Bug#1110075: tomcat9: Regression in 9.0.107-0+deb11u1 breaks startup and applications

[Roland Tapken]

Package: tomcat9
Version: 9.0.43-2~deb11u10
Severity: important
X-Debbugs-Cc: dev+debian at cybso.de

After upgrading from (9.0.43-2~deb11u12 to 9.0.107-0+deb11u1, the startup
failed with:

> Unrecognized VM option 'CMSPermGenSweepingEnabled'

After removing that option the unchanged application fails with:

>   org.springframework.beans.factory.BeanCreationException: Error creating
>   bean with name 'reportDefinitionRegistry' defined in ServletContext
>   resource [/WEB-INF/applicationContext.xml]: Invocation of init method
>   failed; nested exception is javax.xml.bind.JAXBException: Implementation
>   of JAXB-API has not been found on module path or classpath.
>  - with linked exception:
>       [java.lang.ClassNotFoundException:
>        com.sun.xml.internal.bind.v2.ContextFactory
> ...
> Caused by: java.lang.ClassNotFoundException: 
>    com.sun.xml.internal.bind.v2.ContextFactory
> at org.apache.catalina.loader.WebappClassLoaderBase.loadClass
>     (WebappClassLoaderBase.java:1354)
> at org.apache.catalina.loader.WebappClassLoaderBase.loadClass
>     (WebappClassLoaderBase.java:1163)
> at javax.xml.bind.ServiceLoaderUtil.nullSafeLoadClass
>     (ServiceLoaderUtil.java:122)
> at javax.xml.bind.ServiceLoaderUtil.safeLoadClass
> at javax.xml.bind.ContextFinder.newInstance(ContextFinder.java:276)
>     
>         ... 59 more

Our /etc/default/tomcat9 is:

> JAVA_HOME=/usr/lib/jvm/temurin-8-jre-amd64
> JAVA_OPTS="-Djava.awt.headless=true -XX:+UseConcMarkSweepGC -Xms1024m"
> JAVA_OPTS="${JAVA_OPTS} -Xmx10240m -XX:MaxPermSize=1024M "
> JAVA_OPTS="${JAVA_OPTS} -XX:+CMSClassUnloadingEnabled"
> JAVA_OPTS="${JAVA_OPTS} -XX:+CMSPermGenSweepingEnabled"
> JAVA_OPTS="${JAVA_OPTS} -Dlog4j2.formatMsgNoLookups=true"

While temurin-8-jre was also upgraded from 8.0.452.0.0+9 to 8.0.462.0.0+8 I've
traced down that this regression is only related to the upgrade of the tomcat9
packages and not to the temurin version.

-- System Information:
Debian Release: 11.11
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500,
'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-35-amd64 (SMP w/2 CPU threads)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not
set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages tomcat9 depends on:
ii  lsb-base        11.1.0
ii  systemd         247.3-7+deb11u6
ii  tomcat9-common  9.0.43-2~deb11u10
ii  ucf             3.0043+deb11u2

Versions of packages tomcat9 recommends:
ii  libtcnative-1  1.2.26-1

Versions of packages tomcat9 suggests:
pn  tomcat9-admin     <none>
pn  tomcat9-docs      <none>
pn  tomcat9-examples  <none>
pn  tomcat9-user      <none>

-- no debconf information