From owner-freebsd-java@freebsd.org Sat Aug 10 19:35:32 2019 Return-Path: Delivered-To: freebsd-java@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B1E50C3D7C for ; Sat, 10 Aug 2019 19:35:32 +0000 (UTC) (envelope-from glewis@eyesbeyond.com) Received: from mailman.nyi.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id 465XQD3fCjz44K8 for ; Sat, 10 Aug 2019 19:35:32 +0000 (UTC) (envelope-from glewis@eyesbeyond.com) Received: by mailman.nyi.freebsd.org (Postfix) id 7D27FC3D7B; Sat, 10 Aug 2019 19:35:32 +0000 (UTC) Delivered-To: java@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 7CF2CC3D7A for ; Sat, 10 Aug 2019 19:35:32 +0000 (UTC) (envelope-from glewis@eyesbeyond.com) Received: from misty.eyesbeyond.com (gerbercreations.com [71.39.140.16]) by mx1.freebsd.org (Postfix) with ESMTP id 465XQC50Q6z44K7 for ; Sat, 10 Aug 2019 19:35:31 +0000 (UTC) (envelope-from glewis@eyesbeyond.com) Received: from misty.eyesbeyond.com (localhost.eyesbeyond.com [127.0.0.1]) by misty.eyesbeyond.com (8.15.2/8.15.2) with ESMTP id x7AJZU2A038535; Sat, 10 Aug 2019 12:35:30 -0700 (PDT) (envelope-from glewis@eyesbeyond.com) Received: (from glewis@localhost) by misty.eyesbeyond.com (8.15.2/8.15.2/Submit) id x7AJZTA9038534; Sat, 10 Aug 2019 12:35:29 -0700 (PDT) (envelope-from glewis@eyesbeyond.com) X-Authentication-Warning: misty.eyesbeyond.com: glewis set sender to glewis@eyesbeyond.com using -f Date: Sat, 10 Aug 2019 12:35:29 -0700 From: Greg Lewis To: Michael Osipov <1983-01-06@gmx.net> Cc: java@freebsd.org Subject: Re: RFC: Future of java/openjdk6 and java/openjdk7 Message-ID: <20190810193529.GA38493@misty.eyesbeyond.com> References: <20190802014149.GA59118@misty.eyesbeyond.com> <935ee70b-0f6e-1813-25c3-ced836143e32@gmx.net> <20190810183901.GA76800@misty.eyesbeyond.com> <22887160-4c94-9907-84f3-23fff562c239@gmx.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <22887160-4c94-9907-84f3-23fff562c239@gmx.net> User-Agent: Mutt/1.12.1 (2019-06-15) X-Rspamd-Queue-Id: 465XQC50Q6z44K7 X-Spamd-Bar: / Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of glewis@eyesbeyond.com has no SPF policy when checking 71.39.140.16) smtp.mailfrom=glewis@eyesbeyond.com X-Spamd-Result: default: False [0.38 / 15.00]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; MIME_GOOD(-0.10)[text/plain]; HAS_XAW(0.00)[]; DMARC_NA(0.00)[eyesbeyond.com]; AUTH_NA(1.00)[]; NEURAL_SPAM_MEDIUM(0.02)[0.020,0]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_HAM_SHORT(-0.89)[-0.894,0]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_SPAM_LONG(0.26)[0.261,0]; R_SPF_NA(0.00)[]; FREEMAIL_TO(0.00)[gmx.net]; RCVD_NO_TLS_LAST(0.10)[]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:209, ipnet:71.39.128.0/20, country:US]; RCVD_COUNT_TWO(0.00)[2]; IP_SCORE(-0.01)[asn: 209(0.01), country: US(-0.05)] X-BeenThere: freebsd-java@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Porting Java to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Aug 2019 19:35:32 -0000 On Sat, Aug 10, 2019 at 08:52:26PM +0200, Michael Osipov wrote: > Am 2019-08-10 um 20:39 schrieb Greg Lewis: > > On Fri, Aug 02, 2019 at 08:07:39AM +0200, Michael Osipov wrote: > >> Am 2019-08-02 um 03:41 schrieb Greg Lewis: > >>> Oracle ended official releases of JDK 7 in April of 2015, and JDK 6 even > >>> earlier. In the FreeBSD ports collection both java/openjdk6 and > >>> java/openjdk7 have fallen out of maintenance and are considerably behind > >>> in terms of updates (which likely include fixes for security > >>> vulnerabilities). In addition, openjdk6 will soon become unbuildable in > >>> FreeBSD 12-STABLE based on > >>> > >>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=234792 > >>> > >>> With OpenJDK 8 having been the default JDK for a number of years now, > >>> OpenJDK 11 and 12 both being available (and soon 13) I would suggest > >>> that both openjdk6 and openjdk7 be removed, along with any ports > >>> depending explicitly on them(*) which are unable to be updated to use a > >>> newer version. > >> > >> Being an Apache Maven PMC member and a happy FreeBSD user, we guarantee > >> that the entire Maven stack runs on top of Java 7+, so I run all > >> integration tests for all components I change on a regular basis on > >> several BSD boxes (home, work) to test compat outside of the monotonic > >> Windows/Linux world. > >> > >> Just because Oracle does not provide any binary packages for Java 7 it > >> does not meean that it is not supported. There are a lot of vendors > >> still providing Java 7 packages, e.g, Azul Systems, RHEL, HPE for HP-UX > >> (Java SE 7 is supported till July 2022 and Java SE 8 is supported till > >> March 2025) and likely others. > > > > Given this is the only response so far, I assume all are comfortable with > > removing openjdk6 and I'm going to go ahead with that once the ports that > > need upgrading have done so. > > > > With openjdk7, removing the port will not force you to remove the package > > from your system. I still have some older JDK ports on my desktop even > > though they've been removed from the ports tree. The problem with leaving > > it in the tree is that it has security vulnerabilities with the current > > version and no one has volunteered to update it to the latest version. > > > > My question then is whether that would work. You leave the port on your > > machine and/or build a local package of it prior to removal. That should > > be sufficient to use it for the lifecycle of the current FreeBSD release > > and further without leaving a vulnerable port in the ports tree. > > Well, I am not a huge fan of this because I cannot reproduce the build > at any time -- making an OSS component virtually useless. I don't want > to be dependent on others to produce it. I have gone through this with > the "HP-UX Porting and Archive Centre" and abandoned all packages from > them because they never brought there changes upstream and I was not > really able to reproduce their builds. > > To make a long story short, if you want to cut OpenJDK 7, perform a > final update, announce the port as deprecated and remove it at some > point. That would be fair deal. OpenJDK 6 is obsolete. To reiterate, I am not planning on spending any time on openjdk7 since it has been EoL for so long. There are more important (IMO) uses of my time in regards to newer versions. I will however mark it as vulnerable and to be removed within 3 months. If someone with time and interest steps up within that time span and produces an update then it can potentially be kept for longer. I'll do the same for openjdk6, but with a much shorter time span. A couple of weeks tops. -- Greg