Activity log for bug #1664179

Date Who What changed Old value New value Message
2017-02-13 10:26:00 Yury Zavarin bug added bug
2017-02-13 10:26:00 Yury Zavarin attachment added pom.xml https://bugs.launchpad.net/bugs/1664179/+attachment/4818104/+files/pom.xml
2017-02-14 17:53:07 Joshua Powers bug added subscriber Joshua Powers
2017-02-14 17:53:09 Joshua Powers tomcat7 (Ubuntu): status New Incomplete
2017-02-14 17:53:11 Joshua Powers tomcat7 (Ubuntu): importance Undecided High
2017-02-15 23:30:03 Joshua Powers tomcat7 (Ubuntu): status Incomplete Confirmed
2017-02-15 23:30:13 Joshua Powers bug added subscriber Ubuntu Server Team
2017-02-15 23:30:16 Joshua Powers tomcat7 (Ubuntu): assignee Joshua Powers (powersj)
2017-03-09 22:20:19 Joshua Powers tomcat7 (Ubuntu): status Confirmed In Progress
2017-03-22 19:55:22 Joshua Powers nominated for series Ubuntu Xenial
2017-03-22 19:55:22 Joshua Powers nominated for series Ubuntu Yakkety
2017-03-22 19:55:22 Joshua Powers nominated for series Ubuntu Trusty
2017-03-22 20:18:56 Joshua Powers description Hi, Ubuntu 16.04.1 LTS, libservlet3.0-java=7.0.68-1ubuntu0.1 In /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom file that belongs to libservlet3.0-java there is the following dependency: <dependency> <groupId>javax.servlet</groupId> <artifactId>servlet-api</artifactId> <version>2.2</version> <scope>compile</scope> </dependency> But there is no corresponding javax.servlet:servlet-api:2.2 in /usr/share/maven-repo. So if I try to build some Java library that depends on javax.servlet.jsp:jsp-api:2.2 with mvn-debian, I cannot do it due to wrong transitive dependency. I've attached a test pom.xml to reproduce the bug: ubuntu@build:~$ ls -la pom.xml -rw-rw-r-- 1 ubuntu ubuntu 1185 Feb 13 10:12 pom.xml ubuntu@build:~$ ubuntu@build:~$ mvn-debian -q generate-sources find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compiler/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compilers/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-containers/*/*.jar’: No such file or directory [ERROR] Failed to execute goal on project yyy: Could not resolve dependencies for project xxx:yyy:pom:debian: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact javax.servlet:servlet-api:jar:2.2 has not been downloaded from it before. -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException ubuntu@build:~$ I believe that javax.servlet.jsp:jsp-api:2.2 should list javax.servlet:servlet-api:3.0 as dependency, not 2.2 == Begin SRU Template == [Impact] * The Tomcat7 package specifies an incorrect version of the javax.servlet api. If users attempt to use the version specified, 2.2, it will fail trying to find that version as it does not exist at all. * Currently the version is auto filled in by @MAVEN.DEPLOY.VERSION@, which is used to fill in other fields as well. However, the API versions are not all the same and should not be specified like this. * The official servlet version for Tomcat 7, 3.0, was specified here: https://jcp.org/en/jsr/detail?id=315 [Test Case] An example to test Tomcat7 on Trusty. The same instructions can apply to other releases. Overview: Install tomcat7 and attempt to build the pom. It will fail as the built in library specifies a non-existent version of 2.2. * lxc launch ubuntu-daily:trusty trusty * lxc exec trusty bash * apt install tomcat7 maven-debian-helper libmaven-dependency-plugin-java libservlet3.0-java * wget https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/1664179/+attachment/4818104/+files/pom.xml * mvn-deiban -q generate-sources -X [Regression Potential] * Users currently experiencing this issue would be expecting a SRU fix to come from us. Working around it would require changing the /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom to use the 3.0 version. This fix does the same thing. * There is the slight, albeit incredibly low chance, that someone actually has scripted something to modify the package itself and swap out @MAVEN.DEPLOY.VERSION@ to the correct value. * The tomcat8 package has gone away from using @MAVEN.DEPLOY.VERSION@ in favor of specifying the exact version as well to avoid this type of mismatch. [Other Info] Hi, Ubuntu 16.04.1 LTS, libservlet3.0-java=7.0.68-1ubuntu0.1 In /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom file that belongs to libservlet3.0-java there is the following dependency: <dependency>   <groupId>javax.servlet</groupId>   <artifactId>servlet-api</artifactId>   <version>2.2</version>   <scope>compile</scope> </dependency> But there is no corresponding javax.servlet:servlet-api:2.2 in /usr/share/maven-repo. So if I try to build some Java library that depends on javax.servlet.jsp:jsp-api:2.2 with mvn-debian, I cannot do it due to wrong transitive dependency. I've attached a test pom.xml to reproduce the bug: ubuntu@build:~$ ls -la pom.xml -rw-rw-r-- 1 ubuntu ubuntu 1185 Feb 13 10:12 pom.xml ubuntu@build:~$ ubuntu@build:~$ mvn-debian -q generate-sources find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compiler/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compilers/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-containers/*/*.jar’: No such file or directory [ERROR] Failed to execute goal on project yyy: Could not resolve dependencies for project xxx:yyy:pom:debian: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact javax.servlet:servlet-api:jar:2.2 has not been downloaded from it before. -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException ubuntu@build:~$ I believe that javax.servlet.jsp:jsp-api:2.2 should list javax.servlet:servlet-api:3.0 as dependency, not 2.2 == End SRU Template ==
2017-03-22 20:20:06 Joshua Powers tomcat7 (Ubuntu): status In Progress Fix Committed
2017-03-22 23:28:56 Nish Aravamudan bug task added tomcat7 (Ubuntu Trusty)
2017-03-22 23:29:02 Nish Aravamudan bug task added tomcat7 (Ubuntu Xenial)
2017-03-22 23:29:07 Nish Aravamudan bug task added tomcat7 (Ubuntu Yakkety)
2017-03-23 15:20:26 Joshua Powers tomcat7 (Ubuntu Trusty): status New In Progress
2017-03-23 15:20:28 Joshua Powers tomcat7 (Ubuntu Xenial): status New In Progress
2017-03-23 15:20:30 Joshua Powers tomcat7 (Ubuntu Yakkety): status New In Progress
2017-03-23 15:20:35 Joshua Powers tomcat7 (Ubuntu Trusty): assignee Joshua Powers (powersj)
2017-03-23 15:20:37 Joshua Powers tomcat7 (Ubuntu Xenial): assignee Joshua Powers (powersj)
2017-03-23 15:20:38 Joshua Powers tomcat7 (Ubuntu Yakkety): assignee Joshua Powers (powersj)
2017-03-23 15:20:40 Joshua Powers tomcat7 (Ubuntu Trusty): importance Undecided High
2017-03-23 15:20:42 Joshua Powers tomcat7 (Ubuntu Xenial): importance Undecided High
2017-03-23 15:20:44 Joshua Powers tomcat7 (Ubuntu Yakkety): importance Undecided High
2017-04-05 14:51:46 Joshua Powers tomcat7 (Ubuntu): status Fix Committed Invalid
2017-04-05 18:14:01 Brian Murray tomcat7 (Ubuntu Yakkety): status In Progress Fix Committed
2017-04-05 18:14:02 Brian Murray bug added subscriber Ubuntu Stable Release Updates Team
2017-04-05 18:14:05 Brian Murray bug added subscriber SRU Verification
2017-04-05 18:14:12 Brian Murray tags verification-needed
2017-04-05 18:15:54 Brian Murray tomcat7 (Ubuntu Xenial): status In Progress Fix Committed
2017-04-05 18:24:25 Brian Murray tomcat7 (Ubuntu Trusty): status In Progress Fix Committed
2017-04-19 15:15:46 Joshua Powers description == Begin SRU Template == [Impact] * The Tomcat7 package specifies an incorrect version of the javax.servlet api. If users attempt to use the version specified, 2.2, it will fail trying to find that version as it does not exist at all. * Currently the version is auto filled in by @MAVEN.DEPLOY.VERSION@, which is used to fill in other fields as well. However, the API versions are not all the same and should not be specified like this. * The official servlet version for Tomcat 7, 3.0, was specified here: https://jcp.org/en/jsr/detail?id=315 [Test Case] An example to test Tomcat7 on Trusty. The same instructions can apply to other releases. Overview: Install tomcat7 and attempt to build the pom. It will fail as the built in library specifies a non-existent version of 2.2. * lxc launch ubuntu-daily:trusty trusty * lxc exec trusty bash * apt install tomcat7 maven-debian-helper libmaven-dependency-plugin-java libservlet3.0-java * wget https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/1664179/+attachment/4818104/+files/pom.xml * mvn-deiban -q generate-sources -X [Regression Potential] * Users currently experiencing this issue would be expecting a SRU fix to come from us. Working around it would require changing the /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom to use the 3.0 version. This fix does the same thing. * There is the slight, albeit incredibly low chance, that someone actually has scripted something to modify the package itself and swap out @MAVEN.DEPLOY.VERSION@ to the correct value. * The tomcat8 package has gone away from using @MAVEN.DEPLOY.VERSION@ in favor of specifying the exact version as well to avoid this type of mismatch. [Other Info] Hi, Ubuntu 16.04.1 LTS, libservlet3.0-java=7.0.68-1ubuntu0.1 In /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom file that belongs to libservlet3.0-java there is the following dependency: <dependency>   <groupId>javax.servlet</groupId>   <artifactId>servlet-api</artifactId>   <version>2.2</version>   <scope>compile</scope> </dependency> But there is no corresponding javax.servlet:servlet-api:2.2 in /usr/share/maven-repo. So if I try to build some Java library that depends on javax.servlet.jsp:jsp-api:2.2 with mvn-debian, I cannot do it due to wrong transitive dependency. I've attached a test pom.xml to reproduce the bug: ubuntu@build:~$ ls -la pom.xml -rw-rw-r-- 1 ubuntu ubuntu 1185 Feb 13 10:12 pom.xml ubuntu@build:~$ ubuntu@build:~$ mvn-debian -q generate-sources find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compiler/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compilers/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-containers/*/*.jar’: No such file or directory [ERROR] Failed to execute goal on project yyy: Could not resolve dependencies for project xxx:yyy:pom:debian: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact javax.servlet:servlet-api:jar:2.2 has not been downloaded from it before. -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException ubuntu@build:~$ I believe that javax.servlet.jsp:jsp-api:2.2 should list javax.servlet:servlet-api:3.0 as dependency, not 2.2 == End SRU Template == == Begin SRU Template == [Impact]  * The Tomcat7 package specifies an incorrect version of the javax.servlet api. If users attempt to use the version specified, 2.2, it will fail trying to find that version as it does not exist at all.  * Currently the version is auto filled in by @MAVEN.DEPLOY.VERSION@, which is used to fill in other fields as well. However, the API versions are not all the same and should not be specified like this.  * The official servlet version for Tomcat 7, 3.0, was specified here: https://jcp.org/en/jsr/detail?id=315 [Test Case] An example to test Tomcat7 on Trusty. The same instructions can apply to other releases. Overview: Install tomcat7 and attempt to build the pom. It will fail as the built in library specifies a non-existent version of 2.2.  * lxc launch ubuntu-daily:trusty trusty  * lxc exec trusty bash  * apt install tomcat7 maven-debian-helper libmaven-dependency-plugin-java libservlet3.0-java  * wget https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/1664179/+attachment/4818104/+files/pom.xml  * mvn-debian -q generate-sources -X [Regression Potential]  * Users currently experiencing this issue would be expecting a SRU fix to come from us. Working around it would require changing the /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom to use the 3.0 version. This fix does the same thing.  * There is the slight, albeit incredibly low chance, that someone actually has scripted something to modify the package itself and swap out @MAVEN.DEPLOY.VERSION@ to the correct value.  * The tomcat8 package has gone away from using @MAVEN.DEPLOY.VERSION@ in favor of specifying the exact version as well to avoid this type of mismatch. [Other Info] Hi, Ubuntu 16.04.1 LTS, libservlet3.0-java=7.0.68-1ubuntu0.1 In /usr/share/maven-repo/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.pom file that belongs to libservlet3.0-java there is the following dependency: <dependency>   <groupId>javax.servlet</groupId>   <artifactId>servlet-api</artifactId>   <version>2.2</version>   <scope>compile</scope> </dependency> But there is no corresponding javax.servlet:servlet-api:2.2 in /usr/share/maven-repo. So if I try to build some Java library that depends on javax.servlet.jsp:jsp-api:2.2 with mvn-debian, I cannot do it due to wrong transitive dependency. I've attached a test pom.xml to reproduce the bug: ubuntu@build:~$ ls -la pom.xml -rw-rw-r-- 1 ubuntu ubuntu 1185 Feb 13 10:12 pom.xml ubuntu@build:~$ ubuntu@build:~$ mvn-debian -q generate-sources find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compiler/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-compilers/*/*.jar’: No such file or directory find: ‘/usr/share/maven-repo/org/codehaus/plexus/plexus-containers/*/*.jar’: No such file or directory [ERROR] Failed to execute goal on project yyy: Could not resolve dependencies for project xxx:yyy:pom:debian: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact javax.servlet:servlet-api:jar:2.2 has not been downloaded from it before. -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException ubuntu@build:~$ I believe that javax.servlet.jsp:jsp-api:2.2 should list javax.servlet:servlet-api:3.0 as dependency, not 2.2 == End SRU Template ==
2017-04-19 15:35:17 Joshua Powers tags verification-needed verification-done-trusty verification-needed
2017-04-24 22:11:47 Launchpad Janitor tomcat7 (Ubuntu Trusty): status Fix Committed Fix Released
2017-07-15 20:18:43 Mathew Hodson bug added subscriber Mathew Hodson
2017-08-17 16:11:38 Joshua Powers tomcat7 (Ubuntu Yakkety): status Fix Committed Won't Fix
2017-08-17 23:32:26 Mathew Hodson bug task deleted tomcat7 (Ubuntu)
2017-08-17 23:36:57 Mathew Hodson tomcat7 (Ubuntu Xenial): status Fix Committed In Progress
2017-08-17 23:37:18 Mathew Hodson tags verification-done-trusty verification-needed verification-done-trusty
2018-06-29 15:09:19 Łukasz Zemczak tomcat7 (Ubuntu Xenial): status In Progress Won't Fix
2018-06-30 19:24:09 Mathew Hodson removed subscriber Mathew Hodson