[IdPv3] Targeting Java 7

[Kaspar Brand]

On 24.10.2011 16:36, Chad La Joie wrote:
> On Mon, Oct 24, 2011 at 10:28, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> It should if the result is that the software becomes unsupported. If other
>> vendors are going to continue to maintain it, then it's not unsupported.

Supported by whom is what it really boils down to, yes. With OpenJDK
on Linux, it's the distribution vendors, not Oracle. Red Hat e.g. will
have to support Java 6 in RHEL 6 until November 2017
(cf. https://access.redhat.com/support/policy/updates/errata/). It seems
relatively unlikely to me that they would go from Java 6 to Java 7
sometime during the RHEL 6 lifecycle.

> At this point, OpenJDK is *the* JVM.  Oracle, Apple, and IBM have
> merged their efforts in to it.  Short of crap like gcj, there isn't
> anything else available.  I see no indication that any patches or
> security fixes will be made available once the EOL is reached.  If
> anyone can find anything to the contrary please be sure to post it
> here.

Assuming that Oracle keeps to its promises in the OpenJDK FAQ
(http://openjdk.java.net/faq/), I would expect that after July 2012,
they provide source code fixes for Java 7, at least. It is then the job
of Red Hat, Ubuntu et al. to backport fixes to the versions bundled with
their enterprise distributions (if not done by someone from the OpenJDK
project).

Having Java 5 or Java 6 a minimum requirement for the IdP v3 doesn't
prevent people from going to Java 7 for the IdP next year already, but
*requiring* Java 7 for v3 makes that step inevitable. That's what I
consider premature, as in most cases it means maintaining your JRE
separately from the base OS - clearly something you want to avoid when
it comes to (security-related) patch management.

Kaspar