Merge remote-tracking branch 'origin/main' into fix/tomcat-context-path

Author: stokpop

docs/container-java_main.md

@@ -25,6 +25,25 @@ If the application uses Spring, [Spring profiles][] can be specified by setting
 
 If `java_main_class` is set to one of Spring Boot's launchers (`JarLauncher`, `PropertiesLauncher` or `WarLauncher`), the Java Main Container sets `SERVER_PORT=$PORT` so that the application binds to the CF-assigned port.
 
+## CF Tasks
+
+The buildpack emits both `web` and `task` process types with the same command so `cf run-task` works without `--command`.
+
+To run a task with a different main class (batch job, migration, etc.), set `java_main_class` to Spring Boot's `PropertiesLauncher` at staging time:
+
+```yaml
+env:
+  JBP_CONFIG_JAVA_MAIN: '{java_main_class: "org.springframework.boot.loader.launch.PropertiesLauncher"}'
+```
+
+Then override the main class per task at run time (requires CF CLI v7+):
+
+```bash
+cf run-task my-app --env JAVA_OPTS="-Dloader.main=com.example.BatchJob"
+```
+
+`-Dloader.main` is a Spring Boot `PropertiesLauncher` system property -- the buildpack passes it through to the JVM unchanged. `JBP_CONFIG_JAVA_MAIN` is a staging-time setting that applies to both `web` and `task`; `-Dloader.main` is a per-task runtime override.
+
 ## Configuration
 For general information on configuring the buildpack, including how to specify configuration values through environment variables, refer to [Configuration and Extension][].
 

docs/container-spring_boot.md

@@ -17,6 +17,19 @@ The container expects to run the application creating by running [`gradle distZi
 
 If the application uses Spring, [Spring profiles][] can be specified by setting the [`SPRING_PROFILES_ACTIVE`][] environment variable. This is automatically detected and used by Spring. The Spring Auto-reconfiguration Framework will specify the `cloud` profile in addition to any others. 
 
+## CF Tasks
+
+The buildpack includes a `task` process type in the release output using the same command as `web`, so `cf run-task` works without an explicit `--command`.
+
+```bash
+cf run-task my-app              # uses the task process type command
+cf run-task my-app --command "..." # explicit override
+```
+
+To run a task with a different main class (batch job, migration, etc.), see [Java Main Container - CF Tasks][java-main-tasks].
+
+[java-main-tasks]: container-java_main.md#cf-tasks
+
 ## Configuration
 The Spring Boot Container cannot be configured.
 

manifest.yml

@@ -295,22 +295,22 @@ dependencies:
   source: https://repo1.maven.org/maven2/org/cloudfoundry/container-security-provider/1.20.0/container-security-provider-1.20.0-RELEASE.jar
   source_sha256: e791ccfcfee9c0d299d07474d9bfcbfcbebf1181323be601220c8a823062ab99
 - name: contrast-security
-  version: 6.30.1
-  uri: https://buildpacks.cloudfoundry.org/dependencies/contrast-security/contrast-security_6.30.1_linux_noarch_any-stack_52b78e02.jar
-  sha256: 52b78e029439d8ce9d3bfde0e93f224948d4bed1dcf1a7e4d22d35cc80dc386a
+  version: 6.31.0
+  uri: https://buildpacks.cloudfoundry.org/dependencies/contrast-security/contrast-security_6.31.0_linux_noarch_any-stack_0c176385.jar
+  sha256: 0c1763850f31734e3514713cfe78dc5d95ea276561b4dc42c6f1272c112c1a86
   cf_stacks:
   - cflinuxfs4
   - cflinuxfs5
-  source: https://repo1.maven.org/maven2/com/contrastsecurity/contrast-agent/6.30.1/contrast-agent-6.30.1.jar
+  source: https://repo1.maven.org/maven2/com/contrastsecurity/contrast-agent/6.31.0/contrast-agent-6.31.0.jar
   source_sha256: ''
 - name: datadog-javaagent
-  version: 1.63.0
-  uri: https://buildpacks.cloudfoundry.org/dependencies/datadog-javaagent/datadog-javaagent_1.63.0_linux_noarch_any-stack_6a8df6bb.jar
-  sha256: 6a8df6bb668bb2ca4318112a9c39e99737663fe1eb887cab02f9f46b59f7418a
+  version: 1.63.1
+  uri: https://buildpacks.cloudfoundry.org/dependencies/datadog-javaagent/datadog-javaagent_1.63.1_linux_noarch_any-stack_b1266db2.jar
+  sha256: b1266db2aa6f5dda9673eb6b8c23e21f2cd262dffbee19ee55972f13cbfab98d
   cf_stacks:
   - cflinuxfs4
   - cflinuxfs5
-  source: https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/1.63.0/dd-java-agent-1.63.0.jar
+  source: https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/1.63.1/dd-java-agent-1.63.1.jar
   source_sha256: ''
 - name: elastic-apm-agent
   version: 1.56.0

scripts/unit.sh

@@ -14,6 +14,8 @@ function main() {
   local src
   src="$(find "${ROOTDIR}/src" -mindepth 1 -maxdepth 1 -type d )"
 
+  echo "bash: ${BASH_VERSION}"
+
   util::tools::ginkgo::install --directory "${ROOTDIR}/.bin"
   util::tools::buildpack-packager::install --directory "${ROOTDIR}/.bin"
 

src/java/finalize/finalize.go

@@ -280,10 +280,12 @@ func (f *Finalizer) writeReleaseYaml(container containers.Container) error {
 	}
 
 	releaseYamlPath := filepath.Join(tmpDir, "java-buildpack-release-step.yml")
+	escapedCommand := strings.ReplaceAll(fullCommand, "'", "''")
 	yamlContent := fmt.Sprintf(`---
 default_process_types:
   web: '%s'
-`, fullCommand)
+  task: '%s'
+`, escapedCommand, escapedCommand)
 
 	if err := os.WriteFile(releaseYamlPath, []byte(yamlContent), 0644); err != nil {
 		return fmt.Errorf("failed to write release YAML: %w", err)

src/java/finalize/finalize_test.go

@@ -1,16 +1,18 @@
 package finalize_test
 
 import (
-	"github.com/cloudfoundry/java-buildpack/src/internal/mocks"
-	"github.com/golang/mock/gomock"
 	"os"
 	"path/filepath"
+	"regexp"
 	"time"
 
+	"github.com/cloudfoundry/java-buildpack/src/internal/mocks"
 	"github.com/cloudfoundry/java-buildpack/src/java/finalize"
 	"github.com/cloudfoundry/libbuildpack"
+	"github.com/golang/mock/gomock"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	"gopkg.in/yaml.v2"
 )
 
 var _ = Describe("Finalize", func() {
@@ -243,6 +245,50 @@ dependencies: []
 		})
 	})
 
+	Describe("Release YAML", func() {
+		BeforeEach(func() {
+			os.Setenv("JBP_CONFIG_JAVA_MAIN", "{java_main_class: com.example.App}")
+			finalizer.JREName = "OpenJDK"
+			finalizer.ContainerName = "Java Main"
+		})
+
+		AfterEach(func() {
+			os.Unsetenv("JBP_CONFIG_JAVA_MAIN")
+		})
+
+		It("emits web and task process types with identical commands", func() {
+			Expect(finalize.Run(finalizer)).To(Succeed())
+			content, err := os.ReadFile(filepath.Join(buildDir, "tmp", "java-buildpack-release-step.yml"))
+			Expect(err).NotTo(HaveOccurred())
+
+			re := regexp.MustCompile(`(?m)^\s+(web|task):\s+'(.+)'$`)
+			matches := re.FindAllStringSubmatch(string(content), -1)
+			Expect(matches).To(HaveLen(2), "expected both web and task process types")
+
+			commands := map[string]string{}
+			for _, m := range matches {
+				commands[m[1]] = m[2]
+			}
+			Expect(commands).To(HaveKey("web"))
+			Expect(commands).To(HaveKey("task"))
+			Expect(commands["web"]).To(Equal(commands["task"]))
+		})
+
+		It("escapes single quotes in commands so release YAML is valid", func() {
+			os.Setenv("JBP_CONFIG_JAVA_MAIN", `{java_main_class: com.example.App, arguments: "--message=it's alive"}`)
+			Expect(finalize.Run(finalizer)).To(Succeed())
+			content, err := os.ReadFile(filepath.Join(buildDir, "tmp", "java-buildpack-release-step.yml"))
+			Expect(err).NotTo(HaveOccurred())
+
+			var parsed struct {
+				DefaultProcessTypes map[string]string `yaml:"default_process_types"`
+			}
+			Expect(yaml.Unmarshal(content, &parsed)).To(Succeed(), "release YAML must be valid")
+			Expect(parsed.DefaultProcessTypes["web"]).To(ContainSubstring("it's alive"))
+			Expect(parsed.DefaultProcessTypes["task"]).To(ContainSubstring("it's alive"))
+		})
+	})
+
 	Describe("javaexec launcher installation", func() {
 		It("installs launcher from buildpack bin/ for packaged buildpack usage", func() {
 			// Default path: <buildpackDir>/bin/javaexec already written in BeforeEach.

src/java/frameworks/java_opts_writer.go

@@ -140,14 +140,7 @@ case "$USER_JAVA_OPTS" in
         ;;
 esac
 
-# Escape replacement-special chars once; these values are loop-invariant.
-_escaped_deps_dir="${DEPS_DIR//\\/\\\\}"
-_escaped_deps_dir="${_escaped_deps_dir//&/\\&}"
-_escaped_home="${HOME//\\/\\\\}"
-_escaped_home="${_escaped_home//&/\\&}"
 _user_java_opts_placeholder='__JAVA_OPTS_BUILDPACK_PLACEHOLDER__'
-_escaped_user_java_opts="${USER_JAVA_OPTS//\\/\\\\}"
-_escaped_user_java_opts="${_escaped_user_java_opts//&/\\&}"
 
 if [ -d "$DEPS_DIR/%s/java_opts" ]; then
     for opts_file in "$DEPS_DIR/%s/java_opts"/*.opts; do
@@ -159,11 +152,22 @@ if [ -d "$DEPS_DIR/%s/java_opts" ]; then
             # a literal $VAR to the JVM (Ruby buildpack parity).
             opts_content="${opts_content//\\\$/$_escaped_dollar_placeholder}"
 
-            # Expand $DEPS_DIR and $HOME using bash parameter expansion.
-            # In ${var//pattern/repl}, '&' and '\' are special in replacement strings,
-            # so escape them first to preserve literal path contents.
-            opts_content="${opts_content//\$DEPS_DIR/$_escaped_deps_dir}"
-            opts_content="${opts_content//\$HOME/$_escaped_home}"
+            # Replace $DEPS_DIR and $HOME using string-split, not ${//}: bash 4.x, 5.1.x
+            # and 5.2.x differ in how '&' and '\' in replacement variables are handled,
+            # causing literal \& and \\ in output on bash 5.1 (cflinuxfs4).
+            _rest="$opts_content"; opts_content=""
+            while [[ "$_rest" == *'$DEPS_DIR'* ]]; do
+                opts_content+="${_rest%%%%'$DEPS_DIR'*}${DEPS_DIR}"
+                _rest="${_rest#*'$DEPS_DIR'}"
+            done
+            opts_content+="$_rest"
+
+            _rest="$opts_content"; opts_content=""
+            while [[ "$_rest" == *'$HOME'* ]]; do
+                opts_content+="${_rest%%%%'$HOME'*}${HOME}"
+                _rest="${_rest#*'$HOME'}"
+            done
+            opts_content+="$_rest"
 
             # Resolve the trusted $(nproc) token to the computed processor count.
             opts_content="${opts_content//\$\(nproc\)/$_nproc_count}"
@@ -194,8 +198,21 @@ if [ -d "$DEPS_DIR/%s/java_opts" ]; then
                     ;;
             esac
 
-            # Now safely substitute JAVA_OPTS after expansion (preserves quotes, backslashes, and ampersands)
-            opts_content="${opts_content//$_user_java_opts_placeholder/$_escaped_user_java_opts}"
+            # Restore USER_JAVA_OPTS via string-split, not ${//}: bash 4.x and 5.x
+            # treat '\\' in replacement strings differently, corrupting backslashes.
+            # %%%% / # are pure string ops — no special-char interpretation, any bash.
+            # Pre-count occurrences so the loop is bounded even if USER_JAVA_OPTS
+            # itself contained the placeholder string (infinite-loop defence).
+            # Counting uses empty replacement — no backslash in replacement, safe.
+            # Handles multiple occurrences (e.g. user config "$JAVA_OPTS -Xmx512m"
+            # with from_environment:true produces "$JAVA_OPTS -Xmx512m $JAVA_OPTS").
+            _stripped="${opts_content//"$_user_java_opts_placeholder"/}"
+            _placeholder_count=$(( (${#opts_content} - ${#_stripped}) / ${#_user_java_opts_placeholder} ))
+            for (( _i=0; _i<_placeholder_count; _i++ )); do
+                _before="${opts_content%%%%"$_user_java_opts_placeholder"*}"
+                _after="${opts_content#*"$_user_java_opts_placeholder"}"
+                opts_content="${_before}${USER_JAVA_OPTS}${_after}"
+            done
             
             if [ -n "$opts_content" ]; then
                 JAVA_OPTS="$JAVA_OPTS $opts_content"

src/java/frameworks/java_opts_writer_test.go

@@ -370,6 +370,15 @@ var _ = Describe("Java Opts Writer", func() {
 			Expect(output).To(ContainSubstring(`-Dpath=C:\\double`))
 		})
 
+		It("replaces all occurrences of $JAVA_OPTS when opts file contains it twice", func() {
+			// Scenario: JBP_CONFIG_JAVA_OPTS: '{java_opts: "$JAVA_OPTS -Xmx512m", from_environment: true}'
+			// produces opts file: "$JAVA_OPTS -Xmx512m $JAVA_OPTS" — two placeholders
+			output, err := runScript(`-Dfoo=bar`, "$JAVA_OPTS -Xmx512m $JAVA_OPTS")
+			Expect(err).NotTo(HaveOccurred(), "script failed with output: %s", output)
+			Expect(strings.Count(output, "-Dfoo=bar")).To(Equal(2))
+			Expect(output).NotTo(ContainSubstring("__JAVA_OPTS_BUILDPACK_PLACEHOLDER__"))
+		})
+
 		// Full invocation cycle tests for issue #1301:
 		// Verify that javaexec tokenizes $JAVA_OPTS without a shell, so glob chars,
 		// pipes, and shell metacharacters are never expanded or executed.

src/java/resources/files/tomcat/conf/server.xml

@@ -20,7 +20,7 @@
 
     <Service name='Catalina'>
         <Connector port='${http.port}' bindOnInit='false' connectionTimeout='20000' keepAliveTimeout='120000'>
-            <UpgradeProtocol className='org.apache.coyote.http2.Http2Protocol' />
+            <UpgradeProtocol className='org.apache.coyote.http2.Http2Protocol' allowSchemeMismatch='true'/>
         </Connector>
 
         <Engine defaultHost='localhost' name='Catalina'>