Installing Adobe ColdFusion (2016 release) hotfix

There seems to be a bug in ColdFusion Administrator when you click of Download and Install, the download happens, but the installation does not start. 

In such a situation, confirm the following:

Linux: When you run ps -ef | grep hf, you should see the following in the console:

/opt/coldfusion2016/jre/bin/java -jar /opt/coldfusion2016/cfusion/hf-updates/hotfix_002.jar -i silent -f /opt/coldfusion2016/cfusion/hf-updates/hf-10-00002.properties

Windows: Ensure that java.exe process runs (from the TaskManager window).

If the procedures mentioned above for both Linux and Windows do not work, click the Install button again.

All efforts are taken to ensure that it does not happen. However,there could be external factors that influence your system.

As soon as hotfix installation starts, stopping the sever(s) first is the core thing that happens before hotfix files are applied on the server(s). The same must happen for un-installation as well. Unless this is done, nothing proceeds. If the server is in a state where you cannot stop the server, installation/un-installation can become unresponsive.

ColdFusion server(s) use ports 8007 and above to shut itself down. If for some reason, another service or server occupies the ports, then you cannot stop the ColdFusion server unless you kill the process.

Kill both the installer/uninstaller and the server, and reinstall or uninstall.

If you apply the hotfix from ColdFusion Administrator, ensure that the ColdFusion server starts only with appropriate start/stop privileges. The hotfix installer runs with the same privileges and server start/stop happens automatically in the background.

For Mac/Unix/Solaris users:

When the server starts using /bin/coldfusion script, the script starts the server with the RUNTIME USER that the ColdFusion start/stop script mentions. The default user that is shown while installing ColdFusion is nobody. If you have any other user while installing, the server runs as that user.

When you apply the hotfix from the ColdFusion Administrator, it restarts the server with the same user as it was running with which makes your server secure. If your server runs as nobody before the hotfix, the server starts with the user nobody even after applying the hotfix.

All other hotfix operations like stopping the server and then applying the hotfix are successful except the 'Start Server' operation that happens after applying the Hotfix.

As a workaround, stop the server which was improperly started manually and restart it once you apply the hotfix.

Launch the command prompt with Administrator privileges to start/stop the ColdFusion Windows Services.You know if have enough privileges when you run the JAR installer from the command prompt. 

Open a terminal and switch to Administrator privileges. You know if you have enough privileges when you run the installer.

If you are a sudo user, execute the installation. Enter the following command:

> sudo /opt/coldfusion2016/jre/bin/java -jar /opt/coldfusion2016/cfusion/hf-updates/hotfix_001.jar

Install it from the command prompt. There is no option to install it from ColdFusion Administrator. However, you can view the Available updates and Installed updates in the ColdFusion Administrator.

Download the hotfix from ColdFusion Administrator's Server Updates section. Since installing hotfix on J2EE server is a manual process, stop the ColdFusion instance first from your JEE application server.

The hotfix installer file is located at: <CFHome>\cfusion.war\WEB-INF\cfusion\hf-updates.

Open the command prompt and navigate to the directory named hf-updates. Type the command,

> C:\Program files\Java\jre\bin\java -jar hotfix_001.jar

This opens the installer which guides you through the installation of hotfix.

Once the installation completes, start ColdFusion server instance from your application server.

When you open the command prompt, it generally opens up with User Home directory. But if this directory has lot of files/directories under it (recursively), you have to cd to any other directory that has very few or no files/directories under it for launching the installer fast. If there are many files/directories, then Introduction screen will be shown a bit slowly and it might even just be stuck at Installer splash screen if your command prompt is at drive roots like C:\ or E:\

To avoid confusion, cd to the directory wherever hotfix installer jar (Ex:- hotfix_001.jar) is downloaded and then invoke the installation from command prompt.

> cd C:\ColdFusion2016\cfusion\hf-updates\

> C:\ColdFusion2016\jre\bin\java -jar C:\ColdFusion10\cfusion\hf-updates\hotfix_005.jar

1. If you want to run the hotfix installer from the command prompt, run the following command whenever you wish to install later in GUI or Console mode.
   >C:\ColdFusion2016\jre\bin\java -jar C:\ColdFusion10\cfusion\hf-updates\hotfix_001.jar
2. This is a mandatory step for applying hotfix to JEE CF instance. 
3. If you want to apply the hotfix using your organization's customary methods. Details on how to get it worked with customary methods is explained later.

It is good to stop the base application server (WebSphere) before applying the hotfix. Unless any ColdFusion files are locked by the base application server even after ColdFusion instances are stopped, this is not mandatory.

You can apply Hotfix using the above said command prompt installer only to the exploded ear/war deployments.

For applying the hotfix to unexploded ear, you have to first explode it and then apply it using the command prompt installer.

Once you apply it, you have to create a EAR/WAR file and then deploy it back.

If there is a ColdFusion service for which you have applied the hotfix, it will start the service.
If the service is not there for the ColdFusion instance, then it starts ColdFusion instance in the background.

It always starts the servers in the background.

The installer puts the log files under: C:\ColdFusion2016\cfusion\hf-updates\hf-10-00001\
Any modified/added/removed files are listed in the file named: hotfix_filelist.log in the above directory.
And the installation log with the name Adobe_ColdFusion_2016_Update_1***.log is also in the same directory.

Download the hotfix again and then install it.

OR 

Manually apply the update from the command prompt.

http://www.adobe.com/support/coldfusion/downloads_updates.html

1. Download the updater manually from the above URL and place the update JAR file in a directory.
2. Open the command prompt.
3. cd to C:\ColdFusion2016 and then run the command as follows:
   > C:\ColdFusion2016\jre\bin\jre\java -jar cf10_mdt_updt.jar
   Give full path of the file cf2016_mdt_updt.jar depending on where it is downloaded and follow the on-screen instructions.

In the command prompt, first change the directory to C:\ColdFusion2016 and then run the installer

> C:\ColdFusion10\jre\bin\jre\java -jar cf2016_mdt_updt.jar

In the above command, use the path of the jar file that you have downloaded.

Whenever there is modification to the updates file (due to build refresh), your browser might still be verifying the install jar's checksum with cached updates file that lists the checksum.

As a workaround, Ctrl+F5 to clear cache in your browser and then click  Check for Updates.
And now, if you try to Download and Install, it will all be fine.

There can be two reasons:

1. Your ColdFusion server is behind a proxy.
2. Your ColdFusion server is behind firewall.

If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Proxy settings can be specified using the below-mentioned system properties in the jvm.config (<ColdFusion_Home>\cfusion\bin\jvm.config) in case of stand-alone installation or corresponding script file for JEE installation.

• http.proxyHost
• http.proxyPort
• http.proxyUser
• http.proxyPassword

Template/Placing of these args for putting the above values is as follows:

-Dcoldfusion.home={application.home} -Dhttp.proxyHost=<host> -Dhttp.proxyPort=<port>

-Dhttp.proxyUser=<User> -Dhttp.proxyPassword=<Password>

As an option, set up your own local site. From a different machine where you can open http://www.adobe.com/go/coldfusion-updates/, first download the file http://download.adobe.com/pub/adobe/coldfusion/xml/updates.xml from your browser (Open it and use "Save Page as" option).

Then download the file http://download.adobe.com/pub/adobe/coldfusion/hotfix_001.jar from your browser.

The following set up is required only on one server.

Say, you want to use ColdFusion Server itself which is behind firewall for hosting these two files for making the local site:

Create a directory named updates under C:\ColdFusion2016\cfusion\wwwroot\. Then place the files hotfix_001.jar and updates.xml under C:\ColdFusion2016\cfusion\wwwroot\updates\

Then open the file updates.xml and update the value of the tag cfhf_downloadlink to your local URL (say http://<MachineIP>:<Server Port>/updates/hotfix_001.jar )

<cfhf_downloadlink>http://download.adobe.com/pub/adobe/coldfusion/hotfix_001.jar</cfhf_downloadlink>

Then open the ColdFusion Administrator for which you want to apply the hotfix.

And navigate to SERVER UPDATE -> Updates

Then change the Update Site/Site URL "http://www.adobe.com/go/coldfusion-updates/" to your local networks updates.xml path(http://<MachineIP>:<Server Port>/updates/updates.xml).

Once this is done you can use this URL instead of the default URL from any ColdFusion Administrator running within your local network.

Whenever hotfix is released, you will have to update this xml file and place the new hotfix JAR on your local site. 

Then verify that whatever you have done is working fine. To do this go to Available Updates under Updates link and click on Check for Updates . It should show you update depending on the Updates that are listed in the updates.xml file. Then try downloading the file by clicking on Download button.

This should download the file hotfix_001.jar (assuming the hotfix file name is that) to the Directory

C:\ColdFusion2016\cfusion\hf-updates\hotfix_001.jar.

The Administrator first creates the file named hf-10-00001.properties file at the same location as hotfix jar file. This file is used to invoke the hotfix installer. Once the installation is started, first thing it does is trying to stop the ColdFusion servers. Then it applies the hotfix and then restarts all the servers for stand-alone and multi-instance installations.

If you open your Task Manager window (Choose the option Show processes from all users in the Task Manager) in Windows machine, it has coldfusion.exe running and if you are running as service then both coldfusion.exe and coldfusionsvc.exe are there. 

So, if you have three ColdFusion 2016 services running, then there are total of six ColdFusion-related processes.

This hotfix installer stops one server after the other when 'coldfusion.exe stop' command is issued to the server. Even this process comes up in the Task Manager. Once the installation starts, you can view the processes in the Task Manager.

Once the installer puts the log file Adobe_ColdFusion_2016_Update_1_Install***.log in C:\ColdFusion2016\cfusion\hf-updates\hf-10-00001, installation is complete.

If you open the ColdFusion Administrator you should be able to access.

1. In Server Update > Updates > Installed Updates tab, the newly installed hotfix Update Level displays. If it is Update 1, it displays as 01.
2. In Server Settings > Settings Summary, the version gets updated to the new build number. (for example, the first update shows as 01)
3. Make sure the log file, Adobe_ColdFusion_2016_Update_1***.log in C:\ColdFusion2016\cfusion\hf-updates\hf-10-00001\, contains no errors.
4. When log in to the newly hotfix-applied ColdFusion Administrator, you should be asked for credentials to log in, which indicates that the server starts again after the hotfix. 

Yes, it changes. In System Information, the build number will be updated. In Version field, the new Update Level field shows the update number.

Under Available Updates, only the latest (not yet applied) HotFixes are listed.
For example, if hotfix update level 10 is applied on the server, and now say hotfix 12 is available and you have not applied Update 11, it shows only the hotfixes whose update level is more than 10. (that is, Update levels 11, 12 are shown) 

You can find the hotfix installation log in C:\ColdFusion2016\cfusion\hf-updates\hf-10-00002\Adobe_ColdFusion_10_Update_2_Install*.log depending on the instance you have applied the hotfix from.
If there are errors logged in this file, and if you want to re-run the installer to fix them you have can do the following:
After rectifying the root cause (like base app server stop for jee installation if files are locked by base app server), you can uninstall and then install it again or do the following.
In the following example is for update 2 change it according to your update. 
Copy the file C:\ColdFusion2016\cfusion\hf-updates\hf-10-00002\backup\hf-updates\updates.xml
to C:\ColdFusion2016\cfusion\hf-updates\updates.xml
This will make the update level to previous level and so you will be allowed to run the installation again. It is equivalent to updating the updates.xml file by removing the <item> node corresponding to the current hotfix.

If the steps above do not work, you can install the hotfix from command prompt.

> cd C:\ColdFusion2016\cfusion\hf-updates\

> C:\ColdFusion2016\jre\bin\java -jar C:\ColdFusion10\cfusion\hf-updates\hotfix_005.jar

1. Confirm whether the hotfix is getting downloaded by checking the file hotfix_006.jar at C:\ColdFusion2016\cfusion\hf-updates (File names and instance paths as per your case)
2. If this file exists, this means the hotfix installer is downloaded.
3. If you have any issues downloading the file, download the hotfix by entering: http://download.adobe.com/pub/adobe/coldfusion/hotfix_001.jar (Change the Hotfix Jar name according to your Hotfix) and try installing from command prompt.

To confirm if there is any error for downloading the file you can see the log at:

C:\ColdFusion2016\cfusion\logs\update.log

Case 1:-
If the bug fix is included in the publicly released Hotfix, you don't need to do anything. Hotfix installer itself takes care of all clean-up required. In general, it is always intended to be included.

Case 2:-
However, for some reason (say, due to timing of release), if a bug fix is not included into public hotfix, you have to apply back the fix manually to your ColdFusion Servers. But it is a rare case.

Uninstaller removes the files from all the server instances to whichever it is applied. If you have applied the hotfix to ColdFusion instances cfusion,cfusion1,cfusion2 at one go, when you invoke uninstallation from any of these instances it will uninstall from all the instances(cfusion,cfusion1,cfusion2). However, backup directory containing the original backed up files is left back for debug/backup purposes.

1. If you have installed from command prompt in Console or UI mode, you can run the following command.
First cd to C:\ColdFusion2016 and then run the following.
> C:\ColdFusion2016\jre\bin\java -jar \opt\coldfusion10\cfusion\hf-updates\hf-10-00002\uninstall\uninstaller.jar
(Modify the command according to your path/OS/Hotfix)

2. If you have installed it from ColdFusion Administrator you can run the following command
First cd to C:\ColdFusion2016 and then run the following.
> C:\ColdFusion2016\jre\bin\java -jar \opt\coldfusion10\cfusion\hf-updates\hf-10-00002\uninstall\uninstaller.jar -i SILENT

3. If you have installed the hotfix using silent installation on your own, uninstallation can also be done silently. Run the following command:                                                                               > C:\ColdFusion2016\jre\bin\java -jar \opt\coldfusion10\cfusion\hf-updates\hf-10-00002\uninstall\uninstaller.jar        

Even though you have installed hotfix to five instances using a single script, there is only one hotfix uninstaller for all these five instances for a given update (Usually this is under cfusion instance. It could be under other instance if cfusion was not opted for HF ). And when you invoke the above command it will uninstall hotfix from all the five instances.

The directory backs up all the files that are modified and removed. Even after un-installation this directory is kept back for any of your debug purposes.

This is also helpful when uninstaller does not work due to a corrupt uninstaller jar. You still a choice to revert the hotfix applied to previous state.

Any hotfix is cumulative of all the previous hotfixes. For example, if Update 2 is released and you have not applied Update ,1 then if you are just applying Update 2, Update 2 also contains what was released in Update 1. 

Yes, it is cumulative and contains the previous general hotfixes also.

This feature is available for all editions of ColdFusion - Developer, Enterprise, or Standard.

There are many limitations with Server Manager for applying the hotfixes to servers.
Hotfix notification and installation is a fully functional substitute to Server Manager which is very productive and can be applied just by accessing the ColdFusion Administrator.

When you access ColdFusion Default Server Instance (cfusion)'s Administrator, you can apply the hotfix to all the child instances of this main instance irrespective of whether they are in cluster or not.

No, you can apply the Hotfix to any number of instances of same installation on the same machine from the cfusion server instance's Administrator, but you cannot apply the hotfix to any ColdFusion instance on some other machine. You have to access that machine's default server instances' ColdFusion administrator to apply the hotfix to any ColdFusion instance.

No, you cannot. You can apply the hotfix to any child instance only from default server (cfusion)'s Administrator. 

However, you can apply to only that child instance from child instance's ColdFusion Administrator.

After downloading the instance, you can run them from command prompt and you can choose to apply only for particular instance that you wish.

You can also can apply the hotfix from a child instance’s Administrator.

The time taken to stop the server(s) + 10-20 seconds to apply the Hotfix depending on the machine's processor + time taken to start the server(s). It generally consumes 40 secs to 2 minutes depending on the number instances and speed.

When you apply the hotfixes to multi instances at one go, it has to stop all the servers and then only it proceeds. So, it takes more time.

It is recommended that once you start the installation, do not interrupt as the file operations will only be half-done if you do that. However, you can cancel it during pre-installation.

Re-run the installation. If the installer shows that it is already applied then you just copy the file C:\ColdFusion201610\cfusion\hf-updates\hf-10-00001\backup\hf-updates\updates.xml(Change the path according to your current Hotfix level) to C:\ColdFusion2016\cfusion\hf-updates\updates.xml by replacing it and then re-run the installation from ColdFusion Administrator or from command prompt.

No. There are no traditional hotfixes and manual steps since ColdFusion 10.

Hotfix installer takes care of auto-applying any type of files (Even the configuration files like jvm.config, Tomcat upgrades/Hotfixes required for ColdFusion 2016 except the jre as the installer itself runs on top of ColdFusion's jre.)

A new java process starts in the background.

In case of Windows, you can see it in the Task Manager.

For Unix/Linux platforms you can use ps -ef | grep hf  to find out.

For installation it displays as /opt/coldfusion2016/jre/bin/java -jar /opt/coldfusion10/cfusion/hf-updates/hotfix_002.jar -i silent -f /opt/coldfusion2016/cfusion/hf-updates/hf-10-00002.properties.

For uninstallation it displays as /opt/coldfusion2016/jre/bin/java -jar /opt/coldfusion2016/cfusion/hf-updates/hf-10-00002/uninstall/uninstaller.jar -i SILENT

Unless any specific hotfix needs any extra step there, you do not need any manual intervention.

For example, in case of Update 1, re-run the connector for external web servers.
If you have not applied Update 1 and are applying the Update 2, perform the manual steps after applying the Update 2.

List of special manual steps to be performed for each Update for ColdFusion 2016:

Update 1 (General) - http://helpx.adobe.com/coldfusion/kb/coldfusion2016-update-01.html
Rerun(Remove and add back) the connector for external Web servers.

Update 2 (Security) - http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb12-21.html
Do nothing. (But If you have not done the steps of Update 1 then Update 1 steps are required to be performed after applying Update 2).

Method 1(File Management with your Custom Scripts):
--------------------------------------------------------------------
If your organization has Scripts/Other Methods rather than applying from ColdFusion Administrator or from GUI/Console Installation  and wants only the Hotfix files that are Added/Modified/Deleted,  you can do that as well.

Step 1: Using your own customary scripts, first of all, you always will have to clear all the files under CF Instance\lib\updates from all your server instances.

Step 2: Then get the modified and added file list (of hotfix).
After downloading the Hotfix from the ColdFusion Administrator,

1. Open the command prompt

2. cd to C:\ColdFusion2016\cfusion\hf-updates.

3. Run the following:

> C:\ColdFusion2016\jre\bin\java -jar hotfix_001.jar -DINSTALL_FILES_OUTSIDE_CF=true 

This will put up the files under a location that you would have selected while installing.
In this example I have selected the path as C:\CF2016_HF1_Files while installing.
Under the directory C:\CF2016_HF1_Files\hf-updates\hf-10-00001 all the added and modified files are there. These files are maintained with the target directory structure required. So, you just have to drop this directory into your ColdFusion Instance Root (Say, C:\ColdFusion2016\cfusion\)

Combine the steps 1 and 2 in your scripts and move these wherever you want them to be moved by replacing the target files with always file-overwrite option.

If there are any changes for JVM.config file or to some of configuration XML files which has the chance of being modified by end customers themselves, those files are not laid out as said above.
For Update 1 there are no such changes. 

Method 2 ( Hotfix Silent Installation) :
-----------------------------------------------
Depending on your requirements sometimes even silent installation could also be useful.
After downloading the Hotfix from ColdFusion Administrator you can use that Hotfix installer jar file for silent installation on your own also.

Create a properties file and fill up with the following key/values depending on your installation.
INSTANCE_LIST value can be a list of comma-separated server instances that are created under a particular ColdFusion installation.

USER_INSTALL_DIR=C:$/$ColdFusion2016
INSTANCE_LIST=cfusion,cfusionprod2  
#COMMAND_INSTALL applies only to *INX based systems. 
COMMAND_INSTALL=true 
 
The parameter COMMAND_INSTALL=true makes sure that the server is started as ColdFusion runtime user(default is nobody) rather the root user. So, make sure to pass this param in Unix/Mac/Solaris machines.

On Non-Windows, value of USER_INSTALL_DIR looks as: $/$opt$/$coldfusion2016 ($/$ makes the installer to interpret the path properly depending on whether it is Windows or Non-Windows platform)

For JEE installation, USER_INSTALL_DIR value is the WAR directory containing CFIDE, WEB-INF and META-INF under it. An example is as follows:
C:$/$Jboss-6.1.0$/$server$/$default$/$deploy$/$cfusion.ear$/$cfusion.war
And the key INSTANCE_LIST  is NOT required at all for JEE.
-------------------------------------------------------------------------
You are ready to run the silent installation now.