Downporting JDK-8313765 to jdk11u and jdk17u and respinning 11.0.20 and 17.0.8

[Lindenmaier, Goetz]

Hi,

I just checked.
I can not create the branch.

The ops team at Oracle had asked me to check whether I can do it,
but as it does not work they will create a branch.

There is a convention not to use dashes, so the branches will be
Named "jdk11.0.20.1" and "jdk17.0.8.1".

Once they are there you can make PRs against these branches
and push once reviewed etc.

Best regards,
  Goetz.


> -----Original Message-----
> From: Volker Simonis <volker.simonis at gmail.com>
> Sent: Montag, 21. August 2023 19:58
> To: Andrew Hughes <gnu.andrew at redhat.com>
> Cc: Sergey Bylokhov <bylokhov at amazon.com>; jdk-updates-dev <jdk-updates-
> dev at openjdk.java.net>; Langer, Christoph <christoph.langer at sap.com>;
> Andrew Haley <aph at redhat.com>; Severin Gehwolf <sgehwolf at redhat.com>;
> Lindenmaier, Goetz <goetz.lindenmaier at sap.com>; Taylor, Ben
> <benty at amazon.com>
> Subject: Re: Downporting JDK-8313765 to jdk11u and jdk17u and respinning
> 11.0.20 and 17.0.8
>
> I've just created "JDK-8314677: Bump update version for OpenJDK:
> jdk-17.0.8.1" [1] and set its "Fix version" to "17.0.8.1".
> Ben is preparing a PR for it. I'm not sure however, if he can create a
> PR which will be merged with 17.0.8-ga? Maybe only Götzt can do that
> (or create a 17.0.8.1 branch in 17u)?
>
> [1] https://bugs.openjdk.org/browse/JDK-8314677
>
> On Fri, Aug 18, 2023 at 10:41 AM Andrew Hughes <gnu.andrew at redhat.com>
> wrote:
> >
> > On 14:50 Thu 17 Aug     , Sergey Bylokhov wrote:
> > > Nobody mention respin of JDK 20u:
> > > https://github.com/openjdk/jdk20u/pull/87
> > > Does anybody plan to do it?
> > >
> > > On 8/17/23 10:31, Andrew Hughes wrote:
> > > > Yes, I've been tracking this since it was discussed in the vulnerability
> > > > group. I agree it is preferable to have a fix rather than resorting to
> > > > turning off a CVE fix.
> > > >
> > > > My main worry is not about backporting the fix, but in whether we can
> > > > squeeze in a respin. I'm glad to see the proposed fix has finally been
> > > > posted publicly, reviewed and integrated as of yesterday. It seems
> > > > to have taken a long time to get to that stage from the original VG
> > > > discussion.
> > > >
> > > > When we've done interim releases in the past, they have been within a
> > > > few weeks of the original release. With this release, we are already
> > > > at the point where we enter rampdown for the next release in < 2
> > > > weeks.
> > > >
> > > > I think we can still manage an interim release this time, but it
> > > > needs to happen within the next week, before people start to focus
> > > > on testing and adding security fixes to the October update.
> > > >
> > > > I'll go and review the 11u & 17u backports now. Note that there
> > > > are currently GHA failures with both, one down to the GCC versioning
> > > > we removed in 8u with https://bugs.openjdk.org/browse/JDK-8284772
> > >
> > > --
> > > Best regards, Sergey.
> > >
> >
> > We're not maintainers, Oracle are. I guess their efforts are now focused
> > on 21. They are aware of this and have apparently added it to 17.0.10-oracle
> > and 11.0.22-oracle already, and I see a request for 21 too [0]
> >
> > [0] https://bugs.openjdk.org/browse/JDK-
> 8313765?focusedCommentId=14604862&page=com.atlassian.jira.plugin.syste
> m.issuetabpanels:comment-tabpanel#comment-14604862
> >
> > Best regards,
> > --
> > Andrew :)
> > Pronouns: he / him or they / them
> > Principal Free Java Software Engineer
> > OpenJDK Package Owner
> > Red Hat, Inc.
> (http://www.re/
> dhat.com%2F&data=05%7C01%7Cgoetz.lindenmaier%40sap.com%7Cea1605b
> d5234423e4a7608dba2702388%7C42f7676cf455423c82f6dc2d99791af7%7C0
> %7C0%7C638282374731170501%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC
> 4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7
> C%7C%7C&sdata=uTOwVSxZZtb08DjX6lB6uUHOzUeHzRo145u3itNqCDc%3D&r
> eserved=0)
> >
> > PGP Key: ed25519/0xCFDA0F9B35964222 (hkp://keys.gnupg.net)
> > Fingerprint = 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222
> >
> > Please contact via e-mail, not proprietary chat networks
> > Available on Libera Chat & OFTC IRC networks as gnu_andrew