Not fully tested
```
Java 17 bcprov 1.80 Jetty 12 libslf4j2 support
trixie y y y y y
bookworm y n n n y (jammy)
bullseye y n n n y (jammy)
buster n n n n n
resolute y y not yet y y (questing until it gets Jetty 12)
questing y y n y y
noble y n n n y (jammy)
jammy y n n n y
focal n n n n n
bionic n n n n n
```
Jetty server high CPU when client send data length > 17408
This affects SSL connections only, which is not part of our default setup.
Adapted from workaround at:
https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
Put the new checks directly in the unwrap() method,
rather than subclassing SslConnection, as that would require config file changes.
Prior to Jetty 9, we used the Tomcat 6 distribution.
As of Jetty 9, we used Tomcat 8.0.33 that was included in the Jetty 9 distribution,
but that is old and doesn't get updated.
Now use the latest Tomcat 8 distribution, and pick the same packages
as Jetty 9 did in their distribution.
Fix up LICENSES.txt
Build.xml cleanup
Debian:
- Add support for with-libtomcat8-java but not with-libjetty9-java for wheezy/jessie
- Fix wheezy/precise/trusty build files to use tomcat8 but not jetty9 packages
- Remove build dependency on ant-optional, not required
- Remove some remaining eclipse-ecj dependencies
- Add short README files for wheezy and jessie
- Remove with-libtomcat6-java and with-libtomcat7-java
- Replace with-libjetty8-java with-libjetty9-java
- Add libtomcat8-java dependency in debian builds
- Change libservlet-3.0-java implicit dependency to libservlet-3.1-java
- Initial mods for trusty build files, as it does not have jetty 9
- Initial xenial build files
- Add link to jetty9-apache-jsp.jar
- Add necessary util jars to jsp classpath
Non-Debian builds:
- Move tomcat runtime from javax.servlet.jar to jasper-runtime.jar,
to be consistent with Jetty 8
- Switch from jetty (glassfish) to apache (tomcat) jsp implementation,
to be consistent with Debian builds
- Drop checked-in Tomcat 6 and Jetty 8 jars
Code:
- Force Jasper initialization in RouterConsoleRunner since we
don't use the Jetty annotation scanner
Bundle the DTDs, as extracted from jetty-schemas-3.1.jar
These were in lib/jsp/javax.servlet.jsp-2.2.0.v201112011158.jar in Jetty 8
but are not in any lib/jsp/*.jar in Jetty 9.
GPL v2:
Copyright 2003-2009 Sun Microsystems, Inc. All rights reserved.
Copyright 2004 The Apache Software Foundation
Copyright (c) 2009-2013 Oracle and/or its affiliates. All rights reserved.
