Bug 63739 - Automatic-Module-Names in embedded jars are language-level invalid
Summary: Automatic-Module-Names in embedded jars are language-level invalid
Alias: None
Product: Tomcat 9
Classification: Unclassified
Component: Packaging (show other bugs)
Version: 9.0.24
Hardware: PC All
: P1 critical (vote)
Target Milestone: -----
Assignee: Tomcat Developers Mailing List
Depends on:
Reported: 2019-09-09 11:18 UTC by Rob
Modified: 2019-09-11 09:42 UTC (History)
0 users


Note You need to log in before you can comment on or make changes to this bug.
Description Rob 2019-09-09 11:18:16 UTC
Hi this is a follow-up to 63555, to resolve which Automatic-Module-Names were introduced into the MANIFEST.MF from 9.0.24.

Unfortunately, those module names are not valid because they contain hyphens. Module descriptor files (module-info.java) are compiled into Java classes and simply won't be able to reference them. It's rather like if a package name in a .jar had hyphens in it; the package could not be used in an import.

This renders Tomcat impossible to use with the Java module system from 9.0.24, a significantly more adverse situation than what the automatic module names are supposed to address, as it blocks future CVE security patches.

There is some good advice on the matter here: https://sormuras.github.io/blog/2018-11-16-invalid-automatic-module-names.html

Example invalid values from Tomcat 9.0.24:

Automatic-Module-Name: org.apache.tomcat-embed-core
Automatic-Module-Name: org.apache.tomcat-embed-jasper-el

What I would expect:

Automatic-Module-Name: org.apache.tomcat.embed.core
Automatic-Module-Name: org.apache.tomcat.embed.jasper.el
Comment 1 Mark Thomas 2019-09-10 17:53:49 UTC
Thanks for the report.

Fixed in:
- master for 9.0.25 onwards
Comment 2 Rob 2019-09-11 09:42:39 UTC
Reviewed the commit, and it looks perfect to me. Thanks, that's really appreciated.