Path: csiph.com!1.us.feeder.erje.net!2.eu.feeder.erje.net!feeder.erje.net!fu-berlin.de!bofh.it!news.nic.it!robomod From: Thorsten Glaser Newsgroups: linux.debian.maint.java Subject: Re: Kotlin and OpenJDK 8 in Bookworm? Date: Mon, 30 Jan 2023 00:50:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-java-request@lists.debian.org Sun Jan 29 23:48:21 2023 Old-Return-Path: X-Amavis-Spam-Status: No, score=-5.6 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, BODY_8BITS=1.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .tarent. - helo: .mail-wm1-x336.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AO0yUKWDFiB09qjCPdmjxHNpAFKSACYI0E6oVwpRrF8kktLKTI+revh4 xQD1G/z/wkLuLyVdK7ktWBAuPjevtuYe6ur9 X-Google-SMTP-Source: AK7set9+hP4ZW0NCmUGSdWYRzaOCfik2V7Wtmr6Ry7XSSnv+S721CxDWyNg81Uvqi1uuRMvsmkDiSw== X-Received: by 2002:a05:600c:1e0f:b0:3dc:5227:4f71 with SMTP id ay15-20020a05600c1e0f00b003dc52274f71mr3969500wmb.9.1675036077757; Sun, 29 Jan 2023 15:47:57 -0800 (PST) Content-Language: de-DE-1901 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE X-Mailing-List: archive/latest/23168 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/8631bd90-3370-5a87-8b3a-af7fd2cd16bb@tarent.de Approved: robomod@news.nic.it Lines: 121 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-java@lists.debian.org X-Original-Date: Mon, 30 Jan 2023 00:47:56 +0100 (CET) X-Original-Message-ID: <8631bd90-3370-5a87-8b3a-af7fd2cd16bb@tarent.de> X-Original-References: <298c5e7142ad9fc677f2f567242c8ea3@apache.org> <8ea25c60-6fb1-eee9-cc95-b773abad2f4a@tarent.de> Xref: csiph.com linux.debian.maint.java:12519 On Mon, 30 Jan 2023, Emmanuel Bourg wrote: > Le 2023-01-26 19:39, Thorsten Glaser a =C3=A9crit=C2=A0: > >>> ineluctable truth: we need OpenJDK 8 back into the stable distribution. >> >> Not going to happen, sorry. This has been vetoed by the security >> team and was the condition for keeping it in unstable at all. > > Are you opposed to this idea, or just pessimistic it could be accepted? Pessimistic. It is currently manageable to upgrade in sid and the jessie and stretch updates in ELTS are trivial. I personally also build it for wheezy and (on user request) buster, bullseye, and on a PPA for trusty/xenial/bionic/focal/jammy, so it works. I can only mildly test it, though. > I think it's important to highlight that the situation has evolved. We > thought openjdk-8 was good enough in unstable only to bootstrap Kotlin > and then move to a more recent JDK, but this isn't going to happen. Any proposal to keep openjdk-8 will want to know for how long this isn=E2=80=99t going to happen, i.e. at what point Kotlin &c. are expected to work with default-jdk. > Also there was an uncertainty on the lifetime of OpenJDK 8, but it's > clear now that it'll be maintained for at least two more Debian > releases. Oh, indeed? I haven=E2=80=99t seen the plan, but if that is so, this may be a good data point. On the other hand, the security team will not be liking having more than one implementation of something to support. Yes, documenting its unsupportedness is one thing, but if it exists=E2=80=A6 > We have invested an insane amount of time in these Kotlin/Gradle OK, I understand the frustration. > maintaining openjdk-8 in stable would require only a fraction of that. (Not to mention that it is currently I who=E2=80=99s maintaining that, and the ELTS people do the actual work of writing the DSA/DLAs and uploading to -security. But I=E2=80=99m okay with this as long as I=E2=80=99m not expected to upload a new version on basically the same day as its release; I took a bit longer for the 2023Q1 update due to other work-relared things having priority, but I normally do it within the week or so. On the other hand, I=E2=80=99m currently in the position of being able to do most of that on company time, and I=E2=80=99m not sure how much I want to continue this when that will no longer be true.) > The longer we wait, the more likely we are going to paint ourself in a > corner, with a completely broken and unmaintainable Gradle for What=E2=80=99s the status of Gradle then? I thought it required Kotlin, and we have Kotlin now, so isn=E2=80=99t it already using that? > example, or other elements in our tool chain that will no longer work > with OpenJDK 8 and break even more the kotlin build. To be honest, I expected that point to happen within the preceding two years already. I know I could not build Maven projects with < 11 (but targetting 8 from 11 works well now, and some of the bugs were building accidents on the Maven plugin developers=E2=80=99 side). > We still have some time to discuss this before the Bookworm release. Do we? We=E2=80=99re in the first part of the freeze already. > I suggest that we let openjdk-8 transition to testing now before the > beginning of the soft freeze, just to keep our options open. I=E2=80=99d like to have at least one person from the stable release manage= rs =E2=80=9Csign off=E2=80=9D on that beforehand, also because it is the packa= ge maintainer who is going to be blamed. Not necessarily as a for-the-team decision, just so that at least someone is informed; the team can decide later then, if we indeed can keep the options open. > We won't expand the usage of kotlin during that time (no Gradle > upgrade for example) such that the situation remains reversible before > the release. Sounds like a plan. I=E2=80=99d appreciate if you could distill from this thread what has been said and contact the SRM. Once we have at least one n=C5=8Dn-veto response you can close #989736 so it will migrate so we have options open. It was freshly uploaded today anyway, so it=E2=80=99ll take some time. As a caveat, one of the MIPS platforms FTBFS=E2=80=99d with the previous release (they all are currently still in Needs-Build for this one). https://mail.openjdk.org/pipermail/jdk8u-dev/2022-October/015730.html is where I informed upstream about this, but I don=E2=80=99t know if someon= e has even looked at that. We=E2=80=99ll want to have this running on at leas= t all release architectures if we go forward with this. bye, //mirabilos --=20 Infrastrukturexperte =E2=80=A2 tarent solutions GmbH Am Dickobskreuz 10, D-53121 Bonn =E2=80=A2 http://www.tarent.de/ Telephon +49 228 54881-393 =E2=80=A2 Fax: +49 228 54881-235 HRB AG Bonn 5168 =E2=80=A2 USt-ID (VAT): DE122264941 Gesch=C3=A4ftsf=C3=BChrer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Ale= xander Steeg ***************************************************= * /=E2=81=80\ The UTF-8 Ribbon =E2=95=B2=C2=A0=E2=95=B1 Campaign against Mit dem tarent-Newsletter ni= chts mehr verpassen: =C2=A0=E2=95=B3=C2=A0 HTML eMail! Also, https://www.tarent.de/newslette= r =E2=95=B1=C2=A0=E2=95=B2 header encryption! ***************************************************= *