Repository navigation
build: web.xml on the Jakarta EE 11 (Servlet 6.1) schema (PR 6 of jakarta migration #861) - #940
Merged
ismisepaul merged 23 commits intoOct 23, 2026
Conversation
…R 6 of jakarta migration #861) - web.xml: Java EE 2.5 descriptor -> Jakarta EE web-app 6.1 (https://jakarta.ee/xml/ns/jakartaee). Annotation scanning was already on under 2.5 (the /api servlets rely on @WebServlet), so metadata-complete is left unset. - docker/tomcat/serverxml.patch regenerated against Tomcat 11.0.27's conf/server.xml: the old 8080-connector hunk no longer matched, which would fail `RUN patch` in the image build. The HTTPS connector now uses <SSLHostConfig>/<Certificate> instead of the legacy Connector-level keystoreFile/keystorePass/keyAlias attributes; the resulting setup is the same (8080 redirects to HTTPS_PORT, TLS on 8443 from the built keystore). - Dockerfile placeholder substitution updated for the new attribute names. webxml.patch still applies cleanly to Tomcat 11.0.27's conf/web.xml. Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The old patch was a diff against a 2020 Tomcat web.xml. On Tomcat 11's conf/web.xml, GNU patch (used in the image build) only applied it with fuzz 2 at an offset of -4108 lines, dropping the security-constraint between session-config and the MIME mappings. That is still valid XML and still enforced HTTPS, but only by luck. Regenerated as an exact diff against the base image's conf/web.xml; verified with the image's own GNU patch (Hunk #1 succeeded, no fuzz) alongside serverxml.patch. Refs #861 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused configuration changes align with the Tomcat 11 baseline, with no unresolved findings and reported deployment smoke tests passing.
No open issues 🎉
What changed in this PR
Updates Security Shepherd’s deployment configuration for Jakarta EE 11 and Tomcat 11 as part of migration #861, following the SAML changes in #939.
Changes:
- Migrates the application descriptor to Servlet 6.1 while preserving annotation scanning.
- Regenerates Tomcat configuration patches for HTTP-to-HTTPS redirects and the modern TLS certificate configuration.
- Updates Docker build substitutions to match the new certificate attributes.
| File | Description |
|---|---|
src/main/webapp/WEB-INF/web.xml |
Adopts the Jakarta namespace and Servlet 6.1 schema. |
Dockerfile |
Updates TLS certificate placeholder substitutions. |
docker/tomcat/webxml.patch |
Places the HTTPS constraint immediately before the closing application tag. |
docker/tomcat/serverxml.patch |
Refreshes Tomcat patch context and uses nested TLS certificate configuration. |
Review effort: Balanced
ismisepaul
added this pull request to stack #943
October 22, 2026 21:01
ismisepaul
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR 6 of the Jakarta migration stack (#861)
Stacked on #939 (PR 5).
Change
web.xml: Java EE 2.5 descriptor → Jakarta EEweb-app6.1 (https://jakarta.ee/xml/ns/jakartaee). Annotation scanning was already on under 2.5 (the/api/*servlets rely on@WebServlet), sometadata-completestays unset.The Tomcat 11
server.xml/web.xmlpatches and Dockerfile changes that were originally here have moved to PR 4 (#936). They belong with the Tomcat 11 image change, and without themdocker compose buildfailed on PRs 4 and 5.Verification
Full Docker smoke test of the stack on Tomcat 11.0.27: the WAR deploys with no
SEVERE;/api/levels(an@WebServlet) returns 200; admin login and translated JSPs work.Please merge with a merge commit.
Refs #861
🤖 Generated with Claude Code