From bfce9939ea94e522c7a5d05329013de48ca6d4ca Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Oct 20 2019 18:39:46 +0000
Subject: import apache-commons-collections-3.2.1-22.el7_2


---

diff --git a/.apache-commons-collections.metadata b/.apache-commons-collections.metadata
new file mode 100644
index 0000000..302cfa7
--- /dev/null
+++ b/.apache-commons-collections.metadata
@@ -0,0 +1 @@
+6925f4a487d58538a4d3ef11d63aefdd66ee2405 SOURCES/commons-collections-3.2.1-src.tar.gz
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..f1bfe99
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+SOURCES/commons-collections-3.2.1-src.tar.gz
diff --git a/SOURCES/CVE-2015-7501.patch b/SOURCES/CVE-2015-7501.patch
new file mode 100644
index 0000000..79b3153
--- /dev/null
+++ b/SOURCES/CVE-2015-7501.patch
@@ -0,0 +1,513 @@
+diff --git a/src/java/org/apache/commons/collections/functors/CloneTransformer.java b/src/java/org/apache/commons/collections/functors/CloneTransformer.java
+index 7200402..3df18ff 100644
+--- a/src/java/org/apache/commons/collections/functors/CloneTransformer.java
++++ b/src/java/org/apache/commons/collections/functors/CloneTransformer.java
+@@ -16,6 +16,9 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.io.IOException;
++import java.io.ObjectInputStream;
++import java.io.ObjectOutputStream;
+ import java.io.Serializable;
+ 
+ import org.apache.commons.collections.Transformer;
+@@ -24,6 +27,16 @@ import org.apache.commons.collections.Transformer;
+  * Transformer implementation that returns a clone of the input object.
+  * <p>
+  * Clone is performed using <code>PrototypeFactory.getInstance(input).create()</code>.
++ * <p>
++ * <b>WARNING:</b> This class will throw an
++ * {@link UnsupportedOperationException} when trying to serialize or
++ * de-serialize an instance to prevent potential remote code execution exploits.
++ * <p>
++ * In order to re-enable serialization support for {@code CloneTransformer}
++ * the following system property can be used (via -Dproperty=true):
++ * <pre>
++ * org.apache.commons.collections.enableUnsafeSerialization
++ * </pre>
+  * 
+  * @since Commons Collections 3.0
+  * @version $Revision: 646777 $ $Date: 2008-04-10 13:33:15 +0100 (Thu, 10 Apr 2008) $
+@@ -68,4 +81,21 @@ public class CloneTransformer implements Transformer, Serializable {
+         return PrototypeFactory.getInstance(input).create();
+     }
+ 
++    /**
++     * Overrides the default writeObject implementation to prevent
++     * serialization (see COLLECTIONS-580).
++     */
++    private void writeObject(ObjectOutputStream os) throws IOException {
++        FunctorUtils.checkUnsafeSerialization(CloneTransformer.class);
++        os.defaultWriteObject();
++    }
++
++    /**
++     * Overrides the default readObject implementation to prevent
++     * de-serialization (see COLLECTIONS-580).
++     */
++    private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++        FunctorUtils.checkUnsafeSerialization(CloneTransformer.class);
++        is.defaultReadObject();
++    }
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/ForClosure.java b/src/java/org/apache/commons/collections/functors/ForClosure.java
+index f0355c4..e15475c 100644
+--- a/src/java/org/apache/commons/collections/functors/ForClosure.java
++++ b/src/java/org/apache/commons/collections/functors/ForClosure.java
+@@ -16,12 +16,25 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.io.IOException;
++import java.io.ObjectInputStream;
++import java.io.ObjectOutputStream;
+ import java.io.Serializable;
+ 
+ import org.apache.commons.collections.Closure;
+ 
+ /**
+  * Closure implementation that calls another closure n times, like a for loop.
++ * <p>
++ * <b>WARNING:</b> This class will throw an
++ * {@link UnsupportedOperationException} when trying to serialize or
++ * de-serialize an instance to prevent potential remote code execution exploits.
++ * <p>
++ * In order to re-enable serialization support for {@code ForClosure}
++ * the following system property can be used (via -Dproperty=true):
++ * <pre>
++ * org.apache.commons.collections.enableUnsafeSerialization
++ * </pre>
+  * 
+  * @since Commons Collections 3.0
+  * @version $Revision: 646777 $ $Date: 2008-04-10 13:33:15 +0100 (Thu, 10 Apr 2008) $
+@@ -102,4 +115,22 @@ public class ForClosure implements Closure, Serializable {
+         return iCount;
+     }
+ 
++    /**
++     * Overrides the default writeObject implementation to prevent
++     * serialization (see COLLECTIONS-580).
++     */
++    private void writeObject(ObjectOutputStream os) throws IOException {
++        FunctorUtils.checkUnsafeSerialization(ForClosure.class);
++        os.defaultWriteObject();
++    }
++
++    /**
++     * Overrides the default readObject implementation to prevent
++     * de-serialization (see COLLECTIONS-580).
++     */
++    private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++        FunctorUtils.checkUnsafeSerialization(ForClosure.class);
++        is.defaultReadObject();
++    }
++
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/FunctorUtils.java b/src/java/org/apache/commons/collections/functors/FunctorUtils.java
+index 75f8d9b..aa7bec3 100644
+--- a/src/java/org/apache/commons/collections/functors/FunctorUtils.java
++++ b/src/java/org/apache/commons/collections/functors/FunctorUtils.java
+@@ -16,6 +16,8 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.security.AccessController;
++import java.security.PrivilegedAction;
+ import java.util.Collection;
+ import java.util.Iterator;
+ 
+@@ -33,7 +35,11 @@ import org.apache.commons.collections.Transformer;
+  * @author Matt Benson
+  */
+ class FunctorUtils {
+-    
++
++    /** System property key to enable unsafe serialization */
++    final static String UNSAFE_SERIALIZABLE_PROPERTY
++        = "org.apache.commons.collections.enableUnsafeSerialization";
++
+     /**
+      * Restricted constructor.
+      */
+@@ -152,4 +158,33 @@ class FunctorUtils {
+         }
+     }
+ 
++    /**
++     * Package-private helper method to check if serialization support is
++     * enabled for unsafe classes.
++     *
++     * @param clazz  the clazz to check for serialization support
++     * @throws UnsupportedOperationException if unsafe serialization is disabled
++     */
++    static void checkUnsafeSerialization(Class clazz) {
++        String unsafeSerializableProperty;
++
++        try {
++            unsafeSerializableProperty = 
++                (String) AccessController.doPrivileged(new PrivilegedAction() {
++                    public Object run() {
++                        return System.getProperty(UNSAFE_SERIALIZABLE_PROPERTY);
++                    }
++                });
++        } catch (SecurityException ex) {
++            unsafeSerializableProperty = null;
++        }
++
++        if (!"true".equalsIgnoreCase(unsafeSerializableProperty)) {
++            throw new UnsupportedOperationException(
++                    "Serialization support for " + clazz.getName() + " is disabled for security reasons. " +
++                    "To enable it set system property '" + UNSAFE_SERIALIZABLE_PROPERTY + "' to 'true', " +
++                    "but you must ensure that your application does not de-serialize objects from untrusted sources.");
++        }
++    }
++
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/InstantiateFactory.java b/src/java/org/apache/commons/collections/functors/InstantiateFactory.java
+index 5d375de..938d6dc 100644
+--- a/src/java/org/apache/commons/collections/functors/InstantiateFactory.java
++++ b/src/java/org/apache/commons/collections/functors/InstantiateFactory.java
+@@ -16,6 +16,9 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.io.IOException;
++import java.io.ObjectInputStream;
++import java.io.ObjectOutputStream;
+ import java.io.Serializable;
+ import java.lang.reflect.Constructor;
+ import java.lang.reflect.InvocationTargetException;
+@@ -25,6 +28,16 @@ import org.apache.commons.collections.FunctorException;
+ 
+ /**
+  * Factory implementation that creates a new object instance by reflection.
++ * <p>
++ * <b>WARNING:</b> This class will throw an
++ * {@link UnsupportedOperationException} when trying to serialize or
++ * de-serialize an instance to prevent potential remote code execution exploits.
++ * <p>
++ * In order to re-enable serialization support for {@code InstantiateTransformer}
++ * the following system property can be used (via -Dproperty=true):
++ * <pre>
++ * org.apache.commons.collections.enableUnsafeSerialization
++ * </pre>
+  * 
+  * @since Commons Collections 3.0
+  * @version $Revision: 646777 $ $Date: 2008-04-10 13:33:15 +0100 (Thu, 10 Apr 2008) $
+@@ -136,5 +149,22 @@ public class InstantiateFactory implements Factory, Serializable {
+             throw new FunctorException("InstantiateFactory: Constructor threw an exception", ex);
+         }
+     }
+-    
++
++    /**
++     * Overrides the default writeObject implementation to prevent
++     * serialization (see COLLECTIONS-580).
++     */
++    private void writeObject(ObjectOutputStream os) throws IOException {
++        FunctorUtils.checkUnsafeSerialization(InstantiateFactory.class);
++        os.defaultWriteObject();
++    }
++
++    /**
++     * Overrides the default readObject implementation to prevent
++     * de-serialization (see COLLECTIONS-580).
++     */
++    private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++        FunctorUtils.checkUnsafeSerialization(InstantiateFactory.class);
++        is.defaultReadObject();
++    }
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/InstantiateTransformer.java b/src/java/org/apache/commons/collections/functors/InstantiateTransformer.java
+index 73d6b2f..4927f05 100644
+--- a/src/java/org/apache/commons/collections/functors/InstantiateTransformer.java
++++ b/src/java/org/apache/commons/collections/functors/InstantiateTransformer.java
+@@ -16,6 +16,9 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.io.IOException;
++import java.io.ObjectInputStream;
++import java.io.ObjectOutputStream;
+ import java.io.Serializable;
+ import java.lang.reflect.Constructor;
+ import java.lang.reflect.InvocationTargetException;
+@@ -25,6 +28,16 @@ import org.apache.commons.collections.Transformer;
+ 
+ /**
+  * Transformer implementation that creates a new object instance by reflection.
++ * <p>
++ * <b>WARNING:</b> This class will throw an
++ * {@link UnsupportedOperationException} when trying to serialize or
++ * de-serialize an instance to prevent potential remote code execution exploits.
++ * <p>
++ * In order to re-enable serialization support for {@code InstantiateTransformer}
++ * the following system property can be used (via -Dproperty=true):
++ * <pre>
++ * org.apache.commons.collections.enableUnsafeSerialization
++ * </pre>
+  * 
+  * @since Commons Collections 3.0
+  * @version $Revision: 646777 $ $Date: 2008-04-10 13:33:15 +0100 (Thu, 10 Apr 2008) $
+@@ -116,4 +129,22 @@ public class InstantiateTransformer implements Transformer, Serializable {
+         }
+     }
+ 
++    /**
++     * Overrides the default writeObject implementation to prevent
++     * serialization (see COLLECTIONS-580).
++     */
++    private void writeObject(ObjectOutputStream os) throws IOException {
++        FunctorUtils.checkUnsafeSerialization(InstantiateTransformer.class);
++        os.defaultWriteObject();
++    }
++
++    /**
++     * Overrides the default readObject implementation to prevent
++     * de-serialization (see COLLECTIONS-580).
++     */
++    private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++        FunctorUtils.checkUnsafeSerialization(InstantiateTransformer.class);
++        is.defaultReadObject();
++    }
++
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/InvokerTransformer.java b/src/java/org/apache/commons/collections/functors/InvokerTransformer.java
+index 6f60961..75f48af 100644
+--- a/src/java/org/apache/commons/collections/functors/InvokerTransformer.java
++++ b/src/java/org/apache/commons/collections/functors/InvokerTransformer.java
+@@ -16,6 +16,9 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.io.IOException;
++import java.io.ObjectInputStream;
++import java.io.ObjectOutputStream;
+ import java.io.Serializable;
+ import java.lang.reflect.InvocationTargetException;
+ import java.lang.reflect.Method;
+@@ -25,6 +28,16 @@ import org.apache.commons.collections.Transformer;
+ 
+ /**
+  * Transformer implementation that creates a new object instance by reflection.
++ * <p>
++ * <b>WARNING:</b> This class will throw an
++ * {@link UnsupportedOperationException} when trying to serialize or
++ * de-serialize an instance to prevent potential remote code execution exploits.
++ * <p>
++ * In order to re-enable serialization support for {@code InvokerTransformer}
++ * the following system property can be used (via -Dproperty=true):
++ * <pre>
++ * org.apache.commons.collections.enableUnsafeSerialization
++ * </pre>
+  * 
+  * @since Commons Collections 3.0
+  * @version $Revision: 646777 $ $Date: 2008-04-10 13:33:15 +0100 (Thu, 10 Apr 2008) $
+@@ -134,4 +147,21 @@ public class InvokerTransformer implements Transformer, Serializable {
+         }
+     }
+ 
++    /**
++     * Overrides the default writeObject implementation to prevent
++     * serialization (see COLLECTIONS-580).
++     */
++    private void writeObject(ObjectOutputStream os) throws IOException {
++        FunctorUtils.checkUnsafeSerialization(InvokerTransformer.class);
++        os.defaultWriteObject();
++    }
++
++    /**
++     * Overrides the default readObject implementation to prevent
++     * de-serialization (see COLLECTIONS-580).
++     */
++    private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++        FunctorUtils.checkUnsafeSerialization(InvokerTransformer.class);
++        is.defaultReadObject();
++    }
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/PrototypeFactory.java b/src/java/org/apache/commons/collections/functors/PrototypeFactory.java
+index 4fa4150..d9908fa 100644
+--- a/src/java/org/apache/commons/collections/functors/PrototypeFactory.java
++++ b/src/java/org/apache/commons/collections/functors/PrototypeFactory.java
+@@ -49,6 +49,16 @@ public class PrototypeFactory {
+      * <li>public copy constructor
+      * <li>serialization clone
+      * <ul>
++     * <p>
++     * <b>WARNING:</b> This method will return a {@code Factory}
++     * that will throw an {@link UnsupportedOperationException} when trying to serialize
++     * or de-serialize it to prevent potential remote code execution exploits.
++     * <p>
++     * In order to re-enable serialization support the following system property
++     * can be used (via -Dproperty=true):
++     * <pre>
++     * org.apache.commons.collections.enableUnsafeSerialization
++     * </pre>
+      *
+      * @param prototype  the object to clone each time in the factory
+      * @return the <code>prototype</code> factory
+@@ -144,6 +154,24 @@ public class PrototypeFactory {
+                 throw new FunctorException("PrototypeCloneFactory: Clone method threw an exception", ex);
+             }
+         }
++
++        /**
++         * Overrides the default writeObject implementation to prevent
++         * serialization (see COLLECTIONS-580).
++         */
++        private void writeObject(ObjectOutputStream os) throws IOException {
++            FunctorUtils.checkUnsafeSerialization(PrototypeCloneFactory.class);
++            os.defaultWriteObject();
++        }
++
++        /**
++         * Overrides the default readObject implementation to prevent
++         * de-serialization (see COLLECTIONS-580).
++         */
++        private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++            FunctorUtils.checkUnsafeSerialization(PrototypeCloneFactory.class);
++            is.defaultReadObject();
++        }
+     }
+ 
+     // PrototypeSerializationFactory
+@@ -204,6 +232,24 @@ public class PrototypeFactory {
+                 }
+             }
+         }
++
++        /**
++         * Overrides the default writeObject implementation to prevent
++         * serialization (see COLLECTIONS-580).
++         */
++        private void writeObject(ObjectOutputStream os) throws IOException {
++            FunctorUtils.checkUnsafeSerialization(PrototypeSerializationFactory.class);
++            os.defaultWriteObject();
++        }
++
++        /**
++         * Overrides the default readObject implementation to prevent
++         * de-serialization (see COLLECTIONS-580).
++         */
++        private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++            FunctorUtils.checkUnsafeSerialization(PrototypeSerializationFactory.class);
++            is.defaultReadObject();
++        }
+     }
+ 
+ }
+diff --git a/src/java/org/apache/commons/collections/functors/WhileClosure.java b/src/java/org/apache/commons/collections/functors/WhileClosure.java
+index 853e83a..596afc8 100644
+--- a/src/java/org/apache/commons/collections/functors/WhileClosure.java
++++ b/src/java/org/apache/commons/collections/functors/WhileClosure.java
+@@ -16,6 +16,9 @@
+  */
+ package org.apache.commons.collections.functors;
+ 
++import java.io.IOException;
++import java.io.ObjectInputStream;
++import java.io.ObjectOutputStream;
+ import java.io.Serializable;
+ 
+ import org.apache.commons.collections.Closure;
+@@ -24,6 +27,16 @@ import org.apache.commons.collections.Predicate;
+ /**
+  * Closure implementation that executes a closure repeatedly until a condition is met,
+  * like a do-while or while loop.
++ * <p>
++ * <b>WARNING:</b> This class will throw an
++ * {@link UnsupportedOperationException} when trying to serialize or
++ * de-serialize an instance to prevent potential remote code execution exploits.
++ * <p>
++ * In order to re-enable serialization support for {@code WhileClosure}
++ * the following system property can be used (via -Dproperty=true):
++ * <pre>
++ * org.apache.commons.collections.enableUnsafeSerialization
++ * </pre>
+  * 
+  * @since Commons Collections 3.0
+  * @version $Revision: 646777 $ $Date: 2008-04-10 13:33:15 +0100 (Thu, 10 Apr 2008) $
+@@ -120,4 +133,22 @@ public class WhileClosure implements Closure, Serializable {
+         return iDoLoop;
+     }
+ 
++    /**
++     * Overrides the default writeObject implementation to prevent
++     * serialization (see COLLECTIONS-580).
++     */
++    private void writeObject(ObjectOutputStream os) throws IOException {
++        FunctorUtils.checkUnsafeSerialization(WhileClosure.class);
++        os.defaultWriteObject();
++    }
++
++    /**
++     * Overrides the default readObject implementation to prevent
++     * de-serialization (see COLLECTIONS-580).
++     */
++    private void readObject(ObjectInputStream is) throws ClassNotFoundException, IOException {
++        FunctorUtils.checkUnsafeSerialization(WhileClosure.class);
++        is.defaultReadObject();
++    }
++
+ }
+diff --git a/src/test/org/apache/commons/collections/TestFactoryUtils.java b/src/test/org/apache/commons/collections/TestFactoryUtils.java
+index 0895903..bc7d729 100644
+--- a/src/test/org/apache/commons/collections/TestFactoryUtils.java
++++ b/src/test/org/apache/commons/collections/TestFactoryUtils.java
+@@ -136,15 +136,6 @@ public class TestFactoryUtils extends junit.framework.TestCase {
+         Object created = factory.create();
+         assertTrue(proto != created);
+         assertEquals(proto, created);
+-        
+-        // check serialisation works
+-        ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+-        ObjectOutputStream out = new ObjectOutputStream(buffer);
+-        out.writeObject(factory);
+-        out.close();
+-        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(buffer.toByteArray()));
+-        Object dest = in.readObject();
+-        in.close();
+     }
+ 
+     public void testPrototypeFactoryPublicCopyConstructor() throws Exception {
+@@ -154,23 +145,6 @@ public class TestFactoryUtils extends junit.framework.TestCase {
+         Object created = factory.create();
+         assertTrue(proto != created);
+         assertEquals(proto, created);
+-        
+-        // check serialisation works
+-        ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+-        ObjectOutputStream out = new ObjectOutputStream(buffer);
+-        try {
+-            out.writeObject(factory);
+-        } catch (NotSerializableException ex) {
+-            out.close();
+-        }
+-        factory = FactoryUtils.prototypeFactory(new Mock2("S"));
+-        buffer = new ByteArrayOutputStream();
+-        out = new ObjectOutputStream(buffer);
+-        out.writeObject(factory);
+-        out.close();
+-        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(buffer.toByteArray()));
+-        Object dest = in.readObject();
+-        in.close();
+     }
+ 
+     public void testPrototypeFactoryPublicSerialization() throws Exception {
+@@ -180,15 +154,6 @@ public class TestFactoryUtils extends junit.framework.TestCase {
+         Object created = factory.create();
+         assertTrue(proto != created);
+         assertEquals(proto, created);
+-        
+-        // check serialisation works
+-        ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+-        ObjectOutputStream out = new ObjectOutputStream(buffer);
+-        out.writeObject(factory);
+-        out.close();
+-        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(buffer.toByteArray()));
+-        Object dest = in.readObject();
+-        in.close();
+     }
+ 
+     public void testPrototypeFactoryPublicSerializationError() {
diff --git a/SOURCES/commons-collections-3.2-build_xml.patch b/SOURCES/commons-collections-3.2-build_xml.patch
new file mode 100644
index 0000000..c9169f1
--- /dev/null
+++ b/SOURCES/commons-collections-3.2-build_xml.patch
@@ -0,0 +1,20 @@
+--- build.xml.orig	2008-11-29 21:16:01.000000000 +0200
++++ build.xml	2008-11-29 21:17:28.000000000 +0200
+@@ -286,7 +286,7 @@
+   <!-- Runs all tests -->
+   <target name="-test-all" depends="compile.tests" unless="testcase">
+     <mkdir dir="${build.test.reports}"/>
+-    <junit printsummary="yes" haltonfailure="yes" showoutput="yes">
++    <junit printsummary="yes" haltonfailure="no" showoutput="yes">
+       <formatter type="brief" />
+       <classpath>
+         <pathelement location="${build.classes}"/>
+@@ -331,7 +331,7 @@
+   <target name="testjar"  depends="compile.tests,jar"
+           description="Run all unit test cases">
+     <echo message="Running collections tests against built jar ..."/>
+-    <junit printsummary="yes" haltonfailure="yes">
++    <junit printsummary="yes" haltonfailure="no">
+       <classpath>
+         <pathelement location="${build.jar.name}"/>
+         <pathelement location="${build.tests}"/>
diff --git a/SOURCES/jakarta-commons-collections-javadoc-nonet.patch b/SOURCES/jakarta-commons-collections-javadoc-nonet.patch
new file mode 100644
index 0000000..1dcb47a
--- /dev/null
+++ b/SOURCES/jakarta-commons-collections-javadoc-nonet.patch
@@ -0,0 +1,26 @@
+--- commons-collections-3.1/build.xml~	2004-06-23 00:17:14.000000000 +0100
++++ commons-collections-3.1/build.xml	2005-05-04 13:58:44.000000000 +0100
+@@ -80,7 +80,6 @@
+ 
+   <!-- Javadoc -->
+   <property name="javadoc.access"          value="protected"/>
+-  <property name="javadoc.links"           value="http://java.sun.com/j2se/1.3/docs/api/"/>
+ 
+   <!-- JUnit -->
+   <property name="test.failonerror"        value="true"/>
+@@ -362,7 +361,6 @@
+                  author="true"
+                 version="true"
+                     use="true"
+-                   link="${javadoc.links}"
+                overview="${source.java}/org/apache/commons/collections/overview.html"
+                doctitle="${component.title} ${component.version} API;"
+             windowtitle="${component.title} ${component.version} API"
+@@ -470,7 +468,6 @@
+                  access="protected"
+                  author="false"
+                 version="false"
+-                   link="${javadoc.links}"
+                overview="${source.test}/org/apache/commons/collections/overview.html"
+                doctitle="${tf.title} ${tf.version} API;"
+             windowtitle="${tf.title} ${tf.version} API"
diff --git a/SPECS/apache-commons-collections.spec b/SPECS/apache-commons-collections.spec
new file mode 100644
index 0000000..cd658ac
--- /dev/null
+++ b/SPECS/apache-commons-collections.spec
@@ -0,0 +1,199 @@
+%global base_name       collections
+%global short_name      commons-%{base_name}
+
+Name:           apache-%{short_name}
+Version:        3.2.1
+Release:        22%{?dist}
+Summary:        Provides new interfaces, implementations and utilities for Java Collections
+License:        ASL 2.0
+Group:          Development/Libraries
+URL:            http://commons.apache.org/%{base_name}/
+Source0:        http://www.apache.org/dist/commons/%{base_name}/source/%{short_name}-%{version}-src.tar.gz
+
+Patch0:         jakarta-%{short_name}-javadoc-nonet.patch
+Patch4:         commons-collections-3.2-build_xml.patch
+Patch5:         CVE-2015-7501.patch
+
+BuildArch:      noarch
+
+BuildRequires: java-devel
+BuildRequires: jpackage-utils
+BuildRequires: maven-local
+BuildRequires: maven-antrun-plugin
+BuildRequires: maven-assembly-plugin
+BuildRequires: maven-compiler-plugin
+BuildRequires: maven-jar-plugin
+BuildRequires: maven-javadoc-plugin
+BuildRequires: maven-install-plugin
+BuildRequires: maven-resources-plugin
+BuildRequires: maven-doxia-sitetools
+BuildRequires: maven-plugin-bundle
+BuildRequires: maven-surefire-plugin
+BuildRequires: maven-surefire-provider-junit
+BuildRequires: ant
+BuildRequires: apache-commons-parent >= 26-7
+
+Provides:       jakarta-%{short_name} = %{version}-%{release}
+Obsoletes:      jakarta-%{short_name} < %{version}-%{release}
+Obsoletes:      %{name}-tomcat5 < %{version}-%{release}
+
+%description
+The introduction of the Collections API by Sun in JDK 1.2 has been a
+boon to quick and effective Java programming. Ready access to powerful
+data structures has accelerated development by reducing the need for
+custom container classes around each core object. Most Java2 APIs are
+significantly easier to use because of the Collections API.
+However, there are certain holes left unfilled by Sun's
+implementations, and the Jakarta-Commons Collections Component strives
+to fulfill them. Among the features of this package are:
+- special-purpose implementations of Lists and Maps for fast access
+- adapter classes from Java1-style containers (arrays, enumerations) to
+Java2-style collections.
+- methods to test or create typical set-theory properties of collections
+such as union, intersection, and closure.
+
+%package testframework
+Summary:        Testframework for %{name}
+Group:          Development/Tools
+Requires:       %{name} = %{version}-%{release}
+Provides:       jakarta-%{short_name}-testframework = %{version}-%{release}
+Obsoletes:      jakarta-%{short_name}-testframework < %{version}-%{release}
+
+%description testframework
+%{summary}.
+
+%package javadoc
+Summary:        Javadoc for %{name}
+Group:          Documentation
+Provides:       jakarta-%{short_name}-javadoc = %{version}-%{release}
+Obsoletes:      jakarta-%{short_name}-javadoc < %{version}-%{release}
+
+%description javadoc
+%{summary}.
+
+%package testframework-javadoc
+Summary:        Javadoc for %{name}-testframework
+Group:          Documentation
+Provides:       jakarta-%{short_name}-testframework-javadoc = %{version}-%{release}
+Obsoletes:      jakarta-%{short_name}-testframework-javadoc < %{version}-%{release}
+
+%description testframework-javadoc
+%{summary}.
+
+%prep
+
+%setup -q -n %{short_name}-%{version}-src
+# remove all binary libs
+find . -name "*.jar" -exec rm -f {} \;
+
+%patch0 -p1
+%patch4 -b .sav
+%patch5 -p1
+
+# Fix file eof
+%{__sed} -i 's/\r//' LICENSE.txt
+%{__sed} -i 's/\r//' PROPOSAL.html
+%{__sed} -i 's/\r//' RELEASE-NOTES.html
+%{__sed} -i 's/\r//' README.txt
+%{__sed} -i 's/\r//' NOTICE.txt
+
+%mvn_file : %{name} %{short_name}
+%mvn_alias : "org.apache.commons:%{short_name}"
+
+%build
+%mvn_build
+
+ant tf.javadoc
+
+%install
+%mvn_install
+
+# this JAR doesn't have POM file
+install -Dm 644 target/%{short_name}-testframework-%{version}.jar $RPM_BUILD_ROOT%{_javadir}/%{name}-testframework.jar
+ln -sr $RPM_BUILD_ROOT%{_javadir}/%{name}-testframework.jar $RPM_BUILD_ROOT%{_javadir}/%{short_name}-testframework.jar
+
+# testframework-javadoc
+install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-testframework
+cp -pr build/docs/testframework/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-testframework
+
+%files -f .mfiles
+%doc PROPOSAL.html README.txt LICENSE.txt RELEASE-NOTES.html NOTICE.txt
+
+%files testframework
+%{_javadir}/%{name}-testframework.jar
+%{_javadir}/%{short_name}-testframework.jar
+
+%files javadoc -f .mfiles-javadoc
+%doc LICENSE.txt NOTICE.txt
+
+%files testframework-javadoc
+%{_javadocdir}/%{name}-testframework
+%doc LICENSE.txt NOTICE.txt
+
+
+%changelog
+* Fri Nov 20 2015 Michal Srb <msrb@redhat.com> - 3.2.1-22
+- Fix Java object de-serialization vulnerability
+- Resolves: CVE-2015-7501
+
+* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 3.2.1-21
+- Mass rebuild 2013-12-27
+
+* Fri Sep 20 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.2.1-20
+- Add BuildRequires on apache-commons-parent >= 26-7
+
+* Mon Aug 26 2013 Michal Srb <msrb@redhat.com> - 3.2.1-19
+- Migrate away from mvn-rpmbuild (Resolves: #997509)
+
+* Fri Jun 28 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.2.1-18
+- Rebuild to regenerate API documentation
+- Resolves: CVE-2013-1571
+
+* Mon Apr 29 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.2.1-17
+- Remove unneeded BR: maven-idea-plugin
+
+* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2.1-16
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Wed Feb 06 2013 Java SIG <java-devel@lists.fedoraproject.org> - 3.2.1-15
+- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
+- Replace maven BuildRequires with maven-local
+
+* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2.1-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Wed Feb 08 2012 Jaromir Capik <jcapik@redhat.com> 3.2.1-13
+- saxon dependency removed - not needed
+- minor spec file changes according to the latest guidelines
+
+* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2.1-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Mon Jun 6 2011 Chris Spike <spike@fedoraproject.org> 3.2.1-11
+- Added *-testframework depmap entries.
+
+* Wed Mar 16 2011 Alexander Kurtakov <akurtako@redhat.com> 3.2.1-10
+- Drop tomcat5 subpackage.
+
+* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2.1-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Mon Nov 8 2010 Alexander Kurtakov <akurtako@redhat.com> 3.2.1-8
+- Add commons-collections:commons-collections depmap.
+
+* Mon Oct 4 2010 Alexander Kurtakov <akurtako@redhat.com> 3.2.1-7
+- Fix pom name.
+- Use newer maven plugins names.
+
+* Tue Aug 30 2010 Carl Green <carlgreen at gmail.com> - 3.2.1-6
+- Change package to own files in directories, not the directories
+
+* Mon Aug 30 2010 Carl Green <carlgreen at gmail.com> - 3.2.1-5
+- Remove source and patches no longer needed for Maven
+- Fix non-standard groups and remove empty sections
+- Fix file permissions
+
+* Sat Aug 28 2010 Carl Green <carlgreen at gmail.com> - 3.2.1-4
+- Renamed from jakarta-commons-collections
+- Updated to use maven2
+- Replaced saxon:group instruction with xsl:for-each-group in pom-maven2jpp-newdepmap.xsl