[IdPv3] Targeting Java 7

[Chad La Joie]

On Tue, Oct 25, 2011 at 02:57, Kaspar Brand <kaspar.brand at switch.ch> wrote:
> On 24.10.2011 16:36, Chad La Joie wrote:
>> On Mon, Oct 24, 2011 at 10:28, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>> It should if the result is that the software becomes unsupported. If other
>>> vendors are going to continue to maintain it, then it's not unsupported.
>
> Supported by whom is what it really boils down to, yes. With OpenJDK
> on Linux, it's the distribution vendors, not Oracle. Red Hat e.g. will
> have to support Java 6 in RHEL 6 until November 2017
> (cf. https://access.redhat.com/support/policy/updates/errata/). It seems
> relatively unlikely to me that they would go from Java 6 to Java 7
> sometime during the RHEL 6 lifecycle.

I don't see anything on this page that suggests that RedHat will be
patching their release version of OpenJDK.

>> At this point, OpenJDK is *the* JVM.  Oracle, Apple, and IBM have
>> merged their efforts in to it.  Short of crap like gcj, there isn't
>> anything else available.  I see no indication that any patches or
>> security fixes will be made available once the EOL is reached.  If
>> anyone can find anything to the contrary please be sure to post it
>> here.
>
> Assuming that Oracle keeps to its promises in the OpenJDK FAQ
> (http://openjdk.java.net/faq/), I would expect that after July 2012,
> they provide source code fixes for Java 7, at least. It is then the job
> of Red Hat, Ubuntu et al. to backport fixes to the versions bundled with
> their enterprise distributions (if not done by someone from the OpenJDK
> project).

Do you have any indication they are actually planning for this?  I
haven't been able to find anything.

> Having Java 5 or Java 6 a minimum requirement for the IdP v3 doesn't
> prevent people from going to Java 7 for the IdP next year already, but
> *requiring* Java 7 for v3 makes that step inevitable. That's what I
> consider premature, as in most cases it means maintaining your JRE
> separately from the base OS - clearly something you want to avoid when
> it comes to (security-related) patch management.

Yes, we do want to avoid issues in this area.  However, targeting an
EoL platform where the provider clearly says it will NOT be providing
support (except through their for-pay "enterprise" support thing) and
with no indication from distribution providers that they'll track and
patch their builds of OpenJDK, seems far more questionable than
targeting a supported platform.