Re: [JPackage-announce] [RPM (6.0)] [DIST generic] tomcat6-6.0.32-2.jpp6

Given that tomcat 6.0.29 in the current JPP release (5.0) is
vulnerable to CVE-2011-0534, CVE-2011-0013, CVE-2010-4172, and
CVE-2010-3718 (as illustrated on the tomcat security page -
http://tomcat.apache.org/security-6.html), and that tomcat 6.0.32 was
released on February 3, 2011 (as illustrated by
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201102.mbox/raw/%3C20110203150938.GA88837-8LWK89apvwiY1pf4d8vP8EB+6BGkLq7r@public.gmane.org%3E),
and that JPP 6.0 is not even an official beta much less a release (at
least according to the home page), why is the package tomcat 6.0.32
not backported to JPP 5.0-updates?
Jason

On Thu, Jun 23, 2011 at 2:52 PM, Ralph Apel <[email protected]> wrote:
> Name        : tomcat6                      Relocations: (not relocatable)
> Version     : 6.0.32                            Vendor: JPackage Project
> Release     : 2.jpp6                        Build Date: Thu 23 Jun 2011 08:34:59 PM CEST
> Install Date: (not installed)               Build Host: localhost.localdomain
> Group       : Networking/Daemons            Source RPM: (none)
> Size        : 3856061                          License: ASL 2.0
> Signature   : (none)
> Packager    : Ralph Apel <[email protected]>
> URL         : http://tomcat.apache.org/
> Summary     : Apache Servlet/JSP Engine, RI for Servlet 2.5/JSP 2.1 API
> Description :
> Tomcat is the servlet container that is used in the official Reference
> Implementation for the Java Servlet and JavaServer Pages technologies.
> The Java Servlet and JavaServer Pages specifications are developed by
> Sun under the Java Community Process.
>
> Tomcat is developed in an open and participatory environment and
> released under the Apache Software License version 2.0. Tomcat is intended
> to be a collaboration of the best-of-breed developers from around the world.
>
> ---------------
> Ralph Apel <[email protected]> 0:6.0.32-2
> - Add missing update_maven_depmap
> ---------------
> tomcat6.src:175: W: unversioned-explicit-provides jsp21
> tomcat6.src:203: W: unversioned-explicit-provides servlet6
> tomcat6.src:204: W: unversioned-explicit-provides servlet25
> tomcat6.src: W: strange-permission tomcat6-6.0.starter 0755
> tomcat6.src: W: source-or-patch-not-bzipped tomcat6-6.0-bootstrap-MANIFEST.MF.patch
> tomcat6.src: W: source-or-patch-not-bzipped tomcat6-6.0-tomcat-users-webapp.patch
> tomcat6.src: W: non-standard-group Networking/Daemons
> tomcat6.src: W: no-signature
> tomcat6.src: W: lib-package-without-%mklibname
> tomcat6.src: W: invalid-license ASL 2.0
> tomcat6.src:122: W: hardcoded-library-path in /lib/lsb/init-functions
> tomcat6.src:123: W: hardcoded-library-path in /lib/lsb/init-functions
> 1 packages and 0 specfiles checked; 0 errors, 12 warnings.
>
> ---------------
> Index: tomcat6.spec
> ===================================================================
> RCS file: /home/projects/jpackage/cvs/rpms/free/tomcat6/tomcat6.spec,v
> retrieving revision 1.15
> diff -u -r1.15 tomcat6.spec
> --- tomcat6.spec        23 Jun 2011 10:17:59 -0000      1.15
> +++ tomcat6.spec        23 Jun 2011 18:52:28 -0000
> @@ -55,7 +55,7 @@
>  Name: tomcat6
>  Epoch: 0
>  Version: %{major_version}.%{minor_version}.%{micro_version}
> -Release: 1%{?dist}
> +Release: 2%{?dist}
>  Summary: Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
>
>  Group: Networking/Daemons
> @@ -493,9 +493,13 @@
>     -s /bin/sh -r -d %{homedir} tomcat 2>/dev/null || :
>
>  %post
> +%update_maven_depmap
>  # install but don't activate
>  /sbin/chkconfig --add %{name}
>
> +%postun
> +%update_maven_depmap
> +
>  %post el-1.0-api
>  %{_sbindir}/update-alternatives --install %{_javadir}/el_api.jar \
>     el_api %{_javadir}/%{name}-el-%{elspec}-api.jar 10000
> @@ -653,6 +657,9 @@
>  %{appdir}/sample
>
>  %changelog
> +* Thu Jun 23 2011 Ralph Apel <[email protected]> 0:6.0.32-2
> +- Add missing update_maven_depmap
> +
>  * Wed Jun 10 2011 Ralph Apel <[email protected]> 0:6.0.32-1
>  - 6.0.32
>  - Move juli to javadir and symlink to /bin
>
>
> _______________________________________________
> JPackage-announce mailing list
> [email protected]
> https://www.zarb.org/mailman/listinfo/jpackage-announce
>