BUILDING.txt

@@ -21,7 +21,7 @@
 
 This subproject contains the source code for Tomcat @VERSION_MAJOR_MINOR@, a container that
 implements the Servlet 3.1, JSP 2.3, EL 3.0, WebSocket 1.1 and JASPIC 1.1
-specifications from the Java Community Process <http://www.jcp.org/>.
+specifications from the Java Community Process <https://www.jcp.org/>.
 
 Note: If you just need to run Apache Tomcat, it is not necessary to build
 it. You may simply download a binary distribution. It is cross-platform.
@@ -56,7 +56,7 @@ source distribution, do the following:
       See Apache Commons DBCP project web site for more details on
       available versions of the library and its requirements,
 
-        http://commons.apache.org/dbcp/
+        https://commons.apache.org/dbcp/
 
  3. Install the JDK according to the instructions included with the release.
 
@@ -64,14 +64,14 @@ source distribution, do the following:
     into which you installed the JDK release.
 
 
-(2) Install Apache Ant version 1.9.5 or later on your computer.
+(2) Install Apache Ant version 1.9.8 or later on your computer.
 
- 1. If Apache Ant version 1.9.5 or later is already installed on your
+ 1. If Apache Ant version 1.9.8 or later is already installed on your
     computer, skip to (3).
 
  2. Download a binary distribution of Ant from:
 
-        http://ant.apache.org/bindownload.cgi
+        https://ant.apache.org/bindownload.cgi
 
  3. Unpack the binary distribution into a convenient location so that the
     Ant release resides in its own directory (conventionally named
@@ -99,11 +99,11 @@ package.
 
  *  Tomcat SVN repository URL:
 
-        http://svn.apache.org/repos/asf/tomcat/tc@VERSION_MAJOR_MINOR@.x/trunk/
+        https://svn.apache.org/repos/asf/tomcat/tc@VERSION_MAJOR_MINOR@.x/trunk/
 
  *  Source packages can be downloaded from:
 
-        http://tomcat.apache.org/download-@VERSION_MAJOR@0.cgi
+        https://tomcat.apache.org/download-@VERSION_MAJOR@0.cgi
 
 The location where the source has been placed will be further referred as
 ${tomcat.source}.
@@ -449,8 +449,8 @@ as for the property "test.name".
  6. Optional support is provided for the Cobertura code coverage tool.
 
 NOTE: Cobertura is licensed under GPL v2 with parts of it being under
-      Apache License v1.1. See http://cobertura.sf.net for details. Using it
-      during Tomcat build is optional and is off by default.
+      Apache License v1.1. See https://cobertura.github.io/cobertura/ for details.
+      Using it during Tomcat build is optional and is off by default.
 
  Cobertura can be enabled using the following properties:
 

CONTRIBUTING.md

@@ -4,17 +4,17 @@ Firstly, thanks for your interest in contributing! I hope that this will be a
 pleasant first experience for you, and that you will return to continue
 contributing.
 
-Please visit our [Get Involved page](http://tomcat.apache.org/getinvolved.html)
+Please visit our [Get Involved page](https://tomcat.apache.org/getinvolved.html)
 for more information on how to contribute.
 
 ## Code of Conduct
 
 This project and everyone participating in it is governed by the Apache
 software Foundation's
-[Code of Conduct](http://www.apache.org/foundation/policies/conduct.html). By
+[Code of Conduct](https://www.apache.org/foundation/policies/conduct.html). By
 participating, you are expected to adhere to this code. If you are aware of
 unacceptable behavior, please visit the
-[Reporting Guidelines page](http://www.apache.org/foundation/policies/conduct.html#reporting-guidelines)
+[Reporting Guidelines page](https://www.apache.org/foundation/policies/conduct.html#reporting-guidelines)
 and follow the instructions there.
 
 ## How Can I Contribute?
@@ -25,7 +25,7 @@ for us to fix.
 
 ### Reporting Bugs
 
-Please review our [guide](http://tomcat.apache.org/bugreport.html) on how to
+Please review our [guide](https://tomcat.apache.org/bugreport.html) on how to
 submit a bug report. This page also has links to other resources to assist
 you.
 
@@ -36,7 +36,7 @@ you.
 Unsure where to begin contributing to Tomcat? You can start by taking a look at
 the issues marked 'Beginner', link below. Please note that the Beginner keyword
 is pretty new to the project, so if there aren't any issues in the filter feel
-free to ask on the [dev list](http://tomcat.apache.org/lists.html#tomcat-dev).
+free to ask on the [dev list](https://tomcat.apache.org/lists.html#tomcat-dev).
 
 * [Beginner issues](https://bz.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=NEEDINFO&keywords=Beginner&keywords_type=allwords&list_id=160824&product=Tomcat%207&product=Tomcat%208&product=Tomcat%209&query_format=advanced) -
 issues which should only require a few lines of code, and a test or two to
@@ -77,14 +77,17 @@ This method works if you want to submit a patch (like you would do for SVN), but
 the difference in using the sources distribution and a VCS is that you have to
 manually generate the patch file by using diff. If this is what you want, you
 can download the sources from the "Source Code Distributions" section of the
-[Download Page](https://tomcat.apache.org/download-90.cgi).
+Download Page. There is one such page for every major Tomcat version:
+- [Tomcat 9](https://tomcat.apache.org/download-90.cgi)
+- [Tomcat 8](https://tomcat.apache.org/download-80.cgi)
+- [Tomcat 7](https://tomcat.apache.org/download-70.cgi)
 
 ###### SVN
 
 If you have chosen to attach a patch to the Bugzilla issue (or email
 one), then you'll need to checkout the SVN version. Instructions for new
 committers to learn how to do this are found
-[here](http://www.apache.org/dev/contributors.html#svnbasics). However, in the
+[here](https://www.apache.org/dev/contributors.html#svnbasics). However, in the
 interest of a fast ramp up, the short version is below. Note that the root of
 the SVN repository is
 [tomcat/trunk](http://svn.apache.org/repos/asf/tomcat/trunk),

MERGE.txt

@@ -57,7 +57,7 @@ FileUpload
 Sub-tree:
 src/main/java/org/apache/commons/fileupload
 The SHA1 ID for the most recent commit to be merged to Tomcat is:
-6c00d575a9521c386743891fd34bc5181174cc01
+b1498c9877d751f8bc4635a6f252ebdfcba28518
 
 Note: Tomcat's copy of fileupload also includes classes copied manually (rather
       than svn copied) from Commons IO.
@@ -69,10 +69,10 @@ Sub-tree
 src/main/java/org/apache/commons/dbcp2
 src/main/resources/org/apache/commons/dbcp2
 The SHA1 ID for the most recent commit to be merged to Tomcat is:
-d7aa662fbbb99e536ae28c47d0c4e1d51e39d5b9
+abc048454398d8c9924a1af9c04501817f44a11d
 
 Pool2
 Sub-tree
 src/main/java/org/apache/commons/pool2
 The SHA1 ID for the most recent commit to be merged to Tomcat is:
-dfef97be70e8b1c3edb44b972fc7f700f3fe6255
+3e02523b6907fb22f3582544fe362c785821bcb8

NOTICE

@@ -2,11 +2,11 @@ Apache Tomcat
 Copyright 1999-2018 The Apache Software Foundation
 
 This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
+The Apache Software Foundation (https://www.apache.org/).
 
 This software contains code derived from netty-native
 developed by the Netty project
-(http://netty.io, https://github.com/netty/netty-tcnative/)
+(https://netty.io, https://github.com/netty/netty-tcnative/)
 and from finagle-native developed at Twitter
 (https://github.com/twitter/finagle).
 
@@ -19,7 +19,7 @@ http://nsis.sourceforge.net.
 Java compilation software for JSP pages is provided by the Eclipse
 JDT Core Batch Compiler component, which is open source software.
 The original software and related information is available at
-http://www.eclipse.org/jdt/core/.
+https://www.eclipse.org/jdt/core/.
 
 For portions of the Tomcat JNI OpenSSL API and the OpenSSL JSSE integration
 The org.apache.tomcat.jni and the org.apache.tomcat.net.openssl packages

README.md

@@ -6,35 +6,45 @@ The Apache Tomcat® software is an open source implementation of the Java
 Servlet, JavaServer Pages, Java Expression Language and Java WebSocket
 technologies. The Java Servlet, JavaServer Pages, Java Expression Language and
 Java WebSocket specifications are developed under the
-[Java Community Process](http://jcp.org/en/introduction/overview).
+[Java Community Process](https://jcp.org/en/introduction/overview).
 
 The Apache Tomcat software is developed in an open and participatory
 environment and released under the
-[Apache License version 2](http://www.apache.org/licenses/). The Apache Tomcat
+[Apache License version 2](https://www.apache.org/licenses/). The Apache Tomcat
 project is intended to be a collaboration of the best-of-breed developers from
 around the world. We invite you to participate in this open development
 project. To learn more about getting involved,
-[click here](http://tomcat.apache.org/getinvolved.html) or keep reading.
+[click here](https://tomcat.apache.org/getinvolved.html) or keep reading.
 
 Apache Tomcat software powers numerous large-scale, mission-critical web
 applications across a diverse range of industries and organizations. Some of
 these users and their stories are listed on the
-[PoweredBy wiki page](http://wiki.apache.org/tomcat/PoweredBy).
+[PoweredBy wiki page](https://wiki.apache.org/tomcat/PoweredBy).
 
 Apache Tomcat, Tomcat, Apache, the Apache feather, and the Apache Tomcat
 project logo are trademarks of the Apache Software Foundation.
 
-### The Latest Version
+### Get It
 
-The current latest version in this branch (trunk) can be found on the [Tomcat 9.0](https://tomcat.apache.org/download-90.cgi) page.
+For every major Tomcat version there is one download page containing
+links to the latest binary and source code downloads, but also
+links for browsing the download directories and archives:
+- [Tomcat 9](https://tomcat.apache.org/download-90.cgi)
+- [Tomcat 8](https://tomcat.apache.org/download-80.cgi)
+- [Tomcat 7](https://tomcat.apache.org/download-70.cgi)
+
+To facilitate choosing the right major Tomcat version one, we have provided a
+[version overview page](https://tomcat.apache.org/whichversion.html).
 
 ### Documentation
 
 The documentation available as of the date of this release is
 included in the docs webapp which ships with tomcat. You can access that webapp
 by starting tomcat and visiting http://localhost:8080/docs/ in your browser.
-The most up-to-date documentation can be found at
-http://tomcat.apache.org/tomcat-9.0-doc/.
+The most up-to-date documentation for each version can be found at:
+- [Tomcat 9](https://tomcat.apache.org/tomcat-9.0-doc/)
+- [Tomcat 8](https://tomcat.apache.org/tomcat-8.5-doc/)
+- [Tomcat 7](https://tomcat.apache.org/tomcat-7.0-doc/)
 
 ### Installation
 
@@ -47,22 +57,22 @@ Please see [LICENSE](LICENSE) for more info.
 ### Support and Mailing List Information
 
 * Free community support is available through the
-[tomcat-users](http://tomcat.apache.org/lists.html#tomcat-users) email list and
-a dedicated [IRC channel](http://tomcat.apache.org/irc.html) (#tomcat on
+[tomcat-users](https://tomcat.apache.org/lists.html#tomcat-users) email list and
+a dedicated [IRC channel](https://tomcat.apache.org/irc.html) (#tomcat on
 Freenode).
 
 * If you want freely available support for running Apache Tomcat, please see the
-resources page [here](http://tomcat.apache.org/findhelp.html).
+resources page [here](https://tomcat.apache.org/findhelp.html).
 
 * If you want to be informed about new code releases, bug fixes,
 security fixes, general news and information about Apache Tomcat, please
 subscribe to the
-[tomcat-announce](http://tomcat.apache.org/lists.html#tomcat-announce) email
+[tomcat-announce](https://tomcat.apache.org/lists.html#tomcat-announce) email
 list.
 
 * If you have a concrete bug report for Apache Tomcat, please see the
 instructions for reporting a bug
-[here](http://tomcat.apache.org/bugreport.html).
+[here](https://tomcat.apache.org/bugreport.html).
 
 ### Contributing
 

RELEASE-NOTES

@@ -139,7 +139,7 @@ the check.
 ==============================
 Viewing the Tomcat Change Log:
 ==============================
-The full change log is available from http://tomcat.apache.org and is also
+The full change log is available from https://tomcat.apache.org and is also
 included in the documentation web application.
 
 
@@ -175,4 +175,4 @@ software:
 When all else fails:
 ====================
 See the FAQ
-http://tomcat.apache.org/faq/
+https://tomcat.apache.org/faq/

RUNNING.txt

@@ -43,7 +43,7 @@ Running With JRE 7 Or Later
 
 (2.1) Download a binary distribution of Tomcat from:
 
-      http://tomcat.apache.org/
+      https://tomcat.apache.org/
 
 (2.2) Unpack the binary distribution so that it resides in its own
       directory (conventionally named "apache-tomcat-[version]").
@@ -203,7 +203,7 @@ launches Java directly and does not use the script files.
 (4.3) Further information about configuring and running Tomcat can be found in
       the documentation included here, as well as on the Tomcat web site:
 
-      http://tomcat.apache.org/
+      https://tomcat.apache.org/
 
 
 (5) Shut Down Tomcat
@@ -393,32 +393,32 @@ For further reading:
 
     * Documentation for APR/Native library in the Tomcat User's Guide
 
-      http://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/apr.html
+      https://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/apr.html
 
     * Documentation for the HTTP and AJP protocol connectors in the Tomcat
       Configuration Reference
 
-      http://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/config/http.html
+      https://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/config/http.html
 
-      http://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/config/ajp.html
+      https://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/config/ajp.html
 
  - Apache Tomcat Native project home
 
-      http://tomcat.apache.org/native-doc/
+      https://tomcat.apache.org/native-doc/
 
  - Other projects
 
     * OpenSSL
 
-      http://openssl.org/
+      https://www.openssl.org/
 
     * Apache Portable Runtime
 
-      http://apr.apache.org/
+      https://apr.apache.org/
 
     * Apache HTTP Server
 
-      http://httpd.apache.org/
+      https://httpd.apache.org/
 
 To disable Apache Tomcat Native library:
 
@@ -449,17 +449,17 @@ For further reading:
 
  - Apache Commons Daemon project
 
-      http://commons.apache.org/daemon/
+      https://commons.apache.org/daemon/
 
  - Apache Tomcat documentation
 
     * Installing Apache Tomcat
 
-      http://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/setup.html
+      https://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/setup.html
 
     * Windows service HOW-TO
 
-      http://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/windows-service-howto.html
+      https://tomcat.apache.org/tomcat-@VERSION_MAJOR_MINOR@-doc/windows-service-howto.html
 
 The binary files of Apache Commons Daemon in Apache Tomcat distributions
 for Windows are named:

bin/daemon.sh

@@ -260,7 +260,7 @@ case "$1" in
       exit $?
     ;;
     *       )
-      echo "Unknown command: \`$1'"
+      echo "Unknown command: '$1'"
       echo "Usage: $PROGRAM ( commands ... )"
       echo "commands:"
       echo "  run               Start Tomcat without detaching from console"

bin/service.bat

@@ -164,7 +164,7 @@ if "%JvmMs%" == "" set JvmMs=128
 if "%JvmMx%" == "" set JvmMx=256
 
 "%EXECUTABLE%" //IS//%SERVICE_NAME% ^
-    --Description "Apache Tomcat @VERSION@ Server - http://tomcat.apache.org/" ^
+    --Description "Apache Tomcat @VERSION@ Server - https://tomcat.apache.org/" ^
     --DisplayName "%DISPLAYNAME%" ^
     --Install "%EXECUTABLE%" ^
     --LogPath "%CATALINA_BASE%\logs" ^

build.properties.default

@@ -25,7 +25,7 @@
 # ----- Version Control Flags -----
 version.major=8
 version.minor=5
-version.build=32
+version.build=33
 version.patch=0
 version.suffix=
 
@@ -89,8 +89,8 @@ compile.debug=true
 # Do not pass -deprecation (-Xlint:deprecation) flag to javac
 compile.deprecation=false
 
-base-apache.loc.1=http://www.apache.org/dyn/closer.lua?action=download&filename=
-base-apache.loc.2=http://archive.apache.org/dist
+base-apache.loc.1=https://www.apache.org/dyn/closer.lua?action=download&filename=
+base-apache.loc.2=https://archive.apache.org/dist
 base-commons.loc.1=${base-apache.loc.1}/commons
 base-commons.loc.2=${base-apache.loc.2}/commons
 base-tomcat.loc.1=${base-apache.loc.1}/tomcat
@@ -105,20 +105,34 @@ base-maven.loc=https://repo.maven.apache.org/maven2
 
 # ----- Webservices - JAX RPC -----
 jaxrpc-lib.version=1.1-rc4
+jaxrpc-lib.checksum.enabled=true
+jaxrpc-lib.checksum.algorithm=MD5|SHA-1
+jaxrpc-lib.checksum.value=4bebba22a4cdb9f68e16c45129770333|fe9371d33dc3e1646d4d13bde19614283eb998b1
 jaxrpc-lib.home=${base.path}/jaxrpc-${jaxrpc-lib.version}
 jaxrpc-lib.loc=${base-maven.loc}/geronimo-spec/geronimo-spec-jaxrpc/${jaxrpc-lib.version}/geronimo-spec-jaxrpc-${jaxrpc-lib.version}.jar
 jaxrpc-lib.jar=${jaxrpc-lib.home}/geronimo-spec-jaxrpc-${jaxrpc-lib.version}.jar
 
 # ----- Webservices - WSDL4J -----
-wsdl4j-lib.version=1.6.2
+wsdl4j-lib.version=1.6.3
+wsdl4j-lib.checksum.enabled=true
+wsdl4j-lib.checksum.algorithm=MD5|SHA-1
+wsdl4j-lib.checksum.value=cfc28d89625c5e88589aec7a9aee0208|6d106a6845a3d3477a1560008479312888e94f2f
 wsdl4j-lib.home=${base.path}/wsdl4j-${wsdl4j-lib.version}
 wsdl4j-lib.loc=${base-maven.loc}/wsdl4j/wsdl4j/${wsdl4j-lib.version}/wsdl4j-${wsdl4j-lib.version}.jar
 wsdl4j-lib.jar=${wsdl4j-lib.home}/wsdl4j-${wsdl4j-lib.version}.jar
 
 # ----- Eclipse JDT, version 4.5.1 or later -----#
 # See https://wiki.apache.org/tomcat/JDTCoreBatchCompiler before updating
+#
+# Checksum is from "SHA512 Checksums for 4.6.3" link at
+# http://archive.eclipse.org/eclipse/downloads/drops4/R-4.6.3-201703010400/
+# http://archive.eclipse.org/eclipse/downloads/drops4/R-4.6.3-201703010400/checksum/eclipse-4.6.3-SUMSSHA512
+#
 jdt.version=4.6.3
 jdt.release=R-4.6.3-201703010400
+jdt.checksum.enabled=true
+jdt.checksum.algorithm=SHA-512
+jdt.checksum.value=372da97d5f37095a3616c730170dc541b93acb8f50370cd9b0d81fba4583e865f0c933dc012155f26638306b82a402eaab209123cd0a979fa7c86313c0fca477
 jdt.home=${base.path}/ecj-${jdt.version}
 jdt.jar=${jdt.home}/ecj-${jdt.version}.jar
 # The download will be moved to the archive area eventually. We are taking care of that in advance.
@@ -127,6 +141,12 @@ jdt.loc.2=http://download.eclipse.org/eclipse/downloads/drops4/${jdt.release}/ec
 
 # ----- Tomcat native library -----
 tomcat-native.version=1.2.17
+tomcat-native.src.checksum.enabled=true
+tomcat-native.src.checksum.algorithm=SHA-512
+tomcat-native.src.checksum.value=8fa946855fd14525ec0abe7b09975bbd34d6127352e90730a8afb77e16cd91715417e812a40017fee65939a9ce95faf39a9193222f441cda0ad2eb7f690e77b9
+tomcat-native.win.checksum.enabled=true
+tomcat-native.win.checksum.algorithm=SHA-512
+tomcat-native.win.checksum.value=2955209b39707949b080f13c09edcad08a13faf5545f7890e2ac493ccbc66d09e152a39b4fa6ac40fe3de6b209b305608db3db8dcf24dda94567b417f55a5f49
 tomcat-native.home=${base.path}/tomcat-native-${tomcat-native.version}
 tomcat-native.tar.gz=${tomcat-native.home}/tomcat-native.tar.gz
 tomcat-native.loc.1=${base-tomcat.loc.1}/tomcat-connectors/native/${tomcat-native.version}/source/tomcat-native-${tomcat-native.version}-src.tar.gz
@@ -136,6 +156,9 @@ tomcat-native.win.2=${base-tomcat.loc.2}/tomcat-connectors/native/${tomcat-nativ
 
 # ----- NSIS, version 3.0 or later -----
 nsis.version=3.03
+nsis.checksum.enabled=true
+nsis.checksum.algorithm=MD5|SHA-1
+nsis.checksum.value=d4919dc089ec256a7264e97ada299b64|ea69aa8d538916c9e8630dfd0106b063f7bb5d46
 nsis.home=${base.path}/nsis-${nsis.version}
 nsis.exe=${nsis.home}/makensis.exe
 nsis.arch.dir=x86-unicode/
@@ -148,6 +171,20 @@ nsis.loc=${base-sf.loc}/nsis/nsis-${nsis.version}.zip
 
 # ----- Commons Daemon, version 1.1.0 or later -----
 commons-daemon.version=1.1.0
+
+# checksum for commons-daemon-1.1.0-bin.tar.gz
+commons-daemon.bin.checksum.enabled=true
+commons-daemon.bin.checksum.algorithm=SHA-512
+commons-daemon.bin.checksum.value=43c33e52e0be11e73370083500592ee9df0431c3166dbc7ed95794cabb462ac2a140e3eb4bbe2a0b99882bb93d9244ff534f13e4933c13e7a31a37e58e0c8e1d
+
+# checksums for commons-daemon-1.1.0-native-src.tar.gz, commons-daemon-1.1.0-bin-windows.zip
+commons-daemon.native.src.checksum.enabled=true
+commons-daemon.native.src.checksum.algorithm=SHA-512
+commons-daemon.native.src.checksum.value=3443f1c95a4b267c4387a9ac7c79315422a51e896c0bcea48fbe959bc301094770aa8065b2388a84760a3e07e5d1753c2b351336fb2d3a8c996ee14d32088f6e
+commons-daemon.native.win.checksum.enabled=true
+commons-daemon.native.win.checksum.algorithm=SHA-512
+commons-daemon.native.win.checksum.value=10cda04d9a44286cb67107fdb9d20958013f075cad4accba048801f3677765c334dc16f6901e1d2e4a9df5a2c702797370de63393568df6fceb9e7902421f9ea
+
 commons-daemon.home=${base.path}/commons-daemon-${commons-daemon.version}
 commons-daemon.jar=${commons-daemon.home}/commons-daemon-${commons-daemon.version}.jar
 commons-daemon.native.win.home=${commons-daemon.home}/windows
@@ -162,43 +199,65 @@ commons-daemon.native.win.loc.1=${base-commons.loc.1}/daemon/binaries/windows/co
 commons-daemon.native.win.loc.2=${base-commons.loc.2}/daemon/binaries/windows/commons-daemon-${commons-daemon.version}-bin-windows.zip
 
 # ----- JUnit Unit Test Suite, version 4.11 or later -----
-junit.version=4.11
+junit.version=4.12
+junit.checksum.enabled=true
+junit.checksum.algorithm=MD5|SHA-1
+junit.checksum.value=5b38c40c97fbd0adee29f91e60405584|2973d150c0dc1fefe998f834810d68f278ea58ec
 junit.home=${base.path}/junit-${junit.version}
 junit.jar=${junit.home}/junit-${junit.version}.jar
 junit.loc=${base-maven.loc}/junit/junit/${junit.version}/junit-${junit.version}.jar
 
 # ----- Hamcrest Library, used by JUnit, version 1.3 or later ----
 hamcrest.version=1.3
+hamcrest.checksum.enabled=true
+hamcrest.checksum.algorithm=MD5|SHA-1
+hamcrest.checksum.value=6393363b47ddcbba82321110c3e07519|42a25dc3219429f0e5d060061f71acb49bf010a0
 hamcrest.home=${base.path}/hamcrest-${hamcrest.version}
 hamcrest.jar=${hamcrest.home}/hamcrest-core-${hamcrest.version}.jar
 hamcrest.loc=${base-maven.loc}/org/hamcrest/hamcrest-core/${hamcrest.version}/hamcrest-core-${hamcrest.version}.jar
 
 # ----- EasyMock, version 3.2 or later -----
 easymock.version=3.2
+easymock.checksum.enabled=true
+easymock.checksum.algorithm=MD5|SHA-1
+easymock.checksum.value=0da4291328e18798621c36fdf8bc4c3a|00c82f7fa3ef377d8954b1db25123944b5af2ba4
 easymock.home=${base.path}/easymock-${easymock.version}
-easymock.loc=${base-sf.loc}/easymock/easymock-${easymock.version}.zip
 easymock.jar=${easymock.home}/easymock-${easymock.version}.jar
+easymock.loc=${base-maven.loc}/org/easymock/easymock/${easymock.version}/easymock-${easymock.version}.jar
 
 # ----- cglib, used by EasyMock, version 2.2 or later -----
-cglib.version=2.2.3
+cglib.version=2.2.2
+cglib.checksum.enabled=true
+cglib.checksum.algorithm=MD5|SHA-1
+cglib.checksum.value=af93e373d7ddf35db0e9612480d9ed13|00d456bb230c70c0b95c76fb28e429d42f275941
 cglib.home=${base.path}/cglib-${cglib.version}
-cglib.loc=${base-sf.loc}/cglib/cglib-nodep-${cglib.version}.jar
 cglib.jar=${cglib.home}/cglib-nodep-${cglib.version}.jar
+cglib.loc=${base-maven.loc}/cglib/cglib-nodep/${cglib.version}/cglib-nodep-${cglib.version}.jar
 
 # ----- objenesis, used by EasyMock, version 1.2 or later -----
 objenesis.version=1.2
+objenesis.checksum.enabled=true
+objenesis.checksum.algorithm=MD5|SHA-1
+objenesis.checksum.value=bee117291d50b41b8e8cf0ac5435df1d|bfcb0539a071a4c5a30690388903ac48c0667f2a
 objenesis.home=${base.path}/objenesis-${objenesis.version}
-objenesis.loc=https://bintray.com/easymock/distributions/download_file?file_path=objenesis-${objenesis.version}-bin.zip
 objenesis.jar=${objenesis.home}/objenesis-${objenesis.version}.jar
+objenesis.loc=${base-maven.loc}/org/objenesis/objenesis/${objenesis.version}/objenesis-${objenesis.version}.jar
 
 # ----- Checkstyle, version 6.16 or later -----
+# Checksums are available at https://sourceforge.net/projects/checkstyle/files/OldFiles/6.17/
 checkstyle.version=6.17
+checkstyle.checksum.enabled=true
+checkstyle.checksum.algorithm=MD5|SHA-1
+checkstyle.checksum.value=9180ab8b8219b262bfe88f26fd95d26d|11a02d7b0374f8a82fbd76361a69756faa6aefa0
 checkstyle.home=${base.path}/checkstyle-${checkstyle.version}
 checkstyle.loc=${base-sf.loc}/checkstyle/checkstyle/${checkstyle.version}/checkstyle-${checkstyle.version}-all.jar
 checkstyle.jar=${checkstyle.home}/checkstyle-${checkstyle.version}-all.jar
 
 # ----- Cobertura code coverage tool -----
 cobertura.version=2.1.1
+cobertura.checksum.enabled=true
+cobertura.checksum.algorithm=MD5|SHA-1
+cobertura.checksum.value=4f46638aa8e4d89565c038092398ea06|99cb44d36555feedcedc46263c23c2f5394ef342
 cobertura.home=${base.path}/cobertura-${cobertura.version}
 cobertura.jar=${cobertura.home}/cobertura-${cobertura.version}.jar
 cobertura.lib=${cobertura.home}/lib
@@ -206,6 +265,9 @@ cobertura.loc=${base-sf.loc}/cobertura/cobertura-2.1.1-bin.tar.gz
 
 # ----- Findbugs -----
 findbugs.version=3.0.1
+findbugs.checksum.enabled=true
+findbugs.checksum.algorithm=MD5|SHA-1
+findbugs.checksum.value=dec8828de8657910fcb258ce5383c168|59a24064ca6869e483ce9a04d3c50d14a227d5e6
 findbugs.home=${base.path}/findbugs-${findbugs.version}
 findbugs.lib=${findbugs.home}/lib
 findbugs.jar=${findbugs.lib}/findbugs-ant.jar

conf/catalina.properties

@@ -106,31 +106,91 @@ shared.loader=
 # - Common non-Tomcat JARs
 # - Test JARs (JUnit, Cobertura and dependencies)
 tomcat.util.scan.StandardJarScanFilter.jarsToSkip=\
-bootstrap.jar,commons-daemon.jar,tomcat-juli.jar,\
-annotations-api.jar,el-api.jar,jsp-api.jar,servlet-api.jar,websocket-api.jar,\
-jaspic-api.jar,\
-catalina.jar,catalina-ant.jar,catalina-ha.jar,catalina-storeconfig.jar,\
+annotations-api.jar,\
+ant-junit*.jar,\
+ant-launcher.jar,\
+ant.jar,\
+asm-*.jar,\
+aspectj*.jar,\
+bootstrap.jar,\
+catalina-ant.jar,\
+catalina-ha.jar,\
+catalina-jmx-remote.jar,\
+catalina-storeconfig.jar,\
 catalina-tribes.jar,\
-jasper.jar,jasper-el.jar,ecj-*.jar,\
-tomcat-api.jar,tomcat-util.jar,tomcat-util-scan.jar,tomcat-coyote.jar,\
-tomcat-dbcp.jar,tomcat-jni.jar,tomcat-websocket.jar,\
-tomcat-i18n-en.jar,tomcat-i18n-es.jar,tomcat-i18n-fr.jar,tomcat-i18n-ja.jar,\
-tomcat-juli-adapters.jar,catalina-jmx-remote.jar,catalina-ws.jar,\
+catalina-ws.jar,\
+catalina.jar,\
+cglib-*.jar,\
+cobertura-*.jar,\
+commons-beanutils*.jar,\
+commons-codec*.jar,\
+commons-collections*.jar,\
+commons-daemon.jar,\
+commons-dbcp*.jar,\
+commons-digester*.jar,\
+commons-fileupload*.jar,\
+commons-httpclient*.jar,\
+commons-io*.jar,\
+commons-lang*.jar,\
+commons-logging*.jar,\
+commons-math*.jar,\
+commons-pool*.jar,\
+dom4j-*.jar,\
+easymock-*.jar,\
+ecj-*.jar,\
+el-api.jar,\
+geronimo-spec-jaxrpc*.jar,\
+h2*.jar,\
+hamcrest-*.jar,\
+hibernate*.jar,\
+httpclient*.jar,\
+icu4j-*.jar,\
+jasper-el.jar,\
+jasper.jar,\
+jaspic-api.jar,\
+jaxb-*.jar,\
+jaxen-*.jar,\
+jdom-*.jar,\
+jetty-*.jar,\
+jmx-tools.jar,\
+jmx.jar,\
+jsp-api.jar,\
+jstl.jar,\
+jta*.jar,\
+junit-*.jar,\
+junit.jar,\
+log4j*.jar,\
+mail*.jar,\
+objenesis-*.jar,\
+oraclepki.jar,\
+oro-*.jar,\
+servlet-api-*.jar,\
+servlet-api.jar,\
+slf4j*.jar,\
+taglibs-standard-spec-*.jar,\
+tagsoup-*.jar,\
+tomcat-api.jar,\
+tomcat-coyote.jar,\
+tomcat-dbcp.jar,\
+tomcat-i18n-en.jar,\
+tomcat-i18n-es.jar,\
+tomcat-i18n-fr.jar,\
+tomcat-i18n-ja.jar,\
+tomcat-i18n-ru.jar,\
 tomcat-jdbc.jar,\
+tomcat-jni.jar,\
+tomcat-juli-adapters.jar,\
+tomcat-juli.jar,\
+tomcat-util-scan.jar,\
+tomcat-util.jar,\
+tomcat-websocket.jar,\
 tools.jar,\
-commons-beanutils*.jar,commons-codec*.jar,commons-collections*.jar,\
-commons-dbcp*.jar,commons-digester*.jar,commons-fileupload*.jar,\
-commons-httpclient*.jar,commons-io*.jar,commons-lang*.jar,commons-logging*.jar,\
-commons-math*.jar,commons-pool*.jar,\
-jstl.jar,taglibs-standard-spec-*.jar,\
-geronimo-spec-jaxrpc*.jar,wsdl4j*.jar,\
-ant.jar,ant-junit*.jar,aspectj*.jar,jmx.jar,h2*.jar,hibernate*.jar,httpclient*.jar,\
-jmx-tools.jar,jta*.jar,log4j*.jar,mail*.jar,slf4j*.jar,\
-xercesImpl.jar,xmlParserAPIs.jar,xml-apis.jar,\
-junit.jar,junit-*.jar,hamcrest-*.jar,easymock-*.jar,cglib-*.jar,\
-objenesis-*.jar,ant-launcher.jar,\
-cobertura-*.jar,asm-*.jar,dom4j-*.jar,icu4j-*.jar,jaxen-*.jar,jdom-*.jar,\
-jetty-*.jar,oro-*.jar,servlet-api-*.jar,tagsoup-*.jar,xmlParserAPIs-*.jar,\
+websocket-api.jar,\
+wsdl4j*.jar,\
+xercesImpl.jar,\
+xml-apis.jar,\
+xmlParserAPIs-*.jar,\
+xmlParserAPIs.jar,\
 xom-*.jar
 
 # Default list of JAR files that should be scanned that overrides the default
@@ -139,7 +199,10 @@ xom-*.jar
 # The list of JARs to scan may be over-ridden at a Context level for individual
 # scan types by configuring a JarScanner with a nested JarScanFilter.
 tomcat.util.scan.StandardJarScanFilter.jarsToScan=\
-log4j-web*.jar,log4j-taglib*.jar,log4javascript*.jar,slf4j-taglib*.jar
+log4j-taglib*.jar,\
+log4j-web*.jar,\
+log4javascript*.jar,\
+slf4j-taglib*.jar
 
 # String cache configuration.
 tomcat.util.buf.StringCache.byte.enabled=true

debian/changelog

+tomcat8 (8.5.33-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream version 8.5.33.
+    - Tomcat compiles to Java 7 bytecode and passes release=7 to javac now.
+      This ensures backwards compatibility with older JREs. (Closes: #906447)
+  * Declare compliance with Debian Policy 4.2.1.
+  * Refresh 0025-invalid-configuration-exit-status.patch.
+
+ -- Markus Koschany <apo@debian.org>  Mon, 27 Aug 2018 13:41:16 +0200
+
 tomcat8 (8.5.32-2) unstable; urgency=medium
 
   * Team upload.

debian/control

@@ -24,7 +24,7 @@ Build-Depends:
  lsb-release,
  maven-repo-helper,
  po-debconf
-Standards-Version: 4.2.0
+Standards-Version: 4.2.1
 Vcs-Git: https://salsa.debian.org/java-team/tomcat8.git
 Vcs-Browser: https://salsa.debian.org/java-team/tomcat8
 Homepage: http://tomcat.apache.org

debian/patches/0025-invalid-configuration-exit-status.patch

@@ -3,7 +3,7 @@ Author: Emmanuel Bourg <ebourg@apache.org>
 Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=62607
 --- a/java/org/apache/catalina/startup/Bootstrap.java
 +++ b/java/org/apache/catalina/startup/Bootstrap.java
-@@ -490,6 +490,10 @@
+@@ -490,6 +490,10 @@ public final class Bootstrap {
              } else if (command.equals("start")) {
                  daemon.setAwait(true);
                  daemon.load(args);
@@ -12,5 +12,5 @@ Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=62607
 +                    System.exit(1);
 +                }
                  daemon.start();
-             } else if (command.equals("stop")) {
-                 daemon.stopServer(args);
+                 if (null == daemon.getServer()) {
+                     System.exit(1);

java/javax/el/ImportHandler.java

@@ -19,9 +19,11 @@ package javax.el;
 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
-import java.util.ArrayList;
-import java.util.List;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
 /**
@@ -29,7 +31,242 @@ import java.util.concurrent.ConcurrentHashMap;
  */
 public class ImportHandler {
 
-    private List<String> packageNames = new ArrayList<>();
+    private static final Map<String,Set<String>> standardPackages = new HashMap<>();
+
+    static {
+        // Servlet 4.0
+        Set<String> servletClassNames = new HashSet<>();
+        // Interfaces
+        servletClassNames.add("AsyncContext");
+        servletClassNames.add("AsyncListener");
+        servletClassNames.add("Filter");
+        servletClassNames.add("FilterChain");
+        servletClassNames.add("FilterConfig");
+        servletClassNames.add("FilterRegistration");
+        servletClassNames.add("FilterRegistration.Dynamic");
+        servletClassNames.add("ReadListener");
+        servletClassNames.add("Registration");
+        servletClassNames.add("Registration.Dynamic");
+        servletClassNames.add("RequestDispatcher");
+        servletClassNames.add("Servlet");
+        servletClassNames.add("ServletConfig");
+        servletClassNames.add("ServletContainerInitializer");
+        servletClassNames.add("ServletContext");
+        servletClassNames.add("ServletContextAttributeListener");
+        servletClassNames.add("ServletContextListener");
+        servletClassNames.add("ServletRegistration");
+        servletClassNames.add("ServletRegistration.Dynamic");
+        servletClassNames.add("ServletRequest");
+        servletClassNames.add("ServletRequestAttributeListener");
+        servletClassNames.add("ServletRequestListener");
+        servletClassNames.add("ServletResponse");
+        servletClassNames.add("SessionCookieConfig");
+        servletClassNames.add("SingleThreadModel");
+        servletClassNames.add("WriteListener");
+        // Classes
+        servletClassNames.add("AsyncEvent");
+        servletClassNames.add("GenericFilter");
+        servletClassNames.add("GenericServlet");
+        servletClassNames.add("HttpConstraintElement");
+        servletClassNames.add("HttpMethodConstraintElement");
+        servletClassNames.add("MultipartConfigElement");
+        servletClassNames.add("ServletContextAttributeEvent");
+        servletClassNames.add("ServletContextEvent");
+        servletClassNames.add("ServletInputStream");
+        servletClassNames.add("ServletOutputStream");
+        servletClassNames.add("ServletRequestAttributeEvent");
+        servletClassNames.add("ServletRequestEvent");
+        servletClassNames.add("ServletRequestWrapper");
+        servletClassNames.add("ServletResponseWrapper");
+        servletClassNames.add("ServletSecurityElement");
+        // Enums
+        servletClassNames.add("DispatcherType");
+        servletClassNames.add("SessionTrackingMode");
+        // Exceptions
+        servletClassNames.add("ServletException");
+        servletClassNames.add("UnavailableException");
+        standardPackages.put("javax.servlet", servletClassNames);
+
+        // Servlet 4.0
+        Set<String> servletHttpClassNames = new HashSet<>();
+        // Interfaces
+        servletHttpClassNames.add("HttpServletMapping");
+        servletHttpClassNames.add("HttpServletRequest");
+        servletHttpClassNames.add("HttpServletResponse");
+        servletHttpClassNames.add("HttpSession");
+        servletHttpClassNames.add("HttpSessionActivationListener");
+        servletHttpClassNames.add("HttpSessionAttributeListener");
+        servletHttpClassNames.add("HttpSessionBindingListener");
+        servletHttpClassNames.add("HttpSessionContext");
+        servletHttpClassNames.add("HttpSessionIdListener");
+        servletHttpClassNames.add("HttpSessionListener");
+        servletHttpClassNames.add("HttpUpgradeHandler");
+        servletHttpClassNames.add("Part");
+        servletHttpClassNames.add("PushBuilder");
+        servletHttpClassNames.add("WebConnection");
+        // Classes
+        servletHttpClassNames.add("Cookie");
+        servletHttpClassNames.add("HttpFilter");
+        servletHttpClassNames.add("HttpServlet");
+        servletHttpClassNames.add("HttpServletRequestWrapper");
+        servletHttpClassNames.add("HttpServletResponseWrapper");
+        servletHttpClassNames.add("HttpSessionBindingEvent");
+        servletHttpClassNames.add("HttpSessionEvent");
+        servletHttpClassNames.add("HttpUtils");
+        // Enums
+        servletHttpClassNames.add("MappingMatch");
+        standardPackages.put("javax.servlet.http", servletHttpClassNames);
+
+        // JSP 2.3
+        Set<String> servletJspClassNames = new HashSet<>();
+        //Interfaces
+        servletJspClassNames.add("HttpJspPage");
+        servletJspClassNames.add("JspApplicationContext");
+        servletJspClassNames.add("JspPage");
+        // Classes
+        servletJspClassNames.add("ErrorData");
+        servletJspClassNames.add("JspContext");
+        servletJspClassNames.add("JspEngineInfo");
+        servletJspClassNames.add("JspFactory");
+        servletJspClassNames.add("JspWriter");
+        servletJspClassNames.add("PageContext");
+        servletJspClassNames.add("Exceptions");
+        servletJspClassNames.add("JspException");
+        servletJspClassNames.add("JspTagException");
+        servletJspClassNames.add("SkipPageException");
+        standardPackages.put("javax.servlet.jsp", servletJspClassNames);
+
+        Set<String> javaLangClassNames = new HashSet<>();
+        // Taken from Java 11 EA18 Javadoc
+        // Interfaces
+        javaLangClassNames.add("Appendable");
+        javaLangClassNames.add("AutoCloseable");
+        javaLangClassNames.add("CharSequence");
+        javaLangClassNames.add("Cloneable");
+        javaLangClassNames.add("Comparable");
+        javaLangClassNames.add("Iterable");
+        javaLangClassNames.add("ProcessHandle");
+        javaLangClassNames.add("ProcessHandle.Info");
+        javaLangClassNames.add("Readable");
+        javaLangClassNames.add("Runnable");
+        javaLangClassNames.add("StackWalker.StackFrame");
+        javaLangClassNames.add("System.Logger");
+        javaLangClassNames.add("Thread.UncaughtExceptionHandler");
+        //Classes
+        javaLangClassNames.add("Boolean");
+        javaLangClassNames.add("Byte");
+        javaLangClassNames.add("Character");
+        javaLangClassNames.add("Character.Subset");
+        javaLangClassNames.add("Character.UnicodeBlock");
+        javaLangClassNames.add("Class");
+        javaLangClassNames.add("ClassLoader");
+        javaLangClassNames.add("ClassValue");
+        javaLangClassNames.add("Compiler");
+        javaLangClassNames.add("Double");
+        javaLangClassNames.add("Enum");
+        javaLangClassNames.add("Float");
+        javaLangClassNames.add("InheritableThreadLocal");
+        javaLangClassNames.add("Integer");
+        javaLangClassNames.add("Long");
+        javaLangClassNames.add("Math");
+        javaLangClassNames.add("Module");
+        javaLangClassNames.add("ModuleLayer");
+        javaLangClassNames.add("ModuleLayer.Controller");
+        javaLangClassNames.add("Number");
+        javaLangClassNames.add("Object");
+        javaLangClassNames.add("Package");
+        javaLangClassNames.add("Process");
+        javaLangClassNames.add("ProcessBuilder");
+        javaLangClassNames.add("ProcessBuilder.Redirect");
+        javaLangClassNames.add("Runtime");
+        javaLangClassNames.add("Runtime.Version");
+        javaLangClassNames.add("RuntimePermission");
+        javaLangClassNames.add("SecurityManager");
+        javaLangClassNames.add("Short");
+        javaLangClassNames.add("StackTraceElement");
+        javaLangClassNames.add("StackWalker");
+        javaLangClassNames.add("StrictMath");
+        javaLangClassNames.add("String");
+        javaLangClassNames.add("StringBuffer");
+        javaLangClassNames.add("StringBuilder");
+        javaLangClassNames.add("System");
+        javaLangClassNames.add("System.LoggerFinder");
+        javaLangClassNames.add("Thread");
+        javaLangClassNames.add("ThreadGroup");
+        javaLangClassNames.add("ThreadLocal");
+        javaLangClassNames.add("Throwable");
+        javaLangClassNames.add("Void");
+        //Enums
+        javaLangClassNames.add("Character.UnicodeScript");
+        javaLangClassNames.add("ProcessBuilder.Redirect.Type");
+        javaLangClassNames.add("StackWalker.Option");
+        javaLangClassNames.add("System.Logger.Level");
+        javaLangClassNames.add("Thread.State");
+        //Exceptions
+        javaLangClassNames.add("ArithmeticException");
+        javaLangClassNames.add("ArrayIndexOutOfBoundsException");
+        javaLangClassNames.add("ArrayStoreException");
+        javaLangClassNames.add("ClassCastException");
+        javaLangClassNames.add("ClassNotFoundException");
+        javaLangClassNames.add("CloneNotSupportedException");
+        javaLangClassNames.add("EnumConstantNotPresentException");
+        javaLangClassNames.add("Exception");
+        javaLangClassNames.add("IllegalAccessException");
+        javaLangClassNames.add("IllegalArgumentException");
+        javaLangClassNames.add("IllegalCallerException");
+        javaLangClassNames.add("IllegalMonitorStateException");
+        javaLangClassNames.add("IllegalStateException");
+        javaLangClassNames.add("IllegalThreadStateException");
+        javaLangClassNames.add("IndexOutOfBoundsException");
+        javaLangClassNames.add("InstantiationException");
+        javaLangClassNames.add("InterruptedException");
+        javaLangClassNames.add("LayerInstantiationException");
+        javaLangClassNames.add("NegativeArraySizeException");
+        javaLangClassNames.add("NoSuchFieldException");
+        javaLangClassNames.add("NoSuchMethodException");
+        javaLangClassNames.add("NullPointerException");
+        javaLangClassNames.add("NumberFormatException");
+        javaLangClassNames.add("ReflectiveOperationException");
+        javaLangClassNames.add("RuntimeException");
+        javaLangClassNames.add("SecurityException");
+        javaLangClassNames.add("StringIndexOutOfBoundsException");
+        javaLangClassNames.add("TypeNotPresentException");
+        javaLangClassNames.add("UnsupportedOperationException");
+        //Errors
+        javaLangClassNames.add("AbstractMethodError");
+        javaLangClassNames.add("AssertionError");
+        javaLangClassNames.add("BootstrapMethodError");
+        javaLangClassNames.add("ClassCircularityError");
+        javaLangClassNames.add("ClassFormatError");
+        javaLangClassNames.add("Error");
+        javaLangClassNames.add("ExceptionInInitializerError");
+        javaLangClassNames.add("IllegalAccessError");
+        javaLangClassNames.add("IncompatibleClassChangeError");
+        javaLangClassNames.add("InstantiationError");
+        javaLangClassNames.add("InternalError");
+        javaLangClassNames.add("LinkageError");
+        javaLangClassNames.add("NoClassDefFoundError");
+        javaLangClassNames.add("NoSuchFieldError");
+        javaLangClassNames.add("NoSuchMethodError");
+        javaLangClassNames.add("OutOfMemoryError");
+        javaLangClassNames.add("StackOverflowError");
+        javaLangClassNames.add("ThreadDeath");
+        javaLangClassNames.add("UnknownError");
+        javaLangClassNames.add("UnsatisfiedLinkError");
+        javaLangClassNames.add("UnsupportedClassVersionError");
+        javaLangClassNames.add("VerifyError");
+        javaLangClassNames.add("VirtualMachineError");
+        //Annotation Types
+        javaLangClassNames.add("Deprecated");
+        javaLangClassNames.add("FunctionalInterface");
+        javaLangClassNames.add("Override");
+        javaLangClassNames.add("SafeVarargs");
+        javaLangClassNames.add("SuppressWarnings");
+        standardPackages.put("java.lang", javaLangClassNames);
+
+    }
+
+    private Map<String,Set<String>> packageNames = new ConcurrentHashMap<>();
     private ConcurrentHashMap<String,String> classNames = new ConcurrentHashMap<>();
     private Map<String,Class<?>> clazzes = new ConcurrentHashMap<>();
     private Map<String,Class<?>> statics = new ConcurrentHashMap<>();
@@ -127,7 +364,11 @@ public class ImportHandler {
         // a) for sake of performance when used in JSPs (BZ 57142),
         // b) java.lang.Package.getPackage(name) is not reliable (BZ 57574),
         // c) such check is not required by specification.
-        packageNames.add(name);
+        Set<String> preloaded = standardPackages.get(name);
+        if (preloaded == null) {
+            preloaded = Collections.emptySet();
+        }
+        packageNames.put(name, preloaded);
     }
 
 
@@ -159,8 +400,17 @@ public class ImportHandler {
 
         // Search the package imports - note there may be multiple matches
         // (which correctly triggers an error)
-        for (String p : packageNames) {
-            className = p + '.' + name;
+        for (Map.Entry<String,Set<String>> entry : packageNames.entrySet()) {
+            if (!entry.getValue().isEmpty()) {
+                // Standard package where we know all the class names
+                if (!entry.getValue().contains(name)) {
+                    // Requested name isn't in the list so it isn't in this
+                    // package so move on to next package. This allows the
+                    // class loader look-up to be skipped.
+                    continue;
+                }
+            }
+            className = entry.getKey() + '.' + name;
             Class<?> clazz = findClass(className, false);
             if (clazz != null) {
                 if (result != null) {

java/javax/servlet/resources/XMLSchema.dtd

@@ -33,7 +33,7 @@
      are defined in XML Schema: Part 2: Datatypes -->
 <!ENTITY % xs-datatypes PUBLIC 'datatypes' 'datatypes.dtd' >
 
-<!ENTITY % p 'xs:'> <!-- can be overriden in the internal subset of a
+<!ENTITY % p 'xs:'> <!-- can be overridden in the internal subset of a
                          schema document to establish a different
                          namespace prefix -->
 <!ENTITY % s ':xs'> <!-- if %p is defined (e.g. as foo:) then you must
@@ -170,7 +170,7 @@
           %complexTypeAttrs;>
 
 <!-- particleAndAttrs is shorthand for a root type -->
-<!-- mixed is disallowed if simpleContent, overriden if complexContent
+<!-- mixed is disallowed if simpleContent, overridden if complexContent
      has one too. -->
 
 <!-- If anyAttribute appears in one or more referenced attributeGroups

java/javax/servlet/resources/j2ee_web_services_client_1_1.xsd

@@ -188,7 +188,7 @@
           <xsd:documentation>
 
             The service-qname element declares the specific WSDL service
-            element that is being refered to.  It is not specified if no
+            element that is being referred to.  It is not specified if no
             wsdl-file is declared.
 
           </xsd:documentation>

java/javax/servlet/resources/web-jsptaglibrary_1_1.dtd

@@ -35,7 +35,7 @@ jspversion  the version of JSP the tag library depends upon
 
 shortname   a simple default short name that could be used by
             a JSP authoring tool to create names with a mnemonic
-            value; for example, the it may be used as the prefered
+            value; for example, the it may be used as the preferred
             prefix value in taglib directives
 uri         a uri uniquely identifying this taglib
 info        a simple string describing the "use" of this taglib,

java/javax/servlet/resources/web-jsptaglibrary_1_2.dtd

@@ -50,7 +50,7 @@ jsp-version     the version of JSP the tag library depends upon
 
 short-name      a simple default short name that could be used by
                 a JSP authoring tool to create names with a mnemonic
-                value; for example, the it may be used as the prefered
+                value; for example, the it may be used as the preferred
                 prefix value in taglib directives
 
 uri             a uri uniquely identifying this taglib