nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Does a stand alone installation stops you from applying Tomcat security updates?

anatole farci

Hi,

I'm new to JIRA and not a Tomcat person but I was told that one of the benefits of using WAR installations vs. Stand alone/installer is that if we have to deploy any Tomcat security updates, using the stand alone, it would be harder.

Working a little in the Websphere and WAR files on another application, my understanding is that it should in irrelevant. While I understand that the OS Tomcat installation vs. JIRA stand alone might place the binaries in different folders, etc. but does the stand alone really makes Tomcat updates that much harder? I figured in worst case, one would export/build a WAR file of the current JIRA, update tomcat and re-import the saved WAR file in case the Tomcat patch updated any JIRA data/binaries.

Thanks

Anatole

Accepted answers

LucasA

Hi Anatole,

Atlassian also ships the latest Tomcat version with JIRA standalone. Since we have a JIRA version every 2 weeks, in a worst case scenario you would have a 14 days gap between a new Tomcat version and a new JIRA release. If this is a problem for you, a EAR/WAR deployment would fit better for your needs, but it's a little bit more complex than the JIRA automatic installer. Since you are already experienced with WebSphere, the process shouldn't be that hard.

Best regards,
Lucas Timm

All comments

Timothy

You should be able to apply the security updates for Tomcat. The release of JIRA is built into Tomcat and you can override the libs.

LucasA

Hi Anatole,

Best regards,
Lucas Timm

anatole farci

Lucas,
we might not be able to upgrade as often but perhaps when a security patch comes along, we may take that option even if requires us additional testing of plug-ins and other functionality.But I'm not very clear from your answer and Timothy's if I have to have a WAR deployment in order to deploy Tomcat fixpacks or can I still go with Linux Installer and only update Tomcat as/when needed.
Does the Installer create special Tomcat folders that a generic Tomcat patch can't find and update OR is it that the Installer placed some JIRA files into Tomcat's folder and the patch would override it?
thanks

VitalyA

While this is not a supported configuration, upgrading Tomcat for security patches never broke anything on my memory.

anatole farci

Hi Vitaly, I'm asuming that you are using the Installer option since the WAR option works for one of our groups and doesn't break anything but I wanted to confirm that the installer option doesn't do anything special to make Tomcat patching a burden as our team is in favor of using the Installer. thx

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

jira-administration

tomcat

security

install

ear-war