn_package} ':test-*' __noinstall
%{mvn_package} ':*-tests' __noinstall
%{mvn_package} ':*-it' __noinstall
%{mvn_package} ':example-*' __noinstall
%{mvn_package} org.eclipse.jetty.tests: __noinstall
%{mvn_package} ::war: __noinstall
%{mvn_package} :jetty-runner __noinstall
%{mvn_package} :build-resources __noinstall
%{mvn_package} org.eclipse.jetty.cdi: jetty-cdi
%{mvn_package} ':jetty-alpn*-client' jetty-alpn-client
%{mvn_package} ':jetty-alpn*-server' jetty-alpn-server
%{mvn_package} :apache-jsp jetty-jsp
%{mvn_alias} :apache-jsp :jetty-jsp
# we don't have all necessary dependencies to run tests
# missing test dep: org.eclipse.jetty.toolchain:jetty-perf-helper
%{mvn_build} -f -s -- \
-Dproject.build.outputTimestamp=$(date -u -d @${SOURCE_DATE_EPOCH:-$(date +%%s)} +%%Y-%%m-%%dT%%H:%%M:%%SZ) \
%if %{?pkg_vcmp:%pkg_vcmp java-devel >= 9}%{!?pkg_vcmp:0}
-Dmaven.compiler.release=8 \
%endif
-Dsource=8
%install
%mvn_install
%fdupes -s %{buildroot}%{_javadocdir}
%files -n %{base_name}-websocket-api -f .mfiles-websocket-api
%files -n %{base_name}-websocket-client -f .mfiles-websocket-client
%files -n %{base_name}-websocket-common -f .mfiles-websocket-common
%files -n %{base_name}-websocket-server -f .mfiles-websocket-server
%files -n %{base_name}-websocket-servlet -f .mfiles-websocket-servlet
%files -n %{base_name}-javax-websocket-client-impl -f .mfiles-javax-websocket-client-impl
%files -n %{base_name}-javax-websocket-server-impl -f .mfiles-javax-websocket-server-impl
%files javadoc -f .mfiles-javadoc
%license LICENSE NOTICE.txt
%changelog

3
jetty.project-jetty-9.4.56.v20240826.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:02955a9152023af2238ed5a5aa331b6b6ef2e2934f9d4871b318763254315968
size 19348893