Tomcat Package Changes in Rawhide

[Coty Sutherland]

Hi all,

Sorry to be a bit late to the party, but in response to some indirect
dependencies being orphaned I've taken the opportunity to clean up the
Tomcat package a little. I have removed the following "features" from
tomcat:

1) I dropped the "examples" webapp from Tomcat, which is recommended by the
Security Considerations page of the upstream project anyway. This removed
our dependency on the tomcat-taglibs-standard package.
2) Due to changes in the javapackages-local package (%add_maven_depmap was
finally removed), I dropped the maven pom files from the tomcat packages as
I feel that their usefulness is limited anyway. If you need to use the
poms, Maven Central should work.
3) I've removed the tomcat-jsvc subpackage from the distribution as it
isn't very useful either. This removes our dependency on the
apache-commons-daemon package. This also removed the logrotate config that
was offered since it was used within the tomcat-jsvc package.
4) Dropped geronimo-saaj (aka jakarta-saaj) as it's no longer required by
Tomcat 9+.
5) Dropped geronimo-jaxrpc (aka jakarta-xml-rpc), which provided the
webservices naming factory resources that are generally unused. This was
only a build time dependency, so it wasn't used at runtime (unless users
were explicitly installing it for their webapp).

If anyone has issues with these changes, please let me know ASAP.

There are a couple other dependencies that have to be resolved to keep
Tomcat which are ant and javapackage-tools; I hope to see those resolved on
the "The Javapocalypse is Monday" thread :)



Thanks,
Coty

[Peter Boy]

Please, could you re-include the logrotate config file. It is useful independently from
the jsvc package and does not harm.

Thanks
Peter



>  Am 04.06.2021 um 13:46 schrieb Coty Sutherland
> <csutherl(a)fedoraproject.org&gt;:
>  3) I've removed the tomcat-jsvc subpackage from the distribution as it isn't very
> useful either. This removes our dependency on the apache-commons-daemon package. This also
> removed the logrotate config that was offered since it was used within the tomcat-jsvc
> package.

[Coty Sutherland]

On Fri, Jun 4, 2021 at 8:58 AM Peter Boy <pboy(a)uni-bremen.de&gt; wrote:

>  Please, could you re-include the logrotate config file. It is useful
>  independently from the jsvc package and does not harm.
>  
Sure, no problem. Thanks for the reply :)


>  Thanks
>  Peter
>
>
>
>  > Am 04.06.2021 um 13:46 schrieb Coty Sutherland <
>  csutherl(a)fedoraproject.org&gt;:
>  > 3) I've removed the tomcat-jsvc subpackage from the distribution as it
>  isn't very useful either. This removes our dependency on the
>  apache-commons-daemon package. This also removed the logrotate config that
>  was offered since it was used within the tomcat-jsvc package.
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Fabio Valentini]

On Fri, Jun 4, 2021 at 1:47 PM Coty Sutherland
<csutherl(a)fedoraproject.org&gt; wrote:
>  Hi all,
>
>  Sorry to be a bit late to the party, but in response to some indirect dependencies being
> orphaned I've taken the opportunity to clean up the Tomcat package a little. I have
> removed the following "features" from tomcat:
>
>  1) I dropped the "examples" webapp from Tomcat, which is recommended by the
> Security Considerations page of the upstream project anyway. This removed our dependency
> on the tomcat-taglibs-standard package.
>  2) Due to changes in the javapackages-local package (%add_maven_depmap was finally
> removed), I dropped the maven pom files from the tomcat packages as I feel that their
> usefulness is limited anyway. If you need to use the poms, Maven Central should work.
>  3) I've removed the tomcat-jsvc subpackage from the distribution as it isn't very
> useful either. This removes our dependency on the apache-commons-daemon package. This also
> removed the logrotate config that was offered since it was used within the tomcat-jsvc
> package.
>  4) Dropped geronimo-saaj (aka jakarta-saaj) as it's no longer required by Tomcat 9+.
>  5) Dropped geronimo-jaxrpc (aka jakarta-xml-rpc), which provided the webservices naming
> factory resources that are generally unused. This was only a build time dependency, so it
> wasn't used at runtime (unless users were explicitly installing it for their webapp).
>
>  If anyone has issues with these changes, please let me know ASAP. 
It looks like 2) is causing problems with resteasy, and in turn
pki-core and dogtag-pki (FreeIPA components):
nothing provides mvn(org.apache.tomcat:tomcat-servlet-api) needed by
pki-resteasy-core

resteasy is built with maven and depends on tomcat, so the pom files
are actually needed ...

Fabio

[Coty Sutherland]

On Fri, Jun 4, 2021 at 10:56 AM Fabio Valentini <decathorpe(a)gmail.com&gt;
wrote:

>  On Fri, Jun 4, 2021 at 1:47 PM Coty Sutherland
>  <csutherl(a)fedoraproject.org&gt; wrote:
>  >
>  > Hi all,
>  >
>  > Sorry to be a bit late to the party, but in response to some indirect
>  dependencies being orphaned I've taken the opportunity to clean up the
>  Tomcat package a little. I have removed the following "features" from
>  tomcat:
>  >
>  > 1) I dropped the "examples" webapp from Tomcat, which is recommended by
>  the Security Considerations page of the upstream project anyway. This
>  removed our dependency on the tomcat-taglibs-standard package.
>  > 2) Due to changes in the javapackages-local package (%add_maven_depmap
>  was finally removed), I dropped the maven pom files from the tomcat
>  packages as I feel that their usefulness is limited anyway. If you need to
>  use the poms, Maven Central should work.
>  > 3) I've removed the tomcat-jsvc subpackage from the distribution as it
>  isn't very useful either. This removes our dependency on the
>  apache-commons-daemon package. This also removed the logrotate config that
>  was offered since it was used within the tomcat-jsvc package.
>  > 4) Dropped geronimo-saaj (aka jakarta-saaj) as it's no longer required
>  by Tomcat 9+.
>  > 5) Dropped geronimo-jaxrpc (aka jakarta-xml-rpc), which provided the
>  webservices naming factory resources that are generally unused. This was
>  only a build time dependency, so it wasn't used at runtime (unless users
>  were explicitly installing it for their webapp).
>  >
>  > If anyone has issues with these changes, please let me know ASAP.
>
>  It looks like 2) is causing problems with resteasy, and in turn
>  pki-core and dogtag-pki (FreeIPA components):
>  nothing provides mvn(org.apache.tomcat:tomcat-servlet-api) needed by
>  pki-resteasy-core
>
>  resteasy is built with maven and depends on tomcat, so the pom files
>  are actually needed ...
>  
That is the worst news I've gotten in a while :/ How many maven artifacts
are being used? Could I get away with only providing poms/artifacts for the
servlet/jsp/el implementations or do they need all 30+ artifacts?


>  Fabio
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>

[Fabio Valentini]

On Fri, Jun 4, 2021 at 5:08 PM Coty Sutherland
<csutherl(a)fedoraproject.org&gt; wrote:
>  On Fri, Jun 4, 2021 at 10:56 AM Fabio Valentini <decathorpe(a)gmail.com&gt; wrote:
> >
> > On Fri, Jun 4, 2021 at 1:47 PM Coty Sutherland
> > <csutherl(a)fedoraproject.org&gt; wrote:
> > >
> > > Hi all,
> > >
> > > Sorry to be a bit late to the party, but in response to some indirect
> dependencies being orphaned I've taken the opportunity to clean up the Tomcat package
> a little. I have removed the following "features" from tomcat:
> > >
> > > 1) I dropped the "examples" webapp from Tomcat, which is recommended
> by the Security Considerations page of the upstream project anyway. This removed our
> dependency on the tomcat-taglibs-standard package.
> > > 2) Due to changes in the javapackages-local package (%add_maven_depmap was
> finally removed), I dropped the maven pom files from the tomcat packages as I feel that
> their usefulness is limited anyway. If you need to use the poms, Maven Central should
> work.
> > > 3) I've removed the tomcat-jsvc subpackage from the distribution as it
> isn't very useful either. This removes our dependency on the apache-commons-daemon
> package. This also removed the logrotate config that was offered since it was used within
> the tomcat-jsvc package.
> > > 4) Dropped geronimo-saaj (aka jakarta-saaj) as it's no longer required by
> Tomcat 9+.
> > > 5) Dropped geronimo-jaxrpc (aka jakarta-xml-rpc), which provided the webservices
> naming factory resources that are generally unused. This was only a build time dependency,
> so it wasn't used at runtime (unless users were explicitly installing it for their
> webapp).
> > >
> > > If anyone has issues with these changes, please let me know ASAP.
> >
> > It looks like 2) is causing problems with resteasy, and in turn
> > pki-core and dogtag-pki (FreeIPA components):
> > nothing provides mvn(org.apache.tomcat:tomcat-servlet-api) needed by
> > pki-resteasy-core
> >
> > resteasy is built with maven and depends on tomcat, so the pom files
> > are actually needed ...
>
>
>  That is the worst news I've gotten in a while :/ How many maven artifacts are being
> used? Could I get away with only providing poms/artifacts for the servlet/jsp/el
> implementations or do they need all 30+ artifacts? 
It wouldn't have been news if you checked if anything depends on those
"mvn(foo:bar)" virtual Provides before dropping them ;)

According to koschei, resteasy only depends on one maven pom though:
No package found for: mvn(org.apache.tomcat:tomcat-servlet-api)

See: https://koschei.fedoraproject.org/package/resteasy

Not sure if just adding that one back will make it work again, though.

Fabio

[Coty Sutherland]

On Fri, Jun 4, 2021 at 11:21 AM Fabio Valentini <decathorpe(a)gmail.com&gt;
wrote:

>  > That is the worst news I've gotten in a while :/ How many
> maven
>  artifacts are being used? Could I get away with only providing
>  poms/artifacts for the servlet/jsp/el implementations or do they need all
>  30+ artifacts?
>
>  It wouldn't have been news if you checked if anything depends on those
>  "mvn(foo:bar)" virtual Provides before dropping them ;)
>
>  According to koschei, resteasy only depends on one maven pom though:
>  No package found for: mvn(org.apache.tomcat:tomcat-servlet-api)
>
>  See: https://koschei.fedoraproject.org/package/resteasy
>
>  Not sure if just adding that one back will make it work again, though.
>  
That is true :) I didn't even think about virtual deps to be honest...shame
on me for that. Anyway, it looks like pki-core and dogtag-pki depend on the
servlet-api via resteasy, so adding it back should be fine. Now I just have
to make that happen :) For consistency sake I guess I'll add the other spec
impls too, in case anyone needs them.

Cheers,

[Alexander Bokovoy]

On pe, 04 kesä 2021, Coty Sutherland wrote:
> On Fri, Jun 4, 2021 at 11:21 AM Fabio Valentini
> <decathorpe(a)gmail.com&gt;
> wrote:
>
> > > That is the worst news I've gotten in a while :/ How many maven
> > artifacts are being used? Could I get away with only providing
> > poms/artifacts for the servlet/jsp/el implementations or do they need all
> > 30+ artifacts?
> >
> > It wouldn't have been news if you checked if anything depends on those
> > "mvn(foo:bar)" virtual Provides before dropping them ;)
> >
> > According to koschei, resteasy only depends on one maven pom though:
> > No package found for: mvn(org.apache.tomcat:tomcat-servlet-api)
> >
> > See: https://koschei.fedoraproject.org/package/resteasy
> >
> > Not sure if just adding that one back will make it work again, though.
> >
>
> That is true :) I didn't even think about virtual deps to be honest...shame
> on me for that. Anyway, it looks like pki-core and dogtag-pki depend on the
> servlet-api via resteasy, so adding it back should be fine. Now I just have
> to make that happen :) For consistency sake I guess I'll add the other spec
> impls too, in case anyone needs them. 
Just to report that one can track an installation issue like this with

   dnf -y groupinstall freeipa-server

like it is done in OpenQA tests:
https://openqa.fedoraproject.org/tests/902432#step/role_deploy_domain_con...

Once the build
https://koji.fedoraproject.org/koji/buildinfo?buildID=1762794 with
https://src.fedoraproject.org/rpms/tomcat/c/de863ffa6657ae4fb789d2ece41ab...
would be in Rawhide compose, that test should succeed.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland