OpenJDK for lenny

[Matthias Klose]

So, we are late with OpenJDK for lenny. I still think lenny would
benefit from having OpenJDK. I'm proposing the following steps,
realizing that not all of them probably can be realized.

- The current 6b11-2 package is not yet ready for migration. We will
need a -3 upload which properly will fix build issues, and adds
ports for alpha, mips, mipsel and m68k. s390 support is pending
some build issues (Bastian Blank is working on those).

- Upload a -3, which should be a candidate for testing. If the s390
bits are not yet ready, have an opportunity to upload a -4.
The current status can be seen in the repository.

- At this point we'll have OpenJDK VM with a JIT (amd64, i386, sparc)
and an interpreter (alpha, armel, ia64, mips, mipsel, m68k,
powerpc, s390). The intrepreter is good for building stuff, but
runtime performance ...

- Allow tzdata to build a tzdata-java package; the openjdk-6 is
prepared to use the data from tzdata-java (which comes in a
different file format). With this openjdk-6 doesn't have to be
updated for new timeezone data.

- Allow a java-common update to build default-* for alpha, pointing
to openjdk-6.

- Allow cacao-oj6 (currently in NEW) into testing. This just uses
the same packaging as openjdk-6, but uses the cacao JIT for alpha
and powerpc (and amd64, i386, maybe mips*). This adds a usable
runtime for these two architectures. Sources and packaging are the
same as openjdk-6 (and cacao).

- Allow java-common to point the default-* for the hotspot JIT archs
(amd64, i386, sparc) to point to openjdk-6.
This only should be done if a rebuild test of the archive is
successful.

- Allow java-common to point the default-* for the cacao JIT archs
(alpha, powerpc) to point to cacao-oj6.

We won't have a openjdk-6 for arm and hppa; I'm currently not aware of
a working jdk on these architectures to build openjdk-6 or cacao-oj6.

Matthias

[Florian Weimer]

Post by Matthias Klose
So, we are late with OpenJDK for lenny. I still think lenny would
benefit from having OpenJDK. I'm proposing the following steps,
realizing that not all of them probably can be realized.

Is there upstream security support for OpenJDK 6? I'm asking because
the DLJ stuff used to lag quite a bit.

[David Herron]

Post by Florian Weimer

Post by Matthias Klose
So, we are late with OpenJDK for lenny. I still think lenny would
benefit from having OpenJDK. I'm proposing the following steps,
realizing that not all of them probably can be realized.

Is there upstream security support for OpenJDK 6? I'm asking because
the DLJ stuff used to lag quite a bit.

FWIW I've been working to make sure the DLJ bundles gets published more
in line with the regular bundles. I took over DLJ in Jan/Feb when Tom
went off to greener pastures.

If you need to know details about the security fix releases I can get a
statement from one of the guys directly involved. The model we're
moving to (have moved to) is to synchronize security fix releases across
all the JDK release channels we have. We're still releasing JDK's back
to 1.3.1 (for some reason). Each synchronized security release
involves simultaneous release of all current binary JDK bundles as well
as OpenJDK 6/7 source releases of the same bug fixes. For OpenJDK there
is some kind of behind the scenes source handshaking as (I think) is
common among open source projects and if you want to know more either I
or Dalibor could get the information to you. We of course don't want to
release source for a security fix until the matching binary JDK build
has been released.

OpenJDK 6 b 11 was the matching synchronized security release

http://blogs.sun.com/darcy/entry/openjdk_6_sources_for_b11

The matching DLJ bundle, 5.0u17 and 6u7, was published within a couple
hours of the normal (non-DLJ) bundles. This was much better than the
release lag for earlier DLJ bundle releases (heavy sigh).


- David Herron

[Mark Wielaard]

Hi,

Each synchronized security release involves simultaneous release of
all current binary JDK bundles as well as OpenJDK 6/7 source releases
of the same bug fixes. For OpenJDK there is some kind of behind the
scenes source handshaking as (I think) is common among open source
projects and if you want to know more either I or Dalibor could get
the information to you. We of course don't want to release source for
a security fix until the matching binary JDK build has been released.
OpenJDK 6 b 11 was the matching synchronized security release
http://blogs.sun.com/darcy/entry/openjdk_6_sources_for_b11

And the security fixes were released and incorporated into icedtea
several days before the b11 code drop by Lillian:
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2008-July/002650.html
So in principle we can turn around pretty fast. As soon as the source
code for any fixes are available, we don't have to wait for any drops to
get the security holes resolved for the distros immediately.

Cheers,

Mark

[Petter Reinholdtsen]

[Matthias Klose]

Post by Matthias Klose
So, we are late with OpenJDK for lenny. I still think lenny would
benefit from having OpenJDK. I'm proposing the following steps,
realizing that not all of them probably can be realized.

Just for the record, Debian Edu would very much like to have the new
openjdk package in Lenny. 80 000 Linux terminals in Extremadura,
Spain, would benefit a lot from it. :)

Because of this, I hope it will be allowed into Lenny.

Happy hacking,

[Aurelien Jarno]

Post by Matthias Klose
So, we are late with OpenJDK for lenny. I still think lenny would
benefit from having OpenJDK. I'm proposing the following steps,
realizing that not all of them probably can be realized.
- The current 6b11-2 package is not yet ready for migration. We will
need a -3 upload which properly will fix build issues, and adds
ports for alpha, mips, mipsel and m68k. s390 support is pending
some build issues (Bastian Blank is working on those).
- Upload a -3, which should be a candidate for testing. If the s390
bits are not yet ready, have an opportunity to upload a -4.
The current status can be seen in the repository.
- At this point we'll have OpenJDK VM with a JIT (amd64, i386, sparc)
and an interpreter (alpha, armel, ia64, mips, mipsel, m68k,
powerpc, s390). The intrepreter is good for building stuff, but
runtime performance ...
- Allow tzdata to build a tzdata-java package; the openjdk-6 is
prepared to use the data from tzdata-java (which comes in a
different file format). With this openjdk-6 doesn't have to be
updated for new timeezone data.

tzdata-java is now waiting in NEW.

[Mark Hymers]

On Thu, 31, Jul, 2008 at 02:35:12PM +0200, Aurelien Jarno spoke thus..

Post by Aurelien Jarno
tzdata-java is now waiting in NEW.

ACCEPTED.

Mark

[Aurelien Jarno]

Post by Mark Hymers
On Thu, 31, Jul, 2008 at 02:35:12PM +0200, Aurelien Jarno spoke thus..

Post by Aurelien Jarno
tzdata-java is now waiting in NEW.

ACCEPTED.

Thanks.

Could we also have a freeze exception for lenny?

Thanks,
Aurelien

[Luk Claes]

Post by Aurelien Jarno

Post by Mark Hymers
On Thu, 31, Jul, 2008 at 02:35:12PM +0200, Aurelien Jarno spoke thus..

Post by Aurelien Jarno
tzdata-java is now waiting in NEW.

ACCEPTED.

Thanks.
Could we also have a freeze exception for lenny?

unblocked

Cheers

Luk

[Neil McGovern]

Post by Matthias Klose
So, we are late with OpenJDK for lenny. I still think lenny would
benefit from having OpenJDK. I'm proposing the following steps,
realizing that not all of them probably can be realized.

Unblocked.

Neil