Issue with 13.0.2 release (was: [Updates Communication] 13.0.2 security patches pushed)

[Andrew John Hughes]

On 29/01/2020 14:00, Rob McKenna wrote:
> Hi Christoph,
> 
> These patches did not make the ga build of OpenJDK 13.0.2, however the
> patches were pushed to the repo (post-ga tag) in order to give the
> option to downstream builders to include them in their own builds if
> they wanted.
> 
> Those 13.0.2 records are incorrect however, thanks for pointing that
> out. I'll change the fix version to jdk13u.
> 
>     -Rob
> 
> On 24/01/20 15:21, Langer, Christoph wrote:
>> Hi Rob,
>>
>> first of all, thanks for pushing the security patches to 13.0.2 and setting the tags.
>>
>> I have, however, found a little issue. The tag 13.0.2-ga points to this change: http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/7b8ce94cc932
>>
>> If you look at the repository tree, you'll see however that this change is below the merge of this branch and another line in jdk13u which contains the last 6 public pushes:
>>
>> 8233223: Add Amazon Root CA certificates8 weeks ago, by rhalade - http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/459a2f735b99 
>> 8234245: sun/security/lib/cacerts/VerifyCACerts.java fails due to wrong checksum2 months ago, by jiefu - http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/b2305a0a3146 
>> 8233219: NMT output on AIX misses some categories2 months ago, by mbaesken - http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/0919082b7634 
>> 8232019: Add LuxTrust certificate updates to the existing root program2 months ago, by rhalade - http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/e69aa0686696 
>> 8234107: Several AWT modal dialog tests failing on Linux after JDK-82319912 months ago, by neugens - http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/486735e93d55 
>> 8231991: Mouse wheel change focus on awt/swing windows - http://hg.openjdk.java.net/jdk-updates/jdk13u/rev/743b29c2372f 
>>
>> So, these 6 changesets are not contained in 13.0.2-ga!
>>
>> Looking at the corresponding JBS items, you'll find resolved backports of these for 13.0.2 and 13u-cpu. I think since we see 13.0.2 here, those should be under the 13.0.2-ga tag.
>>
>> For the LuxTrust and Amazon Root CA changes, there have been separate pushes in your internal repository as well which are in 13.0.2-ga. And I believe 8234245 was contained in your internal 8233223 push. So, effectively 13.0.2 OpenJDK is missing these items:
>> 8233219: NMT output on AIX misses some categories
>> 8234107: Several AWT modal dialog tests failing on Linux after JDK-8231991
>> 8231991: Mouse wheel change focus on awt/swing windows
>>
>> I don't know whether we should move the 13.0.2-ga tag to the merge commit or just leave it as is, given the importance of JDK13 and the priority of these fixes. But in any case, this shouldn't happen again with 14.0.1 and later...
>>
>> Best regards
>> Christoph
>>

It sounds like 13.0.2-ga accurately reflects what was released - which
didn't include those fixes - and can't be changed.

Having these additional changesets that have never made a release is
confusing and I agree it should be avoided with future release branches.

Thanks,
-- 
Andrew :)

Senior Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

PGP Key: ed25519/0xCFDA0F9B35964222 (hkp://keys.gnupg.net)
Fingerprint = 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222
https://keybase.io/gnu_andrew