Question about OpenJDK packaging

[Attila-Mihaly Balazs]

Hello all,

I'm writing you to let you know about a site I just launched you might
be interested in: The Java Advent Calendar available at
http://www.javaadvent.com/. The idea is to publish one article / day
between the 1st and 24th of December about Java or related
technologies.

Besides the articles being (hopefully) interesting, I would like to
ask if somebody would be interested in writing an article for one of
the days. For example I think a good topic would be: how does code get
into the OpenJDK that I install in my distribution? This is also a
personal curiosity of mine (and I imagine for many people) and it's
one which people on this list are well equipped answering I imagine.
My somewhat nebulous idea is:

- there is a public repository and Oracle has an internal repository
- Oracle merges contributions from the public repository and merges
them to the internal one (do we know when? do we know what?)
- Oracle merges internal contributions to the public repository
(again: when? what? what are the criteria?)
- Oracle releases their versions of JDK 7 (probably there is no need
to go into the whole "OpenJDK 6 as backward branch" thing). Is there a
"source of truth" to tell us what it is from the public repository
which is included in a particular Oracle Java release? (So for example
if I say Oracle JDK 1.7u3, can I look in the public source tree and
see all the public parts exactly as they were used during the build?)
- As far as I know the OpenJDK project doesn't produce their packages,
but rather people from each distro patch the code and create packages.
Is there an easy way to find out what the source code for the package
is which got installed? This is especially relevant I think in cases
where security vulnerabilities come out and people would like to know
if they have the pached version or not.

As you can see there are a lot of interesting questions here which you
could answer and it would be useful to do it in the format of a
publicly available blog post. What do people think?

Regards,
Attila Balazs