<i18n dev> Security fixes are back; other fixes can go in. Time for build 18?

Andrew John Hughes gnu_andrew at member.fsf.org
Thu Dec 10 10:06:09 PST 2009 

2009/12/9 Joseph D. Darcy <Joe.Darcy at sun.com>:
> Andrew John Hughes wrote:
>>
>> 2009/12/8 Andrew John Hughes <gnu_andrew at member.fsf.org>:
>>
>>>
>>> 2009/12/8 Joseph D. Darcy <Joe.Darcy at sun.com>:
>>>
>>>>
>>>> Andrew John Hughes wrote:
>>>>
>>>>>
>>>>> 2009/12/8 Andrew John Hughes <gnu_andrew at member.fsf.org>:
>>>>>
>>>>>
>>>>>>
>>>>>> 2009/12/8 Joseph D. Darcy <Joe.Darcy at sun.com>:
>>>>>>
>>>>>>
>>>>>>>
>>>>>>> Joseph D. Darcy wrote:
>>>>>>>
>>>>>>>
>>>>>>>>
>>>>>>>> Andrew John Hughes wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>>>
>>>>>>>>> 2009/11/13 Joseph D. Darcy <Joe.Darcy at sun.com>:
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> Andrew John Hughes wrote:
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> 2009/11/10 Andrew John Hughes <gnu_andrew at member.fsf.org>:
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> [snip]
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> Still need to look at this, but was wondering what was happening
>>>>>>>>>>> with
>>>>>>>>>>> timezone data in 6?
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> It doesn't seem like much of anything is happening with timezone
>>>>>>>>>> data
>>>>>>>>>> in
>>>>>>>>>> OpenJDK 6!
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>
>>>>>>> [snip]
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>>>>
>>>>>>>>>> I'd appreciate if you could backport these timezone changes.
>>>>>>>>>>
>>>>>>>>>> -Joe
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Ok, no problem.
>>>>>>>>>
>>>>>>>>> So I make it for b18 we still have:
>>>>>>>>>
>>>>>>>>>  * the issue with the X11 patch I can't apply because of jcheck
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>> I'll check in with Mark, but we're both speaking at Devoxx next week
>>>>>>>> so
>>>>>>>> recognizing Latin-1 characters in jcheck may not happen immediately.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>>
>>>>>>>>>  * Nimbus issues
>>>>>>>>>  * the diff issue with HotSpot Martin pointed out
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>> Right.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>>
>>>>>>>>> Do we also want the timezone data changes for b18 or shall we do
>>>>>>>>> that
>>>>>>>>> in b19? I think b19's main feature is likely to be hs16.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>> I think the time zone updates would be better in b18; the nature of
>>>>>>>> these
>>>>>>>> changes is very well-understood.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>> Some time has passed, a few more fixes have come into the repos, and
>>>>>>> I'm
>>>>>>> beginning to think it would better to have OpenJDK 6 b18 be more or
>>>>>>> less
>>>>>>> what is there now and to have the timezone update and other changes
>>>>>>> go
>>>>>>> into
>>>>>>> b19.
>>>>>>>
>>>>>>> Thoughts?
>>>>>>>
>>>>>>> -Joe
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> Sorry, I've been distracted with first the OpenJDK7 release and then
>>>>>> time off work.  Backporting the timezone stuff should be fairly
>>>>>> trivial.  I'll have a try today and if it isn't, then we can consider
>>>>>> delaying it.
>>>>>>
>>>>>>
>>>>
>>>> Okay.
>>>>
>>>>
>>>>>>
>>>>>> I think we do need to get the Nimbus fixes in.  I'm trying to get
>>>>>> IcedTea6 working against OpenJDK6 hg so I can test this, and all the
>>>>>> JAXWS/JAXP changes don't make that a simple job.  But it's in
>>>>>> progress.
>>>>>>
>>>>>> Is there any news on updating jcheck?  I still haven't been able to
>>>>>> push the X11 fix.
>>>>>>
>>>>>>
>>>>
>>>> I've pinged Mark but haven't heard back.
>>>>
>>>> Unfortunately, the most expedient way to get this fix back to probably
>>>> to
>>>> ASCII-fy the contributor's name.
>>>>
>>>>
>>>
>>> I've already tried that.  Whatever jcheck is doing goes beyond ASCII
>>> as it doesn't accept a backtick either (o` is the ASCIIfied version)
>>>
>>> As with other issues with jcheck, if it was open-sourced we wouldn't
>>> have Mark as a bottleneck for fixing the inevitable issues with it.
>>>
>>> This is a fairly serious issue; I currently can't build OpenJDK6
>>> unless I apply that patch first and no doubt others will see this too
>>> (all F12 users for a start).
>>>
>>>
>>>>>>
>>>>>> In response to Erik's e-mail, I'd be happier making HotSpot b16 part
>>>>>> of b19 rather than b18, so we have more time for testing.
>>>>>>
>>>>>>
>>>>
>>>> Yes, the HotSpot upgrade should occur in b19.
>>>>
>>>>
>>>>>>
>>>>>> So still:
>>>>>>
>>>>>> * Timezone fixes
>>>>>> * Nimbus fixes
>>>>>>
>>>>>>
>>>>
>>>> Nimbus backports from JDK 7 I assume.
>>>>
>>>>
>>>
>>> There is one, but I was thinking of the test issues you raised in
>>> previous emails.
>>>
>>>
>>>>>>
>>>>>> * X11 fix
>>>>>>
>>>>>> for b18 from my side.  Is there some rush to get this out?
>>>>>>
>>>>>>
>>>>
>>>> No rush per se, but with the holiday coming up (including my on vacation
>>>> soon), if the build doesn't happen in the next week or so, it probably
>>>> won't
>>>> happen until January and I'd prefer to get a build with the security
>>>> fixes
>>>> officially out before then.
>>>>
>>>>
>>>
>>> Well, I think most things can probably be sorted this week.  The X11
>>> fix is the real blocker.  Can we not just turn jcheck off or something
>>> for one commit?
>>>
>>> I'm currently building OpenJDK6 with the timezone fixes applied and it
>>> looks ok so far.  I'll post a webrev once it completes.
>>>
>>> There are two more tz issues worthy of consideration that I didn't
>>> include yet because they are not related to the data, but would be
>>> good to have.  One adds support for old timezone IDs (I'm wary of this
>>> because it introduces a property) and the other fixes an issue with
>>> determining the timezone on GNU/Linux boxes which I believe will
>>> obsolete a different but related fix in IcedTea6.  I'd also like to
>>> add a simple patch which fixes up the remaining data differences
>>> between 6 and 7 (just typos and revision headers) which seems to have
>>> occurred in the black hole between the OpenJDK6 fork and the OpenJDK7
>>> hg repositories.
>>>
>>> Finally, during build, I just spotted another issue.  The langtools
>>> build wrongly passes -Werror to javac and this has been removed in the
>>> OpenJDK7 version.  It only shows up if you build OpenJDK6 with
>>> OpenJDK7, so it's minor but probably worth fixing.  I doubt that is
>>> the only building-with-7 issue though.
>>>
>>>
>>>>>
>>>>> Just remembered about Kelly's JDI work; that would be good to get in
>>>>> and being test-related, shouldn't break anything about the build or
>>>>> JDK itself.
>>>>>
>>>>>
>>>>
>>>> There are a bunch of source changes too, but they have been in JDK 7 for
>>>> a
>>>> while so they should be fine for OpenJDK 6.
>>>>
>>>> -Joe
>>>>
>>>>
>>>
>>> --
>>> Andrew :-)
>>>
>>> Free Java Software Engineer
>>> Red Hat, Inc. (http://www.redhat.com)
>>>
>>> Support Free Java!
>>> Contribute to GNU Classpath and the OpenJDK
>>> http://www.gnu.org/software/classpath
>>> http://openjdk.java.net
>>>
>>> PGP Key: 94EFD9D8 (http://subkeys.pgp.net)
>>> Fingerprint: F8EF F1EA 401E 2E60 15FA  7927 142C 2591 94EF D9D8
>>>
>>>
>>
>> No sooner did I write that than it built:
>>
>> http://cr.openjdk.java.net/~andrew/tz/webrev.01/
>>
>
> Approved.
>
>> The remaining three tz fixes are:
>>
>> changeset:   639:67c41d740e6d
>> user:        peytoia
>> date:        Mon Sep 08 15:21:55 2008 +0900
>> summary:     6466476: (tz) Introduction of tzdata2005r can introduce
>> incompatility issues with some JDK1.1 3-letter TZ Ids
>> http://hg.openjdk.java.net/jdk7/jdk7/jdk/rev/67c41d740e6d
>>
>> changeset:   1693:92b6482e7719
>> user:        peytoia
>> date:        Mon Aug 31 14:53:05 2009 +0900
>> summary:     6456628: (tz) Default timezone is incorrectly set
>> occasionally on Linux
>> http://hg.openjdk.java.net/jdk7/jdk7/jdk/rev/92b6482e7719
>>
>>
>
> These other backports approved.
>
>> and http://cr.openjdk.java.net/~andrew/tz/webrev.02 which needs a bug ID.
>>
>
> Approved to use 6908946 "(tz) Sync JDK 7 tz changes into OpenJDK 6" for this
> change.
>
> Thanks,
>
> -Joe
>

Thanks. All of them are now in OpenJDK6.

There is one more backport lurking in IcedTea6:

http://cr.openjdk.java.net/~andrew/tz/webrev.03/

The actual code fix went in to OpenJDK7 in the black hole between the
two (b22): http://mail.openjdk.java.net/pipermail/security-dev/2009-August/001153.html
 There should be a bug ID as a result -- presumably, you can discover
that internally?

The test case included in the webrev is from Mark Wielaard and is
contributed through Red Hat's SCA.

CCing i18n-dev in case they have any input; it would be nice to have
the test case in 7 too as well as the fix.
-- 
Andrew :-)

Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

Support Free Java!
Contribute to GNU Classpath and the OpenJDK
http://www.gnu.org/software/classpath
http://openjdk.java.net

PGP Key: 94EFD9D8 (http://subkeys.pgp.net)
Fingerprint: F8EF F1EA 401E 2E60 15FA  7927 142C 2591 94EF D9D8

More information about the i18n-dev mailing list