Re: MDB Activation Properties

[Richard Zowalla]

Hey Alex,

Would be great to get a doc update PR ;-)

Thanks
Richard

> Am 09.07.2024 um 11:02 schrieb Alex The Rocker :
> 
> What a "funny" coincidence!
> 
> Today I was investigating ways of setting up JMS parameters in TomEE,
> and I too found quite outdated (if not in contradiction) pages.
> 
> This say understatement: "there's plenty of improvement opportunity in
> TomEE JMS-related documentation"...
> 
> I'll see if I can recap all the "gotchas" which I found...
> 
> Alex
> 
> Le mar. 9 juil. 2024 à 10:28, Richard Zowalla  a écrit :
>> 
>> Hi,
>> 
>> at a first glance, it looks like the docs are just out-dated.
>> 
>> I would check the docs of the latest activemq (classic) version used in 
>> TomEE 8 and compare, if these properties are still available or have 
>> changed: 
>> https://activemq.apache.org/components/classic/documentation/redelivery-policy
>> 
>> Gruß
>> Richard
>> 
>> On 2024/06/17 11:47:31 chege wrote:
>>> Hi,
>>> 
>>> I have tried deploying this mdb in tomee 8.0.15 but keeps failing.
>>> 
>>> MDB
>>> 
>>> @MessageDriven(activationConfig = {
>>>@ActivationConfigProperty(propertyName = "useJndi", propertyValue =
>>> "false"),
>>>@ActivationConfigProperty(propertyName = "destination",
>>> propertyValue = "getnews"),
>>>@ActivationConfigProperty(propertyName = "destinationType",
>>> propertyValue = "javax.jms.Queue"),
>>>@ActivationConfigProperty(propertyName = "initialRedeliveryDelay",
>>> propertyValue = "6"),
>>>@ActivationConfigProperty(propertyName = "maximumRedeliveries",
>>> propertyValue = "20"),
>>>@ActivationConfigProperty(propertyName =
>>> "redeliveryBackOffMultiplier", propertyValue = "2"),
>>>@ActivationConfigProperty(propertyName =
>>> "redeliveryUseExponentialBackOff", propertyValue = "true")
>>> })
>>> public class A implements MessageListener {
>>> 
>>>@Override
>>>public void onMessage(Message msg) {
>>> 
>>> 
>>> 
>>>}
>>> 
>>> }
>>> 
>>> 
>>> tomee.xml
>>> 
>>> 
>>>  # Do not start the embedded ActiveMQ broker
>>>  BrokerXmlConfig  =
>>>  ServerUrl = tcp://localhost:61616
>>>  
>>> 
>>> Error:
>>> 
>>> Caused by: org.apache.openejb.OpenEJBException: Unable to create
>>> activation spec: No setter found for the activation spec properties:
>>> [RedeliveryUseExponentialBackOff, redeliveryBackOffMultiplier]
>>> 
>>> 
>>> Acccording to the error [redeliveryBackOffMultiplier,
>>> redeliveryUseExponentialBackOff] are unknown.
>>> 
>>> I am refering to this documentation
>>> https://tomee.apache.org/latest/docs/jms-resources-and-mdb-container.html
>>> 
>>> What I am doing wrong?
>>> 
>>> Chege
>>> 
>>> 

Re: CVE-2024-34750

[Richard Zowalla]

To clarify a bit more: 

Feel free to provide a PR backporting the required changes (may also be 
relevant for bouncycastle). We have recently updated our download page and now 
explicitly state: 

"SECURITY NOTICE: This software is developed and maintained by unpaid 
volunteers who donate time as they have it. There is no guarantee security 
vulnerabilities will be fixed on any timeline or at all."

In addition, there is the option to contact the vendors listed in [1] if 
enterprise-level support is required, or to support the active community in the 
ways already discussed on this list.

[1] https://tomee.apache.org/community/commercial.html

On 2024/07/09 08:21:12 Richard Zowalla wrote:
> Hello,
> 
> most likely yes (haven't checked in detail).
> 
> Personally, I'm not going to port anything back to TomEE 9.x as I'm currently 
> focused on 10.x work. However, I am available to review any community driven 
> patches/initiatives via PRs targeting tomee-9.x branch.
> 
> Best regards
> Richard
> 
> On 2024/07/09 08:10:59 COURTAULT Francois wrote:
> > THALES GROUP LIMITED DISTRIBUTION to email recipients
> > 
> > Hello everyone,
> > 
> > TomEE 9.1.3 is based on Tomcat 10.0.27.
> > So the question is: Is TomEE 9.1.3 vulnerable to this CVE ?
> > If the answer is yes, will you provide a fix for Tomcat 10.0.27 which is 
> > not maintained anymore ? and so will you release a new TomEE 9.x version ?
> > 
> > This CVE has been fixed by Tomcat 9.0.90+ and 10.1.25+.
> > 
> > Best Regards.
> > 
> > 
> > 
> > 
> 

Re: MDB Activation Properties

[Richard Zowalla]

Hi,

at a first glance, it looks like the docs are just out-dated.

I would check the docs of the latest activemq (classic) version used in TomEE 8 
and compare, if these properties are still available or have changed: 
https://activemq.apache.org/components/classic/documentation/redelivery-policy

Gruß
Richard

On 2024/06/17 11:47:31 chege wrote:
> Hi,
> 
> I have tried deploying this mdb in tomee 8.0.15 but keeps failing.
> 
> MDB
> 
> @MessageDriven(activationConfig = {
> @ActivationConfigProperty(propertyName = "useJndi", propertyValue =
> "false"),
> @ActivationConfigProperty(propertyName = "destination",
> propertyValue = "getnews"),
> @ActivationConfigProperty(propertyName = "destinationType",
> propertyValue = "javax.jms.Queue"),
> @ActivationConfigProperty(propertyName = "initialRedeliveryDelay",
> propertyValue = "6"),
> @ActivationConfigProperty(propertyName = "maximumRedeliveries",
> propertyValue = "20"),
> @ActivationConfigProperty(propertyName =
> "redeliveryBackOffMultiplier", propertyValue = "2"),
> @ActivationConfigProperty(propertyName =
> "redeliveryUseExponentialBackOff", propertyValue = "true")
> })
> public class A implements MessageListener {
> 
> @Override
> public void onMessage(Message msg) {
> 
> 
> 
> }
> 
> }
> 
> 
> tomee.xml
> 
> 
>   # Do not start the embedded ActiveMQ broker
>   BrokerXmlConfig  =
>   ServerUrl = tcp://localhost:61616
>   
> 
> Error:
> 
> Caused by: org.apache.openejb.OpenEJBException: Unable to create
> activation spec: No setter found for the activation spec properties:
> [RedeliveryUseExponentialBackOff, redeliveryBackOffMultiplier]
> 
> 
> Acccording to the error [redeliveryBackOffMultiplier,
> redeliveryUseExponentialBackOff] are unknown.
> 
> I am refering to this documentation
> https://tomee.apache.org/latest/docs/jms-resources-and-mdb-container.html
> 
> What I am doing wrong?
> 
> Chege
> 
> 

Re: CVE-2024-34750

[Richard Zowalla]

Hello,

most likely yes (haven't checked in detail).

Personally, I'm not going to port anything back to TomEE 9.x as I'm currently 
focused on 10.x work. However, I am available to review any community driven 
patches/initiatives via PRs targeting tomee-9.x branch.

Best regards
Richard

On 2024/07/09 08:10:59 COURTAULT Francois wrote:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> TomEE 9.1.3 is based on Tomcat 10.0.27.
> So the question is: Is TomEE 9.1.3 vulnerable to this CVE ?
> If the answer is yes, will you provide a fix for Tomcat 10.0.27 which is not 
> maintained anymore ? and so will you release a new TomEE 9.x version ?
> 
> This CVE has been fixed by Tomcat 9.0.90+ and 10.1.25+.
> 
> Best Regards.
> 
> 
> 
> 

Re: Are you aware of CXF-8951 ?

[Richard Zowalla]

Yes and it's a CXF thing. You'll need to wait for their release.

Meanwhile you can force the old conduit via the property 
org.apache.cxf.transport.http.forceURLConnection 

The old conduit doesn't have the issue.

Am 28. Juni 2024 18:19:41 MESZ schrieb COURTAULT Francois 
:
>THALES GROUP LIMITED DISTRIBUTION to email recipients
>
>Hello everyone,
>
>This issue is present in TomEE 9.1.3 as it uses cxf v 4.0.4.
>Any TomEE update for this  ?
>
>Best regards.
>
>
>

Re: system.properties file not the same between apache-tomee-9.1.3-microprofile and apache-tomee-9.1.3-plus

[Richard Zowalla]

Yes and yes.

Am 8. Juni 2024 12:27:49 MESZ schrieb COURTAULT Francois 
:
>THALES GROUP LIMITED DISTRIBUTION to email recipients
>
>Hello everyone,
>
>I think I have reported that for TomEE 8.0.x.
>If I download apache-tomee-9.1.3-microprofile at look at the system.properties 
>content, I am able to see at the bottom of this file the following section:
># MicroProfile
>tomee.mp.scan = all
>
>whereas in  apache-tomee-9.1.3-plus, the above section doesn't exist.
>Is it as designed ? If yes, it means that if we want to activate the MP 
>features in apache-tomee-9.1.3-plus, we have to manually add this section in 
>the tomee-9.1.3-plus system.properties file, right ?
>
>Best Regards.
>
>
>

Re: I Need some help configuring apache tomee

[Richard Zowalla]

Hi,

This kind of exception mostly happens, if the related datasource could not be 
found.
TomEE auto-creates default resources baed on in memory databases (and if no 
schema is present, this is the typical exception which happens).

You can try to use the following JNDI schema:

java:openejb/Resource/

With a declaration like

   
JtaManaged = true

//properties here

Gruß
Richard

> Am 02.06.2024 um 00:13 schrieb Fernando :
> 
> Hi,
> I am trying to migrate an small application from payara community 5 to
> Apache Tomee Plume 8.
> I am working with Java 8 and postgresql 14 on windows and I am getting this
> error message when I try to launch the  application:
> 
> 
> 
> *javax.ejb.EJBException: The bean encountered a non-application exception;
> nested exception is: javax.persistence.PersistenceException: Exception
> [EclipseLink-4002] (Eclipse Persistence Services -
> 2.7.13.v20230724-7ffb888abf):
> org.eclipse.persistence.exceptions.DatabaseExceptionInternal Exception:
> java.sql.SQLSyntaxErrorException: usuario no tiene privilegios suficientes
> o objeto no encontrado: CUENTAS in statement [SELECT ID, NOMBRE, TIPO FROM
> cuentas ORDER BY NOMBRE]*
> 
> I am understand that said that the user have not  enough privilege, but I the
> user and password are correct!
> In file context.xml under the META-INF of my project I set this:
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> * driverClassName="org.postgresql.Driver" maxIdle="10"
> maxTotal="20" maxWaitMillis="-1" name="jdbc/gastos"
> password="unacontrasena" type="javax.sql.DataSource"
> url="jdbc:postgresql://localhost:5432/GastosJ"
> username="operador"/>*
> 
> and in persistence.xml I have this configuration:
> 
> 
> 
> 
> 
> 
> *http://xmlns.jcp.org/xml/ns/persistence
> "
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
> "
> xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/persistence
> 
> http://xmlns.jcp.org/xml/ns/persistence/persistence_2_1.xsd
> ">
> 
> org.eclipse.persistence.jpa.PersistenceProvider
> jdbc/gastos
> *
> 
> Finally in Dao Class, where I have the error showed up, I have:
> 
> 
> 
> 
> 
> 
> *@Statelesspublic class CuentaDaoImp implements CuentaDao {
> @PersistenceContext(unitName = "GastosPU")private EntityManager em;*
> 
> Maybe I am not understanding something i am a little lost.someone
> could give me a hand?
> Thanks in advance!
> 
> Fernando

Re: pom content for TomEE 8.0.16 and TomEE 9.1.3

[Richard Zowalla]

-> 
https://github.com/apache/tomee/commit/ccfc34096e6f0b8ca1c5d1c3f8dc4b7dc8c9183e

It was renamed. TomEE 9+ uses our own MP compliant JWT implementation, which 
still resides in mp-jwt.


> Am 31.05.2024 um 11:11 schrieb COURTAULT Francois 
> :
> 
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> For one TomEE 8.0.16 application, I use the JWTAuthContextInfo class.
> So in my pom I have:
> 
> 
>org.apache.tomee
>mp-jwt
>7.1.4
>provided
> 
> and I was able to compile my application
> If I change the version to 8.0.x even 9.1.3, it doesn't compile.
> Any idea ? what is the update I have to do ?
> 
> If I switch to TomEE 9.1.3, I should use smallrye then, right?
> import io.smallrye.jwt.auth.principal.JWTAuthContextInfo
> What dependency I have to have in my pom?
> 
> Thanks in advance for your support.
> 
> Best Regards.
> 
> 
> 

Re: Memory leak solved in TomEE 8.0.13 (TOMEE-2771) ?

[Richard Zowalla]

If the ticket is still open, I don't think, that it was investigated. Since no 
one else reported it, it might not be a problem anymore.

For newer versions of TomEE, it shouldn't apply at all as we no longer have the 
geronimo impl.

Gruß
Richard

On 2024/05/27 07:44:10 COURTAULT Francois wrote:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> I opened a JIRA ticket a long time ago: 
> https://issues.apache.org/jira/browse/TOMEE-2771
> We observed from TomEE 8.0.0 to 8.0.5, a memory leak : lot of opentracing 
> objects created without any reason (eg our application doesn't use 
> opentracing).
> 
> Do you know if it has been fixed in the latest TomEE 8 version (eg TomEE 
> 8.0.26) ?
> 
> Best Regards.
> 
> 
> 
> 

Re: [ANN] Apache TomEE 9.1.3

[Richard Zowalla]

Automated release note generation is only as good as the underlying
data is ;-) -
https://github.com/apache/tomee-site-generator/commit/c54ef5b557cc97c98746e1fe07d7ce93ec0e55b2

Gruß
Richard



Am Dienstag, dem 16.04.2024 um 07:35 + schrieb COURTAULT Francois:
> THALES GROUP LIMITED DISTRIBUTION to email recipients 
> 
> Hello Richard,
> 
> Great news 
> 
> I haven't checked everything but, at least, the jose upgrade from
> 0.9.3 to 0.9.6 is missing in the release note 
> 
> Best Regards.
> 
> -Original Message-
> From: Richard Zowalla  
> Sent: lundi 15 avril 2024 22:40
> To: annou...@apache.org
> Cc: d...@tomee.apache.org; users@tomee.apache.org
> Subject: [ANN] Apache TomEE 9.1.3
> 
> The Apache TomEE team is pleased to announce the availability of
> TomEE
> 9.1.3
> 
> Apache TomEE delivers enterprise application containers and services
> based on, but not limited to the Enterprise JavaBeans Specification
> and Java/Jakarta Enterprise Edition Specifications.
> 
> This release contains some bug fixes and dependency upgrades.
> 
> Full release notes:
> 
> - https://tomee.apache.org/9.1.3/release-notes.html
> -
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12354125
> 
> 
> Downloads are available at: https://tomee.apache.org/download.html
> 
> - The Apache TomEE Team
> 

[ANN] Apache TomEE 9.1.3

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
9.1.3

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java/Jakarta Enterprise Edition Specifications.

This release contains some bug fixes and dependency upgrades.

Full release notes:

- https://tomee.apache.org/9.1.3/release-notes.html
-
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12354125


Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE Team

[ANN] Apache TomEE 10.0.0-M1

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
10.0.0-M1

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java/Jakarta Enterprise Edition Specifications.

This release is a first milestone of TomEE 10, aimed at JakartaEE 10.

Full release notes:

- https://tomee.apache.org/10.0.0-M1/release-notes.html
-
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12352714

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE Team

Re: Some issues with simple rest application

[Richard Zowalla]

Hi,

I don't see an actual issue here. I have reproduced the example you
described in your mail here (declare a resource, add an application
servlet in web.xml):
 
https://github.com/rzo1/ml-jaxrs-repro

Running that on a TomEE 9.1.2 (Microprofile) deploys the resource as
expected:

02-Apr-2024 20:16:38.994 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints REST
Application: http://localhost:8282/myapp->
org.apache.openejb.config.AnnotationDeployer$ProvidedJAXRSApplication@7a023e34
02-Apr-2024 20:16:38.996 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints 
Service URI: http://localhost:8282/myapp/health -> Pojo
org.apache.tomee.microprofile.health.MicroProfileHealthChecksEndpoint
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health ->  Response
getChecks()   
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health/live->  Response
getLiveChecks()   
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health/ready   ->  Response
getReadyChecks()  
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health/started ->  Response
getStartedChecks()
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints 
Service URI: http://localhost:8282/myapp/myresource -> Pojo
com.github.rzo1.MyResource   
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/myresource ->  Response test()


Next, I went on and followed the instructions for the second example
(add a class extending Application, purge web.xml)

https://github.com/rzo1/ml-jaxrs-repro/tree/case-2

Also works as expected:

02-Apr-2024 20:16:38.994 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints REST
Application: http://localhost:8282/myapp->
org.apache.openejb.config.AnnotationDeployer$ProvidedJAXRSApplication@7a023e34
02-Apr-2024 20:16:38.996 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints 
Service URI: http://localhost:8282/myapp/health -> Pojo
org.apache.tomee.microprofile.health.MicroProfileHealthChecksEndpoint
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health ->  Response
getChecks()   
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health/live->  Response
getLiveChecks()   
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health/ready   ->  Response
getReadyChecks()  
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/health/started ->  Response
getStartedChecks()
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints 
Service URI: http://localhost:8282/myapp/myresource -> Pojo
com.github.rzo1.MyResource   
02-Apr-2024 20:16:38.997 INFORMATION [main]
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.logEndpoints   
GET http://localhost:8282/myapp/myresource ->  Response test()

Might have missed something from your explanation, though.

Gruß
Richard


Am Montag, dem 01.04.2024 um 20:15 + schrieb COURTAULT Francois:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> After having read the Jakarta Restful 3.0 specification.
> I want to check how it works.
> 
> For that I have built a web application (war) without any Application
> subclass.
> According to the specification, I have to add a servlet with the name
> jakarta.ws.rs.core.Application in web.xml.
> In the war, I have:
> 
>   *   a Root resource named MyResource
> @Path("myresource")
> 
> public class MyResource {
> 
>     @GET
> 
>    public Response test () {
> 
>     return Response.ok().build();
> 
>     }
> 
> }
> 
>   *   web.xml with the following section
>     
> 
>     jakarta.ws.rs.core.Application
> 
>     
> 
>     
> 
>     jakarta.ws.rs.core.Application
> 
>     /myapp/*
> 
>     
> 
> Pb when I start up tomee-microprofile 9.1.2, I see:
> 01-Apr-2024 21:42:21.835 INFO [main]
> 

Re: Question: Can I donate to an Apache project? (was Re: Will Tomee be discontinued ?)

[Richard Zowalla]

e:   19-03-2024 03:20
> > > Subject:    Question: Can I donate to an Apache project? (was
> > > Re: 
> > Will 
> > > Tomee be discontinued ?)
> > > 
> > > 
> > > 
> > > > On Mar 16, 2024, at 9:02 AM, Vicente Rossello
> > > >  
> > > wrote:
> > > > 
> > > > Hi,
> > > > 
> > > > I've tried a few times to do some contributions to the project,
> > > > but 
> > > testing
> > > > the TCK or solving almost any issue is really hard, and very
> > > > far from 
> > > what
> > > > I'm used to do in my daily work. And now I don't have much
> > > > time... 
> > > family
> > > > and work consumes almost all my time.
> > > > 
> > > > I really find this project relevant in the jakarta EE and I
> > > > would love 
> > > to
> > > > see it keep going. What I can do is to make some donations. I
> > > > guess 
> > that
> > > > the donations should go to apache, my question is can I fund
> > > > this 
> > > specific
> > > > project? Also I see that donations are tax deductible in the
> > > > US, does
> > > > anyone know if this is possible in Spain (or even any country
> > > > in 
> > > Europe)?
> > > 
> > > First, I just want to say on a personal level, I find your email 
> > touching. 
> > > Most people only ask what can I get and not what can I give.  The
> > > world 
> > > needs more people like you.
> > > 
> > > Donations to Apache aren't used to fund development of Apache
> > > projects. 
> > > The foundation in terms of being a corporation is actually
> > > incredibly 
> > > small; less than 10 employees and contractors combined.  The
> > > funding 
> > > Apache gets goes to that very tiny crew and covers
> > > infrastructure, 
> > legal, 
> > > the conferences Apache coordinates and some limited marketing.
> > > 
> > > Everything else including the board of directors are all
> > > volunteers.
> > > 
> > > What that means is there is no way for you to sponsor "the
> > > project", you 
> > 
> > > would have to single out individuals and sponsor them directly. 
> > > I've 
> > used 
> > > Github sponsors to sponsor a few of the people I saw
> > > contributing, such 
> > as 
> > > Daniel Dias, Richard Zowalla and Thomas Andraschko.  They take
> > > 10% and 
> > and 
> > > handle tax.
> > > 
> > > I agree with your perspective on not wanting to sacrifice family
> > > time 
> > for 
> > > open source.  Unfortunately it is the main source of contribution
> > > for 
> > most 
> > > Apache projects and the main reason people burn out and stop 
> > contributing.
> > > 
> > > I used to encourage people to contribute in their spare time and
> > > did so 
> > > myself.  TomEE 1.0 to 1.5 were created and shipped by people
> > > working in 
> > > their spare time.  We would frequently use vacation time to hack
> > > on open 
> > 
> > > source together, cut releases, etc.  The 1.5 release was actually
> > > cut 
> > > while Jean-Louis was in the hospital while his wife was giving
> > > birth to 
> > > their second kid and I was on vacation helping.  On my side I
> > > ended up 
> > > having to quit my job in order to get permission to work on TomEE
> > > in my 
> > > spare time after having gotten in some hot water for taking a
> > > week off 
> > to 
> > > cut the 1.0.  I later learned Jonathan Gallimore had to apply
> > > similar 
> > > pressure to his employer to get the permission to also work in
> > > his spare 
> > 
> > > time.
> > > 
> > > There was some occasional employer support.  Atos/Worldline was 
> > supportive 
> > > as they used OpenEJB and had a smart manager, Jean-Francois
> > > James, that 
> > > saw benefit in allowing some contribution on company time when
> > > they had 
> > a 
> > > specific need (this is where Jean-Louis Monteiro, Romain Manni-
> > > Bucau 
> > > worked).  IBM was very supportive of me in the 2005 - 2010 range
> > > when 
> > > Geronimo was active as long as it benefit Geronimo and my
> > > contri

Re: Question: Can I donate to an Apache project? (was Re: Will Tomee be discontinued ?)

[Richard Zowalla]

Hi,

you actually need to choose the right branch on that repository. Some
of these tests require specific settings to be present (only available
on some branches) and assume certain locale / enviroment conditions
(most of them aren't documented in the README). I had a lot of pain
running TCK tests for 8.x and 9.1.x on my de_DE Ubuntu machine ;-) (and
yes, I also had the bsdtar issue). Another thing is, that a run polutes
your TCK installation, so I ended up putting it under a local git and
clean it after each run ;-)

Getting the old TCK to run, is a bit of a pain. Even if you are doing
everything right, it sometimes also depends on the JDK version you have
on your machine (for 9.1.1, I had some pain because of a bug in the JDK
HTTP client resulting in TCK tests to fail due to a change in CXF). 

Long story short: Given that most TCK/specs migrated towards
arquillian/junit/testng, setting up and running the TCK for TomEE 10,
is now a totally different thing than before. Some of the quirks and
properties / configs (and hacks) can be copied over or need to be
added. A good example for that procedere is [1], in which Benedict and
myself did a trial and error approach to get the JAX-RS E10 TCK set up.

We would need to do that for the other relevant spec TCKs inside of
TomEE too, but this is "Neuland" (new area) for everyone involved. Some
of these modern TCKs are straightforward (eg. BatchEE TCK), but others
require a more sophisticated setup. It involves looking into the TCK
guide, looking into other projects (how they do it), copying / checking
quirks required for TomEE inside the old TCK (system properties, etc.)
and trying to get it setup and run it. It is really a try and error
process. The signature tests are more or less "quick" wins, but
sometimes also require some hackery :/

I guess, that the place to ask questions is the dev@ list. If it
requires a more sync way of communicating, Slack might also be an
opton. A synchronous meeting might work too, but is limited to
timezone, etc. 


Gruß
Richard


[1] https://github.com/apache/tomee/pull/1063


Am Freitag, dem 22.03.2024 um 13:59 +0100 schrieb Jens Zurawski:
> Hi David,
> 
> thanks for your reply. It's a difficult situation right now, feels a
> bit 
> like a "deadlock": No relief for the active rest of the committers 
> without new and "educated" team members, but no new team members
> without 
> additional time invest of the current committers. As with technical 
> deadlocks, it has to be broken up at some point (even with some small
> loss somewhere if there is no other way). So, I'm looking forward if 
> it's possible to re-activate one of the retired committers. At least
> to 
> be available as a kind of "big brother" who can be asked some
> questions 
> once in a while when the newbies get stuck somewhere. And, of course,
> a 
> short introduction into what/where/when/how.
> 
> Just out of curiosity I've started a quick and naive attempt to check
> the TCKs on my machine. I actually don't have the time slices to dig 
> deeper into this, but I wanted to get a feeling of what's coming up
> if I 
> decide to get into it.
> 
> So I just installed a new WSL ubuntu 22.04 instance (if that won't
> work, 
> I would have continued with a dedicated linux VM), installed git and 
> maven, and followed the instructions on
> https://github.com/apache/tomee-tck/
> 
> It doesn't work out of the box on a fresh ubuntu. "bsdtar" is not 
> installed in default dist setup. Why bsdtar? Maybe could be changed
> to 
> just use GNU tar?
> Now, with bsdtar installed, after setup.sh has finished (there is no 
> setup-tck9.sh, the README.adoc should be adapted), there were no
> error 
> messages or warnings, but glassfish-7.0.0-M8 download/unzip wasn't 
> successful. Don't know why, I've done it manually then. When I have
> some 
> more time, I may try to find out where the problem is.
> 
> Now, everything seems to be here and I started a first try with the 
> sample from the README:
> ./runtests --web tomee-plume 
> com.sun.ts.tests.ejb30.bb.localaccess.statelessclient
> 
> Nice, all tests passed :-)
> 
> Then, cheered up from this first success, tried a more comprehensive 
> test with:
> ./runtests --web tomee-plume -c com.sun.ts.tests.ejb30
> 
> Could run in background during I was doing my daily stuff. Ok, seems 
> this will take quite a while It's already running since 2 hours
> or 
> so and I think I will stop it here. Until now, 795 tests passed and
> 1807 
> tests failed. So what I learn from this quick shot: Something is not 
> working correct by now or I have not understood correctly how it
> works, 
> because a failed/passed ratio of 2:1 can't be correct. On the other 
> hand, passing 795 tests with success also means I'm not totally off 
> track ;-)
> 
> Yeah, well, without some educated hints it will take much more time
> to 
> correctly get into this. I guess it's only some glitches in my setup,
> or 
> I have forgotten something, or I'm just doing it 

RE: TomEE system.properties : tomee.mp.scan doc/meaning

[Richard Zowalla]

>From just reading the code it might be possible to by doing it via properties 
>[1]

 SystemInstance.get().setProperty(extension + ".active", "false"));

Didn't test it or digged deeper though.

[1] 
https://github.com/apache/tomee/blob/main/tomee/tomee-microprofile/mp-common/src/main/java/org/apache/tomee/microprofile/TomEEMicroProfileListener.java#L75

On 2024/03/15 10:27:11 COURTAULT Francois wrote:
> THALES GROUP LIMITED DISTRIBUTION to email recipients 
> 
> Hello everyone,
> 
> Any answers/comments ?
> 
> Best Regards.
> 
> -Original Message-
> From: COURTAULT Francois 
> Sent: jeudi 7 mars 2024 17:07
> To: users@tomee.apache.org
> Subject: RE: TomEE system.properties : tomee.mp.scan doc/meaning
> 
> THALES GROUP LIMITED DISTRIBUTION to email recipients 
> 
> Hello Richard,
> 
> Thanks a lot. But it seems that it is a kind of anything/nothing.
> 
> If tomee.mp.scan = none (nothing), then our application can't use any of the 
> micro-profile spec, right ?
> If tomee.mp.scan = all (everything), then our application can use any of the 
> following specs: 
>  - MPJWTCDIExtension (microprofile-jwt-auth-spec-2.0)
>  - RestClientExtension (microprofile-rest-client-spec-3.0)
>  - ConfigExtension (microprofile-config-spec-3.0.3)
>  - MetricCdiInjectionExtension (microprofile-metrics-spec-4.0)
>  - SmallRyeTracingDynamicFeature & OpenTracingInterceptor 
> (microprofile-opentracing-spec-3.0)
>  - FaultToleranceExtension (microprofile-fault-tolerance-spec-4.0.2)
> right ?
> 
> Is it possible to specify that we only want to use microprofile-config-spec & 
> microprofile-jwt-auth-spec ?
> 
> BTW OpenApi & Health aren't listed. Does it means they are activated by 
> default ?
> 
> Best Regards.
> 
> -Original Message-
> From: Richard Zowalla 
> Sent: jeudi 7 mars 2024 15:16
> To: users@tomee.apache.org
> Subject: Re: TomEE system.properties : tomee.mp.scan doc/meaning
> 
> Hi,
> 
> looking into [1], a value != "none" will activate the MP extensions.
> The default is "none" if the property is not present. "none" means, that the 
> extensions listed in line 59 and below are disabled by default.
> 
> [1]
> https://github.com/apache/tomee/blob/main/tomee/tomee-microprofile/mp-common/src/main/java/org/apache/tomee/microprofile/TomEEMicroProfileListener.java#L73
> 
> Am Mittwoch, dem 06.03.2024 um 15:29 + schrieb COURTAULT Francois:
> > THALES GROUP LIMITED DISTRIBUTION to email recipients
> > 
> > Hello everyone,
> > 
> > Is there somewhere a doc describing the system property tomee.mp.scan 
> > ? any default value if missing ? what are the possible values with 
> > their meanings ?
> > What if the tomee.mp.scan is set to none ? what would happen in such 
> > case ? Any good reason to set this entry to none ?
> > 
> > Best Regards.
> > 
> > 
> > 
> 

Re: CVE-2023-51775 in jose library embedded in TomEE 9.1.2

[Richard Zowalla]

I did the updates yesterday and the CI is still running, but I don't think, 
that we expect any regressions, so it should be save to upgrade in /lib

On 2024/03/15 14:56:11 COURTAULT Francois wrote:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> The CVE 2023-51775 (Sonatype CVSS 3: 8.6) has been raised end of February 
> 2024.
> jose4j-0.9.3.jar has this vulnerability.
> 
> Is it safe/ok to replace this version by jose4j-0.9.6.jar released the 6th of 
> March 2024 ?
> 
> Best Regards.
> 
> 
> 

Re: Will Tomee be discontinued ?

[Richard Zowalla]

Hi Francois,

first of all: Please do not cross post between list. Most people on
dev@ are also subscribed on user@

TomEE is an open source project, so it fully depends on the community
to step up and getting a TomEE 10.x out of the door. So instead of
asking "will we have at some point TomEE 10.x", the better question
would be "how can I or my team help to get a TomEE 10.x out of the door
soon".

We are (imho) close to a milestone release (far away from passing the
EE10 tck) but with sufficient coverage of the most important aspects.
However, the current main branch depends on SNAPSHOT dependencies, so
we need to get rid of them before doing a milestone release. If you
have followed my last mails on dev@, you might have seen, that it
currently hangs on batchee to get a EE10 compatible release out of the
door. 

What would activley help?

We need more resources / contributors to keep going. Most people are
volunteers and are not working full time on TomEE. Keeping up with the
spec changes, etc. is really difficult and every active contributor
would really help. 


Best
Richard


Am Donnerstag, dem 14.03.2024 um 15:57 + schrieb COURTAULT
Francois:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> Will we have at some point TomEE 10.x ?
> 
> Best Regards.
> 
> 
> 

Re: TomEE system.properties : tomee.mp.scan doc/meaning

[Richard Zowalla]

Hi,

looking into [1], a value != "none" will activate the MP extensions.
The default is "none" if the property is not present. "none" means,
that the extensions listed in line 59 and below are disabled by
default.

[1]
https://github.com/apache/tomee/blob/main/tomee/tomee-microprofile/mp-common/src/main/java/org/apache/tomee/microprofile/TomEEMicroProfileListener.java#L73

Am Mittwoch, dem 06.03.2024 um 15:29 + schrieb COURTAULT Francois:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> Is there somewhere a doc describing the system property tomee.mp.scan
> ? any default value if missing ? what are the possible values with
> their meanings ?
> What if the tomee.mp.scan is set to none ? what would happen in such
> case ? Any good reason to set this entry to none ?
> 
> Best Regards.
> 
> 
> 

Re: Migration doc from TomEE 8.x to TomEE 9.x

[Richard Zowalla]

Hi,

to add to what is already said:

Keep an eye on the different Jakarta API versions for EE9 vs EE10.

If you have Hibernate somewhere, 6.4.x doesn't work out of the box with TomEE 
9.x because they removed some workarounds/fallbacks for earlier JPA spec 
versions. 

And of course legacy third party libs are pain - we sometimes had to fork or 
follow a shade/relocate approach.

Best
Richard 



Am 21. Februar 2024 12:29:41 MEZ schrieb Alex The Rocker :
>Hi François,
>
>Just speaking from my own experience on a huge set of webapps to
>migrate, but Eclipse Transformer was quite good for both source-level
>& JAR (bytecode) level Java -> Jakarta EE migration. For sure, 80% of
>the time was spent chasing the devil in details in the 20% remaining
>glitches (mostly caused by deadly old code not even at EE8 level but
>*older*, and fighting with some not quite supported old 3rd party
>JARs..)
>
>Alex
>
>
>
>
>Le mer. 21 févr. 2024 à 12:17, COURTAULT Francois
> a écrit :
>>
>> THALES GROUP LIMITED DISTRIBUTION to email recipients
>>
>> Hello everyone,
>>
>> Is there any document somewhere which describes the way to migrate our 
>> applications from TomEE 8.x to TomEE 9.x ?
>> I saw that there is some tool available at Tomcat site like "Tomcat 
>> Migration Tool for Jakarta EE 1.0.8 Released".
>>
>> Thanks in advance.
>>
>> Best regards.
>>
>>
>>

Re: TomeEE official maven repo

[Richard Zowalla]

https://repository.apache.org/content/repositories/releases/org/apache/tomee/apache-tomee/

(but you shouldn't use the ASF repo for a PROD env because of rate
limit restrictions)

Am Montag, dem 08.01.2024 um 12:53 + schrieb COURTAULT Francois:
> THALES GROUP LIMITED DISTRIBUTION to email recipients
> 
> Hello everyone,
> 
> Could someone confirm or not to me that the official TomEE maven
> repos is
> https://repo.maven.apache.org/maven2/org/apache/tomee/apache-tomee/
> If the answer is no then what is the official TomEE maven repo ?
> If the answer is no then  9.1.2 entry is missing, right ?
> 
> Best Regards.
> 
> 
> 

Re: TomEEMicroProfileListener IllegalStateException

[Richard Zowalla]

Hi,

yes. If it bothers you, it might be a good point to start.

The main difference between 8 and 9 is the switch of the micro profile
implementation from geronimo to smallrye.

The integration code is in
https://github.com/apache/tomee/tree/main/tomee/tomee-microprofile/mp-common

So the process would be to try to understand the problem a bit better,
maybe add an itest, which can reproduce the behaviour and than do some
debugging to figure out, what exactly is happening here.

Gruß
Richard

Am Donnerstag, dem 16.11.2023 um 14:58 +0100 schrieb Bart van Leeuwen:
> Hi,
> 
> What would be a good way to pin point this issue, where to start
> looking 
> etc?
> 
> Met Vriendelijke Groet / With Kind Regards
> Bart van Leeuwen
> 
> 
> 
> 
> From:   "Bart van Leeuwen" 
> To: users@tomee.apache.org
> Date:   02-11-2023 13:29
> Subject:    TomEEMicroProfileListener IllegalStateException
> 
> 
> 
> Hi,
> 
> Again in the transition from TomEE 8 to TomEE 9 (Plus version) I run
> into 
> the following error on app deployment.
> This only happens on the first deployment of the app, if redeployed
> the 
> error doesn't happen.
> So far I have not been able to create a testcase.
> 
> SEVERE [Catalina-utility-1] 
> org.apache.openejb.observer.ObserverManager$MethodInvocation.invoke
> error 
> invoking
> org.apache.tomee.microprofile.TomEEMicroProfileListener@53f0a4cb
>     java.lang.IllegalStateException: On a thread without an 
> initialized context nor a classloader mapping a deployed app
> 
> Met Vriendelijke Groet / With Kind Regards
> Bart van Leeuwen
> 
> 
> 
> 



signature.asc
Description: This is a digitally signed message part

Re: Health of this project -- should we keep going?

[Richard Zowalla]

I guess, that setting up TCK for the EE10 / main branch would be of
great help. There are some open PRs in this area but they need to be
rebased, etc. - and we need to fix potential failures or add missing
implementations / edge cases. The related code part is in
https://github.com/apache/tomee/tree/main/tck

In https://github.com/apache/tomee/pulls there are some open PRs
related to TCK setups and some Specs/TCKs are missing.

Background: With EE10 the way the TCK works has changed, so our
previous TCK setup in https://github.com/apache/tomee-tck won't work
anymore. 

Gruß
Richard

Am Donnerstag, dem 16.11.2023 um 14:57 +0100 schrieb Bart van Leeuwen:
> I'm still interested in helping?
> 
> Met Vriendelijke Groet / With Kind Regards
> Bart van Leeuwen
> 
> 
> 
> From:   "Bart van Leeuwen" 
> To: users@tomee.apache.org
> Date:   31-10-2023 11:19
> Subject:    RE: Health of this project -- should we keep going?
> 
> 
> 
> So as an active user of Tomee, where would you need help? where to
> start?
> 
> (my employer has no problem that I would work on it)
> 
> On 2023/10/11 19:36:23 David Blevins wrote:
> > Hi All,
> > 
> > Wanted to share the state of this project as reported to the Apache
> board.
> > 
> >  - https://tomee.apache.org/board-report-2023-09-20.txt
> > 
> > The short version is we do not get enough help from you to keep
> > this 
> project going.
> > 
> > Should we continue or should we just give up?
> > 
> > 
> > 
> > -David
> > 
> > 
> Met Vriendelijke Groet / With Kind Regards
> Bart van Leeuwen
> 
> 
> 
> 
> 

RE: TomEE 9.x relies on Tomcat 10.0.27 but this one is quite old ...

[Richard Zowalla]

The TomEE Patch Plugin doesn't rewrite the content of the manifest files ;-)

You could check the file hashes or the related classes, which required patching

Gruß
Richard 

Am 13. November 2023 17:42:18 MEZ schrieb COURTAULT Francois 
:
>THALES GROUP LIMITED DISTRIBUTION to email recipients 
>
>Hello Jonathan
>
>You wrote:
>" > One comment I'll make though, is that NexusIQ (I also use it) will 
>> potentially still identify the jars as Tomcat 10.0.27, and therefore 
>> may still identify them as vulnerable (incorrectly), despite a patch 
>> being applied."
>
>I have checked the MANIFEST.MF file of the Tomcat and Catalina libraries 
>inside TomEE 9.1.1 and 
>all of them have Implementation-Version: 10.0.27.and sometimes Bundle-Version: 
>10.0.27.  
>
>Best Regards.
>
>-Original Message-
>From: Vicente Rossello  
>Sent: lundi 13 novembre 2023 16:16
>To: users@tomee.apache.org
>Subject: Re: TomEE 9.x relies on Tomcat 10.0.27 but this one is quite old ...
>
>Hi,
>
>I was also wondering about this outdated tomcat.
>
>I was trying to move to tomee 9.1, but I realized that we depend on some 
>tomcat features that are not present on tomcat 10.x.
>
>So I guess we have to move from tomee 8 all the way to tomee 10. So, also 
>checking on 10.x branch, I see that it depends on eclipselink 3.0.3, but I 
>guess that this is temporal and it will be upgraded to eclipselink 4.x, since 
>this is the version compatible with jakarta 10
>
>This jakarta migration seems like a huge and risky task, every time I try to 
>attempt it I find new obstacles (this is not criticism of course, just saying).
>
>On Mon, Nov 13, 2023 at 4:00 PM Jonathan Gallimore < 
>jonathan.gallim...@gmail.com> wrote:
>
>> I will check on the state of these CVEs with respect to the backports, 
>> and reply on this thread.
>>
>> One comment I'll make though, is that NexusIQ (I also use it) will 
>> potentially still identify the jars as Tomcat 10.0.27, and therefore 
>> may still identify them as vulnerable (incorrectly), despite a patch 
>> being applied.
>>
>> While I understand the frustration that may cause both yourself and 
>> your customers, please understand that both Tomcat and TomEE are 
>> community projects, and everyone contributing is doing so as a volunteer.
>>
>> Richard has already outlined why we can't move to Tomcat 10.1.x on 
>> TomEE 9.x. TomEE 10.x is in progress. Any contributions you wanted to 
>> make would be most welcome.
>>
>> Jon
>>
>> On Mon, Nov 13, 2023 at 1:29 PM COURTAULT Francois 
>>  wrote:
>>
>> > THALES GROUP LIMITED DISTRIBUTION to email recipients
>> >
>> > Hello Richard,
>> >
>> > I performed a vulnerabilities scan using NexusIQ, the result are:
>> > - CVE-2022-45143 (CVSS 3 scoring 7.5) on  tomcat-catalina : 10.0.27
>> > - CVE-2023-24998 (CVSS 3 scoring 7.5) on tomcat-coyote : 10.0.27
>> >
>> > Some of our customers won't accept that ☹
>> >
>> > BTW I also scan Tomcat 10.1.15 with the same tool and I don't have
>> anymore
>> > such CVSS 3 score.
>> > So will you start TomEE 10.x at some point ?
>> >
>> > Best Regards.
>> >
>> > -Original Message-
>> > From: Richard Zowalla 
>> > Sent: lundi 13 novembre 2023 12:53
>> > To: users@tomee.apache.org
>> > Subject: Re: TomEE 9.x relies on Tomcat 10.0.27 but this one is 
>> > quite old ...
>> >
>> > Hi,
>> >
>> > the TomEE 10.0.27 contained in TomEE 9.1.x is patched inside the 
>> > TomEE build to fix the latest CVEs. We did not backport bug fixes, though.
>> >
>> > As TomEE 9 targets EE9(.1), we cannot upgrade to Tomcat 10.1.x, 
>> > which is EE10. So from a spec perspective, there is currently no 
>> > plan to migrate TomEE 9.x to Tomcat 10.1.x (without breaking the tck).
>> >
>> > Gruß
>> > Richard
>> >
>> >
>> > Am Montag, dem 13.11.2023 um 11:30 + schrieb COURTAULT Francois:
>> > > THALES GROUP LIMITED DISTRIBUTION to email recipients
>> > >
>> > > Hello everyone,
>> > >
>> > > According to this link
>> > > https://tomcat.apache.org/tomcat-10.0-eol.html  Tomcat 10.0.x is 
>> > > EOL, right?
>> > > But TomEE 9.1.1 still rely on Tomcat 10.0.x.
>> > >
>> > > Any plan to migrate TomEE 9.x to Tomcat 10.1.x ?
>> > >
>> > > Best Regards.
>> > >
>> > >
>> > >
>> >
>>

[ANN] Apache TomEE 8.0.16

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
8.0.16

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java/Jakarta Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and updates
the dependencies TomEE 8 uses.

Full release notes:

- https://tomee.apache.org/8.0.16/release-notes.html

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team

Re: Very slow JSF Development Mode on tomee 8.x newer than 8.0.6

[Richard Zowalla]

Cool. Thanks for going down the rabbit hole ;-)

Given that there is a lot of information/benchmarks etc. collected in this 
thread, what do you think about opening an issue in Tomcat with a reference to 
this thread?

They might take a look.

Gruß
Richard 

Am 28. Oktober 2023 12:22:12 MESZ schrieb Jens Zurawski :
>For all who are interested I've made some quick benchmarks, to see the impact.
>I've taken one of my biggest views which is making a small AJAX poll on the 
>same view every 30s to be able to get some balanced average values for the 
>response times. The payload of the poll is small (around 500 to 1000 bytes) 
>but because it's the same view, the component tree is big.
>
>Windows (same machine localhost, it is an 8 core Ryzen-7 with 64GB of RAM and 
>SSD, so the machine is not the limiting factor)
>
>~ 12000 ms DevMode plain
>~ 600 ms DevMode with allowLinking="true"/>
>~ 100 ms ProdMode plain
>~ 100 ms ProdMode with allowLinking="true"/>
>
>Linux (customer site over Internet VPN, it is a 6 core Intel i5 with 16GB of 
>RAM and SSD)
>
>~ 700 ms DevMode plain
>~ 350 ms DevMode with allowLinking="true"/>
>~ 130 ms ProdMode plain
>~ 130 ms ProdMode with allowLinking="true"/>
>
>No, the 12000 ms is _not_ a typo ;-)
>
>My conclusions from these figures are:
>- ProdMode is not affected by this issue
>- On Windows the problem is very significant and renders the DevMode unusable
>- On Linux the problem is not that dramatic, so one can say "well, it's dev 
>mode, deal with it", but it is also affected in doubling the response times. 
>Maybe worth enough to also look into this issue even if one is Linux only.
>
>cu
>Jens
>
>
>
>Am 28.10.2023 um 11:43 schrieb Jens Zurawski:
>> I can confirm, that this setting also solves the problem of the slow dev 
>> mode. Thank you for the tip.
>> 
>> So, either this or the canonCache solves this issue for me on my development 
>> environment. But, of course, both of them should be avoided on production 
>> systems. The chances that they slip from dev to prod by accident may be 
>> small (if one is using well known "good" development strategies and methods, 
>> like staging, testing Q, reviews, and the like) but still possible.
>> And the fact, that it seems to only really matter in JSF dev mode is curious 
>> at the least.
>> 
>> Am 28.10.2023 um 08:24 schrieb Vicente Rossello:
>>> Sorry, that was not correct.
>>> 
>>> The allowLinking is at the resources level. So, in the META-INF/context.xml
>>> file:
>>> 
>>> 
>>> >> containerSciFilter="org.apache.tomcat.websocket.server.WsSci|org.apache.jasper.servlet.JasperInitializer"
>>>  
>>>   parallelAnnotationScanning="true"
>>>   clearReferencesThreadLocals="false"
>>> skipMemoryLeakChecksOnJvmShutdown="true">
>>>  
>>> 
>>>  
>>> 
>>> 
>>> 
>>> BTW, the slowness is something between checking the canonicalPath too
>>> many times and jdk12 that removed those canonCache by default. See
>>> https://bugs.openjdk.org/browse/JDK-8258036
>>> 
>>> 

Re: Very slow JSF Development Mode on tomee 8.x newer than 8.0.6

[Richard Zowalla]

Sounds like it should be worth reporting it ;-)

Am 28. Oktober 2023 08:51:20 MESZ schrieb Vicente Rossello 
:
>The tomcat regression is probably introduced here:
>https://github.com/apache/tomcat/commit/08431bc0b895aa80e78e993a006cabb73aaa6490
>
>As it only affects windows and when there are a lot of files (and those
>files are constantly refreshed) it's not probably reported by anyone.
>
>
>
>On Sat, Oct 28, 2023 at 8:24 AM Vicente Rossello 
>wrote:
>
>> Sorry, that was not correct.
>>
>> The allowLinking is at the resources level. So, in the
>> META-INF/context.xml file:
>>
>> 
>> > containerSciFilter="org.apache.tomcat.websocket.server.WsSci|org.apache.jasper.servlet.JasperInitializer"
>>  parallelAnnotationScanning="true"
>>  clearReferencesThreadLocals="false" 
>> skipMemoryLeakChecksOnJvmShutdown="true">
>> 
>>
>> 
>> 
>>
>>
>> BTW, the slowness is something between checking the canonicalPath too many 
>> times and jdk12 that removed those canonCache by default. See 
>> https://bugs.openjdk.org/browse/JDK-8258036
>>
>>
>> On Sat, Oct 28, 2023 at 8:07 AM Vicente Rossello 
>> wrote:
>>
>>> Hi,
>>>
>>> It is a tomcat problem. The real problem is in DirResourcesSet. It is
>>> calling a lot of times File.getCanonicalPath(). This method is very slow in
>>> windows.
>>>
>>> What I did is extending the DirResourcesSet to skip processing the
>>> getCanonicalPath method so many times, but I really didn't understand the
>>> problem.
>>>
>>> A simpler and better solution is to set  allowLinking="true" in the
>>> context.xml file. So tomcat does not validate the canonicalPath every
>>> single time, which is just too much.
>>>
>>> Best regards,
>>> Vicente
>>>
>>> On Fri, Oct 27, 2023 at 5:51 PM Jens Zurawski  wrote:
>>>
>>>> My client is the last Windows System in my little universe. Due to some
>>>> constraints with my customers I have to deal with it for the time being.
>>>>
>>>> The switches, Vicente has provided, solved the problem for me so far.
>>>> But my "inner monk" is still not satisfied, because practical no one
>>>> knows of these switches, and after all, TomEE should do a good job on
>>>> Windows, too. And because 8.0.6 does a good job, and 8.0.8 breaks it to
>>>> some degree, we should at least try to figure out, what exactly causes
>>>> this break. Maybe there is an easy way to fix it, then it should be
>>>> fixed IMHO.
>>>>
>>>> So, I will go through the bisect session anyway, as it seems the best
>>>> possibility to get a grip on it. But I don't want to make these builds
>>>> on Windows. I'll build them on Linux and will try to ease my life a bit
>>>> with some scripting.
>>>>
>>>> cu
>>>> Jens
>>>>
>>>>
>>>> Am 27.10.2023 um 17:11 schrieb Richard Zowalla:
>>>> > Great news! (though I am not a Windows user anymore).
>>>> >
>>>> > You should be able to build TomEE on Windows, too. If that does not
>>>> > work out-of-the-box, you could try to build within a docker container
>>>> > or via git-bash in Windows
>>>> >
>>>> > (I am not 100% sure a Windows build will work out of the box)
>>>> >
>>>> > I agree, that it might complicate things for testing purpose as it
>>>> > increases the amount of cycles needed, but that are already very good
>>>> > insights!
>>>> >
>>>> > Gruß
>>>> > Richard
>>>> >
>>>> >
>>>> > Am Freitag, dem 27.10.2023 um 16:55 +0200 schrieb Jens Zurawski:
>>>> >> I have a first result on this issue:
>>>> >>
>>>> >> The problem does not occur if TomEE is running on Linux. I've tested
>>>> >> my
>>>> >> own built 8.0.8, a freshly extracted 8.0.8 and 8.0.15 from the
>>>> >> releases,
>>>> >> and none of them showed the dev mode performance problem.
>>>> >>
>>>> >> Using TomEE 8.0.8 on Windows does show the dev mode performance
>>>> >> problem.
>>>> >> All of the tested ones, means the released 8.0.8 and my own built
>>>> >> 8.0.8
>>&g

Re: Very slow JSF Development Mode on tomee 8.x newer than 8.0.6

[Richard Zowalla]

Great news! (though I am not a Windows user anymore).

You should be able to build TomEE on Windows, too. If that does not
work out-of-the-box, you could try to build within a docker container
or via git-bash in Windows 

(I am not 100% sure a Windows build will work out of the box)

I agree, that it might complicate things for testing purpose as it
increases the amount of cycles needed, but that are already very good
insights!

Gruß
Richard


Am Freitag, dem 27.10.2023 um 16:55 +0200 schrieb Jens Zurawski:
> I have a first result on this issue:
> 
> The problem does not occur if TomEE is running on Linux. I've tested
> my 
> own built 8.0.8, a freshly extracted 8.0.8 and 8.0.15 from the
> releases, 
> and none of them showed the dev mode performance problem.
> 
> Using TomEE 8.0.8 on Windows does show the dev mode performance
> problem. 
> All of the tested ones, means the released 8.0.8 and my own built
> 8.0.8 
> (the one I've built on Linux).
> 
> My development environment is Windows 10 (Netbeans and therefore also
> the TomEE for easy deployment and debugging). The problem does occur
> on 
> stand alone started TomEE and also if started out of Netbeans, so 
> Netbeans can be sorted out as the root of the problem. Java Versions
> 11, 
> 13, 15 and 17 tested, all the same, so Java should also not be the 
> problem. BTW: It is very unlikely a problem of my individual Windows 
> installation, because this problem also shows up on the Windows
> system 
> of my colleague, which btw. was the root cause why I'm started to dig
> deeper into this problem now and why I subscribed to this mailing
> list ;-)
> 
> I'm afraid, this will complicate my git bisect session a little bit
> :-(
> 
> However, I'll keep you posted.
> 
> cu
> Jens
> 
> 
> Am 27.10.2023 um 13:12 schrieb Jens Zurawski:
> > Thanks Richard (and Vicente),
> > 
> > I've changed to JDK 8 and now the builds are successful (both 8.0.6
> > and 8.0.8).
> > 
> > I'll script me some test scripts to ease the build, run and test
> > for 
> > every bisect step.
> > A build needs around 3 to 4 minutes. Running a test with my 
> > application will need some manual interaction and checks, I guess
> > also 
> > something around 4 minutes. This sums up to roughly 8 minutes per
> > step.
> > 
> > I've started a bisect and it told me:
> > git bisect good 20441eb
> > git bisect bad 4c8a616
> > Bisecting: 136 revisions left to test after this (roughly 7 steps)
> > 
> > That means, if everything works fine, I should be able to identify
> > the 
> > commit after about an hour? (That's cool why nobody has told me
> > about git bisect before? ;-) )
> > 
> > Anyway, I will have to find some time for this, maybe I need a
> > couple 
> > of days to find some.
> > I will let you know about the outcome.
> > 
> > cu
> > Jens
> > 
> > 
> > Am 27.10.2023 um 11:50 schrieb Richard Zowalla:
> > > Hi,
> > > 
> > > you need Java/JDK 8 to build TomEE 8.
> > > 
> > > The Maven command is
> > > 
> > > mvn --fail-at-end clean install -pl tomee/apache-tomee -am -
> > > Dfile.encoding=UTF-8 -DskipTests=true
> > > 
> > > You will find the tar.gz/zip in ./tomee/apache-tomee/target
> > > 
> > > Gruß
> > > Richard
> > > 
> > > P.S. 8.0.7 is here:
> > > https://archive.apache.org/dist/tomee/tomee-8.0.7/
> > > 
> > > Am Freitag, dem 27.10.2023 um 10:50 +0200 schrieb Jens Zurawski:
> > > > Hi Richard,
> > > > 
> > > > to identify the "bad" version was easy. I didn't find a 8.0.7
> > > > release
> > > > on
> > > > the download page, so I started with 8.0.8. And this version
> > > > already
> > > > has
> > > > the slow dev mode. So for my problem I can say:
> > > > good: 8.0.6
> > > > bad: 8.0.8
> > > > 
> > > > Now, I think, I need a little help from you. I tried to build a
> > > > TomEE
> > > > out of git (I've cloned the github repository
> > > > https://github.com/apache/tomee.git). I've tried these two
> > > > commits:
> > > > 20441eb (tag: tomee-8.0.6)
> > > > 4c8a616 (tag: tomee-project-8.0.8)
> > > > 
> > > > But the build fails every time on "TomEE :: Container :: Core"
> > > > with:
> > > > 
> > > > [INFO] BUILD FAILURE
> > > > [INFO]
> > > > --

Re: Very slow JSF Development Mode on tomee 8.x newer than 8.0.6

[Richard Zowalla]

Hi,

you need Java/JDK 8 to build TomEE 8.

The Maven command is 

mvn --fail-at-end clean install -pl tomee/apache-tomee -am -
Dfile.encoding=UTF-8 -DskipTests=true

You will find the tar.gz/zip in ./tomee/apache-tomee/target

Gruß
Richard

P.S. 8.0.7 is here: https://archive.apache.org/dist/tomee/tomee-8.0.7/

Am Freitag, dem 27.10.2023 um 10:50 +0200 schrieb Jens Zurawski:
> Hi Richard,
> 
> to identify the "bad" version was easy. I didn't find a 8.0.7 release
> on 
> the download page, so I started with 8.0.8. And this version already
> has 
> the slow dev mode. So for my problem I can say:
> good: 8.0.6
> bad: 8.0.8
> 
> Now, I think, I need a little help from you. I tried to build a TomEE
> out of git (I've cloned the github repository 
> https://github.com/apache/tomee.git). I've tried these two commits:
> 20441eb (tag: tomee-8.0.6)
> 4c8a616 (tag: tomee-project-8.0.8)
> 
> But the build fails every time on "TomEE :: Container :: Core" with:
> 
> [INFO] BUILD FAILURE
> [INFO] 
> -
> ---
> [INFO] Total time:  01:19 min
> [INFO] Finished at: 2023-10-27T10:29:40+02:00
> [INFO] 
> -
> ---
> [ERROR] Failed to execute goal 
> org.apache.maven.plugins:maven-compiler-plugin:3.6.2:compile 
> (default-compile) on project openejb-core: Compilation failure: 
> Compilation failure:
> [ERROR] 
> /sandbox/tomee/container/openejb-
> core/src/main/java/org/apache/openejb/core/OrbFactory.java:[21,21] 
> package org.omg.CORBA does not exist
> [ERROR] 
> /sandbox/tomee/container/openejb-
> core/src/main/java/org/apache/openejb/core/OrbFactory.java:[24,12] 
> cannot find symbol
> [ERROR]   symbol:   class ORB
> [ERROR]   location: class org.apache.openejb.core.OrbFactory
> 
> I've tried to build with:
> mvn clean install
> 
> My build environment is a linux ubuntu 20.04.6 LTS VM with:
> git 2.25.1
> Maven 3.6.3
> java 14.0.2
> 
> Is it some easy thing to fix, or do I have to switch some versions of
> my 
> environment?
> 
> cu
> Jens
> 
> Am 26.10.2023 um 19:48 schrieb Richard Zowalla:
> > Hi,
> > 
> > without knowing code or having a reproducer, it might be not that
> > obvious to find a reason / answer for the "academic problem" ;-)
> > 
> > If you really want to boil it down, I recommend the following
> > approach:
> > 
> > (1) From your description it seems, that 8.0.6 is the last known
> > "good"
> > version.
> > 
> > (2) You've investigated versions starting from 8.0.12 onwards,
> > which
> > seems to be "bad".
> > 
> > Following the approach recommended by Jonathan:
> > 
> > - Can you check if it happens in 8.0.7 (8.0.8, ...) until we find
> > the
> > first "bad" released version?
> > 
> > - If we have that, you could start a "git bisect" session between
> > 8.0.6
> > and the first version, which is known to be bad (reducing the
> > amount of
> > needed bisect cycles dramatically), so we find a commit / reason
> > (if it
> > is in TomEE).
> > 
> > - It would involve some quick builds without executing tests (~10-
> > 15min
> > each) for each bisect step and testing on your side.
> > 
> > Don't know if your inner monk is willing to go that route, but I am
> > happy to help with the related Maven commands for quick building :)
> > 
> > Gruß
> > Richard
> > 
> > 
> > 
> > 
> > 
> > Am Donnerstag, dem 26.10.2023 um 18:00 +0200 schrieb Jens Zurawski:
> > > Hi Vicente,
> > > 
> > > thank you for the tip. This is a good workaround. When I switch
> > > to
> > > Production mode and insert this configuration, it reloads the
> > > view
> > > from
> > > the file if it has changed. This means, I can use a decent
> > > version of
> > > TomEE in my dev environment.
> > > 
> > > However, it doesn't completely solve my problem, as the error
> > > reporting
> > > isn't as verbose as in Dev mode as far as I can see. But I have
> > > to
> > > check, maybe it's enough for my development.
> > > 
> > > And, well the academic problem: "Why is it still broken in
> > > Dev
> > > mode?" still runs circles through my brain ;-) Because if it's a
> > > problem
> > > of my coding, it might be a good idea to change this, before it
> > > might
> > > get a problem on Productio

Re: Very slow JSF Development Mode on tomee 8.x newer than 8.0.6

[Richard Zowalla]

Hi,

without knowing code or having a reproducer, it might be not that
obvious to find a reason / answer for the "academic problem" ;-)

If you really want to boil it down, I recommend the following approach:

(1) From your description it seems, that 8.0.6 is the last known "good"
version.

(2) You've investigated versions starting from 8.0.12 onwards, which
seems to be "bad".

Following the approach recommended by Jonathan: 

- Can you check if it happens in 8.0.7 (8.0.8, ...) until we find the
first "bad" released version?

- If we have that, you could start a "git bisect" session between 8.0.6
and the first version, which is known to be bad (reducing the amount of
needed bisect cycles dramatically), so we find a commit / reason (if it
is in TomEE). 

- It would involve some quick builds without executing tests (~10-15min
each) for each bisect step and testing on your side. 

Don't know if your inner monk is willing to go that route, but I am
happy to help with the related Maven commands for quick building :)

Gruß
Richard





Am Donnerstag, dem 26.10.2023 um 18:00 +0200 schrieb Jens Zurawski:
> Hi Vicente,
> 
> thank you for the tip. This is a good workaround. When I switch to 
> Production mode and insert this configuration, it reloads the view
> from 
> the file if it has changed. This means, I can use a decent version of
> TomEE in my dev environment.
> 
> However, it doesn't completely solve my problem, as the error
> reporting 
> isn't as verbose as in Dev mode as far as I can see. But I have to 
> check, maybe it's enough for my development.
> 
> And, well the academic problem: "Why is it still broken in Dev 
> mode?" still runs circles through my brain ;-) Because if it's a
> problem 
> of my coding, it might be a good idea to change this, before it might
> get a problem on Production mode, too, at some time in the future.
> 
> But anyway, you've helped me a good step forward, thanks.
> cu
> Jens
> 
> 
> Am 26.10.2023 um 17:04 schrieb Vicente Rossello:
> > We are using the production stage with
> > javax.faces.FACELETS_REFRESH_PERIOD
> > = 1. It's faster and more similar to production, just try it if it
> > solves
> > your problem
> > 
> > On Thu, Oct 26, 2023 at 4:18 PM Jens Zurawski 
> > wrote:
> > 
> > > The one bundled with TomEE.
> > > myfaces 2.3.7 on TomEE 8.0.6
> > > and  e.g. myfaces 2.3.9 on TomEE 8.0.12
> > > 
> > > Am 26.10.2023 um 16:08 schrieb Richard Zowalla:
> > > > Which JSF lib are you using?
> > > > 
> > > > Am 26. Oktober 2023 16:00:57 MESZ schrieb Jens Zurawski
> > > >  > > > :
> > > > > Thank you for your quick reply, Jonathan.
> > > > > 
> > > > > It is good to know, that normally the Dev mode should work as
> > > > > fast as
> > > before even with 8.0.15. So it obviously has something to do with
> > > my
> > > environment, configuration and/or code.
> > > > > And also thank you for the reference to tomitribe.
> > > > > Unfortunately I'm
> > > the only developer on this project, and it will be difficult to
> > > convince my
> > > customer to an additional support subscription, because he on
> > > production
> > > doesn't have issues ;-) But, ok, that's my problem, and maybe
> > > I'll consult
> > > tomitribe in the future for other projects.
> > > > > So, I'm afraid, for the near future I'm on my own to solve
> > > > > this
> > > problem. Therefore any hints to restrict the places where I
> > > should take a
> > > look will be more than welcome.
> > > > > I'm a senior programmer with 20 years of experience in Java
> > > > > programming
> > > (SE and JSP). But I'm relative new to JSF/JavaEE/JakartaEE and
> > > sometimes I
> > > have a hard time to understand which component of the whole stack
> > > is
> > > responsible for what.
> > > > > The project meanwhile has over a 1/4 million lines of code
> > > > > (most of
> > > them in the back-end, but also the front-end is big enough to not
> > > trace
> > > through every lane if I want to get to the point in this life :-D
> > > ).
> > > > > The application now runs for nearly 2 years on the customers
> > > > > site and
> > > is very reliable and fast in its daily usage. Apart from
> > > occasional updates
> > > every few month, it will never be restarted or need any manual
> > > maintenance
> > &

Re: Very slow JSF Development Mode on tomee 8.x newer than 8.0.6

[Richard Zowalla]

Which JSF lib are you using?

Am 26. Oktober 2023 16:00:57 MESZ schrieb Jens Zurawski :
>Thank you for your quick reply, Jonathan.
>
>It is good to know, that normally the Dev mode should work as fast as before 
>even with 8.0.15. So it obviously has something to do with my environment, 
>configuration and/or code.
>And also thank you for the reference to tomitribe. Unfortunately I'm the only 
>developer on this project, and it will be difficult to convince my customer to 
>an additional support subscription, because he on production doesn't have 
>issues ;-) But, ok, that's my problem, and maybe I'll consult tomitribe in the 
>future for other projects.
>So, I'm afraid, for the near future I'm on my own to solve this problem. 
>Therefore any hints to restrict the places where I should take a look will be 
>more than welcome.
>
>I'm a senior programmer with 20 years of experience in Java programming (SE 
>and JSP). But I'm relative new to JSF/JavaEE/JakartaEE and sometimes I have a 
>hard time to understand which component of the whole stack is responsible for 
>what.
>The project meanwhile has over a 1/4 million lines of code (most of them in 
>the back-end, but also the front-end is big enough to not trace through every 
>lane if I want to get to the point in this life :-D ).
>
>The application now runs for nearly 2 years on the customers site and is very 
>reliable and fast in its daily usage. Apart from occasional updates every few 
>month, it will never be restarted or need any manual maintenance at all. So I 
>assume the code is not the badest on earth. At least because of that I'm able 
>to out-rule things like memory leaks, gc issues or bottlenecks (max Heap is 
>never reached, neither half of it, even after running for month).
>
>Of course there could be aspects of JSF which I may not have understood 
>correctly until now. But because there are so many new things to a JSF 
>beginner like me, I'm running out of ideas what this could be. It is something 
>that worked well 'til TomEE 8.0.6 (Prod and Dev mode) and suddenly don't work 
>anymore on 8.0.12 in Dev mode (but still works great in Prod mode). There are 
>only minor versions in-between. So I think there were no revolutionary changes 
>anywhere. My hope was (and still is), that anybody here on the list might have 
>had a similar problem and has solved it, or maybe someone knows about some 
>changes in Dev mode which could explain such behaviour (don't know, maybe xml 
>parsing or component tree generation has changed, or scope handling of managed 
>beans, or whatever could cause some code to be entered far more often than 
>before, or some cache/pool was removed or has different behaviour... such 
>things). Then it would be far more easy for me to track down the real problem.
>
>Anyway, when I get some spare time (currently have some deadlines in sight), 
>I'll try to build a small test case. Either I can get a grip on the issue 
>myself on doing this, or I can supply it to anyone who might want to have a 
>look at it.
>
>cu
>Jens
>
>
>
>Am 26.10.2023 um 14:01 schrieb Jonathan S. Fisher:
>>> newer versions are so incredibly slow in dev mode
>> I can assure you that Dev/Prod mode works very very swiftly on 8.0.15
>> for sizable applications. For example, I have a giant application
>> (thousands of LOC, 50+ jsf views) that has sub-8ms response times
>> (minus database time). More than likely they are doing something they
>> should not be doing with JSF apis and are causing problems.
>> 
>> I would check the obvious things first with VisualVM: heap size, gc
>> frequency, etc. You can also run their profiler and see if you can
>> spot anything immediately obvious.
>> 
>> After that, the easiest way to locate the code slowing you down is
>> bisection. Cut half the code out, run, and continue cutting until you
>> can locate the problematic code. Then after that, isolate a test case
>> where flipping a boolean flag triggers the issue and post the results
>> here.
>> 
>> I would get ahold of: https://www.tomitribe.com who are literal
>> experts in this stuff. They offer professional services to handle
>> exactly these situations and can work directly in your codebase to
>> help you find and fix the problem.
>> 
>> On Thu, Oct 26, 2023 at 5:48 AM Jens Zurawski  wrote:
>>> Hi altogether,
>>> 
>>> I'm new to this list and hope it's the right place to ask this question.
>>> If not, and someone know the right place to ask this, please give advise.
>>> 
>>> I'm developing a big JSF Application for a customer. It's a long running
>>> project and development and when I started with it, TomEE 8.0.6 was the
>>> most recent Version of TomEE. The switch to Jakarta is planned for next
>>> year, so I'm still on the 8.x path for the time being and wasn't able to
>>> test if this problem still exists in the 9.x branch.
>>> 
>>> The problem:
>>> On the customers site I'm with the latest TomEE version 8.0.15 (running
>>> on Java 11) and everything works fine, because 

[ANN] Apache TomEE 9.1.1

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
9.1.1

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java/Jakarta Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and update
the dependencies TomEE 9 uses.

Full release notes:

- https://tomee.apache.org/9.1.1/release-notes.html
-
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12353331

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team

Re: JAX-WS Enpoint.publish not running on specified port

[Richard Zowalla]

Hi,

if possible put a small reproducer on GitHub, so people can have a
look.

Gruß
Richard

Am Dienstag, dem 26.09.2023 um 12:00 -0700 schrieb Boyan Mihaylov:
> Hello,
> 
> Migrating an existing application to TomEE, which uses JAX-WS
> javax.xml.ws.Endpoint. The following code does not open port 7001.
> 
> @WebServiceProvider
> 
> @ServiceMode(value=Service.Mode.*PAYLOAD*)
> 
> *public* *final* *class* WsProvider *implements* Provider {
>   ...
>   public void start() {
> 
>     String publishAddress = "http://0.0.0.0:7001/v1.0.1/soap;;
>     Endpoint endPoint = Endpoint.create(this);
>     endPoint.publish(publishAddress);
>     log.debug("published: " + endPoint.isPublished());
>   }
> 
> }
> 
> TomEE log:
> 
> 2023-09-24 05:06:05.526 INFO [main]
> org.apache.cxf.wsdl.service.factory.ReflectionServiceFactoryBean.buil
> dServiceFromClass
> Creating Service {http://ws.app.com/} WsProviderService from class
> com.app.ws.WsProvider2023-09-24 05:06:05.969 INFO [main]
> org.apache.cxf.endpoint.ServerImpl.initDestination Setting the
> server's publish address to be http://0.0.0.0:7001/v1.0.1/soap
> 2023-09-24 
> 05:06:05.994
> DEBUG: published: true
> 
> 7001 not in the list of open ports:
> 
> lsof -i -P -n | grep LISTEN | grep java
> 
> java  4859    root   21u  IPv4  34883  0t0  TCP
> *:9998 (LISTEN)
> java  4859    root   22u  IPv4  34884  0t0  TCP
> *: (LISTEN)
> java  4859    root   23u  IPv4  34885  0t0  TCP
> *:42883 (LISTEN)
> java  4859    root  219u  IPv4  34886  0t0  TCP
> *:8080 (LISTEN)
> java  4859    root  232u  IPv4  34905  0t0  TCP
> 127.0.0.1:61616 (LISTEN)
> java  4859    root  296u  IPv4  34942  0t0  TCP
> 127.0.0.1:8005 (LISTEN)
> 
> Environment:
> 
>    - TomEE 8.0.15
>    - Java 1.8.0_181
>    - Ubuntu 5.15.0-84-generic
> 
> There are no exceptions, the app deploys and runs fine on TomEE,
> except it
> does not listen on port 7001. The same app runs as expected on
> Weblogic and
> Tomcat. Is there a TomEE specific configuration that needs to be
> enabled to
> make this work?
> 
> 
> Thans, appreciate your help.
> 
> 
> Boyan

Re: Issue with NexusIQ and TomEE

[Richard Zowalla]

Hi.

Might be related to the patch plugin while building the distribution archives.

Adding the commons lib to the skip list in 
https://github.com/apache/tomee/blob/320f9a20c51a5a058e21d1f20205110d02bf6a94/tomee/apache-tomee/pom.xml#L566
  might resolve it (didn't test, just a blind guess). 

It might also be a thing for the patch plugin itself, ie. don't tamper with the 
jars, if they aren't patched. As usual: PRs welcome.

Gruß
Richard 




Am 27. September 2023 14:27:03 MESZ schrieb COURTAULT Francois 
:
>THALES GROUP LIMITED DISTRIBUTION to email recipients
>
>Hello everyone,
>
>Quite recently I run NexusIQ on TomEE Plus 8.0.15.
>The tool reports a vulnerability on commons-collections--3.2.1.
>Issue: in TomEE delivery there is no commons-collections--3.2.1 ☹
>
>So we opened a ticket to NexusIQ support.
>You have to know that the tools uses Maven Central for its processing.
>If I download the  commons-collections--3.2.2.jar from this repo and I run a 
>sha1 on it, I get 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
>Now, if I take the one inside TomEE and run a sha1 on it, I get 
>bd3c432b046a303c22a1915a4c6f9217b4688ea6
>
>Then I performed a binary comparison using BeyondCompare. Result: there the 
>same ☹
>Finally, we found the issue: the sha1 difference comes from the jar metadata.
>For example, the date of the files in the jar downloaded from maven central is 
>2015-11-13 whereas for the one from Tomee is  2023-05-08.
>
>It seems that TomEE somehow repackage the libraries it is using. The side 
>effect is that NexusIQ generates false positive.
>It’s really annoying !
>
>Do you have a solution for that ?
>
>Best Regards.
>
>
>

Re: Unable to use Resouce value with $

[Richard Zowalla]

You are right. I looked into the wrong properties in the debugger ;-)

The relevant code fragment is:

https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/util/ServiceInfos.java#L176

It seems, that we didn't implement an escape mechanismn, so it tries to
resolve a service for $ in any case resulting in the NULL value.


Am Dienstag, dem 12.09.2023 um 08:44 +0200 schrieb Thomas Butz:
> That didn't work.
> 
> - Ursprüngliche Mail -
> Von: "Richard Zowalla" 
> An: "users" 
> Gesendet: Freitag, 8. September 2023 20:34:38
> Betreff: Re: Unable to use Resouce value with $
> 
> Hi,
> 
> $ is used as an identifier, i.e. for injecting properties.
> 
> You can use 
> 
>    
>     SkipPropertiesFallback = true
>     test = $abc
>     
> 
> The `SkipPropertiesFallback` will prevent the resolution of $-values.
> The related code is here: [1]
> 
> Hope it helps.
> Richard
> 
> [1]
> https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java#L3083
> 
> 
> Am Freitag, dem 08.09.2023 um 15:44 +0200 schrieb Thomas Butz:
> > I'm trying to implement a custom resources class by implementing
> > setProperties(Properties) as outlined in the documentation:
> > 
> > https://tomee.apache.org/application-resources.html
> > 
> > The resource is defined tomee.xml:
> > 
> > 
> > myproperty=$omething
> > 
> > 
> > But as soon as the value starts with a dollar sign, its value is
> > interpreted as null while passed into setProperties().
> > My current theory is that property substitution is interfering
> > here,
> > but I have no clue how to avoid it.
> > 
> > My failed attempts include:
> > 
> > myproperty=\$omething
> > myproperty=$$omething
> > myproperty=\u0024omething
> > myproperty=domething
> > myproperty=${xxx:-$omething}

Re: Unable to use Resouce value with $

[Richard Zowalla]

Hi,

$ is used as an identifier, i.e. for injecting properties.

You can use 

   
SkipPropertiesFallback = true
test = $abc


The `SkipPropertiesFallback` will prevent the resolution of $-values.
The related code is here: [1]

Hope it helps.
Richard

[1]
https://github.com/apache/tomee/blob/main/container/openejb-core/src/main/java/org/apache/openejb/assembler/classic/Assembler.java#L3083


Am Freitag, dem 08.09.2023 um 15:44 +0200 schrieb Thomas Butz:
> I'm trying to implement a custom resources class by implementing
> setProperties(Properties) as outlined in the documentation:
> 
> https://tomee.apache.org/application-resources.html
> 
> The resource is defined tomee.xml:
> 
> 
> myproperty=$omething
> 
> 
> But as soon as the value starts with a dollar sign, its value is
> interpreted as null while passed into setProperties().
> My current theory is that property substitution is interfering here,
> but I have no clue how to avoid it.
> 
> My failed attempts include:
> 
> myproperty=\$omething
> myproperty=$$omething
> myproperty=\u0024omething
> myproperty=domething
> myproperty=${xxx:-$omething}

Re: PropertyException thrown during SOAP communication

[Richard Zowalla]

Hi,

see
https://github.com/apache/cxf/blob/main/core/src/main/java/org/apache/cxf/common/jaxb/JAXBUtils.java#L1105


vs

https://github.com/apache/cxf/blob/cxf-3.5.5/core/src/main/java/org/apache/cxf/common/jaxb/JAXBUtils.java#L1104

I think, it should disappear after upgrading to cxf 4 ;) (wip atm,
waiting for the cxf guys to fix one tck regression).

Gruß
Richard



Am Mittwoch, dem 30.08.2023 um 13:10 +0200 schrieb tomee-u...@web.de:
> Hi,
> 
> by upgrading to TomEE 9.1.0 we have a lot of message exception stack
> about a missing property: jakarta.xml.bind.PropertyException: name:
> com.sun.xml.bind.characterEscapeHandler value: null. [1]
> 
> By using the debugger I come to following conlusion:
> 
> In the lib org.apache.cxf.common.jaxb (org.apache.tomee:cxf-
> shade:9.1.0) the method
> org.apache.cxf.common.jaxb.DataWriterImpl.createMarshaller will be
> invoked which creates a marshaller from the context which is on my
> machine: jar:file:/opt/tomee/lib/jaxb-runtime-
> 3.0.2.jar!/org/glassfish/jaxb/runtime/v2/runtime/JAXBContextImpl.clas
> s.
> 
> Then the JAXBUtils.setEscapeHandler will be invoked
> databinding.applyEscapeHandler(!noEscape, eh ->
> JAXBUtils.setEscapeHandler(marshaller, eh)); which is in the same
> jar.
> 
> The invoked methodd adds a com.sun.xml package namespace... (which I
> assume is wrong). [2]
> 
> After this in the lib org.glassfish.jaxb:jaxb-runtime:3.0.2 the
> method
> org.glassfish.jaxb.runtime.v2.runtime.MarshallerImpl.setProperty will
> be invoked.
> The constant name is protected static final String ENCODING_HANDLER =
> "org.glassfish.jaxb.characterEscapeHandler";.
> My assumption is that here a match should happen. [3]
> 
> At the end it runs into the method
> jakarta.xml.bind.helpers.AbstractMarshallerImpl.setProperty of
> org.apache.tomee:jakartaee-api:9.1.1. The end of the process the
> PropertyException will be thrown (throw new PropertyException(name,
> value);)
> 
> Can you confirm that this is a bug?
> If the name would be correct a null value is not an correct value, so
> another exception will be thrown where I am not sure if I have any
> influence on it ( databinding.applyEscapeHandler(!noEscape, eh ->
> JAXBUtils.setEscapeHandler(marshaller, eh));).[2][3]
> 
> Thanks,
> Markus
> 
> 
> 
> [1]
> 20-Jul-2023 11:22:16.142 INFO [http-nio-8080-exec-1]
> org.apache.cxf.jaxb.io.DataReaderImpl.createUnmarshaller
> PropertyException setting Marshaller properties
>     jakarta.xml.bind.PropertyException: name:
> org.glassfish.jaxb.ObjectFactory value:
> jakarta.xml.bind.JAXBElementFactory@6bc54824
>     at
> jakarta.xml.bind.helpers.AbstractUnmarshallerImpl.setProperty(Abstrac
> tUnmarshallerImpl.java:327)
>     at
> org.glassfish.jaxb.runtime.v2.runtime.unmarshaller.UnmarshallerImpl.s
> etProperty(UnmarshallerImpl.java:474)
>     at
> org.apache.cxf.jaxb.io.DataReaderImpl.createUnmarshaller(DataReaderIm
> pl.java:123)
>     at
> org.apache.cxf.jaxb.io.DataReaderImpl.read(DataReaderImpl.java:166)
>     at
> org.apache.cxf.wsdl.interceptors.DocLiteralInInterceptor.handleMessag
> e(DocLiteralInInterceptor.java:109)
>     at
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseIntercept
> orChain.java:307)
>     at
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainIniti
> ationObserver.java:121)
>     at
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(Abstract
> HTTPDestination.java:265)
>     at
> org.apache.openejb.server.cxf.CxfWsContainer.onMessage(CxfWsContainer
> .java:85)
>     at
> org.apache.openejb.server.webservices.WsServlet.service(WsServlet.jav
> a:72)
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
> icationFilterChain.java:223)
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
> ilterChain.java:158)
>     at
> org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53
> )
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
> icationFilterChain.java:185)
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
> ilterChain.java:158)
>     at
> org.apache.openejb.server.httpd.EEFilter.doFilter(EEFilter.java:67)
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
> icationFilterChain.java:185)
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
> ilterChain.java:158)
>     at
> io.smallrye.metrics.jaxrs.JaxRsMetricsServletFilter.doFilter(JaxRsMet
> ricsServletFilter.java:53)
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
> icationFilterChain.java:185)
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
> ilterChain.java:158)
>     at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
> alve.java:197)
>     at
> 

Re: Question about data-sources defined directly in tomee.xml

[Richard Zowalla]

Hi,

had a quick look because I was thinking about some excludes, but you
need to simply remove the quotes (") from the jdbc driver declaration. 

Otherwise it is looking for "net.sourceforge.jtds.jdbc.Driver" instead
of just net.sourceforge.jtds.jdbc.Driver (and " is removed from the log
output, so difficult to see).

Gruß
Richard

Am Dienstag, dem 15.08.2023 um 14:18 +0200 schrieb Stefaan Somers:
> Hi Richard,
> 
> it's indeed in the lib-folder
> You can find my TomEE installation on the following link :
> https://github.com/somersst/TomEE
> Please tell me when copied, so I can remove it again...
> 
> Op di 15 aug 2023 om 11:45 schreef Richard Zowalla :
> 
> > Looks ok to me.
> > 
> > "net.sourceforge.jtds.jdbc.Driver" is available in TomEE's lib
> > folder?
> > 
> > If yes, we might need a small reproducer on GitHub to check.
> > 
> > Gruß
> > Richard
> > 
> > 
> > Am Dienstag, dem 15.08.2023 um 10:57 +0200 schrieb Stefaan Somers:
> > > > 
> > > > 
> > > > Hi,
> > > > 
> > > > 
> > > > 
> > > > 
> > > >   
> > > > 
> > > >   
> > > >   
> > > > 
> > > > 
> > > >   
> > > > 
> > > >  JdbcDriver = "net.sourceforge.jtds.jdbc.Driver"
> > > >     JdbcUrl = "jdbc:jtds:sqlserver://
> > > > 10.10.10.10/USERNAME_ACC_LPBE;instanceName=MSSQLSERVER"
> > > >     UserName = "USERNAME"
> > > >     Password = "PWD"
> > > >     JtaManaged = true
> > > >     MaxActive = "100"
> > > >     MinIdle = "10"
> > > >     MaxWaitTime = "5"
> > > >     ValidationQuery = "select 1"
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > >     JdbcDriver = "net.sourceforge.jtds.jdbc.Driver"
> > > >     JdbcUrl = "jdbc:jtds:sqlserver://
> > > > 10.10.10.10/USERNAME_ACC_LPBE;instanceName=MSSQLSERVER"
> > > >     UserName = "USERNAME"
> > > >     Password = "PWD"
> > > >     JtaManaged = true
> > > >     MaxActive = "100"
> > > >     MinIdle = "10"
> > > >     MaxWaitTime = "5"
> > > >     ValidationQuery = "select 1"
> > > > 
> > > >  -->
> > > > 
> > > > 
> > > >  > > > type="DataSource">
> > > >     JdbcDriver = "com.ibm.as400.access.AS400JDBCDriver"
> > > >     JdbcUrl = "jdbc:as400://ISERIES;transaction
> > > > isolation=none;decimal
> > > > separator=comma;date format=iso"
> > > >     UserName = "USERNAME"
> > > >     Password = "PASSWORD"
> > > >     JtaManaged = true
> > > >     MaxActive = "100"
> > > >     MinIdle = "10"
> > > >     MaxWaitTime = "5"
> > > >     ValidationQuery = "values 1"
> > > > 
> > > > 
> > > > 
> > > > 
> > > >  > > > type="DataSource">
> > > >     JdbcDriver = "com.ibm.as400.access.AS400JDBCDriver"
> > > >     JdbcUrl = "jdbc:as400://ISERIES;transaction
> > > > isolation=none;decimal
> > > > separator=comma;date format=iso"
> > > >     UserName = "USERNAME"
> > > >     Password = "PASSWORD"
> > > >     JtaManaged = true
> > > >     MaxActive = "100"
> > > >     MinIdle = "10"
> > > >     MaxWaitTime = "5"
> > > >     ValidationQuery = "values 1"
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > > > 
> > 
> > 



signature.asc
Description: This is a digitally signed message part

Re: Question about data-sources defined directly in tomee.xml

[Richard Zowalla]

Looks ok to me.

"net.sourceforge.jtds.jdbc.Driver" is available in TomEE's lib folder?

If yes, we might need a small reproducer on GitHub to check.

Gruß
Richard


Am Dienstag, dem 15.08.2023 um 10:57 +0200 schrieb Stefaan Somers:
> > 
> > 
> > Hi,
> > 
> > 
> > 
> > 
> >   
> > 
> >   
> >   
> > 
> > 
> >   
> > 
> >  JdbcDriver = "net.sourceforge.jtds.jdbc.Driver"
> >     JdbcUrl = "jdbc:jtds:sqlserver://
> > 10.10.10.10/USERNAME_ACC_LPBE;instanceName=MSSQLSERVER"
> >     UserName = "USERNAME"
> >     Password = "PWD"
> >     JtaManaged = true
> >     MaxActive = "100"
> >     MinIdle = "10"
> >     MaxWaitTime = "5"
> >     ValidationQuery = "select 1"
> > 
> > 
> > 
> > 
> > 
> >     JdbcDriver = "net.sourceforge.jtds.jdbc.Driver"
> >     JdbcUrl = "jdbc:jtds:sqlserver://
> > 10.10.10.10/USERNAME_ACC_LPBE;instanceName=MSSQLSERVER"
> >     UserName = "USERNAME"
> >     Password = "PWD"
> >     JtaManaged = true
> >     MaxActive = "100"
> >     MinIdle = "10"
> >     MaxWaitTime = "5"
> >     ValidationQuery = "select 1"
> > 
> >  -->
> > 
> > 
> > 
> >     JdbcDriver = "com.ibm.as400.access.AS400JDBCDriver"
> >     JdbcUrl = "jdbc:as400://ISERIES;transaction
> > isolation=none;decimal
> > separator=comma;date format=iso"
> >     UserName = "USERNAME"
> >     Password = "PASSWORD"
> >     JtaManaged = true
> >     MaxActive = "100"
> >     MinIdle = "10"
> >     MaxWaitTime = "5"
> >     ValidationQuery = "values 1"
> > 
> > 
> > 
> > 
> >  > type="DataSource">
> >     JdbcDriver = "com.ibm.as400.access.AS400JDBCDriver"
> >     JdbcUrl = "jdbc:as400://ISERIES;transaction
> > isolation=none;decimal
> > separator=comma;date format=iso"
> >     UserName = "USERNAME"
> >     Password = "PASSWORD"
> >     JtaManaged = true
> >     MaxActive = "100"
> >     MinIdle = "10"
> >     MaxWaitTime = "5"
> >     ValidationQuery = "values 1"
> > 
> > 
> > 
> > 
> > 
> > 
> > 



signature.asc
Description: This is a digitally signed message part

Re: Question about data-sources defined directly in tomee.xml

[Richard Zowalla]

How does your tomee.xml look like?

Am Dienstag, dem 15.08.2023 um 10:35 +0200 schrieb Stefaan Somers:
> I've defined a data-source in the tomee.xml, and put the jar-file in
> the
> lib folder of TomEE (see hereunder). Nevertheless I always get the
> following message when starting the server :
> 14-Aug-2023 10:25:04.452 SEVERE [main]
> org.apache.tomee.catalina.ServerListener.lifecycleEvent TomEE
> Listener
> can't start OpenEJB
>     org.apache.openejb.OpenEJBException:
> org.apache.xbean.propertyeditor.PropertyEditorException: Unable to
> resolve
> class "net.sourceforge.jtds.jdbc.Driver": Unable to resolve class
> "net.sourceforge.jtds.jdbc.Driver"
> 
> Any idea what I am doing wrong?
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> *  
>  >    
> JdbcDriver
> = "net.sourceforge.jtds.jdbc.Driver"    JdbcUrl =
> "jdbc:jtds:sqlserver://x.x.x./X;instanceName=MSSQLSERVER"   
> UserName =
> ""    Password = "X"    JtaManaged = true    MaxActive =
> "100"
> MinIdle = "10"    MaxWaitTime = "5"    ValidationQuery = "select
> 1"*



signature.asc
Description: This is a digitally signed message part

Re: Re: Re: No XML deserialization with TomEE 9.1.0 and JAAS

[Richard Zowalla]

Hi Markus,

thanks for the sample project. I followed the README and could
reproduce the stacktrace. I noticed, that the WAR file created via
Gradle contains a lot of libs of which many are already bundled within
TomEE:

-rw-rw-r-- 1 rz rz 310K Jul 19 13:59 FastInfoset-1.2.16.jar
-rw-rw-r-- 1 rz rz 27K Jul 19 13:59 istack-commons-runtime-3.0.8.jar
-rw-rw-r-- 1 rz rz 44K Jul 19 13:59 jakarta.activation-api-1.2.1.jar
-rw-rw-r-- 1 rz rz 113K Jul 19 13:59 jakarta.xml.bind-api-2.3.2.jar
-rw-rw-r-- 1 rz rz 36K Jul 19 13:59 jakarta.xml.soap-api-1.4.1.jar
-rw-rw-r-- 1 rz rz 56K Jul 19 13:58 javax.activation-api-1.2.0.jar
-rw-rw-r-- 1 rz rz 26K Jul 19 13:58 javax.annotation-api-1.3.2.jar
-rw-rw-r-- 1 rz rz 23K Jul 19 13:58 javax.jws-3.1.2.2.jar
-rw-rw-r-- 1 rz rz 46K Jul 19 13:58 javax.xml.soap-api-1.4.0.jar
-rw-rw-r-- 1 rz rz 126K Jul 19 13:58 jaxb-api-2.3.1.jar
-rw-rw-r-- 1 rz rz 990K Jul 19 13:59 jaxb-runtime-2.3.2.jar
-rw-rw-r-- 1 rz rz 56K Jul 19 13:58 jaxws-api-2.3.1.jar
-rw-rw-r-- 1 rz rz 66K Jul 19 13:59 mimepull-1.9.11.jar
-rw-rw-r-- 1 rz rz 447K Jul 19 13:59 saaj-impl-1.5.1.jar
-rw-rw-r-- 1 rz rz 38K Jul 19 13:59 stax-ex-1.8.1.jar
-rw-rw-r-- 1 rz rz 71K Jul 19 13:59 txw2-2.3.2.jar

Looking into FactoryFinder.find(...) and some debugging further, the
actual exception while trying to load the factory is:

java.util.ServiceConfigurationError: jakarta.xml.soap.SAAJMetaFactory:
com.sun.xml.messaging.saaj.soap.SAAJMetaFactoryImpl not a subtype

This is because you have a javax dependency in your webapp: saaj-impl-
1.5.1.jar (+ classloader looks up here first) uses the old namespace.

As I am not really familiar with Gradle, I migrated the project to
Maven and debugged it with the TomEE Maven Plugin. The resulting WAR
file does not contain any libs as everything is provided by TomEE.
(Don't really know why Gradle puts the whole bunch of stuff into the
WAR file ...)

Deploying that "stripped" war file, sending a related SOAP request as
mentioned in the README:

http://schemas.xmlsoap.org/soap/envelope/;
xmlns:wss="http://example.com/wssession/;>
   
   
  
 
 ?
 
 ?
  
   


I get the following response:

http://schemas.xmlsoap.org/soap/envelope/;>
 
 http://example.com/wssession/;>
 http://www.w3.org/2001/XMLSchema-instance;
xsi:nil="true"/>
 http://www.w3.org/2001/XMLSchema-instance;
xsi:nil="true"/>
 
 


Gruß
Richard



Am Mittwoch, dem 19.07.2023 um 12:56 +0200 schrieb tomee-u...@web.de:
> > Sorry, opened the repository.
> > 
> > 
> > > > Gesendet: Mittwoch, 19. Juli 2023 um 12:14 Uhr
> > > > Von: "Richard Zowalla" 
> > > > An: users@tomee.apache.org
> > > > Betreff: Re: Re: No XML deserialization with TomEE 9.1.0 and
> > > > JAAS
> > > > 
> > > > Hi Markus,
> > > > 
> > > > the link results in a 404 -> private repo?
> > > > 
> > > > Gruß
> > > > Richard
> > > > 
> > > > Am Mittwoch, dem 19.07.2023 um 11:10 +0200 schrieb > >
> > > > tomee-u...@web.de:
> > > > > > Hi Richard,
> > > > > > 
> > > > > > to my surprise I was able to reproduce the issue with a
> > > > > > small
> > > > > > example.
> > > > > > https://github.com/abstract-thinking/JaasSoapTomEEIssue/tree/master
> > > > > > 
> > > > > > I really hope that it is not mistake by myself. ;-)
> > > > > > 
> > > > > > By the way - Java 17 is used.
> > > > > > 
> > > > > > Cheers,
> > > > > > Markus
> > > > > > 
> > > > > > > > Gesendet: Dienstag, 18. Juli 2023 um 20:18 Uhr
> > > > > > > > Von: "Richard Zowalla" 
> > > > > > > > An: users@tomee.apache.org
> > > > > > > > Betreff: Re: No XML deserialization with TomEE 9.1.0
> > > > > > > > and JAAS
> > > > > > > > 
> > > > > > > > Hi,
> > > > > > > > 
> > > > > > > > maybe adding a small reproducer to GitHub would help in
> > > > > > > > > > > > identifying
> > > > > > > > any
> > > > > > > > issue?
> > > > > > > > 
> > > > > > > > Gruß
> > > > > > > > Richard
> > > > > > > > 
> > > > > > > > 
> > > > > > > > Am Dienstag, dem 18.07.2023 um 17:56 +0200 schrieb
> > > > > > &g

Re: Re: No XML deserialization with TomEE 9.1.0 and JAAS

[Richard Zowalla]

Hi Markus,

the link results in a 404 -> private repo?

Gruß
Richard

Am Mittwoch, dem 19.07.2023 um 11:10 +0200 schrieb tomee-u...@web.de:
> Hi Richard,
> 
> to my surprise I was able to reproduce the issue with a small
> example.
> https://github.com/abstract-thinking/JaasSoapTomEEIssue/tree/master
> 
> I really hope that it is not mistake by myself. ;-)
> 
> By the way - Java 17 is used.
> 
> Cheers,
> Markus
> 
> > Gesendet: Dienstag, 18. Juli 2023 um 20:18 Uhr
> > Von: "Richard Zowalla" 
> > An: users@tomee.apache.org
> > Betreff: Re: No XML deserialization with TomEE 9.1.0 and JAAS
> > 
> > Hi,
> > 
> > maybe adding a small reproducer to GitHub would help in identifying
> > any
> > issue?
> > 
> > Gruß
> > Richard
> > 
> > 
> > Am Dienstag, dem 18.07.2023 um 17:56 +0200 schrieb
> > tomee-u...@web.de:
> > > Hi,
> > > 
> > > I ported our war file from TomEE 8.0.15 to TomEE 9.1.0.
> > > 
> > > The deployment works fine with some new infos[1] where I think
> > > they
> > > are not a serious issue.
> > > 
> > > The application uses a SOAP interface and the WSDL will be
> > > retrieved.
> > > 
> > > The server is using JAAS [2][3][4]. I think at the moment I
> > > configured the TomEE system correctly.
> > > 
> > > Now I'm observing that the SOAP messages are not deserialized and
> > > an
> > > exception will be thrown.
> > > 
> > > 18-Jul-2023 17:19:49.419 WARNING [http-nio-8080-exec-1]
> > > org.apache.cxf.phase.PhaseInterceptorChain.doDefaultLogging
> > > Interceptor for {http://company.com/wssession/}WSSession has
> > > thrown
> > > exc
> > > eption, unwinding now
> > >     org.apache.cxf.binding.soap.SoapFault: Error reading
> > > XMLStreamReader.
> > >     at
> > > org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInInter
> > > cept
> > > or.handleMessage(SAAJInInterceptor.java:145)
> > >     at
> > > org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInInter
> > > cept
> > > or.handleMessage(SAAJInInterceptor.java:107)
> > >     at
> > > org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInter
> > > cept
> > > orChain.java:307)
> > >     [...]
> > >     Caused by: jakarta.xml.soap.SOAPException: Unable to
> > > create
> > > message factory for SOAP: Error while searching for service
> > > [jakarta.xml.soap.MessageFactory]
> > >     at
> > > jakarta.xml.soap.MessageFactory.newInstance(MessageFactory.java:9
> > > 0)
> > >     at
> > > org.apache.cxf.binding.soap.saaj.SAAJFactoryResolver.createMessag
> > > eFac
> > > tory(SAAJFactoryResolver.java:56)
> > >     at
> > > org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInInter
> > > cept
> > > or.getFactory(SAAJInInterceptor.java:151)
> > >     at
> > > org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInInter
> > > cept
> > > or.handleMessage(SAAJInInterceptor.java:133)
> > >     ... 36 more
> > > 
> > > 
> > > In the resources.xml the WSS4J is configured where the
> > > onterceptor is
> > > invoked [5] ...
> > > 
> > > Does anybody have an idea how TomEE is not finding a
> > > SoapMessageFactory? What can I do? My assumption was that a lib
> > > is
> > > inside the library folder? [6]
> > > 
> > > Thanks,
> > > Markus
> > > 
> > > 
> > > 
> > > [1]
> > > 18-Jul-2023 17:17:48.929 INFO [main]
> > > org.apache.cxf.jaxb.JAXBContextInitializer.addClass Class
> > > jakarta.xml.bind.JAXBElement does not have a default constructor
> > > which JAXB requires.
> > > 18-Jul-2023 17:17:48.983 INFO [main]
> > > org.apache.cxf.common.jaxb.JAXBUtils.createEscapeHandler Failed
> > > to
> > > create MinimumEscapeHandler
> > > 
> > > [2]
> > > less conf/login.config
> > > jaasContext  {
> > >    
> > > org.apache.openejb.core.security.jaas.ServiceProviderLoginModule
> > > required;
> > > };
> > > 
> > > [3]
> > > less conf/server.xml
> > >     
> > > 
> > >   
> > >   
> > &g

Re: No XML deserialization with TomEE 9.1.0 and JAAS

[Richard Zowalla]

Hi,

maybe adding a small reproducer to GitHub would help in identifying any
issue?

Gruß
Richard


Am Dienstag, dem 18.07.2023 um 17:56 +0200 schrieb tomee-u...@web.de:
> Hi,
> 
> I ported our war file from TomEE 8.0.15 to TomEE 9.1.0.
> 
> The deployment works fine with some new infos[1] where I think they
> are not a serious issue.
> 
> The application uses a SOAP interface and the WSDL will be retrieved.
> 
> The server is using JAAS [2][3][4]. I think at the moment I
> configured the TomEE system correctly.
> 
> Now I'm observing that the SOAP messages are not deserialized and an
> exception will be thrown.
> 
> 18-Jul-2023 17:19:49.419 WARNING [http-nio-8080-exec-1]
> org.apache.cxf.phase.PhaseInterceptorChain.doDefaultLogging
> Interceptor for {http://company.com/wssession/}WSSession has thrown
> exc
> eption, unwinding now
>     org.apache.cxf.binding.soap.SoapFault: Error reading
> XMLStreamReader.
>     at
> org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInIntercept
> or.handleMessage(SAAJInInterceptor.java:145)
>     at
> org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInIntercept
> or.handleMessage(SAAJInInterceptor.java:107)
>     at
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseIntercept
> orChain.java:307)
>     [...]
>     Caused by: jakarta.xml.soap.SOAPException: Unable to create
> message factory for SOAP: Error while searching for service
> [jakarta.xml.soap.MessageFactory]
>     at
> jakarta.xml.soap.MessageFactory.newInstance(MessageFactory.java:90)
>     at
> org.apache.cxf.binding.soap.saaj.SAAJFactoryResolver.createMessageFac
> tory(SAAJFactoryResolver.java:56)
>     at
> org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInIntercept
> or.getFactory(SAAJInInterceptor.java:151)
>     at
> org.apache.cxf.binding.soap.saaj.SAAJInInterceptor$SAAJPreInIntercept
> or.handleMessage(SAAJInInterceptor.java:133)
>     ... 36 more
> 
> 
> In the resources.xml the WSS4J is configured where the onterceptor is
> invoked [5] ...
> 
> Does anybody have an idea how TomEE is not finding a
> SoapMessageFactory? What can I do? My assumption was that a lib is
> inside the library folder? [6]
> 
> Thanks,
> Markus
> 
> 
> 
> [1]
> 18-Jul-2023 17:17:48.929 INFO [main]
> org.apache.cxf.jaxb.JAXBContextInitializer.addClass Class
> jakarta.xml.bind.JAXBElement does not have a default constructor
> which JAXB requires.
> 18-Jul-2023 17:17:48.983 INFO [main]
> org.apache.cxf.common.jaxb.JAXBUtils.createEscapeHandler Failed to
> create MinimumEscapeHandler
> 
> [2]
> less conf/login.config
> jaasContext  {
>     org.apache.openejb.core.security.jaas.ServiceProviderLoginModule
> required;
> };
> 
> [3]
> less conf/server.xml
>     
> 
>   
>   
> 
>   
>    appName="jaasContext"
>    
> userClassNames="org.apache.openejb.core.security.jaas.UserPrincipal"
>    
> roleClassNames="org.apache.openejb.core.security.jaas.GroupPrincipal"
> >
>   
> 
> [4]
> less bin/setenv.sh
> export CATALINA_OPTS="$CATALINA_OPTS -
> Djava.security.auth.login.config=/opt/tomee/current/conf/login.config
> "
> 
> [5]
> 
>     
>      name="org.apache.openejb.server.cxf.config.WSS4JInInterceptorFactory"
> factory-name="create">
>     action = UsernameToken
>     passwordCallbackClass = com.company.PasswordHandler
>     
> 
> 
> [6]
> /opt/tomee/apache-tomee-plus-9.1.0/lib$ find -name "*cxf*"
> ./cxf-rt-rs-mp-client-shade-9.1.0.jar
> ./openejb-cxf-transport-9.1.0.jar
> ./openejb-cxf-rs-9.1.0.jar
> ./cxf-shade-9.1.0.jar
> ./openejb-cxf-9.1.0.jar
> /opt/tomee/apache-tomee-plus-9.1.0/lib$ find -name "*soap*"
> ./opensaml-soap-api-4.2.0.jar
> /opt/tomee/apache-tomee-plus-9.1.0/lib$ find -name "*xml*"
> ./opensaml-xmlsec-impl-4.2.0.jar
> ./opensaml-xmlsec-api-4.2.0.jar
> ./xmlsec-3.0.1.jar
> ./xmlschema-core-2.2.5.jar
> 
> 
> 
> 
> 
> 

Re: Upgrading from TomeEE 8 to TomEE 9 -> java.lang.NoClassDefFoundError: jakarta/management/Notification

[Richard Zowalla]

Hi,

I think, that it is a shading error on deltaspike side.
Notification should still be in javax namespace: [1]

I refined the relocation patterns (see [2]) via a PR after 1.9.6 but
there is no 1.9.7 or 2.0.0 yet. Best to ask on the deltaspike list, I
guess.

Gruß
Richard


[1]
https://docs.oracle.com/en/java/javase/17/docs/api/java.management/javax/management/Notification.html

[2] https://issues.apache.org/jira/browse/DELTASPIKE-1434

Am Mittwoch, dem 12.07.2023 um 17:14 +0200 schrieb tomee-u...@web.de:
> Hi guys,
> 
> I'm updating our project from TomEE 8 to TomEE 9.
> 
> It compiles but our test framework is unhappy during runtime.
> 
> There is some magic which I don't understand in detail.
> 
> First we tell the EJBContainer to use deltaspike:
> 
>    System.setProperty("openejb.deployments.classpath.include",
> ".*deltaspike.*");
> 
> The the EJBContainer will be created.
> 
>    ejbContainer =
> jakarta.ejb.embeddable.EJBContainer.createEJBContainer();
> 
> When checking the module deltaspike-core-impl-1.9.6 which is in the
> classpath an excpetion will be thrown.
> 
> jakarta.ejb.EJBException: No EJBContainer provider available
> Provider named org.apache.openejb.OpenEjbContainer$Provider threw
> unexpected exception at create EJBContainer:
> java.lang.NoClassDefFoundError
> java.lang.NoClassDefFoundError: jakarta/management/Notification
> at java.base/java.lang.Class.getDeclaredMethods0(Native
> Method)
> at
> java.base/java.lang.Class.privateGetDeclaredMethods(Class.java:3402)
> at
> java.base/java.lang.Class.getDeclaredMethods(Class.java:2504)
> at
> org.apache.xbean.finder.AnnotationFinder.readClassDef(AnnotationFinde
> r.java:1203)
> at
> org.apache.xbean.finder.AnnotationFinder.linkInterfaces(AnnotationFin
> der.java:440)
> at
> org.apache.xbean.finder.AnnotationFinder.enableFindImplementations(An
> notationFinder.java:254)
> [...]
> 
> Caused by: java.lang.ClassNotFoundException:
> jakarta.management.Notification
> at
> org.apache.openejb.core.TempClassLoader.loadClass(TempClassLoader.jav
> a:186)
> at
> org.apache.openejb.core.TempClassLoader.loadClass(TempClassLoader.jav
> a:83)
> ... 93 more
> 
> 
> The following providers:
> org.apache.tomee.embedded.EmbeddedTomEEContainer$EmbeddedTomEEContain
> erProvider
> Returned null from createEJBContainer call.
> 
> My understanding is this class jakarta.management.Notification is not
> existing. It should be still javax.management.Notification.
> 
> def deltaSpikeVersion = '1.9.6'
> 
>     testImplementation 'org.apache.tomee:tomee-embedded:9.1.0'
> 
>     testImplementation 'org.apache.deltaspike.cdictrl:deltaspike-
> cdictrl-api:' + deltaSpikeVersion
> //    testImplementation 'org.apache.deltaspike.cdictrl:deltaspike-
> cdictrl-owb:' + deltaSpikeVersion
>     testImplementation 'org.apache.deltaspike.cdictrl:deltaspike-
> cdictrl-owb:' + deltaSpikeVersion + ':jakarta'
>     testImplementation 'org.apache.deltaspike.core:deltaspike-core-
> api:' + deltaSpikeVersion
>     testImplementation 'org.apache.deltaspike.core:deltaspike-core-
> impl:' + deltaSpikeVersion
> //    testImplementation 'org.apache.deltaspike.modules:deltaspike-
> servlet-module-api:' + deltaSpikeVersion
>     testImplementation 'org.apache.deltaspike.modules:deltaspike-
> servlet-module-api:' + deltaSpikeVersion + ':jakarta'
> //    testImplementation 'org.apache.deltaspike.modules:deltaspike-
> servlet-module-impl:' + deltaSpikeVersion
>     testImplementation 'org.apache.deltaspike.modules:deltaspike-
> servlet-module-impl:' + deltaSpikeVersion + ':jakarta'
>     testImplementation 'org.apache.deltaspike.test:test-utils:' +
> deltaSpikeVersion
> 
> Does anybody have an idea what I can do?
> 
> Thanks,
> Markus
> 
> 

Re: TomEE Java version supported

[Richard Zowalla]

Hi,

Compiler target is Java 8 for TomEE 8.x [1].

Did not test with 18, 19 or 20 (depends on asm to recognize newer class 
versions and if TomEE uses deprecated features which are removed in those 
versions). If someone would like to test ;)

Runs fine with Java 17 for me. 

Gruß
Richard


[1] https://github.com/apache/tomee/blob/tomee-8.x/pom.xml#L446

Am 5. Juli 2023 18:52:04 MESZ schrieb COURTAULT Francois 
:
>Hello,
>
>Looking at https://tomee.apache.org/tomee-8.0/docs/installing-tomee.html
>It seems that TomEE 8.0.x might run on java 6 and 7: someone could confirm ?
>
>But at https://tomee.apache.org/
>It is written "Runs on Java 8 or higher."
>Does it mean that TomEE running on Java 8 and superior, up to 20, is also 
>supported ?
>
>Best Regards.
>
>
>

[ANN] Apache TomEE 9.1.0

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
9.1.0

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java/ Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and update
the dependencies TomEE uses.

Full release notes:

- https://tomee.apache.org/9.1.0/release-notes.html
-
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12353156

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team



signature.asc
Description: This is a digitally signed message part

Re: How to Configure JDBC Web-INF resource with TomEE 9

[Richard Zowalla]

Hi,

can you push a small code example to GitHub?
would make it much easier to point you into the right direction.

Gruß
Richard

Am Dienstag, dem 30.05.2023 um 13:28 +0200 schrieb tomee-u...@web.de:
> Hello,
> 
> I'm looking for an example hot two configure JDBC with Tomee 9.0.
> 
> First I read this article and the example works as expected.
> https://www.tomitribe.com/blog/configuring-jdbc-in-tomee/
> 
> Then I tried to use TomEE 9.0 and MSSQL. [1]
> 
> On the first glance it looked successful because the string was given
> as output. By a closer look not a connection to MSSQL was set up,
> instead HSQL was used. [2][3]
> 
> Does anybody can point me to an example using WEB-
> INF/resources.xml[4] and ToMEE 9?
> 
> Thanks,
> Markus
> 
> [1]
> 
>     
>     17
>     17
>     UTF-
> 8
>     
> 
>     
>     
>     org.apache.tomee.bom
>     tomee-plus
>     9.0.0
>     provided
>     
>     
> 
>     
>     jdbc-servlet
>     
>     
>     org.apache.maven.plugins
>     maven-war-plugin
>     3.3.2
>     
>     
>     org.apache.tomee.maven
>     tomee-maven-plugin
>     9.0.0
>     
>     
>     com.microsoft.sqlserver:mssql-
> jdbc:9.2.0.jre8
>     
>     plus
>     -Xmx512m
>    
> false
>     
>     
>     
>     
> 
> [2]
> 
>     try(final Connection connection =
> dataSource.getConnection()){
>     writer.println("Metadata at: " +
> connection.getMetaData().getUserName());
>     writer.println("Metadata at: " +
> connection.getMetaData().getDriverName());
>     writer.println("Metadata at: " +
> connection.getMetaData().getDriverVersion());
> 
>     boolean valid = connection.isValid(1000);
> 
> [3]
> 
> curl http://localhost:8080/jdbc-servlet/
> Metadata at: SA
> Metadata at: HSQL Database Engine Driver
> Metadata at: 2.7.1
> 
>  JDBC Connection is valid @ timestamp = 1685439527124
> 
> [4]
> 
> 
>     JdbcDriver com.microsoft.sqlserver.jdbc.SQLServerDriver
>     JdbcUrl
> jdbc:sqlserver://qa.company.local:1433;databaseName=myDatabase
>     UserName username
>     Password password
>     JtaManaged true
>     InitialSize 10
>     MaxActive 128
>     MaxIdle 25
>     MinIdle 10
>     AccessToUnderlyingConnectionAllowed true
>     TestOnBorrow false
>     TestWhileIdle true
>     TimeBetweenEvictionRuns 1 minute
>     MaxWaitTime 0 seconds
>     PoolPreparedStatements true
>     MaxOpenPreparedStatements 1024
>     ValidationQuery select 1
> 
> 

Re: [ANN] Apache TomEE 8.0.15

[Richard Zowalla]

Should be available now.

Am Dienstag, dem 16.05.2023 um 12:50 -0400 schrieb Adam Cornett:
> How long does it normally take for the artifacts to appear in the
> Maven
> Central repo?
> 
> On Tue, May 16, 2023 at 8:14 AM Richard Zowalla 
> wrote:
> 
> > The Apache TomEE team is pleased to announce the availability of
> > TomEE
> > 8.0.15
> > 
> > Apache TomEE delivers enterprise application containers and
> > services
> > based on, but not limited to the Enterprise JavaBeans Specification
> > and
> > Java/ Enterprise Edition Specifications.
> > 
> > These releases primarily provide bug fixes, documentation and
> > update
> > the dependencies TomEE uses.
> > 
> > Full release notes:
> > 
> > - https://tomee.apache.org/8.0.15/release-notes.html
> > -
> > 
> > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12351820
> > 
> > Downloads are available at: https://tomee.apache.org/download.html
> > 
> > - The Apache TomEE team
> > 
> 
> 

[ANN] Apache TomEE 8.0.15

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
8.0.15

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java/ Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and update
the dependencies TomEE uses.

Full release notes:

- https://tomee.apache.org/8.0.15/release-notes.html
- 
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12351820

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team


signature.asc
Description: This is a digitally signed message part

Re: Approx. release date for TomEE 10.x

[Richard Zowalla]

Hi,

we had some discussion on various lists, that we most likely cannot eol
9.x before having a 10.x ready - otherwise ppl won't migrate ;)

The bad thing is, that Tomcat 10.0.x (targeting EE9), which is the
basis for TomEE 9, got eol'ed by the Tomcat team and won't receive any
security/bug fixes.

We still need to figure out, if upgrading TomEE 9 to use Tomcat 10.1.x
(targeting EE10) will have a significant impact on the EE9.1 tck
results. 

To determine a first impact level on the tck side, we need to run the
TCK signature tests on a TomEE 9.x build with a Tomcat 10.1.x under the
covers.

Any help with it is welcome.

Gruß
Richard




Am Mittwoch, dem 29.03.2023 um 12:42 + schrieb
manuel.gamerdin...@t-systems.com:
> Hello TomEE users,
> 
> is there already an approximate date when TomEE 10.x will be
> released?
> I have read this thread with interest and attention. We are in the
> process of migrating to 9.x and the question is now how long the
> support for 9.x is given.
> 
> https://lists.apache.org/thread/jz4y20q039cckcv436xvtgzr1ofmostj
> 
> 
> 
> BR,
> Manuel

Re: TomEE 8.0.x and next plans ?

[Richard Zowalla]

Hi,

there is a discussion on dev@:

https://lists.apache.org/thread/jz4y20q039cckcv436xvtgzr1ofmostj

Gruß
Richard

Am Freitag, dem 17.02.2023 um 12:30 +0530 schrieb somasani nikhil:
> Hello Everyone,
> 
> We are currently using TomEE for our internal application with *JDK
> 1.8.x*,
> and very recently upgraded to *TomEE plus 8.0.14.*
> 
> We generally patch our systems with the latest available software to
> majorly fix the security updates and other bugs within the TomEE
> container.
> Since there is *TomEE 9.0.0 *available now & runs only with *JDK 11 &
> higher*.
> 
> We would be very much interested to know the future plans and make
> decisions based on the support of TomEE 8.x series. It would be
> ideally
> better to update to the latest versions but we have the JDK
> constraint at
> this moment so we would like to understand the 8.x release plans
> going
> forward so that we can take corresponding actions from our end within
> our
> applications.
> 
> I couldn't find much information at this point of time regarding the
> above
> in apache forums, Appreciate if anyone could share the link of the
> already
> published content (if any).
> 
> Thank you in advance.
> 
> Regards,
> Nikhil Somasani

Re: CVE-2016-3088

[Richard Zowalla]

TomEE relies on activemq 5.16.5.

According to [1], the fileserver was removed with 5.14.0.

Gruß
Richard

[1]
https://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt

Am Freitag, dem 27.01.2023 um 18:05 + schrieb COURTAULT Francois:
> Hello everyone,
> 
> We scan the vulnerabilities in TomEE Plus 8.0.14 and we have
> discovered the following CVE: CVE-2016-3088 which prevent us to use
> this version :(
> It seems it is due to activemq-protobuf-1.1.jar.
> 
> The question: Is the ActiveMQ Fileserver web application deployed in
> TomEE 8.0.14 and TomEE 9.0.0 ?
> If not the CVE-2016-3088 doesn't affect TomEE 8.0.14 and 9.0.0, right
> ?
> 
> Best Regards.
> 
> 
> 

[ANN] Apache TomEE 8.0.14

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
8.0.14

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and update
the dependencies TomEE uses.

Full release notes:

- https://tomee.apache.org/8.0.14/release-notes.html
- https://issues.apache.org/jira/projects/TOMEE/versions/12352390

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team


signature.asc
Description: This is a digitally signed message part

Re: Fwd: TomEE Webprofile Support

[Richard Zowalla]

Hi Richard,

you can have a look at https://tomee.apache.org/community/commercial.html

Gruß
Richard 

Am 25. November 2022 17:11:39 MEZ schrieb Richard OConnell 
:
>
>
>Get Outlook for Android
>
>From: Richard OConnell
>Sent: Friday, November 25, 2022 9:45:15 AM
>To: users-subscr...@tomee.apache.org 
>Subject: TomEE Webprofile Support
>
>Hi There,
>
>Could you advise on recommended support providers who could offer 24/7 support 
>on TomEE Webprofile v1.7.5?
>Understand that this version is end of life, however, need to retain for 
>project purposes.
>
>Thanks
>Richard

Re: Behaviour change between TomEE 8.0.12 and TomEE 8.0.13

[Richard Zowalla]

Can you provide a sample application?

Am Donnerstag, dem 24.11.2022 um 17:51 + schrieb COURTAULT
Francois:
> Hello,
> 
> I have a REST WS endpoint with the annotation @Path( v1/xxx/{ZZZ}" )
> Using TomEE 8.0.11, if I target v1/xxx, I get a 404 but with TomEE
> 8.0.13, I get a 500.
> 
> Are you aware of this issue ? Is it a bug according to you ?
> 
> Best Regards.
> 
> 
> 
> 
> 


signature.asc
Description: This is a digitally signed message part

Re: Tomee 8.0.13 and Java Mail

[Richard Zowalla]

Hi,

the default mail / smtp provider in TomEE 8.0.13 is from the Geronimo
project. As written, afaik it does not support smtp proxy
authentication.

Exchanging the mail provider in TomEE 8.0.13 is - however - fairly
simple. You can just replace the provider with the implementation,
which fits your need.

Gruß
Richard

Am Dienstag, dem 22.11.2022 um 21:37 + schrieb COURTAULT Francois:
> Hello Richard,
> 
> Thanks for your support.
> Looking at Sun SMTP provider doc: 
> https://javaee.github.io/javamail/docs/api/ 
> You will see the properties we may use.
> 
> Among them: 
> mail.smtp.proxy.host
> mail.smtp.proxy.port
> mail.smtp.proxy.user
> mail.smtp.proxy.password
> 
> What is the SMTP provider in TomEE 8.0.13 ? Is it geronimo-
> javamail_1.6_mail-1.0.1.jar ?
> The question is: does Geronimo_1.6_mail-1.0.1 support the above
> properties as the SMTP Sun provider do ?
> 
> Best Regards.
> 
> -Original Message-
> From: Richard Zowalla  
> Sent: mardi 22 novembre 2022 20:16
> To: users@tomee.apache.org
> Subject: Re: Tomee 8.0.13 and Java Mail
> 
> Hi,
> 
> TomEE relies on Geronimo mail. I  did a quick search in the source
> code, but couldn't find anything related to mail.smtp.proxy.*
> properties. Judging from the source code, it does not support
> ProxyAuthentication.
> 
> The RI might support proxy authentication. You can just switch the
> mailing library used in TomEE and replace it with the RI.
> 
> Gruß
> Richard
> 
> Am Montag, dem 21.11.2022 um 15:38 + schrieb COURTAULT Francois:
> > Hello everyone,
> > 
> > Does TomEE 8.0.13 support proxy authentication properties for
> > Session 
> > object for sending emails ?
> > Through the following properties:
> > 
> > *mail.smtp.proxy.host
> > 
> > *mail.smtp.proxy.port
> > 
> > *mail.smtp.proxy.user
> > 
> > *mail.smtp.proxy.password
> > ?
> > 
> > Best Regards.
> > 
> > 
> > 

Re: Tomee 8.0.13 and Java Mail

[Richard Zowalla]

Hi,

TomEE relies on Geronimo mail. I  did a quick search in the source
code, but couldn't find anything related to mail.smtp.proxy.*
properties. Judging from the source code, it does not support
ProxyAuthentication.

The RI might support proxy authentication. You can just switch the
mailing library used in TomEE and replace it with the RI.

Gruß
Richard

Am Montag, dem 21.11.2022 um 15:38 + schrieb COURTAULT Francois:
> Hello everyone,
> 
> Does TomEE 8.0.13 support proxy authentication properties for Session
> object for sending emails ?
> Through the following properties:
> 
> *mail.smtp.proxy.host
> 
> *mail.smtp.proxy.port
> 
> *mail.smtp.proxy.user
> 
> *mail.smtp.proxy.password
> ?
> 
> Best Regards.
> 
> 
> 

[ANN] Apache TomEE 8.0.13

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
8.0.13

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and update
the dependencies TomEE uses.

Full release notes:

- https://tomee.apache.org/8.0.13/release-notes.html
- 
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12351820

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team

Re: TomEE 8.0.9 introduce ehcache-3.8.1.jar in lib folder

[Richard Zowalla]

Hi,

I created TOMEE-4021 [1] and backported the changes from master to 8.x
Should be fixed with the next release (8.0.13).

Gruß
Richard


[1] https://issues.apache.org/jira/browse/TOMEE-4021


Am Freitag, dem 29.07.2022 um 09:43 +0200 schrieb David Bonnafous:
> hi,
> 
> I'm glad to read you.
> I hope the backport will be done so PrimeFaces showcase works out of
> the
> box in TomEE 8.
> 
> Thank you.
> 
> On Fri, 29 Jul 2022 at 09:34, Richard Zowalla 
> wrote:
> > Hi all,
> > 
> > imho ehcache 3.8.1 shouldn't be in lib. You should be able to
> > simply
> > remove it from the lib folder of TomEE without any major problems
> > and
> > use the newer version coming with Primefaces in your app.
> > 
> > Nevertheless, JL is right: We did actually fix it (but only on
> > master).
> > We did not backport the exclusions for org.ehcache to 8.x (yet).
> > 
> > I will create a Jira and have a look.
> > 
> > Gruß
> > Richard

Re: TomEE 8.0.9 introduce ehcache-3.8.1.jar in lib folder

[Richard Zowalla]

Hi all,

imho ehcache 3.8.1 shouldn't be in lib. You should be able to simply
remove it from the lib folder of TomEE without any major problems and
use the newer version coming with Primefaces in your app.

Nevertheless, JL is right: We did actually fix it (but only on master).
We did not backport the exclusions for org.ehcache to 8.x (yet).

I will create a Jira and have a look.

Gruß
Richard



Am Freitag, dem 29.07.2022 um 06:44 + schrieb COURTAULT Francois:
> Hello,
> 
> Jean-Louis asked you to try with the latest TomEE version : 8.0.12.
> 
> Best Regards.
> 
> -Original Message-
> From: David Bonnafous  
> Sent: vendredi 29 juillet 2022 00:09
> To: users@tomee.apache.org
> Subject: Re: TomEE 8.0.9 introduce ehcache-3.8.1.jar in lib folder
> 
> hi,
> 
> 
> apache-tomee-plus-8.0.13-SNAPSHOT contains ehcache-3.8.1.jar in lib/
> folder.
> 
> 
> (downloaded from
> https://ci-builds.apache.org/job/Tomee/job/tomee-8.x-build-full/lastStableBuild/org.apache.tomee$apache-tomee/
> )
> 
> On Thu, 28 Jul 2022 at 23:46, Jean-Louis Monteiro <
> jlmonte...@tomitribe.com>
> wrote:
> 
> > Did you look at the next available release?
> > I remember the issue. I'm on the cell phone but I think it's been
> > fixed.
> > 
> > Le jeu. 28 juil. 2022, 22:16, David Bonnafous 
> > a 
> > écrit :
> > 
> > > hi,
> > > 
> > > I can't figure out why and how TomEE 8.0.9 introduced 
> > > ehcache-3.8.1.jar
> > in
> > > the lib folder.
> > > 
> > > It's produced a defect for me: a conflict of version.
> > > https://github.com/primefaces/primefaces/issues/9042#issue-132091098
> > > 0
> > > 
> > > Thank you.
> > > 
> > > --
> > > David Bonnafous
> > > 

[ANN] Apache TomEE 8.0.11

[Richard Zowalla]

The Apache TomEE team is pleased to announce the availability of TomEE
8.0.11

Apache TomEE delivers enterprise application containers and services
based on, but not limited to the Enterprise JavaBeans Specification and
Java Enterprise Edition Specifications.

These releases primarily provide bug fixes, documentation and update
the dependencies TomEE uses.

Full release notes:

- https://tomee.apache.org/8.0.11/release-notes.html
- 
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12312320=12351352

Downloads are available at: https://tomee.apache.org/download.html

- The Apache TomEE team