Dear maintainer,

this is a heads-up to let you know that jetty9 has reached its
end-of-life and will not receive official upstream security support anymore.

I plan to package a supported jetty version this release cycle which
will replace jetty9 eventually. At the moment jetty 11 seems to be the
best version because it supports the Jakarta servlet API but this is
not finally decided yet.

It seems trapperkeeper-webserver-jetty9-clojure is tightly coupled
with puppetdb and jetty9 is currently the only supported version.
Please prepare for the removal of jetty9 during the trixie release
cycle. If this is not feasible then there will be no security support
for jetty9 and thus puppetdb anymore.

Regards,

Markus

 >

I've started working on packaging Puppet 8 and noticed that upstream has
moved on to jetty10 via the trapperkeeper-webserver-jetty10 library.

So moving on from jetty9 for trixie should be fine, but I'm worried
about compatibility with jetty11 if that ends up being the version
chosen for trixie.

In any event, let me know, because I'm now pretty much blocked on that.

Thanks.

Hello,

Am Mittwoch, dem 14.02.2024 um 09:48 -0500 schrieb Jérôme Charaoui:

I intend to package Jetty 12 soon. According to upstream Jetty 12 is the only
supported version going forward while Jetty 10 and Jetty 11 are already EOL
since 01.01.2024.

https://eclipse.dev/jetty/download.php

You probably have to maintain a separate Jetty package just for Puppet because
I doubt that Jetty 12 would be compatible with trapperkeeper-webserver-jetty10.
but we can take a look at that when Jetty 12 arrives in Debian. The best way
forward is to convince the Puppet developers to switch to Jetty 12 in my
opinion.

Regards,

Markus

Hi Markus,

Le 2024-02-14 à 16 h 06, Markus Koschany a écrit :

With the trixie freeze coming up fast, I was wondering if that's still
your plan? As far as I can tell, Jetty 9 is still the only version in
Debian currently.

I think It's unlikely Puppet upstream will make the switch, because as
far as I know development has more or less stopped, and a community fork
(OpenVox) is (slowly) taking over development, but I doubt that will be
one of their priorities since they aim to ship all this stuff (jetty9
included) bundled in their own .deb package, like the previous upstream.

I'm a little worried that if Jetty 12 (or whatever other version is
chosen) lands in Debian and Jetty 9 is removed very near the freeze, I
might not have much time to fix the Puppet packages...

Thanks,