OpenJDK 8u272 Released

[Andrew Hughes]

On 23:38 Thu 22 Oct     , Langer, Christoph wrote:
> Hi,
> 
> > On 10/21/20 6:00 PM, Andrew Hughes wrote:
> > >>  From my point of view, the ideal workflow would be to push the changes
> > >> to the OpenJDK update repos right after the embargo was lifted. After
> > >> that anybody can use these repos as "golden master" and create source
> > >> bundles, binararies, etc from them. Or am I missing something?
> > >
> > > That might be better, but it would be a change for how we have done
> > > things for the last decade. As I say, the repos, source bundles and
> > > binary bundles all have different target audiences. I don't think it's
> > > correct to assume everyone who wants the new release is able to build
> > > their own from a repository.
> > 
> > I am reluctantly against pushing anything to the public repos without a
> > second (hopefully
> > non-involved) person looking at it. The rare exceptions are clean merges
> > from other public repos.
> > Human errors happen, and reviews help to catch them early before they
> > propagate. IMO, 8u and 11u
> > work is too important to take process shortcuts.
> 

> I think, for the CPU patches, the review ought to be done in the VG,
> prior to the release date. Then, when the embargo is lifted, the
> changes should be merged into the public repos. That's also what
> Oracle does for the short term releases (e.g. 15u). There is no
> public review, they're just merging their closed source tree with
> all build tags into the public repo.

Right. In that case, they've changed their process, because there did
used to be a post (e.g. [0]). Maybe we can move it inside the vulnerability
group, now that exists.

[0] https://mail.openjdk.java.net/pipermail/jdk8u-dev/2016-July/005719.html
-- 
Andrew :)

Senior Free Java Software Engineer
OpenJDK Package Owner
Red Hat, Inc. (http://www.redhat.com)

PGP Key: ed25519/0xCFDA0F9B35964222 (hkp://keys.gnupg.net)
Fingerprint = 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222