Date: Sat, 10 Aug 2019 13:53:58 -0700 From: Greg Lewis <glewis@eyesbeyond.com> To: Michael Osipov <1983-01-06@gmx.net> Cc: java@freebsd.org Subject: Re: RFC: Future of java/openjdk6 and java/openjdk7 Message-ID: <20190810205358.GA38888@misty.eyesbeyond.com> In-Reply-To: <d8036483-9b1f-c54b-6e7d-4821c4a93afd@gmx.net> References: <20190802014149.GA59118@misty.eyesbeyond.com> <935ee70b-0f6e-1813-25c3-ced836143e32@gmx.net> <20190810183901.GA76800@misty.eyesbeyond.com> <22887160-4c94-9907-84f3-23fff562c239@gmx.net> <20190810193529.GA38493@misty.eyesbeyond.com> <d8036483-9b1f-c54b-6e7d-4821c4a93afd@gmx.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Aug 10, 2019 at 09:42:35PM +0200, Michael Osipov wrote: > Am 2019-08-10 um 21:35 schrieb Greg Lewis: > > On Sat, Aug 10, 2019 at 08:52:26PM +0200, Michael Osipov wrote: > >> Am 2019-08-10 um 20:39 schrieb Greg Lewis: > >>> On Fri, Aug 02, 2019 at 08:07:39AM +0200, Michael Osipov wrote: > >>>> Am 2019-08-02 um 03:41 schrieb Greg Lewis: > >>>>> Oracle ended official releases of JDK 7 in April of 2015, and JDK 6 even > >>>>> earlier. In the FreeBSD ports collection both java/openjdk6 and > >>>>> java/openjdk7 have fallen out of maintenance and are considerably behind > >>>>> in terms of updates (which likely include fixes for security > >>>>> vulnerabilities). In addition, openjdk6 will soon become unbuildable in > >>>>> FreeBSD 12-STABLE based on > >>>>> > >>>>> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=234792 > >>>>> > >>>>> With OpenJDK 8 having been the default JDK for a number of years now, > >>>>> OpenJDK 11 and 12 both being available (and soon 13) I would suggest > >>>>> that both openjdk6 and openjdk7 be removed, along with any ports > >>>>> depending explicitly on them(*) which are unable to be updated to use a > >>>>> newer version. > >>>> > >>>> Being an Apache Maven PMC member and a happy FreeBSD user, we guarantee > >>>> that the entire Maven stack runs on top of Java 7+, so I run all > >>>> integration tests for all components I change on a regular basis on > >>>> several BSD boxes (home, work) to test compat outside of the monotonic > >>>> Windows/Linux world. > >>>> > >>>> Just because Oracle does not provide any binary packages for Java 7 it > >>>> does not meean that it is not supported. There are a lot of vendors > >>>> still providing Java 7 packages, e.g, Azul Systems, RHEL, HPE for HP-UX > >>>> (Java SE 7 is supported till July 2022 and Java SE 8 is supported till > >>>> March 2025) and likely others. > >>> > >>> Given this is the only response so far, I assume all are comfortable with > >>> removing openjdk6 and I'm going to go ahead with that once the ports that > >>> need upgrading have done so. > >>> > >>> With openjdk7, removing the port will not force you to remove the package > >>> from your system. I still have some older JDK ports on my desktop even > >>> though they've been removed from the ports tree. The problem with leaving > >>> it in the tree is that it has security vulnerabilities with the current > >>> version and no one has volunteered to update it to the latest version. > >>> > >>> My question then is whether that would work. You leave the port on your > >>> machine and/or build a local package of it prior to removal. That should > >>> be sufficient to use it for the lifecycle of the current FreeBSD release > >>> and further without leaving a vulnerable port in the ports tree. > >> > >> Well, I am not a huge fan of this because I cannot reproduce the build > >> at any time -- making an OSS component virtually useless. I don't want > >> to be dependent on others to produce it. I have gone through this with > >> the "HP-UX Porting and Archive Centre" and abandoned all packages from > >> them because they never brought there changes upstream and I was not > >> really able to reproduce their builds. > >> > >> To make a long story short, if you want to cut OpenJDK 7, perform a > >> final update, announce the port as deprecated and remove it at some > >> point. That would be fair deal. OpenJDK 6 is obsolete. > > > > To reiterate, I am not planning on spending any time on openjdk7 since it > > has been EoL for so long. > > Where is this EOL? I see regular changes here: > http://hg.openjdk.java.net/jdk7u/jdk7u/ The last public release of Java 7 was April 2015 (GA was July 2011). From the main Oracle Java SE page: "Updates for Java SE 7 released after April 2015 are only available to Oracle Customers through My Oracle Support (requires support login)." Given that there are multiple types of support, I should have clarified that I was referring to the end of public updates. There are Oracle customers that are continuing to purchase this support, so that is why there continue to be updates to the repository. However, even if there are updates to the repository, there is a maintenance burden to supporting openjdk7 within the ports tree. Given that no one is funding work to update openjdk7, I have to then make a decision about whether I would like to spend volunteer time on it. My answer to that has to fit in with the answers to questions like: "Would most FreeBSD users prefer that time is spent to make sure they get access to the newest versions when they are released or would they prefer that time is spent on openjdk7?" This is particularly relevant given the six month release cadence that Java has adopted. There are no longer years between releases and keeping up to date with the release schedule is now something that requires significant and continuous time investment. "Would most FreeBSD users prefer that time is spent on fixing bugs in newer versions of Java or would they prefer that time is spent on openjdk7?" There are crash reports against openjdk8 and openjdk11 in the bugs database that require in depth analysis and work. Given that I believe far more people are running production applications on these two versions, the precedence there is higher for me. "Would most FreeBSD users and developers prefer time is spent on improving other aspects of Java support in FreeBSD (e.g. adding ports for more common Java applications or development libraries, making it fit into the current USES scheme, rethinking javavmwrapper, etc.) or would they prefer that time is spent on openjdk7?" Again, to me openjdk7 loses out here in regards to other enhancements for making Java a better supported language on FreeBSD. The question has already been asked about removing USE_JAVA and getting it working with a standard USES clause. Most other languages already support that. Support for powerpc64 and aarch64 still needs to be finalised as well. "How many versions does it make sense to have in the FreeBSD ports tree for Java, since each of them requires support and maintenance?" Currently we have versions of 6, 7, 8, 9, 10, 11, and 12. 13 will be here next month. If I look at the ports tree in general, most languages support 3-4 versions. There are a few exceptions, but the median appears to be 3 or 4. So if we want to trim the number of Java versions down to something more manageable, some of them have to go. 6, 7, 9, and 10 are all candidates for being trimmed. Removing all of them gets us down to 8, 11, 12. With 13 to land in a month that will put us at 4 supported versions. For me, the answer to all those questions leads me to the conclusion that I won't be spending volunteer time on openjdk7 other than to remove it. If someone else wants to keep it going, I'll support them by reviewing and commiting updates. -- Greg
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20190810205358.GA38888>