Mark,
Thanks for RMing.
On 10/22/26 3:04 PM, Mark Thomas wrote:
The key differences in version 1.3.10 compared to 1.3.9 are:
- Windows binaries built with OpenSSL 3.5.9
- Restore support for OpenSSL 1.1.1
- Align OCSP checks with JSSE so that a certificate that is itself a
trust anchor (whether a self-signed root or a certificate trusted
directly via the configured trust store) is not subject to OCSP
checking
The proposed release artifacts can be found at [1],
and the build was done using tag [2].
The Apache Tomcat Native 1.3.10 release is
[ ] Stable, go ahead and release
[ ] Broken because of ...
+1 for stable release.
The package builds cleanly with a single warning (see below) on MacOS
aarch64 with both OpenSSL 3 and OpenSSL 4.
The unit tests all pass on Tomcat 9.0.x/head on MacOS aarch64 as well.
Lots of tests were skipped with indicator like these:
"
SKIPPED: With APR, only run for OpenSSL
"
I can confirm that the native module loaded as expected given other logs
during testing like this:
"
Loaded Apache Tomcat Native library [1.3.10] using APR version [1.7.6].
APR capabilities: IPv6 [true], sendfile [true], accept filters [false],
random [true], UDS [true].
APR/OpenSSL configuration: useAprConnector [false], useOpenSSL [true]
OpenSSL successfully initialized [OpenSSL 3.5.9 29 Sep 2026]
"
The warning about the source Zip and tarball is because there are
certain build scripts, etc. for *NIX which are not included in the ZIP
archive. I think there is no harm in including those files, so perhaps
we should throw them in to make the archives the same. For example, the
Windows-specific NMAKEmakefile is included in the tarball but the ZIP
file does not include the *NIX-specific files.
Details:
* Environment
* OS: Darwin 25.6.0 arm64
* cc: Apple clang version 21.0.0 (clang-2100.3.34.2)
* make: GNU Make 3.81
* OpenSSL: OpenSSL 3.5.9 29 Sep 2026 (Library: OpenSSL 3.5.9 29 Sep 2026)
* Java (build): OpenJDK Runtime Environment (Temurin)(build 1.8.0_432-b06)
* Java (test): OpenJDK Runtime Environment Temurin-25.0.4.1+1 (build
25.0.4.1+1-LTS)
* tcnative statically-linked OpenSSL version: 3.5.9
* APR: 1.7.6
* Valid SHA-512 signature for
tomcat-native-1.3.10-openssl-3.5.9-win32-bin.zip
* Valid GPG signature for tomcat-native-1.3.10-openssl-3.5.9-win32-bin.zip
* Valid SHA512 signature for tomcat-native-1.3.10-win32-src.zip
* Valid GPG signature for tomcat-native-1.3.10-win32-src.zip
* Valid SHA512 signature for tomcat-native-1.3.10-src.tar.gz
* Valid GPG signature for tomcat-native-1.3.10-src.tar.gz
* Source Zip and tarball: !! NOT SAME
* tcnative builds cleanly
Compiler warning:
src/ssl.c:771:27: warning: a function declaration without a prototype is
deprecated in all versions of C [-Wstrict-prototypes]
771 | static BIO_METHOD *BIO_jbs()
| ^
| void
This should be easy to fix for the next release. It does not impact the
current release IMO. I've pushed a patch for that warning to the 1.3.x
branch.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
