Re: [VOTE] Release Apache Tomcat 9.0.121

Am 12.08.26 um 22:08 schrieb Rémy Maucherat:
> The proposed Apache Tomcat 9.0.121 release is now available for voting.
> 
> The notable changes compared to 9.0.120 are:
> 
> - Add a new attribute to the Context, urlPatternsProvidedInDecodedForm.
>     This attribute controls whether URLs and URL patterns provided in the
>     deployment descriptor (web.xml), annotations and/or their programmatic
>     equivalents are treated as being provided in URL-encoded form (i.e.
>     using %nn encoding) or in decoded form. The Servlet specification
>     requires that they are provided in decoded form. However, Tomcat has
>     historically treated them as if they are provided in encoded form. In
>     Tomcat 12, they will always be treated as if they are provided in
>     decoded form. This setting enables migration from encoded form to
>     decoded form on an application by application basis. This attribute
>     will be removed in Tomcat 12 where it will effectively be hard-coded
>     to true.
> - Require every HTTP/2 request to provide an authority (either an
>     :authority pseudo header or a Host header)
> - Change the default encryptionAlgorithm for the EncryptInterceptor to
>     AES/GCM/NoPadding. This is a breaking change for the
>     EncryptInterceptor.
> 
> For full details, see the changelog:
> https://nightlies.apache.org/tomcat/tomcat-9.0.x/docs/changelog.html
> 
> It can be obtained from:
> https://dist.apache.org/repos/dist/dev/tomcat/tomcat-9/v9.0.121/
> 
> The Maven staging repo is:
> https://repository.apache.org/content/repositories/orgapachetomcat-1601
> 
> The tag is:
> https://github.com/apache/tomcat/tree/9.0.121
> dc00a53100b38c8eb8befce5855e3b152eed9353
> 
> The proposed 9.0.121 release is:
> [ ] -1, Broken - do not release
> [X] +1, Stable - go ahead and release as 9.0.121
+1 to release.

Reproducibility of the build checked (including the Windows installer) 
using "ant verify-release" on Linux Mint 22.3. OK after setting LANG.

Original Windows installer signature verified with osslsigncode 2.10.

Unit tests ran on platforms

- RHEL 7, 8, 9 and 10 and SLES 12 and 15

using

- recent patch versions of JDK 1.8.0, 11, 17, 21, 25, 26 and 27+28 (EA)

from

- Eclipse Adoptium, Azul Zulu, Amazon Coretto, Oracle, RedHat (26 
missing) and from OpenJDK for 27+28

Also tested with

- tcnative 1.3.8, 2.0.15 and panama

based on

- OpenSSL 3.5.7, 3.6.3 and 4.0.1 (only for tcnative 2 and panama)

Each combination of platform, JVM and JSSE or tcnative or panama only 
tested for NIO or NIO2 (randomized). Total number of test combinations:

      96 nio jsse
     102 nio panama
     406 nio tcnative
      80 nio2 jsse
      90 nio2 panama
     474 nio2 tcnative

Test observations:

   - IMHO nothing critical

   - 2 consistent failures for some Java versions due to bugs in test 
classes (already fixed)

   - in addition
     - two crash failures with JSSE (2 in 176 runs)
     - few crashes with tcnative (9 in 880 runs)
     - no crash failures with panama (192 runs)
     - very few non-crash failures with jsse (4 in 176 runs)
     - very few non-crash failures with tcnative (2 in 880 runs)
     - no non-crash failures with panama (192 runs)

Thanks for RM!

Best regards,

Rainer