[Bug 63739] New: Automatic-Module-Names in embedded jars are language-level invalid

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

[Bug 63739] New: Automatic-Module-Names in embedded jars are language-level invalid

Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=63739

            Bug ID: 63739
           Summary: Automatic-Module-Names in embedded jars are
                    language-level invalid
           Product: Tomcat 9
           Version: unspecified
          Hardware: PC
            Status: NEW
          Severity: critical
          Priority: P2
         Component: Packaging
          Assignee: [hidden email]
          Reporter: [hidden email]
  Target Milestone: -----

Hi this is a follow-up to 63555, to resolve which Automatic-Module-Names were
introduced into the MANIFEST.MF from 9.0.24.

Unfortunately, those module names are not valid because they contain hyphens.
Module descriptor files (module-info.java) are compiled into Java classes and
simply won't be able to reference them. It's rather like if a package name in a
.jar had hyphens in it; the package could not be used in an import.

This renders Tomcat impossible to use with the Java module system from 9.0.24,
a significantly more adverse situation than what the automatic module names are
supposed to address, as it blocks future CVE security patches.

There is some good advice on the matter here:
https://sormuras.github.io/blog/2018-11-16-invalid-automatic-module-names.html

Example invalid values from Tomcat 9.0.24:

Automatic-Module-Name: org.apache.tomcat-embed-core
Automatic-Module-Name: org.apache.tomcat-embed-jasper-el

What I would expect:

Automatic-Module-Name: org.apache.tomcat.embed.core
Automatic-Module-Name: org.apache.tomcat.embed.jasper.el

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 63739] Automatic-Module-Names in embedded jars are language-level invalid

Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=63739

Rob <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |9.0.24
                 OS|                            |All

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 63739] Automatic-Module-Names in embedded jars are language-level invalid

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=63739

Rob <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P2                          |P1

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 63739] Automatic-Module-Names in embedded jars are language-level invalid

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=63739

Mark Thomas <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #1 from Mark Thomas <[hidden email]> ---
Thanks for the report.

Fixed in:
- master for 9.0.25 onwards

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 63739] Automatic-Module-Names in embedded jars are language-level invalid

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=63739

--- Comment #2 from Rob <[hidden email]> ---
Reviewed the commit, and it looks perfect to me. Thanks, that's really
appreciated.

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]