CSR for JDK11u backport of JDK-8080462: Update SunPKCS11 provider with PKCS11 v2.40 support

[Langer, Christoph]

Hi,

I'm currently looking into backporting "JDK-8080462: Update SunPKCS11 provider with PKCS11 v2.40 support" [0] to OpenJDK 11 updates. I can see that the original change has a CSR attached [1].

I was under the impression, that Oracle would use the CSR process for their JDK 11u backports as well - and we can in such cases refer to the Oracle CSRs. However, in this case, I can see that Oracle have backported that patch to JDK11 updates without an additional backport CSR [2].

That raises 2 questions:
a) Does Oracle still have the policy to use CSR for 11u backports?
b) In case there's a backport of a change with CSR to 11u by Oracle and Oracle did not do a backport CSR, should we backport the fix to OpenJDK11u without CSR as well? Or should we go through CSR review nevertheless?

Thanks
Christoph

[0] https://bugs.openjdk.java.net/browse/JDK-8080462
[1] https://bugs.openjdk.java.net/browse/JDK-8221442
[2] https://bugs.openjdk.java.net/browse/JDK-8228662