[8u] TLS 1.3: fallback scheme for the new SunJSSE engine

[Martin Balao]

Hi Andrew,

On 6/7/20 2:21 PM, Andrew Hughes wrote:
> 
> I don't think this is feasible. It seems to assume that the only change
> in 8u272 will be the TLS 1.3 engine. The reality is that the period from
> now until rampdown will be a mix of TLS 1.3 patches interleaved with
> other backports, so one would have to cherry-pick out all the non-TLS
> work and reapply it somewhere else.

That's a valid point. It might be the case that the TLS engine cannot be
plugged-in/out easily because of dependencies with other patches pushed
for the release. My understanding, though, is that the risk is not that
high because the TLS engine is pretty much self-contained within
sun/security/ssl boundaries. Perhaps certificate validation or a couple
of things related to Security providers are the weakest fronts.

Note: we should integrate as soon as possible to minimize risk by having
enough time to test and to avoid last minute rebasing of the TLS 1.3
series of patches -which may even cascade between steps and cause a lot
of rework-. Also because there are quite a few patches that went to
11.0.8 (instead of 11.0.7 or before) which are currently blocked and we
need to independently backport for October's CPU.

> 
> My suggestion would be to follow the JFR route:
> 
> 1. Now: Setup a TLS incubator tree and apply the patches there.
> 
> 2. Monday, August 24th, 2020: Decide whether to merge the incubator tree
> into 8u-dev before rampdown on Friday, 28th.
> 
> 3. Assuming it is integrated, test TLS 1.3 in 8u272 during September.
> 
> The benefits of this are:
> 
> 1. You can handle the commit policy for the incubator (just reviews, no
> need for individual approvals)
> 
> 2. One single approval can be used to merge TLS 1.3 in rampdown week.
> 
> 3. Merging just before rampdown makes your proposal feasible, assuming
> low traffic during rampdown.

I'm okay with this approach.

Thanks,
Martin.-